From 816a5debe82d0a8b3ebc321c633504672aa377a7 Mon Sep 17 00:00:00 2001 From: Vaibhav Date: Thu, 22 Jul 2021 18:54:41 +0530 Subject: [PATCH 001/148] Remove the duplicate content from access-cluster.md --- .../access-cluster.md | 111 +----------------- .../access-cluster-services.md | 13 +- 2 files changed, 14 insertions(+), 110 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/access-cluster.md b/content/en/docs/tasks/access-application-cluster/access-cluster.md index 23d4f133a6..b50dee5dcc 100644 --- a/content/en/docs/tasks/access-application-cluster/access-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/access-cluster.md @@ -214,115 +214,8 @@ In each case, the credentials of the pod are used to communicate securely with t ## Accessing services running on the cluster -The previous section was about connecting the Kubernetes API server. This section is about -connecting to other services running on Kubernetes cluster. In Kubernetes, the -[nodes](/docs/concepts/architecture/nodes/), -[pods](/docs/concepts/workloads/pods/) and -[services](/docs/concepts/services-networking/service/) all have -their own IPs. In many cases, the node IPs, pod IPs, and some service IPs on a cluster will not be -routable, so they will not be reachable from a machine outside the cluster, -such as your desktop machine. - -### Ways to connect - -You have several options for connecting to nodes, pods and services from outside the cluster: - - - Access services through public IPs. - - Use a service with type `NodePort` or `LoadBalancer` to make the service reachable outside - the cluster. See the [services](/docs/concepts/services-networking/service/) and - [kubectl expose](/docs/reference/generated/kubectl/kubectl-commands/#expose) documentation. - - Depending on your cluster environment, this may only expose the service to your corporate network, - or it may expose it to the internet. Think about whether the service being exposed is secure. - Does it do its own authentication? - - Place pods behind services. To access one specific pod from a set of replicas, such as for debugging, - place a unique label on the pod and create a new service which selects this label. - - In most cases, it should not be necessary for application developer to directly access - nodes via their nodeIPs. - - Access services, nodes, or pods using the Proxy Verb. - - Does apiserver authentication and authorization prior to accessing the remote service. - Use this if the services are not secure enough to expose to the internet, or to gain - access to ports on the node IP, or for debugging. - - Proxies may cause problems for some web applications. - - Only works for HTTP/HTTPS. - - Described [here](#manually-constructing-apiserver-proxy-urls). - - Access from a node or pod in the cluster. - - Run a pod, and then connect to a shell in it using [kubectl exec](/docs/reference/generated/kubectl/kubectl-commands/#exec). - Connect to other nodes, pods, and services from that shell. - - Some clusters may allow you to ssh to a node in the cluster. From there you may be able to - access cluster services. This is a non-standard method, and will work on some clusters but - not others. Browsers and other tools may or may not be installed. Cluster DNS may not work. - -### Discovering builtin services - -Typically, there are several services which are started on a cluster by kube-system. Get a list of these -with the `kubectl cluster-info` command: - -```shell -kubectl cluster-info -``` - -The output is similar to this: - -``` -Kubernetes master is running at https://104.197.5.247 -elasticsearch-logging is running at https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy -kibana-logging is running at https://104.197.5.247/api/v1/namespaces/kube-system/services/kibana-logging/proxy -kube-dns is running at https://104.197.5.247/api/v1/namespaces/kube-system/services/kube-dns/proxy -grafana is running at https://104.197.5.247/api/v1/namespaces/kube-system/services/monitoring-grafana/proxy -heapster is running at https://104.197.5.247/api/v1/namespaces/kube-system/services/monitoring-heapster/proxy -``` - -This shows the proxy-verb URL for accessing each service. -For example, this cluster has cluster-level logging enabled (using Elasticsearch), which can be reached -at `https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/` if suitable credentials are passed. Logging can also be reached through a kubectl proxy, for example at: -`http://localhost:8080/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/`. -(See [Access Clusters Using the Kubernetes API](/docs/tasks/administer-cluster/access-cluster-api/) for how to pass credentials or use kubectl proxy.) - -#### Manually constructing apiserver proxy URLs - -As mentioned above, you use the `kubectl cluster-info` command to retrieve the service's proxy URL. To create proxy URLs that include service endpoints, suffixes, and parameters, you append to the service's proxy URL: -`http://`*`kubernetes_master_address`*`/api/v1/namespaces/`*`namespace_name`*`/services/`*`service_name[:port_name]`*`/proxy` - -If you haven't specified a name for your port, you don't have to specify *port_name* in the URL. You can also use the port number in place of the *port_name* for both named and unnamed ports. - -By default, the API server proxies to your service using http. To use https, prefix the service name with `https:`: -`http://`*`kubernetes_master_address`*`/api/v1/namespaces/`*`namespace_name`*`/services/`*`https:service_name:[port_name]`*`/proxy` - -The supported formats for the name segment of the URL are: - -* `` - proxies to the default or unnamed port using http -* `:` - proxies to the specified port name or port number using http -* `https::` - proxies to the default or unnamed port using https (note the trailing colon) -* `https::` - proxies to the specified port name or port number using https - -##### Examples - - * To access the Elasticsearch service endpoint `_search?q=user:kimchy`, you would use: `http://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_search?q=user:kimchy` - * To access the Elasticsearch cluster health information `_cluster/health?pretty=true`, you would use: `https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/_cluster/health?pretty=true` - -```json -{ - "cluster_name" : "kubernetes_logging", - "status" : "yellow", - "timed_out" : false, - "number_of_nodes" : 1, - "number_of_data_nodes" : 1, - "active_primary_shards" : 5, - "active_shards" : 5, - "relocating_shards" : 0, - "initializing_shards" : 0, - "unassigned_shards" : 5 -} -``` - -### Using web browsers to access services running on the cluster - -You may be able to put an apiserver proxy url into the address bar of a browser. However: - - - Web browsers cannot usually pass tokens, so you may need to use basic (password) auth. Apiserver can be configured to accept basic auth, - but your cluster may not be configured to accept basic auth. - - Some web apps may not work, particularly those with client side javascript that construct urls in a - way that is unaware of the proxy path prefix. +The previous section was about connecting the Kubernetes API server. [This section](/docs/tasks/access-application-cluster/access-cluster/) is about +connecting to other services running on Kubernetes cluster. ## Requesting redirects diff --git a/content/en/docs/tasks/administer-cluster/access-cluster-services.md b/content/en/docs/tasks/administer-cluster/access-cluster-services.md index 927e05b77a..acce12bf5d 100644 --- a/content/en/docs/tasks/administer-cluster/access-cluster-services.md +++ b/content/en/docs/tasks/administer-cluster/access-cluster-services.md @@ -86,7 +86,18 @@ See [Access Clusters Using the Kubernetes API](/docs/tasks/administer-cluster/ac As mentioned above, you use the `kubectl cluster-info` command to retrieve the service's proxy URL. To create proxy URLs that include service endpoints, suffixes, and parameters, you append to the service's proxy URL: `http://`*`kubernetes_master_address`*`/api/v1/namespaces/`*`namespace_name`*`/services/`*`[https:]service_name[:port_name]`*`/proxy` -If you haven't specified a name for your port, you don't have to specify *port_name* in the URL. +If you haven't specified a name for your port, you don't have to specify *port_name* in the URL. You can also use the port number in place of the *port_name* for both named and unnamed ports. + +By default, the API server proxies to your service using http. To use https, prefix the service name with `https:`: +`http://`*`kubernetes_master_address`*`/api/v1/namespaces/`*`namespace_name`*`/services/`*`https:service_name:[port_name]`*`/proxy` + +The supported formats for the name segment of the URL are: + +* `` - proxies to the default or unnamed port using http +* `:` - proxies to the specified port name or port number using http +* `https::` - proxies to the default or unnamed port using https (note the trailing colon) +* `https::` - proxies to the specified port name or port number using https + ##### Examples From 03dea1a56f699f38bba6fbb2b6ee0d10fbfe421d Mon Sep 17 00:00:00 2001 From: Vaibhav Date: Mon, 26 Jul 2021 13:54:44 +0530 Subject: [PATCH 002/148] Update the changes in access-cluster-services.md --- .../tasks/administer-cluster/access-cluster-services.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/access-cluster-services.md b/content/en/docs/tasks/administer-cluster/access-cluster-services.md index acce12bf5d..262071094c 100644 --- a/content/en/docs/tasks/administer-cluster/access-cluster-services.md +++ b/content/en/docs/tasks/administer-cluster/access-cluster-services.md @@ -88,10 +88,10 @@ As mentioned above, you use the `kubectl cluster-info` command to retrieve the s If you haven't specified a name for your port, you don't have to specify *port_name* in the URL. You can also use the port number in place of the *port_name* for both named and unnamed ports. -By default, the API server proxies to your service using http. To use https, prefix the service name with `https:`: -`http://`*`kubernetes_master_address`*`/api/v1/namespaces/`*`namespace_name`*`/services/`*`https:service_name:[port_name]`*`/proxy` +By default, the API server proxies to your service using HTTP. To use HTTPS, prefix the service name with `https:`: +`http:///api/v1/namespaces//services//proxy` -The supported formats for the name segment of the URL are: +The supported formats for the `` segment of the URL are: * `` - proxies to the default or unnamed port using http * `:` - proxies to the specified port name or port number using http From eca82e08f9cafadefe534a6b417b7c6a5c7b4136 Mon Sep 17 00:00:00 2001 From: Simone Tiraboschi Date: Thu, 29 Jul 2021 13:42:46 +0200 Subject: [PATCH 003/148] Concretely explain how to patch CRD status Current documentation simply suggest "Remove v1beta1 from the CustomResourceDefinition status.storedVersions field." but this cannot be done just with kubectl and it's not so intuitive. Adding an example to make it more clear. Signed-off-by: Simone Tiraboschi --- .../custom-resource-definition-versioning.md | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning.md b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning.md index 05e60449c4..b1f283000d 100644 --- a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning.md +++ b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning.md @@ -1038,8 +1038,8 @@ procedure. *Option 1:* Use the Storage Version Migrator -1. Run the [storage Version migrator](https://github.com/kubernetes-sigs/kube-storage-version-migrator) -2. Remove the old version from the CustomResourceDefinition `status.storedVersions` field. +1. Run the [storage Version migrator](https://github.com/kubernetes-sigs/kube-storage-version-migrator) +2. Remove the old version from the CustomResourceDefinition `status.storedVersions` field. *Option 2:* Manually upgrade the existing objects to a new stored version @@ -1050,6 +1050,16 @@ The following is an example procedure to upgrade from `v1beta1` to `v1`. 2. Write an upgrade procedure to list all existing objects and write them with the same content. This forces the backend to write objects in the current storage version, which is `v1`. -2. Remove `v1beta1` from the CustomResourceDefinition `status.storedVersions` field. +3. Remove `v1beta1` from the CustomResourceDefinition `status.storedVersions` field. +{{< note >}} +The `kubectl` tool currently cannot be used to edit or patch the `status` subresource on a CRD: see the [Kubectl Subresource Support KEP](https://github.com/kubernetes/enhancements/tree/master/keps/sig-cli/2590-kubectl-subresource) for more details. +The easier way to patch the status subresource from the CLI is directly interacting with the API server using the `curl` tool, in this example: +```bash +kubectl proxy & +curl --header "Content-Type: application/json-patch+json" \ + --request PATCH http://localhost:8001/apis/apiextensions.k8s.io/v1/customresourcedefinitions//status \ + --data '[{"op": "replace", "path": "/status/storedVersions", "value":["v1"]}]' +``` +{{< /note >}} From 703f8b92f514fd6f84ff8b3e6c577e80f640dfdb Mon Sep 17 00:00:00 2001 From: Victor Palade Date: Thu, 5 Aug 2021 01:06:02 +0200 Subject: [PATCH 004/148] Tracking commit for v1.23 docs From 5f192f2cb1df5b15aa1574efd565867815c3073e Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Tue, 17 Aug 2021 09:51:11 +0200 Subject: [PATCH 005/148] Add note about deprecated seccomp annotation We now add a note to clarify that the annotations are deprecated and will become non-functional in v1.25. Signed-off-by: Sascha Grunert --- .../docs/reference/labels-annotations-taints.md | 8 +++++++- content/en/docs/tutorials/clusters/seccomp.md | 16 ++++++++++++---- 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/content/en/docs/reference/labels-annotations-taints.md b/content/en/docs/reference/labels-annotations-taints.md index 07e6d19426..e2fc2b317e 100644 --- a/content/en/docs/reference/labels-annotations-taints.md +++ b/content/en/docs/reference/labels-annotations-taints.md @@ -425,4 +425,10 @@ policies to apply when validating a submitted Pod. Note that warnings are also d or updating objects that contain Pod templates, such as Deployments, Jobs, StatefulSets, etc. See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) -for more information. \ No newline at end of file +for more information. + +## seccomp.security.alpha.kubernetes.io/pod and container.seccomp.security.alpha.kubernetes.io/[NAME] (deprecated) + +The seccomp annotations have been deprecated since Kubernetes v1.19 and will +become non-functional in v1.25. Please use the `seccompProfile` of the +`SecurityContext` instead. \ No newline at end of file diff --git a/content/en/docs/tutorials/clusters/seccomp.md b/content/en/docs/tutorials/clusters/seccomp.md index c510f4c707..ce16eb524a 100644 --- a/content/en/docs/tutorials/clusters/seccomp.md +++ b/content/en/docs/tutorials/clusters/seccomp.md @@ -170,12 +170,20 @@ Download the correct manifest for your Kubernetes version: {{< tab name="v1.19 or Later (GA)" >}} {{< codenew file="pods/security/seccomp/ga/audit-pod.yaml" >}} {{< /tab >}}} -{{{< tab name="Pre-v1.19 (alpha)" >}} +{{{< tab name="Pre-v1.19 (deprecated)" >}} {{< codenew file="pods/security/seccomp/alpha/audit-pod.yaml" >}} {{< /tab >}} {{< /tabs >}}
+{{< note >}} +The functional support for the already deprecated seccomp annotations +`seccomp.security.alpha.kubernetes.io/pod` (for the whole pod) and +`container.seccomp.security.alpha.kubernetes.io/[name]` (for a single container) +is going to be removed with the release of Kubernetes v1.25. Please always use +the native API fields in favor of the annotations. +{{< /note >}} + Create the Pod in the cluster: ``` @@ -270,7 +278,7 @@ Download the correct manifest for your Kubernetes version: {{< tab name="v1.19 or Later (GA)" >}} {{< codenew file="pods/security/seccomp/ga/violation-pod.yaml" >}} {{< /tab >}}} -{{{< tab name="Pre-v1.19 (alpha)" >}} +{{{< tab name="Pre-v1.19 (deprecated)" >}} {{< codenew file="pods/security/seccomp/alpha/violation-pod.yaml" >}} {{< /tab >}} {{< /tabs >}} @@ -321,7 +329,7 @@ Download the correct manifest for your Kubernetes version: {{< tab name="v1.19 or Later (GA)" >}} {{< codenew file="pods/security/seccomp/ga/fine-pod.yaml" >}} {{< /tab >}}} -{{{< tab name="Pre-v1.19 (alpha)" >}} +{{{< tab name="Pre-v1.19 (deprecated)" >}} {{< codenew file="pods/security/seccomp/alpha/fine-pod.yaml" >}} {{< /tab >}} {{< /tabs >}} @@ -403,7 +411,7 @@ Download the correct manifest for your Kubernetes version: {{< tab name="v1.19 or Later (GA)" >}} {{< codenew file="pods/security/seccomp/ga/default-pod.yaml" >}} {{< /tab >}}} -{{{< tab name="Pre-v1.19 (alpha)" >}} +{{{< tab name="Pre-v1.19 (deprecated)" >}} {{< codenew file="pods/security/seccomp/alpha/default-pod.yaml" >}} {{< /tab >}} {{< /tabs >}} From 5db769d46c22d1b05b0ca73ac4af10a9ebdbb2e4 Mon Sep 17 00:00:00 2001 From: Jesse Butler Date: Thu, 9 Sep 2021 08:52:52 -0400 Subject: [PATCH 006/148] update config.toml for 1.23 release --- config.toml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/config.toml b/config.toml index c8953f2f7d..7c7f88a4e6 100644 --- a/config.toml +++ b/config.toml @@ -138,10 +138,10 @@ time_format_default = "January 02, 2006 at 3:04 PM PST" description = "Production-Grade Container Orchestration" showedit = true -latest = "v1.22" +latest = "v1.23" -fullversion = "v1.22.0" -version = "v1.22" +fullversion = "v1.23.0" +version = "v1.23" githubbranch = "main" docsbranch = "main" deprecated = false @@ -178,12 +178,19 @@ js = [ ] [[params.versions]] -fullversion = "v1.22.0" -version = "v1.22" -githubbranch = "v1.22.0" +fullversion = "v1.23.0" +version = "v1.23" +githubbranch = "v1.23.0" docsbranch = "main" url = "https://kubernetes.io" +[[params.versions]] +fullversion = "v1.22.1" +version = "v1.22" +githubbranch = "v1.22.1" +docsbranch = "release-1.22" +url = "https://v1-22.docs.kubernetes.io" + [[params.versions]] fullversion = "v1.21.4" version = "v1.21" @@ -205,13 +212,6 @@ githubbranch = "v1.19.14" docsbranch = "release-1.19" url = "https://v1-19.docs.kubernetes.io" -[[params.versions]] -fullversion = "v1.18.20" -version = "v1.18" -githubbranch = "v1.18.20" -docsbranch = "release-1.18" -url = "https://v1-18.docs.kubernetes.io" - # User interface configuration [params.ui] # Enable to show the side bar menu in its compact state. From a886ec620c999eb6b9942e144d41c18c5162cfbd Mon Sep 17 00:00:00 2001 From: Abhibhaw Date: Fri, 10 Sep 2021 15:34:35 +0530 Subject: [PATCH 007/148] feat: Documents effects on secrets when memory swap is enabled --- content/en/docs/concepts/architecture/nodes.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/en/docs/concepts/architecture/nodes.md b/content/en/docs/concepts/architecture/nodes.md index 1d4f6455b7..80d1ed6283 100644 --- a/content/en/docs/concepts/architecture/nodes.md +++ b/content/en/docs/concepts/architecture/nodes.md @@ -435,6 +435,8 @@ the kubelet, and the `--fail-swap-on` command line flag or `failSwapOn` [configuration setting](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) must be set to false. +{{< warning >}}When memory swap feature is turned on, kubernetes features that were written to tmps could be swapped to write to disk.{{< /warning >}} + A user can also optionally configure `memorySwap.swapBehavior` in order to specify how a node will use swap memory. For example, From c189c2d162e5e283272551aca2e43130bd654054 Mon Sep 17 00:00:00 2001 From: Zovin Khanmohammed Date: Sun, 12 Sep 2021 04:56:06 -0500 Subject: [PATCH 008/148] Update docs to reflect newly support shells with autocompletions (#29610) * Update docs to reflect newly support shells with autocompletions * Update Windows docs to use Powershell instead of zsh * Adds a bit more explanation of the different lines. * Apply suggestions from code review Co-authored-by: Tim Bannister * Apply PR suggestions Co-authored-by: Tim Bannister --- .../included/optional-kubectl-configs-pwsh.md | 23 +++++++++++++++++++ .../docs/tasks/tools/install-kubectl-linux.md | 2 +- .../docs/tasks/tools/install-kubectl-macos.md | 2 +- .../tasks/tools/install-kubectl-windows.md | 7 +++--- 4 files changed, 28 insertions(+), 6 deletions(-) create mode 100644 content/en/docs/tasks/tools/included/optional-kubectl-configs-pwsh.md diff --git a/content/en/docs/tasks/tools/included/optional-kubectl-configs-pwsh.md b/content/en/docs/tasks/tools/included/optional-kubectl-configs-pwsh.md new file mode 100644 index 0000000000..12e5d60c5d --- /dev/null +++ b/content/en/docs/tasks/tools/included/optional-kubectl-configs-pwsh.md @@ -0,0 +1,23 @@ +--- +title: "PowerShell auto-completion" +description: "Some optional configuration for powershell auto-completion." +headless: true +--- + +The kubectl completion script for PowerShell can be generated with the command `kubectl completion powershell`. + +To do so in all your shell sessions, add the following line to your `$PROFILE` file: + +```powershell +kubectl completion powershell | Out-String | Invoke-Expression +``` + +This command will regenerate the auto-completion script on every PowerShell start up. You can also add the generated script directly to your `$PROFILE` file. + +To add the generated script to your `$PROFILE` file, run the following line in your powershell prompt: + +```powershell +kubectl completion powershell >> $PROFILE +``` + +After reloading your shell, kubectl autocompletion should be working. diff --git a/content/en/docs/tasks/tools/install-kubectl-linux.md b/content/en/docs/tasks/tools/install-kubectl-linux.md index efb203f8b9..3b48ce6790 100644 --- a/content/en/docs/tasks/tools/install-kubectl-linux.md +++ b/content/en/docs/tasks/tools/install-kubectl-linux.md @@ -176,7 +176,7 @@ kubectl version --client ### Enable shell autocompletion -kubectl provides autocompletion support for Bash and Zsh, which can save you a lot of typing. +kubectl provides autocompletion support for Bash, Zsh, Fish, and PowerShell, which can save you a lot of typing. Below are the procedures to set up autocompletion for Bash and Zsh. diff --git a/content/en/docs/tasks/tools/install-kubectl-macos.md b/content/en/docs/tasks/tools/install-kubectl-macos.md index b46ab03640..f2f7cf1a9c 100644 --- a/content/en/docs/tasks/tools/install-kubectl-macos.md +++ b/content/en/docs/tasks/tools/install-kubectl-macos.md @@ -159,7 +159,7 @@ If you are on macOS and using [Macports](https://macports.org/) package manager, ### Enable shell autocompletion -kubectl provides autocompletion support for Bash and Zsh, which can save you a lot of typing. +kubectl provides autocompletion support for Bash, Zsh, Fish, and PowerShell which can save you a lot of typing. Below are the procedures to set up autocompletion for Bash and Zsh. diff --git a/content/en/docs/tasks/tools/install-kubectl-windows.md b/content/en/docs/tasks/tools/install-kubectl-windows.md index 8059fa7a3a..2417d1a3c4 100644 --- a/content/en/docs/tasks/tools/install-kubectl-windows.md +++ b/content/en/docs/tasks/tools/install-kubectl-windows.md @@ -22,7 +22,6 @@ The following methods exist for installing kubectl on Windows: - [Install kubectl binary with curl on Windows](#install-kubectl-binary-with-curl-on-windows) - [Install on Windows using Chocolatey or Scoop](#install-on-windows-using-chocolatey-or-scoop) - ### Install kubectl binary with curl on Windows 1. Download the [latest release {{< param "fullversion" >}}](https://dl.k8s.io/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe). @@ -134,11 +133,11 @@ Edit the config file with a text editor of your choice, such as Notepad. ### Enable shell autocompletion -kubectl provides autocompletion support for Bash and Zsh, which can save you a lot of typing. +kubectl provides autocompletion support for Bash, Zsh, Fish, and PowerShell, which can save you a lot of typing. -Below are the procedures to set up autocompletion for Zsh, if you are running that on Windows. +Below are the procedures to set up autocompletion for PowerShell. -{{< include "included/optional-kubectl-configs-zsh.md" >}} +{{< include "included/optional-kubectl-configs-pwsh.md" >}} ### Install `kubectl convert` plugin From 56342b7ed6d34dbdb041cfa2de4a304ca54ca6a3 Mon Sep 17 00:00:00 2001 From: Romain Guichard Date: Mon, 13 Sep 2021 14:50:05 +0200 Subject: [PATCH 009/148] fix: RWX access mode is about nodes, not pods --- .../_posts/2021-09-13-read-write-once-pod-access-mode-alpha.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2021-09-13-read-write-once-pod-access-mode-alpha.md b/content/en/blog/_posts/2021-09-13-read-write-once-pod-access-mode-alpha.md index c04df56284..e569c7a015 100644 --- a/content/en/blog/_posts/2021-09-13-read-write-once-pod-access-mode-alpha.md +++ b/content/en/blog/_posts/2021-09-13-read-write-once-pod-access-mode-alpha.md @@ -28,7 +28,7 @@ metadata: name: shared-cache spec: accessModes: - - ReadWriteMany # Allow many pods to access shared-cache simultaneously. + - ReadWriteMany # Allow many nodes to access shared-cache simultaneously. resources: requests: storage: 1Gi From f9d5ab06279561b61dd23d08af9bb077717ffd16 Mon Sep 17 00:00:00 2001 From: Jonas Steinberg Date: Wed, 15 Sep 2021 09:29:37 -0500 Subject: [PATCH 010/148] add 'the' to 'without restarting [the] API server' from Static Token File section smol. --- content/en/docs/reference/access-authn-authz/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index 70d416af60..b1e51f55c5 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -104,7 +104,7 @@ See [Managing Certificates](/docs/tasks/administer-cluster/certificates/) for ho ### Static Token File The API server reads bearer tokens from a file when given the `--token-auth-file=SOMEFILE` option on the command line. Currently, tokens last indefinitely, and the token list cannot be -changed without restarting API server. +changed without restarting the API server. The token file is a csv file with a minimum of 3 columns: token, user name, user uid, followed by optional group names. From 8bc94886226564a33484ec2d168623c30f25c042 Mon Sep 17 00:00:00 2001 From: Abhibhaw Asthana <39991296+abhibhaw@users.noreply.github.com> Date: Sat, 25 Sep 2021 01:50:09 +0530 Subject: [PATCH 011/148] Adds suggested changes to #29663 Co-authored-by: Qiming Teng --- content/en/docs/concepts/architecture/nodes.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/content/en/docs/concepts/architecture/nodes.md b/content/en/docs/concepts/architecture/nodes.md index 80d1ed6283..25cec18bbe 100644 --- a/content/en/docs/concepts/architecture/nodes.md +++ b/content/en/docs/concepts/architecture/nodes.md @@ -435,7 +435,10 @@ the kubelet, and the `--fail-swap-on` command line flag or `failSwapOn` [configuration setting](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) must be set to false. -{{< warning >}}When memory swap feature is turned on, kubernetes features that were written to tmps could be swapped to write to disk.{{< /warning >}} +{{< warning >}} +When the memory swap feature is turned on, Kubernetes data such as the content +of Secret objects that were written to tmpfs now could be swapped to disk. +{{< /warning >}} A user can also optionally configure `memorySwap.swapBehavior` in order to specify how a node will use swap memory. For example, From 39d087088200cfd58b2a05d962fe868eb80e6a82 Mon Sep 17 00:00:00 2001 From: Paco Xu Date: Tue, 28 Sep 2021 14:46:25 +0800 Subject: [PATCH 012/148] Add safe sysctl net.ipv4.ip_unprivileged_port_start https://github.com/kubernetes/kubernetes/pull/103326 --- content/en/docs/tasks/administer-cluster/sysctl-cluster.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/tasks/administer-cluster/sysctl-cluster.md b/content/en/docs/tasks/administer-cluster/sysctl-cluster.md index f81623982f..910ee9a817 100644 --- a/content/en/docs/tasks/administer-cluster/sysctl-cluster.md +++ b/content/en/docs/tasks/administer-cluster/sysctl-cluster.md @@ -60,6 +60,7 @@ The following sysctls are supported in the _safe_ set: - `net.ipv4.ip_local_port_range`, - `net.ipv4.tcp_syncookies`, - `net.ipv4.ping_group_range` (since Kubernetes 1.18). +- `net.ipv4.ip_unprivileged_port_start` (since Kubernetes 1.22). {{< note >}} The example `net.ipv4.tcp_syncookies` is not namespaced on Linux kernel version 4.4 or lower. From 5f6c6877bbb52765dadddf896e586df42dc6c628 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Sun, 3 Oct 2021 16:33:15 +0100 Subject: [PATCH 013/148] Fix gradient background rendering for announcements When an announcement uses a gradient background, the inherited background looks wrong. Instead, make the child element's background transparent. --- assets/scss/_custom.scss | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assets/scss/_custom.scss b/assets/scss/_custom.scss index 7d6aa6784f..cb403e3c33 100644 --- a/assets/scss/_custom.scss +++ b/assets/scss/_custom.scss @@ -585,7 +585,7 @@ body.td-documentation { #announcement, #fp-announcement { > * { color: inherit; - background: inherit; + background: transparent; } a { From 95321d0a77ea959c205cec89f196b24e8b0afdd2 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Sun, 3 Oct 2021 17:20:37 +0100 Subject: [PATCH 014/148] Fix logic for setting cid-* classes Only set a cid-* class on the body element if the value won't actually be "cid-". --- layouts/_default/baseof.html | 2 +- layouts/_default/search.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/layouts/_default/baseof.html b/layouts/_default/baseof.html index 612bddbb2c..034a59cd96 100644 --- a/layouts/_default/baseof.html +++ b/layouts/_default/baseof.html @@ -3,7 +3,7 @@ {{ partial "head.html" . }} - +
{{ partial "navbar.html" . }}
diff --git a/layouts/_default/search.html b/layouts/_default/search.html index 286e476de1..301e3da146 100644 --- a/layouts/_default/search.html +++ b/layouts/_default/search.html @@ -3,7 +3,7 @@ {{ partial "head.html" . }} - +
{{ partial "navbar.html" . }}
From 7122c5115254194c74e6136dca49616581a90390 Mon Sep 17 00:00:00 2001 From: Mike Spreitzer Date: Thu, 7 Oct 2021 15:58:56 -0700 Subject: [PATCH 015/148] Improve API Priority and Fairness for clients --- .../en/docs/concepts/cluster-administration/flow-control.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/en/docs/concepts/cluster-administration/flow-control.md b/content/en/docs/concepts/cluster-administration/flow-control.md index 71eb8106e5..4a6f815aad 100644 --- a/content/en/docs/concepts/cluster-administration/flow-control.md +++ b/content/en/docs/concepts/cluster-administration/flow-control.md @@ -26,6 +26,10 @@ fair queuing technique so that, for example, a poorly-behaved {{< glossary_tooltip text="controller" term_id="controller" >}} need not starve others (even at the same priority level). +This feature is designed to work well with standard controllers, which +use informers and react to failures of API requests with exponential +back-off, and other clients that also work this way. + {{< caution >}} Requests classified as "long-running" — primarily watches — are not subject to the API Priority and Fairness filter. This is also true for @@ -101,6 +105,8 @@ name of the matching FlowSchema plus a _flow distinguisher_ — which is either the requesting user, the target resource's namespace, or nothing — and the system attempts to give approximately equal weight to requests in different flows of the same priority level. +To enable distinct handling of distinct instances, controllers that have +many instances should authenticate with distinct usernames After classifying a request into a flow, the API Priority and Fairness feature then may assign the request to a queue. This assignment uses From 31e44b5774d739e4dd45838d0d6fba2dd02e08a0 Mon Sep 17 00:00:00 2001 From: Mauren Berti Date: Fri, 8 Oct 2021 14:03:40 -0400 Subject: [PATCH 016/148] Clarify secret encryption in the glossary. - Add a sentence clarifying that secrets are not encrypted by default. --- content/en/docs/reference/glossary/secret.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/glossary/secret.md b/content/en/docs/reference/glossary/secret.md index 48088bbf9c..281b8b7b65 100644 --- a/content/en/docs/reference/glossary/secret.md +++ b/content/en/docs/reference/glossary/secret.md @@ -15,4 +15,4 @@ tags: -Allows for more control over how sensitive information is used and reduces the risk of accidental exposure, including [encryption](/docs/tasks/administer-cluster/encrypt-data/#ensure-all-secrets-are-encrypted) at rest. A {{< glossary_tooltip text="Pod" term_id="pod" >}} references the secret as a file in a volume mount or by the kubelet pulling images for a pod. Secrets are great for confidential data and [ConfigMaps](/docs/tasks/configure-pod-container/configure-pod-configmap/) for non-confidential data. +Allows for more control over how sensitive information is used and reduces the risk of accidental exposure. Secret values are encoded as base64 strings and stored unencrypted by default, but can be configured to be [encrypted at rest](/docs/tasks/administer-cluster/encrypt-data/#ensure-all-secrets-are-encrypted). A {{< glossary_tooltip text="Pod" term_id="pod" >}} references the secret as a file in a volume mount or by the kubelet pulling images for a pod. Secrets are great for confidential data and [ConfigMaps](/docs/tasks/configure-pod-container/configure-pod-configmap/) for non-confidential data. From dae1b392e6377f7e8c83863df86a75bf5e3cd92f Mon Sep 17 00:00:00 2001 From: siddhantprateek Date: Mon, 11 Oct 2021 18:32:45 +0530 Subject: [PATCH 017/148] replaced link from api-beta2 to api-beta3 Signed-off-by: siddhantprateek --- content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md index 3779ec2fdf..60abb96e56 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md +++ b/content/en/docs/reference/setup-tools/kubeadm/kubeadm-init.md @@ -127,7 +127,7 @@ If your configuration is not using the latest version it is **recommended** that the [kubeadm config migrate](/docs/reference/setup-tools/kubeadm/kubeadm-config/) command. For more information on the fields and usage of the configuration you can navigate to our -[API reference page](/docs/reference/config-api/kubeadm-config.v1beta2/). +[API reference page](/docs/reference/config-api/kubeadm-config.v1beta3/). ### Adding kube-proxy parameters {#kube-proxy} From bb634e6db9b439258dd5ec79c3a17f73a992f88c Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Sat, 16 Oct 2021 12:23:33 +0100 Subject: [PATCH 018/148] Revise seccomp tutorial - Drop docs for Kubernetes earlier than v1.19 - Have kubectl fetch manifests using HTTP where suitable - General tidying --- content/en/docs/tutorials/clusters/seccomp.md | 316 +++++++++--------- 1 file changed, 165 insertions(+), 151 deletions(-) diff --git a/content/en/docs/tutorials/clusters/seccomp.md b/content/en/docs/tutorials/clusters/seccomp.md index 3a883baf5e..af8cb9e2ef 100644 --- a/content/en/docs/tutorials/clusters/seccomp.md +++ b/content/en/docs/tutorials/clusters/seccomp.md @@ -36,16 +36,18 @@ profiles that give only the necessary privileges to your container processes. ## {{% heading "prerequisites" %}} -{{< version-check >}} - In order to complete all steps in this tutorial, you must install -[kind](https://kind.sigs.k8s.io/docs/user/quick-start/) and -[kubectl](/docs/tasks/tools/). This tutorial will show examples -both alpha (new in v1.22) and generally available seccomp functionality. You should -make sure that your cluster is [configured -correctly](https://kind.sigs.k8s.io/docs/user/quick-start/#setting-kubernetes-version) +[kind](/docs/tasks/tools/#kind) and [kubectl](/docs/tasks/tools/#kubectl). + +This tutorial shows some examples that are still alpha (since v1.22) and +others that use only generally available seccomp functionality. You should +make sure that your cluster is +[configured correctly](https://kind.sigs.k8s.io/docs/user/quick-start/#setting-kubernetes-version) for the version you are using. +The tutorial also uses the `curl` tool for downloading examples to your computer. +You can adapt the steps to use a different tool if you prefer. + {{< note >}} It is not possible to apply a seccomp profile to a container running with `privileged: true` set in the container's `securityContext`. Privileged containers always @@ -54,6 +56,107 @@ run as `Unconfined`. + +## Create Seccomp Profiles + +The contents of these profiles will be explored later on, but for now go ahead +and download them into a directory named `profiles/` so that they can be loaded +into the cluster. + +{{< tabs name="tab_with_code" >}} +{{{< tab name="audit.json" >}} +{{< codenew file="pods/security/seccomp/profiles/audit.json" >}} +{{< /tab >}} +{{< tab name="violation.json" >}} +{{< codenew file="pods/security/seccomp/profiles/violation.json" >}} +{{< /tab >}}} +{{< tab name="fine-grained.json" >}} +{{< codenew file="pods/security/seccomp/profiles/fine-grained.json" >}} +{{< /tab >}}} +{{< /tabs >}} + +Run these commands: + +```shell +mkdir ./profiles +curl -L -o profiles/audit.json https://k8s.io/examples/pods/security/seccomp/profiles/audit.json +curl -L -o profiles/violation.json https://k8s.io/examples/pods/security/seccomp/profiles/violation.json +curl -L -o profiles/fine-grained.json https://k8s.io/examples/pods/security/seccomp/profiles/fine-grained.json +ls profiles +``` + +You should see three profiles listed at the end of the final step: +``` +audit.json fine-grained.json violation.json +``` + + +## Create a Local Kubernetes Cluster with kind + + +For simplicity, [kind](https://kind.sigs.k8s.io/) can be used to create a single +node cluster with the seccomp profiles loaded. Kind runs Kubernetes in Docker, +so each node of the cluster is a container. This allows for files +to be mounted in the filesystem of each container similar to loading files +onto a node. + +{{< codenew file="pods/security/seccomp/kind.yaml" >}} + +Download that example kind configuration, and save it to a file named `kind.yaml`: +```shell +curl -L -O https://k8s.io/examples/pods/security/seccomp/kind.yaml +``` + +You can set a specific Kubernetes version by setting the node's container image. +See [Nodes](https://kind.sigs.k8s.io/docs/user/configuration/#nodes) within the +kind documentation about configuration for more details on this. +This tutorial assumes you are using Kubernetes {{< param "version" >}}. + +As an alpha feature, you can configure Kubernetes to use the profile that the +{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}} +prefers by default, rather than falling back to `Unconfined`. +If you want to try that, see +[enable the use of `RuntimeDefault` as the default seccomp profile for all workloads](#enable-the-use-of-runtimedefault-as-the-default-seccomp-profile-for-all-workloads) +before you continue. + +Once you have a kind configuration in place, create the kind cluster with +that configuration: + +```shell +kind create cluster --config=kind.yaml +``` + +After the new Kubernetes cluster is ready, identify the Docker container running +as the single node cluster: + +```shell +docker ps +``` + +You should see output indicating that a container is running with name +`kind-control-plane`. The output is similar to: + +``` +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +6a96207fed4b kindest/node:v1.18.2 "/usr/local/bin/entr…" 27 seconds ago Up 24 seconds 127.0.0.1:42223->6443/tcp kind-control-plane +``` + +If observing the filesystem of that container, you should see that the +`profiles/` directory has been successfully loaded into the default seccomp path +of the kubelet. Use `docker exec` to run a command in the Pod: + +```shell +# Change 6a96207fed4b to the container ID you saw from "docker ps" +docker exec -it 6a96207fed4b ls /var/lib/kubelet/seccomp/profiles +``` + +``` +audit.json fine-grained.json violation.json +``` + +You have verified that these seccomp profiles are available to the kubelet +running within kind. + ## Enable the use of `RuntimeDefault` as the default seccomp profile for all workloads {{< feature-state state="alpha" for_k8s_version="v1.22" >}} @@ -64,8 +167,8 @@ well as corresponding `--seccomp-default` [command line flag](/docs/reference/command-line-tools-reference/kubelet). Both have to be enabled simultaneously to use the feature. -If enabled, the kubelet will use the `RuntimeDefault` seccomp profile by default, which is -defined by the container runtime, instead of using the `Unconfined` (seccomp disabled) mode. +If enabled, the kubelet will use the `RuntimeDefault` seccomp profile by default, which is +defined by the container runtime, instead of using the `Unconfined` (seccomp disabled) mode. The default profiles aim to provide a strong set of security defaults while preserving the functionality of the workload. It is possible that the default profiles differ between container runtimes and their @@ -102,85 +205,14 @@ featureGates: SeccompDefault: true ``` -## Create Seccomp Profiles - -The contents of these profiles will be explored later on, but for now go ahead -and download them into a directory named `profiles/` so that they can be loaded -into the cluster. - -{{< tabs name="tab_with_code" >}} -{{{< tab name="audit.json" >}} -{{< codenew file="pods/security/seccomp/profiles/audit.json" >}} -{{< /tab >}} -{{< tab name="violation.json" >}} -{{< codenew file="pods/security/seccomp/profiles/violation.json" >}} -{{< /tab >}}} -{{< tab name="fine-grained.json" >}} -{{< codenew file="pods/security/seccomp/profiles/fine-grained.json" >}} -{{< /tab >}}} -{{< /tabs >}} - -## Create a Local Kubernetes Cluster with Kind - -For simplicity, [kind](https://kind.sigs.k8s.io/) can be used to create a single -node cluster with the seccomp profiles loaded. Kind runs Kubernetes in Docker, -so each node of the cluster is a container. This allows for files -to be mounted in the filesystem of each container similar to loading files -onto a node. - -{{< codenew file="pods/security/seccomp/kind.yaml" >}} -
- -Download the example above, and save it to a file named `kind.yaml`. Then create -the cluster with the configuration. - -``` -kind create cluster --config=kind.yaml -``` - -Once the cluster is ready, identify the container running as the single node -cluster: - -``` -docker ps -``` - -You should see output indicating that a container is running with name -`kind-control-plane`. - -``` -CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES -6a96207fed4b kindest/node:v1.18.2 "/usr/local/bin/entr…" 27 seconds ago Up 24 seconds 127.0.0.1:42223->6443/tcp kind-control-plane -``` - -If observing the filesystem of that container, one should see that the -`profiles/` directory has been successfully loaded into the default seccomp path -of the kubelet. Use `docker exec` to run a command in the Pod: - -``` -docker exec -it 6a96207fed4b ls /var/lib/kubelet/seccomp/profiles -``` - -``` -audit.json fine-grained.json violation.json -``` - ## Create a Pod with a seccomp profile for syscall auditing To start off, apply the `audit.json` profile, which will log all syscalls of the process, to a new Pod. -Download the correct manifest for your Kubernetes version: +Here's a manifest for that Pod: -{{< tabs name="audit_pods" >}} -{{< tab name="v1.19 or Later (GA)" >}} {{< codenew file="pods/security/seccomp/ga/audit-pod.yaml" >}} -{{< /tab >}}} -{{{< tab name="Pre-v1.19 (deprecated)" >}} -{{< codenew file="pods/security/seccomp/alpha/audit-pod.yaml" >}} -{{< /tab >}} -{{< /tabs >}} -
{{< note >}} The functional support for the already deprecated seccomp annotations @@ -192,14 +224,14 @@ the native API fields in favor of the annotations. Create the Pod in the cluster: -``` -kubectl apply -f audit-pod.yaml +```shell +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/audit-pod.yaml ``` This profile does not restrict any syscalls, so the Pod should start successfully. -``` +```shell kubectl get pod/audit-pod ``` @@ -209,28 +241,31 @@ audit-pod 1/1 Running 0 30s ``` In order to be able to interact with this endpoint exposed by this -container,create a NodePort Service that allows access to the endpoint from -inside the kind control plane container. +container, create a NodePort {{< glossary_tooltip text="Services" term_id="service" >}} +that allows access to the endpoint from inside the kind control plane container. -``` -kubectl expose pod/audit-pod --type NodePort --port 5678 +```shell +kubectl expose pod audit-pod --type NodePort --port 5678 ``` Check what port the Service has been assigned on the node. -``` -kubectl get svc/audit-pod +```shell +kubectl get service audit-pod ``` +The output is similar to: ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE audit-pod NodePort 10.111.36.142 5678:32373/TCP 72s ``` -Now you can `curl` the endpoint from inside the kind control plane container at -the port exposed by this Service. Use `docker exec` to run a command in the Pod: +Now you can use `curl` to access that endpoint from inside the kind control plane container, +at the port exposed by this Service. Use `docker exec` to run the `curl` command within the +container belonging to that control plane container: -``` +```shell +# Change 6a96207fed4b to the control plane container ID you saw from "docker ps" docker exec -it 6a96207fed4b curl localhost:32373 ``` @@ -243,13 +278,14 @@ Because this Pod is running in a local cluster, you should be able to see those in `/var/log/syslog`. Open up a new terminal window and `tail` the output for calls from `http-echo`: -``` +```shell tail -f /var/log/syslog | grep 'http-echo' ``` You should already see some logs of syscalls made by `http-echo`, and if you `curl` the endpoint in the control plane container you will see more written. +For example: ``` Jul 6 15:37:40 my-machine kernel: [369128.669452] audit: type=1326 audit(1594067860.484:14536): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=51 compat=0 ip=0x46fe1f code=0x7ffc0000 Jul 6 15:37:40 my-machine kernel: [369128.669453] audit: type=1326 audit(1594067860.484:14537): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=54 compat=0 ip=0x46fdba code=0x7ffc0000 @@ -268,9 +304,9 @@ for this container. Clean up that Pod and Service before moving to the next section: -``` -kubectl delete pod/audit-pod -kubectl delete svc/audit-pod +```shell +kubectl delete service audit-pod --wait +kubectl delete pod audit-pod --wait --now ``` ## Create Pod with seccomp Profile that Causes Violation @@ -278,27 +314,20 @@ kubectl delete svc/audit-pod For demonstration, apply a profile to the Pod that does not allow for any syscalls. -Download the correct manifest for your Kubernetes version: +The manifest for this demonstration is: -{{< tabs name="violation_pods" >}} -{{< tab name="v1.19 or Later (GA)" >}} {{< codenew file="pods/security/seccomp/ga/violation-pod.yaml" >}} -{{< /tab >}}} -{{{< tab name="Pre-v1.19 (deprecated)" >}} -{{< codenew file="pods/security/seccomp/alpha/violation-pod.yaml" >}} -{{< /tab >}} -{{< /tabs >}} -
-Create the Pod in the cluster: +Attempt to create the Pod in the cluster: -``` -kubectl apply -f violation-pod.yaml +```shell +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/violation-pod.yaml ``` +The Pod creates, but there is an issue. If you check the status of the Pod, you should see that it failed to start. -``` +```shell kubectl get pod/violation-pod ``` @@ -316,8 +345,8 @@ only the privileges they need. Clean up that Pod and Service before moving to the next section: ``` -kubectl delete pod/violation-pod -kubectl delete svc/violation-pod +kubectl delete service violation-pod --wait +kubectl delete pod violation-pod --wait --now ``` ## Create Pod with seccomp Profile that Only Allows Necessary Syscalls @@ -329,61 +358,56 @@ but explicitly allowing a set of syscalls in the `"action": "SCMP_ACT_ALLOW"` block. Ideally, the container will run successfully and you will see no messages sent to `syslog`. -Download the correct manifest for your Kubernetes version: +The manifest for this example is: -{{< tabs name="fine_pods" >}} -{{< tab name="v1.19 or Later (GA)" >}} {{< codenew file="pods/security/seccomp/ga/fine-pod.yaml" >}} -{{< /tab >}}} -{{{< tab name="Pre-v1.19 (deprecated)" >}} -{{< codenew file="pods/security/seccomp/alpha/fine-pod.yaml" >}} -{{< /tab >}} -{{< /tabs >}} -
Create the Pod in your cluster: -``` -kubectl apply -f fine-pod.yaml +```shell +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/fine-pod.yaml ``` -The Pod should start successfully. - -``` -kubectl get pod/fine-pod +```shell +kubectl get pod fine-pod ``` +The Pod should be showing as having started successfully: ``` NAME READY STATUS RESTARTS AGE fine-pod 1/1 Running 0 30s ``` -Open up a new terminal window and `tail` the output for calls from `http-echo`: +Open up a new terminal window and use `tail` to monitor for log entries that +mention calls from `http-echo`: -``` +```shell +# The log path on your computer might be different from "/var/log/syslog" tail -f /var/log/syslog | grep 'http-echo' ``` -Expose the Pod with a NodePort Service: +Next, expose the Pod with a NodePort Service: -``` -kubectl expose pod/fine-pod --type NodePort --port 5678 +```shell +kubectl expose pod fine-pod --type NodePort --port 5678 ``` Check what port the Service has been assigned on the node: -``` -kubectl get svc/fine-pod +```shell +kubectl get service fine-pod ``` +The output is similar to: ``` NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE fine-pod NodePort 10.111.36.142 5678:32373/TCP 72s ``` -`curl` the endpoint from inside the kind control plane container: +Use `curl` to access that endpoint from inside the kind control plane container: -``` +```shell +# Change 6a96207fed4b to the control plane container ID you saw from "docker ps" docker exec -it 6a96207fed4b curl localhost:32373 ``` @@ -391,7 +415,7 @@ docker exec -it 6a96207fed4b curl localhost:32373 just made some syscalls! ``` -You should see no output in the `syslog` because the profile allowed all +You should see no output in the `syslog`. This is because the profile allowed all necessary syscalls and specified that an error should occur if one outside of the list is invoked. This is an ideal situation from a security perspective, but required some effort in analyzing the program. It would be nice if there was a @@ -399,9 +423,9 @@ simple way to get closer to this security without requiring as much effort. Clean up that Pod and Service before moving to the next section: -``` -kubectl delete pod/fine-pod -kubectl delete svc/fine-pod +```shell +kubectl delete service fine-pod --wait +kubectl delete pod fine-pod --wait --now ``` ## Create Pod that uses the Container Runtime Default seccomp Profile @@ -411,23 +435,13 @@ or not. The defaults can easily be applied in Kubernetes by using the `runtime/default` annotation or setting the seccomp type in the security context of a pod or container to `RuntimeDefault`. -Download the correct manifest for your Kubernetes version: - -{{< tabs name="default_pods" >}} -{{< tab name="v1.19 or Later (GA)" >}} {{< codenew file="pods/security/seccomp/ga/default-pod.yaml" >}} -{{< /tab >}}} -{{{< tab name="Pre-v1.19 (deprecated)" >}} -{{< codenew file="pods/security/seccomp/alpha/default-pod.yaml" >}} -{{< /tab >}} -{{< /tabs >}} -
The default seccomp profile should provide adequate access for most workloads. ## {{% heading "whatsnext" %}} -Additional resources: +You can learn more about Linux seccomp: * [A seccomp Overview](https://lwn.net/Articles/656307/) * [Seccomp Security Profiles for Docker](https://docs.docker.com/engine/security/seccomp/) From 97a7bbcea8dd72bb5babb6f8eb2446f173667e6b Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Sat, 16 Oct 2021 13:01:36 +0100 Subject: [PATCH 019/148] Expand on runtime default part of seccomp tutorial --- content/en/docs/tutorials/clusters/seccomp.md | 36 ++++++++++++++++--- .../pods/security/seccomp/ga/default-pod.yaml | 6 ++-- 2 files changed, 34 insertions(+), 8 deletions(-) diff --git a/content/en/docs/tutorials/clusters/seccomp.md b/content/en/docs/tutorials/clusters/seccomp.md index af8cb9e2ef..e3705f5d38 100644 --- a/content/en/docs/tutorials/clusters/seccomp.md +++ b/content/en/docs/tutorials/clusters/seccomp.md @@ -344,7 +344,7 @@ only the privileges they need. Clean up that Pod and Service before moving to the next section: -``` +```shell kubectl delete service violation-pod --wait kubectl delete pod violation-pod --wait --now ``` @@ -431,13 +431,39 @@ kubectl delete pod fine-pod --wait --now ## Create Pod that uses the Container Runtime Default seccomp Profile Most container runtimes provide a sane set of default syscalls that are allowed -or not. The defaults can easily be applied in Kubernetes by using the -`runtime/default` annotation or setting the seccomp type in the security context -of a pod or container to `RuntimeDefault`. +or not. You can adopt these defaults for your workload by setting the seccomp +type in the security context of a pod or container to `RuntimeDefault`. + +{{< note >}} +If you have the `SeccompDefault` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) enabled, then Pods use the `RuntimeDefault` seccomp profile whenever +no other seccomp profile is specified. Otherwise, the default is `Unconfined`. +{{< /note >}} + +Here's a manifest for a Pod that requests the `RuntimeDefault` seccomp profile +for all its containers: {{< codenew file="pods/security/seccomp/ga/default-pod.yaml" >}} -The default seccomp profile should provide adequate access for most workloads. +Create that Pod: +```shell +kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/default-pod.yaml +``` + +```shell +kubectl get pod default-pod +``` + +The Pod should be showing as having started successfully: +``` +NAME READY STATUS RESTARTS AGE +default-pod 1/1 Running 0 20s +``` + +Finally, now that you saw that work OK, clean up: + +```shell +kubectl delete pod default-pod --wait --now +``` ## {{% heading "whatsnext" %}} diff --git a/content/en/examples/pods/security/seccomp/ga/default-pod.yaml b/content/en/examples/pods/security/seccomp/ga/default-pod.yaml index fbeec4c167..b884ec5924 100644 --- a/content/en/examples/pods/security/seccomp/ga/default-pod.yaml +++ b/content/en/examples/pods/security/seccomp/ga/default-pod.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Pod metadata: - name: audit-pod + name: default-pod labels: - app: audit-pod + app: default-pod spec: securityContext: seccompProfile: @@ -12,6 +12,6 @@ spec: - name: test-container image: hashicorp/http-echo:0.2.3 args: - - "-text=just made some syscalls!" + - "-text=just made some more syscalls!" securityContext: allowPrivilegeEscalation: false \ No newline at end of file From ee588f6d2badb3c0ccca204c848d85bd45497d57 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Sat, 16 Oct 2021 12:24:32 +0100 Subject: [PATCH 020/148] Write headings in sentence case Other than page titles, headings should be sentence case --- content/en/docs/tutorials/clusters/seccomp.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/en/docs/tutorials/clusters/seccomp.md b/content/en/docs/tutorials/clusters/seccomp.md index e3705f5d38..a160e08542 100644 --- a/content/en/docs/tutorials/clusters/seccomp.md +++ b/content/en/docs/tutorials/clusters/seccomp.md @@ -57,7 +57,7 @@ run as `Unconfined`. -## Create Seccomp Profiles +## Download example seccomp profiles {#download-profiles} The contents of these profiles will be explored later on, but for now go ahead and download them into a directory named `profiles/` so that they can be loaded @@ -91,7 +91,7 @@ audit.json fine-grained.json violation.json ``` -## Create a Local Kubernetes Cluster with kind +## Create a local Kubernetes cluster with kind For simplicity, [kind](https://kind.sigs.k8s.io/) can be used to create a single @@ -309,7 +309,7 @@ kubectl delete service audit-pod --wait kubectl delete pod audit-pod --wait --now ``` -## Create Pod with seccomp Profile that Causes Violation +## Create Pod with seccomp profile that causes violation For demonstration, apply a profile to the Pod that does not allow for any syscalls. @@ -349,7 +349,7 @@ kubectl delete service violation-pod --wait kubectl delete pod violation-pod --wait --now ``` -## Create Pod with seccomp Profile that Only Allows Necessary Syscalls +## Create Pod with seccomp profile that only allows necessary syscalls If you take a look at the `fine-pod.json`, you will notice some of the syscalls seen in the first example where the profile set `"defaultAction": @@ -428,7 +428,7 @@ kubectl delete service fine-pod --wait kubectl delete pod fine-pod --wait --now ``` -## Create Pod that uses the Container Runtime Default seccomp Profile +## Create Pod that uses the container runtime default seccomp profile Most container runtimes provide a sane set of default syscalls that are allowed or not. You can adopt these defaults for your workload by setting the seccomp From 5d5a2125c58c741259d37a9f1bc1dcfc22e66284 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Sat, 16 Oct 2021 12:24:54 +0100 Subject: [PATCH 021/148] Use a glossary tooltip for "node" --- content/en/docs/tutorials/clusters/seccomp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tutorials/clusters/seccomp.md b/content/en/docs/tutorials/clusters/seccomp.md index a160e08542..2d4ec69999 100644 --- a/content/en/docs/tutorials/clusters/seccomp.md +++ b/content/en/docs/tutorials/clusters/seccomp.md @@ -17,7 +17,7 @@ Seccomp stands for secure computing mode and has been a feature of the Linux kernel since version 2.6.12. It can be used to sandbox the privileges of a process, restricting the calls it is able to make from userspace into the kernel. Kubernetes lets you automatically apply seccomp profiles loaded onto a -Node to your Pods and containers. +{{< glossary_tooltip text="node" term_id="node" >}} to your Pods and containers. Identifying the privileges required for your workloads can be difficult. In this tutorial, you will go through how to load seccomp profiles into a local From 029ec4cd67b57986ac5746517f1ee027bd220edc Mon Sep 17 00:00:00 2001 From: chirangaalwis Date: Mon, 18 Oct 2021 10:52:48 +0530 Subject: [PATCH 022/148] Combine Service Account to map with resource kind --- content/en/docs/reference/access-authn-authz/authorization.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/authorization.md b/content/en/docs/reference/access-authn-authz/authorization.md index 0698512772..21b6089e86 100644 --- a/content/en/docs/reference/access-authn-authz/authorization.md +++ b/content/en/docs/reference/access-authn-authz/authorization.md @@ -134,7 +134,7 @@ The output is similar to this: no ``` -Similarly, to check whether a Service Account named `dev-sa` in Namespace `dev` +Similarly, to check whether a ServiceAccount named `dev-sa` in Namespace `dev` can list Pods in the Namespace `target`: ```bash From 7d9051266d1788f2ef73dc2b3b909b2c6114e0fd Mon Sep 17 00:00:00 2001 From: ixodie Date: Mon, 18 Oct 2021 18:29:33 -0400 Subject: [PATCH 023/148] Removing GCE bridging/routing config tweaks Removing this content seems to be appropriate: Content does not contain a link to a CNI. Content is not required for k8s to function. Content seems to be replicated in longer form on the Google Cloud docs site. --- .../cluster-administration/networking.md | 43 ------------------- 1 file changed, 43 deletions(-) diff --git a/content/en/docs/concepts/cluster-administration/networking.md b/content/en/docs/concepts/cluster-administration/networking.md index 8426de2508..e2f347052b 100644 --- a/content/en/docs/concepts/cluster-administration/networking.md +++ b/content/en/docs/concepts/cluster-administration/networking.md @@ -169,49 +169,6 @@ With this toolset DANM is able to provide multiple separated network interfaces, network that satisfies the Kubernetes requirements. Many people have reported success with Flannel and Kubernetes. -### Google Compute Engine (GCE) - -For the Google Compute Engine cluster configuration scripts, [advanced -routing](https://cloud.google.com/vpc/docs/routes) is used to -assign each VM a subnet (default is `/24` - 254 IPs). Any traffic bound for that -subnet will be routed directly to the VM by the GCE network fabric. This is in -addition to the "main" IP address assigned to the VM, which is NAT'ed for -outbound internet access. A linux bridge (called `cbr0`) is configured to exist -on that subnet, and is passed to docker's `--bridge` flag. - -Docker is started with: - -```shell -DOCKER_OPTS="--bridge=cbr0 --iptables=false --ip-masq=false" -``` - -This bridge is created by Kubelet (controlled by the `--network-plugin=kubenet` -flag) according to the `Node`'s `.spec.podCIDR`. - -Docker will now allocate IPs from the `cbr-cidr` block. Containers can reach -each other and `Nodes` over the `cbr0` bridge. Those IPs are all routable -within the GCE project network. - -GCE itself does not know anything about these IPs, though, so it will not NAT -them for outbound internet traffic. To achieve that an iptables rule is used -to masquerade (aka SNAT - to make it seem as if packets came from the `Node` -itself) traffic that is bound for IPs outside the GCE project network -(10.0.0.0/8). - -```shell -iptables -t nat -A POSTROUTING ! -d 10.0.0.0/8 -o eth0 -j MASQUERADE -``` - -Lastly IP forwarding is enabled in the kernel (so the kernel will process -packets for bridged containers): - -```shell -sysctl net.ipv4.ip_forward=1 -``` - -The result of all this is that all `Pods` can reach each other and can egress -traffic to the internet. - ### Jaguar [Jaguar](https://gitlab.com/sdnlab/jaguar) is an open source solution for Kubernetes's network based on OpenDaylight. Jaguar provides overlay network using vxlan and Jaguar CNIPlugin provides one IP address per pod. From 11117310a52a86be8b023404c2a6dd5378ec197e Mon Sep 17 00:00:00 2001 From: Sahil Vazirani Date: Sun, 10 Oct 2021 23:09:52 -0700 Subject: [PATCH 024/148] GA TTLAfterFinish --- .../workloads/controllers/cron-jobs.md | 2 + .../workloads/controllers/ttlafterfinished.md | 51 ++++++++----------- .../feature-gates.md | 5 +- 3 files changed, 27 insertions(+), 31 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/cron-jobs.md b/content/en/docs/concepts/workloads/controllers/cron-jobs.md index c6cd4d1336..95a58dfc83 100644 --- a/content/en/docs/concepts/workloads/controllers/cron-jobs.md +++ b/content/en/docs/concepts/workloads/controllers/cron-jobs.md @@ -142,3 +142,5 @@ documents the format of CronJob `schedule` fields. For instructions on creating and working with cron jobs, and for an example of CronJob manifest, see [Running automated tasks with cron jobs](/docs/tasks/job/automated-tasks-with-cron-jobs). +For instructions to clean up failed or completed jobs automatically, see +[Clean up Jobs automatically](/docs/concepts/workloads/controllers/job/#clean-up-finished-jobs-automatically) diff --git a/content/en/docs/concepts/workloads/controllers/ttlafterfinished.md b/content/en/docs/concepts/workloads/controllers/ttlafterfinished.md index 266e72a79f..a51c88602f 100644 --- a/content/en/docs/concepts/workloads/controllers/ttlafterfinished.md +++ b/content/en/docs/concepts/workloads/controllers/ttlafterfinished.md @@ -1,75 +1,68 @@ --- reviewers: - janetkuo -title: TTL Controller for Finished Resources +title: Automatic Clean-up for Finished Jobs content_type: concept weight: 70 --- -{{< feature-state for_k8s_version="v1.21" state="beta" >}} +{{< feature-state for_k8s_version="v1.23" state="stable" >}} -The TTL controller provides a TTL (time to live) mechanism to limit the lifetime of resource -objects that have finished execution. TTL controller only handles -{{< glossary_tooltip text="Jobs" term_id="job" >}} for now, -and may be expanded to handle other resources that will finish execution, -such as Pods and custom resources. - -This feature is currently beta and enabled by default, and can be disabled via -[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) -`TTLAfterFinished` in both kube-apiserver and kube-controller-manager. +TTL-after-finished {{}} provides a +TTL (time to live) mechanism to limit the lifetime of resource objects that +have finished execution. TTL controller only handles +{{< glossary_tooltip text="Jobs" term_id="job" >}}. -## TTL Controller +## TTL-after-finished Controller -The TTL controller only supports Jobs for now. A cluster operator can use this feature to clean +The TTL-after-finished controller is only supported for Jobs. A cluster operator can use this feature to clean up finished Jobs (either `Complete` or `Failed`) automatically by specifying the `.spec.ttlSecondsAfterFinished` field of a Job, as in this [example](/docs/concepts/workloads/controllers/job/#clean-up-finished-jobs-automatically). -The TTL controller will assume that a resource is eligible to be cleaned up -TTL seconds after the resource has finished, in other words, when the TTL has expired. When the -TTL controller cleans up a resource, it will delete it cascadingly, that is to say it will delete -its dependent objects together with it. Note that when the resource is deleted, +The TTL-after-finished controller will assume that a job is eligible to be cleaned up +TTL seconds after the job has finished, in other words, when the TTL has expired. When the +TTL-after-finished controller cleans up a job, it will delete it cascadingly, that is to say it will delete +its dependent objects together with it. Note that when the job is deleted, its lifecycle guarantees, such as finalizers, will be honored. The TTL seconds can be set at any time. Here are some examples for setting the `.spec.ttlSecondsAfterFinished` field of a Job: -* Specify this field in the resource manifest, so that a Job can be cleaned up +* Specify this field in the job manifest, so that a Job can be cleaned up automatically some time after it finishes. -* Set this field of existing, already finished resources, to adopt this new +* Set this field of existing, already finished jobs, to adopt this new feature. * Use a [mutating admission webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks) - to set this field dynamically at resource creation time. Cluster administrators can - use this to enforce a TTL policy for finished resources. + to set this field dynamically at job creation time. Cluster administrators can + use this to enforce a TTL policy for finished jobs. * Use a [mutating admission webhook](/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks) - to set this field dynamically after the resource has finished, and choose - different TTL values based on resource status, labels, etc. + to set this field dynamically after the job has finished, and choose + different TTL values based on job status, labels, etc. ## Caveat ### Updating TTL Seconds Note that the TTL period, e.g. `.spec.ttlSecondsAfterFinished` field of Jobs, -can be modified after the resource is created or has finished. However, once the +can be modified after the job is created or has finished. However, once the Job becomes eligible to be deleted (when the TTL has expired), the system won't guarantee that the Jobs will be kept, even if an update to extend the TTL returns a successful API response. ### Time Skew -Because TTL controller uses timestamps stored in the Kubernetes resources to +Because TTL-after-finished controller uses timestamps stored in the Kubernetes jobs to determine whether the TTL has expired or not, this feature is sensitive to time -skew in the cluster, which may cause TTL controller to clean up resource objects +skew in the cluster, which may cause TTL-after-finish controller to clean up job objects at the wrong time. -In Kubernetes, it's required to run NTP on all nodes -(see [#6159](https://github.com/kubernetes/kubernetes/issues/6159#issuecomment-93844058)) -to avoid time skew. Clocks aren't always correct, but the difference should be +Clocks aren't always correct, but the difference should be very small. Please be aware of this risk when setting a non-zero TTL. diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index d639029659..b392117237 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -190,8 +190,6 @@ different Kubernetes components. | `StorageVersionHash` | `true` | Beta | 1.15 | | | `SuspendJob` | `false` | Alpha | 1.21 | 1.21 | | `SuspendJob` | `true` | Beta | 1.22 | | -| `TTLAfterFinished` | `false` | Alpha | 1.12 | 1.20 | -| `TTLAfterFinished` | `true` | Beta | 1.21 | | | `TopologyAwareHints` | `false` | Alpha | 1.21 | | | `TopologyManager` | `false` | Alpha | 1.16 | 1.17 | | `TopologyManager` | `true` | Beta | 1.18 | | @@ -439,6 +437,9 @@ different Kubernetes components. | `SupportPodPidsLimit` | `true` | GA | 1.20 | - | | `Sysctls` | `true` | Beta | 1.11 | 1.20 | | `Sysctls` | `true` | GA | 1.21 | | +| `TTLAfterFinished` | `false` | Alpha | 1.12 | 1.20 | +| `TTLAfterFinished` | `true` | Beta | 1.21 | 1.22 | +| `TTLAfterFinished` | `true` | GA | 1.23 | - | | `TaintBasedEvictions` | `false` | Alpha | 1.6 | 1.12 | | `TaintBasedEvictions` | `true` | Beta | 1.13 | 1.17 | | `TaintBasedEvictions` | `true` | GA | 1.18 | - | From d283c1f5453d0c9ef03f08bbdf35d45ca152e2cc Mon Sep 17 00:00:00 2001 From: slayer321 Date: Mon, 25 Oct 2021 09:52:46 -0400 Subject: [PATCH 025/148] docs: add PV duplicate example --- .../configure-persistent-volume-storage.md | 6 ++++++ .../examples/pods/storage/pv-duplicate.yaml | 20 +++++++++++++++++++ 2 files changed, 26 insertions(+) create mode 100644 content/en/examples/pods/storage/pv-duplicate.yaml diff --git a/content/en/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md b/content/en/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md index a53d278223..73755891ca 100644 --- a/content/en/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md +++ b/content/en/docs/tasks/configure-pod-container/configure-persistent-volume-storage.md @@ -236,8 +236,14 @@ sudo rmdir /mnt/data You can now close the shell to your Node. +## Mounting the same persistentVolume in two places +{{< codenew file="pods/storage/pv-duplicate.yaml" >}} +You can perform 2 volume mounts on your nginx container: + +`/usr/share/nginx/html` for the static website +`/etc/nginx/nginx.conf` for the default config diff --git a/content/en/examples/pods/storage/pv-duplicate.yaml b/content/en/examples/pods/storage/pv-duplicate.yaml new file mode 100644 index 0000000000..15a48acbed --- /dev/null +++ b/content/en/examples/pods/storage/pv-duplicate.yaml @@ -0,0 +1,20 @@ + +apiVersion: v1 +kind: Pod +metadata: + name: test +spec: + containers: + - name: test + image: nginx + volumeMounts: + - name: site-data + mountPath: /usr/share/nginx/html + subPath: html + - name: config + mountPath: /etc/nginx/nginx.conf + subPath: nginx.conf + volumes: + - name: config + persistentVolumeClaim: + claimName: test-nfs-claim \ No newline at end of file From 489e938f1c0e8de483d4315c759f8928b1cfa70b Mon Sep 17 00:00:00 2001 From: Robert Van Voorhees Date: Sun, 24 Oct 2021 06:06:43 -0400 Subject: [PATCH 026/148] Resolve formatting issue and add example for node affinity example. --- .../pods/pod-topology-spread-constraints.md | 64 ++++++++++--------- 1 file changed, 33 insertions(+), 31 deletions(-) diff --git a/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md b/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md index 43f537c9a5..a4186e1240 100644 --- a/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md +++ b/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md @@ -85,7 +85,7 @@ You can define one or multiple `topologySpreadConstraint` to instruct the kube-s It must be greater than zero. Its semantics differs according to the value of `whenUnsatisfiable`: - when `whenUnsatisfiable` equals to "DoNotSchedule", `maxSkew` is the maximum permitted difference between the number of matching pods in the target - topology and the global minimum + topology and the global minimum (the minimum number of pods that match the label selector in a topology domain. For example, if you have 3 zones with 0, 2 and 3 matching pods respectively, The global minimum is 0). - when `whenUnsatisfiable` equals to "ScheduleAnyway", scheduler gives higher precedence to topologies that would help reduce the skew. @@ -234,43 +234,45 @@ To overcome this situation, you can either increase the `maxSkew` or modify one The scheduler will skip the non-matching nodes from the skew calculations if the incoming Pod has `spec.nodeSelector` or `spec.affinity.nodeAffinity` defined. +### Example: TopologySpreadConstraints with NodeAffinity + Suppose you have a 5-node cluster ranging from zoneA to zoneC: - {{}} - graph BT - subgraph "zoneB" - p3(Pod) --> n3(Node3) - n4(Node4) - end - subgraph "zoneA" - p1(Pod) --> n1(Node1) - p2(Pod) --> n2(Node2) - end +{{}} +graph BT + subgraph "zoneB" + p3(Pod) --> n3(Node3) + n4(Node4) + end + subgraph "zoneA" + p1(Pod) --> n1(Node1) + p2(Pod) --> n2(Node2) + end - classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; - classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; - classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; - class n1,n2,n3,n4,p1,p2,p3 k8s; - class p4 plain; - class zoneA,zoneB cluster; - {{< /mermaid >}} +classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; +classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; +classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; +class n1,n2,n3,n4,p1,p2,p3 k8s; +class p4 plain; +class zoneA,zoneB cluster; +{{< /mermaid >}} - {{}} - graph BT - subgraph "zoneC" - n5(Node5) - end +{{}} +graph BT + subgraph "zoneC" + n5(Node5) + end - classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; - classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; - classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; - class n5 k8s; - class zoneC cluster; - {{< /mermaid >}} +classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; +classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; +classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; +class n5 k8s; +class zoneC cluster; +{{< /mermaid >}} and you know that "zoneC" must be excluded. In this case, you can compose the yaml as below, so that "mypod" will be placed onto "zoneB" instead of "zoneC". Similarly `spec.nodeSelector` is also respected. - {{< codenew file="pods/topology-spread-constraints/one-constraint-with-nodeaffinity.yaml" >}} +{{< codenew file="pods/topology-spread-constraints/one-constraint-with-nodeaffinity.yaml" >}} The scheduler doesn't have prior knowledge of all the zones or other topology domains that a cluster has. They are determined from the existing nodes in the cluster. This could lead to a problem in autoscaled clusters, when a node pool (or node group) is scaled to zero nodes and the user is expecting them to scale up, because, in this case, those topology domains won't be considered until there is at least one node in them. @@ -392,7 +394,7 @@ for more details. ## Known Limitations -- There's no guarantee that the constraints remain satisfied when Pods are removed. For example, scaling down a Deployment may result in imbalanced Pods distribution. +- There's no guarantee that the constraints remain satisfied when Pods are removed. For example, scaling down a Deployment may result in imbalanced Pods distribution. You can use [Descheduler](https://github.com/kubernetes-sigs/descheduler) to rebalance the Pods distribution. - Pods matched on tainted nodes are respected. See [Issue 80921](https://github.com/kubernetes/kubernetes/issues/80921) From 26280ee0c1104bb475d90beed2bf4937ff72fed3 Mon Sep 17 00:00:00 2001 From: Jonathan Dobson Date: Wed, 27 Oct 2021 12:02:08 -0600 Subject: [PATCH 027/148] Move CSIVolumeFSGroupPolicy to GA --- .../reference/command-line-tools-reference/feature-gates.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 91aa118fa2..fab4148736 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -83,8 +83,6 @@ different Kubernetes components. | `CSIMigrationvSphere` | `false` | Beta | 1.19 | | | `CSIStorageCapacity` | `false` | Alpha | 1.19 | 1.20 | | `CSIStorageCapacity` | `true` | Beta | 1.21 | | -| `CSIVolumeFSGroupPolicy` | `false` | Alpha | 1.19 | 1.19 | -| `CSIVolumeFSGroupPolicy` | `true` | Beta | 1.20 | | | `CSIVolumeHealth` | `false` | Alpha | 1.21 | | | `CSRDuration` | `true` | Beta | 1.22 | | | `ConfigurableFSGroupPolicy` | `false` | Alpha | 1.18 | 1.19 | @@ -255,6 +253,9 @@ different Kubernetes components. | `CSIServiceAccountToken` | `false` | Alpha | 1.20 | 1.20 | | `CSIServiceAccountToken` | `true` | Beta | 1.21 | 1.21 | | `CSIServiceAccountToken` | `true` | GA | 1.22 | | +| `CSIVolumeFSGroupPolicy` | `false` | Alpha | 1.19 | 1.19 | +| `CSIVolumeFSGroupPolicy` | `true` | Beta | 1.20 | 1.22 | +| `CSIVolumeFSGroupPolicy` | `true` | GA | 1.23 | | | `CronJobControllerV2` | `false` | Alpha | 1.20 | 1.20 | | `CronJobControllerV2` | `true` | Beta | 1.21 | 1.21 | | `CronJobControllerV2` | `true` | GA | 1.22 | - | From e50ce5f26925db442559ee4d307deb01c322424f Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Mon, 25 Oct 2021 14:13:24 -0400 Subject: [PATCH 028/148] PodSecurity: runAsUser --- .../security/pod-security-standards.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/content/en/docs/concepts/security/pod-security-standards.md b/content/en/docs/concepts/security/pod-security-standards.md index f3b43344bf..62e8943479 100644 --- a/content/en/docs/concepts/security/pod-security-standards.md +++ b/content/en/docs/concepts/security/pod-security-standards.md @@ -373,6 +373,24 @@ fail validation. + + Running as Non-root user (v1.23+) + +

Containers must not set runAsUser to 0

+

Restricted Fields

+
    +
  • spec.securityContext.runAsUser
  • +
  • spec.containers[*].securityContext.runAsUser
  • +
  • spec.initContainers[*].securityContext.runAsUser
  • +
  • spec.ephemeralContainers[*].securityContext.runAsUser
  • +
+

Allowed Values

+
    +
  • any non-zero value
  • +
  • undefined/null
  • +
+ + Non-root groups (optional) From f160db17d605385cc5654929b45af10193fdf8a9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Svensson?= Date: Wed, 15 Sep 2021 12:38:40 +0200 Subject: [PATCH 029/148] PodTopology: add notes of possible changed default behavior MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Svensson --- .../workloads/pods/pod-topology-spread-constraints.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md b/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md index 4e69837503..47176e885b 100644 --- a/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md +++ b/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md @@ -349,12 +349,14 @@ Also, the legacy `SelectorSpread` plugin, which provides an equivalent behavior, is disabled. {{< note >}} +The `PodTopologySpread` plugin does not score the nodes that don't have +the topology keys specified in the spreading constraints. This might result +in a different default behavior compared to the legacy `SelectorSpread` plugin when +using the default topology constraints. + If your nodes are not expected to have **both** `kubernetes.io/hostname` and `topology.kubernetes.io/zone` labels set, define your own constraints instead of using the Kubernetes defaults. - -The `PodTopologySpread` plugin does not score the nodes that don't have -the topology keys specified in the spreading constraints. {{< /note >}} If you don't want to use the default Pod spreading constraints for your cluster, From 2b61e464a6a78451efdedf4cf3fa78397dee83e8 Mon Sep 17 00:00:00 2001 From: Suresh Kumar Date: Wed, 3 Nov 2021 19:33:09 +0530 Subject: [PATCH 030/148] Update parallel-processing-expansion.md removed unwanted jinja tags --- .../en/docs/tasks/job/parallel-processing-expansion.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/en/docs/tasks/job/parallel-processing-expansion.md b/content/en/docs/tasks/job/parallel-processing-expansion.md index fdd309cafb..30942b3ede 100644 --- a/content/en/docs/tasks/job/parallel-processing-expansion.md +++ b/content/en/docs/tasks/job/parallel-processing-expansion.md @@ -178,13 +178,13 @@ First, copy and paste the following template of a Job object, into a file called ```liquid -{%- set params = [{ "name": "apple", "url": "http://dbpedia.org/resource/Apple", }, +{% set params = [{ "name": "apple", "url": "http://dbpedia.org/resource/Apple", }, { "name": "banana", "url": "http://dbpedia.org/resource/Banana", }, { "name": "cherry", "url": "http://dbpedia.org/resource/Cherry" }] %} -{%- for p in params %} -{%- set name = p["name"] %} -{%- set url = p["url"] %} +{% for p in params %} +{% set name = p["name"] %} +{% set url = p["url"] %} --- apiVersion: batch/v1 kind: Job @@ -204,7 +204,7 @@ spec: image: busybox command: ["sh", "-c", "echo Processing URL {{ url }} && sleep 5"] restartPolicy: Never -{%- endfor %} +{% endfor %} ``` The above template defines two parameters for each Job object using a list of From ba4390cf48bc7fb31b501564a02d8c7f0cb9cfcc Mon Sep 17 00:00:00 2001 From: Rey Lejano Date: Fri, 5 Nov 2021 11:46:22 -0700 Subject: [PATCH 031/148] add line about contributor blogs to kubernetes.dev --- content/en/docs/contribute/new-content/blogs-case-studies.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/contribute/new-content/blogs-case-studies.md b/content/en/docs/contribute/new-content/blogs-case-studies.md index ee06f204cb..0380bd7e2d 100644 --- a/content/en/docs/contribute/new-content/blogs-case-studies.md +++ b/content/en/docs/contribute/new-content/blogs-case-studies.md @@ -38,6 +38,7 @@ Anyone can write a blog post and submit it for review. - The components of Kubernetes are purposely modular, so tools that use existing integration points like CNI and CSI are on topic. - Posts about other CNCF projects may or may not be on topic. We recommend asking the blog team before submitting a draft. - Many CNCF projects have their own blog. These are often a better choice for posts. There are times of major feature or milestone for a CNCF project that users would be interested in reading on the Kubernetes blog. + - Blog posts about contributing to the Kubernetes project should be in the [Kubernetes Contributors site](https://kubernetes.dev) - Blog posts should be original content - The official blog is not for repurposing existing content from a third party as new content. - The [license](https://github.com/kubernetes/website/blob/main/LICENSE) for the blog allows commercial use of the content for commercial purposes, but not the other way around. From dabf80ae5629da135758d0e742f8d032e32069e3 Mon Sep 17 00:00:00 2001 From: Ayushman Date: Tue, 2 Nov 2021 20:07:15 +0530 Subject: [PATCH 032/148] Added Note for Deprecation of Flexvolume flexVolume Signed-off-by: Ayushman --- content/en/docs/concepts/storage/volumes.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/en/docs/concepts/storage/volumes.md b/content/en/docs/concepts/storage/volumes.md index 56694dee66..e8f65df8cc 100644 --- a/content/en/docs/concepts/storage/volumes.md +++ b/content/en/docs/concepts/storage/volumes.md @@ -1381,6 +1381,10 @@ plugin path on each node and in some cases the control plane nodes as well. Pods interact with FlexVolume drivers through the `flexvolume` in-tree volume plugin. For more details, see the [FlexVolume](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-storage/flexvolume.md) examples. +{{< note >}} +FlexVolume is deprecated starting v1.23. Out-of-tree CSI driver is the recommended way to write volume driver in Kubernetes. Maintainers of FlexVolume driver should implement a CSI Driver and move users of FlexVolume to CSI. Users of FlexVolume should move their workloads to CSI Driver. +{{< /note >}} + ## Mount propagation Mount propagation allows for sharing volumes mounted by a container to From 14a003cb3b42967f6c516353c6a1f36989d54925 Mon Sep 17 00:00:00 2001 From: ahg-g <40361897+ahg-g@users.noreply.github.com> Date: Wed, 10 Nov 2021 07:43:27 -0500 Subject: [PATCH 033/148] add docs for JobMutableNodeSchedulingDirectives (#30390) --- .../concepts/workloads/controllers/job.md | 31 ++++++++++++++++++- .../feature-gates.md | 3 ++ 2 files changed, 33 insertions(+), 1 deletion(-) diff --git a/content/en/docs/concepts/workloads/controllers/job.md b/content/en/docs/concepts/workloads/controllers/job.md index 54a4104c5e..7ab98f6fba 100644 --- a/content/en/docs/concepts/workloads/controllers/job.md +++ b/content/en/docs/concepts/workloads/controllers/job.md @@ -417,7 +417,10 @@ version of Kubernetes you're using](/docs/home/supported-doc-versions/). When a Job is created, the Job controller will immediately begin creating Pods to satisfy the Job's requirements and will continue to do so until the Job is complete. However, you may want to temporarily suspend a Job's execution and -resume it later. To suspend a Job, you can update the `.spec.suspend` field of +resume it later, or start Jobs in suspended state and have a custom controller +decide later when to start them. + +To suspend a Job, you can update the `.spec.suspend` field of the Job to true; later, when you want to resume it again, update it to false. Creating a Job with `.spec.suspend` set to true will create it in the suspended state. @@ -503,6 +506,32 @@ directly a result of toggling the `.spec.suspend` field. In the time between these two events, we see that no Pods were created, but Pod creation restarted as soon as the Job was resumed. +### Mutable Scheduling Directives + +{{< feature-state for_k8s_version="v1.23" state="beta" >}} + +{{< note >}} +In order to use this behavior, you must enable the `JobMutableNodeSchedulingDirectives` +[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) +on the [API server](/docs/reference/command-line-tools-reference/kube-apiserver/). +It is enabled by default. +{{< /note >}} + +In most cases a parallel job will want the pods to run with constraints, +like all in the same zone, or all either on GPU model x or y but not a mix of both. + +The [suspend](#suspending-a-job) field is the first step towards achieving those semantics. Suspend allows a +custom queue controller to decide when a job should start; However, once a job is unsuspended, +a custom queue controller has no influence on where the pods of a job will actually land. + +This feature allows updating a Job's scheduling directives before it starts, which gives custom queue +controllers the ability to influence pod placement while at the same time offloading actual +pod-to-node assignment to kube-scheduler. This is allowed only for suspended Jobs that have never +been unsuspended before. + +The fields in a Job's pod template that can be updated are node affinity, node selector, +tolerations, labels and annotations. + ### Specifying your own Pod selector Normally, when you create a Job object, you do not specify `.spec.selector`. diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index fab4148736..8b2d4dd18e 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -133,6 +133,7 @@ different Kubernetes components. | `InTreePluginvSphereUnregister` | `false` | Alpha | 1.21 | | | `IPv6DualStack` | `false` | Alpha | 1.15 | 1.20 | | `IPv6DualStack` | `true` | Beta | 1.21 | | +| `JobMutableNodeSchedulingDirectives` | `true` | Beta | 1.23 | | | `JobTrackingWithFinalizers` | `false` | Alpha | 1.22 | | | `KubeletCredentialProviders` | `false` | Alpha | 1.20 | | | `KubeletInUserNamespace` | `false` | Alpha | 1.22 | | @@ -794,6 +795,8 @@ Each feature gate is designed for enabling/disabling a specific feature: Initializers admission plugin. - `IPv6DualStack`: Enable [dual stack](/docs/concepts/services-networking/dual-stack/) support for IPv6. +- `JobMutableNodeSchedulingDirectives`: Allows updating node scheduling directives in + the pod template of [Job](/docs/concepts/workloads/controllers/job). - `JobTrackingWithFinalizers`: Enables tracking [Job](/docs/concepts/workloads/controllers/job) completions without relying on Pods remaining in the cluster indefinitely. The Job controller uses Pod finalizers and a field in the Job status to keep From 575b742e0a800328ed357331d56d95f133b5f857 Mon Sep 17 00:00:00 2001 From: Aldo Culquicondor Date: Tue, 9 Nov 2021 14:15:45 -0500 Subject: [PATCH 034/148] Graduate JobTrackingWithFinalizers to beta --- content/en/docs/concepts/workloads/controllers/job.md | 9 +++++---- .../command-line-tools-reference/feature-gates.md | 3 ++- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/job.md b/content/en/docs/concepts/workloads/controllers/job.md index 7ab98f6fba..33bb415570 100644 --- a/content/en/docs/concepts/workloads/controllers/job.md +++ b/content/en/docs/concepts/workloads/controllers/job.md @@ -601,18 +601,19 @@ mismatch. ### Job tracking with finalizers -{{< feature-state for_k8s_version="v1.22" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} {{< note >}} In order to use this behavior, you must enable the `JobTrackingWithFinalizers` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) on the [API server](/docs/reference/command-line-tools-reference/kube-apiserver/) and the [controller manager](/docs/reference/command-line-tools-reference/kube-controller-manager/). -It is disabled by default. +It is enabled by default. When enabled, the control plane tracks new Jobs using the behavior described -below. Existing Jobs are unaffected. As a user, the only difference you would -see is that the control plane tracking of Job completion is more accurate. +below. Jobs created before the feature was enabled are unaffected. As a user, +the only difference you would see is that the control plane tracking of Job +completion is more accurate. {{< /note >}} When this feature isn't enabled, the Job {{< glossary_tooltip term_id="controller" >}} diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 8b2d4dd18e..8cc2ed9cbc 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -134,7 +134,8 @@ different Kubernetes components. | `IPv6DualStack` | `false` | Alpha | 1.15 | 1.20 | | `IPv6DualStack` | `true` | Beta | 1.21 | | | `JobMutableNodeSchedulingDirectives` | `true` | Beta | 1.23 | | -| `JobTrackingWithFinalizers` | `false` | Alpha | 1.22 | | +| `JobTrackingWithFinalizers` | `false` | Alpha | 1.22 | 1.22 | +| `JobTrackingWithFinalizers` | `true` | Beta | 1.23 | | | `KubeletCredentialProviders` | `false` | Alpha | 1.20 | | | `KubeletInUserNamespace` | `false` | Alpha | 1.22 | | | `KubeletPodResourcesGetAllocatable` | `false` | Alpha | 1.21 | | From 4b7784728a24bc5c8dcb71c89fcc11e432b3e163 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Wed, 3 Nov 2021 17:43:43 -0400 Subject: [PATCH 035/148] PodSecurity beta updates --- .../security/pod-security-admission.md | 37 +++++++++++--- .../admission-controllers.md | 2 +- .../feature-gates.md | 3 +- .../enforce-standards-admission-controller.md | 48 ++++++++++++++++++- .../enforce-standards-namespace-labels.md | 2 +- .../migrate-from-psp.md | 2 +- 6 files changed, 82 insertions(+), 12 deletions(-) diff --git a/content/en/docs/concepts/security/pod-security-admission.md b/content/en/docs/concepts/security/pod-security-admission.md index a1c87767c9..933dc62940 100644 --- a/content/en/docs/concepts/security/pod-security-admission.md +++ b/content/en/docs/concepts/security/pod-security-admission.md @@ -13,13 +13,13 @@ min-kubernetes-server-version: v1.22 -{{< feature-state for_k8s_version="v1.22" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} The Kubernetes [Pod Security Standards](/docs/concepts/security/pod-security-standards/) define different isolation levels for Pods. These standards let you define how you want to restrict the behavior of pods in a clear, consistent fashion. -As an Alpha feature, Kubernetes offers a built-in _Pod Security_ {{< glossary_tooltip +As an Beta feature, Kubernetes offers a built-in _Pod Security_ {{< glossary_tooltip text="admission controller" term_id="admission-controller" >}}, the successor to [PodSecurityPolicies](/docs/concepts/policy/pod-security-policy/). Pod security restrictions are applied at the {{< glossary_tooltip text="namespace" term_id="namespace" >}} level when pods @@ -32,15 +32,40 @@ The PodSecurityPolicy API is deprecated and will be -## Enabling the Alpha feature +## Enabling the `PodSecurity` admission plugin -Setting pod security controls by namespace is an alpha feature. You must enable the `PodSecurity` -[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) in order to use it. +In v1.23, the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) +is a Beta feature and is enabled by default. + +In v1.22, the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) +is an Alpha feature and must be enabled in `kube-apiserver` in order to use the built-in admission plugin. ```shell --feature-gates="...,PodSecurity=true" ``` +## Alternative: installing the `PodSecurity` admission webhook + +For environments where the built-in `PodSecurity` admission plugin cannot be used, +either because the cluster is older than v1.22, or the `PodSecurity` feature cannot be enabled, +the `PodSecurity` admission logic is also available as a Beta [validating admission webhook](https://git.k8s.io/pod-security-admission/webhook). + +A pre-built container image, certificate generation scripts, and example manifests +are available at [https://git.k8s.io/pod-security-admission/webhook](https://git.k8s.io/pod-security-admission/webhook). + +To install: +```shell +git clone git@github.com:kubernetes/pod-security-admission.git +cd pod-security-admission/webhook +make certs +kubectl apply -k . +``` + +{{< note >}} +The generated certificate is valid for 2 years. Before it expires, +regenerate the certificate or remove the webhook in favor of the built-in admission plugin. +{{< /note >}} + ## Pod Security levels Pod Security admission places requirements on a Pod's [Security @@ -52,7 +77,7 @@ page for an in-depth look at those requirements. ## Pod Security Admission labels for namespaces -Provided that you have enabled this feature, you can configure namespaces to define the admission +Once the feature is enabled or the webhook is installed, you can configure namespaces to define the admission control mode you want to use for pod security in each namespace. Kubernetes defines a set of {{< glossary_tooltip term_id="label" text="labels" >}} that you can set to define which of the predefined Pod Security Standard levels you want to use for a namespace. The label you select diff --git a/content/en/docs/reference/access-authn-authz/admission-controllers.md b/content/en/docs/reference/access-authn-authz/admission-controllers.md index 0461c09f53..7957ff7a4f 100644 --- a/content/en/docs/reference/access-authn-authz/admission-controllers.md +++ b/content/en/docs/reference/access-authn-authz/admission-controllers.md @@ -698,7 +698,7 @@ admission plugin, which allows preventing pods from running on specifically tain ### PodSecurity {#podsecurity} -{{< feature-state for_k8s_version="v1.22" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} This is the replacement for the deprecated [PodSecurityPolicy](#podsecuritypolicy) admission controller defined in the next section. This admission controller acts on creation and modification of the pod and diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 91aa118fa2..dc369aee3d 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -159,7 +159,8 @@ different Kubernetes components. | `PodAffinityNamespaceSelector` | `true` | Beta | 1.22 | | | `PodOverhead` | `false` | Alpha | 1.16 | 1.17 | | `PodOverhead` | `true` | Beta | 1.18 | | -| `PodSecurity` | `false` | Alpha | 1.22 | | +| `PodSecurity` | `false` | Alpha | 1.22 | 1.22 | +| `PodSecurity` | `true` | Beta | 1.23 | | | `PreferNominatedNode` | `false` | Alpha | 1.21 | 1.21 | | `PreferNominatedNode` | `true` | Beta | 1.22 | | | `ProbeTerminationGracePeriod` | `false` | Alpha | 1.21 | 1.21 | diff --git a/content/en/docs/tasks/configure-pod-container/enforce-standards-admission-controller.md b/content/en/docs/tasks/configure-pod-container/enforce-standards-admission-controller.md index ef8206b1b6..c2f9fae3f7 100644 --- a/content/en/docs/tasks/configure-pod-container/enforce-standards-admission-controller.md +++ b/content/en/docs/tasks/configure-pod-container/enforce-standards-admission-controller.md @@ -15,10 +15,52 @@ You can configure this admission controller to set cluster-wide defaults and [ex {{% version-check %}} -- Enable the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features). +- Ensure the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features) is enabled. ## Configure the Admission Controller +{{< tabs name="PodSecurityConfiguration_example_1" >}} +{{% tab name="pod-security.admission.config.k8s.io/v1beta1" %}} +```yaml +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- name: PodSecurity + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1beta1 + kind: PodSecurityConfiguration + # Defaults applied when a mode label is not set. + # + # Level label values must be one of: + # - "privileged" (default) + # - "baseline" + # - "restricted" + # + # Version label values must be one of: + # - "latest" (default) + # - specific version like "v{{< skew latestVersion >}}" + defaults: + enforce: "privileged" + enforce-version: "latest" + audit: "privileged" + audit-version: "latest" + warn: "privileged" + warn-version: "latest" + exemptions: + # Array of authenticated usernames to exempt. + usernames: [] + # Array of runtime class names to exempt. + runtimeClassNames: [] + # Array of namespaces to exempt. + namespaces: [] +``` + +{{< note >}} +v1beta1 configuration requires v1.23+. For v1.22, use v1alpha1. +{{< /note >}} + +{{% /tab %}} +{{% tab name="pod-security.admission.config.k8s.io/v1alpha1" %}} ```yaml apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration @@ -51,4 +93,6 @@ plugins: runtimeClassNames: [] # Array of namespaces to exempt. namespaces: [] -``` \ No newline at end of file +``` +{{% /tab %}} +{{< /tabs >}} diff --git a/content/en/docs/tasks/configure-pod-container/enforce-standards-namespace-labels.md b/content/en/docs/tasks/configure-pod-container/enforce-standards-namespace-labels.md index 9a4c3a44ed..121f9b15e7 100644 --- a/content/en/docs/tasks/configure-pod-container/enforce-standards-namespace-labels.md +++ b/content/en/docs/tasks/configure-pod-container/enforce-standards-namespace-labels.md @@ -13,7 +13,7 @@ Namespaces can be labeled to enforce the [Pod Security Standards](/docs/concepts {{% version-check %}} -- Enable the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features). +- Ensure the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features) is enabled. ## Requiring the `baseline` Pod Security Standard with namespace labels diff --git a/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md b/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md index f0ea2d02df..adc8225e23 100644 --- a/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md +++ b/content/en/docs/tasks/configure-pod-container/migrate-from-psp.md @@ -17,7 +17,7 @@ admission controller. This can be done effectively using a combination of dry-ru {{% version-check %}} -- Enable the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features). +- Ensure the `PodSecurity` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features) is enabled. From 1e0796c4e4ae671329b1a5728d1e3af05b060c89 Mon Sep 17 00:00:00 2001 From: Cheng Xing Date: Wed, 10 Nov 2021 16:57:29 -0800 Subject: [PATCH 036/148] Delegate FSGroup to CSI beta --- .../en/docs/tasks/configure-pod-container/security-context.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/configure-pod-container/security-context.md b/content/en/docs/tasks/configure-pod-container/security-context.md index 56bcc0f3f9..ef9cbf6200 100644 --- a/content/en/docs/tasks/configure-pod-container/security-context.md +++ b/content/en/docs/tasks/configure-pod-container/security-context.md @@ -186,7 +186,7 @@ and [`emptydir`](/docs/concepts/storage/volumes/#emptydir). ## Delegating volume permission and ownership change to CSI driver -{{< feature-state for_k8s_version="v1.22" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} If you deploy a [Container Storage Interface (CSI)](https://github.com/container-storage-interface/spec/blob/master/spec.md) driver which supports the `VOLUME_MOUNT_GROUP` `NodeServiceCapability`, the From 4729b75ffb04203c2f1173c97fafdd194f217c0c Mon Sep 17 00:00:00 2001 From: Harry Bagdi Date: Thu, 11 Nov 2021 08:51:52 -0800 Subject: [PATCH 037/148] graduate IngressClassNamespacedParams to GA --- content/en/docs/concepts/services-networking/ingress.md | 2 +- .../reference/command-line-tools-reference/feature-gates.md | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/services-networking/ingress.md b/content/en/docs/concepts/services-networking/ingress.md index 6879b998db..fbeb5289fb 100644 --- a/content/en/docs/concepts/services-networking/ingress.md +++ b/content/en/docs/concepts/services-networking/ingress.md @@ -224,7 +224,7 @@ reference additional implementation-specific configuration for this class. #### Namespace-scoped parameters -{{< feature-state for_k8s_version="v1.22" state="beta" >}} +{{< feature-state for_k8s_version="v1.23" state="stable" >}} `Parameters` field has a `scope` and `namespace` field that can be used to reference a namespace-specific resource for configuration of an Ingress class. diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index fab4148736..a3ff10133e 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -123,8 +123,6 @@ different Kubernetes components. | `HPAScaleToZero` | `false` | Alpha | 1.16 | | | `IndexedJob` | `false` | Alpha | 1.21 | 1.21 | | `IndexedJob` | `true` | Beta | 1.22 | | -| `IngressClassNamespacedParams` | `false` | Alpha | 1.21 | 1.21 | -| `IngressClassNamespacedParams` | `true` | Beta | 1.22 | | | `InTreePluginAWSUnregister` | `false` | Alpha | 1.21 | | | `InTreePluginAzureDiskUnregister` | `false` | Alpha | 1.21 | | | `InTreePluginAzureFileUnregister` | `false` | Alpha | 1.21 | | @@ -324,6 +322,9 @@ different Kubernetes components. | `ImmutableEphemeralVolumes` | `false` | Alpha | 1.18 | 1.18 | | `ImmutableEphemeralVolumes` | `true` | Beta | 1.19 | 1.20 | | `ImmutableEphemeralVolumes` | `true` | GA | 1.21 | | +| `IngressClassNamespacedParams` | `false` | Alpha | 1.21 | 1.21 | +| `IngressClassNamespacedParams` | `true` | Beta | 1.22 | 1.22 | +| `IngressClassNamespacedParams` | `true` | GA | 1.23 | - | | `Initializers` | `false` | Alpha | 1.7 | 1.13 | | `Initializers` | - | Deprecated | 1.14 | - | | `KubeletConfigFile` | `false` | Alpha | 1.8 | 1.9 | From 65bceb18762f0c182dbbc50d9dfbeb478fcccc03 Mon Sep 17 00:00:00 2001 From: Patrick Ohly Date: Thu, 4 Nov 2021 15:01:34 +0100 Subject: [PATCH 038/148] generic ephemeral volumes: document graduation to GA --- content/en/docs/concepts/storage/ephemeral-volumes.md | 7 +------ .../command-line-tools-reference/feature-gates.md | 5 +++-- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/content/en/docs/concepts/storage/ephemeral-volumes.md b/content/en/docs/concepts/storage/ephemeral-volumes.md index 1e811fb82a..5c9f9b21d3 100644 --- a/content/en/docs/concepts/storage/ephemeral-volumes.md +++ b/content/en/docs/concepts/storage/ephemeral-volumes.md @@ -130,10 +130,7 @@ As a cluster administrator, you can use a [PodSecurityPolicy](/docs/concepts/pol ### Generic ephemeral volumes -{{< feature-state for_k8s_version="v1.21" state="beta" >}} - -This feature requires the `GenericEphemeralVolume` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) to be -enabled. Because this is a beta feature, it is enabled by default. +{{< feature-state for_k8s_version="v1.23" state="stable" >}} Generic ephemeral volumes are similar to `emptyDir` volumes in the sense that they provide a per-pod directory for scratch data that is @@ -245,7 +242,6 @@ PVCs indirectly if they can create Pods, even if they do not have permission to create PVCs directly. Cluster administrators must be aware of this. If this does not fit their security model, they have two choices: -- Explicitly disable the feature through the feature gate. - Use a [Pod Security Policy](/docs/concepts/policy/pod-security-policy/) where the `volumes` list does not contain the `ephemeral` volume type @@ -274,4 +270,3 @@ See [local ephemeral storage](/docs/concepts/configuration/manage-resources-cont - For more information on the design, see the [Generic ephemeral inline volumes KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-storage/1698-generic-ephemeral-volumes/README.md). -- For more information on further development of this feature, see the [enhancement tracking issue #1698](https://github.com/kubernetes/enhancements/issues/1698). diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 91aa118fa2..01b2310638 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -117,8 +117,6 @@ different Kubernetes components. | `ExpandPersistentVolumes` | `false` | Alpha | 1.8 | 1.10 | | `ExpandPersistentVolumes` | `true` | Beta | 1.11 | | | `ExperimentalHostUserNamespaceDefaulting` | `false` | Beta | 1.5 | | -| `GenericEphemeralVolume` | `false` | Alpha | 1.19 | 1.20 | -| `GenericEphemeralVolume` | `true` | Beta | 1.21 | | | `GracefulNodeShutdown` | `false` | Alpha | 1.20 | 1.20 | | `GracefulNodeShutdown` | `true` | Beta | 1.21 | | | `HPAContainerMetrics` | `false` | Alpha | 1.20 | | @@ -309,6 +307,9 @@ different Kubernetes components. | `ExternalPolicyForExternalIP` | `true` | GA | 1.18 | - | | `GCERegionalPersistentDisk` | `true` | Beta | 1.10 | 1.12 | | `GCERegionalPersistentDisk` | `true` | GA | 1.13 | - | +| `GenericEphemeralVolume` | `false` | Alpha | 1.19 | 1.20 | +| `GenericEphemeralVolume` | `true` | Beta | 1.21 | 1.22 | +| `GenericEphemeralVolume` | `true` | GA | 1.23 | - | | `HugePageStorageMediumSize` | `false` | Alpha | 1.18 | 1.18 | | `HugePageStorageMediumSize` | `true` | Beta | 1.19 | 1.21 | | `HugePageStorageMediumSize` | `true` | GA | 1.22 | - | From 53bf4f212a8353a967892069f992a0b07701f2a7 Mon Sep 17 00:00:00 2001 From: "Umair A. Shahid" Date: Fri, 12 Nov 2021 12:29:34 +0100 Subject: [PATCH 039/148] Kubelet accepts graceful node shutdown parameters in camel case while they are written in the document in pascal case --- content/en/docs/concepts/architecture/nodes.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/content/en/docs/concepts/architecture/nodes.md b/content/en/docs/concepts/architecture/nodes.md index a57d47219e..c5c34940bc 100644 --- a/content/en/docs/concepts/architecture/nodes.md +++ b/content/en/docs/concepts/architecture/nodes.md @@ -402,7 +402,7 @@ Graceful node shutdown is controlled with the `GracefulNodeShutdown` enabled by default in 1.21. Note that by default, both configuration options described below, -`ShutdownGracePeriod` and `ShutdownGracePeriodCriticalPods` are set to zero, +`shutdownGracePeriod` and `shutdownGracePeriodCriticalPods` are set to zero, thus not activating Graceful node shutdown functionality. To activate the feature, the two kubelet config settings should be configured appropriately and set to non-zero values. @@ -412,13 +412,13 @@ During a graceful shutdown, kubelet terminates pods in two phases: 2. Terminate [critical pods](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical) running on the node. Graceful node shutdown feature is configured with two [`KubeletConfiguration`](/docs/tasks/administer-cluster/kubelet-config-file/) options: -* `ShutdownGracePeriod`: +* `shutdownGracePeriod`: * Specifies the total duration that the node should delay the shutdown by. This is the total grace period for pod termination for both regular and [critical pods](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical). -* `ShutdownGracePeriodCriticalPods`: - * Specifies the duration used to terminate [critical pods](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical) during a node shutdown. This value should be less than `ShutdownGracePeriod`. +* `shutdownGracePeriodCriticalPods`: + * Specifies the duration used to terminate [critical pods](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical) during a node shutdown. This value should be less than `shutdownGracePeriod`. -For example, if `ShutdownGracePeriod=30s`, and -`ShutdownGracePeriodCriticalPods=10s`, kubelet will delay the node shutdown by +For example, if `shutdownGracePeriod=30s`, and +`shutdownGracePeriodCriticalPods=10s`, kubelet will delay the node shutdown by 30 seconds. During the shutdown, the first 20 (30-10) seconds would be reserved for gracefully terminating normal pods, and the last 10 seconds would be reserved for terminating [critical pods](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical). From 0913d9ed39bd6d2f39d930c4949ef8cb359a3dee Mon Sep 17 00:00:00 2001 From: Avinash Upadhyaya Date: Sun, 24 Oct 2021 17:52:19 +0530 Subject: [PATCH 040/148] fix: deployment rollout pause and resume wordings fix: revert link change for pausing deployments and some rewording Co-authored-by: Tim Bannister --- .../workloads/controllers/deployment.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/deployment.md b/content/en/docs/concepts/workloads/controllers/deployment.md index 6a5df06c02..ddffd4a11c 100644 --- a/content/en/docs/concepts/workloads/controllers/deployment.md +++ b/content/en/docs/concepts/workloads/controllers/deployment.md @@ -32,7 +32,7 @@ The following are typical use cases for Deployments: * [Declare the new state of the Pods](#updating-a-deployment) by updating the PodTemplateSpec of the Deployment. A new ReplicaSet is created and the Deployment manages moving the Pods from the old ReplicaSet to the new one at a controlled rate. Each new ReplicaSet updates the revision of the Deployment. * [Rollback to an earlier Deployment revision](#rolling-back-a-deployment) if the current state of the Deployment is not stable. Each rollback updates the revision of the Deployment. * [Scale up the Deployment to facilitate more load](#scaling-a-deployment). -* [Pause the Deployment](#pausing-and-resuming-a-deployment) to apply multiple fixes to its PodTemplateSpec and then resume it to start a new rollout. +* [Pause the rollout of a Deployment](#pausing-and-resuming-a-deployment) to apply multiple fixes to its PodTemplateSpec and then resume it to start a new rollout. * [Use the status of the Deployment](#deployment-status) as an indicator that a rollout has stuck. * [Clean up older ReplicaSets](#clean-up-policy) that you don't need anymore. @@ -697,9 +697,12 @@ nginx-deployment-1989198191 7 7 0 7m nginx-deployment-618515232 11 11 11 7m ``` -## Pausing and Resuming a Deployment +## Pausing and Resuming a rollout of a Deployment {#pausing-and-resuming-a-deployment} -You can pause a Deployment before triggering one or more updates and then resume it. This allows you to +When you update a Deployment, or plan to, you can pause rollouts +for that Deployment before you trigger one or more updates. When +you're ready to apply those changes, you resume rollouts for the +Deployment. This approach allows you to apply multiple fixes in between pausing and resuming without triggering unnecessary rollouts. * For example, with a Deployment that was created: @@ -774,10 +777,10 @@ apply multiple fixes in between pausing and resuming without triggering unnecess deployment.apps/nginx-deployment resource requirements updated ``` - The initial state of the Deployment prior to pausing it will continue its function, but new updates to - the Deployment will not have any effect as long as the Deployment is paused. + The initial state of the Deployment prior to pausing its rollout will continue its function, but new updates to + the Deployment will not have any effect as long as the Deployment rollout is paused. -* Eventually, resume the Deployment and observe a new ReplicaSet coming up with all the new updates: +* Eventually, resume the Deployment rollout and observe a new ReplicaSet coming up with all the new updates: ```shell kubectl rollout resume deployment.v1.apps/nginx-deployment ``` @@ -911,8 +914,8 @@ example, rollback the Deployment to its previous version. {{< /note >}} {{< note >}} -If you pause a Deployment, Kubernetes does not check progress against your specified deadline. -You can safely pause a Deployment in the middle of a rollout and resume without triggering +If you pause a Deployment rollout, Kubernetes does not check progress against your specified deadline. +You can safely pause a Deployment rollout in the middle of a rollout and resume without triggering the condition for exceeding the deadline. {{< /note >}} From 62a3baf06cb94c408298d8a6b39564c4cf4f7579 Mon Sep 17 00:00:00 2001 From: Seokho Son Date: Mon, 15 Nov 2021 03:53:10 +0900 Subject: [PATCH 041/148] Fix outdated in ko architecture/nodes --- .../ko/docs/concepts/architecture/nodes.md | 78 +++++++++++++------ 1 file changed, 55 insertions(+), 23 deletions(-) diff --git a/content/ko/docs/concepts/architecture/nodes.md b/content/ko/docs/concepts/architecture/nodes.md index 5ceb5d98ce..09e2264a80 100644 --- a/content/ko/docs/concepts/architecture/nodes.md +++ b/content/ko/docs/concepts/architecture/nodes.md @@ -72,15 +72,16 @@ kubelet이 노드의 `metadata.name` 필드와 일치하는 API 서버에 등록 [이름](/ko/docs/concepts/overview/working-with-objects/names#names)은 노드를 식별한다. 두 노드는 동시에 같은 이름을 가질 수 없다. 쿠버네티스는 또한 같은 이름의 리소스가 동일한 객체라고 가정한다. 노드의 경우, 동일한 이름을 사용하는 인스턴스가 동일한 -상태(예: 네트워크 설정, 루트 디스크 내용)를 갖는다고 암시적으로 가정한다. 인스턴스가 +상태(예: 네트워크 설정, 루트 디스크 내용)와 노드 레이블과 같은 동일한 속성(attribute)을 +갖는다고 암시적으로 가정한다. 인스턴스가 이름을 변경하지 않고 수정된 경우 이로 인해 불일치가 발생할 수 있다. 노드를 대폭 교체하거나 업데이트해야 하는 경우, 기존 노드 오브젝트를 먼저 API 서버에서 제거하고 업데이트 후 다시 추가해야 한다. -### 노드에 대한 자체-등록 +### 노드에 대한 자체-등록(self-registration) -kubelet 플래그 `--register-node`는 참(기본값)일 경우, kubelet 은 API 서버에 -스스로 등록을 시도할 것이다. 이는 대부분의 배포판에 의해 이용되는, 선호하는 패턴이다. +kubelet 플래그 `--register-node`가 참(기본값)일 경우, kubelet은 API 서버에 +스스로 등록을 시도할 것이다. 이는 선호되는 패턴이며, 대부분의 배포판에서 사용된다. 자체-등록에 대해, kubelet은 다음 옵션과 함께 시작된다. @@ -96,7 +97,22 @@ kubelet 플래그 `--register-node`는 참(기본값)일 경우, kubelet 은 API [Node authorization mode](/docs/reference/access-authn-authz/node/)와 [NodeRestriction admission plugin](/docs/reference/access-authn-authz/admission-controllers/#noderestriction)이 활성화 되면, -kubelets 은 자신의 노드 리소스를 생성/수정할 권한을 가진다. +kubelets은 자신의 노드 리소스를 생성/수정할 권한을 가진다. + +{{< note >}} +[노드 이름 고유성](#노드-이름-고유성) 섹션에서 언급했듯이, +노드 구성을 업데이트해야 하는 경우 API 서버에 노드를 +다시 등록하는 것이 좋다. 예를 들어 kubelet이 `--node-labels`의 새로운 구성으로 +다시 시작되더라도, 동일한 노드 이름이 사용된 경우 +레이블이 해당 노드의 등록에 설정되기 때문에 변경 사항이 적용되지 않는다. + +노드에 이미 스케줄된 파드는 해당 노드 구성이 kubelet 재시작에 의해 변경된 경우 +오작동하거나 문제를 일으킬 수 있다. 예를 들어 이미 실행 중인 파드가 노드에 +할당된 새 레이블에 대해 테인트(taint)될 수 있는 반면 해당 파드와 호환되지 않는 다른 파드는 +새 레이블을 기반으로 스케줄링된다. 노드 재-등록(re-registration)은 모든 파드를 +비우고(drain) 다시 적절하게 스케줄링되도록 +한다. +{{< /note >}} #### 수동 노드 관리 @@ -177,7 +193,8 @@ kubectl describe node 대신 코드화된 노드는 사양에 스케줄 불가로 표시된다. {{< /note >}} -쿠버네티스 API에서, 노드의 컨디션은 노드 리소스의 `.status` 부분에 표현된다. 예를 들어, 다음의 JSON 구조는 상태가 양호한 노드를 나타낸다. +쿠버네티스 API에서, 노드의 컨디션은 노드 리소스의 `.status` 부분에 +표현된다. 예를 들어, 다음의 JSON 구조는 상태가 양호한 노드를 나타낸다. ```json "conditions": [ @@ -209,10 +226,12 @@ API 서버와의 통신이 재개될 때까지 파드 삭제에 대한 결정은 대한 여부를 쿠버네티스가 기반 인프라로부터 유추할 수 없는 경우, 노드가 클러스터를 영구적으로 탈퇴하게 되면, 클러스터 관리자는 손수 노드 오브젝트를 삭제해야 할 수도 있다. 쿠버네티스에서 노드 오브젝트를 삭제하면 노드 상에서 동작중인 모든 파드 오브젝트가 -API 서버로부터 삭제되어 그 이름을 사용할 수 있는 결과를 낳는다. +API 서버로부터 삭제되어 그 이름을 사용할 수 있는 결과를 +낳는다. 노드에서 문제가 발생하면, 쿠버네티스 컨트롤 플레인은 자동으로 노드 상태에 영향을 주는 조건과 일치하는 -[테인트(taints)](/ko/docs/concepts/scheduling-eviction/taint-and-toleration/)를 생성한다. +[테인트(taints)](/ko/docs/concepts/scheduling-eviction/taint-and-toleration/)를 +생성한다. 스케줄러는 파드를 노드에 할당 할 때 노드의 테인트를 고려한다. 또한 파드는 노드에 특정 테인트가 있더라도 해당 노드에서 동작하도록 {{< glossary_tooltip text="톨러레이션(toleration)" term_id="toleration" >}}을 가질 수 있다. @@ -235,9 +254,11 @@ API 서버로부터 삭제되어 그 이름을 사용할 수 있는 결과를 ### 정보 -커널 버전, 쿠버네티스 버전 (kubelet과 kube-proxy 버전), 컨테이너 런타임 상세 정보 및 노드가 사용하는 운영 체계가 무엇인지와 같은 노드에 대한 일반적인 정보가 기술된다. - -이 정보는 Kubelet이 노드로부터 수집해서 쿠버네티스 API로 이를 보낸다. +커널 버전, 쿠버네티스 버전 (kubelet과 kube-proxy 버전), 컨테이너 +런타임 상세 정보 및 노드가 사용하는 운영 체계가 무엇인지와 같은 +노드에 대한 일반적인 정보가 기술된다. +이 정보는 Kubelet이 노드로부터 수집해서 +쿠버네티스 API로 이를 보낸다. ## 하트비트 @@ -248,20 +269,25 @@ API 서버로부터 삭제되어 그 이름을 사용할 수 있는 결과를 * 노드의 `.status`에 대한 업데이트 * `kube-node-lease` - {{< glossary_tooltip term_id="namespace" text="네임스페이스">}} 내의 [리스(Lease)](/docs/reference/kubernetes-api/cluster-resources/lease-v1/) 오브젝트. - 각 노드는 연관된 리스 오브젝트를 갖는다. + {{< glossary_tooltip term_id="namespace" text="네임스페이스">}} + 내의 [리스(Lease)](/docs/reference/kubernetes-api/cluster-resources/lease-v1/) + 오브젝트. 각 노드는 연관된 리스 오브젝트를 갖는다. 노드의 `.status`와 비교해서, 리스는 경량의 리소스이다. -큰 규모의 클러스터에서는 리스를 하트비트에 사용해서 업데이트를 위해 필요한 성능 영향도를 줄일 수 있다. +큰 규모의 클러스터에서는 리스를 하트비트에 사용해서 업데이트를 위해 +필요한 성능 영향도를 줄일 수 있다. kubelet은 노드의 `.status` 생성과 업데이트 및 관련된 리스의 업데이트를 담당한다. -- kubelet은 상태가 변경되거나 설정된 인터벌보다 오래 업데이트가 없는 경우 노드의 `.status`를 업데이트한다. - 노드의 `.status` 업데이트에 대한 기본 인터벌은 접근이 불가능한 노드에 대한 타임아웃인 40초 보다 훨씬 긴 5분이다. -- kubelet은 리스 오브젝트를 (기본 업데이트 인터벌인) 매 10초마다 생성하고 업데이트한다. - 리스 업데이트는 노드의 `.status` 업데이트와는 독립적이다. - 만약 리스 업데이트가 실패하면, kubelet은 200밀리초에서 시작하고 7초의 상한을 갖는 지수적 백오프를 사용해서 재시도한다. +- kubelet은 상태가 변경되거나 설정된 인터벌보다 오래 업데이트가 없는 경우 + 노드의 `.status`를 업데이트한다. 노드의 `.status` 업데이트에 대한 기본 + 인터벌은 접근이 불가능한 노드에 대한 타임아웃인 + 40초 보다 훨씬 긴 5분이다. +- kubelet은 리스 오브젝트를 (기본 업데이트 인터벌인) 매 10초마다 + 생성하고 업데이트한다. 리스 업데이트는 노드의 `.status` 업데이트와는 독립적이다. + 만약 리스 업데이트가 실패하면, kubelet은 200밀리초에서 시작하고 + 7초의 상한을 갖는 지수적 백오프를 사용해서 재시도한다. ### 노드 컨트롤러 @@ -280,11 +306,14 @@ kubelet은 노드의 `.status` 생성과 업데이트 및 세 번째는 노드의 동작 상태를 모니터링 하는 것이다. 노드 컨트롤러는 다음을 담당한다. -- 노드가 접근이 불가능한 상태가되는 경우, 노드의 `.status` 내에 있는 NodeReady 컨디션을 업데이트한다. +- 노드가 접근이 불가능한 상태가되는 경우, 노드의 `.status` + 내에 있는 NodeReady 컨디션을 업데이트한다. 이 경우에는 노드 컨트롤러가 NodeReady 컨디션을 `ConditionUnknown`으로 설정한다. - 노드에 계속 접근이 불가능한 상태로 남아있는 경우에는 해당 노드의 모든 파드에 대해서 - [API를 이용한 축출](/docs/concepts/scheduling-eviction/api-eviction/)을 트리거한다. - 기본적으로, 노드 컨트롤러는 노드를 `ConditionUnknown`으로 마킹한 뒤 5분을 기다렸다가 최초의 축출 요청을 시작한다. + [API를 이용한 축출](/docs/concepts/scheduling-eviction/api-eviction/)을 + 트리거한다. 기본적으로, 노드 컨트롤러는 노드를 + `ConditionUnknown`으로 마킹한 뒤 5분을 기다렸다가 + 최초의 축출 요청을 시작한다. 노드 컨트롤러는 매 `--node-monitor-period` 초 마다 각 노드의 상태를 체크한다. @@ -315,7 +344,10 @@ kubelet은 노드의 `.status` 생성과 업데이트 및 그러므로, 하나의 영역 내 모든 노드들이 상태가 불량하면 노드 컨트롤러는 `--node-eviction-rate` 의 정상 속도로 축출한다. 코너 케이스란 모든 영역이 완전히 상태불량(클러스터 내 양호한 노드가 없는 경우)한 경우이다. -이러한 경우, 노드 컨트롤러는 컨트롤 플레인과 노드 간 연결에 문제가 있는 것으로 간주하고 축출을 실행하지 않는다. (중단 이후 일부 노드가 다시 보이는 경우 노드 컨트롤러는 상태가 양호하지 않거나 접근이 불가능한 나머지 노드에서 파드를 축출한다.) +이러한 경우, 노드 컨트롤러는 컨트롤 플레인과 노드 간 연결에 문제가 +있는 것으로 간주하고 축출을 실행하지 않는다. (중단 이후 일부 노드가 +다시 보이는 경우 노드 컨트롤러는 상태가 양호하지 않거나 접근이 불가능한 +나머지 노드에서 파드를 축출한다.) 또한, 노드 컨트롤러는 파드가 테인트를 허용하지 않을 때 `NoExecute` 테인트 상태의 노드에서 동작하는 파드에 대한 축출 책임을 가지고 있다. From 4616e63617705c2b1c2b630b0604d8261971750b Mon Sep 17 00:00:00 2001 From: Seokho Son Date: Mon, 15 Nov 2021 04:14:38 +0900 Subject: [PATCH 042/148] Update outdated in dev-1.22-ko.3 (M2-M3) --- .../cluster-administration/networking.md | 8 +------ .../docs/concepts/extend-kubernetes/_index.md | 23 +++++++++++-------- 2 files changed, 14 insertions(+), 17 deletions(-) diff --git a/content/ko/docs/concepts/cluster-administration/networking.md b/content/ko/docs/concepts/cluster-administration/networking.md index 3f6e103ba7..545c26f420 100644 --- a/content/ko/docs/concepts/cluster-administration/networking.md +++ b/content/ko/docs/concepts/cluster-administration/networking.md @@ -145,7 +145,7 @@ Coil은 베어메탈에 비해 낮은 오버헤드로 작동하며, 외부 네 ### 콘티브(Contiv) -[콘티브](https://github.com/contiv/netplugin)는 다양한 적용 사례에서 구성 가능한 네트워킹(BGP를 사용하는 네이티브 L3, vxlan을 사용하는 오버레이, 클래식 L2 또는 Cisco-SDN/ACI)을 제공한다. [콘티브](https://contiv.io)는 모두 오픈소스이다. +[콘티브](https://github.com/contiv/netplugin)는 다양한 적용 사례에서 구성 가능한 네트워킹(BGP를 사용하는 네이티브 L3, vxlan을 사용하는 오버레이, 클래식 L2 또는 Cisco-SDN/ACI)을 제공한다. ### 콘트레일(Contrail) / 텅스텐 패브릭(Tungsten Fabric) @@ -260,12 +260,6 @@ Multus는 CNI 명세를 구현하는 모든 [레퍼런스 플러그인](https:// [NSX-T 컨테이너 플러그인(NCP)](https://docs.vmware.com/en/VMware-NSX-T/2.0/nsxt_20_ncp_kubernetes.pdf)은 NSX-T와 쿠버네티스와 같은 컨테이너 오케스트레이터 사이의 통합은 물론, NSX-T와 Pivotal 컨테이너 서비스(PKS) 및 OpenShift와 같은 컨테이너 기반 CaaS/PaaS 플랫폼 간의 통합을 제공한다. -### Nuage Networks VCS(가상 클라우드 서비스) - -[Nuage](https://www.nuagenetworks.net)는 확장성이 뛰어난 정책 기반의 소프트웨어 정의 네트워킹(SDN) 플랫폼을 제공한다. Nuage는 개방형 표준을 기반으로 구축된 풍부한 기능의 SDN 컨트롤러와 함께 데이터 플레인용 오픈소스 Open vSwitch를 사용한다. - -Nuage 플랫폼은 오버레이를 사용하여 쿠버네티스 파드와 쿠버네티스가 아닌 환경(VM 및 베어메탈 서버) 간에 완벽한 정책 기반의 네트워킹을 제공한다. Nuage의 정책 추상화 모델은 애플리케이션을 염두에 두고 설계되었으며 애플리케이션에 대한 세분화된 정책을 쉽게 선언할 수 있도록 한다. 플랫폼의 실시간 분석 엔진을 통해 쿠버네티스 애플리케이션에 대한 가시성과 보안 모니터링이 가능하다. - ### OpenVSwitch [OpenVSwitch](https://www.openvswitch.org/)는 다소 성숙하지만 diff --git a/content/ko/docs/concepts/extend-kubernetes/_index.md b/content/ko/docs/concepts/extend-kubernetes/_index.md index 95c61079dd..79466e8df3 100644 --- a/content/ko/docs/concepts/extend-kubernetes/_index.md +++ b/content/ko/docs/concepts/extend-kubernetes/_index.md @@ -2,6 +2,11 @@ title: 쿠버네티스 확장 weight: 110 description: 쿠버네티스 클러스터의 동작을 변경하는 다양한 방법 + + + + + feature: title: 확장성을 고려하여 설계됨 description: > @@ -47,9 +52,9 @@ no_list: true 익스텐션은 쿠버네티스를 확장하고 쿠버네티스와 긴밀하게 통합되는 소프트웨어 컴포넌트이다. 이들 컴포넌트는 쿠버네티스가 새로운 유형과 새로운 종류의 하드웨어를 지원할 수 있게 해준다. -대부분의 클러스터 관리자는 쿠버네티스의 호스팅 또는 배포판 인스턴스를 사용한다. -결과적으로 대부분의 쿠버네티스 사용자는 익스텐션 기능을 설치할 필요가 없고 -새로운 익스텐션 기능을 작성할 필요가 있는 사람은 더 적다. +많은 클러스터 관리자가 호스팅 또는 배포판 쿠버네티스 인스턴스를 사용한다. +이러한 클러스터들은 미리 설치된 익스텐션을 포함한다. 결과적으로 대부분의 +쿠버네티스 사용자는 익스텐션을 설치할 필요가 없고, 새로운 익스텐션을 만들 필요가 있는 사용자는 더 적다. ## 익스텐션 패턴 @@ -74,14 +79,12 @@ no_list: true 바이너리 플러그인은 kubelet(예: [Flex Volume 플러그인](/ko/docs/concepts/storage/volumes/#flexVolume)과 [네트워크 플러그인](/ko/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/))과 -kubectl에서 -사용한다. +kubectl에서 사용한다. 아래는 익스텐션 포인트가 쿠버네티스 컨트롤 플레인과 상호 작용하는 방법을 보여주는 다이어그램이다. - ![익스텐션 포인트와 컨트롤 플레인](/ko/docs/concepts/extend-kubernetes/control-plane.png) ## 익스텐션 포인트 @@ -89,7 +92,6 @@ kubectl에서 이 다이어그램은 쿠버네티스 시스템의 익스텐션 포인트를 보여준다. - ![익스텐션 포인트](/docs/concepts/extend-kubernetes/extension-points.png) 1. 사용자는 종종 `kubectl`을 사용하여 쿠버네티스 API와 상호 작용한다. [Kubectl 플러그인](/ko/docs/tasks/extend-kubectl/kubectl-plugins/)은 kubectl 바이너리를 확장한다. 개별 사용자의 로컬 환경에만 영향을 미치므로 사이트 전체 정책을 적용할 수는 없다. @@ -103,10 +105,10 @@ kubectl에서 어디서부터 시작해야 할지 모르겠다면, 이 플로우 차트가 도움이 될 수 있다. 일부 솔루션에는 여러 유형의 익스텐션이 포함될 수 있다. - ![익스텐션 플로우차트](/ko/docs/concepts/extend-kubernetes/flowchart.png) ## API 익스텐션 + ### 사용자 정의 유형 새 컨트롤러, 애플리케이션 구성 오브젝트 또는 기타 선언적 API를 정의하고 `kubectl` 과 같은 쿠버네티스 도구를 사용하여 관리하려면 쿠버네티스에 커스텀 리소스를 추가하자. @@ -155,7 +157,6 @@ API를 추가해도 기존 API(예: 파드)의 동작에 직접 영향을 미치 ## 인프라스트럭처 익스텐션 - ### 스토리지 플러그인 [Flex Volumes](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/flexvolume-deployment.md)을 사용하면 @@ -172,7 +173,8 @@ Kubelet이 바이너리 플러그인을 호출하여 볼륨을 마운트하도 ### 네트워크 플러그인 -노드-레벨의 [네트워크 플러그인](/ko/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/)을 통해 다양한 네트워킹 패브릭을 지원할 수 있다. +노드-레벨의 [네트워크 플러그인](/ko/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) +을 통해 다양한 네트워킹 패브릭을 지원할 수 있다. ### 스케줄러 익스텐션 @@ -200,3 +202,4 @@ Kubelet이 바이너리 플러그인을 호출하여 볼륨을 마운트하도 * [장치 플러그인](/ko/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/) * [kubectl 플러그인](/ko/docs/tasks/extend-kubectl/kubectl-plugins/)에 대해 알아보기 * [오퍼레이터 패턴](/ko/docs/concepts/extend-kubernetes/operator/)에 대해 알아보기 + From 7373ffe1fdcc72f77d3f99e757c2d61848be2c51 Mon Sep 17 00:00:00 2001 From: Seokho Son Date: Mon, 15 Nov 2021 05:40:16 +0900 Subject: [PATCH 043/148] Apply 1.21-ko.2 enhancement to 1.22-ko.3 --- content/ko/docs/concepts/architecture/nodes.md | 4 ++-- .../ko/docs/concepts/configuration/secret.md | 2 +- content/ko/docs/concepts/containers/_index.md | 2 +- .../compute-storage-net/network-plugins.md | 2 +- .../overview/working-with-objects/labels.md | 6 +++--- .../scheduling-eviction/assign-pod-node.md | 2 +- .../pod-priority-preemption.md | 4 ++-- .../connect-applications-service.md | 4 ++-- .../services-networking/dns-pod-service.md | 2 +- .../services-networking/network-policies.md | 2 +- .../services-networking/service-topology.md | 2 +- content/ko/docs/concepts/storage/volumes.md | 2 +- .../workloads/controllers/daemonset.md | 2 +- .../workloads/controllers/deployment.md | 6 +++--- .../docs/concepts/workloads/controllers/job.md | 2 +- .../workloads/controllers/replicaset.md | 10 +++++----- .../change-default-storage-class.md | 2 +- .../horizontal-pod-autoscale-walkthrough.md | 2 +- .../horizontal-pod-autoscale.md | 2 +- content/ko/docs/tutorials/clusters/apparmor.md | 18 +++++++++--------- 20 files changed, 39 insertions(+), 39 deletions(-) diff --git a/content/ko/docs/concepts/architecture/nodes.md b/content/ko/docs/concepts/architecture/nodes.md index 5ceb5d98ce..b6bf9c1ac7 100644 --- a/content/ko/docs/concepts/architecture/nodes.md +++ b/content/ko/docs/concepts/architecture/nodes.md @@ -51,7 +51,7 @@ weight: 10 ``` 쿠버네티스는 내부적으로 노드 오브젝트를 생성한다(표시한다). 쿠버네티스는 -kubelet이 노드의 `metadata.name` 필드와 일치하는 API 서버에 등록이 되어있는지 확인한다. +kubelet이 노드의 `metadata.name` 필드와 일치하는 API 서버에 등록이 되어 있는지 확인한다. 노드가 정상이면(예를 들어 필요한 모든 서비스가 실행중인 경우) 파드를 실행할 수 있게 된다. 그렇지 않으면, 해당 노드는 정상이 될 때까지 모든 클러스터 활동에 대해 무시된다. @@ -146,7 +146,7 @@ kubectl cordon $NODENAME kubectl describe node ``` -출력되는 각 섹션은 아래에 설명되어있다. +출력되는 각 섹션은 아래에 설명되어 있다. ### 주소 {#addresses} diff --git a/content/ko/docs/concepts/configuration/secret.md b/content/ko/docs/concepts/configuration/secret.md index 8c0630c4b2..891e1def90 100644 --- a/content/ko/docs/concepts/configuration/secret.md +++ b/content/ko/docs/concepts/configuration/secret.md @@ -37,7 +37,7 @@ weight: 30 1. 시크릿에 대한 [암호화 활성화](/docs/tasks/administer-cluster/encrypt-data/). 2. 시크릿의 데이터 읽기 및 쓰기(간접적인 방식 포함)를 제한하는 [RBAC 규칙](/ko/docs/reference/access-authn-authz/authorization/) 활성화 또는 구성. -3. 적절한 경우, RBAC와 같은 메커니즘을 사용하여 새로운 시크릿을 생성하거나 기존 시크릿을 대체할 수 있는 주체(principal)들을 제한한다. +3. 적절한 경우, RBAC과 같은 메커니즘을 사용하여 새로운 시크릿을 생성하거나 기존 시크릿을 대체할 수 있는 주체(principal)들을 제한한다. {{< /caution >}} diff --git a/content/ko/docs/concepts/containers/_index.md b/content/ko/docs/concepts/containers/_index.md index fa56660f1a..7d37a1c4f3 100644 --- a/content/ko/docs/concepts/containers/_index.md +++ b/content/ko/docs/concepts/containers/_index.md @@ -22,7 +22,7 @@ no_list: true ## 컨테이너 이미지 [컨테이너 이미지](/ko/docs/concepts/containers/images/)는 애플리케이션을 -실행하는 데 필요한 모든 것이 포함된 실행할 준비가 되어있는(ready-to-run) 소프트웨어 패키지이다. +실행하는 데 필요한 모든 것이 포함된 실행할 준비가 되어 있는(ready-to-run) 소프트웨어 패키지이다. 여기에는 실행하는 데 필요한 코드와 모든 런타임, 애플리케이션 및 시스템 라이브러리, 그리고 모든 필수 설정에 대한 기본값이 포함된다. diff --git a/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins.md b/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins.md index 359284b357..ce53f997c8 100644 --- a/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins.md +++ b/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins.md @@ -85,7 +85,7 @@ CNI 네트워킹 플러그인은 파드 수신 및 송신 트래픽 셰이핑도 플러그인을 사용하거나 대역폭 제어 기능이 있는 자체 플러그인을 사용할 수 있다. 트래픽 셰이핑 지원을 활성화하려면, CNI 구성 파일 (기본값 `/etc/cni/net.d`)에 `bandwidth` 플러그인을 -추가하고, 바이너리가 CNI 실행 파일 디렉터리(기본값: `/opt/cni/bin`)에 포함되어있는지 확인한다. +추가하고, 바이너리가 CNI 실행 파일 디렉터리(기본값: `/opt/cni/bin`)에 포함되어 있는지 확인한다. ```json { diff --git a/content/ko/docs/concepts/overview/working-with-objects/labels.md b/content/ko/docs/concepts/overview/working-with-objects/labels.md index 571c62b7db..76eda67392 100644 --- a/content/ko/docs/concepts/overview/working-with-objects/labels.md +++ b/content/ko/docs/concepts/overview/working-with-objects/labels.md @@ -50,7 +50,7 @@ _레이블_ 은 키와 값의 쌍이다. 유효한 레이블 키에는 슬래시 접두사를 생략하면 키 레이블은 개인용으로 간주한다. 최종 사용자의 오브젝트에 자동화된 시스템 컴포넌트(예: `kube-scheduler`, `kube-controller-manager`, `kube-apiserver`, `kubectl` 또는 다른 타사의 자동화 구성 요소)의 접두사를 지정해야 한다. -`kubernetes.io/`와 `k8s.io/` 접두사는 쿠버네티스의 핵심 컴포넌트로 [예약](/ko/docs/reference/labels-annotations-taints/)되어있다. +`kubernetes.io/`와 `k8s.io/` 접두사는 쿠버네티스의 핵심 컴포넌트로 [예약](/ko/docs/reference/labels-annotations-taints/)되어 있다. 유효한 레이블 값은 다음과 같다. * 63 자 이하여야 하고 (공백일 수도 있음), @@ -95,7 +95,7 @@ API는 현재 _일치성 기준_ 과 _집합성 기준_ 이라는 두 종류의 {{< /note >}} {{< caution >}} -일치성 기준과 집합성 기준 조건 모두에 대해 논리적인 _OR_ (`||`) 연산자가 없다. 필터 구문이 적절히 구성되어있는지 확인해야 한다. +일치성 기준과 집합성 기준 조건 모두에 대해 논리적인 _OR_ (`||`) 연산자가 없다. 필터 구문이 적절히 구성되어 있는지 확인해야 한다. {{< /caution >}} ### _일치성 기준_ 요건 @@ -231,7 +231,7 @@ selector: - {key: environment, operator: NotIn, values: [dev]} ``` -`matchLabels`는 `{key,value}`의 쌍과 매칭된다. `matchLabels`에 매칭된 단일 `{key,value}`는 `matchExpressions`의 요소와 같으며 `key` 필드는 "key"로, `operator`는 "In" 그리고 `values`에는 "value"만 나열되어 있다. `matchExpressions`는 파드 셀렉터의 요건 목록이다. 유효한 연산자에는 In, NotIn, Exists 및 DoNotExist가 포함된다. In 및 NotIn은 설정된 값이 있어야 한다. `matchLabels`와 `matchExpressions` 모두 AND로 되어있어 일치하기 위해서는 모든 요건을 만족해야 한다. +`matchLabels`는 `{key,value}`의 쌍과 매칭된다. `matchLabels`에 매칭된 단일 `{key,value}`는 `matchExpressions`의 요소와 같으며 `key` 필드는 "key"로, `operator`는 "In" 그리고 `values`에는 "value"만 나열되어 있다. `matchExpressions`는 파드 셀렉터의 요건 목록이다. 유효한 연산자에는 In, NotIn, Exists 및 DoNotExist가 포함된다. In 및 NotIn은 설정된 값이 있어야 한다. `matchLabels`와 `matchExpressions` 모두 AND로 되어 있어 일치하기 위해서는 모든 요건을 만족해야 한다. #### 노드 셋 선택 diff --git a/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md b/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md index d64358ec64..0d099b13e7 100644 --- a/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md +++ b/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md @@ -265,7 +265,7 @@ PodSpec에 지정된 NodeAffinity도 적용된다. `labelSelector` 와 `topologyKey` 외에도 `labelSelector` 와 일치해야 하는 네임스페이스 목록 `namespaces` 를 선택적으로 지정할 수 있다(이것은 `labelSelector` 와 `topologyKey` 와 같은 수준의 정의이다). -생략되어있거나 비어있을 경우 어피니티/안티-어피니티 정의가 있는 파드의 네임스페이스가 기본 값이다. +생략되어 있거나 비어있을 경우 어피니티/안티-어피니티 정의가 있는 파드의 네임스페이스가 기본 값이다. 파드를 노드에 스케줄하려면 `requiredDuringSchedulingIgnoredDuringExecution` 어피니티와 안티-어피니티와 연관된 `matchExpressions` 가 모두 충족되어야 한다. diff --git a/content/ko/docs/concepts/scheduling-eviction/pod-priority-preemption.md b/content/ko/docs/concepts/scheduling-eviction/pod-priority-preemption.md index 6df4ec16b4..96a8f005b1 100644 --- a/content/ko/docs/concepts/scheduling-eviction/pod-priority-preemption.md +++ b/content/ko/docs/concepts/scheduling-eviction/pod-priority-preemption.md @@ -357,11 +357,11 @@ kubelet은 우선순위를 사용하여 파드의 [노드-압박(node-pressure) 사용자는 QoS 클래스를 사용하여 어떤 파드가 축출될 것인지 예상할 수 있다. kubelet은 다음의 요소들을 통해서 파드의 축출 순위를 매긴다. - 1. 부족한 리소스 사용량이 요청을 초과하는지 여부 + 1. 기아(starved) 리소스 사용량이 요청을 초과하는지 여부 1. 파드 우선순위 1. 요청 대비 리소스 사용량 -더 자세한 내용은 [kubelet 축출에서 파드 선택](/ko/docs/concepts/scheduling-eviction/node-pressure-eviction/#kubelet-축출을-위한-파드-선택)을 +더 자세한 내용은 [kubelet 축출을 위한 파드 선택](/ko/docs/concepts/scheduling-eviction/node-pressure-eviction/#kubelet-축출을-위한-파드-선택)을 참조한다. kubelet 노드-압박 축출은 사용량이 요청을 초과하지 않는 경우 diff --git a/content/ko/docs/concepts/services-networking/connect-applications-service.md b/content/ko/docs/concepts/services-networking/connect-applications-service.md index 2b70f86d54..bb7a9154c3 100644 --- a/content/ko/docs/concepts/services-networking/connect-applications-service.md +++ b/content/ko/docs/concepts/services-networking/connect-applications-service.md @@ -56,7 +56,7 @@ kubectl get pods -l run=my-nginx -o yaml | grep podIP 평평하고 넓은 클러스터 전체의 주소 공간에서 nginx를 실행하는 파드가 있다고 가정하자. 이론적으로는 이러한 파드와 직접 대화할 수 있지만, 노드가 죽으면 어떻게 되는가? 파드가 함께 죽으면 디플로이먼트에서 다른 IP를 가진 새로운 파드를 생성한다. 이 문제를 서비스가 해결한다. -쿠버네티스 서비스는 클러스터 어딘가에서 실행되는 논리적인 파드 집합을 정의하고 추상화함으로써 모두 동일한 기능을 제공한다. 생성시 각 서비스에는 고유한 IP 주소(clusterIP라고도 한다)가 할당된다. 이 주소는 서비스의 수명과 연관되어 있으며, 서비스가 활성화 되어있는 동안에는 변경되지 않는다. 파드는 서비스와 통신하도록 구성할 수 있으며, 서비스와의 통신은 서비스의 맴버 중 일부 파드에 자동적으로 로드-밸런싱 된다. +쿠버네티스 서비스는 클러스터 어딘가에서 실행되는 논리적인 파드 집합을 정의하고 추상화함으로써 모두 동일한 기능을 제공한다. 생성시 각 서비스에는 고유한 IP 주소(clusterIP라고도 한다)가 할당된다. 이 주소는 서비스의 수명과 연관되어 있으며, 서비스가 활성화 되어 있는 동안에는 변경되지 않는다. 파드는 서비스와 통신하도록 구성할 수 있으며, 서비스와의 통신은 서비스의 맴버 중 일부 파드에 자동적으로 로드-밸런싱 된다. `kubectl expose` 를 사용해서 2개의 nginx 레플리카에 대한 서비스를 생성할 수 있다. @@ -346,7 +346,7 @@ kubectl exec curl-deployment-1515033274-1410r -- curl https://my-nginx --cacert 노출할 수 있다. 쿠버네티스는 이를 수행하는 2가지 방법인 NodePorts와 LoadBalancers를지원한다. 마지막 섹션에서 생성된 서비스는 이미 `NodePort` 를 사용했기에 노드에 공용 IP가 있는경우 nginx HTTPS 레플리카가 인터넷 트래픽을 처리할 -준비가 되어있다. +준비가 되어 있다. ```shell kubectl get svc my-nginx -o yaml | grep nodePort -C 5 diff --git a/content/ko/docs/concepts/services-networking/dns-pod-service.md b/content/ko/docs/concepts/services-networking/dns-pod-service.md index 5b8dada435..3544d7e745 100644 --- a/content/ko/docs/concepts/services-networking/dns-pod-service.md +++ b/content/ko/docs/concepts/services-networking/dns-pod-service.md @@ -233,7 +233,7 @@ DNS 정책은 파드별로 설정할 수 있다. 자세한 내용을 확인할 수 있다. {{< note >}} -"Default"는 기본 DNS 정책이 아니다. `dnsPolicy`가 명시적으로 지정되어있지 않다면 +"Default"는 기본 DNS 정책이 아니다. `dnsPolicy`가 명시적으로 지정되어 있지 않다면 "ClusterFirst"가 기본값으로 사용된다. {{< /note >}} diff --git a/content/ko/docs/concepts/services-networking/network-policies.md b/content/ko/docs/concepts/services-networking/network-policies.md index bd1bc328f8..6ce089d72f 100644 --- a/content/ko/docs/concepts/services-networking/network-policies.md +++ b/content/ko/docs/concepts/services-networking/network-policies.md @@ -96,7 +96,7 @@ __podSelector__: 각 네트워크폴리시에는 정책이 적용되는 파드 __policyTypes__: 각 네트워크폴리시에는 `Ingress`, `Egress` 또는 두 가지 모두를 포함할 수 있는 `policyTypes` 목록이 포함된다. `policyTypes` 필드는 선택한 파드에 대한 인그레스 트래픽 정책, 선택한 파드에 대한 이그레스 트래픽 정책 또는 두 가지 모두에 지정된 정책의 적용 여부를 나타낸다. 만약 네트워크폴리시에 `policyTypes` 가 지정되어 있지 않으면 기본적으로 `Ingress` 가 항상 설정되고, 네트워크폴리시에 `Egress` 가 있으면 이그레스 규칙이 설정된다. -__ingress__: 각 네트워크폴리시에는 화이트리스트 `ingress` 규칙 목록이 포함될 수 있다. 각 규칙은 `from` 과 `ports` 부분과 모두 일치하는 트래픽을 허용한다. 예시 정책에는 단일 규칙이 포함되어있는데 첫 번째 포트는 `ipBlock` 을 통해 지정되고, 두 번째는 `namespaceSelector` 를 통해 그리고 세 번째는 `podSelector` 를 통해 세 가지 소스 중 하나의 단일 포트에서 발생하는 트래픽과 일치 시킨다. +__ingress__: 각 네트워크폴리시에는 화이트리스트 `ingress` 규칙 목록이 포함될 수 있다. 각 규칙은 `from` 과 `ports` 부분과 모두 일치하는 트래픽을 허용한다. 예시 정책에는 단일 규칙이 포함되어 있는데 첫 번째 포트는 `ipBlock` 을 통해 지정되고, 두 번째는 `namespaceSelector` 를 통해 그리고 세 번째는 `podSelector` 를 통해 세 가지 소스 중 하나의 단일 포트에서 발생하는 트래픽과 일치 시킨다. __egress__: 각 네트워크폴리시에는 화이트리스트 `egress` 규칙이 포함될 수 있다. 각 규칙은 `to` 와 `ports` 부분과 모두 일치하는 트래픽을 허용한다. 예시 정책에는 단일 포트의 트래픽을 `10.0.0.0/24` 의 모든 대상과 일치시키는 단일 규칙을 포함하고 있다. diff --git a/content/ko/docs/concepts/services-networking/service-topology.md b/content/ko/docs/concepts/services-networking/service-topology.md index 47799ba9f7..8814c772c7 100644 --- a/content/ko/docs/concepts/services-networking/service-topology.md +++ b/content/ko/docs/concepts/services-networking/service-topology.md @@ -96,7 +96,7 @@ _서비스 토폴로지_ 를 활성화 하면 서비스는 클러스터의 노 * 유효한 토폴로지 키는 현재 `kubernetes.io/hostname`, `topology.kubernetes.io/zone` 그리고 `topology.kubernetes.io/region` 로 - 제한되어있지만, 앞으로 다른 노드 레이블로 일반화 될 것이다. + 제한되어 있지만, 앞으로 다른 노드 레이블로 일반화 될 것이다. * 토폴로지 키는 유효한 레이블 키이어야 하며 최대 16개의 키를 지정할 수 있다. diff --git a/content/ko/docs/concepts/storage/volumes.md b/content/ko/docs/concepts/storage/volumes.md index 349f47a55c..6771f6fd01 100644 --- a/content/ko/docs/concepts/storage/volumes.md +++ b/content/ko/docs/concepts/storage/volumes.md @@ -358,7 +358,7 @@ targetWWN은 해당 WWN이 다중 경로 연결에서 온 것으로 예상한다 `flocker` 볼륨은 Flocker 데이터셋을 파드에 마운트할 수 있게 한다. 만약 Flocker내에 데이터셋이 없는 경우, 먼저 Flocker CLI 또는 Flocker API를 사용해서 생성해야 한다. 만약 데이터셋이 이미 있다면 -Flocker는 파드가 스케줄 되어있는 노드에 다시 연결한다. 이는 필요에 +Flocker는 파드가 스케줄 되어 있는 노드에 다시 연결한다. 이는 필요에 따라 파드 간에 데이터를 공유할 수 있다는 의미이다. {{< note >}} diff --git a/content/ko/docs/concepts/workloads/controllers/daemonset.md b/content/ko/docs/concepts/workloads/controllers/daemonset.md index c5a1beeb38..2514d56ab3 100644 --- a/content/ko/docs/concepts/workloads/controllers/daemonset.md +++ b/content/ko/docs/concepts/workloads/controllers/daemonset.md @@ -166,7 +166,7 @@ nodeAffinity: 데몬셋의 파드와 통신할 수 있는 몇 가지 패턴은 다음과 같다. - **푸시(Push)**: 데몬셋의 파드는 통계 데이터베이스와 같은 다른 서비스로 업데이트를 보내도록 - 구성되어있다. 그들은 클라이언트들을 가지지 않는다. + 구성되어 있다. 그들은 클라이언트들을 가지지 않는다. - **노드IP와 알려진 포트**: 데몬셋의 파드는 `호스트 포트`를 사용할 수 있으며, 노드IP를 통해 파드에 접근할 수 있다. 클라이언트는 노드IP를 어떻게든지 알고 있으며, 관례에 따라 포트를 알고 있다. diff --git a/content/ko/docs/concepts/workloads/controllers/deployment.md b/content/ko/docs/concepts/workloads/controllers/deployment.md index 6d1a5a9568..8769e2b9fd 100644 --- a/content/ko/docs/concepts/workloads/controllers/deployment.md +++ b/content/ko/docs/concepts/workloads/controllers/deployment.md @@ -50,13 +50,13 @@ _디플로이먼트(Deployment)_ 는 {{< glossary_tooltip text="파드" term_id= 보다 정교한 선택 규칙의 적용이 가능하다. {{< note >}} - `.spec.selector.matchLabels` 필드는 {key,value}의 쌍으로 매핑되어있다. `matchLabels` 에 매핑된 + `.spec.selector.matchLabels` 필드는 {key,value}의 쌍으로 매핑되어 있다. `matchLabels` 에 매핑된 단일 {key,value}은 `matchExpressions` 의 요소에 해당하며, `key` 필드는 "key"에 그리고 `operator`는 "In"에 대응되며 `value` 배열은 "value"만 포함한다. 매칭을 위해서는 `matchLabels` 와 `matchExpressions` 의 모든 요건이 충족되어야 한다. {{< /note >}} -* `template` 필드에는 다음 하위 필드가 포함되어있다. +* `template` 필드에는 다음 하위 필드가 포함되어 있다. * 파드는 `.metadata.labels` 필드를 사용해서 `app: nginx` 라는 레이블을 붙인다. * 파드 템플릿의 사양 또는 `.template.spec` 필드는 파드가 [도커 허브](https://hub.docker.com/)의 `nginx` 1.14.2 버전 이미지를 실행하는 @@ -1023,7 +1023,7 @@ echo $? 디플로이먼트의 `.spec.revisionHistoryLimit` 필드를 설정해서 디플로이먼트에서 유지해야 하는 이전 레플리카셋의 수를 명시할 수 있다. 나머지는 백그라운드에서 가비지-수집이 진행된다. -기본적으로 10으로 되어있다. +기본적으로 10으로 되어 있다. {{< note >}} 명시적으로 이 필드를 0으로 설정하면 그 결과로 디플로이먼트의 기록을 전부 초기화를 하고, diff --git a/content/ko/docs/concepts/workloads/controllers/job.md b/content/ko/docs/concepts/workloads/controllers/job.md index 382495e2f6..3f1666b940 100644 --- a/content/ko/docs/concepts/workloads/controllers/job.md +++ b/content/ko/docs/concepts/workloads/controllers/job.md @@ -369,7 +369,7 @@ spec: 다른 접근 방식들은 기존에 컨테이너화된 애플리케이션에 보다 쉽게 적용할 수 있다. -여기에 트레이드오프가 요약되어있고, 2열에서 4열까지가 위의 트레이드오프에 해당한다. +여기에 트레이드오프가 요약되어 있고, 2열에서 4열까지가 위의 트레이드오프에 해당한다. 패턴 이름은 예시와 더 자세한 설명을 위한 링크이다. | 패턴 | 단일 잡 오브젝트 | 작업 항목보다 파드가 적은가? | 수정되지 않은 앱을 사용하는가? | diff --git a/content/ko/docs/concepts/workloads/controllers/replicaset.md b/content/ko/docs/concepts/workloads/controllers/replicaset.md index 9fd3bbe794..7e02f90ef9 100644 --- a/content/ko/docs/concepts/workloads/controllers/replicaset.md +++ b/content/ko/docs/concepts/workloads/controllers/replicaset.md @@ -50,7 +50,7 @@ OwnerReference가 {{< glossary_tooltip term_id="controller" >}} 가 아니고 {{< codenew file="controllers/frontend.yaml" >}} -이 매니페스트를 `frontend.yaml`에 저장하고 쿠버네티스 클러스터에 적용하면 정의되어있는 레플리카셋이 +이 매니페스트를 `frontend.yaml`에 저장하고 쿠버네티스 클러스터에 적용하면 정의되어 있는 레플리카셋이 생성되고 레플리카셋이 관리하는 파드가 생성된다. ```shell @@ -128,7 +128,7 @@ frontend-wtsmm 1/1 Running 0 6m36s kubectl get pods frontend-b2zdv -o yaml ``` -메타데이터의 ownerReferences 필드에 설정되어있는 프런트엔드 레플리카셋의 정보가 다음과 유사하게 나오는 것을 볼 수 있다. +메타데이터의 ownerReferences 필드에 설정되어 있는 프런트엔드 레플리카셋의 정보가 다음과 유사하게 나오는 것을 볼 수 있다. ```shell apiVersion: v1 @@ -223,7 +223,7 @@ pod2 1/1 Running 0 36s 레플리카셋은 모든 쿠버네티스 API 오브젝트와 마찬가지로 `apiVersion`, `kind`, `metadata` 필드가 필요하다. 레플리카셋에 대한 `kind` 필드의 값은 항상 레플리카셋이다. -쿠버네티스 1.9에서의 레플리카셋의 kind에 있는 API 버전 `apps/v1`은 현재 버전이며, 기본으로 활성화 되어있다. API 버전 `apps/v1beta2`은 사용 중단(deprecated)되었다. +쿠버네티스 1.9에서의 레플리카셋의 kind에 있는 API 버전 `apps/v1`은 현재 버전이며, 기본으로 활성화 되어 있다. API 버전 `apps/v1beta2`은 사용 중단(deprecated)되었다. API 버전에 대해서는 `frontend.yaml` 예제의 첫 번째 줄을 참고한다. 레플리카셋 오브젝트의 이름은 유효한 @@ -233,7 +233,7 @@ API 버전에 대해서는 `frontend.yaml` 예제의 첫 번째 줄을 참고한 ### 파드 템플릿 -`.spec.template`은 레이블을 붙이도록 되어있는 [파드 템플릿](/ko/docs/concepts/workloads/pods/#파드-템플릿)이다. +`.spec.template`은 레이블을 붙이도록 되어 있는 [파드 템플릿](/ko/docs/concepts/workloads/pods/#파드-템플릿)이다. 우리는 `frontend.yaml` 예제에서 `tier: frontend`이라는 레이블을 하나 가지고 있다. 이 파드를 다른 컨트롤러가 취하지 않도록 다른 컨트롤러의 셀렉터와 겹치지 않도록 주의해야 한다. @@ -269,7 +269,7 @@ matchLabels: ### 레플리카셋과 해당 파드 삭제 -레플리카셋 및 모든 파드를 삭제하려면 [`kubectl delete`](/docs/reference/generated/kubectl/kubectl-commands#delete)를 사용한다. [가비지 수집기](/ko/docs/concepts/workloads/controllers/garbage-collection/)는 기본적으로 종속되어있는 모든 파드를 자동으로 삭제한다. +레플리카셋 및 모든 파드를 삭제하려면 [`kubectl delete`](/docs/reference/generated/kubectl/kubectl-commands#delete)를 사용한다. [가비지 수집기](/ko/docs/concepts/workloads/controllers/garbage-collection/)는 기본적으로 종속되어 있는 모든 파드를 자동으로 삭제한다. REST API또는 `client-go` 라이브러리를 이용할 때는 -d 옵션으로 `propagationPolicy`를 `Background`또는 `Foreground`로 설정해야 한다. diff --git a/content/ko/docs/tasks/administer-cluster/change-default-storage-class.md b/content/ko/docs/tasks/administer-cluster/change-default-storage-class.md index ff6379ee1f..2f64503d49 100644 --- a/content/ko/docs/tasks/administer-cluster/change-default-storage-class.md +++ b/content/ko/docs/tasks/administer-cluster/change-default-storage-class.md @@ -80,7 +80,7 @@ content_type: task 최대 1개의 스토리지클래스를 기본값으로 표시할 수 있다는 것을 알아두자. 만약 2개 이상이 기본값으로 표시되면, 명시적으로 `storageClassName` 가 지정되지 않은 `PersistentVolumeClaim` 은 생성될 수 없다. -1. 사용자가 선택한 스토리지클래스가 기본값으로 되어있는지 확인한다. +1. 사용자가 선택한 스토리지클래스가 기본값으로 되어 있는지 확인한다. ```bash kubectl get storageclass diff --git a/content/ko/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md b/content/ko/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md index 1ec1db988c..9b5ea5b6cf 100644 --- a/content/ko/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md +++ b/content/ko/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md @@ -447,7 +447,7 @@ Events: 이 HorizontalPodAutoscaler 경우, 건강 상태의 여러 조건들을 볼 수 있다. 첫 번째 `AbleToScale`는 HPA가 스케일을 가져오고 업데이트할 수 있는지, 백 오프 관련 조건으로 스케일링이 방지되는지 여부를 나타낸다. -두 번째 `ScalingActive`는 HPA가 활성화되어있는지(즉 대상 레플리카 개수가 0이 아닌지), +두 번째 `ScalingActive`는 HPA가 활성화되어 있는지(즉 대상 레플리카 개수가 0이 아닌지), 원하는 스케일을 계산할 수 있는지 여부를 나타낸다. 만약 `False` 인 경우, 일반적으로 메트릭을 가져오는데 문제가 있다. 마지막으로, 마지막 조건인 `ScalingLimited`는 diff --git a/content/ko/docs/tasks/run-application/horizontal-pod-autoscale.md b/content/ko/docs/tasks/run-application/horizontal-pod-autoscale.md index 8ceafa7d6a..96f86ac046 100644 --- a/content/ko/docs/tasks/run-application/horizontal-pod-autoscale.md +++ b/content/ko/docs/tasks/run-application/horizontal-pod-autoscale.md @@ -398,7 +398,7 @@ behavior: 안정화 윈도우는 스케일링에 사용되는 메트릭이 계속 변동할 때 레플리카의 플래핑을 다시 제한하기 위해 사용된다. 안정화 윈도우는 스케일링을 방지하기 위해 과거부터 계산된 의도한 상태를 고려하는 오토스케일링 알고리즘에 의해 사용된다. -다음의 예시에서 `scaleDown` 에 대해 안정화 윈도우가 지정되어있다. +다음의 예시에서 `scaleDown` 에 대해 안정화 윈도우가 지정되어 있다. ```yaml scaleDown: diff --git a/content/ko/docs/tutorials/clusters/apparmor.md b/content/ko/docs/tutorials/clusters/apparmor.md index 7b11ea7722..a8facdaa67 100644 --- a/content/ko/docs/tutorials/clusters/apparmor.md +++ b/content/ko/docs/tutorials/clusters/apparmor.md @@ -346,21 +346,21 @@ Events: [노드 셀렉터](/ko/docs/concepts/scheduling-eviction/assign-pod-node/)를 이용하여 파드가 필요한 프로파일이 있는 노드에서 실행되도록 한다. -### PodSecurityPolicy로 프로파일 제한하기 {#restricting-profiles-with-the-podsecuritypolicy} +### 파드시큐리티폴리시(PodSecurityPolicy)로 프로파일 제한하기 {#restricting-profiles-with-the-podsecuritypolicy} {{< note >}} -PodSecurityPolicy는 쿠버네티스 v1.21에서 사용 중지되었으며, v1.25에서 제거될 예정이다. -더 자세한 내용은 [PodSecurityPolicy 문서](/ko/docs/concepts/policy/pod-security-policy/)를 참고한다. +파드시큐리티폴리시는 쿠버네티스 v1.21에서 사용 중단되었으며, v1.25에서 제거될 예정이다. +더 자세한 내용은 [파드시큐리티폴리시 문서](/ko/docs/concepts/policy/pod-security-policy/)를 참고한다. {{< /note >}} -만약 PodSecurityPolicy 확장을 사용하면, 클러스터 단위로 AppArmor 제한을 적용할 수 있다. -PodSecurityPolicy를 사용하려면 위해 다음의 플래그를 반드시 `apiserver`에 설정해야 한다. +만약 파드시큐리티폴리시 확장을 사용하면, 클러스터 단위로 AppArmor 제한을 적용할 수 있다. +파드시큐리티폴리시를 사용하려면 위해 다음의 플래그를 반드시 `apiserver`에 설정해야 한다. ``` --enable-admission-plugins=PodSecurityPolicy[,others...] ``` -AppArmor 옵션은 PodSecurityPolicy의 어노테이션으로 지정할 수 있다. +AppArmor 옵션은 파드시큐리티폴리시의 어노테이션으로 지정할 수 있다. ```yaml apparmor.security.beta.kubernetes.io/defaultProfileName: @@ -390,7 +390,7 @@ AppArmor가 일반 사용자 버전이 되면 제거된다. ### AppArmor와 함께 쿠버네티스 1.4로 업그레이드 하기 {#upgrading-to-kubernetes-v1.4-with-apparmor} 클러스터 버전을 v1.4로 업그레이드하기 위해 AppArmor쪽 작업은 없다. -그러나 AppArmor 어노테이션을 가진 파드는 유효성 검사(혹은 PodSecurityPolicy 승인)을 거치지 않는다. +그러나 AppArmor 어노테이션을 가진 파드는 유효성 검사(혹은 파드시큐리티폴리시 승인)을 거치지 않는다. 그 노드에 허용 프로파일이 로드되면, 악의적인 사용자가 허가 프로필을 미리 적용하여 파드의 권한을 docker-default 보다 높일 수 있다. 이것이 염려된다면 `apparmor.security.beta.kubernetes.io` 어노테이션이 포함된 @@ -439,7 +439,7 @@ AppArmor 로그는 `dmesg`에서 보이며, 오류는 보통 시스템 로그나 ### 프로파일 참조 {#profile-reference} - `runtime/default`: 기본 런타임 프로파일을 참조한다. - - (기본 PodSecurityPolicy 없이) 프로파일을 지정하지 않고 + - (기본 파드시큐리티폴리시 없이) 프로파일을 지정하지 않고 AppArmor를 사용하는 것과 동등하다. - 도커에서는 권한 없는 컨테이너의 경우는 [`docker-default`](https://docs.docker.com/engine/security/apparmor/) 프로파일로, @@ -451,7 +451,7 @@ AppArmor 로그는 `dmesg`에서 보이며, 오류는 보통 시스템 로그나 다른 어떤 프로파일 참조 형식도 유효하지 않다. -### PodSecurityPolicy 어노테이션 {#podsecuritypolicy-annotations} +### 파드시큐리티폴리시 어노테이션 {#podsecuritypolicy-annotations} 아무 프로파일도 제공하지 않을 때에 컨테이너에 적용할 기본 프로파일을 지정하기 From 0d09bd668fb83d576dcc8c398e66d4d0928c4dc2 Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Mon, 15 Nov 2021 15:11:00 +0900 Subject: [PATCH 044/148] [ko] Update links in dev-1.22-ko.3 --- .../architecture/control-plane-node-communication.md | 2 +- content/ko/docs/concepts/architecture/nodes.md | 10 +++++----- .../docs/concepts/cluster-administration/_index.md | 2 +- .../kubelet-garbage-collection.md | 2 +- content/ko/docs/concepts/configuration/secret.md | 12 ++++++------ .../concepts/containers/container-environment.md | 2 +- .../ko/docs/concepts/policy/pod-security-policy.md | 2 +- .../ko/docs/concepts/scheduling-eviction/_index.md | 2 +- .../concepts/scheduling-eviction/api-eviction.md | 2 +- .../concepts/scheduling-eviction/kube-scheduler.md | 2 +- .../scheduling-eviction/pod-priority-preemption.md | 2 +- .../services-networking/ingress-controllers.md | 2 +- .../ko/docs/concepts/services-networking/ingress.md | 4 ++-- .../services-networking/service-traffic-policy.md | 2 +- content/ko/docs/concepts/storage/volumes.md | 2 +- content/ko/docs/concepts/workloads/_index.md | 2 +- .../docs/concepts/workloads/controllers/daemonset.md | 2 +- .../concepts/workloads/controllers/deployment.md | 2 +- .../concepts/workloads/controllers/statefulset.md | 2 +- .../ko/docs/concepts/workloads/pods/disruptions.md | 4 ++-- .../concepts/workloads/pods/ephemeral-containers.md | 2 +- .../ko/docs/concepts/workloads/pods/pod-lifecycle.md | 2 +- content/ko/docs/contribute/_index.md | 2 +- content/ko/docs/contribute/advanced.md | 2 +- content/ko/docs/contribute/new-content/open-a-pr.md | 2 +- content/ko/docs/contribute/participate/_index.md | 2 +- .../participate/roles-and-responsibilities.md | 2 +- content/ko/docs/contribute/review/reviewing-prs.md | 2 +- content/ko/docs/contribute/style/write-new-topic.md | 2 +- .../command-line-tools-reference/feature-gates.md | 12 ++++++------ content/ko/docs/reference/glossary/sysctl.md | 2 +- .../docs/reference/kubectl/docker-cli-to-kubectl.md | 2 +- .../windows/user-guide-windows-containers.md | 2 +- .../access-application-cluster/web-ui-dashboard.md | 2 +- .../docs/tasks/administer-cluster/sysctl-cluster.md | 2 +- .../configure-runasusername.md | 2 +- .../debug-pod-replication-controller.md | 2 +- .../debug-application-cluster/debug-running-pod.md | 4 ++-- .../debug-application-cluster/debug-stateful-set.md | 2 +- .../define-command-argument-container.md | 2 +- .../define-environment-variable-container.md | 2 +- .../define-interdependent-environment-variables.md | 2 +- .../downward-api-volume-expose-pod-information.md | 8 ++++---- .../environment-variable-expose-pod-information.md | 4 ++-- .../docs/tasks/job/automated-tasks-with-cron-jobs.md | 2 +- .../ko/docs/tasks/manage-daemon/update-daemon-set.md | 2 +- .../tasks/run-application/delete-stateful-set.md | 4 ++-- .../run-application/force-delete-stateful-set-pod.md | 2 +- .../run-single-instance-stateful-application.md | 2 +- content/ko/docs/tutorials/hello-minikube.md | 2 +- .../mysql-wordpress-persistent-volume.md | 2 +- 51 files changed, 73 insertions(+), 73 deletions(-) diff --git a/content/ko/docs/concepts/architecture/control-plane-node-communication.md b/content/ko/docs/concepts/architecture/control-plane-node-communication.md index 52fa728043..00f99d07ea 100644 --- a/content/ko/docs/concepts/architecture/control-plane-node-communication.md +++ b/content/ko/docs/concepts/architecture/control-plane-node-communication.md @@ -67,4 +67,4 @@ SSH 터널은 현재 더 이상 사용되지 않으므로, 수행 중인 작업 SSH 터널을 대체하는 Konnectivity 서비스는 컨트롤 플레인에서 클러스터 통신에 TCP 레벨 프록시를 제공한다. Konnectivity 서비스는 컨트롤 플레인 네트워크의 Konnectivity 서버와 노드 네트워크의 Konnectivity 에이전트, 두 부분으로 구성된다. Konnectivity 에이전트는 Konnectivity 서버에 대한 연결을 시작하고 네트워크 연결을 유지한다. Konnectivity 서비스를 활성화한 후, 모든 컨트롤 플레인에서 노드로의 트래픽은 이 연결을 통과한다. -[Konnectivity 서비스 태스크](/docs/tasks/extend-kubernetes/setup-konnectivity/)에 따라 클러스터에서 Konnectivity 서비스를 설정한다. +[Konnectivity 서비스 태스크](/ko/docs/tasks/extend-kubernetes/setup-konnectivity/)에 따라 클러스터에서 Konnectivity 서비스를 설정한다. diff --git a/content/ko/docs/concepts/architecture/nodes.md b/content/ko/docs/concepts/architecture/nodes.md index b6bf9c1ac7..dd37c35a3a 100644 --- a/content/ko/docs/concepts/architecture/nodes.md +++ b/content/ko/docs/concepts/architecture/nodes.md @@ -283,7 +283,7 @@ kubelet은 노드의 `.status` 생성과 업데이트 및 - 노드가 접근이 불가능한 상태가되는 경우, 노드의 `.status` 내에 있는 NodeReady 컨디션을 업데이트한다. 이 경우에는 노드 컨트롤러가 NodeReady 컨디션을 `ConditionUnknown`으로 설정한다. - 노드에 계속 접근이 불가능한 상태로 남아있는 경우에는 해당 노드의 모든 파드에 대해서 - [API를 이용한 축출](/docs/concepts/scheduling-eviction/api-eviction/)을 트리거한다. + [API를 이용한 축출](/ko/docs/concepts/scheduling-eviction/api-eviction/)을 트리거한다. 기본적으로, 노드 컨트롤러는 노드를 `ConditionUnknown`으로 마킹한 뒤 5분을 기다렸다가 최초의 축출 요청을 시작한다. 노드 컨트롤러는 매 `--node-monitor-period` 초 마다 각 노드의 상태를 체크한다. @@ -377,19 +377,19 @@ Kubelet은 노드가 종료되는 동안 파드가 일반 [파드 종료 프로 그레이스풀 셧다운 중에 kubelet은 다음의 두 단계로 파드를 종료한다. 1. 노드에서 실행 중인 일반 파드를 종료시킨다. -2. 노드에서 실행 중인 [중요(critical) 파드](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical)를 종료시킨다. +2. 노드에서 실행 중인 [중요(critical) 파드](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#파드를-중요-critical-로-표시하기)를 종료시킨다. 그레이스풀 노드 셧다운 기능은 두 개의 [`KubeletConfiguration`](/docs/tasks/administer-cluster/kubelet-config-file/) 옵션으로 구성된다. * `ShutdownGracePeriod`: - * 노드가 종료를 지연해야 하는 총 기간을 지정한다. 이것은 모든 일반 및 [중요 파드](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical)의 파드 종료에 필요한 총 유예 기간에 해당한다. + * 노드가 종료를 지연해야 하는 총 기간을 지정한다. 이것은 모든 일반 및 [중요 파드](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#파드를-중요-critical-로-표시하기)의 파드 종료에 필요한 총 유예 기간에 해당한다. * `ShutdownGracePeriodCriticalPods`: - * 노드 종료 중에 [중요 파드](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical)를 종료하는 데 사용되는 기간을 지정한다. 이 값은 `ShutdownGracePeriod` 보다 작아야 한다. + * 노드 종료 중에 [중요 파드](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#파드를-중요-critical-로-표시하기)를 종료하는 데 사용되는 기간을 지정한다. 이 값은 `ShutdownGracePeriod` 보다 작아야 한다. 예를 들어, `ShutdownGracePeriod=30s`, `ShutdownGracePeriodCriticalPods=10s` 인 경우, kubelet은 노드 종료를 30초까지 지연시킨다. 종료하는 동안 처음 20(30-10)초는 일반 파드의 유예 종료에 할당되고, 마지막 10초는 -[중요 파드](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical)의 종료에 할당된다. +[중요 파드](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#파드를-중요-critical-로-표시하기)의 종료에 할당된다. {{< note >}} 그레이스풀 노드 셧다운 과정에서 축출된 파드는 `Failed` 라고 표시된다. diff --git a/content/ko/docs/concepts/cluster-administration/_index.md b/content/ko/docs/concepts/cluster-administration/_index.md index f5363a45c2..5879f3cf8f 100644 --- a/content/ko/docs/concepts/cluster-administration/_index.md +++ b/content/ko/docs/concepts/cluster-administration/_index.md @@ -57,7 +57,7 @@ no_list: true * [어드미션 컨트롤러 사용하기](/docs/reference/access-authn-authz/admission-controllers/)는 인증과 권한 부여 후 쿠버네티스 API 서버에 대한 요청을 가로채는 플러그인에 대해 설명한다. -* [쿠버네티스 클러스터에서 Sysctls 사용하기](/docs/tasks/administer-cluster/sysctl-cluster/)는 관리자가 `sysctl` 커맨드라인 도구를 사용하여 커널 파라미터를 설정하는 방법에 대해 설명한다. +* [쿠버네티스 클러스터에서 Sysctls 사용하기](/ko/docs/tasks/administer-cluster/sysctl-cluster/)는 관리자가 `sysctl` 커맨드라인 도구를 사용하여 커널 파라미터를 설정하는 방법에 대해 설명한다. * [감사(audit)](/docs/tasks/debug-application-cluster/audit/)는 쿠버네티스의 감사 로그를 다루는 방법에 대해 설명한다. diff --git a/content/ko/docs/concepts/cluster-administration/kubelet-garbage-collection.md b/content/ko/docs/concepts/cluster-administration/kubelet-garbage-collection.md index 6db0871e48..a21715e4b3 100644 --- a/content/ko/docs/concepts/cluster-administration/kubelet-garbage-collection.md +++ b/content/ko/docs/concepts/cluster-administration/kubelet-garbage-collection.md @@ -105,5 +105,5 @@ kubelet이 관리하지 않는 컨테이너는 컨테이너 가비지 수집 대 ## {{% heading "whatsnext" %}} -자세한 내용은 [리소스 부족 처리 구성](/docs/concepts/scheduling-eviction/node-pressure-eviction/)를 +자세한 내용은 [리소스 부족 처리 구성](/ko/docs/concepts/scheduling-eviction/node-pressure-eviction/)를 본다. diff --git a/content/ko/docs/concepts/configuration/secret.md b/content/ko/docs/concepts/configuration/secret.md index 891e1def90..73d48cd18b 100644 --- a/content/ko/docs/concepts/configuration/secret.md +++ b/content/ko/docs/concepts/configuration/secret.md @@ -425,9 +425,9 @@ stringData: 시크릿을 생성하기 위한 몇 가지 옵션이 있다. -- [`kubectl` 명령을 사용하여 시크릿 생성하기](/docs/tasks/configmap-secret/managing-secret-using-kubectl/) -- [구성 파일로 시크릿 생성하기](/docs/tasks/configmap-secret/managing-secret-using-config-file/) -- [kustomize를 사용하여 시크릿 생성하기](/docs/tasks/configmap-secret/managing-secret-using-kustomize/) +- [`kubectl` 명령을 사용하여 시크릿 생성하기](/ko/docs/tasks/configmap-secret/managing-secret-using-kubectl/) +- [구성 파일로 시크릿 생성하기](/ko/docs/tasks/configmap-secret/managing-secret-using-config-file/) +- [kustomize를 사용하여 시크릿 생성하기](/ko/docs/tasks/configmap-secret/managing-secret-using-kustomize/) ## 시크릿 편집하기 @@ -1259,7 +1259,7 @@ API 서버에서 kubelet으로의 통신은 SSL/TLS로 보호된다. ## {{% heading "whatsnext" %}} -- [`kubectl` 을 사용한 시크릿 관리](/docs/tasks/configmap-secret/managing-secret-using-kubectl/)하는 방법 배우기 -- [구성 파일을 사용한 시크릿 관리](/docs/tasks/configmap-secret/managing-secret-using-config-file/)하는 방법 배우기 -- [kustomize를 사용한 시크릿 관리](/docs/tasks/configmap-secret/managing-secret-using-kustomize/)하는 방법 배우기 +- [`kubectl` 을 사용한 시크릿 관리](/ko/docs/tasks/configmap-secret/managing-secret-using-kubectl/)하는 방법 배우기 +- [구성 파일을 사용한 시크릿 관리](/ko/docs/tasks/configmap-secret/managing-secret-using-config-file/)하는 방법 배우기 +- [kustomize를 사용한 시크릿 관리](/ko/docs/tasks/configmap-secret/managing-secret-using-kustomize/)하는 방법 배우기 - [API 레퍼런스](/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/)에서 `Secret`에 대해 읽기 diff --git a/content/ko/docs/concepts/containers/container-environment.md b/content/ko/docs/concepts/containers/container-environment.md index 18ed0aadd3..fe6010d961 100644 --- a/content/ko/docs/concepts/containers/container-environment.md +++ b/content/ko/docs/concepts/containers/container-environment.md @@ -32,7 +32,7 @@ weight: 20 함수 호출을 통해서 구할 수 있다. 파드 이름과 네임스페이스는 -[다운워드(Downward) API](/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/)를 통해 환경 변수로 구할 수 있다. +[다운워드(Downward) API](/ko/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/)를 통해 환경 변수로 구할 수 있다. Docker 이미지에 정적으로 명시된 환경 변수와 마찬가지로, 파드 정의에서의 사용자 정의 환경 변수도 컨테이너가 사용할 수 있다. diff --git a/content/ko/docs/concepts/policy/pod-security-policy.md b/content/ko/docs/concepts/policy/pod-security-policy.md index ff98e134eb..91f431b22d 100644 --- a/content/ko/docs/concepts/policy/pod-security-policy.md +++ b/content/ko/docs/concepts/policy/pod-security-policy.md @@ -695,7 +695,7 @@ spec: - `allowedUnsafeSysctls` - `forbiddenSysctls`에 나열되지 않는 한 기본 목록에서 허용하지 않은 특정 sysctls를 허용한다. [Sysctl 문서]( -/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy)를 참고하길 바란다. +/ko/docs/tasks/administer-cluster/sysctl-cluster/#파드시큐리티폴리시-podsecuritypolicy)를 참고하길 바란다. ## {{% heading "whatsnext" %}} diff --git a/content/ko/docs/concepts/scheduling-eviction/_index.md b/content/ko/docs/concepts/scheduling-eviction/_index.md index 7128dbe99f..7ee5c488ed 100644 --- a/content/ko/docs/concepts/scheduling-eviction/_index.md +++ b/content/ko/docs/concepts/scheduling-eviction/_index.md @@ -33,5 +33,5 @@ no_list: true {{}} * [파드 우선순위와 선점](/ko/docs/concepts/scheduling-eviction/pod-priority-preemption/) -* [노드-압박 축출](/docs/concepts/scheduling-eviction/node-pressure-eviction/) +* [노드-압박 축출](/ko/docs/concepts/scheduling-eviction/node-pressure-eviction/) * [API를 이용한 축출](/ko/docs/concepts/scheduling-eviction/api-eviction/) diff --git a/content/ko/docs/concepts/scheduling-eviction/api-eviction.md b/content/ko/docs/concepts/scheduling-eviction/api-eviction.md index 53724320b0..45077a6674 100644 --- a/content/ko/docs/concepts/scheduling-eviction/api-eviction.md +++ b/content/ko/docs/concepts/scheduling-eviction/api-eviction.md @@ -14,5 +14,5 @@ API를 이용한 축출은 구성된 [`PodDisruptionBudgets`](/docs/tasks/run-ap ## {{% heading "whatsnext" %}} -- [노드-압박 축출](/docs/concepts/scheduling-eviction/node-pressure-eviction/)에 대해 더 배우기 +- [노드-압박 축출](/ko/docs/concepts/scheduling-eviction/node-pressure-eviction/)에 대해 더 배우기 - [파드 우선순위와 선점](/ko/docs/concepts/scheduling-eviction/pod-priority-preemption/)에 대해 더 배우기 diff --git a/content/ko/docs/concepts/scheduling-eviction/kube-scheduler.md b/content/ko/docs/concepts/scheduling-eviction/kube-scheduler.md index 5b0a1648c3..1c4424a047 100644 --- a/content/ko/docs/concepts/scheduling-eviction/kube-scheduler.md +++ b/content/ko/docs/concepts/scheduling-eviction/kube-scheduler.md @@ -91,5 +91,5 @@ _스코어링_ 단계에서 스케줄러는 목록에 남아있는 노드의 순 * [파드 오버헤드](/ko/docs/concepts/scheduling-eviction/pod-overhead/)에 대해 배우기 * 볼륨을 사용하는 파드의 스케줄링에 대해 배우기 * [볼륨 토폴리지 지원](/ko/docs/concepts/storage/storage-classes/#볼륨-바인딩-모드) - * [스토리지 용량 추적](/docs/concepts/storage/storage-capacity/) + * [스토리지 용량 추적](/ko/docs/concepts/storage/storage-capacity/) * [노드별 볼륨 한도](/ko/docs/concepts/storage/storage-limits/) diff --git a/content/ko/docs/concepts/scheduling-eviction/pod-priority-preemption.md b/content/ko/docs/concepts/scheduling-eviction/pod-priority-preemption.md index 96a8f005b1..1f78510759 100644 --- a/content/ko/docs/concepts/scheduling-eviction/pod-priority-preemption.md +++ b/content/ko/docs/concepts/scheduling-eviction/pod-priority-preemption.md @@ -48,7 +48,7 @@ weight: 70 {{< note >}} 쿠버네티스는 이미 `system-cluster-critical` 과 `system-node-critical`, 두 개의 프라이어리티클래스를 제공한다. -이들은 일반적인 클래스이며 [중요한(critical) 컴포넌트가 항상 먼저 스케줄링이 되도록 하는 데](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/) 사용된다. +이들은 일반적인 클래스이며 [중요한(critical) 컴포넌트가 항상 먼저 스케줄링이 되도록 하는 데](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/) 사용된다. {{< /note >}} ## 프라이어리티클래스 diff --git a/content/ko/docs/concepts/services-networking/ingress-controllers.md b/content/ko/docs/concepts/services-networking/ingress-controllers.md index b43467d936..c66a9b6e84 100644 --- a/content/ko/docs/concepts/services-networking/ingress-controllers.md +++ b/content/ko/docs/concepts/services-networking/ingress-controllers.md @@ -76,4 +76,4 @@ weight: 40 * [인그레스](/ko/docs/concepts/services-networking/ingress/)에 대해 자세히 알아보기. -* [NGINX 컨트롤러로 Minikube에서 인그레스를 설정하기](/docs/tasks/access-application-cluster/ingress-minikube). +* [NGINX 컨트롤러로 Minikube에서 인그레스를 설정하기](/ko/docs/tasks/access-application-cluster/ingress-minikube/). diff --git a/content/ko/docs/concepts/services-networking/ingress.md b/content/ko/docs/concepts/services-networking/ingress.md index e9e5f12a05..bafb216014 100644 --- a/content/ko/docs/concepts/services-networking/ingress.md +++ b/content/ko/docs/concepts/services-networking/ingress.md @@ -77,7 +77,7 @@ graph LR; 다른 모든 쿠버네티스 리소스와 마찬가지로 인그레스에는 `apiVersion`, `kind`, 그리고 `metadata` 필드가 필요하다. 인그레스 오브젝트의 이름은 유효한 [DNS 서브도메인 이름](/ko/docs/concepts/overview/working-with-objects/names/#dns-서브도메인-이름)이어야 한다. -설정 파일의 작성에 대한 일반적인 내용은 [애플리케이션 배포하기](/docs/tasks/run-application/run-stateless-application-deployment/), [컨테이너 구성하기](/docs/tasks/configure-pod-container/configure-pod-configmap/), [리소스 관리하기](/ko/docs/concepts/cluster-administration/manage-deployment/)를 참조한다. +설정 파일의 작성에 대한 일반적인 내용은 [애플리케이션 배포하기](/ko/docs/tasks/run-application/run-stateless-application-deployment/), [컨테이너 구성하기](/docs/tasks/configure-pod-container/configure-pod-configmap/), [리소스 관리하기](/ko/docs/concepts/cluster-administration/manage-deployment/)를 참조한다. 인그레스는 종종 어노테이션을 이용해서 인그레스 컨트롤러에 따라 몇 가지 옵션을 구성하는데, 그 예시는 [재작성-타겟 어노테이션](https://github.com/kubernetes/ingress-nginx/blob/master/docs/examples/rewrite/README.md)이다. 다른 [인그레스 컨트롤러](/ko/docs/concepts/services-networking/ingress-controllers)는 다른 어노테이션을 지원한다. @@ -567,4 +567,4 @@ Events: * [인그레스 API](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#ingress-v1beta1-networking-k8s-io)에 대해 배우기 * [인그레스 컨트롤러](/ko/docs/concepts/services-networking/ingress-controllers/)에 대해 배우기 -* [NGINX 컨트롤러로 Minikube에서 인그레스 구성하기](/docs/tasks/access-application-cluster/ingress-minikube/) +* [NGINX 컨트롤러로 Minikube에서 인그레스 구성하기](/ko/docs/tasks/access-application-cluster/ingress-minikube/) diff --git a/content/ko/docs/concepts/services-networking/service-traffic-policy.md b/content/ko/docs/concepts/services-networking/service-traffic-policy.md index c4f87e2b3e..f658cd6cfa 100644 --- a/content/ko/docs/concepts/services-networking/service-traffic-policy.md +++ b/content/ko/docs/concepts/services-networking/service-traffic-policy.md @@ -68,6 +68,6 @@ kube-proxy는 `spec.internalTrafficPolicy` 의 설정에 따라서 라우팅되 ## {{% heading "whatsnext" %}} -* [토폴로지 인식 힌트 활성화](/docs/tasks/administer-cluster/enabling-topology-aware-hints)에 대해서 읽기 +* [토폴로지 인식 힌트 활성화](/ko/docs/tasks/administer-cluster/enabling-topology-aware-hints/)에 대해서 읽기 * [서비스 외부 트래픽 정책](/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip)에 대해서 읽기 * [서비스와 애플리케이션 연결하기](/ko/docs/concepts/services-networking/connect-applications-service/) 읽기 diff --git a/content/ko/docs/concepts/storage/volumes.md b/content/ko/docs/concepts/storage/volumes.md index 6771f6fd01..5983c37647 100644 --- a/content/ko/docs/concepts/storage/volumes.md +++ b/content/ko/docs/concepts/storage/volumes.md @@ -280,7 +280,7 @@ spec: 업데이트를 수신하지 않는다. {{< /note >}} -더 자세한 내용은 [다운워드 API 예시](/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/)를 참고한다. +더 자세한 내용은 [다운워드 API 예시](/ko/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/)를 참고한다. ### emptyDir {#emptydir} diff --git a/content/ko/docs/concepts/workloads/_index.md b/content/ko/docs/concepts/workloads/_index.md index ff1c62221c..e42f482a32 100644 --- a/content/ko/docs/concepts/workloads/_index.md +++ b/content/ko/docs/concepts/workloads/_index.md @@ -60,7 +60,7 @@ _모든_ 파드가 가용한 경우가 아닌 경우 멈추고 싶다면(아마 각 리소스에 대해 읽을 수 있을 뿐만 아니라, 리소스와 관련된 특정 작업에 대해서도 알아볼 수 있다. -* [`Deployment` 를 사용하여 스테이트리스(stateless) 애플리케이션 실행](/docs/tasks/run-application/run-stateless-application-deployment/) +* [`Deployment` 를 사용하여 스테이트리스(stateless) 애플리케이션 실행](/ko/docs/tasks/run-application/run-stateless-application-deployment/) * 스테이트풀(stateful) 애플리케이션을 [단일 인스턴스](/ko/docs/tasks/run-application/run-single-instance-stateful-application/) 또는 [복제된 세트](/docs/tasks/run-application/run-replicated-stateful-application/)로 실행 * [`CronJob` 을 사용하여 자동화된 작업 실행](/ko/docs/tasks/job/automated-tasks-with-cron-jobs/) diff --git a/content/ko/docs/concepts/workloads/controllers/daemonset.md b/content/ko/docs/concepts/workloads/controllers/daemonset.md index 2514d56ab3..33b8812d1a 100644 --- a/content/ko/docs/concepts/workloads/controllers/daemonset.md +++ b/content/ko/docs/concepts/workloads/controllers/daemonset.md @@ -47,7 +47,7 @@ kubectl apply -f https://k8s.io/examples/controllers/daemonset.yaml 다른 모든 쿠버네티스 설정과 마찬가지로 데몬셋에는 `apiVersion`, `kind` 그리고 `metadata` 필드가 필요하다. 일반적인 설정파일 작업에 대한 정보는 -[스테이트리스 애플리케이션 실행하기](/docs/tasks/run-application/run-stateless-application-deployment/)와 +[스테이트리스 애플리케이션 실행하기](/ko/docs/tasks/run-application/run-stateless-application-deployment/)와 [kubectl을 사용한 오브젝트 관리](/ko/docs/concepts/overview/working-with-objects/object-management/)를 참고한다. 데몬셋 오브젝트의 이름은 유효한 diff --git a/content/ko/docs/concepts/workloads/controllers/deployment.md b/content/ko/docs/concepts/workloads/controllers/deployment.md index 8769e2b9fd..fc82199883 100644 --- a/content/ko/docs/concepts/workloads/controllers/deployment.md +++ b/content/ko/docs/concepts/workloads/controllers/deployment.md @@ -1040,7 +1040,7 @@ echo $? 다른 모든 쿠버네티스 설정과 마찬가지로 디플로이먼트에는 `.apiVersion`, `.kind` 그리고 `.metadata` 필드가 필요하다. 설정 파일 작업에 대한 일반적인 내용은 -[애플리케이션 배포하기](/docs/tasks/run-application/run-stateless-application-deployment/), +[애플리케이션 배포하기](/ko/docs/tasks/run-application/run-stateless-application-deployment/), 컨테이너 구성하기 그리고 [kubectl을 사용해서 리소스 관리하기](/ko/docs/concepts/overview/working-with-objects/object-management/) 문서를 참조한다. 디플로이먼트 오브젝트의 이름은 유효한 [DNS 서브도메인 이름](/ko/docs/concepts/overview/working-with-objects/names/#dns-서브도메인-이름)이어야 한다. diff --git a/content/ko/docs/concepts/workloads/controllers/statefulset.md b/content/ko/docs/concepts/workloads/controllers/statefulset.md index 9bb8b4a345..e09a08ab47 100644 --- a/content/ko/docs/concepts/workloads/controllers/statefulset.md +++ b/content/ko/docs/concepts/workloads/controllers/statefulset.md @@ -189,7 +189,7 @@ N개의 레플리카가 있는 스테이트풀셋은 스테이트풀셋에 있 * 파드에 스케일링 작업을 적용하기 전에 모든 선행 파드가 Running 및 Ready 상태여야 한다. * 파드가 종료되기 전에 모든 후속 파드가 완전히 종료 되어야 한다. -스테이트풀셋은 `pod.Spec.TerminationGracePeriodSeconds` 을 0으로 명시해서는 안된다. 이 방법은 안전하지 않으며, 사용하지 않기를 강권한다. 자세한 설명은 [스테이트풀셋 파드 강제 삭제](/docs/tasks/run-application/force-delete-stateful-set-pod/)를 참고한다. +스테이트풀셋은 `pod.Spec.TerminationGracePeriodSeconds` 을 0으로 명시해서는 안된다. 이 방법은 안전하지 않으며, 사용하지 않기를 강권한다. 자세한 설명은 [스테이트풀셋 파드 강제 삭제](/ko/docs/tasks/run-application/force-delete-stateful-set-pod/)를 참고한다. 위의 nginx 예시가 생성될 때 web-0, web-1, web-2 순서로 3개 파드가 배포된다. web-1은 web-0이 diff --git a/content/ko/docs/concepts/workloads/pods/disruptions.md b/content/ko/docs/concepts/workloads/pods/disruptions.md index 497d857d11..4a5452a826 100644 --- a/content/ko/docs/concepts/workloads/pods/disruptions.md +++ b/content/ko/docs/concepts/workloads/pods/disruptions.md @@ -31,7 +31,7 @@ weight: 60 - 클라우드 공급자 또는 하이퍼바이저의 오류로 인한 VM 장애 - 커널 패닉 - 클러스터 네트워크 파티션의 발생으로 클러스터에서 노드가 사라짐 -- 노드의 [리소스 부족](/docs/concepts/scheduling-eviction/node-pressure-eviction/)으로 파드가 축출됨 +- 노드의 [리소스 부족](/ko/docs/concepts/scheduling-eviction/node-pressure-eviction/)으로 파드가 축출됨 리소스 부족을 제외한 나머지 조건은 대부분의 사용자가 익숙할 것이다. 왜냐하면 @@ -71,7 +71,7 @@ weight: 60 - 파드가 필요로 하는 [리소스를 요청](/ko/docs/tasks/configure-pod-container/assign-memory-resource/)하는지 확인한다. - 고가용성이 필요한 경우 애플리케이션을 복제한다. - (복제된 [스테이트리스](/docs/tasks/run-application/run-stateless-application-deployment/) 및 + (복제된 [스테이트리스](/ko/docs/tasks/run-application/run-stateless-application-deployment/) 및 [스테이트풀](/docs/tasks/run-application/run-replicated-stateful-application/) 애플리케이션에 대해 알아보기.) - 복제된 애플리케이션의 구동 시 훨씬 더 높은 가용성을 위해 랙 전체 ([안티-어피니티](/ko/docs/concepts/scheduling-eviction/assign-pod-node/#파드간-어피니티와-안티-어피니티) 이용) diff --git a/content/ko/docs/concepts/workloads/pods/ephemeral-containers.md b/content/ko/docs/concepts/workloads/pods/ephemeral-containers.md index 136413b88f..cda62ef09b 100644 --- a/content/ko/docs/concepts/workloads/pods/ephemeral-containers.md +++ b/content/ko/docs/concepts/workloads/pods/ephemeral-containers.md @@ -76,4 +76,4 @@ API에서 특별한 `ephemeralcontainers` 핸들러를 사용해서 만들어지 ## {{% heading "whatsnext" %}} -* [임시 컨테이너 디버깅하기](/docs/tasks/debug-application-cluster/debug-running-pod/#ephemeral-container)에 대해 알아보기. +* [임시 컨테이너 디버깅하기](/ko/docs/tasks/debug-application-cluster/debug-running-pod/#ephemeral-container)에 대해 알아보기. diff --git a/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md b/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md index 48a918715e..3b48baf4eb 100644 --- a/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md @@ -433,7 +433,7 @@ API에서 즉시 파드를 제거하므로 동일한 이름으로 새로운 파 작은 유예 기간이 계속 제공된다. 스테이트풀셋(StatefulSet)의 일부인 파드를 강제 삭제해야 하는 경우, -[스테이트풀셋에서 파드를 삭제하기](/docs/tasks/run-application/force-delete-stateful-set-pod/)에 대한 +[스테이트풀셋에서 파드를 삭제하기](/ko/docs/tasks/run-application/force-delete-stateful-set-pod/)에 대한 태스크 문서를 참고한다. ### 실패한 파드의 가비지 콜렉션 {#pod-garbage-collection} diff --git a/content/ko/docs/contribute/_index.md b/content/ko/docs/contribute/_index.md index dcb7a68f49..d96ad15195 100644 --- a/content/ko/docs/contribute/_index.md +++ b/content/ko/docs/contribute/_index.md @@ -56,7 +56,7 @@ card: ## 첫 번째 기여 -- [기여 개요](/ko/docs/contribute/new-content/overview/)를 읽고 +- [기여 개요](/ko/docs/contribute/new-content/)를 읽고 기여할 수 있는 다양한 방법에 대해 알아봅니다. - [`kubernetes/website` 이슈 목록](https://github.com/kubernetes/website/issues/)을 확인하여 좋은 진입점이 되는 이슈를 찾을 수 있습니다. diff --git a/content/ko/docs/contribute/advanced.md b/content/ko/docs/contribute/advanced.md index 21337a785e..2f28ab6acd 100644 --- a/content/ko/docs/contribute/advanced.md +++ b/content/ko/docs/contribute/advanced.md @@ -8,7 +8,7 @@ weight: 98 이 페이지에서는 당신이 -[새로운 콘텐츠에 기여](/ko/docs/contribute/new-content/overview)하고 +[새로운 콘텐츠에 기여](/ko/docs/contribute/new-content/)하고 [다른 사람의 작업을 리뷰](/ko/docs/contribute/review/reviewing-prs/)하는 방법을 이해한다고 가정한다. 또한 기여하기 위한 더 많은 방법에 대해 배울 준비가 되었다고 가정한다. 이러한 작업 중 일부에는 Git 커맨드 라인 클라이언트와 다른 도구를 사용해야 한다. diff --git a/content/ko/docs/contribute/new-content/open-a-pr.md b/content/ko/docs/contribute/new-content/open-a-pr.md index a1f0178b3c..1a46323612 100644 --- a/content/ko/docs/contribute/new-content/open-a-pr.md +++ b/content/ko/docs/contribute/new-content/open-a-pr.md @@ -15,7 +15,7 @@ card: [새 기능 문서화](/docs/contribute/new-content/new-features/)를 참고한다. {{< /note >}} -새 콘텐츠 페이지를 기여하거나 기존 콘텐츠 페이지를 개선하려면, 풀 리퀘스트(PR)를 연다. [시작하기 전에](/ko/docs/contribute/new-content/overview/#before-you-begin) 섹션의 모든 요구 사항을 준수해야 한다. +새 콘텐츠 페이지를 기여하거나 기존 콘텐츠 페이지를 개선하려면, 풀 리퀘스트(PR)를 연다. [시작하기 전에](/ko/docs/contribute/new-content/#before-you-begin) 섹션의 모든 요구 사항을 준수해야 한다. 변경 사항이 작거나, git에 익숙하지 않은 경우, [GitHub을 사용하여 변경하기](#github을-사용하여-변경하기)를 읽고 페이지를 편집하는 방법을 알아보자. diff --git a/content/ko/docs/contribute/participate/_index.md b/content/ko/docs/contribute/participate/_index.md index c2d9aed771..9f874351b0 100644 --- a/content/ko/docs/contribute/participate/_index.md +++ b/content/ko/docs/contribute/participate/_index.md @@ -116,6 +116,6 @@ PR 소유자에게 조언하는데 활용된다. 쿠버네티스 문서화에 기여하는 일에 대한 보다 많은 정보는 다음 문서를 참고한다. -- [신규 콘텐츠 기여하기](/ko/docs/contribute/new-content/overview/) +- [신규 콘텐츠 기여하기](/ko/docs/contribute/new-content/) - [콘텐츠 검토하기](/ko/docs/contribute/review/reviewing-prs/) - [문서 스타일 가이드](/ko/docs/contribute/style/) diff --git a/content/ko/docs/contribute/participate/roles-and-responsibilities.md b/content/ko/docs/contribute/participate/roles-and-responsibilities.md index ad27eea6ff..5f4e1605dd 100644 --- a/content/ko/docs/contribute/participate/roles-and-responsibilities.md +++ b/content/ko/docs/contribute/participate/roles-and-responsibilities.md @@ -32,7 +32,7 @@ GitHub 계정을 가진 누구나 쿠버네티스에 기여할 수 있다. SIG D - [슬랙](https://slack.k8s.io/) 또는 [SIG docs 메일링 리스트](https://groups.google.com/forum/#!forum/kubernetes-sig-docs)에 개선을 제안한다. -[CLA에 서명](/ko/docs/contribute/new-content/overview/#sign-the-cla) 후에 누구나 다음을 할 수 있다. +[CLA에 서명](/ko/docs/contribute/new-content/#sign-the-cla) 후에 누구나 다음을 할 수 있다. - 기존 콘텐츠를 개선하거나, 새 콘텐츠를 추가하거나, 블로그 게시물 또는 사례연구 작성을 위해 풀 리퀘스트를 연다. - 다이어그램, 그래픽 자산 그리고 포함할 수 있는 스크린캐스트와 비디오를 제작한다. diff --git a/content/ko/docs/contribute/review/reviewing-prs.md b/content/ko/docs/contribute/review/reviewing-prs.md index e0b07a79a9..cc9e95b31a 100644 --- a/content/ko/docs/contribute/review/reviewing-prs.md +++ b/content/ko/docs/contribute/review/reviewing-prs.md @@ -43,7 +43,7 @@ weight: 10 표시된다. 2. 다음 레이블 중 하나 또는 모두를 사용하여 열린 PR을 필터링한다. - - `cncf-cla: yes`(권장): CLA에 서명하지 않은 기여자가 제출한 PR은 병합할 수 없다. 자세한 내용은 [CLA 서명](/ko/docs/contribute/new-content/overview/#sign-the-cla)을 참고한다. + - `cncf-cla: yes`(권장): CLA에 서명하지 않은 기여자가 제출한 PR은 병합할 수 없다. 자세한 내용은 [CLA 서명](/ko/docs/contribute/new-content/#sign-the-cla)을 참고한다. - `language/en`(권장): 영어 문서에 대한 PR 전용 필터이다. - `size/`: 특정 크기의 PR을 필터링한다. 새로 시작하는 사람이라면, 더 작은 PR로 시작한다. diff --git a/content/ko/docs/contribute/style/write-new-topic.md b/content/ko/docs/contribute/style/write-new-topic.md index 9bb3376933..cd815d0220 100644 --- a/content/ko/docs/contribute/style/write-new-topic.md +++ b/content/ko/docs/contribute/style/write-new-topic.md @@ -105,7 +105,7 @@ YAML 블록이다. 여기 예시가 있다. 포함할 수 있다. - 이 코드의 목적은 더 큰 파일의 일부를 강조하는 것이기 때문에 불완전한 예제다. 예를 들어 몇 가지 이유로 - [PodSecurityPolicy](/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy) + [PodSecurityPolicy](/ko/docs/tasks/administer-cluster/sysctl-cluster/#파드시큐리티폴리시-podsecuritypolicy) 를 사용자 정의 방법을 설명할 때 문서 파일에서 직접 짧은 요약 정보를 제공할 수 있다. - 이 코드는 사용자가 다른 이유로 시도하기 위한 것이 아니다. 예를 들어 `kubectl edit` 명령을 사용하여 리소스에 새 속성을 추가하는 방법을 diff --git a/content/ko/docs/reference/command-line-tools-reference/feature-gates.md b/content/ko/docs/reference/command-line-tools-reference/feature-gates.md index 9767966cab..9606b74898 100644 --- a/content/ko/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/ko/docs/reference/command-line-tools-reference/feature-gates.md @@ -654,7 +654,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 [토큰 요청](https://kubernetes-csi.github.io/docs/token-requests.html)을 참조한다. - `CSIStorageCapacity`: CSI 드라이버가 스토리지 용량 정보를 게시하고 쿠버네티스 스케줄러가 파드를 스케줄할 때 해당 정보를 사용하도록 한다. - [스토리지 용량](/docs/concepts/storage/storage-capacity/)을 참고한다. + [스토리지 용량](/ko/docs/concepts/storage/storage-capacity/)을 참고한다. 자세한 내용은 [`csi` 볼륨 유형](/ko/docs/concepts/storage/volumes/#csi) 문서를 확인한다. - `CSIVolumeFSGroupPolicy`: CSI드라이버가 `fsGroupPolicy` 필드를 사용하도록 허용한다. 이 필드는 CSI드라이버에서 생성된 볼륨이 마운트될 때 볼륨 소유권과 @@ -698,7 +698,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `DisableCloudProviders`: `kube-apiserver`, `kube-controller-manager`, `--cloud-provider` 컴포넌트 플래그와 관련된 `kubelet`의 모든 기능을 비활성화한다. -- `DownwardAPIHugePages`: [다운워드 API](/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information)에서 +- `DownwardAPIHugePages`: [다운워드 API](/ko/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/)에서 hugepages 사용을 활성화한다. - `DryRun`: 서버 측의 [dry run](/docs/reference/using-api/api-concepts/#dry-run) 요청을 요청을 활성화하여 커밋하지 않고 유효성 검사, 병합 및 변화를 테스트할 수 있다. @@ -738,13 +738,13 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `ExpandCSIVolumes`: CSI 볼륨 확장을 활성화한다. - `ExpandedDNSConfig`: 더 많은 DNS 검색 경로와 더 긴 DNS 검색 경로 목록을 허용하려면 kubelet과 kube-apiserver를 사용하도록 설정한다. - [확장된 DNS 구성](/docs/concepts/services-networking/dns-pod-service/#expanded-dns-configuration)을 참고한다. + [확장된 DNS 구성](/ko/docs/concepts/services-networking/dns-pod-service/#확장된-dns-환경-설정)을 참고한다. - `ExpandInUsePersistentVolumes`: 사용 중인 PVC를 확장할 수 있다. [사용 중인 퍼시스턴트볼륨클레임 크기 조정](/ko/docs/concepts/storage/persistent-volumes/#사용-중인-퍼시스턴트볼륨클레임-크기-조정)을 참고한다. - `ExpandPersistentVolumes`: 퍼시스턴트 볼륨 확장을 활성화한다. [퍼시스턴트 볼륨 클레임 확장](/ko/docs/concepts/storage/persistent-volumes/#퍼시스턴트-볼륨-클레임-확장)을 참고한다. - `ExperimentalCriticalPodAnnotation`: 특정 파드에 *critical* 로 - 어노테이션을 달아서 [스케줄링이 보장되도록](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/) 한다. + 어노테이션을 달아서 [스케줄링이 보장되도록](/ko/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/) 한다. 이 기능은 v1.13부터 파드 우선 순위 및 선점으로 인해 사용 중단되었다. - `ExperimentalHostUserNamespaceDefaulting`: 사용자 네임스페이스를 호스트로 기본 활성화한다. 이것은 다른 호스트 네임스페이스, 호스트 마운트, @@ -847,7 +847,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `NodeLease`: 새로운 리스(Lease) API가 노드 상태 신호로 사용될 수 있는 노드 하트비트(heartbeats)를 보고할 수 있게 한다. - `NodeSwap`: 노드의 쿠버네티스 워크로드용 스왑 메모리를 할당하려면 kubelet을 활성화한다. 반드시 `KubeletConfiguration.failSwapOn`를 false로 설정한 후 사용해야 한다. - 더 자세한 정보는 [스왑 메모리](/docs/concepts/architecture/nodes/#swap-memory)를 참고한다. + 더 자세한 정보는 [스왑 메모리](/ko/docs/concepts/architecture/nodes/#swap-memory)를 참고한다. - `NonPreemptingPriority`: 프라이어리티클래스(PriorityClass)와 파드에 `preemptionPolicy` 필드를 활성화한다. - `PVCProtection`: 파드에서 사용 중일 때 퍼시스턴트볼륨클레임(PVC)이 삭제되지 않도록 한다. @@ -970,7 +970,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 참고한다. - `Sysctls`: 각 파드에 설정할 수 있는 네임스페이스 커널 파라미터(sysctl)를 지원한다. 자세한 내용은 - [sysctl](/docs/tasks/administer-cluster/sysctl-cluster/)을 참고한다. + [sysctl](/ko/docs/tasks/administer-cluster/sysctl-cluster/)을 참고한다. - `TTLAfterFinished`: [TTL 컨트롤러](/ko/docs/concepts/workloads/controllers/ttlafterfinished/)가 실행이 끝난 후 리소스를 정리하도록 허용한다. diff --git a/content/ko/docs/reference/glossary/sysctl.md b/content/ko/docs/reference/glossary/sysctl.md index bce4d26ba1..e099aaec6e 100644 --- a/content/ko/docs/reference/glossary/sysctl.md +++ b/content/ko/docs/reference/glossary/sysctl.md @@ -2,7 +2,7 @@ title: sysctl id: sysctl date: 2019-02-12 -full_link: /docs/tasks/administer-cluster/sysctl-cluster/ +full_link: /ko/docs/tasks/administer-cluster/sysctl-cluster/ short_description: > 유닉스 커널 파라미터를 가져오거나 설정하는 데 사용하는 인터페이스 diff --git a/content/ko/docs/reference/kubectl/docker-cli-to-kubectl.md b/content/ko/docs/reference/kubectl/docker-cli-to-kubectl.md index a367c175cb..4935b83ec6 100644 --- a/content/ko/docs/reference/kubectl/docker-cli-to-kubectl.md +++ b/content/ko/docs/reference/kubectl/docker-cli-to-kubectl.md @@ -187,7 +187,7 @@ kubectl exec -ti nginx-app-5jyvm -- /bin/sh # exit ``` -자세한 내용은 [실행 중인 컨테이너의 셸 얻기](/docs/tasks/debug-application-cluster/get-shell-running-container/)를 참고한다. +자세한 내용은 [실행 중인 컨테이너의 셸 얻기](/ko/docs/tasks/debug-application-cluster/get-shell-running-container/)를 참고한다. ## docker logs diff --git a/content/ko/docs/setup/production-environment/windows/user-guide-windows-containers.md b/content/ko/docs/setup/production-environment/windows/user-guide-windows-containers.md index 2e1694834e..aaa96a4fcf 100644 --- a/content/ko/docs/setup/production-environment/windows/user-guide-windows-containers.md +++ b/content/ko/docs/setup/production-environment/windows/user-guide-windows-containers.md @@ -147,7 +147,7 @@ LogMonitor가 로그를 STDOUT으로 푸시할 수 있도록 필요한 엔트리 그룹 매니지드 서비스 어카운트는 액티브 디렉터리 어카운트의 특정한 종류로 자동 암호 관리 기능, 단순화된 서비스 주체 이름(SPN, simplified service principal name), 여러 서버의 다른 관리자에게 관리를 위임하는 기능을 제공한다. GMSA로 구성한 컨테이너는 GMSA로 구성된 신원을 들고 있는 동안 외부 액티브 디렉터리 도메인 리소스를 접근할 수 있다. -윈도우 컨테이너를 위한 GMSA를 이용하고 구성하는 방법은 [여기](/docs/tasks/configure-pod-container/configure-gmsa/)에서 알아보자. +윈도우 컨테이너를 위한 GMSA를 이용하고 구성하는 방법은 [여기](/ko/docs/tasks/configure-pod-container/configure-gmsa/)에서 알아보자. ## 테인트(Taint)와 톨러레이션(Toleration) diff --git a/content/ko/docs/tasks/access-application-cluster/web-ui-dashboard.md b/content/ko/docs/tasks/access-application-cluster/web-ui-dashboard.md index daa1417ce9..2b308e7e2a 100644 --- a/content/ko/docs/tasks/access-application-cluster/web-ui-dashboard.md +++ b/content/ko/docs/tasks/access-application-cluster/web-ui-dashboard.md @@ -182,7 +182,7 @@ Kubeconfig 인증 방법은 외부 아이덴티티 프로바이더 특권을 가진(privileged) 컨테이너는 네트워크 스택과 디바이스에 접근하는 것을 조작하도록 활용할 수 있다. - **환경 변수**: 쿠버네티스 서비스를 - [환경 변수](/docs/tasks/inject-data-application/environment-variable-expose-pod-information/)를 통해 노출한다. + [환경 변수](/ko/docs/tasks/inject-data-application/environment-variable-expose-pod-information/)를 통해 노출한다. 환경 변수 또는 인자를 환경 변수들의 값으로 커맨드를 통해 구성할 수 있다. 애플리케이션들이 서비스를 찾는데 사용된다. 값들은 `$(VAR_NAME)` 구문을 사용하는 다른 변수들로 참조할 수 있다. diff --git a/content/ko/docs/tasks/administer-cluster/sysctl-cluster.md b/content/ko/docs/tasks/administer-cluster/sysctl-cluster.md index d97850afbc..8adf5c4564 100644 --- a/content/ko/docs/tasks/administer-cluster/sysctl-cluster.md +++ b/content/ko/docs/tasks/administer-cluster/sysctl-cluster.md @@ -156,7 +156,7 @@ sysctl 설정이 필요한 노드에만 파드를 예약하는 것이 좋다. 두 _unsafe_ sysctl을 명시적으로 활성화하지 않은 노드에서 _unsafe_ sysctl을 사용하는 파드가 시작되지 않는다. _node-level_ sysctl과 마찬가지로 [_테인트와 톨러레이션_ 특징](/docs/reference/generated/kubectl/kubectl-commands/#taint) 또는 -[노드 테인트](/docs/concepts/scheduling-eviction/taint-and-toleration/)를 +[노드 테인트](/ko/docs/concepts/scheduling-eviction/taint-and-toleration/)를 사용하여 해당 파드를 오른쪽 노드에 스케줄하는 것을 추천한다. diff --git a/content/ko/docs/tasks/configure-pod-container/configure-runasusername.md b/content/ko/docs/tasks/configure-pod-container/configure-runasusername.md index 8bae2f4286..12546126ce 100644 --- a/content/ko/docs/tasks/configure-pod-container/configure-runasusername.md +++ b/content/ko/docs/tasks/configure-pod-container/configure-runasusername.md @@ -122,5 +122,5 @@ ContainerAdministrator * [쿠버네티스에서 윈도우 컨테이너 스케줄링을 위한 가이드](/ko/docs/setup/production-environment/windows/user-guide-windows-containers/) * [그룹 매니지드 서비스 어카운트를 이용하여 워크로드 신원 관리하기](/ko/docs/setup/production-environment/windows/user-guide-windows-containers/#그룹-매니지드-서비스-어카운트를-이용하여-워크로드-신원-관리하기) -* [윈도우 파드와 컨테이너의 GMSA 구성](/docs/tasks/configure-pod-container/configure-gmsa/) +* [윈도우 파드와 컨테이너의 GMSA 구성](/ko/docs/tasks/configure-pod-container/configure-gmsa/) diff --git a/content/ko/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md b/content/ko/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md index f8696993ff..11b46ede8e 100644 --- a/content/ko/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md +++ b/content/ko/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md @@ -91,7 +91,7 @@ kubectl describe pods ${POD_NAME} ### 파드가 손상(crashing)되었거나 양호하지 않을(unhealthy) 경우 -일단 사용자의 파드가 스케줄 되면, [구동중인 파드 디버그하기](/docs/tasks/debug-application-cluster/debug-running-pod/)에 +일단 사용자의 파드가 스케줄 되면, [구동중인 파드 디버그하기](/ko/docs/tasks/debug-application-cluster/debug-running-pod/)에 기술된 메서드를 디버깅에 사용할 수 있다. diff --git a/content/ko/docs/tasks/debug-application-cluster/debug-running-pod.md b/content/ko/docs/tasks/debug-application-cluster/debug-running-pod.md index 0145967dd8..1c2073a21b 100644 --- a/content/ko/docs/tasks/debug-application-cluster/debug-running-pod.md +++ b/content/ko/docs/tasks/debug-application-cluster/debug-running-pod.md @@ -69,7 +69,7 @@ kubectl exec -it cassandra -- sh ``` 더욱 상세한 내용은 다음 [동작중인 컨테이너의 쉘에 접근하기]( -/docs/tasks/debug-application-cluster/get-shell-running-container/)를 참고하라. +/ko/docs/tasks/debug-application-cluster/get-shell-running-container/)를 참고하라. ## 임시(ephemeral) 디버그 컨테이너를 사용해서 디버깅하기 {#ephemeral-container} @@ -87,7 +87,7 @@ kubectl exec -it cassandra -- sh {{< note >}} 이 섹션에서 소개하는 예시를 사용하기 위해서는 -여러분의 클러스터에 `EphemeralContainers` [기능 게이트](/docs/reference/command-line-tools-reference/feature-gates/)가 +여러분의 클러스터에 `EphemeralContainers` [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)가 활성화되어 있어야 하고 `kubectl`의 버전이 v1.18 이상이어야 한다. {{< /note >}} diff --git a/content/ko/docs/tasks/debug-application-cluster/debug-stateful-set.md b/content/ko/docs/tasks/debug-application-cluster/debug-stateful-set.md index b9a1d3f677..45f170f5d3 100644 --- a/content/ko/docs/tasks/debug-application-cluster/debug-stateful-set.md +++ b/content/ko/docs/tasks/debug-application-cluster/debug-stateful-set.md @@ -32,7 +32,7 @@ kubectl get pods -l app=myapp 만약 오랜 시간동안 `Unknown`이나 `Terminating` 상태에 있는 파드들을 발견하였다면, 이러한 파드들을 어떻게 다루는지 알아보기 위해 -[스테이트풀셋 파드 삭제하기](/docs/tasks/run-application/delete-stateful-set/)를 참고하길 바란다. +[스테이트풀셋 파드 삭제하기](/ko/docs/tasks/run-application/delete-stateful-set/)를 참고하길 바란다. 스테이트풀셋에 포함된 개별 파드들을 디버깅하기 위해서는 [파드 디버그하기](/ko/docs/tasks/debug-application-cluster/debug-pod-replication-controller/) 가이드를 참고하길 바란다. diff --git a/content/ko/docs/tasks/inject-data-application/define-command-argument-container.md b/content/ko/docs/tasks/inject-data-application/define-command-argument-container.md index aae34dc3b9..6893dd0f74 100644 --- a/content/ko/docs/tasks/inject-data-application/define-command-argument-container.md +++ b/content/ko/docs/tasks/inject-data-application/define-command-argument-container.md @@ -152,5 +152,5 @@ EntryPoint 값과 기본 Cmd 값이 덮어쓰여진다. `command`가 `args` 값 * [파드와 컨테이너를 구성하는 방법](/ko/docs/tasks/)에 대해 더 알아본다. -* [컨테이너 안에서 커맨드를 실행하는 방법](/docs/tasks/debug-application-cluster/get-shell-running-container/)에 대해 더 알아본다. +* [컨테이너 안에서 커맨드를 실행하는 방법](/ko/docs/tasks/debug-application-cluster/get-shell-running-container/)에 대해 더 알아본다. * [컨테이너](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#container-v1-core)를 확인한다. diff --git a/content/ko/docs/tasks/inject-data-application/define-environment-variable-container.md b/content/ko/docs/tasks/inject-data-application/define-environment-variable-container.md index 5e23ba831e..40272c3060 100644 --- a/content/ko/docs/tasks/inject-data-application/define-environment-variable-container.md +++ b/content/ko/docs/tasks/inject-data-application/define-environment-variable-container.md @@ -110,6 +110,6 @@ spec: ## {{% heading "whatsnext" %}} -* [환경 변수](/docs/tasks/inject-data-application/environment-variable-expose-pod-information/)에 대해 알아본다. +* [환경 변수](/ko/docs/tasks/inject-data-application/environment-variable-expose-pod-information/)에 대해 알아본다. * [시크릿을 환경 변수로 사용하기](/ko/docs/concepts/configuration/secret/#시크릿을-환경-변수로-사용하기)에 대해 알아본다. * [EnvVarSource](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#envvarsource-v1-core)를 확인한다. diff --git a/content/ko/docs/tasks/inject-data-application/define-interdependent-environment-variables.md b/content/ko/docs/tasks/inject-data-application/define-interdependent-environment-variables.md index 34a91a600c..54e809cf00 100644 --- a/content/ko/docs/tasks/inject-data-application/define-interdependent-environment-variables.md +++ b/content/ko/docs/tasks/inject-data-application/define-interdependent-environment-variables.md @@ -72,6 +72,6 @@ weight: 20 ## {{% heading "whatsnext" %}} -* [환경 변수](/docs/tasks/inject-data-application/environment-variable-expose-pod-information/)에 대해 알아본다. +* [환경 변수](/ko/docs/tasks/inject-data-application/environment-variable-expose-pod-information/)에 대해 알아본다. * [EnvVarSource](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#envvarsource-v1-core)를 확인한다. diff --git a/content/ko/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information.md b/content/ko/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information.md index 2a8a206d6d..b57c6e5f88 100644 --- a/content/ko/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information.md +++ b/content/ko/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information.md @@ -25,7 +25,7 @@ weight: 40 실행 중인 컨테이너에 파드 및 컨테이너 필드를 노출하는 방법에는 두 가지가 있다. -* [환경 변수](/docs/tasks/inject-data-application/environment-variable-expose-pod-information/#the-downward-api) +* [환경 변수](/ko/docs/tasks/inject-data-application/environment-variable-expose-pod-information/#다운워드-downward-api) * 볼륨 파일 파드 및 컨테이너 필드를 노출하는 이 두 가지 방법을 *다운워드 API*라고 한다. @@ -134,7 +134,7 @@ total 8 원자적(atomic)으로 갱신한다. {{< note >}} -다운워드 API를 [subPath](/docs/concepts/storage/volumes/#using-subpath) +다운워드 API를 [subPath](/ko/docs/concepts/storage/volumes/#using-subpath) 볼륨 마운트로 사용하는 컨테이너는 다운워드 API 업데이트를 수신하지 않는다. {{< /note >}} @@ -200,8 +200,8 @@ kubectl exec -it kubernetes-downwardapi-volume-example-2 -- sh * 컨테이너의 CPU 요청(request) * 컨테이너의 메모리 한도(limit) * 컨테이너의 메모리 요청(request) - * 컨테이너의 hugepages 한도(limit) (`DownwardAPIHugePages` [기능 게이트(feature gate)](/docs/reference/command-line-tools-reference/feature-gates/)가 활성화된 경우) - * 컨테이너의 hugepages 요청(request) (`DownwardAPIHugePages` [기능 게이트(feature gate)](/docs/reference/command-line-tools-reference/feature-gates/)가 활성화된 경우) + * 컨테이너의 hugepages 한도(limit) (`DownwardAPIHugePages` [기능 게이트(feature gate)](/ko/docs/reference/command-line-tools-reference/feature-gates/)가 활성화된 경우) + * 컨테이너의 hugepages 요청(request) (`DownwardAPIHugePages` [기능 게이트(feature gate)](/ko/docs/reference/command-line-tools-reference/feature-gates/)가 활성화된 경우) * 컨테이너의 임시-스토리지 한도(limit) * 컨테이너의 임시-스토리지 요청(request) diff --git a/content/ko/docs/tasks/inject-data-application/environment-variable-expose-pod-information.md b/content/ko/docs/tasks/inject-data-application/environment-variable-expose-pod-information.md index 033e0afa79..951fb716f3 100644 --- a/content/ko/docs/tasks/inject-data-application/environment-variable-expose-pod-information.md +++ b/content/ko/docs/tasks/inject-data-application/environment-variable-expose-pod-information.md @@ -27,7 +27,7 @@ weight: 30 파드 및 컨테이너 필드를 실행 중인 컨테이너에 노출하는 두 가지 방법이 있다. * 환경 변수 -* [볼륨 파일](/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/#the-downward-api) +* [볼륨 파일](/ko/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/#다운워드-downward-api) 파드 및 컨테이너 필드를 노출하는 이 두 가지 방법을 *다운워드 API*라고 한다. @@ -145,7 +145,7 @@ kubectl logs dapi-envars-resourcefieldref ## {{% heading "whatsnext" %}} -* [컨테이너를 위한 환경 변수 정의하기](/docs/tasks/inject-data-application/define-environment-variable-container/) +* [컨테이너를 위한 환경 변수 정의하기](/ko/docs/tasks/inject-data-application/define-environment-variable-container/) * [PodSpec](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podspec-v1-core) * [컨테이너](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#container-v1-core) * [EnvVar](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#envvar-v1-core) diff --git a/content/ko/docs/tasks/job/automated-tasks-with-cron-jobs.md b/content/ko/docs/tasks/job/automated-tasks-with-cron-jobs.md index 26353959ef..1a0ffe553b 100644 --- a/content/ko/docs/tasks/job/automated-tasks-with-cron-jobs.md +++ b/content/ko/docs/tasks/job/automated-tasks-with-cron-jobs.md @@ -132,7 +132,7 @@ kubectl delete cronjob hello ## 크론 잡 명세 작성 다른 모든 쿠버네티스 구성과 마찬가지로, 크론 잡은 `apiVersion`, `kind` 그리고 `metadata` 필드가 필요하다. 구성 파일 -작업에 대한 일반적인 정보는 [애플리케이션 배포](/docs/tasks/run-application/run-stateless-application-deployment/)와 +작업에 대한 일반적인 정보는 [애플리케이션 배포](/ko/docs/tasks/run-application/run-stateless-application-deployment/)와 [kubectl을 사용하여 리소스 관리하기](/ko/docs/concepts/overview/working-with-objects/object-management/) 문서를 참고한다. 크론 잡 구성에는 [`.spec` 섹션](https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status)도 필요하다. diff --git a/content/ko/docs/tasks/manage-daemon/update-daemon-set.md b/content/ko/docs/tasks/manage-daemon/update-daemon-set.md index a3575704ae..6bf5e7f659 100644 --- a/content/ko/docs/tasks/manage-daemon/update-daemon-set.md +++ b/content/ko/docs/tasks/manage-daemon/update-daemon-set.md @@ -147,7 +147,7 @@ daemonset "fluentd-elasticsearch" successfully rolled out #### 일부 노드에 리소스가 부족하다 적어도 하나의 노드에서 새 데몬셋 파드를 스케줄링할 수 없어서 롤아웃이 -중단되었다. 노드에 [리소스가 부족](/docs/concepts/scheduling-eviction/node-pressure-eviction/)할 때 +중단되었다. 노드에 [리소스가 부족](/ko/docs/concepts/scheduling-eviction/node-pressure-eviction/)할 때 발생할 수 있다. 이 경우, `kubectl get nodes` 의 출력 결과와 다음의 출력 결과를 비교하여 diff --git a/content/ko/docs/tasks/run-application/delete-stateful-set.md b/content/ko/docs/tasks/run-application/delete-stateful-set.md index 7c2b1ed783..8aeb8aa67b 100644 --- a/content/ko/docs/tasks/run-application/delete-stateful-set.md +++ b/content/ko/docs/tasks/run-application/delete-stateful-set.md @@ -80,11 +80,11 @@ kubectl delete pvc -l app=myapp ### 스테이트풀셋 파드의 강제 삭제 -스테이트풀셋의 일부 파드가 오랫동안 'Terminating' 또는 'Unknown' 상태에 있는 경우, apiserver에 수동적으로 개입하여 파드를 강제 삭제할 수도 있다. 이것은 잠재적으로 위험한 작업이다. 자세한 설명은 [스테이트풀셋 파드 강제 삭제하기](/docs/tasks/run-application/force-delete-stateful-set-pod/)를 참고한다. +스테이트풀셋의 일부 파드가 오랫동안 'Terminating' 또는 'Unknown' 상태에 있는 경우, apiserver에 수동적으로 개입하여 파드를 강제 삭제할 수도 있다. 이것은 잠재적으로 위험한 작업이다. 자세한 설명은 [스테이트풀셋 파드 강제 삭제하기](/ko/docs/tasks/run-application/force-delete-stateful-set-pod/)를 참고한다. ## {{% heading "whatsnext" %}} -[스테이트풀셋 파드 강제 삭제하기](/docs/tasks/run-application/force-delete-stateful-set-pod/)에 대해 더 알아보기. +[스테이트풀셋 파드 강제 삭제하기](/ko/docs/tasks/run-application/force-delete-stateful-set-pod/)에 대해 더 알아보기. diff --git a/content/ko/docs/tasks/run-application/force-delete-stateful-set-pod.md b/content/ko/docs/tasks/run-application/force-delete-stateful-set-pod.md index 5c9f1358a4..7c1b311a2a 100644 --- a/content/ko/docs/tasks/run-application/force-delete-stateful-set-pod.md +++ b/content/ko/docs/tasks/run-application/force-delete-stateful-set-pod.md @@ -91,6 +91,6 @@ kubectl patch pod -p '{"metadata":{"finalizers":null}}' ## {{% heading "whatsnext" %}} -[스테이트풀셋 디버깅하기](/docs/tasks/debug-application-cluster/debug-stateful-set/)에 대해 더 알아보기. +[스테이트풀셋 디버깅하기](/ko/docs/tasks/debug-application-cluster/debug-stateful-set/)에 대해 더 알아보기. diff --git a/content/ko/docs/tasks/run-application/run-single-instance-stateful-application.md b/content/ko/docs/tasks/run-application/run-single-instance-stateful-application.md index cf6c3188b7..a26c0a459f 100644 --- a/content/ko/docs/tasks/run-application/run-single-instance-stateful-application.md +++ b/content/ko/docs/tasks/run-application/run-single-instance-stateful-application.md @@ -196,7 +196,7 @@ kubectl delete pv mysql-pv-volume * [디플로이먼트 오브젝트](/ko/docs/concepts/workloads/controllers/deployment/)에 대해 더 배워 보기 -* [애플리케이션 배포하기](/docs/tasks/run-application/run-stateless-application-deployment/)에 대해 더 배워보기 +* [애플리케이션 배포하기](/ko/docs/tasks/run-application/run-stateless-application-deployment/)에 대해 더 배워보기 * [kubectl run 문서](/docs/reference/generated/kubectl/kubectl-commands/#run) diff --git a/content/ko/docs/tutorials/hello-minikube.md b/content/ko/docs/tutorials/hello-minikube.md index 6518d0102e..cd7e5c9b08 100644 --- a/content/ko/docs/tutorials/hello-minikube.md +++ b/content/ko/docs/tutorials/hello-minikube.md @@ -301,5 +301,5 @@ minikube delete * [디플로이먼트 오브젝트](/ko/docs/concepts/workloads/controllers/deployment/)에 대해서 더 배워 본다. -* [애플리케이션 배포](/docs/tasks/run-application/run-stateless-application-deployment/)에 대해서 더 배워 본다. +* [애플리케이션 배포](/ko/docs/tasks/run-application/run-stateless-application-deployment/)에 대해서 더 배워 본다. * [서비스 오브젝트](/ko/docs/concepts/services-networking/service/)에 대해서 더 배워 본다. diff --git a/content/ko/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md b/content/ko/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md index 4c5f690d70..b2ac3e92b5 100644 --- a/content/ko/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md +++ b/content/ko/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume.md @@ -239,4 +239,4 @@ kubectl apply -k ./ * [인트로스펙션과 디버깅](/docs/tasks/debug-application-cluster/debug-application-introspection/)를 알아보자. * [잡](/ko/docs/concepts/workloads/controllers/job/)를 알아보자. * [포트 포워딩](/ko/docs/tasks/access-application-cluster/port-forward-access-application-cluster/)를 알아보자. -* 어떻게 [컨테이너에서 셸을 사용하는지](/docs/tasks/debug-application-cluster/get-shell-running-container/)를 알아보자. +* 어떻게 [컨테이너에서 셸을 사용하는지](/ko/docs/tasks/debug-application-cluster/get-shell-running-container/)를 알아보자. From 771ee157a9d396284f1030d6b3a5de09b86e151e Mon Sep 17 00:00:00 2001 From: Lee Verberne Date: Thu, 30 Sep 2021 22:25:58 +0200 Subject: [PATCH 045/148] Promote EphemeralContainers to beta --- .../concepts/workloads/pods/ephemeral-containers.md | 11 +---------- .../command-line-tools-reference/feature-gates.md | 3 ++- .../debug-application-cluster/debug-running-pod.md | 8 +------- 3 files changed, 4 insertions(+), 18 deletions(-) diff --git a/content/en/docs/concepts/workloads/pods/ephemeral-containers.md b/content/en/docs/concepts/workloads/pods/ephemeral-containers.md index c26a63b183..d32511da28 100644 --- a/content/en/docs/concepts/workloads/pods/ephemeral-containers.md +++ b/content/en/docs/concepts/workloads/pods/ephemeral-containers.md @@ -9,22 +9,13 @@ weight: 80 -{{< feature-state state="alpha" for_k8s_version="v1.22" >}} +{{< feature-state state="beta" for_k8s_version="v1.23" >}} This page provides an overview of ephemeral containers: a special type of container that runs temporarily in an existing {{< glossary_tooltip term_id="pod" >}} to accomplish user-initiated actions such as troubleshooting. You use ephemeral containers to inspect services rather than to build applications. -{{< warning >}} -Ephemeral containers are in alpha state and are not suitable for production -clusters. In accordance with the [Kubernetes Deprecation Policy]( -/docs/reference/using-api/deprecation-policy/), this alpha feature could change -significantly in the future or be removed entirely. -{{< /warning >}} - - - ## Understanding ephemeral containers diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 63eba752de..91eb1a0f6b 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -106,7 +106,8 @@ different Kubernetes components. | `EfficientWatchResumption` | `true` | Beta | 1.21 | | | `EndpointSliceTerminatingCondition` | `false` | Alpha | 1.20 | 1.21 | | `EndpointSliceTerminatingCondition` | `true` | Beta | 1.22 | | -| `EphemeralContainers` | `false` | Alpha | 1.16 | | +| `EphemeralContainers` | `false` | Alpha | 1.16 | 1.22 | +| `EphemeralContainers` | `true` | Beta | 1.23 | | | `ExpandCSIVolumes` | `false` | Alpha | 1.14 | 1.15 | | `ExpandCSIVolumes` | `true` | Beta | 1.16 | | | `ExpandedDNSConfig` | `false` | Alpha | 1.22 | | diff --git a/content/en/docs/tasks/debug-application-cluster/debug-running-pod.md b/content/en/docs/tasks/debug-application-cluster/debug-running-pod.md index 6009a76341..9653ff05ef 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-running-pod.md +++ b/content/en/docs/tasks/debug-application-cluster/debug-running-pod.md @@ -73,7 +73,7 @@ For more details, see [Get a Shell to a Running Container]( ## Debugging with an ephemeral debug container {#ephemeral-container} -{{< feature-state state="alpha" for_k8s_version="v1.22" >}} +{{< feature-state state="beta" for_k8s_version="v1.23" >}} {{< glossary_tooltip text="Ephemeral containers" term_id="ephemeral-container" >}} are useful for interactive troubleshooting when `kubectl exec` is insufficient @@ -83,12 +83,6 @@ https://github.com/GoogleContainerTools/distroless). ### Example debugging using ephemeral containers {#ephemeral-container-example} -{{< note >}} -The examples in this section require the `EphemeralContainers` [feature gate]( -/docs/reference/command-line-tools-reference/feature-gates/) enabled in your -cluster and `kubectl` version v1.22 or later. -{{< /note >}} - You can use the `kubectl debug` command to add ephemeral containers to a running Pod. First, create a pod for the example: From 9c0c75e0f2d8f5acfb1607b3afa79e3497cfa129 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 17 Nov 2021 00:20:18 +0000 Subject: [PATCH 046/148] Reorder storage concepts Introduce concepts in an order that should suit people new to Kubernetes, so that you don't encounter details like volume cloning until you've seen more of the basic volume types (persistent, ephemeral, projected). --- content/en/docs/concepts/storage/ephemeral-volumes.md | 2 +- content/en/docs/concepts/storage/projected-volumes.md | 1 + content/en/docs/concepts/storage/storage-capacity.md | 2 +- content/en/docs/concepts/storage/volume-pvc-datasource.md | 2 +- content/en/docs/concepts/storage/volume-snapshot-classes.md | 2 +- content/en/docs/concepts/storage/volume-snapshots.md | 2 +- 6 files changed, 6 insertions(+), 5 deletions(-) diff --git a/content/en/docs/concepts/storage/ephemeral-volumes.md b/content/en/docs/concepts/storage/ephemeral-volumes.md index 1e811fb82a..2d54f71cd2 100644 --- a/content/en/docs/concepts/storage/ephemeral-volumes.md +++ b/content/en/docs/concepts/storage/ephemeral-volumes.md @@ -7,7 +7,7 @@ reviewers: - pohly title: Ephemeral Volumes content_type: concept -weight: 50 +weight: 30 --- diff --git a/content/en/docs/concepts/storage/projected-volumes.md b/content/en/docs/concepts/storage/projected-volumes.md index a5914adb6f..962e6bae91 100644 --- a/content/en/docs/concepts/storage/projected-volumes.md +++ b/content/en/docs/concepts/storage/projected-volumes.md @@ -6,6 +6,7 @@ reviewers: - zshihang title: Projected Volumes content_type: concept +weight: 21 # just after persistent volumes --- diff --git a/content/en/docs/concepts/storage/storage-capacity.md b/content/en/docs/concepts/storage/storage-capacity.md index 13ae8ab722..dbe30643d9 100644 --- a/content/en/docs/concepts/storage/storage-capacity.md +++ b/content/en/docs/concepts/storage/storage-capacity.md @@ -7,7 +7,7 @@ reviewers: - pohly title: Storage Capacity content_type: concept -weight: 45 +weight: 70 --- diff --git a/content/en/docs/concepts/storage/volume-pvc-datasource.md b/content/en/docs/concepts/storage/volume-pvc-datasource.md index 9e59560d1d..f800d9107a 100644 --- a/content/en/docs/concepts/storage/volume-pvc-datasource.md +++ b/content/en/docs/concepts/storage/volume-pvc-datasource.md @@ -6,7 +6,7 @@ reviewers: - msau42 title: CSI Volume Cloning content_type: concept -weight: 30 +weight: 60 --- diff --git a/content/en/docs/concepts/storage/volume-snapshot-classes.md b/content/en/docs/concepts/storage/volume-snapshot-classes.md index ee781d665f..45f7149a38 100644 --- a/content/en/docs/concepts/storage/volume-snapshot-classes.md +++ b/content/en/docs/concepts/storage/volume-snapshot-classes.md @@ -8,7 +8,7 @@ reviewers: - yuxiangqian title: Volume Snapshot Classes content_type: concept -weight: 30 +weight: 41 # just after volume snapshots --- diff --git a/content/en/docs/concepts/storage/volume-snapshots.md b/content/en/docs/concepts/storage/volume-snapshots.md index 7673ecf2b4..8d9a5acb72 100644 --- a/content/en/docs/concepts/storage/volume-snapshots.md +++ b/content/en/docs/concepts/storage/volume-snapshots.md @@ -8,7 +8,7 @@ reviewers: - yuxiangqian title: Volume Snapshots content_type: concept -weight: 20 +weight: 40 --- From 195ab34d01bddd08ca440b6bd5c43a114d07f5bf Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 17 Nov 2021 00:21:53 +0000 Subject: [PATCH 047/148] Fix nits Tidying that I spotted whilst reordering the storage concepts section. --- content/en/docs/concepts/storage/persistent-volumes.md | 3 +-- content/en/docs/concepts/storage/projected-volumes.md | 3 +-- content/en/docs/concepts/storage/storage-capacity.md | 1 - 3 files changed, 2 insertions(+), 5 deletions(-) diff --git a/content/en/docs/concepts/storage/persistent-volumes.md b/content/en/docs/concepts/storage/persistent-volumes.md index f2093073df..4496f247d9 100644 --- a/content/en/docs/concepts/storage/persistent-volumes.md +++ b/content/en/docs/concepts/storage/persistent-volumes.md @@ -10,14 +10,13 @@ feature: title: Storage orchestration description: > Automatically mount the storage system of your choice, whether from local storage, a public cloud provider such as GCP or AWS, or a network storage system such as NFS, iSCSI, Gluster, Ceph, Cinder, or Flocker. - content_type: concept weight: 20 --- -This document describes the current state of _persistent volumes_ in Kubernetes. Familiarity with [volumes](/docs/concepts/storage/volumes/) is suggested. +This document describes _persistent volumes_ in Kubernetes. Familiarity with [volumes](/docs/concepts/storage/volumes/) is suggested. diff --git a/content/en/docs/concepts/storage/projected-volumes.md b/content/en/docs/concepts/storage/projected-volumes.md index 962e6bae91..e515b1138e 100644 --- a/content/en/docs/concepts/storage/projected-volumes.md +++ b/content/en/docs/concepts/storage/projected-volumes.md @@ -1,6 +1,5 @@ --- reviewers: -- sftim - marosset - jsturtevant - zshihang @@ -11,7 +10,7 @@ weight: 21 # just after persistent volumes -This document describes the current state of _projected volumes_ in Kubernetes. Familiarity with [volumes](/docs/concepts/storage/volumes/) is suggested. +This document describes _projected volumes_ in Kubernetes. Familiarity with [volumes](/docs/concepts/storage/volumes/) is suggested. diff --git a/content/en/docs/concepts/storage/storage-capacity.md b/content/en/docs/concepts/storage/storage-capacity.md index dbe30643d9..ecf3fdc213 100644 --- a/content/en/docs/concepts/storage/storage-capacity.md +++ b/content/en/docs/concepts/storage/storage-capacity.md @@ -16,7 +16,6 @@ Storage capacity is limited and may vary depending on the node on which a pod runs: network-attached storage might not be accessible by all nodes, or storage is local to a node to begin with. -{{< feature-state for_k8s_version="v1.19" state="alpha" >}} {{< feature-state for_k8s_version="v1.21" state="beta" >}} This page describes how Kubernetes keeps track of storage capacity and From 0f26532d91418d80e615a88931cb856866a9da5b Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Wed, 17 Nov 2021 13:52:56 +0900 Subject: [PATCH 048/148] [ko] Update outdated files in dev-1.22-ko.3 28-38 --- .../ingress-minikube.md | 279 +++++++++--------- .../web-ui-dashboard.md | 2 +- .../change-pv-reclaim-policy.md | 8 +- .../horizontal-pod-autoscale-walkthrough.md | 4 +- .../docs/tasks/tools/install-kubectl-linux.md | 4 +- .../docs/tasks/tools/install-kubectl-macos.md | 4 +- .../tasks/tools/install-kubectl-windows.md | 4 +- .../stateful-application/zookeeper.md | 17 +- content/ko/releases/notes.md | 4 +- content/ko/training/_index.html | 12 + 10 files changed, 166 insertions(+), 172 deletions(-) diff --git a/content/ko/docs/tasks/access-application-cluster/ingress-minikube.md b/content/ko/docs/tasks/access-application-cluster/ingress-minikube.md index fcc64072b7..a59c25d390 100644 --- a/content/ko/docs/tasks/access-application-cluster/ingress-minikube.md +++ b/content/ko/docs/tasks/access-application-cluster/ingress-minikube.md @@ -2,6 +2,7 @@ title: NGINX 인그레스(Ingress) 컨트롤러로 Minikube에서 인그레스 설정하기 content_type: task weight: 100 +min-kubernetes-server-version: 1.19 --- @@ -17,23 +18,21 @@ API 객체이다. [인그레스 컨트롤러](/ko/docs/concepts/services-network {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} +만약 이보다 더 이전 버전의 쿠버네티스를 사용하고 있다면, +해당 쿠버네티스 버전의 문서를 참고한다. +### Minikube 클러스터 생성하기 + +Katacoda 활용하기 +: {{< kat-button >}} + +로컬에서 생성하기 +: 이미 로컬에 [Minikube를 설치](/ko/docs/tasks/tools/#minikube)했다면, + `minikube start`를 실행하여 클러스터를 생성한다. -## Minikube 클러스터 생성하기 - -1. **터미널 실행**을 클릭한다. - - {{< kat-button >}} - -1. (선택 사항) Minikube를 로컬로 설치한 경우 다음 명령을 실행한다. - - ```shell - minikube start - ``` - ## 인그레스 컨트롤러 활성화 1. NGINX 인그레스 컨트롤러를 활성화하기 위해 다음 명령을 실행한다. @@ -45,14 +44,14 @@ API 객체이다. [인그레스 컨트롤러](/ko/docs/concepts/services-network 1. NGINX 인그레스 컨트롤러가 실행 중인지 확인한다. - {{< tabs name="tab_with_md" >}} - {{% tab name="minikube v1.19 or later" %}} + {{< tabs name="tab_with_md" >}} + {{% tab name="minikube v1.19 or later" %}} ```shell kubectl get pods -n ingress-nginx ``` - {{< note >}}이 작업은 1분 정도 소요될 수 있다.{{< /note >}} + {{< note >}}파드가 정상적으로 실행되기까지 1분 정도 소요될 수 있다.{{< /note >}} -Output: + 결과는 다음과 같다. ``` NAME READY STATUS RESTARTS AGE @@ -60,15 +59,14 @@ ingress-nginx-admission-create-g9g49 0/1 Completed 0 11m ingress-nginx-admission-patch-rqp78 0/1 Completed 1 11m ingress-nginx-controller-59b45fb494-26npt 1/1 Running 0 11m ``` - {{% /tab %}} - - {{% tab name="minikube v1.18.1 or earlier" %}} + {{% /tab %}} + {{% tab name="minikube v1.18.1 or earlier" %}} ```shell kubectl get pods -n kube-system ``` -{{< note >}}이 작업은 1분 정도 소요될 수 있다.{{< /note >}} + {{< note >}}파드가 정상적으로 실행되기까지 1분 정도 소요될 수 있다.{{< /note >}} -Output: + 결과는 다음과 같다. ``` NAME READY STATUS RESTARTS AGE @@ -79,133 +77,121 @@ kubernetes-dashboard-5498ccf677-b8p5h 1/1 Running 0 2m nginx-ingress-controller-5984b97644-rnkrg 1/1 Running 0 1m storage-provisioner 1/1 Running 0 2m ``` - {{% /tab %}} - {{< /tabs >}} - - - - ```shell - kubectl get pods -n ingress-nginx - ``` - - {{< note >}}이 작업은 1분 정도 소요될 수 있다.{{< /note >}} - - Output: - - ```shell - NAME READY STATUS RESTARTS AGE - ingress-nginx-admission-create-2tgrf 0/1 Completed 0 3m28s - ingress-nginx-admission-patch-68b98 0/1 Completed 0 3m28s - ingress-nginx-controller-59b45fb494-lzmw2 1/1 Running 0 3m28s - ``` + `nginx-ingress-controller-`로 시작하는 파드가 있는지 확인한다. + {{% /tab %}} + {{< /tabs >}} ## hello, world 앱 배포하기 1. 다음 명령을 사용하여 디플로이먼트(Deployment)를 생성한다. - ```shell - kubectl create deployment web --image=gcr.io/google-samples/hello-app:1.0 - ``` + ```shell + kubectl create deployment web --image=gcr.io/google-samples/hello-app:1.0 + ``` - Output: + 결과는 다음과 같다. - ```shell - deployment.apps/web created - ``` + ``` + deployment.apps/web created + ``` 1. 디플로이먼트를 노출시킨다. - ```shell - kubectl expose deployment web --type=NodePort --port=8080 - ``` + ```shell + kubectl expose deployment web --type=NodePort --port=8080 + ``` - Output: + 결과는 다음과 같다. - ```shell - service/web exposed - ``` + ``` + service/web exposed + ``` 1. 서비스(Service)가 생성되고 노드 포트에서 사용할 수 있는지 확인한다. - ```shell - kubectl get service web - ``` + ```shell + kubectl get service web + ``` - Output: + 결과는 다음과 같다. - ```shell - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - web NodePort 10.104.133.249 8080:31637/TCP 12m - ``` + ``` + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + web NodePort 10.104.133.249 8080:31637/TCP 12m + ``` 1. 노드포트(NodePort)를 통해 서비스에 접속한다. - ```shell - minikube service web --url - ``` + ```shell + minikube service web --url + ``` - Output: + 결과는 다음과 같다. - ```shell - http://172.17.0.15:31637 - ``` + ``` + http://172.17.0.15:31637 + ``` - {{< note >}}Katacoda 환경만 해당: 터미널 패널 상단에서 더하기 기호를 클릭한 다음 **Select port to view on Host 1**을 클릭한다. 노드포트(이 경우 '31637')를 입력한 다음 **Display Port**를 클릭한다.{{< /note >}} + {{< note >}}Katacoda 환경만 해당: 터미널 패널 상단에서 더하기 기호를 클릭한 다음 **Select port to view on Host 1**을 클릭한다. 노드포트(이 경우 '31637')를 입력한 다음 **Display Port**를 클릭한다.{{< /note >}} - Output: + 결과는 다음과 같다. - ```shell - Hello, world! - Version: 1.0.0 - Hostname: web-55b8c6998d-8k564 - ``` + ``` + Hello, world! + Version: 1.0.0 + Hostname: web-55b8c6998d-8k564 + ``` - 이제 Minikube IP 주소와 노드포트를 통해 샘플 앱에 액세스할 수 있다. 다음 단계에서는 - 인그레스 리소스를 사용하여 앱에 액세스할 수 있다. + 이제 Minikube IP 주소와 노드포트를 통해 샘플 앱에 액세스할 수 있다. 다음 단계에서는 + 인그레스 리소스를 사용하여 앱에 액세스할 수 있다. -## 인그레스 리소스 생성하기 +## 인그레스 생성하기 -다음 파일은 hello-world.info를 통해 서비스로 트래픽을 보내는 인그레스 리소스다. +다음 매니페스트는 hello-world.info를 통해 서비스로 트래픽을 보내는 인그레스를 정의한다. 1. 다음 파일을 통해 `example-ingress.yaml`을 만든다. {{< codenew file="service/networking/example-ingress.yaml" >}} -1. 다음 명령어를 실행하여 인그레스 리소스를 생성한다. +1. 다음 명령어를 실행하여 인그레스 오브젝트를 생성한다. - ```shell - kubectl apply -f https://k8s.io/examples/service/networking/example-ingress.yaml - ``` + ```shell + kubectl apply -f https://k8s.io/examples/service/networking/example-ingress.yaml + ``` - Output: + 결과는 다음과 같다. - ```shell - ingress.networking.k8s.io/example-ingress created - ``` + ``` + ingress.networking.k8s.io/example-ingress created + ``` 1. IP 주소가 설정되었는지 확인한다. - ```shell - kubectl get ingress - ``` + ```shell + kubectl get ingress + ``` - {{< note >}}이 작업은 몇 분 정도 소요될 수 있다.{{< /note >}} + {{< note >}}이 작업은 몇 분 정도 소요될 수 있다.{{< /note >}} - ```shell - NAME CLASS HOSTS ADDRESS PORTS AGE - example-ingress hello-world.info 172.17.0.15 80 38s - ``` +다음 예시와 같이, ADDRESS 열에서 IPv4 주소를 확인할 수 있다. -1. `/etc/hosts` 파일의 맨 아래에 다음 행을 추가한다. + ``` + NAME CLASS HOSTS ADDRESS PORTS AGE + example-ingress hello-world.info 172.17.0.15 80 38s + ``` - {{< note >}}Minikube를 로컬에서 실행하는 경우 'minikube ip'를 사용하여 외부 IP를 가져온다. 인그레스 목록에 표시되는 IP 주소는 내부 IP가 된다.{{< /note >}} +1. 호스트 컴퓨터의 `/etc/hosts` 파일 맨 아래에 + 다음 행을 추가한다 (관리자 권한 필요). ``` 172.17.0.15 hello-world.info ``` - 이것은 hello-world.info에서 Minikube로 요청을 보낸다. + {{< note >}}Minikube를 로컬에서 실행하는 경우 'minikube ip'를 사용하여 외부 IP를 가져온다. 인그레스 목록에 표시되는 IP 주소는 내부 IP가 된다.{{< /note >}} + + 이렇게 하면, 웹 브라우저가 + hello-world.info URL에 대한 요청을 Minikube로 전송한다. 1. 인그레스 컨트롤러가 트래픽을 전달하는지 확인한다. @@ -213,9 +199,9 @@ storage-provisioner 1/1 Running 0 2m curl hello-world.info ``` - Output: + 결과는 다음과 같다. - ```shell + ``` Hello, world! Version: 1.0.0 Hostname: web-55b8c6998d-8k564 @@ -225,32 +211,33 @@ storage-provisioner 1/1 Running 0 2m ## 두 번째 디플로이먼트 생성하기 -1. 다음 명령을 사용하여 v2 디플로이먼트를 생성한다. +1. 다음 명령을 사용하여 두 번째 디플로이먼트를 생성한다. - ```shell - kubectl create deployment web2 --image=gcr.io/google-samples/hello-app:2.0 - ``` - Output: + ```shell + kubectl create deployment web2 --image=gcr.io/google-samples/hello-app:2.0 + ``` + 결과는 다음과 같다. - ```shell - deployment.apps/web2 created - ``` + ``` + deployment.apps/web2 created + ``` -1. 디플로이먼트를 노출시킨다. +1. 두 번째 디플로이먼트를 노출시킨다. - ```shell - kubectl expose deployment web2 --port=8080 --type=NodePort - ``` + ```shell + kubectl expose deployment web2 --port=8080 --type=NodePort + ``` - Output: + 결과는 다음과 같다. - ```shell - service/web2 exposed - ``` + ``` + service/web2 exposed + ``` -## 인그레스 수정하기 +## 기존 인그레스 수정하기 {#edit-ingress} -1. 기존 `example-ingress.yaml`을 편집하여 다음 줄을 추가한다. +1. 기존 `example-ingress.yaml` 매니페스트를 편집하고, +하단에 다음 줄을 추가한다. ```yaml - path: /v2 @@ -264,47 +251,47 @@ storage-provisioner 1/1 Running 0 2m 1. 변경 사항을 적용한다. - ```shell - kubectl apply -f example-ingress.yaml - ``` + ```shell + kubectl apply -f example-ingress.yaml + ``` - Output: + 결과는 다음과 같다. - ```shell - ingress.networking/example-ingress configured - ``` + ``` + ingress.networking/example-ingress configured + ``` ## 인그레스 테스트하기 1. Hello World 앱의 첫 번째 버전에 액세스한다. - ```shell - curl hello-world.info - ``` + ```shell + curl hello-world.info + ``` - Output: + 결과는 다음과 같다. - ```shell - Hello, world! - Version: 1.0.0 - Hostname: web-55b8c6998d-8k564 - ``` + ``` + Hello, world! + Version: 1.0.0 + Hostname: web-55b8c6998d-8k564 + ``` 1. Hello World 앱의 두 번째 버전에 액세스한다. - ```shell - curl hello-world.info/v2 - ``` + ```shell + curl hello-world.info/v2 + ``` - Output: + 결과는 다음과 같다. - ```shell - Hello, world! - Version: 2.0.0 - Hostname: web2-75cd47646f-t8cjk - ``` + ``` + Hello, world! + Version: 2.0.0 + Hostname: web2-75cd47646f-t8cjk + ``` - {{< note >}}Minikube를 로컬에서 실행하는 경우 브라우저에서 hello-world.info 및 hello-world.info/v2에 접속할 수 있다.{{< /note >}} + {{< note >}}Minikube를 로컬에서 실행하는 경우 브라우저에서 hello-world.info 및 hello-world.info/v2에 접속할 수 있다.{{< /note >}} @@ -315,5 +302,3 @@ storage-provisioner 1/1 Running 0 2m * [인그레스 컨트롤러](/ko/docs/concepts/services-networking/ingress-controllers/)에 대해 더 보기. * [서비스](/ko/docs/concepts/services-networking/service/)에 대해 더 보기. - - diff --git a/content/ko/docs/tasks/access-application-cluster/web-ui-dashboard.md b/content/ko/docs/tasks/access-application-cluster/web-ui-dashboard.md index daa1417ce9..0f1055ca60 100644 --- a/content/ko/docs/tasks/access-application-cluster/web-ui-dashboard.md +++ b/content/ko/docs/tasks/access-application-cluster/web-ui-dashboard.md @@ -35,7 +35,7 @@ card: 대시보드 UI는 기본으로 배포되지 않는다. 배포하려면 다음 커맨드를 실행한다. ``` -kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.3.1/aio/deploy/recommended.yaml +kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.4.0/aio/deploy/recommended.yaml ``` ## 대시보드 UI 접근 diff --git a/content/ko/docs/tasks/administer-cluster/change-pv-reclaim-policy.md b/content/ko/docs/tasks/administer-cluster/change-pv-reclaim-policy.md index 2d1b723e27..2f663befec 100644 --- a/content/ko/docs/tasks/administer-cluster/change-pv-reclaim-policy.md +++ b/content/ko/docs/tasks/administer-cluster/change-pv-reclaim-policy.md @@ -88,8 +88,8 @@ kubectl patch pv -p "{\"spec\":{\"persistentVolumeReclaimPolicy\" * [퍼시스턴트볼륨](/ko/docs/concepts/storage/persistent-volumes/)에 대해 더 배워 보기. * [퍼시스턴트볼륨클레임](/ko/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims)에 대해 더 배워 보기. -### Reference +### 레퍼런스 {#reference} -* [퍼시스턴트볼륨](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#persistentvolume-v1-core) -* [퍼시스턴트볼륨클레임](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#persistentvolumeclaim-v1-core) -* [PersistentVolumeSpec](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#persistentvolumeclaim-v1-core)의 `persistentVolumeReclaimPolicy` 필드에 대해 보기. +* {{< api-reference page="config-and-storage-resources/persistent-volume-v1" >}} + * Pay attention to the 퍼시스턴트볼륨의 `.spec.persistentVolumeReclaimPolicy` [필드](docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-v1/#PersistentVolumeSpec)에 주의한다. +* {{< api-reference page="config-and-storage-resources/persistent-volume-claim-v1" >}} diff --git a/content/ko/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md b/content/ko/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md index 9b5ea5b6cf..a910dc5c48 100644 --- a/content/ko/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md +++ b/content/ko/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md @@ -82,8 +82,8 @@ service/php-apache created 다음 명령어는 첫 번째 단계에서 만든 php-apache 디플로이먼트 파드의 개수를 1부터 10 사이로 유지하는 Horizontal Pod Autoscaler를 생성한다. 간단히 얘기하면, HPA는 (디플로이먼트를 통한) 평균 CPU 사용량을 50%로 유지하기 위하여 레플리카의 개수를 늘리고 줄인다. -(kubectl run으로 각 파드는 200 밀리코어까지 요청할 수 있고, -따라서 여기서 말하는 평균 CPU 사용은 100 밀리코어를 말한다). +kubectl run으로 각 파드는 200 밀리코어를 요청하므로, +여기서 말하는 평균 CPU 사용은 100 밀리코어를 말한다. 이에 대한 자세한 알고리즘은 [여기](/ko/docs/tasks/run-application/horizontal-pod-autoscale/#알고리즘-세부-정보)를 참고하기 바란다. ```shell diff --git a/content/ko/docs/tasks/tools/install-kubectl-linux.md b/content/ko/docs/tasks/tools/install-kubectl-linux.md index da58e6ca8b..71858e3e92 100644 --- a/content/ko/docs/tasks/tools/install-kubectl-linux.md +++ b/content/ko/docs/tasks/tools/install-kubectl-linux.md @@ -12,8 +12,8 @@ card: ## {{% heading "prerequisites" %}} -클러스터의 마이너(minor) 버전 차이 내에 있는 kubectl 버전을 사용해야 한다. 예를 들어, v{{< skew latestVersion >}} 클라이언트는 v{{< skew prevMinorVersion >}}, v{{< skew latestVersion >}}, v{{< skew nextMinorVersion >}}의 컨트롤 플레인과 연동될 수 있다. -최신 버전의 kubectl을 사용하면 예기치 않은 문제를 피할 수 있다. +클러스터의 마이너(minor) 버전 차이 내에 있는 kubectl 버전을 사용해야 한다. 예를 들어, v{{< skew currentVersion >}} 클라이언트는 v{{< skew currentVersionAddMinor -1 >}}, v{{< skew currentVersion >}}, v{{< skew currentVersionAddMinor 1 >}}의 컨트롤 플레인과 연동될 수 있다. +호환되는 최신 버전의 kubectl을 사용하면 예기치 않은 문제를 피할 수 있다. ## 리눅스에 kubectl 설치 diff --git a/content/ko/docs/tasks/tools/install-kubectl-macos.md b/content/ko/docs/tasks/tools/install-kubectl-macos.md index cd03eb91b7..0fc350f02f 100644 --- a/content/ko/docs/tasks/tools/install-kubectl-macos.md +++ b/content/ko/docs/tasks/tools/install-kubectl-macos.md @@ -12,8 +12,8 @@ card: ## {{% heading "prerequisites" %}} -클러스터의 마이너(minor) 버전 차이 내에 있는 kubectl 버전을 사용해야 한다. 예를 들어, v{{< skew latestVersion >}} 클라이언트는 v{{< skew prevMinorVersion >}}, v{{< skew latestVersion >}}, v{{< skew nextMinorVersion >}}의 컨트롤 플레인과 연동될 수 있다. -최신 버전의 kubectl을 사용하면 예기치 않은 문제를 피할 수 있다. +클러스터의 마이너(minor) 버전 차이 내에 있는 kubectl 버전을 사용해야 한다. 예를 들어, v{{< skew currentVersion >}} 클라이언트는 v{{< skew currentVersionAddMinor -1 >}}, v{{< skew currentVersion >}}, v{{< skew currentVersionAddMinor 1 >}}의 컨트롤 플레인과 연동될 수 있다. +호환되는 최신 버전의 kubectl을 사용하면 예기치 않은 문제를 피할 수 있다. ## macOS에 kubectl 설치 diff --git a/content/ko/docs/tasks/tools/install-kubectl-windows.md b/content/ko/docs/tasks/tools/install-kubectl-windows.md index 21fe1a9afb..e1a62c613c 100644 --- a/content/ko/docs/tasks/tools/install-kubectl-windows.md +++ b/content/ko/docs/tasks/tools/install-kubectl-windows.md @@ -12,8 +12,8 @@ card: ## {{% heading "prerequisites" %}} -클러스터의 마이너(minor) 버전 차이 내에 있는 kubectl 버전을 사용해야 한다. 예를 들어, v{{< skew latestVersion >}} 클라이언트는 v{{< skew prevMinorVersion >}}, v{{< skew latestVersion >}}, v{{< skew nextMinorVersion >}}의 컨트롤 플레인과 연동될 수 있다. -최신 버전의 kubectl을 사용하면 예기치 않은 문제를 피할 수 있다. +클러스터의 마이너(minor) 버전 차이 내에 있는 kubectl 버전을 사용해야 한다. 예를 들어, v{{< skew currentVersion >}} 클라이언트는 v{{< skew currentVersionAddMinor -1 >}}, v{{< skew currentVersion >}}, v{{< skew currentVersionAddMinor 1 >}}의 컨트롤 플레인과 연동될 수 있다. +호환되는 최신 버전의 kubectl을 사용하면 예기치 않은 문제를 피할 수 있다. ## 윈도우에 kubectl 설치 diff --git a/content/ko/docs/tutorials/stateful-application/zookeeper.md b/content/ko/docs/tutorials/stateful-application/zookeeper.md index a9c834d7b3..248d6d1d4d 100644 --- a/content/ko/docs/tutorials/stateful-application/zookeeper.md +++ b/content/ko/docs/tutorials/stateful-application/zookeeper.md @@ -40,7 +40,6 @@ weight: 40 튜토리얼을 시작하기 전에 수동으로 3개의 20 GiB 볼륨을 프로비저닝해야 한다. - ## {{% heading "objectives" %}} 이 튜토리얼을 마치면 다음에 대해 알게 된다. @@ -50,7 +49,6 @@ weight: 40 - 어떻게 ZooKeeper 서버 디플로이먼트를 앙상블 안에서 퍼뜨리는가. - 어떻게 PodDisruptionBudget을 이용하여 계획된 점검 기간 동안 서비스 가용성을 보장하는가. - ### ZooKeeper @@ -262,13 +260,15 @@ server.3=zk-2.zk-hs.default.svc.cluster.local:2888:3888 ### 앙상블 무결성 테스트 -가장 기본적인 테스트는 한 ZooKeeper 서버에 데이터를 쓰고 다른 ZooKeeper 서버에서 데이터를 읽는 것이다. +가장 기본적인 테스트는 한 ZooKeeper 서버에 데이터를 쓰고 +다른 ZooKeeper 서버에서 데이터를 읽는 것이다. 아래 명령어는 앙상블 내에 `zk-0` 파드에서 `/hello` 경로로 `world`를 쓰는 스크립트인 `zkCli.sh`를 실행한다. ```shell -kubectl exec zk-0 zkCli.sh create /hello world +kubectl exec zk-0 -- zkCli.sh create /hello world ``` + ``` WATCHER:: @@ -279,7 +279,7 @@ Created /hello `zk-1` 파드에서 데이터를 읽기 위해 다음 명령어를 이용하자. ```shell -kubectl exec zk-1 zkCli.sh get /hello +kubectl exec zk-1 -- zkCli.sh get /hello ``` `zk-0`에서 생성한 그 데이터는 앙상블 내에 모든 서버에서 @@ -409,7 +409,6 @@ numChildren = 0 `zk` 스테이트풀셋의 `spec`에 `volumeClaimTemplates` 필드는 각 파드에 프로비전될 퍼시스턴트볼륨을 지정한다. - ```yaml volumeClaimTemplates: - metadata: @@ -443,7 +442,6 @@ datadir-zk-2 Bound pvc-bee0817e-bcb1-11e6-994f-42010a800002 20Gi R `스테이트풀셋`의 컨테이너 `template`의 `volumeMounts` 부분이 ZooKeeper 서버의 데이터 디렉터리에 퍼시스턴트볼륨 마운트하는 내용이다. - ```shell volumeMounts: - name: datadir @@ -591,6 +589,7 @@ kubectl exec zk-0 -- ps -elf `securityContext` 오브젝트의 `runAsUser` 필드 값이 1000 이므로 루트 사용자로 실행하는 대신 ZooKeeper 프로세스는 ZooKeeper 사용자로 실행된다. + ``` F S UID PID PPID C PRI NI ADDR SZ WCHAN STIME TTY TIME CMD 4 S zookeep+ 1 0 0 80 0 - 1127 - 20:46 ? 00:00:00 sh -c zkGenConfig.sh && zkServer.sh start-foreground @@ -695,6 +694,7 @@ kubectl exec zk-0 -- ps -ef 컨테이너의 엔트리 포인트로 PID 1 인 명령이 사용되었으며 ZooKeeper 프로세스는 엔트리 포인트의 자식 프로세스로 PID 27 이다. + ``` UID PID PPID C STIME TTY TIME CMD zookeep+ 1 0 0 15:03 ? 00:00:00 sh -c zkGenConfig.sh && zkServer.sh start-foreground @@ -1033,7 +1033,6 @@ kubectl 을 종료하기 위해 `CTRL-C`를 이용하자. `zk-0`에서 온전성 테스트 때에 입력한 값을 가져오는 `zkCli.sh`를 이용하자. - ```shell kubectl exec zk-0 zkCli.sh get /hello ``` @@ -1132,10 +1131,8 @@ drain으로 노드를 통제하고 유지보수를 위해 노드를 오프라인 서비스는 혼란 예산을 표기한 서비스는 그 예산이 존중은 존중될 것이다. 파드가 즉각적으로 재스케줄 할 수 있도록 항상 중요 서비스를 위한 추가 용량을 할당해야 한다. - ## {{% heading "cleanup" %}} - - `kubectl uncordon`은 클러스터 내에 모든 노드를 통제 해제한다. - 반드시 이 튜토리얼에서 사용한 퍼시스턴트 볼륨을 위한 퍼시스턴트 스토리지 미디어를 삭제하자. 귀하의 환경과 스토리지 구성과 프로비저닝 방법에서 필요한 절차를 따라서 diff --git a/content/ko/releases/notes.md b/content/ko/releases/notes.md index b509ae0d65..45f3f0a28a 100644 --- a/content/ko/releases/notes.md +++ b/content/ko/releases/notes.md @@ -8,6 +8,6 @@ sitemap: priority: 0.5 --- -릴리스 노트는 사용자의 쿠버네티스 버전에 해당하는 [변경로그(Changelog)](https://github.com/kubernetes/kubernetes/tree/master/CHANGELOG)를 통해서 확인할 수 있다. {{< skew latestVersion >}} 의 변경로그는 [깃허브](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-{{< skew latestVersion >}}.md)에 있다. +릴리스 노트는 사용자의 쿠버네티스 버전에 해당하는 [변경로그(Changelog)](https://github.com/kubernetes/kubernetes/tree/master/CHANGELOG)를 통해서 확인할 수 있다. {{< skew currentVersionAddMinor 0 >}} 의 변경로그는 [깃허브](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-{{< skew currentVersionAddMinor 0 >}}.md)에 있다. -대안으로, 릴리스 노트는 [relnotes.k8s.io](https://relnotes.k8s.io)에서 온라인으로 검색 및 필터링이 가능하다. {{< skew latestVersion >}}로 필터링된 릴리스 노트는 [relnotes.k8s.io](https://relnotes.k8s.io/?releaseVersions={{< skew latestVersion >}}.0)에서 확인한다. +대안으로, 릴리스 노트는 [relnotes.k8s.io](https://relnotes.k8s.io)에서 온라인으로 검색 및 필터링이 가능하다. {{< skew currentVersionAddMinor 0 >}}로 필터링된 릴리스 노트는 [relnotes.k8s.io](https://relnotes.k8s.io/?releaseVersions={{< skew currentVersionAddMinor 0 >}}.0)에서 확인한다. diff --git a/content/ko/training/_index.html b/content/ko/training/_index.html index ff24428664..ac028b6005 100644 --- a/content/ko/training/_index.html +++ b/content/ko/training/_index.html @@ -14,6 +14,9 @@ class: training

클라우드 네이티브 커리어를 구축하세요

쿠버네티스는 클라우드 네이티브 무브먼트의 핵심입니다. 리눅스 재단이 제공하는 교육과 인증 프로그램을 통해 커리어에 투자하고, 쿠버네티스를 배우며, 클라우드 네이티브 프로젝트를 성공적으로 수행하세요.

+
+ +
@@ -81,6 +84,15 @@ class: training

쿠버네티스 공인 자격 획득하기

+
+
+ 쿠버네티스 및 클라우드 네이티브 전문가(Kubernetes and Cloud Native Associate, KCNA) +
+

쿠버네티스 및 클라우드 네이티브 전문가 시험은 사용자의 쿠버네티스와 더 넓은 클라우드 네이티브 생태계에 대한 핵심 지식과 기술을 보여줍니다.

+

인증된 KCNA는 전체적인 클라우드 네이티브 생태계, 특히 쿠버네티스에 대한 개념적 지식을 확인시켜 줄 것입니다.

+
+ Go to Certification +
공인 쿠버네티스 애플리케이션 개발자(Certified Kubernetes Application Developer, CKAD) From 8d6da018576a9a50acfcdb9f451021d5c1a000dc Mon Sep 17 00:00:00 2001 From: Swati Sehgal Date: Fri, 21 May 2021 00:39:30 +0100 Subject: [PATCH 049/148] podresource-api: Graduate GetAllocatableResources to Beta Also, explicitly clarify the behavior of GetAllocatableResources The explanation that GetAllocatableResources can be used to obtain available resources on the node can be misinterpretted as an API that is used to obtain free/unallocated resources on a node. This PR adds additional text to clarify that this API endpoint only returns allocatable resources which are resources exposed to kubelet as defined here: https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable. Signed-off-by: Swati Sehgal --- .../compute-storage-net/device-plugins.md | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/content/en/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md b/content/en/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md index 868d8d56e8..6e766a86d6 100644 --- a/content/en/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md +++ b/content/en/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md @@ -197,6 +197,8 @@ service PodResourcesLister { } ``` +### `List` gRPC endpoint {#grpc-endpoint-list} + The `List` endpoint provides information on resources of running pods, with details such as the id of exclusively allocated CPUs, device id as it was reported by device plugins and id of the NUMA node where these devices are allocated. Also, for NUMA-based machines, it contains the information about memory and hugepages reserved for a container. @@ -247,9 +249,25 @@ message ContainerDevices { } ``` +### `GetAllocatableResources` gRPC endpoint {#grpc-endpoint-getallocatableresources} + +{{< feature-state state="beta" for_k8s_version="v1.23" >}} + GetAllocatableResources provides information on resources initially available on the worker node. It provides more information than kubelet exports to APIServer. +{{< note >}} +`GetAllocatableResources` should only be used to evaluate [allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable) +resources on a node. If the goal is to evaluate free/unallocated resources it should be used in +conjunction with the List() endpoint. The result obtained by `GetAllocatableResources` would remain +the same unless the underlying resources exposed to kubelet change. This happens rarely but when +it does (for example: hotplug/hotunplug, device health changes), client is expected to call +`GetAlloctableResources` endpoint. +However, calling `GetAllocatableResources` endpoint is not sufficient in case of cpu and/or memory +update and Kubelet needs to be restarted to reflect the correct resource capacity and allocatable. +{{< /note >}} + + ```gRPC // AllocatableResourcesResponses contains informations about all the devices known by the kubelet message AllocatableResourcesResponse { @@ -259,6 +277,13 @@ message AllocatableResourcesResponse { } ``` +Starting from Kubernetes v1.23, the `GetAllocatableResources` is enabled by default. +You can disable it by turning off the +`KubeletPodResourcesGetAllocatable` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/). + +Preceding Kubernetes v1.23, to enable this feature `kubelet` must be started with the following flag: + +`--feature-gates=KubeletPodResourcesGetAllocatable=true` `ContainerDevices` do expose the topology information declaring to which NUMA cells the device is affine. The NUMA cells are identified using a opaque integer ID, which value is consistent to what device From c7231c8d6d0045bba24ea475f44e5daa3525df3c Mon Sep 17 00:00:00 2001 From: Swati Sehgal Date: Tue, 5 Oct 2021 21:08:43 +0100 Subject: [PATCH 050/148] Explicitly state that GetCpuIds returns exclusive cpus Based on the discussion here: https://github.com/kubernetes/kubernetes/pull/97415#discussion_r722548437 we explictly state that the GetCpuIds returned for a ContainerResource in the ListPodResourcesResponse represent only exclusively allocated CPUs. In order to evaluate the CPUs corresponding to the shared pool, List endpoint should be used in conjunction with GetAllocatableResources endpoint. We highlight the steps that the client needs to take evaluate this. Signed-off-by: Swati Sehgal --- .../compute-storage-net/device-plugins.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/content/en/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md b/content/en/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md index 6e766a86d6..f14f78b13b 100644 --- a/content/en/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md +++ b/content/en/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md @@ -248,6 +248,15 @@ message ContainerDevices { TopologyInfo topology = 3; } ``` +{{< note >}} +cpu_ids in the `ContainerResources` in the `List` endpoint correspond to exclusive CPUs allocated +to a partilar container. If the goal is to evaluate CPUs that belong to the shared pool, the `List` +endpoint needs to be used in conjunction with the `GetAllocatableResources` endpoint as explained +below: +1. Call `GetAllocatableResources` to get a list of all the allocatable CPUs +2. Call `GetCpuIds` on all `ContainerResources` in the system +3. Subtract out all of the CPUs from the `GetCpuIds` calls from the `GetAllocatableResources` call +{{< /note >}} ### `GetAllocatableResources` gRPC endpoint {#grpc-endpoint-getallocatableresources} From 378fc570b1863c0494e1541724f21eb49d287872 Mon Sep 17 00:00:00 2001 From: Kevin Klues Date: Sat, 13 Nov 2021 17:06:40 +0100 Subject: [PATCH 051/148] Add description of distribute-cpus-across-numa CPUManager policy option Signed-off-by: Kevin Klues --- .../cpu-management-policies.md | 26 ++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/cpu-management-policies.md b/content/en/docs/tasks/administer-cluster/cpu-management-policies.md index 9eb7d7febb..41fbe77cb0 100644 --- a/content/en/docs/tasks/administer-cluster/cpu-management-policies.md +++ b/content/en/docs/tasks/administer-cluster/cpu-management-policies.md @@ -218,8 +218,11 @@ equal to one. The `nginx` container is granted 2 exclusive CPUs. #### Static policy options +The following policy options exist for the static `CPUManager` policy: +* `full-pcpus-only` (beta, visible by default) +* `distribute-cpus-across-numa` (alpha, hidden by default) + If the `full-pcpus-only` policy option is specified, the static policy will always allocate full physical cores. -You can enable this option by adding `full-pcups-only=true` to the CPUManager policy options. By default, without this option, the static policy allocates CPUs using a topology-aware best-fit allocation. On SMT enabled systems, the policy can allocate individual virtual cores, which correspond to hardware threads. This can lead to different containers sharing the same physical cores; this behaviour in turn contributes @@ -227,3 +230,24 @@ to the [noisy neighbours problem](https://en.wikipedia.org/wiki/Cloud_computing_ With the option enabled, the pod will be admitted by the kubelet only if the CPU request of all its containers can be fulfilled by allocating full physical cores. If the pod does not pass the admission, it will be put in Failed state with the message `SMTAlignmentError`. + +If the `distribute-cpus-across-numa`policy option is specified, the static +policy will evenly distribute CPUs across NUMA nodes in cases where more than +one NUMA node is required to satisfy the allocation. +By default, the `CPUManager` will pack CPUs onto one NUMA node until it is +filled, with any remaining CPUs simply spilling over to the next NUMA node. +This can cause undesired bottlenecks in parallel code relying on barriers (and +similar synchronization primitivies), as this type of code tends to run only as +fast as its slowest worker (which is slowed down by the fact that fewer CPUs +are available on at least one NUMA node). +By distributing CPUs evenly across NUMA nodes, application developers can more +easily ensure that no single worker suffers from NUMA effects more than any +other, improving the overall performance of these types of applications. + +The `full-pcpus-only` option can be enabled by adding `full-pcups-only=true` to +the CPUManager policy options. +Likewise, the `distribute-cpus-across-numa` option can be enabled by adding +`distribute-cpus-across-numa=true` to the CPUManager policy options. +When both are set, they are "additive" in the sense that CPUs will be +distributed across NUMA nodes in chunks of full-pcpus rather than individual +cores. From e8ff60d0e98d730de0bb23614037a5b0738965cb Mon Sep 17 00:00:00 2001 From: Vaibhav Date: Thu, 18 Nov 2021 10:49:08 +0530 Subject: [PATCH 052/148] Update the reference statement in access-cluster-services.md --- .../en/docs/tasks/access-application-cluster/access-cluster.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/access-cluster.md b/content/en/docs/tasks/access-application-cluster/access-cluster.md index b50dee5dcc..9f56a409f4 100644 --- a/content/en/docs/tasks/access-application-cluster/access-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/access-cluster.md @@ -214,8 +214,7 @@ In each case, the credentials of the pod are used to communicate securely with t ## Accessing services running on the cluster -The previous section was about connecting the Kubernetes API server. [This section](/docs/tasks/access-application-cluster/access-cluster/) is about -connecting to other services running on Kubernetes cluster. +The previous section describes how to connect to the Kubernetes API server. For information about connecting to other services running on a Kubernetes cluster, see [Access Cluster Services.](/docs/tasks/access-application-cluster/access-cluster/) ## Requesting redirects From c3073161f7f28b401dbdea1e5a97106aa9ad28f2 Mon Sep 17 00:00:00 2001 From: Patrick Ohly Date: Tue, 16 Nov 2021 16:13:35 +0100 Subject: [PATCH 053/148] logging: structured logging, klog deprecation This is primarily the docs PR for - alpha: https://github.com/kubernetes/enhancements/issues/2845 - beta: https://github.com/kubernetes/enhancements/issues/1602 But as it touches the file, it also updates the examples and explanations to reflect some recent observations. --- .../cluster-administration/system-logs.md | 68 +++++++++++++++++-- 1 file changed, 63 insertions(+), 5 deletions(-) diff --git a/content/en/docs/concepts/cluster-administration/system-logs.md b/content/en/docs/concepts/cluster-administration/system-logs.md index 0466837356..58f123a1c8 100644 --- a/content/en/docs/concepts/cluster-administration/system-logs.md +++ b/content/en/docs/concepts/cluster-administration/system-logs.md @@ -22,14 +22,62 @@ generates log messages for the Kubernetes system components. For more information about klog configuration, see the [Command line tool reference](/docs/reference/command-line-tools-reference/). -An example of the klog native format: +Kubernetes is in the process of simplifying logging in its components. The +following klog command line flags [are +deprecated](https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components) +starting with Kubernetes 1.23 and will be removed in a future release: + +- `--add-dir-header` +- `--alsologtostderr` +- `--log-backtrace-at` +- `--log-dir` +- `--log-file` +- `--log-file-max-size` +- `--logtostderr` +- `--one-output` +- `--skip-headers` +- `--skip-log-headers` +- `--stderrthreshold` + +Output will always be written to stderr, regardless of the output +format. Output redirection is expected to be handled by the component which +invokes a Kubernetes component. This can be a POSIX shell or a tool like +systemd. + +In some cases, for example a distroless container or a Windows system service, +those options are not available. Then the +[`kube-log-runner`](https://github.com/kubernetes/kubernetes/blob/d2a8a81639fcff8d1221b900f66d28361a170654/staging/src/k8s.io/component-base/logs/kube-log-runner/README.md) +binary can be used as wrapper around a Kubernetes component to redirect +output. A prebuilt binary is included in several Kubernetes base images under +its traditional name as `/go-runner` and as `kube-log-runner` in server and +node release archives. + +This table shows how `kube-log-runner` invocations correspond to shell redirection: + +| Usage | POSIX shell (such as bash) | `kube-log-runner ` | +| -----------------------------------------|----------------------------|-------------------------------------------------------------| +| Merge stderr and stdout, write to stdout | `2>&1` | `kube-log-runner` (default behavior) | +| Redirect both into log file | `1>>/tmp/log 2>&1` | `kube-log-runner -log-file=/tmp/log` | +| Copy into log file and to stdout | `2>&1 \| tee -a /tmp/log` | `kube-log-runner -log-file=/tmp/log -also-stdout` | +| Redirect only stdout into log file | `>/tmp/log` | `kube-log-runner -log-file=/tmp/log -redirect-stderr=false` | + +### Klog output + +An example of the traditional klog native format: ``` I1025 00:15:15.525108 1 httplog.go:79] GET /api/v1/namespaces/kube-system/pods/metrics-server-v0.3.1-57c75779f-9p8wg: (1.512ms) 200 [pod_nanny/v0.0.0 (linux/amd64) kubernetes/$Format 10.56.1.19:51756] ``` +The message string may contain line breaks: +``` +I1025 00:15:15.525108 1 example.go:79] This is a message +which has a line break. +``` + + ### Structured Logging -{{< feature-state for_k8s_version="v1.19" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} {{< warning >}} Migration to structured log messages is an ongoing process. Not all log messages are structured in this version. When parsing log files, you must also handle unstructured log messages. @@ -38,9 +86,11 @@ Log formatting and value serialization are subject to change. {{< /warning>}} Structured logging introduces a uniform structure in log messages allowing for programmatic extraction of information. You can store and process structured logs with less effort and cost. -New message format is backward compatible and enabled by default. +The code which generates a log message determines whether it uses the traditional unstructured klog output +or structured logging. -Format of structured logs: +The default formatting of structured log messages is as text, with a format that +is backward compatible with traditional klog: ```ini "" ="" ="" ... @@ -52,6 +102,13 @@ Example: I1025 00:15:15.525108 1 controller_utils.go:116] "Pod status updated" pod="kube-system/kubedns" status="ready" ``` +Strings are quoted. Other values are formatted with +[`%+v`](https://pkg.go.dev/fmt#hdr-Printing), which may cause log messages to +continue on the next line [depending on the data](https://github.com/kubernetes/kubernetes/issues/106428). +``` +I1025 00:15:15.525108 1 example.go:116] "Example" data="This is text with a line break\nand \"quotation marks\"." someInt=1 someFloat=0.1 someStruct={StringField: First line, +second line.} +``` ### JSON log format @@ -82,7 +139,7 @@ Example of JSON log format (pretty printed): Keys with special meaning: * `ts` - timestamp as Unix time (required, float) -* `v` - verbosity (required, int, default 0) +* `v` - verbosity (only for info and not for error messages, int) * `err` - error string (optional, string) * `msg` - message (required, string) @@ -139,4 +196,5 @@ The `logrotate` tool rotates logs daily, or once the log size is greater than 10 * Read about the [Kubernetes Logging Architecture](/docs/concepts/cluster-administration/logging/) * Read about [Structured Logging](https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/1602-structured-logging) +* Read about [deprecation of klog flags](https://github.com/kubernetes/enhancements/tree/master/keps/sig-instrumentation/2845-deprecate-klog-specific-flags-in-k8s-components) * Read about the [Conventions for logging severity](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-instrumentation/logging.md) From 2474ff93aad946c158cec46477601963b2dcda26 Mon Sep 17 00:00:00 2001 From: Rob Scott Date: Wed, 17 Nov 2021 11:21:54 -0800 Subject: [PATCH 054/148] Updating Topology Aware Hints docs for 1.23 --- .../service-traffic-policy.md | 2 +- .../topology-aware-hints.md | 6 +-- .../feature-gates.md | 3 +- .../enabling-topology-aware-hints.md | 40 ------------------- 4 files changed, 5 insertions(+), 46 deletions(-) delete mode 100644 content/en/docs/tasks/administer-cluster/enabling-topology-aware-hints.md diff --git a/content/en/docs/concepts/services-networking/service-traffic-policy.md b/content/en/docs/concepts/services-networking/service-traffic-policy.md index fb55a3d833..0a62cb4934 100644 --- a/content/en/docs/concepts/services-networking/service-traffic-policy.md +++ b/content/en/docs/concepts/services-networking/service-traffic-policy.md @@ -68,6 +68,6 @@ When the [feature gate](/docs/reference/command-line-tools-reference/feature-gat ## {{% heading "whatsnext" %}} -* Read about [enabling Topology Aware Hints](/docs/tasks/administer-cluster/enabling-topology-aware-hints) +* Read about [Topology Aware Hints](/docs/concepts/services-networking/topology-aware-hints) * Read about [Service External Traffic Policy](/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip) * Read [Connecting Applications with Services](/docs/concepts/services-networking/connect-applications-service/) diff --git a/content/en/docs/concepts/services-networking/topology-aware-hints.md b/content/en/docs/concepts/services-networking/topology-aware-hints.md index f471caff6b..d07a75d923 100644 --- a/content/en/docs/concepts/services-networking/topology-aware-hints.md +++ b/content/en/docs/concepts/services-networking/topology-aware-hints.md @@ -9,7 +9,7 @@ weight: 45 -{{< feature-state for_k8s_version="v1.21" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} _Topology Aware Hints_ enable topology aware routing by including suggestions for how clients should consume endpoints. This approach adds metadata to enable @@ -35,8 +35,7 @@ can then consume those hints, and use them to influence how traffic to is routed ## Using Topology Aware Hints -If you have [enabled](/docs/tasks/administer-cluster/enabling-topology-aware-hints) the -overall feature, you can activate Topology Aware Hints for a Service by setting the +You can activate Topology Aware Hints for a Service by setting the `service.kubernetes.io/topology-aware-hints` annotation to `auto`. This tells the EndpointSlice controller to set topology hints if it is deemed safe. Importantly, this does not guarantee that hints will always be set. @@ -156,5 +155,4 @@ zone. ## {{% heading "whatsnext" %}} -* Read about [enabling Topology Aware Hints](/docs/tasks/administer-cluster/enabling-topology-aware-hints/) * Read [Connecting Applications with Services](/docs/concepts/services-networking/connect-applications-service/) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 63eba752de..67c1ac569c 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -186,7 +186,8 @@ different Kubernetes components. | `StorageVersionHash` | `true` | Beta | 1.15 | | | `SuspendJob` | `false` | Alpha | 1.21 | 1.21 | | `SuspendJob` | `true` | Beta | 1.22 | | -| `TopologyAwareHints` | `false` | Alpha | 1.21 | | +| `TopologyAwareHints` | `false` | Alpha | 1.21 | 1.22 | +| `TopologyAwareHints` | `true` | Beta | 1.23 | | | `TopologyManager` | `false` | Alpha | 1.16 | 1.17 | | `TopologyManager` | `true` | Beta | 1.18 | | | `VolumeCapacityPriority` | `false` | Alpha | 1.21 | - | diff --git a/content/en/docs/tasks/administer-cluster/enabling-topology-aware-hints.md b/content/en/docs/tasks/administer-cluster/enabling-topology-aware-hints.md deleted file mode 100644 index dadc653f4e..0000000000 --- a/content/en/docs/tasks/administer-cluster/enabling-topology-aware-hints.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -reviewers: -- robscott -title: Enabling Topology Aware Hints -content_type: task -min-kubernetes-server-version: 1.21 ---- - - -{{< feature-state for_k8s_version="v1.21" state="alpha" >}} - -_Topology Aware Hints_ enable topology aware routing with topology hints -included in {{< glossary_tooltip text="EndpointSlices" term_id="endpoint-slice" >}}. -This approach tries to keep traffic close to where it originated from; -you might do this to reduce costs, or to improve network performance. - -## {{% heading "prerequisites" %}} - - {{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} - -The following prerequisite is needed in order to enable topology aware hints: - -* Configure the {{< glossary_tooltip text="kube-proxy" term_id="kube-proxy" >}} to run in - iptables mode or IPVS mode -* Ensure that you have not disabled EndpointSlices - -## Enable Topology Aware Hints - -To enable service topology hints, enable the `TopologyAwareHints` [feature -gate](/docs/reference/command-line-tools-reference/feature-gates/) for the -kube-apiserver, kube-controller-manager, and kube-proxy: - -``` ---feature-gates="TopologyAwareHints=true" -``` - -## {{% heading "whatsnext" %}} - -* Read about [Topology Aware Hints](/docs/concepts/services-networking/topology-aware-hints) for Services -* Read [Connecting Applications with Services](/docs/concepts/services-networking/connect-applications-service/) From a209e3d65eac600521b33f9091b6263703127432 Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Fri, 13 Aug 2021 17:08:22 -0500 Subject: [PATCH 055/148] Dual-stack to stable in 1.23 Co-Authored-By: Tim Bannister --- .../cluster-administration/networking.md | 2 +- .../services-networking/dual-stack.md | 11 +++------- .../feature-gates.md | 5 +++-- .../tools/kubeadm/dual-stack-support.md | 22 +++++-------------- .../docs/tasks/network/validate-dual-stack.md | 5 ++++- 5 files changed, 16 insertions(+), 29 deletions(-) diff --git a/content/en/docs/concepts/cluster-administration/networking.md b/content/en/docs/concepts/cluster-administration/networking.md index da9aeed0ba..b9759799dc 100644 --- a/content/en/docs/concepts/cluster-administration/networking.md +++ b/content/en/docs/concepts/cluster-administration/networking.md @@ -64,7 +64,7 @@ This means that containers within a `Pod` can all reach each other's ports on usage, but this is no different from processes in a VM. This is called the "IP-per-pod" model. -How this is implemented is a detail of the particular container runtime in use. +How this is implemented is a detail of the particular container runtime in use. Likewise, the networking option you choose may support [dual-stack IPv4/IPv6 networking](/docs/concepts/services-networking/dual-stack/); implementations vary. It is possible to request ports on the `Node` itself which forward to your `Pod` (called host ports), but this is a very niche operation. How that forwarding is diff --git a/content/en/docs/concepts/services-networking/dual-stack.md b/content/en/docs/concepts/services-networking/dual-stack.md index a85226beed..b7ea673621 100644 --- a/content/en/docs/concepts/services-networking/dual-stack.md +++ b/content/en/docs/concepts/services-networking/dual-stack.md @@ -16,7 +16,7 @@ weight: 70 -{{< feature-state for_k8s_version="v1.21" state="beta" >}} +{{< feature-state for_k8s_version="v1.23" state="stable" >}} IPv4/IPv6 dual-stack networking enables the allocation of both IPv4 and IPv6 addresses to {{< glossary_tooltip text="Pods" term_id="pod" >}} and {{< glossary_tooltip text="Services" term_id="service" >}}. @@ -47,8 +47,6 @@ The following prerequisites are needed in order to utilize IPv4/IPv6 dual-stack ## Configure IPv4/IPv6 dual-stack -To use IPv4/IPv6 dual-stack, ensure the `IPv6DualStack` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) is enabled for the relevant components of your cluster. (Starting in 1.21, IPv4/IPv6 dual-stack defaults to enabled.) - To configure IPv4/IPv6 dual-stack, set dual-stack cluster network assignments: * kube-apiserver: @@ -65,9 +63,6 @@ An example of an IPv4 CIDR: `10.244.0.0/16` (though you would supply your own ad An example of an IPv6 CIDR: `fdXY:IJKL:MNOP:15::/64` (this shows the format but is not a valid address - see [RFC 4193](https://tools.ietf.org/html/rfc4193)) -Starting in 1.21, IPv4/IPv6 dual-stack defaults to enabled. -You can disable it when necessary by specifying `--feature-gates="IPv6DualStack=false"` -on the kube-apiserver, kube-controller-manager, kubelet, and kube-proxy command line. {{< /note >}} ## Services @@ -81,7 +76,7 @@ set the `.spec.ipFamilyPolicy` field to one of the following values: * `SingleStack`: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range. * `PreferDualStack`: - * Allocates IPv4 and IPv6 cluster IPs for the Service. (If the cluster has `--feature-gates="IPv6DualStack=false"`, this setting follows the same behavior as `SingleStack`.) + * Allocates IPv4 and IPv6 cluster IPs for the Service. * `RequireDualStack`: Allocates Service `.spec.ClusterIPs` from both IPv4 and IPv6 address ranges. * Selects the `.spec.ClusterIP` from the list of `.spec.ClusterIPs` based on the address family of the first element in the `.spec.ipFamilies` array. @@ -124,7 +119,7 @@ These examples demonstrate the behavior of various dual-stack Service configurat #### Dual-stack defaults on existing Services -These examples demonstrate the default behavior when dual-stack is newly enabled on a cluster where Services already exist. (Upgrading an existing cluster to 1.21 will enable dual-stack unless `--feature-gates="IPv6DualStack=false"` is set.) +These examples demonstrate the default behavior when dual-stack is newly enabled on a cluster where Services already exist. (Upgrading an existing cluster to 1.21 or beyond will enable dual-stack.) 1. When dual-stack is enabled on a cluster, existing Services (whether `IPv4` or `IPv6`) are configured by the control plane to set `.spec.ipFamilyPolicy` to `SingleStack` and set `.spec.ipFamilies` to the address family of the existing Service. The existing Service cluster IP will be stored in `.spec.ClusterIPs`. diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 63eba752de..f74a78bb4c 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -127,8 +127,6 @@ different Kubernetes components. | `InTreePluginGCEUnregister` | `false` | Alpha | 1.21 | | | `InTreePluginOpenStackUnregister` | `false` | Alpha | 1.21 | | | `InTreePluginvSphereUnregister` | `false` | Alpha | 1.21 | | -| `IPv6DualStack` | `false` | Alpha | 1.15 | 1.20 | -| `IPv6DualStack` | `true` | Beta | 1.21 | | | `JobMutableNodeSchedulingDirectives` | `true` | Beta | 1.23 | | | `JobTrackingWithFinalizers` | `false` | Alpha | 1.22 | 1.22 | | `JobTrackingWithFinalizers` | `true` | Beta | 1.23 | | @@ -331,6 +329,9 @@ different Kubernetes components. | `IngressClassNamespacedParams` | `true` | GA | 1.23 | - | | `Initializers` | `false` | Alpha | 1.7 | 1.13 | | `Initializers` | - | Deprecated | 1.14 | - | +| `IPv6DualStack` | `false` | Alpha | 1.15 | 1.20 | +| `IPv6DualStack` | `true` | Beta | 1.21 | 1.22 | +| `IPv6DualStack` | `true` | GA | 1.23 | - | | `KubeletConfigFile` | `false` | Alpha | 1.8 | 1.9 | | `KubeletConfigFile` | - | Deprecated | 1.10 | - | | `KubeletPluginsWatcher` | `false` | Alpha | 1.11 | 1.11 | diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md b/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md index 283f334874..f2d250c296 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md @@ -7,9 +7,9 @@ min-kubernetes-server-version: 1.21 -{{< feature-state for_k8s_version="v1.21" state="beta" >}} +{{< feature-state for_k8s_version="v1.23" state="stable" >}} -Your Kubernetes cluster can run in [dual-stack](/docs/concepts/services-networking/dual-stack/) networking mode, which means that cluster networking lets you use either address family. In a dual-stack cluster, the control plane can assign both an IPv4 address and an IPv6 address to a single {{< glossary_tooltip text="Pod" term_id="pod" >}} or a {{< glossary_tooltip text="Service" term_id="service" >}}. +Your Kubernetes cluster includes [dual-stack](/docs/concepts/services-networking/dual-stack/) networking, which means that cluster networking lets you use either address family. In a cluster, the control plane can assign both an IPv4 address and an IPv6 address to a single {{< glossary_tooltip text="Pod" term_id="pod" >}} or a {{< glossary_tooltip text="Service" term_id="service" >}}. @@ -28,10 +28,8 @@ The size of the IP address allocations should be suitable for the number of Pods Services that you are planning to run. {{< note >}} -If you are upgrading an existing cluster then, by default, the `kubeadm upgrade` command -changes the [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) -`IPv6DualStack` to `true` if that is not already enabled. -However, `kubeadm` does not support making modifications to the pod IP address range +If you are upgrading an existing cluster with the `kubeadm upgrade` command, +`kubeadm` does not support making modifications to the pod IP address range (“cluster CIDR”) nor to the cluster's Service address range (“Service CIDR”). {{< /note >}} @@ -51,8 +49,6 @@ To make things clearer, here is an example kubeadm [configuration file](https:// --- apiVersion: kubeadm.k8s.io/v1beta3 kind: ClusterConfiguration -featureGates: - IPv6DualStack: true networking: podSubnet: 10.244.0.0/16,2001:db8:42:0::/56 serviceSubnet: 10.96.0.0/16,2001:db8:42:1::/112 @@ -132,23 +128,15 @@ kubeadm join --config=kubeadm-config.yaml ### Create a single-stack cluster {{< note >}} -Enabling the dual-stack feature doesn't mean that you need to use dual-stack addressing. +Dual-stack support doesn't mean that you need to use dual-stack addressing. You can deploy a single-stack cluster that has the dual-stack networking feature enabled. {{< /note >}} -In 1.21 the `IPv6DualStack` feature is Beta and the feature gate is defaulted to `true`. To disable the feature you must configure the feature gate to `false`. Note that once the feature is GA, the feature gate will be removed. - -```shell -kubeadm init --feature-gates IPv6DualStack=false -``` - To make things more clear, here is an example kubeadm [configuration file](https://pkg.go.dev/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3) `kubeadm-config.yaml` for the single-stack control plane node. ```yaml apiVersion: kubeadm.k8s.io/v1beta3 kind: ClusterConfiguration -featureGates: - IPv6DualStack: false networking: podSubnet: 10.244.0.0/16 serviceSubnet: 10.96.0.0/16 diff --git a/content/en/docs/tasks/network/validate-dual-stack.md b/content/en/docs/tasks/network/validate-dual-stack.md index 717bac27ad..549c60b003 100644 --- a/content/en/docs/tasks/network/validate-dual-stack.md +++ b/content/en/docs/tasks/network/validate-dual-stack.md @@ -3,7 +3,7 @@ reviewers: - lachie83 - khenidak - bridgetkromhout -min-kubernetes-server-version: v1.20 +min-kubernetes-server-version: v1.23 title: Validate IPv4/IPv6 dual-stack content_type: task --- @@ -21,6 +21,9 @@ This document shares how to validate IPv4/IPv6 dual-stack enabled Kubernetes clu {{< version-check >}} +{{< note >}} +While you can validate with an earlier version, the feature is only GA and officially supported since v1.23. +{{< /note >}} From d75f6f2a46a31121add5355eeee1137d8398b39d Mon Sep 17 00:00:00 2001 From: Seokho Son Date: Mon, 22 Nov 2021 21:02:47 +0900 Subject: [PATCH 056/148] Rev-1 to be squashed --- .../ko/docs/concepts/architecture/nodes.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/content/ko/docs/concepts/architecture/nodes.md b/content/ko/docs/concepts/architecture/nodes.md index 09e2264a80..8c7390eef7 100644 --- a/content/ko/docs/concepts/architecture/nodes.md +++ b/content/ko/docs/concepts/architecture/nodes.md @@ -97,7 +97,7 @@ kubelet 플래그 `--register-node`가 참(기본값)일 경우, kubelet은 API [Node authorization mode](/docs/reference/access-authn-authz/node/)와 [NodeRestriction admission plugin](/docs/reference/access-authn-authz/admission-controllers/#noderestriction)이 활성화 되면, -kubelets은 자신의 노드 리소스를 생성/수정할 권한을 가진다. +각 kubelet은 자신이 속한 노드의 리소스에 대해서만 생성/수정할 권한을 가진다. {{< note >}} [노드 이름 고유성](#노드-이름-고유성) 섹션에서 언급했듯이, @@ -109,7 +109,7 @@ kubelets은 자신의 노드 리소스를 생성/수정할 권한을 가진다. 노드에 이미 스케줄된 파드는 해당 노드 구성이 kubelet 재시작에 의해 변경된 경우 오작동하거나 문제를 일으킬 수 있다. 예를 들어 이미 실행 중인 파드가 노드에 할당된 새 레이블에 대해 테인트(taint)될 수 있는 반면 해당 파드와 호환되지 않는 다른 파드는 -새 레이블을 기반으로 스케줄링된다. 노드 재-등록(re-registration)은 모든 파드를 +새 레이블을 기반으로 스케줄링된다. 노드 재등록(re-registration)은 모든 파드를 비우고(drain) 다시 적절하게 스케줄링되도록 한다. {{< /note >}} @@ -225,14 +225,14 @@ API 서버와의 통신이 재개될 때까지 파드 삭제에 대한 결정은 동작되고 있는 것을 보게 될 수도 있다. 노드가 영구적으로 클러스터에서 삭제되었는지에 대한 여부를 쿠버네티스가 기반 인프라로부터 유추할 수 없는 경우, 노드가 클러스터를 영구적으로 탈퇴하게 되면, 클러스터 관리자는 손수 노드 오브젝트를 삭제해야 할 수도 있다. -쿠버네티스에서 노드 오브젝트를 삭제하면 노드 상에서 동작중인 모든 파드 오브젝트가 -API 서버로부터 삭제되어 그 이름을 사용할 수 있는 결과를 -낳는다. +쿠버네티스에서 노드 오브젝트를 삭제하면 +노드 상에서 동작 중인 모든 파드 오브젝트가 API 서버로부터 삭제되며 +파드가 사용하던 이름을 다시 사용할 수 있게 된다. 노드에서 문제가 발생하면, 쿠버네티스 컨트롤 플레인은 자동으로 노드 상태에 영향을 주는 조건과 일치하는 [테인트(taints)](/ko/docs/concepts/scheduling-eviction/taint-and-toleration/)를 생성한다. -스케줄러는 파드를 노드에 할당 할 때 노드의 테인트를 고려한다. +스케줄러는 파드를 노드에 할당할 때 노드의 테인트를 고려한다. 또한 파드는 노드에 특정 테인트가 있더라도 해당 노드에서 동작하도록 {{< glossary_tooltip text="톨러레이션(toleration)" term_id="toleration" >}}을 가질 수 있다. @@ -255,10 +255,10 @@ API 서버로부터 삭제되어 그 이름을 사용할 수 있는 결과를 ### 정보 커널 버전, 쿠버네티스 버전 (kubelet과 kube-proxy 버전), 컨테이너 -런타임 상세 정보 및 노드가 사용하는 운영 체계가 무엇인지와 같은 +런타임 상세 정보 및 노드가 사용하는 운영 체제가 무엇인지와 같은 노드에 대한 일반적인 정보가 기술된다. -이 정보는 Kubelet이 노드로부터 수집해서 -쿠버네티스 API로 이를 보낸다. +이 정보는 Kubelet이 노드에서 수집하여 +쿠버네티스 API로 전송한다. ## 하트비트 @@ -273,9 +273,9 @@ API 서버로부터 삭제되어 그 이름을 사용할 수 있는 결과를 내의 [리스(Lease)](/docs/reference/kubernetes-api/cluster-resources/lease-v1/) 오브젝트. 각 노드는 연관된 리스 오브젝트를 갖는다. -노드의 `.status`와 비교해서, 리스는 경량의 리소스이다. -큰 규모의 클러스터에서는 리스를 하트비트에 사용해서 업데이트를 위해 -필요한 성능 영향도를 줄일 수 있다. +노드의 `.status`에 비하면, 리스는 경량의 리소스이다. +큰 규모의 클러스터에서는 리스를 하트비트에 사용하여 +업데이트로 인한 성능 영향을 줄일 수 있다. kubelet은 노드의 `.status` 생성과 업데이트 및 관련된 리스의 업데이트를 담당한다. @@ -304,12 +304,12 @@ kubelet은 노드의 `.status` 생성과 업데이트 및 해당 노드용 VM이 여전히 사용 가능한지에 대해 클라우드 제공사업자에게 묻는다. 사용 가능하지 않을 경우, 노드 컨트롤러는 노드 리스트로부터 그 노드를 삭제한다. -세 번째는 노드의 동작 상태를 모니터링 하는 것이다. 노드 컨트롤러는 +세 번째는 노드의 동작 상태를 모니터링하는 것이다. 노드 컨트롤러는 다음을 담당한다. -- 노드가 접근이 불가능한 상태가되는 경우, 노드의 `.status` +- 노드가 접근 불가능(unreachable) 상태가 되는 경우, 노드의 `.status` 내에 있는 NodeReady 컨디션을 업데이트한다. 이 경우에는 노드 컨트롤러가 NodeReady 컨디션을 `ConditionUnknown`으로 설정한다. -- 노드에 계속 접근이 불가능한 상태로 남아있는 경우에는 해당 노드의 모든 파드에 대해서 +- 노드가 계속 접근 불가능 상태로 남아있는 경우, 해당 노드의 모든 파드에 대해서 [API를 이용한 축출](/docs/concepts/scheduling-eviction/api-eviction/)을 트리거한다. 기본적으로, 노드 컨트롤러는 노드를 `ConditionUnknown`으로 마킹한 뒤 5분을 기다렸다가 From 466561c47c9421d0271db764ddf0bea461d4c877 Mon Sep 17 00:00:00 2001 From: ravisantoshgudimetla Date: Wed, 10 Nov 2021 12:56:10 -0500 Subject: [PATCH 057/148] [docs]: Promote STS minReadySeconds to beta --- .../workloads/controllers/statefulset.md | 22 ++++++++++--------- .../feature-gates.md | 3 ++- 2 files changed, 14 insertions(+), 11 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/statefulset.md b/content/en/docs/concepts/workloads/controllers/statefulset.md index 6b65ba1f3b..4f12bb1796 100644 --- a/content/en/docs/concepts/workloads/controllers/statefulset.md +++ b/content/en/docs/concepts/workloads/controllers/statefulset.md @@ -77,6 +77,7 @@ spec: app: nginx # has to match .spec.template.metadata.labels serviceName: "nginx" replicas: 3 # by default is 1 + minReadySeconds: 10 # by default is 0 template: metadata: labels: @@ -112,6 +113,17 @@ In the above example: The name of a StatefulSet object must be a valid [DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). + +### Minimum ready seconds + +{{< feature-state for_k8s_version="v1.23" state="beta" >}} + +`.spec.minReadySeconds` is an optional field that specifies the minimum number of seconds for which a newly +created Pod should be ready without any of its containers crashing, for it to be considered available. +Please note that this feature is beta and enabled by default. Please opt out by unsetting the StatefulSetMinReadySeconds flag, if you don't +want this feature to be enabled. This field defaults to 0 (the Pod will be considered +available as soon as it is ready). To learn more about when a Pod is considered ready, see [Container Probes](/docs/concepts/workloads/pods/pod-lifecycle/#container-probes). + ## Pod Selector You must set the `.spec.selector` field of a StatefulSet to match the labels of its `.spec.template.metadata.labels`. Prior to Kubernetes 1.8, the `.spec.selector` field was defaulted when omitted. In 1.8 and later versions, failing to specify a matching Pod Selector will result in a validation error during StatefulSet creation. @@ -284,16 +296,6 @@ After reverting the template, you must also delete any Pods that StatefulSet had already attempted to run with the bad configuration. StatefulSet will then begin to recreate the Pods using the reverted template. -### Minimum ready seconds - -{{< feature-state for_k8s_version="v1.22" state="alpha" >}} - -`.spec.minReadySeconds` is an optional field that specifies the minimum number of seconds for which a newly -created Pod should be ready without any of its containers crashing, for it to be considered available. -This defaults to 0 (the Pod will be considered available as soon as it is ready). To learn more about when -a Pod is considered ready, see [Container Probes](/docs/concepts/workloads/pods/pod-lifecycle/#container-probes). - -Please note that this field only works if you enable the `StatefulSetMinReadySeconds` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/). ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 8b2d4dd18e..1ab8c95fdb 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -182,7 +182,8 @@ different Kubernetes components. | `ServiceLoadBalancerClass` | `true` | Beta | 1.22 | | | `SizeMemoryBackedVolumes` | `false` | Alpha | 1.20 | 1.21 | | `SizeMemoryBackedVolumes` | `true` | Beta | 1.22 | | -| `StatefulSetMinReadySeconds` | `false` | Alpha | 1.22 | | +| `StatefulSetMinReadySeconds` | `false` | Alpha | 1.22 | 1.22 | +| `StatefulSetMinReadySeconds` | `true` | Beta | 1.23 | | | `StorageVersionAPI` | `false` | Alpha | 1.20 | | | `StorageVersionHash` | `false` | Alpha | 1.14 | 1.14 | | `StorageVersionHash` | `true` | Beta | 1.15 | | From 40d431a42c78ff96206aba2eebbdecbe018fa85e Mon Sep 17 00:00:00 2001 From: Michelle Au Date: Mon, 15 Nov 2021 13:51:53 -0800 Subject: [PATCH 058/148] update on-by-default for csi migration providers --- .../command-line-tools-reference/feature-gates.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 63eba752de..96abe1230d 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -71,13 +71,16 @@ different Kubernetes components. | `CSIMigration` | `false` | Alpha | 1.14 | 1.16 | | `CSIMigration` | `true` | Beta | 1.17 | | | `CSIMigrationAWS` | `false` | Alpha | 1.14 | | -| `CSIMigrationAWS` | `false` | Beta | 1.17 | | +| `CSIMigrationAWS` | `false` | Beta | 1.17 | 1.22 | +| `CSIMigrationAWS` | `true` | Beta | 1.23 | | | `CSIMigrationAzureDisk` | `false` | Alpha | 1.15 | 1.18 | -| `CSIMigrationAzureDisk` | `false` | Beta | 1.19 | | +| `CSIMigrationAzureDisk` | `false` | Beta | 1.19 | 1.22 | +| `CSIMigrationAzureDisk` | `true` | Beta | 1.23 | | | `CSIMigrationAzureFile` | `false` | Alpha | 1.15 | 1.19 | | `CSIMigrationAzureFile` | `false` | Beta | 1.21 | | | `CSIMigrationGCE` | `false` | Alpha | 1.14 | 1.16 | -| `CSIMigrationGCE` | `false` | Beta | 1.17 | | +| `CSIMigrationGCE` | `false` | Beta | 1.17 | 1.22 | +| `CSIMigrationGCE` | `true` | Beta | 1.23 | | | `CSIMigrationOpenStack` | `false` | Alpha | 1.14 | 1.17 | | `CSIMigrationOpenStack` | `true` | Beta | 1.18 | | | `CSIMigrationvSphere` | `false` | Beta | 1.19 | | From ee39fdc2ad7ee34b8893ec6b08dfd2d235d518b5 Mon Sep 17 00:00:00 2001 From: Joseph Burnett Date: Thu, 18 Nov 2021 11:22:40 +0100 Subject: [PATCH 059/148] Update docs with HPA v2 stable. --- .../horizontal-pod-autoscale-walkthrough.md | 10 ++--- .../horizontal-pod-autoscale.md | 41 ++++++++++--------- 2 files changed, 27 insertions(+), 24 deletions(-) diff --git a/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md b/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md index 545e268a10..f5582b9416 100644 --- a/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md +++ b/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md @@ -184,9 +184,9 @@ Autoscaling the replicas may take a few minutes. ## Autoscaling on multiple metrics and custom metrics You can introduce additional metrics to use when autoscaling the `php-apache` Deployment -by making use of the `autoscaling/v2beta2` API version. +by making use of the `autoscaling/v2` API version. -First, get the YAML of your HorizontalPodAutoscaler in the `autoscaling/v2beta2` form: +First, get the YAML of your HorizontalPodAutoscaler in the `autoscaling/v2` form: ```shell kubectl get hpa php-apache -o yaml > /tmp/hpa-v2.yaml @@ -195,7 +195,7 @@ kubectl get hpa php-apache -o yaml > /tmp/hpa-v2.yaml Open the `/tmp/hpa-v2.yaml` file in an editor, and you should see YAML which looks like this: ```yaml -apiVersion: autoscaling/v2beta2 +apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: php-apache @@ -287,7 +287,7 @@ For example, if you had your monitoring system collecting metrics about network you could update the definition above using `kubectl edit` to look like this: ```yaml -apiVersion: autoscaling/v2beta2 +apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: php-apache @@ -411,7 +411,7 @@ access to any metric, so cluster administrators should take care when exposing i ## Appendix: Horizontal Pod Autoscaler Status Conditions -When using the `autoscaling/v2beta2` form of the HorizontalPodAutoscaler, you will be able to see +When using the `autoscaling/v2` form of the HorizontalPodAutoscaler, you will be able to see *status conditions* set by Kubernetes on the HorizontalPodAutoscaler. These status conditions indicate whether or not the HorizontalPodAutoscaler is able to scale, and whether or not it is currently restricted in any way. diff --git a/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md b/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md index 27165d0ca7..3208035a97 100644 --- a/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md +++ b/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md @@ -62,7 +62,7 @@ or the custom metrics API (for all other metrics). * For object metrics and external metrics, a single metric is fetched, which describes the object in question. This metric is compared to the target - value, to produce a ratio as above. In the `autoscaling/v2beta2` API + value, to produce a ratio as above. In the `autoscaling/v2` API version, this value can optionally be divided by the number of Pods before the comparison is made. @@ -161,18 +161,17 @@ fluctuating metric values. ## API Object -The Horizontal Pod Autoscaler is an API resource in the Kubernetes `autoscaling` API group. -The current stable version, which only includes support for CPU autoscaling, -can be found in the `autoscaling/v1` API version. - -The beta version, which includes support for scaling on memory and custom metrics, -can be found in `autoscaling/v2beta2`. The new fields introduced in `autoscaling/v2beta2` -are preserved as annotations when working with `autoscaling/v1`. +The Horizontal Pod Autoscaler is an API resource in the Kubernetes +`autoscaling` API group. The current stable version can be found in +the `autoscaling/v2` API version which includes support for scaling on +memory and custom metrics. The new fields introduced in +`autoscaling/v2` are preserved as annotations when working with +`autoscaling/v1`. When you create a HorizontalPodAutoscaler API object, make sure the name specified is a valid [DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). More details about the API object can be found at -[HorizontalPodAutoscaler Object](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#horizontalpodautoscaler-v1-autoscaling). +[HorizontalPodAutoscaler Object](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#horizontalpodautoscaler-v2-autoscaling). ## Support for Horizontal Pod Autoscaler in kubectl @@ -299,7 +298,7 @@ the old container name from the HPA specification. ## Support for multiple metrics -Kubernetes 1.6 adds support for scaling based on multiple metrics. You can use the `autoscaling/v2beta2` API +Kubernetes 1.6 adds support for scaling based on multiple metrics. You can use the `autoscaling/v2` API version to specify multiple metrics for the Horizontal Pod Autoscaler to scale on. Then, the Horizontal Pod Autoscaler controller will evaluate each metric, and propose a new scale based on that metric. The largest of the proposed scales will be used as the new scale. @@ -313,9 +312,11 @@ custom metrics is still available, these metrics will not be available for use b annotations for specifying which custom metrics to scale on are no longer honored by the Horizontal Pod Autoscaler controller. {{< /note >}} -Kubernetes 1.6 adds support for making use of custom metrics in the Horizontal Pod Autoscaler. -You can add custom metrics for the Horizontal Pod Autoscaler to use in the `autoscaling/v2beta2` API. -Kubernetes then queries the new custom metrics API to fetch the values of the appropriate custom metrics. +You can also use a HorizontalPodAutoscaler to change the scale of a +workload based on custom metrics. You can add custom metrics for the +Horizontal Pod Autoscaler to use in the `autoscaling/v2` API. +Kubernetes then queries the new custom metrics API to fetch the values +of the appropriate custom metrics. See [Support for metrics APIs](#support-for-metrics-apis) for the requirements. @@ -349,12 +350,14 @@ and [the walkthrough for using external metrics](/docs/tasks/run-application/hor Starting from [v1.18](https://github.com/kubernetes/enhancements/blob/master/keps/sig-autoscaling/853-configurable-hpa-scale-velocity/README.md) -the `v2beta2` API allows scaling behavior to be configured through the HPA -`behavior` field. Behaviors are specified separately for scaling up and down in -`scaleUp` or `scaleDown` section under the `behavior` field. A stabilization -window can be specified for both directions which prevents the flapping of the -number of the replicas in the scaling target. Similarly specifying scaling -policies controls the rate of change of replicas while scaling. +the `v2beta2` API (and from v1.23 the `v2` API) allows scaling +behavior to be configured through the HPA `behavior` field. Behaviors +are specified separately for scaling up and down in `scaleUp` or +`scaleDown` section under the `behavior` field. A stabilization window +can be specified for both directions which prevents the flapping of +the number of the replicas in the scaling target. Similarly specifying +scaling policies controls the rate of change of replicas while +scaling. ### Scaling Policies From 7c1e61a697e268885a5cb8e248eb8fd48b59d6ac Mon Sep 17 00:00:00 2001 From: Peter Hunt Date: Mon, 22 Nov 2021 15:19:46 -0500 Subject: [PATCH 060/148] Document PodAndContainerStatsFromCRI feature Signed-off-by: Peter Hunt --- .../command-line-tools-reference/feature-gates.md | 3 +++ .../resource-metrics-pipeline.md | 9 +++++++++ 2 files changed, 12 insertions(+) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index a4eb41f3f4..b433a951ab 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -362,6 +362,7 @@ different Kubernetes components. | `PersistentLocalVolumes` | `false` | Alpha | 1.7 | 1.9 | | `PersistentLocalVolumes` | `true` | Beta | 1.10 | 1.13 | | `PersistentLocalVolumes` | `true` | GA | 1.14 | - | +| `PodAndContainerStatsFromCRI` | `false` | Alpha | 1.23 | | | `PodDisruptionBudget` | `false` | Alpha | 1.3 | 1.4 | | `PodDisruptionBudget` | `true` | Beta | 1.5 | 1.20 | | `PodDisruptionBudget` | `true` | GA | 1.21 | - | @@ -862,6 +863,8 @@ Each feature gate is designed for enabling/disabling a specific feature: feature which allows users to influence ReplicaSet downscaling order. - `PersistentLocalVolumes`: Enable the usage of `local` volume type in Pods. Pod affinity has to be specified if requesting a `local` volume. +- `PodAndContainerStatsFromCRI`: Configure the kubelet to gather container and pod stats from the CRI container runtime + rather than gathering them from cAdvisor. - `PodDisruptionBudget`: Enable the [PodDisruptionBudget](/docs/tasks/run-application/configure-pdb/) feature. - `PodAffinityNamespaceSelector`: Enable the [Pod Affinity Namespace Selector](/docs/concepts/scheduling-eviction/assign-pod-node/#namespace-selector) and [CrossNamespacePodAffinity](/docs/concepts/policy/resource-quotas/#cross-namespace-pod-affinity-quota) quota scope features. diff --git a/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md b/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md index a8c24693dc..b0e9ec4690 100644 --- a/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md +++ b/content/en/docs/tasks/debug-application-cluster/resource-metrics-pipeline.md @@ -65,3 +65,12 @@ Metrics Server collects metrics from the Summary API, exposed by Learn more about the metrics server in [the design doc](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/instrumentation/metrics-server.md). + +### Summary API Source +The [Kubelet](/docs/reference/command-line-tools-reference/kubelet/) gathers stats at node, volume, pod and container level, and omits +them in the [Summary API](https://github.com/kubernetes/kubernetes/blob/7d309e0104fedb57280b261e5677d919cb2a0e2d/staging/src/k8s.io/kubelet/pkg/apis/stats/v1alpha1/types.go) +for consumers to read. + +Pre-1.23, these resources have been primarily gathered from [cAdvisor](https://github.com/google/cadvisor). However, in 1.23 with the +introduction of the `PodAndContainerStatsFromCRI` FeatureGate, container and pod level stats can be gathered by the CRI implementation. +Note: this also requires support from the CRI implementations (containerd >= 1.6.0, CRI-O >= 1.23.0). From 7d8483e0e4ebdddd5f03dcb455ee8047eacd6b85 Mon Sep 17 00:00:00 2001 From: Francesco Romani Date: Tue, 14 Sep 2021 18:01:51 +0200 Subject: [PATCH 061/148] node: cpumanager: document the graduation process Document the graduation process and the maturity level of the cpumanager policy options, and the new feature gate involved. No changes regarding the existing options. For more details: https://github.com/kubernetes/enhancements/pull/2933 Signed-off-by: Francesco Romani --- .../administer-cluster/cpu-management-policies.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/cpu-management-policies.md b/content/en/docs/tasks/administer-cluster/cpu-management-policies.md index 41fbe77cb0..076cbe6149 100644 --- a/content/en/docs/tasks/administer-cluster/cpu-management-policies.md +++ b/content/en/docs/tasks/administer-cluster/cpu-management-policies.md @@ -60,6 +60,13 @@ duration as `--node-status-update-frequency`. The behavior of the static policy can be fine-tuned using the `--cpu-manager-policy-options` flag. The flag takes a comma-separated list of `key=value` policy options. +This feature can be disabled completely using the `CPUManagerPolicyOptions` feature gate. + +The policy options are split into two groups: alpha quality (hidden by default) and beta quality +(visible by default). The groups are guarded respectively by the `CPUManagerPolicyAlphaOptions` +and `CPUManagerPolicyBetaOptions` feature gates. Diverging from the Kubernetes standard, these +feature gates guard groups of options, because it would have been too cumbersome to add a feature +gate for each individual option. ### None policy @@ -218,6 +225,12 @@ equal to one. The `nginx` container is granted 2 exclusive CPUs. #### Static policy options +You can toggle groups of options on and off based upon their maturity level +using the following feature gates: +* `CPUManagerPolicyBetaOptions` default enabled. Disable to hide beta-level options. +* `CPUManagerPolicyAlphaOptions` default disabled. Enable to show alpha-level options. +You will still have to enable each option using the `CPUManagerPolicyOptions` kubelet option. + The following policy options exist for the static `CPUManager` policy: * `full-pcpus-only` (beta, visible by default) * `distribute-cpus-across-numa` (alpha, hidden by default) @@ -237,7 +250,7 @@ one NUMA node is required to satisfy the allocation. By default, the `CPUManager` will pack CPUs onto one NUMA node until it is filled, with any remaining CPUs simply spilling over to the next NUMA node. This can cause undesired bottlenecks in parallel code relying on barriers (and -similar synchronization primitivies), as this type of code tends to run only as +similar synchronization primitives), as this type of code tends to run only as fast as its slowest worker (which is slowed down by the fact that fewer CPUs are available on at least one NUMA node). By distributing CPUs evenly across NUMA nodes, application developers can more From add3441154f2b9f7d2fe33fd8afb4610ee6ebe55 Mon Sep 17 00:00:00 2001 From: "Jason Kim (Jun Chul Kim)" Date: Tue, 16 Nov 2021 11:12:07 +0900 Subject: [PATCH 062/148] Update manage-resources-containers.md Warn people about mistaking "M" suffix for "m" when setting resource limits #30499 --- .../concepts/configuration/manage-resources-containers.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/configuration/manage-resources-containers.md b/content/en/docs/concepts/configuration/manage-resources-containers.md index e21173bfd3..0e1516d2aa 100644 --- a/content/en/docs/concepts/configuration/manage-resources-containers.md +++ b/content/en/docs/concepts/configuration/manage-resources-containers.md @@ -116,11 +116,11 @@ CPU is always requested as an absolute quantity, never as a relative quantity; Limits and requests for `memory` are measured in bytes. You can express memory as a plain integer or as a fixed-point number using one of these suffixes: -E, P, T, G, M, k. You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, +E, P, T, G, M, k, m (millis). You can also use the power-of-two equivalents: Ei, Pi, Ti, Gi, Mi, Ki. For example, the following represent roughly the same value: ```shell -128974848, 129e6, 129M, 123Mi +128974848, 129e6, 129M, 128974848000m, 123Mi ``` Here's an example. From d42a12c2eb2cd43137e1c694296991f68ec410cb Mon Sep 17 00:00:00 2001 From: Aldo Culquicondor Date: Mon, 22 Nov 2021 09:44:38 -0500 Subject: [PATCH 063/148] Add JobReadyPods feature gate --- .../reference/command-line-tools-reference/feature-gates.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index a4eb41f3f4..d8513ad955 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -129,6 +129,7 @@ different Kubernetes components. | `InTreePluginOpenStackUnregister` | `false` | Alpha | 1.21 | | | `InTreePluginvSphereUnregister` | `false` | Alpha | 1.21 | | | `JobMutableNodeSchedulingDirectives` | `true` | Beta | 1.23 | | +| `JobReadyPods` | `false` | Alpha | 1.23 | | | `JobTrackingWithFinalizers` | `false` | Alpha | 1.22 | 1.22 | | `JobTrackingWithFinalizers` | `true` | Beta | 1.23 | | | `KubeletCredentialProviders` | `false` | Alpha | 1.20 | | @@ -803,6 +804,11 @@ Each feature gate is designed for enabling/disabling a specific feature: support for IPv6. - `JobMutableNodeSchedulingDirectives`: Allows updating node scheduling directives in the pod template of [Job](/docs/concepts/workloads/controllers/job). +- `JobReadyPods`: Enables tracking the number of Pods that have a `Ready` + [condition](/docs/concepts/workloads/pods/pod-lifecycle/#pod-conditions). + The count of `Ready` pods is recorded in the + [status](/docs/reference/kubernetes-api/workload-resources/job-v1/#JobStatus) + of a [Job](/docs/concepts/workloads/controllers/job) status. - `JobTrackingWithFinalizers`: Enables tracking [Job](/docs/concepts/workloads/controllers/job) completions without relying on Pods remaining in the cluster indefinitely. The Job controller uses Pod finalizers and a field in the Job status to keep From 159234a0a6332e1007a8700e27eec9aaa861a622 Mon Sep 17 00:00:00 2001 From: Mengjiao Liu Date: Tue, 23 Nov 2021 15:51:22 +0800 Subject: [PATCH 064/148] kubelet: sysctls allows slashes as a separator --- .../docs/tasks/administer-cluster/sysctl-cluster.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/content/en/docs/tasks/administer-cluster/sysctl-cluster.md b/content/en/docs/tasks/administer-cluster/sysctl-cluster.md index f81623982f..791df4a2b4 100644 --- a/content/en/docs/tasks/administer-cluster/sysctl-cluster.md +++ b/content/en/docs/tasks/administer-cluster/sysctl-cluster.md @@ -13,6 +13,17 @@ This document describes how to configure and use kernel parameters within a Kubernetes cluster using the {{< glossary_tooltip term_id="sysctl" >}} interface. +{{< note >}} +Starting from Kubernetes version 1.23, the kubelet supports the use of either `/` or `.` +as separators for sysctl names. +For example, you can represent the same sysctl name as `kernel.shm_rmid_forced` using a +period as the separator, or as `kernel/shm_rmid_forced` using a slash as a separator. +For more sysctl parameter conversion method details, please refer to +the page [sysctl.d(5)](https://man7.org/linux/man-pages/man5/sysctl.d.5.html) from +the Linux man-pages project. +Setting Sysctls for a Pod and PodSecurityPolicy features do not yet support +setting sysctls with slashes. +{{< /note >}} ## {{% heading "prerequisites" %}} From 74dcb53cc5abf8a4680d9b4f7a6ce8e112cce0f1 Mon Sep 17 00:00:00 2001 From: kerthcet Date: Thu, 25 Nov 2021 11:26:25 +0800 Subject: [PATCH 065/148] add migration docs for scheduler component config api from v1beta2 to v1beta3 Signed-off-by: kerthcet --- .../en/docs/reference/scheduling/config.md | 33 ++----- .../en/docs/reference/scheduling/policies.md | 96 +------------------ 2 files changed, 10 insertions(+), 119 deletions(-) diff --git a/content/en/docs/reference/scheduling/config.md b/content/en/docs/reference/scheduling/config.md index bce8d36b5c..dd883d3bac 100644 --- a/content/en/docs/reference/scheduling/config.md +++ b/content/en/docs/reference/scheduling/config.md @@ -20,8 +20,7 @@ by implementing one or more of these extension points. You can specify scheduling profiles by running `kube-scheduler --config `, using the -KubeSchedulerConfiguration ([v1beta1](/docs/reference/config-api/kube-scheduler-config.v1beta1/) -or [v1beta2](/docs/reference/config-api/kube-scheduler-config.v1beta2/)) +KubeSchedulerConfiguration ([v1beta2](/docs/reference/config-api/kube-scheduler-config.v1beta2/)) struct. A minimal configuration looks as follows: @@ -179,30 +178,6 @@ that are not enabled by default: volume limits can be satisfied for the node. Extension points: `filter`. -The following plugins are deprecated and can only be enabled in a `v1beta1` -configuration: - -- `NodeResourcesLeastAllocated`: Favors nodes that have a low allocation of - resources. - Extension points: `score`. -- `NodeResourcesMostAllocated`: Favors nodes that have a high allocation of - resources. - Extension points: `score`. -- `RequestedToCapacityRatio`: Favor nodes according to a configured function of - the allocated resources. - Extension points: `score`. -- `NodeLabel`: Filters and / or scores a node according to configured - {{< glossary_tooltip text="label(s)" term_id="label" >}}. - Extension points: `filter`, `score`. -- `ServiceAffinity`: Checks that Pods that belong to a - {{< glossary_tooltip term_id="service" >}} fit in a set of nodes defined by - configured labels. This plugin also favors spreading the Pods belonging to a - Service across nodes. - Extension points: `preFilter`, `filter`, `score`. -- `NodePreferAvoidPods`: Prioritizes nodes according to the node annotation - `scheduler.alpha.kubernetes.io/preferAvoidPods`. - Extension points: `score`. - ### Multiple profiles You can configure `kube-scheduler` to run more than one profile. @@ -285,7 +260,13 @@ only has one pending pods queue. * A plugin enabled in a v1beta2 configuration file takes precedence over the default configuration for that plugin. * Invalid `host` or `port` configured for scheduler healthz and metrics bind address will cause validation failure. +{{% /tab %}} +{{% tab name="v1beta2 → v1beta3" %}} +* Three plugins' weight are increased by default: + * `InterPodAffinity` from 1 to 2 + * `NodeAffinity` from 1 to 2 + * `TaintToleration` from 1 to 3 {{% /tab %}} {{< /tabs >}} diff --git a/content/en/docs/reference/scheduling/policies.md b/content/en/docs/reference/scheduling/policies.md index 99291c2b37..d9a6d92cfe 100644 --- a/content/en/docs/reference/scheduling/policies.md +++ b/content/en/docs/reference/scheduling/policies.md @@ -6,99 +6,10 @@ weight: 10 -A scheduling Policy can be used to specify the *predicates* and *priorities* -that the {{< glossary_tooltip text="kube-scheduler" term_id="kube-scheduler" >}} -runs to [filter and score nodes](/docs/concepts/scheduling-eviction/kube-scheduler/#kube-scheduler-implementation), -respectively. +In Kubernetes versions before v1.23, a scheduling policy can be used to specify the *predicates* and *priorities* process. For example, you can set a scheduling policy by +running `kube-scheduler --policy-config-file ` or `kube-scheduler --policy-configmap `. -You can set a scheduling policy by running -`kube-scheduler --policy-config-file ` or -`kube-scheduler --policy-configmap ` -and using the [Policy type](/docs/reference/config-api/kube-scheduler-policy-config.v1/). - - - -## Predicates - -The following *predicates* implement filtering: - -- `PodFitsHostPorts`: Checks if a Node has free ports (the network protocol kind) - for the Pod ports the Pod is requesting. - -- `PodFitsHost`: Checks if a Pod specifies a specific Node by its hostname. - -- `PodFitsResources`: Checks if the Node has free resources (eg, CPU and Memory) - to meet the requirement of the Pod. - -- `MatchNodeSelector`: Checks if a Pod's Node {{< glossary_tooltip term_id="selector" >}} - matches the Node's {{< glossary_tooltip text="label(s)" term_id="label" >}}. - -- `NoVolumeZoneConflict`: Evaluate if the {{< glossary_tooltip text="Volumes" term_id="volume" >}} - that a Pod requests are available on the Node, given the failure zone restrictions for - that storage. - -- `NoDiskConflict`: Evaluates if a Pod can fit on a Node due to the volumes it requests, - and those that are already mounted. - -- `MaxCSIVolumeCount`: Decides how many {{< glossary_tooltip text="CSI" term_id="csi" >}} - volumes should be attached, and whether that's over a configured limit. - -- `PodToleratesNodeTaints`: checks if a Pod's {{< glossary_tooltip text="tolerations" term_id="toleration" >}} - can tolerate the Node's {{< glossary_tooltip text="taints" term_id="taint" >}}. - -- `CheckVolumeBinding`: Evaluates if a Pod can fit due to the volumes it requests. - This applies for both bound and unbound - {{< glossary_tooltip text="PVCs" term_id="persistent-volume-claim" >}}. - -## Priorities - -The following *priorities* implement scoring: - -- `SelectorSpreadPriority`: Spreads Pods across hosts, considering Pods that - belong to the same {{< glossary_tooltip text="Service" term_id="service" >}}, - {{< glossary_tooltip term_id="statefulset" >}} or - {{< glossary_tooltip term_id="replica-set" >}}. - -- `InterPodAffinityPriority`: Implements preferred - [inter pod affininity and antiaffinity](/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity). - -- `LeastRequestedPriority`: Favors nodes with fewer requested resources. In other - words, the more Pods that are placed on a Node, and the more resources those - Pods use, the lower the ranking this policy will give. - -- `MostRequestedPriority`: Favors nodes with most requested resources. This policy - will fit the scheduled Pods onto the smallest number of Nodes needed to run your - overall set of workloads. - -- `RequestedToCapacityRatioPriority`: Creates a requestedToCapacity based ResourceAllocationPriority using default resource scoring function shape. - -- `BalancedResourceAllocation`: Favors nodes with balanced resource usage. - -- `NodePreferAvoidPodsPriority`: Prioritizes nodes according to the node annotation - `scheduler.alpha.kubernetes.io/preferAvoidPods`. You can use this to hint that - two different Pods shouldn't run on the same Node. - -- `NodeAffinityPriority`: Prioritizes nodes according to node affinity scheduling - preferences indicated in PreferredDuringSchedulingIgnoredDuringExecution. - You can read more about this in [Assigning Pods to Nodes](/docs/concepts/scheduling-eviction/assign-pod-node/). - -- `TaintTolerationPriority`: Prepares the priority list for all the nodes, based on - the number of intolerable taints on the node. This policy adjusts a node's rank - taking that list into account. - -- `ImageLocalityPriority`: Favors nodes that already have the - {{< glossary_tooltip text="container images" term_id="image" >}} for that - Pod cached locally. - -- `ServiceSpreadingPriority`: For a given Service, this policy aims to make sure that - the Pods for the Service run on different nodes. It favours scheduling onto nodes - that don't have Pods for the service already assigned there. The overall outcome is - that the Service becomes more resilient to a single Node failure. - -- `EqualPriority`: Gives an equal weight of one to all nodes. - -- `EvenPodsSpreadPriority`: Implements preferred - [pod topology spread constraints](/docs/concepts/workloads/pods/pod-topology-spread-constraints/). +This scheduling policy is not supported since Kubernetes v1.23. Associated flags `policy-config-file`, `policy-configmap`, `policy-configmap-namespace` and `use-legacy-policy-config` are also not supported. Instead, use the [Scheduler Configuration](/docs/reference/scheduling/config/) to achieve similar behavior. ## {{% heading "whatsnext" %}} @@ -106,4 +17,3 @@ The following *priorities* implement scoring: * Learn about [kube-scheduler Configuration](/docs/reference/scheduling/config/) * Read the [kube-scheduler configuration reference (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2) * Read the [kube-scheduler Policy reference (v1)](/docs/reference/config-api/kube-scheduler-policy-config.v1/) - From 506fede20cca5701f53f7ce41515858bf6f5d048 Mon Sep 17 00:00:00 2001 From: bang9211 Date: Thu, 25 Nov 2021 15:35:19 +0900 Subject: [PATCH 066/148] Translate tasks/service-catalog/install-service-catalog-using-sc.md in Korean --- .../ko/docs/tasks/service-catalog/_index.md | 5 ++ .../install-service-catalog-using-sc.md | 78 +++++++++++++++++++ 2 files changed, 83 insertions(+) create mode 100644 content/ko/docs/tasks/service-catalog/_index.md create mode 100644 content/ko/docs/tasks/service-catalog/install-service-catalog-using-sc.md diff --git a/content/ko/docs/tasks/service-catalog/_index.md b/content/ko/docs/tasks/service-catalog/_index.md new file mode 100644 index 0000000000..bc8920240f --- /dev/null +++ b/content/ko/docs/tasks/service-catalog/_index.md @@ -0,0 +1,5 @@ +--- +title: "서비스 카탈로그" +description: 서비스 카탈로그 익스텐션(extension) API를 설치한다. +weight: 150 +--- diff --git a/content/ko/docs/tasks/service-catalog/install-service-catalog-using-sc.md b/content/ko/docs/tasks/service-catalog/install-service-catalog-using-sc.md new file mode 100644 index 0000000000..e7af324ddf --- /dev/null +++ b/content/ko/docs/tasks/service-catalog/install-service-catalog-using-sc.md @@ -0,0 +1,78 @@ +--- +title: SC로 서비스 카탈로그 설치하기 +content_type: task +--- + + +{{< glossary_definition term_id="service-catalog" length="all" prepend="서비스 카탈로그는" >}} + +GCP [서비스 카탈로그 설치 프로그램](https://github.com/GoogleCloudPlatform/k8s-service-catalog#installation) +도구로 쿠버네티스 클러스터에 서비스 카탈로그를 쉽게 설치하거나 제거하여 +Google Cloud 프로젝트에 연결할 수 있다. + +서비스 카탈로그는 Google Cloud뿐 아니라 모든 종류의 관리형 서비스와 함께 작동할 수 있다. + +## {{% heading "prerequisites" %}} + +* [서비스 카탈로그](/ko/docs/concepts/extend-kubernetes/service-catalog/)의 핵심 개념을 이해한다. +* [Go 1.6+](https://golang.org/dl/)를 설치하고 `GOPATH`를 설정한다. +* SSL 아티팩트 생성에 필요한 [cfssl](https://github.com/cloudflare/cfssl) 도구를 설치한다. +* 서비스 카탈로그에는 Kubernetes 버전 1.7 이상이 필요하다. +* [kubectl 설치 및 설정](/ko/docs/tasks/tools/)을 사용하여 Kubernetes 버전 1.7 이상의 클러스터에 연결하도록 구성한다. +* kubectl 사용자는 서비스 카탈로그를 설치하기 위해 *cluster-admin* 역할에 바인딩되어야 한다. 이것이 사실인지 확인하려면 다음 명령을 실행한다. + + kubectl create clusterrolebinding cluster-admin-binding --clusterrole=cluster-admin --user= + + + + + +## 로컬 환경에 `sc` 설치하기 + +설치 프로그램은 로컬 컴퓨터에서 `sc`라는 CLI 도구로 실행된다. + +`go get`을 사용하여 설치한다. + +```shell +go get github.com/GoogleCloudPlatform/k8s-service-catalog/installer/cmd/sc +``` + +`sc`는 이제 `GOPATH/bin` 디렉토리에 설치되어야 한다. + +## 쿠버네티스 클러스터에 서비스 카탈로그 설치하기 + +먼저 명령을 실행하여 모든 종속성이 설치되었는지 확인한다. + +```shell +sc check +``` + +확인에 성공하면 다음을 반환해야 한다. + +``` +Dependency check passed. You are good to go. +``` + +그런 다음 설치 명령을 실행하고 백업에 사용할 `storageclass`를 지정한다. + +```shell +sc install --etcd-backup-storageclass "standard" +``` + +## 서비스 카탈로그 제거하기 + +`sc` 도구를 사용하여 쿠버네티스 클러스터에서 서비스 카탈로그를 제거하려면 다음을 실행한다. + +```shell +sc uninstall +``` + + + + +## {{% heading "whatsnext" %}} + +* [샘플 서비스 브로커](https://github.com/openservicebrokerapi/servicebroker/blob/master/gettingStarted.md#sample-service-brokers) 살펴보기 +* [kubernetes-sigs/service-catalog](https://github.com/kubernetes-sigs/service-catalog) 프로젝트 탐색 + + From 5961160ac2a7a17f475cde2cb637a48c28561c49 Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Thu, 25 Nov 2021 19:25:15 +0900 Subject: [PATCH 067/148] [ko] Update outdated files in dev-1.22-ko.3 M4-M8 --- content/ko/docs/concepts/overview/components.md | 8 +++----- .../overview/working-with-objects/namespaces.md | 7 +++++-- content/ko/docs/concepts/security/overview.md | 12 ++++++------ .../ko/docs/concepts/services-networking/service.md | 7 ++++--- 4 files changed, 18 insertions(+), 16 deletions(-) diff --git a/content/ko/docs/concepts/overview/components.md b/content/ko/docs/concepts/overview/components.md index b4c6079213..4a93cf9e5c 100644 --- a/content/ko/docs/concepts/overview/components.md +++ b/content/ko/docs/concepts/overview/components.md @@ -1,4 +1,6 @@ --- + + title: 쿠버네티스 컴포넌트 content_type: concept description: > @@ -17,11 +19,7 @@ card: 이 문서는 완전히 작동하는 쿠버네티스 클러스터를 갖기 위해 필요한 다양한 컴포넌트들에 대해 요약하고 정리한다. -여기에 모든 컴포넌트가 함께 있는 쿠버네티스 클러스터 다이어그램이 있다. - -![쿠버네티스의 컴포넌트](/images/docs/components-of-kubernetes.svg) - - +{{< figure src="/images/docs/components-of-kubernetes.svg" alt="쿠버네티스 구성 요소" caption="쿠버네티스 클러스터 구성 요소" class="diagram-large" >}} ## 컨트롤 플레인 컴포넌트 diff --git a/content/ko/docs/concepts/overview/working-with-objects/namespaces.md b/content/ko/docs/concepts/overview/working-with-objects/namespaces.md index fb2e52534c..03597eee50 100644 --- a/content/ko/docs/concepts/overview/working-with-objects/namespaces.md +++ b/content/ko/docs/concepts/overview/working-with-objects/namespaces.md @@ -1,4 +1,8 @@ --- + + + + title: 네임스페이스 content_type: concept weight: 30 @@ -6,8 +10,7 @@ weight: 30 -쿠버네티스는 동일한 물리 클러스터를 기반으로 하는 여러 가상 클러스터를 지원한다. -이런 가상 클러스터를 네임스페이스라고 한다. +쿠버네티스에서, _네임스페이스_ 는 단일 클러스터 내에서의 리소스 그룹 격리 메커니즘을 제공한다. 리소스의 이름은 네임스페이스 내에서 유일해야 하며, 네임스페이스 간에서 유일할 필요는 없다. 네임스페이스 기반 스코핑은 네임스페이스 기반 오브젝트 _(예: 디플로이먼트, 서비스 등)_ 에만 적용 가능하며 클러스터 범위의 오브젝트 _(예: 스토리지클래스, 노드, 퍼시스턴트볼륨 등)_ 에는 적용 불가능하다. diff --git a/content/ko/docs/concepts/security/overview.md b/content/ko/docs/concepts/security/overview.md index dd81fe6b2c..02cf7d72ae 100644 --- a/content/ko/docs/concepts/security/overview.md +++ b/content/ko/docs/concepts/security/overview.md @@ -29,7 +29,7 @@ weight: 1 널리 알려져 있다. {{< /note >}} -{{< figure src="/images/docs/4c.png" title="클라우드 네이티브 보안의 4C" >}} +{{< figure src="/images/docs/4c.png" title="클라우드 네이티브 보안의 4C" class="diagram-large" >}} 클라우드 네이티브 보안 모델의 각 계층은 다음의 가장 바깥쪽 계층을 기반으로 한다. 코드 계층은 강력한 기본(클라우드, 클러스터, 컨테이너) 보안 계층의 이점을 제공한다. @@ -77,7 +77,7 @@ API 서버에 대한 네트워크 접근(컨트롤 플레인) | 쿠버네티스 노드에 대한 네트워크 접근(노드) | 지정된 포트의 컨트롤 플레인에서 _만_ (네트워크 접근 제어 목록을 통한) 연결을 허용하고 NodePort와 LoadBalancer 유형의 쿠버네티스 서비스에 대한 연결을 허용하도록 노드를 구성해야 한다. 가능하면 이러한 노드가 공용 인터넷에 완전히 노출되어서는 안된다. 클라우드 공급자 API에 대한 쿠버네티스 접근 | 각 클라우드 공급자는 쿠버네티스 컨트롤 플레인 및 노드에 서로 다른 권한 집합을 부여해야 한다. 관리해야하는 리소스에 대해 [최소 권한의 원칙](https://en.wikipedia.org/wiki/Principle_of_least_privilege)을 따르는 클라우드 공급자의 접근 권한을 클러스터에 구성하는 것이 가장 좋다. [Kops 설명서](https://github.com/kubernetes/kops/blob/master/docs/iam_roles.md#iam-roles)는 IAM 정책 및 역할에 대한 정보를 제공한다. etcd에 대한 접근 | etcd(쿠버네티스의 데이터 저장소)에 대한 접근은 컨트롤 플레인으로만 제한되어야 한다. 구성에 따라 TLS를 통해 etcd를 사용해야 한다. 자세한 내용은 [etcd 문서](https://github.com/etcd-io/etcd/tree/master/Documentation)에서 확인할 수 있다. -etcd 암호화 | 가능한 한 모든 드라이브를 암호화하는 것이 좋은 방법이지만, etcd는 전체 클러스터(시크릿 포함)의 상태를 유지하고 있기에 특히 디스크는 암호화되어 있어야 한다. +etcd 암호화 | 가능한 한 모든 스토리지를 암호화하는 것이 좋은 방법이며, etcd는 전체 클러스터(시크릿 포함)의 상태를 유지하고 있기에 특히 디스크는 암호화되어 있어야 한다. {{< /table >}} @@ -107,9 +107,9 @@ etcd 암호화 | 가능한 한 모든 드라이브를 암호화하는 것이 좋 ------------------------------ | ------------ | RBAC 인증(쿠버네티스 API에 대한 접근) | https://kubernetes.io/docs/reference/access-authn-authz/rbac/ 인증 | https://kubernetes.io/ko/docs/concepts/security/controlling-access/ -애플리케이션 시크릿 관리(및 유휴 상태에서의 etcd 암호화 등) | https://kubernetes.io/docs/concepts/configuration/secret/
https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/ -파드 보안 정책 | https://kubernetes.io/docs/concepts/policy/pod-security-policy/ -서비스 품질(및 클러스터 리소스 관리) | https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/ +애플리케이션 시크릿 관리(및 유휴 상태에서의 etcd 암호화 등) | https://kubernetes.io/ko/docs/concepts/configuration/secret/
https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/ +파드가 파드 시큐리티 폴리시를 만족하는지 확인하기 | https://kubernetes.io/docs/concepts/security/pod-security-standards/#policy-instantiation +서비스 품질(및 클러스터 리소스 관리) | https://kubernetes.io/ko/docs/tasks/configure-pod-container/quality-service-pod/ 네트워크 정책 | https://kubernetes.io/ko/docs/concepts/services-networking/network-policies/ 쿠버네티스 인그레스를 위한 TLS | https://kubernetes.io/ko/docs/concepts/services-networking/ingress/#tls @@ -137,7 +137,7 @@ RBAC 인증(쿠버네티스 API에 대한 접근) | https://kubernetes.io/docs/r 코드에서 고려할 영역 | 추천 | -------------------------| -------------- | -TLS를 통한 접근 | 코드가 TCP를 통해 통신해야 한다면, 미리 클라이언트와 TLS 핸드 셰이크를 수행한다. 몇 가지 경우를 제외하고, 전송 중인 모든 것을 암호화한다. 한 걸음 더 나아가, 서비스 간 네트워크 트래픽을 암호화하는 것이 좋다. 이것은 인증서를 가지고 있는 두 서비스의 양방향 검증을 [mTLS](https://en.wikipedia.org/wiki/Mutual_authentication)를 통해 수행할 수 있다. | +TLS를 통한 접근 | 코드가 TCP를 통해 통신해야 한다면, 미리 클라이언트와 TLS 핸드 셰이크를 수행한다. 몇 가지 경우를 제외하고, 전송 중인 모든 것을 암호화한다. 한 걸음 더 나아가, 서비스 간 네트워크 트래픽을 암호화하는 것이 좋다. 이것은 인증서를 가지고 있는 두 서비스의 양방향 검증을 실행하는 [mTLS(상호 TLS 인증)](https://en.wikipedia.org/wiki/Mutual_authentication)를 통해 수행할 수 있다. | 통신 포트 범위 제한 | 이 권장사항은 당연할 수도 있지만, 가능하면 통신이나 메트릭 수집에 꼭 필요한 서비스의 포트만 노출시켜야 한다. | 타사 종속성 보안 | 애플리케이션의 타사 라이브러리를 정기적으로 스캔하여 현재 알려진 취약점이 없는지 확인하는 것이 좋다. 각 언어에는 이런 검사를 자동으로 수행하는 도구를 가지고 있다. | 정적 코드 분석 | 대부분 언어에는 잠재적으로 안전하지 않은 코딩 방법에 대해 코드 스니펫을 분석할 수 있는 방법을 제공한다. 가능한 언제든지 일반적인 보안 오류에 대해 코드베이스를 스캔할 수 있는 자동화된 도구를 사용하여 검사를 한다. 도구는 다음에서 찾을 수 있다. https://owasp.org/www-community/Source_Code_Analysis_Tools | diff --git a/content/ko/docs/concepts/services-networking/service.md b/content/ko/docs/concepts/services-networking/service.md index e0b022185f..798c0b4e97 100644 --- a/content/ko/docs/concepts/services-networking/service.md +++ b/content/ko/docs/concepts/services-networking/service.md @@ -263,9 +263,7 @@ DNS 레코드를 구성하고, 라운드-로빈 이름 확인 방식을 kube-proxy는 구성에 따라 결정되는 여러 모드에서 기동될 수 있다. - kube-proxy의 구성은 컨피그맵(ConfigMap)을 통해 이루어진다. 그리고 해당 kube-proxy를 위한 컨피그맵은 실효성있게 거의 대부분의 kube-proxy의 플래그의 행위를 더 이상 사용하지 않도록 한다. - kube-proxy를 위한 해당 컨피그맵은 기동 중 구성의 재적용(live reloading)은 지원하지 않는다. -- kube-proxy를 위한 컨피그맵 파라미터는 기동 시에 검증이나 확인을 하지 않는다. 예를 들어, - 운영 체계가 iptables 명령을 허용하지 않을 경우, 표준 커널 kube-proxy 구현체는 작동하지 않을 것이다. - 마찬가지로, `netsh`을 지원하지 않는 운영 체계에서는, 윈도우 유저스페이스 모드로는 기동하지 않을 것이다. +- kube-proxy를 위한 컨피그맵 파라미터는 기동 시에 검증이나 확인을 하지 않는다. 예를 들어, 운영 체계가 iptables 명령을 허용하지 않을 경우, 표준 커널 kube-proxy 구현체는 작동하지 않을 것이다. 마찬가지로, `netsh`을 지원하지 않는 운영 체계에서는, 윈도우 유저스페이스 모드로는 기동하지 않을 것이다. ### 유저 스페이스(User space) 프록시 모드 {#proxy-mode-userspace} @@ -1074,6 +1072,9 @@ spec: {{< /note >}} +엘라스틱 IP에 대한 설명 문서와 기타 일반적 사용 사례를 +[AWS 로드 밸런서 컨트롤러 문서](https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/guide/service/annotations/)에서 볼 수 있다. + #### Tencent Kubernetes Engine (TKE)의 다른 CLB 어노테이션 아래 표시된 것처럼 TKE에서 클라우드 로드 밸런서를 관리하기 위한 다른 어노테이션이 있다. From abc7aa0e8bb03ce03dcf35eb7d0b7b69c86066c6 Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Fri, 26 Nov 2021 12:07:03 +0900 Subject: [PATCH 068/148] [ko] Update outdated files in dev-1.22-ko.3 M9-18 --- .../workloads/controllers/cron-jobs.md | 1 + .../workloads/controllers/deployment.md | 47 ++++---- .../controllers/replicationcontroller.md | 1 - .../ko/docs/concepts/workloads/pods/_index.md | 17 ++- .../workloads/pods/init-containers.md | 2 +- .../concepts/workloads/pods/pod-lifecycle.md | 2 +- .../pods/pod-topology-spread-constraints.md | 62 +++++------ content/ko/docs/contribute/_index.md | 93 +++++++++++++++- .../ko/docs/contribute/new-content/_index.md | 84 ++++++++++++--- .../docs/contribute/new-content/open-a-pr.md | 101 ++++++++++++++++-- content/ko/examples/pods/simple-pod.yaml | 10 ++ 11 files changed, 336 insertions(+), 84 deletions(-) create mode 100644 content/ko/examples/pods/simple-pod.yaml diff --git a/content/ko/docs/concepts/workloads/controllers/cron-jobs.md b/content/ko/docs/concepts/workloads/controllers/cron-jobs.md index e2b684166f..3ae5659806 100644 --- a/content/ko/docs/concepts/workloads/controllers/cron-jobs.md +++ b/content/ko/docs/concepts/workloads/controllers/cron-jobs.md @@ -77,6 +77,7 @@ kube-controller-manager 컨테이너에 설정된 시간대는 | @hourly | 매시 0분에 시작 | 0 * * * * | + 예를 들면, 다음은 해당 작업이 매주 금요일 자정에 시작되어야 하고, 매월 13일 자정(UTC 기준)에도 시작되어야 한다는 뜻이다. `CRON_TZ=UTC 0 0 13 * 5` diff --git a/content/ko/docs/concepts/workloads/controllers/deployment.md b/content/ko/docs/concepts/workloads/controllers/deployment.md index fc82199883..ed9eaa8cbb 100644 --- a/content/ko/docs/concepts/workloads/controllers/deployment.md +++ b/content/ko/docs/concepts/workloads/controllers/deployment.md @@ -1,4 +1,6 @@ --- + + title: 디플로이먼트 feature: title: 자동화된 롤아웃과 롤백 @@ -74,7 +76,6 @@ kubectl apply -f https://k8s.io/examples/controllers/nginx-deployment.yaml ``` - 2. `kubectl get deployments` 을 실행해서 디플로이먼트가 생성되었는지 확인한다. 만약 디플로이먼트가 여전히 생성 중이면, 다음과 유사하게 출력된다. @@ -163,7 +164,7 @@ kubectl apply -f https://k8s.io/examples/controllers/nginx-deployment.yaml 1. `nginx:1.14.2` 이미지 대신 `nginx:1.16.1` 이미지를 사용하도록 nginx 파드를 업데이트 한다. ```shell - kubectl deployment.apps/nginx-deployment set image deployment.v1.apps/nginx-deployment nginx=nginx:1.16.1 + kubectl set image deployment.v1.apps/nginx-deployment nginx=nginx:1.16.1 ``` 또는 다음의 명령어를 사용한다. @@ -181,7 +182,7 @@ kubectl apply -f https://k8s.io/examples/controllers/nginx-deployment.yaml 대안으로 디플로이먼트를 `edit` 해서 `.spec.template.spec.containers[0].image` 를 `nginx:1.14.2` 에서 `nginx:1.16.1` 로 변경한다. ```shell - kubectl edit deployment.v1.apps/nginx-deployment + kubectl edit deployment/nginx-deployment ``` 다음과 유사하게 출력된다. @@ -364,7 +365,7 @@ API 버전 `apps/v1` 에서 디플로이먼트의 레이블 셀렉터는 생성 * 디플로이먼트를 업데이트하는 동안 이미지 이름을 `nginx:1.16.1` 이 아닌 `nginx:1.161` 로 입력해서 오타를 냈다고 가정한다. ```shell - kubectl set image deployment.v1.apps/nginx-deployment nginx=nginx:1.161 + kubectl set image deployment/nginx-deployment nginx=nginx:1.161 ``` 이와 유사하게 출력된다. @@ -473,25 +474,25 @@ API 버전 `apps/v1` 에서 디플로이먼트의 레이블 셀렉터는 생성 1. 먼저 이 디플로이먼트의 수정 사항을 확인한다. ```shell - kubectl rollout history deployment.v1.apps/nginx-deployment + kubectl rollout history deployment/nginx-deployment ``` 이와 유사하게 출력된다. ``` deployments "nginx-deployment" REVISION CHANGE-CAUSE 1 kubectl apply --filename=https://k8s.io/examples/controllers/nginx-deployment.yaml - 2 kubectl set image deployment.v1.apps/nginx-deployment nginx=nginx:1.16.1 - 3 kubectl set image deployment.v1.apps/nginx-deployment nginx=nginx:1.161 + 2 kubectl set image deployment/nginx-deployment nginx=nginx:1.16.1 + 3 kubectl set image deployment/nginx-deployment nginx=nginx:1.161 ``` `CHANGE-CAUSE` 는 수정 생성시 디플로이먼트 주석인 `kubernetes.io/change-cause` 에서 복사한다. 다음에 대해 `CHANGE-CAUSE` 메시지를 지정할 수 있다. - * 디플로이먼트에 `kubectl annotate deployment.v1.apps/nginx-deployment kubernetes.io/change-cause="image updated to 1.16.1"` 로 주석을 단다. + * 디플로이먼트에 `kubectl annotate deployment/nginx-deployment kubernetes.io/change-cause="image updated to 1.16.1"` 로 주석을 단다. * 수동으로 리소스 매니페스트 편집. 2. 각 수정 버전의 세부 정보를 보려면 다음을 실행한다. ```shell - kubectl rollout history deployment.v1.apps/nginx-deployment --revision=2 + kubectl rollout history deployment/nginx-deployment --revision=2 ``` 이와 유사하게 출력된다. @@ -499,7 +500,7 @@ API 버전 `apps/v1` 에서 디플로이먼트의 레이블 셀렉터는 생성 deployments "nginx-deployment" revision 2 Labels: app=nginx pod-template-hash=1159050644 - Annotations: kubernetes.io/change-cause=kubectl set image deployment.v1.apps/nginx-deployment nginx=nginx:1.16.1 + Annotations: kubernetes.io/change-cause=kubectl set image deployment/nginx-deployment nginx=nginx:1.16.1 Containers: nginx: Image: nginx:1.16.1 @@ -516,7 +517,7 @@ API 버전 `apps/v1` 에서 디플로이먼트의 레이블 셀렉터는 생성 1. 이제 현재 롤아웃의 실행 취소 및 이전 수정 버전으로 롤백 하기로 결정했다. ```shell - kubectl rollout undo deployment.v1.apps/nginx-deployment + kubectl rollout undo deployment/nginx-deployment ``` 이와 유사하게 출력된다. @@ -526,7 +527,7 @@ API 버전 `apps/v1` 에서 디플로이먼트의 레이블 셀렉터는 생성 Alternatively, you can rollback to a specific revision by specifying it with `--to-revision`: ```shell - kubectl rollout undo deployment.v1.apps/nginx-deployment --to-revision=2 + kubectl rollout undo deployment/nginx-deployment --to-revision=2 ``` 이와 유사하게 출력된다. @@ -560,7 +561,7 @@ API 버전 `apps/v1` 에서 디플로이먼트의 레이블 셀렉터는 생성 CreationTimestamp: Sun, 02 Sep 2018 18:17:55 -0500 Labels: app=nginx Annotations: deployment.kubernetes.io/revision=4 - kubernetes.io/change-cause=kubectl set image deployment.v1.apps/nginx-deployment nginx=nginx:1.16.1 + kubernetes.io/change-cause=kubectl set image deployment/nginx-deployment nginx=nginx:1.16.1 Selector: app=nginx Replicas: 3 desired | 3 updated | 3 total | 3 available | 0 unavailable StrategyType: RollingUpdate @@ -603,7 +604,7 @@ API 버전 `apps/v1` 에서 디플로이먼트의 레이블 셀렉터는 생성 다음 명령어를 사용해서 디플로이먼트의 스케일을 할 수 있다. ```shell -kubectl scale deployment.v1.apps/nginx-deployment --replicas=10 +kubectl scale deployment/nginx-deployment --replicas=10 ``` 이와 유사하게 출력된다. ``` @@ -615,7 +616,7 @@ deployment.apps/nginx-deployment scaled 실행할 최소 파드 및 최대 파드의 수를 선택할 수 있다. ```shell -kubectl autoscale deployment.v1.apps/nginx-deployment --min=10 --max=15 --cpu-percent=80 +kubectl autoscale deployment/nginx-deployment --min=10 --max=15 --cpu-percent=80 ``` 이와 유사하게 출력된다. ``` @@ -644,7 +645,7 @@ deployment.apps/nginx-deployment scaled * 클러스터 내부에서 확인할 수 없는 새 이미지로 업데이트 된다. ```shell - kubectl set image deployment.v1.apps/nginx-deployment nginx=nginx:sometag + kubectl set image deployment/nginx-deployment nginx=nginx:sometag ``` 이와 유사하게 출력된다. @@ -723,7 +724,7 @@ nginx-deployment-618515232 11 11 11 7m * 다음 명령을 사용해서 일시 중지한다. ```shell - kubectl rollout pause deployment.v1.apps/nginx-deployment + kubectl rollout pause deployment/nginx-deployment ``` 이와 유사하게 출력된다. @@ -733,7 +734,7 @@ nginx-deployment-618515232 11 11 11 7m * 그런 다음 디플로이먼트의 이미지를 업데이트 한다. ```shell - kubectl set image deployment.v1.apps/nginx-deployment nginx=nginx:1.16.1 + kubectl set image deployment/nginx-deployment nginx=nginx:1.16.1 ``` 이와 유사하게 출력된다. @@ -743,7 +744,7 @@ nginx-deployment-618515232 11 11 11 7m * 새로운 롤아웃이 시작되지 않는다. ```shell - kubectl rollout history deployment.v1.apps/nginx-deployment + kubectl rollout history deployment/nginx-deployment ``` 이와 유사하게 출력된다. @@ -765,7 +766,7 @@ nginx-deployment-618515232 11 11 11 7m * 예를 들어 사용할 리소스를 업데이트하는 것처럼 원하는 만큼 업데이트할 수 있다. ```shell - kubectl set resources deployment.v1.apps/nginx-deployment -c=nginx --limits=cpu=200m,memory=512Mi + kubectl set resources deployment/nginx-deployment -c=nginx --limits=cpu=200m,memory=512Mi ``` 이와 유사하게 출력된다. @@ -778,7 +779,7 @@ nginx-deployment-618515232 11 11 11 7m * 결국, 디플로이먼트를 재개하고 새로운 레플리카셋이 새로운 업데이트를 제공하는 것을 관찰한다. ```shell - kubectl rollout resume deployment.v1.apps/nginx-deployment + kubectl rollout resume deployment/nginx-deployment ``` 이와 유사하게 출력된다. @@ -888,7 +889,7 @@ echo $? 10분 후 디플로이먼트에 대한 진행 상태의 부족에 대한 리포트를 수행하게 한다. ```shell -kubectl patch deployment.v1.apps/nginx-deployment -p '{"spec":{"progressDeadlineSeconds":600}}' +kubectl patch deployment/nginx-deployment -p '{"spec":{"progressDeadlineSeconds":600}}' ``` 이와 유사하게 출력된다. ``` @@ -999,7 +1000,7 @@ Conditions: `kubectl rollout status` 는 디플로이먼트의 진행 데드라인을 초과하면 0이 아닌 종료 코드를 반환한다. ```shell -kubectl rollout status deployment.v1.apps/nginx-deployment +kubectl rollout status deployment/nginx-deployment ``` 이와 유사하게 출력된다. ``` diff --git a/content/ko/docs/concepts/workloads/controllers/replicationcontroller.md b/content/ko/docs/concepts/workloads/controllers/replicationcontroller.md index a8cc60708e..bcf8a9771a 100644 --- a/content/ko/docs/concepts/workloads/controllers/replicationcontroller.md +++ b/content/ko/docs/concepts/workloads/controllers/replicationcontroller.md @@ -118,7 +118,6 @@ nginx-3ntk0 nginx-4ok8v nginx-qrm3m 다른 형식의 파일인 `replication.yaml` 의 것과 동일하다. `--output=jsonpath` 은 반환된 목록의 각 파드의 이름을 출력하도록 하는 옵션이다. - ## 레플리케이션 컨트롤러의 Spec 작성 다른 모든 쿠버네티스 컨피그와 마찬가지로 레플리케이션 컨트롤러는 `apiVersion`, `kind`, `metadata` 와 같은 필드가 필요하다. diff --git a/content/ko/docs/concepts/workloads/pods/_index.md b/content/ko/docs/concepts/workloads/pods/_index.md index 33f616fed3..6a1066c2ca 100644 --- a/content/ko/docs/concepts/workloads/pods/_index.md +++ b/content/ko/docs/concepts/workloads/pods/_index.md @@ -48,6 +48,21 @@ _파드_ (고래 떼(pod of whales)나 콩꼬투리(pea pod)와 마찬가지로) ## 파드의 사용 +다음은 `nginx:1.14.2` 이미지를 실행하는 컨테이너로 구성되는 파드의 예시이다. + +{{< codenew file="pods/simple-pod.yaml" >}} + +위에서 설명한 파드를 생성하려면, 다음 명령을 실행한다. +```shell +kubectl apply -f https://k8s.io/examples/pods/simple-pod.yaml +``` + +일반적으로 파드는 직접 생성하지는 않으며, 대신 워크로드 리소스를 사용하여 생성한다. +[파드 작업](#파드-작업) 섹션에서 파드와 워크로드 리소스의 관계에 대한 +더 많은 정보를 확인한다. + +### Workload resources for managing pods + 일반적으로 싱글톤(singleton) 파드를 포함하여 파드를 직접 만들 필요가 없다. 대신, {{< glossary_tooltip text="디플로이먼트(Deployment)" term_id="deployment" >}} 또는 {{< glossary_tooltip text="잡(Job)" term_id="job" >}}과 같은 워크로드 리소스를 사용하여 생성한다. 파드가 상태를 추적해야 한다면, @@ -97,7 +112,7 @@ term_id="deployment" >}} 또는 {{< glossary_tooltip text="잡(Job)" term_id="jo 공유 볼륨의 파일에 대한 웹 서버 역할을 하는 컨테이너와, 원격 소스에서 해당 파일을 업데이트하는 별도의 "사이드카" 컨테이너가 있을 수 있다. -{{< figure src="/images/docs/pod.svg" alt="예제 파드 다이어그램" width="50%" >}} +{{< figure src="/images/docs/pod.svg" alt="파드 생성 다이어그램" class="diagram-medium" >}} 일부 파드에는 {{< glossary_tooltip text="앱 컨테이너" term_id="app-container" >}} 뿐만 아니라 {{< glossary_tooltip text="초기화 컨테이너" term_id="init-container" >}}를 갖고 있다. 초기화 컨테이너는 앱 컨테이너가 시작되기 전에 실행되고 완료된다. diff --git a/content/ko/docs/concepts/workloads/pods/init-containers.md b/content/ko/docs/concepts/workloads/pods/init-containers.md index 79b5bb2fff..f3ca845549 100644 --- a/content/ko/docs/concepts/workloads/pods/init-containers.md +++ b/content/ko/docs/concepts/workloads/pods/init-containers.md @@ -283,7 +283,7 @@ myapp-pod 1/1 Running 0 9m 초기화 컨테이너들이 실패를 영원히 지속하는 상황을 방지하기 위해서 파드의 `activeDeadlineSeconds`를 사용한다. Active deadline은 초기화 컨테이너를 포함한다. -그러나 사용자가 애플리케이션을 잡(job)으로 배포한 경우 `activeDeadlineSeconds`를 사용하길 추천한다. 왜냐하면, `activeDeadlineSeconds`는 초기화 컨테이너가 완료된 이후에도 영향을 주기 때문이다. +그러나 팀에서 애플리케이션을 잡(job)으로 배포한 경우에만 `activeDeadlineSeconds`를 사용하길 추천한다. 왜냐하면, `activeDeadlineSeconds`는 초기화 컨테이너가 완료된 이후에도 영향을 주기 때문이다. 이미 정상적으로 동작하고 있는 파드도 `activeDeadlineSeconds`를 설정한 경우 종료(killed)될 수 있다. 파드 내의 각 앱과 초기화 컨테이너의 이름은 유일해야 한다. 어떤 diff --git a/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md b/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md index 3b48baf4eb..54af7521d5 100644 --- a/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md @@ -55,7 +55,7 @@ UID로 정의된 특정 파드는 다른 노드로 절대 "다시 스케줄"되 생성되더라도, 관련된 그것(이 예에서는 볼륨)도 폐기되고 새로 생성된다. -{{< figure src="/images/docs/pod.svg" title="Pod diagram" width="50%" >}} +{{< figure src="/images/docs/pod.svg" title="Pod diagram" class="diagram-medium" >}} *컨테이너 간의 공유 스토리지에 퍼시스턴트 볼륨을 사용하는 웹 서버와 파일 풀러(puller)가 포함된 다중 컨테이너 파드이다.* diff --git a/content/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints.md b/content/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints.md index a7f57b4e6a..865a7cd7c2 100644 --- a/content/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints.md +++ b/content/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints.md @@ -234,43 +234,43 @@ graph BT 스케줄러는 신규 파드에 `spec.nodeSelector` 또는 `spec.affinity.nodeAffinity`가 정의되어 있는 경우, 부합하지 않는 노드들을 차이(skew) 계산에서 생략한다. - zoneA 에서 zoneC에 걸쳐있고, 5개의 노드를 가지는 클러스터가 있다고 가정한다. +zoneA 에서 zoneC에 걸쳐있고, 5개의 노드를 가지는 클러스터가 있다고 가정한다. - {{}} - graph BT - subgraph "zoneB" - p3(Pod) --> n3(Node3) - n4(Node4) - end - subgraph "zoneA" - p1(Pod) --> n1(Node1) - p2(Pod) --> n2(Node2) - end +{{}} +graph BT + subgraph "zoneB" + p3(Pod) --> n3(Node3) + n4(Node4) + end + subgraph "zoneA" + p1(Pod) --> n1(Node1) + p2(Pod) --> n2(Node2) + end - classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; - classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; - classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; - class n1,n2,n3,n4,p1,p2,p3 k8s; - class p4 plain; - class zoneA,zoneB cluster; - {{< /mermaid >}} +classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; +classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; +classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; +class n1,n2,n3,n4,p1,p2,p3 k8s; +class p4 plain; +class zoneA,zoneB cluster; +{{< /mermaid >}} - {{}} - graph BT - subgraph "zoneC" - n5(Node5) - end +{{}} +graph BT + subgraph "zoneC" + n5(Node5) + end - classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; - classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; - classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; - class n5 k8s; - class zoneC cluster; - {{< /mermaid >}} +classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; +classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; +classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; +class n5 k8s; +class zoneC cluster; +{{< /mermaid >}} - 그리고 알다시피 "zoneC"는 제외해야 한다. 이 경우에, "mypod"가 "zoneC"가 아닌 "zoneB"에 배치되도록 yaml을 다음과 같이 구성할 수 있다. 마찬가지로 `spec.nodeSelector` 도 존중된다. +그리고 알다시피 "zoneC"는 제외해야 한다. 이 경우에, "mypod"가 "zoneC"가 아닌 "zoneB"에 배치되도록 yaml을 다음과 같이 구성할 수 있다. 마찬가지로 `spec.nodeSelector` 도 존중된다. - {{< codenew file="pods/topology-spread-constraints/one-constraint-with-nodeaffinity.yaml" >}} +{{< codenew file="pods/topology-spread-constraints/one-constraint-with-nodeaffinity.yaml" >}} 스케줄러는 클러스터에 있는 모든 영역(zone) 또는 다른 토폴로지 도메인에 대한 사전 지식이 없다. 스케줄링은 클러스터의 기존 노드에서 결정된다. 노드 풀(또는 노드 그룹)이 0개의 노드로 스케일(scale)되고 사용자는 노드가 확장될 것으로 예상하는 경우, 자동 스케일되는 클러스터에서 문제가 발생할 수 있다. 이러한 토폴로지 도메인은 스케줄링에서 해당 도메인에 노드가 하나 이상 있을 때까지 고려되지 않을 것이기 때문이다. diff --git a/content/ko/docs/contribute/_index.md b/content/ko/docs/contribute/_index.md index d96ad15195..64b7ba594e 100644 --- a/content/ko/docs/contribute/_index.md +++ b/content/ko/docs/contribute/_index.md @@ -29,6 +29,8 @@ card: - 문서를 번역합니다. - 쿠버네티스 릴리스 주기에 맞추어 문서 부분을 관리하고 발행합니다. + + ## 시작하기 @@ -44,18 +46,98 @@ card: 문서에 참여하려면 1. CNCF [Contributor License Agreement](https://github.com/kubernetes/community/blob/master/CLA.md)에 서명합니다. -1. [문서 리포지터리](https://github.com/kubernetes/website)와 웹사이트의 +2. [문서 리포지터리](https://github.com/kubernetes/website)와 웹사이트의 [정적 사이트 생성기](https://gohugo.io)를 숙지합니다. -1. [풀 리퀘스트 열기](/ko/docs/contribute/new-content/open-a-pr/)와 +3. [풀 리퀘스트 열기](/ko/docs/contribute/new-content/open-a-pr/)와 [변경 검토](/ko/docs/contribute/review/reviewing-prs/)의 기본 프로세스를 이해하도록 합니다. + + + +{{< mermaid >}} +flowchart TB +subgraph third[PR 열기] +direction TB +U[ ] -.- +Q[컨텐츠 향상시키기] --- N[컨텐츠 생성하기] +N --- O[문서 번역하기] +O --- P[K8s 릴리스 사이클의 문서 파트
관리/퍼블리싱하기] + +end + +subgraph second[리뷰] +direction TB + T[ ] -.- + D[K8s/website
저장소 살펴보기] --- E[Hugo 정적 사이트
생성기 확인하기] + E --- F[기본 GitHub 명령어
이해하기] + F --- G[열려 있는 PR을 리뷰하기] +end + +subgraph first[가입] + direction TB + S[ ] -.- + B[CNCF
Contributor
License Agreement
서명하기] --- C[sig-docs 슬랙 채널
가입하기] + C --- V[kubernetes-sig-docs
메일링 리스트 가입하기] + V --- M[주간
sig-docs 회의/
슬랙 미팅 참여하기] +end + +A([fa:fa-user 신규
기여자]) --> first +A --> second +A --> third +A --> H[질문하세요!!!] + + +classDef grey fill:#dddddd,stroke:#ffffff,stroke-width:px,color:#000000, font-size:15px; +classDef white fill:#ffffff,stroke:#000,stroke-width:px,color:#000,font-weight:bold +classDef spacewhite fill:#ffffff,stroke:#fff,stroke-width:0px,color:#000 +class A,B,C,D,E,F,G,H,M,Q,N,O,P,V grey +class S,T,U spacewhite +class first,second,third white +{{}} +***그림 - 신규 기여자를 위한 시작 가이드*** + +위의 그림은 신규 기여자를 위한 로드맵을 간략하게 보여줍니다. `가입` 및 `리뷰` 단계의 일부 또는 전체를 따를 수 있습니다. 이제 `PR 열기` 아래에 나열된 항목들을 수행하여 당신의 기여 목표를 달성할 수 있습니다. 다시 말하지만 질문은 언제나 환영입니다! + 일부 작업에는 쿠버네티스 조직에서 더 많은 신뢰와 더 많은 접근이 필요할 수 있습니다. 역할과 권한에 대한 자세한 내용은 [SIG Docs 참여](/ko/docs/contribute/participate/)를 봅니다. ## 첫 번째 기여 +몇 가지 단계를 미리 검토하여 첫 번째 기여를 준비할 수 있습니다. 아래 그림은 각 단계를 설명하며, 그 다음에 세부 사항도 설명되어 있습니다. + + + + +{{< mermaid >}} +flowchart LR + subgraph second[첫 기여] + direction TB + S[ ] -.- + G[다른 K8s 멤버의 PR 리뷰하기] --> + A[K8s/website 이슈 리스트에서
good first issue 확인하기] --> B[PR을 여세요!!] + end + subgraph first[추천 준비 사항] + direction TB + T[ ] -.- + D[기여 개요 읽기] -->E[K8s 컨텐츠 및
스타일 가이드 읽기] + E --> F[Hugo 페이지 컨텐츠 종류와
shortcode 숙지하기] + end + + + first ----> second + + +classDef grey fill:#dddddd,stroke:#ffffff,stroke-width:px,color:#000000, font-size:15px; +classDef white fill:#ffffff,stroke:#000,stroke-width:px,color:#000,font-weight:bold +classDef spacewhite fill:#ffffff,stroke:#fff,stroke-width:0px,color:#000 +class A,B,D,E,F,G grey +class S,T spacewhite +class first,second white +{{}} +***그림 - 첫 기여를 위한 준비*** + - [기여 개요](/ko/docs/contribute/new-content/)를 읽고 기여할 수 있는 다양한 방법에 대해 알아봅니다. - [`kubernetes/website` 이슈 목록](https://github.com/kubernetes/website/issues/)을 @@ -92,10 +174,13 @@ SIG Docs는 여러가지 방법으로 의견을 나누고 있습니다. 자신을 소개하세요! - 더 광범위한 토론이 이루어지고 공식적인 결정이 기록이 되는 [`kubernetes-sig-docs` 메일링 리스트에 가입](https://groups.google.com/forum/#!forum/kubernetes-sig-docs) 하세요. -- [주간 SIG Docs 화상 회의](https://github.com/kubernetes/community/tree/master/sig-docs)에 참여하세요. 회의는 항상 `#sig-docs` 에 발표되며 [쿠버네티스 커뮤니티 회의 일정](https://calendar.google.com/calendar/embed?src=cgnt364vd8s86hr2phapfjc6uk%40group.calendar.google.com&ctz=America/Los_Angeles)에 추가됩니다. [줌(Zoom) 클라이언트](https://zoom.us/download)를 다운로드하거나 전화를 이용하여 전화 접속해야 합니다. +- 2주마다 열리는 [SIG Docs 화상 회의](https://github.com/kubernetes/community/tree/master/sig-docs)에 참여하세요. 회의는 항상 `#sig-docs` 에 공지되며 [쿠버네티스 커뮤니티 회의 일정](https://calendar.google.com/calendar/embed?src=cgnt364vd8s86hr2phapfjc6uk%40group.calendar.google.com&ctz=America/Los_Angeles)에 추가됩니다. [줌(Zoom) 클라이언트](https://zoom.us/download)를 다운로드하거나 전화를 이용하여 전화 접속해야 합니다. +- 줌 화상 회의가 열리지 않은 경우, SIG Docs 비실시간 슬랙 스탠드업 회의에 참여하세요. 회의는 항상 `#sig-docs` 에 공지됩니다. 회의 공지 후 24시간까지 어느 스레드에나 기여할 수 있습니다. ## 다른 기여 방법들 - [쿠버네티스 커뮤니티 사이트](/ko/community/)를 방문하십시오. 트위터 또는 스택 오버플로우에 참여하고, 현지 쿠버네티스 모임과 이벤트 등에 대해 알아봅니다. -- [기여자 치트시트](https://github.com/kubernetes/community/tree/master/contributors/guide/contributor-cheatsheet)를 읽고 쿠버네티스 기능 개발에 참여합니다. +- [기여자 치트시트](https://www.kubernetes.dev/docs/contributor-cheatsheet/)를 읽고 쿠버네티스 기능 개발에 참여합니다. +- 쿠버네티스 기여자 사이트에서 [쿠버네티스 기여자](https://www.kubernetes.dev/)와 [추가적인 기여자 리소스](https://www.kubernetes.dev/resources/)에 대해 더 알아봅니다. - [블로그 게시물 또는 사례 연구](/docs/contribute/new-content/blogs-case-studies/)를 제출합니다. + diff --git a/content/ko/docs/contribute/new-content/_index.md b/content/ko/docs/contribute/new-content/_index.md index 59b4b7aae4..5abe67265c 100644 --- a/content/ko/docs/contribute/new-content/_index.md +++ b/content/ko/docs/contribute/new-content/_index.md @@ -5,10 +5,48 @@ main_menu: true weight: 20 --- + + -이 섹션에는 새로운 콘텐츠를 기여하기 전에 알아야 할 정보가 있다. +이 섹션에는 새로운 콘텐츠를 기여하기 전에 알아야 할 정보가 +있다. + + +{{< mermaid >}} +flowchart LR + subgraph second[시작하기 전에] + direction TB + S[ ] -.- + A[CNCF CLA 서명하기] --> B[Git 브랜치 선택하기] + B --> C[한 PR에는 한 언어에 대한 변경사항만] + C --> F[기여자 도구 확인하기] + end + subgraph first[기여 기초] + direction TB + T[ ] -.- + D[문서를 마크다운으로 작성하고
Hugo로 사이트 빌드] --- E[GitHub에 있는 소스] + E --- G['/content/../docs' 폴더에
각 언어 컨텐츠가 있음] + G --- H[Hugo 페이지 컨텐츠 종류와
shortcode 숙지하기] + end + + + first ----> second + + +classDef grey fill:#dddddd,stroke:#ffffff,stroke-width:px,color:#000000, font-size:15px; +classDef white fill:#ffffff,stroke:#000,stroke-width:px,color:#000,font-weight:bold +classDef spacewhite fill:#ffffff,stroke:#fff,stroke-width:0px,color:#000 +class A,B,C,D,E,F,G,H grey +class S,T spacewhite +class first,second white +{{}} + +***Figure - Contributing new content preparation*** + +The figure above depicts the information you should know +prior to submitting new content. The information details follow. @@ -16,28 +54,43 @@ weight: 20 ## 기여에 대한 기본 사항 -- 마크다운(Markdown)으로 쿠버네티스 문서를 작성하고 [Hugo](https://gohugo.io/)를 사용하여 쿠버네티스 사이트를 구축한다. -- 소스는 [GitHub](https://github.com/kubernetes/website)에 있다. 쿠버네티스 문서는 `/content/ko/docs/` 에서 찾을 수 있다. 일부 참조 문서는 `update-imported-docs/` 디렉터리의 스크립트에서 자동으로 생성된다. -- [페이지 템플릿](/docs/contribute/style/page-content-types/)은 Hugo에서 문서 콘텐츠의 프리젠테이션을 제어한다. +- 마크다운(Markdown)으로 쿠버네티스 문서를 작성하고 + [Hugo](https://gohugo.io/)를 사용하여 쿠버네티스 사이트를 구축한다. +- 소스는 [GitHub](https://github.com/kubernetes/website)에 있다. + 쿠버네티스 문서는 `/content/ko/docs/` 에서 찾을 수 있다. + 일부 참조 문서는 `update-imported-docs/` 디렉터리의 스크립트를 이용하여 + 자동으로 생성된다. +- [페이지 템플릿](/docs/contribute/style/page-content-types/)은 + Hugo에서 문서 콘텐츠의 프리젠테이션을 제어한다. - 표준 Hugo 단축코드(shortcode) 이외에도 설명서에서 여러 - [사용자 정의 Hugo 단축코드](/docs/contribute/style/hugo-shortcodes/)를 사용하여 콘텐츠 표시를 제어한다. + [사용자 정의 Hugo 단축코드](/docs/contribute/style/hugo-shortcodes/)를 사용하여 + 콘텐츠 표시를 제어한다. - 문서 소스는 `/content/` 에서 여러 언어로 제공된다. 각 언어는 [ISO 639-1 표준](https://www.loc.gov/standards/iso639-2/php/code_list.php)에 의해 결정된 2문자 코드가 있는 자체 폴더가 있다. 예를 들어, 한글 문서의 소스는 `/content/ko/docs/` 에 저장된다. -- 여러 언어로 문서화에 기여하거나 새로운 번역을 시작하는 방법에 대한 자세한 내용은 [현지화](/ko/docs/contribute/localization_ko/)를 참고한다. +- 여러 언어로 문서화에 기여하거나 + 새로운 번역을 시작하는 방법에 대한 자세한 내용은 + [현지화](/ko/docs/contribute/localization_ko/)를 참고한다. ## 시작하기 전에 {#before-you-begin} ### CNCF CLA 서명 {#sign-the-cla} -모든 쿠버네티스 기여자는 **반드시** [기여자 가이드](https://github.com/kubernetes/community/blob/master/contributors/guide/README.md)를 읽고 [기여자 라이선스 계약(CLA)에 서명](https://github.com/kubernetes/community/blob/master/CLA.md)해야 한다. +모든 쿠버네티스 기여자는 **반드시** +[기여자 가이드](https://github.com/kubernetes/community/blob/master/contributors/guide/README.md)를 읽고 +[기여자 라이선스 계약(CLA)에 서명](https://github.com/kubernetes/community/blob/master/CLA.md)해야 한다 +. -CLA에 서명하지 않은 기여자의 풀 리퀘스트(pull request)는 자동 테스트에 실패한다. 제공한 이름과 이메일은 `git config` 에 있는 것과 일치해야 하며, git 이름과 이메일은 CNCF CLA에 사용된 것과 일치해야 한다. +CLA에 서명하지 않은 기여자의 풀 리퀘스트(pull request)는 자동 테스트에 실패한다. +제공한 이름과 이메일은 `git config` 에 있는 것과 일치해야 하며, +git 이름과 이메일은 CNCF CLA에 사용된 것과 +일치해야 한다. ### 사용할 Git 브랜치를 선택한다 -풀 리퀘스트를 열 때는, 작업의 기반이 되는 브랜치를 미리 알아야 한다. +풀 리퀘스트를 열 때는, 작업의 기반이 되는 브랜치를 +미리 알아야 한다. 시나리오 | 브랜치 :---------|:------------ @@ -45,20 +98,21 @@ CLA에 서명하지 않은 기여자의 풀 리퀘스트(pull request)는 자동 기능 변경 릴리스의 콘텐츠 | `dev-` 패턴을 사용하여 기능 변경이 있는 주 버전과 부 버전에 해당하는 브랜치. 예를 들어, `v{{< skew nextMinorVersion >}}` 에서 기능이 변경된 경우, ``dev-{{< skew nextMinorVersion >}}`` 에 문서 변경을 추가한다. 다른 언어로된 콘텐츠(현지화) | 현지화 규칙을 사용. 자세한 내용은 [현지화 브랜치 전략](/docs/contribute/localization/#branching-strategy)을 참고한다. - 어떤 브랜치를 선택해야 할지 잘 모르는 경우 슬랙의 `#sig-docs` 에 문의한다. -{{< note >}} -풀 리퀘스트를 이미 제출했는데 기본 브랜치가 잘못되었다는 것을 알게 되면, +{{< note >}} 풀 리퀘스트를 이미 제출했는데 기본 브랜치가 잘못되었다는 것을 알게 되면, 제출자(제출자인 여러분만)가 이를 변경할 수 있다. {{< /note >}} ### PR 당 언어 -PR 당 하나의 언어로 풀 리퀘스트를 제한한다. 여러 언어로 동일한 코드 샘플을 동일하게 변경해야 하는 경우 각 언어마다 별도의 PR을 연다. +PR 당 하나의 언어로 풀 리퀘스트를 제한한다. +여러 언어로 동일한 코드 샘플을 동일하게 변경해야 하는 경우 +각 언어마다 별도의 PR을 연다. ## 기여자를 위한 도구들 -`kubernetes/website` 리포지터리의 [문서 기여자를 위한 도구](https://github.com/kubernetes/website/tree/main/content/en/docs/doc-contributor-tools) 디렉터리에는 기여 여정을 좀 더 순조롭게 도와주는 도구들이 포함되어 있다. - +`kubernetes/website` 리포지터리의 +[문서 기여자를 위한 도구](https://github.com/kubernetes/website/tree/main/content/en/docs/doc-contributor-tools) +디렉터리에는 기여 여정을 좀 더 순조롭게 도와주는 도구들이 포함되어 있다. diff --git a/content/ko/docs/contribute/new-content/open-a-pr.md b/content/ko/docs/contribute/new-content/open-a-pr.md index 1a46323612..0871800715 100644 --- a/content/ko/docs/contribute/new-content/open-a-pr.md +++ b/content/ko/docs/contribute/new-content/open-a-pr.md @@ -28,7 +28,40 @@ card: ## GitHub을 사용하여 변경하기 git 워크플로에 익숙하지 않은 경우, 풀 리퀘스트를 -여는 쉬운 방법이 있다. +여는 쉬운 방법이 있다. 아래의 그림은 각 단계를 보여주며, 상세사항은 그 아래에 나온다. + + + + +{{< mermaid >}} +flowchart LR +A([fa:fa-user 신규
기여자]) --- id1[(K8s/Website
GitHub)] +subgraph tasks[GitHub 상에서 변경하기] +direction TB + 0[ ] -.- + 1[1. '페이지 편집' 누르기] --> 2[2. GitHub 마크다운
편집기로 편집하기] + 2 --> 3[3. 'Propose file change'에
추가 내용 기재하기] + +end +subgraph tasks2[ ] +direction TB +4[4. 'Propose changes' 누르기] --> 5[5. 'Create pull request' 누르기] --> 6[6. 'Open a pull request'에
추가 내용 기재하기] +6 --> 7[7. 'Create pull request' 누르기] +end + +id1 --> tasks --> tasks2 + +classDef grey fill:#dddddd,stroke:#ffffff,stroke-width:px,color:#000000, font-size:15px; +classDef white fill:#ffffff,stroke:#000,stroke-width:px,color:#000,font-weight:bold +classDef k8s fill:#326ce5,stroke:#fff,stroke-width:1px,color:#fff; +classDef spacewhite fill:#ffffff,stroke:#fff,stroke-width:0px,color:#000 +class A,1,2,3,4,5,6,7 grey +class 0 spacewhite +class tasks,tasks2 white +class id1 k8s +{{}} + +***그림 - GitHub 상에서 PR을 여는 단계*** 1. 이슈가 있는 페이지에서, 오른쪽 상단에 있는 연필 아이콘을 선택한다. 페이지 하단으로 스크롤 하여 **페이지 편집하기** 를 선택할 수도 있다. @@ -89,6 +122,37 @@ git에 익숙하거나, 변경 사항이 몇 줄보다 클 경우, 컴퓨터에 [git](https://git-scm.com/book/en/v2/Getting-Started-Installing-Git)이 설치되어 있는지 확인한다. git UI 애플리케이션을 사용할 수도 있다. +아래 그림은 로컬 포크에서 작업할 때의 단계를 나타낸다. 상세 사항도 소개되어 있다. + + + + +{{< mermaid >}} +flowchart LR +1[K8s/website
저장소 포크하기] --> 2[로컬 클론 생성
및 upstream 설정] +subgraph changes[당신의 변경사항] +direction TB +S[ ] -.- +3[브랜치 생성
예: my_new_branch] --> 3a[텍스트 편집기로
변경사항 만들기] --> 4["Hugo (localhost:1313)
를 이용하거나
컨테이너 이미지를 빌드하여
변경사항을 로컬에서 미리보기"] +end +subgraph changes2[커밋 / 푸시] +direction TB +T[ ] -.- +5[변경사항 커밋하기] --> 6[커밋을
origin/my_new_branch
로 푸시하기] +end + +2 --> changes --> changes2 + +classDef grey fill:#dddddd,stroke:#ffffff,stroke-width:px,color:#000000, font-size:15px; +classDef white fill:#ffffff,stroke:#000,stroke-width:px,color:#000,font-weight:bold +classDef k8s fill:#326ce5,stroke:#fff,stroke-width:1px,color:#fff; +classDef spacewhite fill:#ffffff,stroke:#fff,stroke-width:0px,color:#000 +class 1,2,3,3a,4,5,6 grey +class S,T spacewhite +class changes,changes2 white +{{}} +***그림 - 로컬 포크에서 변경 사항 작업하기*** + ### kubernetes/website 리포지터리 포크하기 1. [`kubernetes/website`](https://github.com/kubernetes/website/) 리포지터리로 이동한다. @@ -230,7 +294,6 @@ website의 컨테이너 이미지를 만들거나 Hugo를 로컬에서 실행할 1. 로컬에서 이미지를 빌드한다. ```bash - make docker-image # docker 사용(기본값) make container-image @@ -243,7 +306,6 @@ website의 컨테이너 이미지를 만들거나 Hugo를 로컬에서 실행할 2. 로컬에서 `kubernetes-hugo` 이미지를 빌드한 후, 사이트를 빌드하고 서비스한다. ```bash - make docker-serve # docker 사용(기본값) make container-serve @@ -291,6 +353,34 @@ website의 컨테이너 이미지를 만들거나 Hugo를 로컬에서 실행할 ### 포크에서 kubernetes/website로 풀 리퀘스트 열기 {#open-a-pr} +아래 그림은 당신의 포크에서 K8s/website 저장소로 PR을 여는 단계를 보여 준다. 상세 사항은 아래에 등장한다. + + + +{{< mermaid >}} +flowchart LR +subgraph first[ ] +direction TB +1[1. K8s/website 저장소로 이동] --> 2[2. 'New Pull Request' 클릭] +2 --> 3[3. 'Compare across forks' 클릭] +3 --> 4[4. 'head repository' 드롭다운 메뉴에서
당신의 포크 선택] +end +subgraph second [ ] +direction TB +5[5. 'compare' 드롭다운 메뉴에서
당신의 브랜치 선택] --> 6[6. 'Create Pull Request' 클릭] +6 --> 7[7. PR 본문에 상세 설명 기재] +7 --> 8[8. 'Create pull request' 클릭] +end + +first --> second + +classDef grey fill:#dddddd,stroke:#ffffff,stroke-width:px,color:#000000, font-size:15px; +classDef white fill:#ffffff,stroke:#000,stroke-width:px,color:#000,font-weight:bold +class 1,2,3,4,5,6,7,8 grey +class first,second white +{{}} +***그림 - 당신의 포크에서 K8s/website 저장소로 PR을 여는 단계*** + 1. 웹 브라우저에서 [`kubernetes/website`](https://github.com/kubernetes/website/) 리포지터리로 이동한다. 2. **New Pull Request** 를 선택한다. 3. **compare across forks** 를 선택한다. @@ -305,7 +395,7 @@ website의 컨테이너 이미지를 만들거나 Hugo를 로컬에서 실행할 8. **Create pull request** 버튼을 선택한다. - 축하한다! 여러분의 풀 리퀘스트가 [풀 리퀘스트](https://github.com/kubernetes/website/pulls)에 열렸다. +축하한다! 여러분의 풀 리퀘스트가 [풀 리퀘스트](https://github.com/kubernetes/website/pulls)에 열렸다. PR을 연 후, GitHub는 자동 테스트를 실행하고 [Netlify](https://www.netlify.com/)를 사용하여 미리보기를 배포하려고 시도한다. @@ -416,7 +506,6 @@ PR을 연 후, GitHub는 자동 테스트를 실행하고 [Netlify](https://www. 풀 리퀘스트에 더 이상 충돌이 표시되지 않는다. - ### 커밋 스쿼시하기 {{< note >}} @@ -502,8 +591,6 @@ PR에 여러 커밋이 있는 경우, PR을 병합하기 전에 해당 커밋을 느낌을 얻으려면 열린 이슈와 PR을 살펴보자. 이슈나 PR을 제출할 때 가능한 한 상세하게 템플릿의 내용을 작성한다. - - ## {{% heading "whatsnext" %}} diff --git a/content/ko/examples/pods/simple-pod.yaml b/content/ko/examples/pods/simple-pod.yaml new file mode 100644 index 0000000000..0e79d8a3c6 --- /dev/null +++ b/content/ko/examples/pods/simple-pod.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx +spec: + containers: + - name: nginx + image: nginx:1.14.2 + ports: + - containerPort: 80 From 55bcd4ec4be8c683f30ce7ed9879349847cf63ac Mon Sep 17 00:00:00 2001 From: Sejin Kim Date: Sat, 27 Nov 2021 00:01:46 +0900 Subject: [PATCH 069/148] Fix the wrong indent for bullet list --- .../concepts/workloads/controllers/job.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/content/ko/docs/concepts/workloads/controllers/job.md b/content/ko/docs/concepts/workloads/controllers/job.md index 3f1666b940..5f52096b3f 100644 --- a/content/ko/docs/concepts/workloads/controllers/job.md +++ b/content/ko/docs/concepts/workloads/controllers/job.md @@ -144,19 +144,19 @@ kubectl logs $pods 잡으로 실행하기에 적합한 작업 유형은 크게 세 가지가 있다. 1. 비-병렬(Non-parallel) 잡: - - 일반적으로, 파드가 실패하지 않은 한, 하나의 파드만 시작된다. - - 파드가 성공적으로 종료하자마자 즉시 잡이 완료된다. + - 일반적으로, 파드가 실패하지 않은 한, 하나의 파드만 시작된다. + - 파드가 성공적으로 종료하자마자 즉시 잡이 완료된다. 1. *고정적(fixed)인 완료 횟수* 를 가진 병렬 잡: - - `.spec.completions` 에 0이 아닌 양수 값을 지정한다. - - 잡은 전체 작업을 나타내며, `.spec.completions` 성공한 파드가 있을 때 완료된다. - - `.spec.completionMode="Indexed"` 를 사용할 때, 각 파드는 0에서 `.spec.completions-1` 범위 내의 서로 다른 인덱스를 가져온다. + - `.spec.completions` 에 0이 아닌 양수 값을 지정한다. + - 잡은 전체 작업을 나타내며, `.spec.completions` 성공한 파드가 있을 때 완료된다. + - `.spec.completionMode="Indexed"` 를 사용할 때, 각 파드는 0에서 `.spec.completions-1` 범위 내의 서로 다른 인덱스를 가져온다. 1. *작업 큐(queue)* 가 있는 병렬 잡: - - `.spec.completions` 를 지정하지 않고, `.spec.parallelism` 를 기본으로 한다. - - 파드는 각자 또는 외부 서비스 간에 조정을 통해 각각의 작업을 결정해야 한다. 예를 들어 파드는 작업 큐에서 최대 N 개의 항목을 일괄로 가져올(fetch) 수 있다. - - 각 파드는 모든 피어들의 작업이 완료되었는지 여부를 독립적으로 판단할 수 있으며, 결과적으로 전체 잡이 완료되게 한다. - - 잡의 _모든_ 파드가 성공적으로 종료되면, 새로운 파드는 생성되지 않는다. - - 하나 이상의 파드가 성공적으로 종료되고, 모든 파드가 종료되면 잡은 성공적으로 완료된다. - - 성공적으로 종료된 파드가 하나라도 생긴 경우, 다른 파드들은 해당 작업을 지속하지 않아야 하며 어떠한 출력도 작성하면 안 된다. 파드들은 모두 종료되는 과정에 있어야 한다. + - `.spec.completions` 를 지정하지 않고, `.spec.parallelism` 를 기본으로 한다. + - 파드는 각자 또는 외부 서비스 간에 조정을 통해 각각의 작업을 결정해야 한다. 예를 들어 파드는 작업 큐에서 최대 N 개의 항목을 일괄로 가져올(fetch) 수 있다. + - 각 파드는 모든 피어들의 작업이 완료되었는지 여부를 독립적으로 판단할 수 있으며, 결과적으로 전체 잡이 완료되게 한다. + - 잡의 _모든_ 파드가 성공적으로 종료되면, 새로운 파드는 생성되지 않는다. + - 하나 이상의 파드가 성공적으로 종료되고, 모든 파드가 종료되면 잡은 성공적으로 완료된다. + - 성공적으로 종료된 파드가 하나라도 생긴 경우, 다른 파드들은 해당 작업을 지속하지 않아야 하며 어떠한 출력도 작성하면 안 된다. 파드들은 모두 종료되는 과정에 있어야 한다. _비-병렬_ 잡은 `.spec.completions` 와 `.spec.parallelism` 모두를 설정하지 않은 채로 둘 수 있다. 이때 둘 다 설정하지 않은 경우 1이 기본으로 설정된다. From 280229b0ec15a362411694dc3ba1b96dd8380cf4 Mon Sep 17 00:00:00 2001 From: Humble Chirammal Date: Wed, 17 Nov 2021 23:35:44 +0530 Subject: [PATCH 070/148] Add RBD CSI migration section to the storage volumes guide Kubernetes adds the RBD CSI migration functionality via CSI migration translation lib. Ref# kubernetes/kubernetes#95361 This commit add the migration details to volumes.md and feature-gates.md Signed-off-by: Humble Chirammal --- content/en/docs/concepts/storage/volumes.md | 42 ++++++++++++++++--- .../feature-gates.md | 8 ++++ 2 files changed, 45 insertions(+), 5 deletions(-) diff --git a/content/en/docs/concepts/storage/volumes.md b/content/en/docs/concepts/storage/volumes.md index 56694dee66..f0d005722f 100644 --- a/content/en/docs/concepts/storage/volumes.md +++ b/content/en/docs/concepts/storage/volumes.md @@ -956,11 +956,11 @@ GitHub project has [instructions](https://github.com/quobyte/quobyte-csi#quobyte ### rbd An `rbd` volume allows a -[Rados Block Device](https://docs.ceph.com/en/latest/rbd/) (RBD) volume to mount into your -Pod. Unlike `emptyDir`, which is erased when a pod is removed, the contents of -an `rbd` volume are preserved and the volume is unmounted. This -means that a RBD volume can be pre-populated with data, and that data can -be shared between pods. +[Rados Block Device](https://docs.ceph.com/en/latest/rbd/) (RBD) volume to mount +into your Pod. Unlike `emptyDir`, which is erased when a pod is removed, the +contents of an `rbd` volume are preserved and the volume is unmounted. This +means that a RBD volume can be pre-populated with data, and that data can be +shared between pods. {{< note >}} You must have a Ceph installation running before you can use RBD. @@ -975,6 +975,38 @@ Simultaneous writers are not allowed. See the [RBD example](https://github.com/kubernetes/examples/tree/master/volumes/rbd) for more details. +#### RBD CSI migration {#rbd-csi-migration} + +{{< feature-state for_k8s_version="v1.23" state="alpha" >}} + +The `CSIMigration` feature for `RBD`, when enabled, redirects all plugin +operations from the existing in-tree plugin to the `rbd.csi.ceph.com` {{< +glossary_tooltip text="CSI" term_id="csi" >}} driver. In order to use this +feature, the +[Ceph CSI driver](https://github.com/ceph/ceph-csi) +must be installed on the cluster and the `CSIMigration` and `CSIMigrationRBD` +[feature gates](/docs/reference/command-line-tools-reference/feature-gates/) +must be enabled. + +{{< note >}} + +As a Kubernetes cluster operator that administers storage, here are the +prerequisites that you must complete before you attempt migration to the +RBD CSI driver: + +* You must install the Ceph CSI driver (`rbd.csi.ceph.com`), v3.5.0 or above, + into your Kubernetes cluster. +* considering the `clusterID` field is a required parameter for CSI driver for + its operations, but in-tree StorageClass has `monitors` field as a required + parameter, a Kubernetes storage admin has to create a clusterID based on the + monitors hash ( ex:`#echo -n + '' | md5sum`) in the CSI config map and keep the monitors + under this clusterID configuration. +* Also, if the value of `adminId` in the in-tree Storageclass is different from + `admin`, the `adminSecretName` mentioned in the in-tree Storageclass has to be + patched with the base64 value of the `adminId` parameter value, otherwise this + step can be skipped. {{< /note >}} + ### secret A `secret` volume is used to pass sensitive information, such as passwords, to diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 63eba752de..e9befb359c 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -81,6 +81,7 @@ different Kubernetes components. | `CSIMigrationOpenStack` | `false` | Alpha | 1.14 | 1.17 | | `CSIMigrationOpenStack` | `true` | Beta | 1.18 | | | `CSIMigrationvSphere` | `false` | Beta | 1.19 | | +| `CSIMigrationRBD` | `false` | Alpha | 1.23 | | | `CSIStorageCapacity` | `false` | Alpha | 1.19 | 1.20 | | `CSIStorageCapacity` | `true` | Beta | 1.21 | | | `CSIVolumeHealth` | `false` | Alpha | 1.21 | | @@ -622,6 +623,13 @@ Each feature gate is designed for enabling/disabling a specific feature: operations from the GCE-PD in-tree plugin to PD CSI plugin. Supports falling back to in-tree GCE plugin if a node does not have PD CSI plugin installed and configured. Requires CSIMigration feature flag enabled. +- `CSIMigrationRBD`: Enables shims and translation logic to route volume + operations from the RBD in-tree plugin to Ceph RBD CSI plugin. Requires + CSIMigration and CSIMigrationRBD feature flags enabled and Ceph CSI plugin + installed and configured in the cluster. This flag has been deprecated in + favor of the + `InTreePluginRBDUnregister` feature flag which prevents the registration of + in-tree RBD plugin. - `CSIMigrationGCEComplete`: Stops registering the GCE-PD in-tree plugin in kubelet and volume controllers and enables shims and translation logic to route volume operations from the GCE-PD in-tree plugin to PD CSI plugin. From c0c3d040f85248d2be8635b8d8d1e1c26208eb7c Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 15 Sep 2021 20:52:45 +0100 Subject: [PATCH 071/148] Add node problem detector to add-ons --- content/en/docs/concepts/cluster-administration/addons.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/en/docs/concepts/cluster-administration/addons.md b/content/en/docs/concepts/cluster-administration/addons.md index f2743064f2..81f57466a9 100644 --- a/content/en/docs/concepts/cluster-administration/addons.md +++ b/content/en/docs/concepts/cluster-administration/addons.md @@ -45,6 +45,11 @@ This page lists some of the available add-ons and links to their respective inst ## Infrastructure * [KubeVirt](https://kubevirt.io/user-guide/#/installation/installation) is an add-on to run virtual machines on Kubernetes. Usually run on bare-metal clusters. +* The + [node problem detector](https://github.com/kubernetes/node-problem-detector) + runs on Linux nodes and reports system issues as either + [Events](/docs/reference/kubernetes-api/cluster-resources/event-v1/) or + [Node conditions](/docs/concepts/architecture/nodes/#condition). ## Legacy Add-ons From b8a9baeb89fde4b9670cf8c3c664afc9f5cf6fbd Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Sun, 28 Nov 2021 19:05:16 +0000 Subject: [PATCH 072/148] De-emphasize scheduling priorities Scheduling priorities are deprecated, so: - move the page later in the parent topic - hint that it's not a priority in the sitemap for the live docs --- content/en/docs/reference/scheduling/policies.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/en/docs/reference/scheduling/policies.md b/content/en/docs/reference/scheduling/policies.md index d9a6d92cfe..3e2e554fc9 100644 --- a/content/en/docs/reference/scheduling/policies.md +++ b/content/en/docs/reference/scheduling/policies.md @@ -1,7 +1,8 @@ --- title: Scheduling Policies content_type: concept -weight: 10 +sitemap: + priority: 0.2 # Scheduling priorities are deprecated --- From 6cb934ba19173e227e6c1d63dc3e58da2d698005 Mon Sep 17 00:00:00 2001 From: gbarceloPIB <77483241+gbarceloPIB@users.noreply.github.com> Date: Mon, 29 Nov 2021 13:59:13 +0100 Subject: [PATCH 073/148] Update pod-lifecycle.md --- content/en/docs/concepts/workloads/pods/pod-lifecycle.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/workloads/pods/pod-lifecycle.md b/content/en/docs/concepts/workloads/pods/pod-lifecycle.md index 75e4a0ba34..b3a0d81337 100644 --- a/content/en/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/en/docs/concepts/workloads/pods/pod-lifecycle.md @@ -159,7 +159,7 @@ through which the Pod has or has not passed: * `PodScheduled`: the Pod has been scheduled to a node. * `ContainersReady`: all containers in the Pod are ready. * `Initialized`: all [init containers](/docs/concepts/workloads/pods/init-containers/) - have started successfully. + have completed successfully. * `Ready`: the Pod is able to serve requests and should be added to the load balancing pools of all matching Services. From 9ea79fa719f12510178898af5835ad46485ae3fe Mon Sep 17 00:00:00 2001 From: ravisantoshgudimetla Date: Mon, 29 Nov 2021 09:06:51 -0500 Subject: [PATCH 074/148] [docs]: Update existing fields in STS spec --- .../concepts/workloads/controllers/statefulset.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/statefulset.md b/content/en/docs/concepts/workloads/controllers/statefulset.md index 4f12bb1796..5197fe4f20 100644 --- a/content/en/docs/concepts/workloads/controllers/statefulset.md +++ b/content/en/docs/concepts/workloads/controllers/statefulset.md @@ -113,6 +113,14 @@ In the above example: The name of a StatefulSet object must be a valid [DNS subdomain name](/docs/concepts/overview/working-with-objects/names#dns-subdomain-names). +### Pod Selector + +You must set the `.spec.selector` field of a StatefulSet to match the labels of its `.spec.template.metadata.labels`. In 1.8 and later versions, failing to specify a matching Pod Selector will result in a validation error during StatefulSet creation. + +### Volume Claim Templates + +You can set the `.spec.volumeClaimTemplates` which can provide stable storage using [PersistentVolumes](/docs/concepts/storage/persistent-volumes/) provisioned by a PersistentVolume Provisioner. + ### Minimum ready seconds @@ -124,10 +132,6 @@ Please note that this feature is beta and enabled by default. Please opt out by want this feature to be enabled. This field defaults to 0 (the Pod will be considered available as soon as it is ready). To learn more about when a Pod is considered ready, see [Container Probes](/docs/concepts/workloads/pods/pod-lifecycle/#container-probes). -## Pod Selector - -You must set the `.spec.selector` field of a StatefulSet to match the labels of its `.spec.template.metadata.labels`. Prior to Kubernetes 1.8, the `.spec.selector` field was defaulted when omitted. In 1.8 and later versions, failing to specify a matching Pod Selector will result in a validation error during StatefulSet creation. - ## Pod Identity StatefulSet Pods have a unique identity that is comprised of an ordinal, a From e6a9fd269e762c4b1ca638b207cfb7704ad37d60 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Mon, 29 Nov 2021 09:46:22 -0500 Subject: [PATCH 075/148] Update webhook anchor --- content/en/docs/concepts/security/pod-security-admission.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/security/pod-security-admission.md b/content/en/docs/concepts/security/pod-security-admission.md index 933dc62940..5969d2bb5d 100644 --- a/content/en/docs/concepts/security/pod-security-admission.md +++ b/content/en/docs/concepts/security/pod-security-admission.md @@ -44,7 +44,7 @@ is an Alpha feature and must be enabled in `kube-apiserver` in order to use the --feature-gates="...,PodSecurity=true" ``` -## Alternative: installing the `PodSecurity` admission webhook +## Alternative: installing the `PodSecurity` admission webhook {#webhook} For environments where the built-in `PodSecurity` admission plugin cannot be used, either because the cluster is older than v1.22, or the `PodSecurity` feature cannot be enabled, From a9641b6ccd33f8899eb628326324d97f3dfd2951 Mon Sep 17 00:00:00 2001 From: Joe Betz Date: Mon, 15 Nov 2021 15:44:54 -0500 Subject: [PATCH 076/148] Add stub for validatiton rule documentation --- .../custom-resource-definitions.md | 83 ++++++++++++++++++- 1 file changed, 81 insertions(+), 2 deletions(-) diff --git a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md index cd2d0fb103..538bc60821 100644 --- a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md +++ b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md @@ -556,8 +556,9 @@ deleted by Kubernetes. ### Validation Custom resources are validated via -[OpenAPI v3 schemas](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.0.md#schemaObject) -and you can add additional validation using +[OpenAPI v3 schemas](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.0.md#schemaObject), +by x-kubernetes-validation-rules when the [Validation Rules feature](#validation-rules) is enabled, and you +can add additional validation using [admission webhooks](/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook). Additionally, the following restrictions are applied to the schema: @@ -577,6 +578,11 @@ Additionally, the following restrictions are applied to the schema: - The field `additionalProperties` cannot be set to `false`. - The field `additionalProperties` is mutually exclusive with `properties`. +The `x-kubernetes-validation-rules` extension can be use to validate custom resources using [Common +Expression Language (CEL)](https://github.com/google/cel-spec) expressions when the [Validation +Rules feature](#validation-rules) feature is enabled and the CustomResourceDefinition schema is a +[structural schema](#specifying-a-structural-schema). + The `default` field can be set when the [Defaulting feature](#defaulting) is enabled, which is the case with `apiextensions.k8s.io/v1` CustomResourceDefinitions. Defaulting is in GA since 1.17 (beta since 1.16 with the `CustomResourceDefaulting` @@ -693,6 +699,79 @@ kubectl apply -f my-crontab.yaml crontab "my-new-cron-object" created ``` +## Validation rules + +{{< feature-state state="alpha" for_k8s_version="v1.23" >}} + +Validation rules are in alpha since 1.23 and validate custom resources when the +`CustomResourceValidationExpressions` [feature +gate](/docs/reference/command-line-tools-reference/feature-gates/) enabled and the schema is a +[structural schema](#specifying-a-structural-schema). + +Validation rules use the [Common Expression Language (CEL)](https://github.com/google/cel-spec) +expression language to validate custom resource values. Validation rules are included in +CustomResourceDefinition schemas using the `x-kubernetes-validation-rules` extension. + +For example: + +```yaml + ... + openAPIV3Schema: + type: object + properties: + spec: + type: object + x-kubernetes-validation-rules: + - rule: "self.minReplicas <= self.replicas" + - rule: "self.replicas <= self.maxReplicas" + properties: + ... + minReplicas: + type: integer + replicas: + type: integer + maxReplicas: + type: integer +``` + +will reject an request to create this custom resource: + +```yaml +apiVersion: "stable.example.com/v1" +kind: CronTab +metadata: + name: my-new-cron-object +spec: + minReplicas: 0 + replicas: 20 + maxReplicas: 10 +``` + +with the response: + +``` +The CronTab "my-new-cron-object" is invalid: +* spec: Invalid value: map[string]interface {}{"minReplicas": 0, "replicas":20, "maxReplicas": 10}: failed rule: self.minReplicas <= self.replicas && self.replicas <= self.maxReplicas +``` + +TODO: (using text from types_jsonprops.go and KEP were applicable, but using "full" multi-line examples that include both the schema and the custom resource data) +- Explain that rules are compiled when CRDs are created/updated. Show full example including compilation error output examples. +- Explain scope, self, and how objects, maps and arrays are accessed. Show full examples. + - Must show: 'self.field' selection, has() field presence checking, 'self[key]' map access and + 'key in self' map containment, 'self[i]' list access, all/exists/filter and how they apply to + maps and lists. Show more of the functions than covered in types_jsonprops.go. Provide links to + functions and macros in spec. Provide link to strings extension library in cel-go that we have + enabled. Explain that this is an extension library. +- Include examples table from KEP? Probably just past it in and add context. +- Explain access to type and object meta. +- Explain openapiv3 -> CEL declarations type mapping and include the table from the KEP. Link to OpenAPIv3 and CEL documentation about types. +- Explain int-or-string, preserve-unknown, nullable, embedded. Provide some short examples. +- Explain escaping using a table. Provide some short examples. Provide guidance on how to name + properties (both in this section of this document and elsewhere in this document where property + names are introduced/discussed). +- Explain + and == for list maps and list sets (table? whatever looks better) +- DO NOT: provide all the motivation and design rationale from the KEP. + ### Defaulting {{< note >}} From 9d69f673999a171a5660b0177792808c4e3ee6f1 Mon Sep 17 00:00:00 2001 From: cici37 Date: Thu, 18 Nov 2021 13:27:39 -0800 Subject: [PATCH 077/148] Add feature gate `CustomResourceValidationExpressions` into /command-line-tools-reference/feature-gates.md --- .../reference/command-line-tools-reference/feature-gates.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index d369723ec8..000fac1e82 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -93,6 +93,7 @@ different Kubernetes components. | `ControllerManagerLeaderMigration` | `false` | Alpha | 1.21 | 1.21 | | `ControllerManagerLeaderMigration` | `true` | Beta | 1.22 | | | `CustomCPUCFSQuotaPeriod` | `false` | Alpha | 1.12 | | +| `CustomResourceValidationExpressions` | `false` | Alpha | 1.23 | | | `DaemonSetUpdateSurge` | `false` | Alpha | 1.21 | 1.21 | | `DaemonSetUpdateSurge` | `true` | Beta | 1.22 | | | `DefaultPodTopologySpread` | `false` | Alpha | 1.19 | 1.19 | @@ -684,6 +685,7 @@ Each feature gate is designed for enabling/disabling a specific feature: version 1 of the same controller is selected. - `CustomCPUCFSQuotaPeriod`: Enable nodes to change `cpuCFSQuotaPeriod` in [kubelet config](/docs/tasks/administer-cluster/kubelet-config-file/). +- `CustomResourceValidationExpressions`: Enable expression language validation in CRD which will validate customer resource based on validation rules written in `x-kubernetes-validations` extension. - `CustomPodDNS`: Enable customizing the DNS settings for a Pod using its `dnsConfig` property. Check [Pod's DNS Config](/docs/concepts/services-networking/dns-pod-service/#pods-dns-config) for more details. From cd1726aa1091d53c7fe7f6f59c0469761b0986a1 Mon Sep 17 00:00:00 2001 From: cici37 Date: Wed, 17 Nov 2021 19:49:08 -0800 Subject: [PATCH 078/148] Adding details on CEL validation for CRD. --- .../custom-resource-definitions.md | 280 ++++++++++++++++-- 1 file changed, 252 insertions(+), 28 deletions(-) diff --git a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md index 538bc60821..e4c5e39915 100644 --- a/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md +++ b/content/en/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions.md @@ -557,7 +557,7 @@ deleted by Kubernetes. Custom resources are validated via [OpenAPI v3 schemas](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.0.md#schemaObject), -by x-kubernetes-validation-rules when the [Validation Rules feature](#validation-rules) is enabled, and you +by x-kubernetes-validations when the [Validation Rules feature](#validation-rules) is enabled, and you can add additional validation using [admission webhooks](/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook). @@ -578,9 +578,9 @@ Additionally, the following restrictions are applied to the schema: - The field `additionalProperties` cannot be set to `false`. - The field `additionalProperties` is mutually exclusive with `properties`. -The `x-kubernetes-validation-rules` extension can be use to validate custom resources using [Common +The `x-kubernetes-validations` extension can be used to validate custom resources using [Common Expression Language (CEL)](https://github.com/google/cel-spec) expressions when the [Validation -Rules feature](#validation-rules) feature is enabled and the CustomResourceDefinition schema is a +rules](#validation-rules) feature is enabled and the CustomResourceDefinition schema is a [structural schema](#specifying-a-structural-schema). The `default` field can be set when the [Defaulting feature](#defaulting) is enabled, @@ -705,12 +705,16 @@ crontab "my-new-cron-object" created Validation rules are in alpha since 1.23 and validate custom resources when the `CustomResourceValidationExpressions` [feature -gate](/docs/reference/command-line-tools-reference/feature-gates/) enabled and the schema is a +gate](/docs/reference/command-line-tools-reference/feature-gates/) is enabled. +This feature is only available if the schema is a [structural schema](#specifying-a-structural-schema). Validation rules use the [Common Expression Language (CEL)](https://github.com/google/cel-spec) -expression language to validate custom resource values. Validation rules are included in -CustomResourceDefinition schemas using the `x-kubernetes-validation-rules` extension. +to validate custom resource values. Validation rules are included in +CustomResourceDefinition schemas using the `x-kubernetes-validations` extension. + +The Rule is scoped to the location of the `x-kubernetes-validations` extension in the schema. +And `self` variable in the CEL expression is bound to the scoped value. For example: @@ -721,9 +725,11 @@ For example: properties: spec: type: object - x-kubernetes-validation-rules: - - rule: "self.minReplicas <= self.replicas" - - rule: "self.replicas <= self.maxReplicas" + x-kubernetes-validation-rules: + - rule: "self.minReplicas <= self.replicas" + message: "replicas should be greater than or equal to minReplicas." + - rule: "self.replicas <= self.maxReplicas" + message: "replicas should be smaller than or equal to maxReplicas." properties: ... minReplicas: @@ -732,9 +738,13 @@ For example: type: integer maxReplicas: type: integer + required: + - minReplicas + - replicas + - maxReplicas ``` -will reject an request to create this custom resource: +will reject a request to create this custom resource: ```yaml apiVersion: "stable.example.com/v1" @@ -751,26 +761,240 @@ with the response: ``` The CronTab "my-new-cron-object" is invalid: -* spec: Invalid value: map[string]interface {}{"minReplicas": 0, "replicas":20, "maxReplicas": 10}: failed rule: self.minReplicas <= self.replicas && self.replicas <= self.maxReplicas +* spec: Invalid value: map[string]interface {}{"maxReplicas":10, "minReplicas":0, "replicas":20}: replicas should be smaller than or equal to maxReplicas. ``` -TODO: (using text from types_jsonprops.go and KEP were applicable, but using "full" multi-line examples that include both the schema and the custom resource data) -- Explain that rules are compiled when CRDs are created/updated. Show full example including compilation error output examples. -- Explain scope, self, and how objects, maps and arrays are accessed. Show full examples. - - Must show: 'self.field' selection, has() field presence checking, 'self[key]' map access and - 'key in self' map containment, 'self[i]' list access, all/exists/filter and how they apply to - maps and lists. Show more of the functions than covered in types_jsonprops.go. Provide links to - functions and macros in spec. Provide link to strings extension library in cel-go that we have - enabled. Explain that this is an extension library. -- Include examples table from KEP? Probably just past it in and add context. -- Explain access to type and object meta. -- Explain openapiv3 -> CEL declarations type mapping and include the table from the KEP. Link to OpenAPIv3 and CEL documentation about types. -- Explain int-or-string, preserve-unknown, nullable, embedded. Provide some short examples. -- Explain escaping using a table. Provide some short examples. Provide guidance on how to name - properties (both in this section of this document and elsewhere in this document where property - names are introduced/discussed). -- Explain + and == for list maps and list sets (table? whatever looks better) -- DO NOT: provide all the motivation and design rationale from the KEP. +`x-kubernetes-validations` could have multiple rules. + +The `rule` under `x-kubernetes-validations` represents the expression which will be evaluated by CEL. + +The `message` represents the message displayed when validation fails. If message is unset, the above response would be: +``` +The CronTab "my-new-cron-object" is invalid: +* spec: Invalid value: map[string]interface {}{"maxReplicas":10, "minReplicas":0, "replicas":20}: failed rule: self.replicas <= self.maxReplicas +``` + +Validation rules are compiled when CRDs are created/updated. +The request of CRDs create/update will fail if compilation of validation rules fail. +Compilation process includes type checking as well. + +The compilation failure: +- `no_matching_overload`: this function has no overload for the types of the arguments. + + e.g. Rule like `self == true` against a field of integer type will get error: + ``` + Invalid value: apiextensions.ValidationRule{Rule:"self == true", Message:""}: compilation failed: ERROR: \:1:6: found no matching overload for '_==_' applied to '(int, bool)' + ``` + +- `no_such_field`: does not contain the desired field. + + e.g. Rule like `self.nonExistingField > 0` against a non-existing field will return the error: + ``` + Invalid value: apiextensions.ValidationRule{Rule:"self.nonExistingField > 0", Message:""}: compilation failed: ERROR: \:1:5: undefined field 'nonExistingField' + ``` + +- `invalid argument`: invalid argument to macros. + + e.g. Rule like `has(self)` will return error: + ``` + Invalid value: apiextensions.ValidationRule{Rule:"has(self)", Message:""}: compilation failed: ERROR: :1:4: invalid argument to has() macro + ``` + + +Validation Rules Examples: + +| Rule | Purpose | +| ---------------- | ------------ | +| `self.minReplicas <= self.replicas && self.replicas <= self.maxReplicas` | Validate that the three fields defining replicas are ordered appropriately | +| `'Available' in self.stateCounts` | Validate that an entry with the 'Available' key exists in a map | +| `(size(self.list1) == 0) != (size(self.list2) == 0)` | Validate that one of two lists is non-empty, but not both | +| !('MY_KEY' in self.map1) || self['MY_KEY'].matches('^[a-zA-Z]*$') | Validate the value of a map for a specific key, if it is in the map | +| `self.envars.filter(e, e.name = 'MY_ENV').all(e, e.value.matches('^[a-zA-Z]*$')` | Validate the 'value' field of a listMap entry where key field 'name' is 'MY_ENV' | +| `has(self.expired) && self.created + self.ttl < self.expired` | Validate that 'expired' date is after a 'create' date plus a 'ttl' duration | +| `self.health.startsWith('ok')` | Validate a 'health' string field has the prefix 'ok' | +| `self.widgets.exists(w, w.key == 'x' && w.foo < 10)` | Validate that the 'foo' property of a listMap item with a key 'x' is less than 10 | +| `type(self) == string ? self == '100%' : self == 1000` | Validate an int-or-string field for both the the int and string cases | +| `self.metadata.name.startsWith(self.prefix)` | Validate that an object's name has the prefix of another field value | +| `self.set1.all(e, !(e in self.set2))` | Validate that two listSets are disjoint | +| `size(self.names) == size(self.details) && self.names.all(n, n in self.details)` | Validate the 'details' map is keyed by the items in the 'names' listSet | + +Xref: [Supported evaluation on CEL](https://github.com/google/cel-spec/blob/v0.6.0/doc/langdef.md#evaluation) + + +- If the Rule is scoped to the root of a resource, it may make field selection into any fields + declared in the OpenAPIv3 schema of the CRD as well as `apiVersion`, `kind`, `metadata.name` and + `metadata.generateName`. This includes selection of fields in both the `spec` and `status` in the + same expression: + ```yaml + ... + openAPIV3Schema: + type: object + x-kubernetes-validation-rules: + - rule: "self.status.availableReplicas >= self.spec.minReplicas" + properties: + spec: + type: object + properties: + minReplicas: + type: integer + ... + status: + type: object + properties: + availableReplicas: + type: integer + ``` + +- If the Rule is scoped to an object with properties, the accessible properties of the object are field selectable + via `self.field` and field presence can be checked via `has(self.field)`. Null valued fields are treated as + absent fields in CEL expressions. + + ```yaml + ... + openAPIV3Schema: + type: object + properties: + spec: + type: object + x-kubernetes-validation-rules: + - rule: "has(self.foo)" + properties: + ... + foo: + type: integer + ``` + +- If the Rule is scoped to an object with additionalProperties (i.e. a map) the value of the map + are accessible via `self[mapKey]`, map containment can be checked via `mapKey in self` and all entries of the map + are accessible via CEL macros and functions such as `self.all(...)`. + ```yaml + ... + openAPIV3Schema: + type: object + properties: + spec: + type: object + x-kubernetes-validation-rules: + - rule: "self['xyz'].foo > 0" + additionalProperties: + ... + type: object + properties: + foo: + type: integer + ``` + +- If the Rule is scoped to an array, the elements of the array are accessible via `self[i]` and also by macros and + functions. + ```yaml + ... + openAPIV3Schema: + type: object + properties: + ... + foo: + type: array + x-kubernetes-validation-rules: + - rule: "size(self) == 1" + items: + type: string + ``` + +- If the Rule is scoped to a scalar, `self` is bound to the scalar value. + ```yaml + ... + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + ... + foo: + type: integer + x-kubernetes-validation-rules: + - rule: "self > 0" + ``` +Examples: + +|type of the field rule scoped to | Rule example | +| -----------------------| -----------------------| +| root object | `self.status.actual <= self.spec.maxDesired`| +| map of objects | `self.components['Widget'].priority < 10`| +| list of integers | `self.values.all(value, value >= 0 && value < 100)`| +| string | `self.startsWith('kube')`| + + +The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the +object and from any x-kubernetes-embedded-resource annotated objects. No other metadata properties are accessible. + +Unknown data preserved in custom resources via `x-kubernetes-preserve-unknown-fields` is not accessible in CEL + expressions. This includes: + - Unknown field values that are preserved by object schemas with x-kubernetes-preserve-unknown-fields. + - Object properties where the property schema is of an "unknown type". An "unknown type" is recursively defined as: + - A schema with no type and x-kubernetes-preserve-unknown-fields set to true + - An array where the items schema is of an "unknown type" + - An object where the additionalProperties schema is of an "unknown type" + + +Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. +Accessible property names are escaped according to the following rules when accessed in the expression: + +| escape sequence | property name equivalent | +| ----------------------- | -----------------------| +| `__underscores__` | `__` | +| `__dot__` | `.` | +|`__dash__` | `-` | +| `__slash__` | `/` | +| `__{keyword}__` | [CEL RESERVED keyword](https://github.com/google/cel-spec/blob/v0.6.0/doc/langdef.md#syntax) | + +Note: CEL RESERVED keyword needs to match the exact property name to be escaped (e.g. int in the word sprint would not be escaped). + +Examples on escaping: + +|property name | rule with escaped property name | +| ----------------| ----------------------- | +| namespace | `self.__namespace__ > 0` | +| x-prop | `self.x__dash__prop > 0` | +| redact__d | `self.redact__underscores__d > 0` | +| string | `self.startsWith('kube')` | + + +Equality on arrays with `x-kubernetes-list-type` of `set` or `map` ignores element order, i.e. [1, 2] == [2, 1]. +Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type: + - `set`: `X + Y` performs a union where the array positions of all elements in `X` are preserved and + non-intersecting elements in `Y` are appended, retaining their partial order. + - `map`: `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values + are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with + non-intersecting keys are appended, retaining their partial order. + + +Here is the declarations type mapping between OpenAPIv3 and CEL type: + +| OpenAPIv3 type | CEL type | +| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | +| 'object' with Properties | object / "message type" | +| 'object' with AdditionalProperties | map | +| 'object' with x-kubernetes-embedded-type | object / "message type", 'apiVersion', 'kind', 'metadata.name' and 'metadata.generateName' are implicitly included in schema | +| 'object' with x-kubernetes-preserve-unknown-fields | object / "message type", unknown fields are NOT accessible in CEL expression | +| x-kubernetes-int-or-string | dynamic object that is either an int or a string, `type(value)` can be used to check the type | +| 'array | list | +| 'array' with x-kubernetes-list-type=map | list with map based Equality & unique key guarantees | +| 'array' with x-kubernetes-list-type=set | list with set based Equality & unique entry guarantees | +| 'boolean' | boolean | +| 'number' (all formats) | double | +| 'integer' (all formats) | int (64) | +| 'null' | null_type | +| 'string' | string | +| 'string' with format=byte (base64 encoded) | bytes | +| 'string' with format=date | timestamp (google.protobuf.Timestamp) | +| 'string' with format=datetime | timestamp (google.protobuf.Timestamp) | +| 'string' with format=duration | duration (google.protobuf.Duration) | + +xref: [CEL types](https://github.com/google/cel-spec/blob/v0.6.0/doc/langdef.md#values), [OpenAPI +types](https://swagger.io/specification/#data-types), [Kubernetes Structural Schemas](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#specifying-a-structural-schema). + + ### Defaulting From 02f63b966140f1d8ba37a17679351190049dd65d Mon Sep 17 00:00:00 2001 From: Oksana Naumov Date: Thu, 11 Nov 2021 12:01:08 -0800 Subject: [PATCH 079/148] CSI migration of Portworx is in alpha --- content/en/docs/concepts/storage/volumes.md | 10 ++++++++++ .../command-line-tools-reference/feature-gates.md | 4 ++++ 2 files changed, 14 insertions(+) diff --git a/content/en/docs/concepts/storage/volumes.md b/content/en/docs/concepts/storage/volumes.md index eb15504cde..792ceae69b 100644 --- a/content/en/docs/concepts/storage/volumes.md +++ b/content/en/docs/concepts/storage/volumes.md @@ -1050,6 +1050,16 @@ but new volumes created by the vSphere CSI driver will not be honoring these par To turn off the `vsphereVolume` plugin from being loaded by the controller manager and the kubelet, you need to set `InTreePluginvSphereUnregister` feature flag to `true`. You must install a `csi.vsphere.vmware.com` {{< glossary_tooltip text="CSI" term_id="csi" >}} driver on all worker nodes. +#### Portworx CSI migration +{{< feature-state for_k8s_version="v1.23" state="alpha" >}} + +The `CSIMigration` feature for Portworx has been added but disabled by default in Kubernetes 1.23 since it's in alpha state. +It redirects all plugin operations from the existing in-tree plugin to the +`pxd.portworx.com` Container Storage Interface (CSI) Driver. +[Portworx CSI Driver](https://docs.portworx.com/portworx-install-with-kubernetes/storage-operations/csi/) +must be installed on the cluster. +To enable the feature, set `CSIMigrationPortworx=true` in kube-controller-manager and kubelet. + ## Using subPath {#using-subpath} Sometimes, it is useful to share one volume for multiple uses in a single pod. diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index ef806fdb6a..55b4316b08 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -84,6 +84,7 @@ different Kubernetes components. | `CSIMigrationOpenStack` | `false` | Alpha | 1.14 | 1.17 | | `CSIMigrationOpenStack` | `true` | Beta | 1.18 | | | `CSIMigrationvSphere` | `false` | Beta | 1.19 | | +| `CSIMigrationPortworx` | `false` | Alpha | 1.23 | | | `CSIMigrationRBD` | `false` | Alpha | 1.23 | | | `CSIStorageCapacity` | `false` | Alpha | 1.19 | 1.20 | | `CSIStorageCapacity` | `true` | Beta | 1.21 | | @@ -664,6 +665,9 @@ Each feature gate is designed for enabling/disabling a specific feature: CSIMigrationvSphere feature flags enabled and vSphere CSI plugin installed and configured on all nodes in the cluster. This flag has been deprecated in favor of the `InTreePluginvSphereUnregister` feature flag which prevents the registration of in-tree vsphere plugin. +- `CSIMigrationPortworx`: Enables shims and translation logic to route volume operations + from the Portworx in-tree plugin to Portworx CSI plugin. + Requires Portworx CSI driver to be installed and configured in the cluster, and feature gate set `CSIMigrationPortworx=true` in kube-controller-manager and kubelet configs. - `CSINodeInfo`: Enable all logic related to the CSINodeInfo API object in csi.storage.k8s.io. - `CSIPersistentVolume`: Enable discovering and mounting volumes provisioned through a [CSI (Container Storage Interface)](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/container-storage-interface.md) From 2ebfcfea1a96f6dec581caaa6affc534eb5c0bd8 Mon Sep 17 00:00:00 2001 From: Hemant Kumar Date: Thu, 18 Nov 2021 12:14:44 -0500 Subject: [PATCH 080/148] Update docs for ConfigurableFSGroupPolicy --- .../reference/command-line-tools-reference/feature-gates.md | 1 + .../en/docs/tasks/configure-pod-container/security-context.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 63eba752de..9926e67e59 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -222,6 +222,7 @@ different Kubernetes components. | `BoundServiceAccountTokenVolume` | `false` | Alpha | 1.13 | 1.20 | | `BoundServiceAccountTokenVolume` | `true` | Beta | 1.21 | 1.21 | | `BoundServiceAccountTokenVolume` | `true` | GA | 1.22 | - | +| `ConfigurableFSGroupPolicy` | `true` | GA | 1.23 | | | `CRIContainerLogRotation` | `false` | Alpha | 1.10 | 1.10 | | `CRIContainerLogRotation` | `true` | Beta | 1.11 | 1.20 | | `CRIContainerLogRotation` | `true` | GA | 1.21 | - | diff --git a/content/en/docs/tasks/configure-pod-container/security-context.md b/content/en/docs/tasks/configure-pod-container/security-context.md index 56bcc0f3f9..ef78e39b6a 100644 --- a/content/en/docs/tasks/configure-pod-container/security-context.md +++ b/content/en/docs/tasks/configure-pod-container/security-context.md @@ -149,7 +149,7 @@ exit ## Configure volume permission and ownership change policy for Pods -{{< feature-state for_k8s_version="v1.20" state="beta" >}} +{{< feature-state for_k8s_version="v1.23" state="stable" >}} By default, Kubernetes recursively changes ownership and permissions for the contents of each volume to match the `fsGroup` specified in a Pod's `securityContext` when that volume is From 37532e231acc1d89a1e39de25a2684d655637efb Mon Sep 17 00:00:00 2001 From: Hemant Kumar Date: Thu, 18 Nov 2021 12:11:21 -0500 Subject: [PATCH 081/148] Add docs for RecoverVolumeExpansionFailure feature --- .../concepts/storage/persistent-volumes.md | 29 +++++++++++++++++++ .../admission-controllers.md | 3 +- .../feature-gates.md | 3 ++ 3 files changed, 34 insertions(+), 1 deletion(-) diff --git a/content/en/docs/concepts/storage/persistent-volumes.md b/content/en/docs/concepts/storage/persistent-volumes.md index f2093073df..7fae64251f 100644 --- a/content/en/docs/concepts/storage/persistent-volumes.md +++ b/content/en/docs/concepts/storage/persistent-volumes.md @@ -299,6 +299,11 @@ Expanding EBS volumes is a time-consuming operation. Also, there is a per-volume #### Recovering from Failure when Expanding Volumes +If a user specifies a new size that is too big to be satisfied by underlying storage system, expansion of PVC will be continuously retried until user or cluster administrator takes some action. This can be undesirable and hence Kubernetes provides following methods of recovering from such failures. + +{{< tabs name="recovery_methods" >}} +{{% tab name="Manually with Cluster Administrator access" %}} + If expanding underlying storage fails, the cluster administrator can manually recover the Persistent Volume Claim (PVC) state and cancel the resize requests. Otherwise, the resize requests are continuously retried by the controller without administrator intervention. 1. Mark the PersistentVolume(PV) that is bound to the PersistentVolumeClaim(PVC) with `Retain` reclaim policy. @@ -307,6 +312,30 @@ If expanding underlying storage fails, the cluster administrator can manually re 4. Re-create the PVC with smaller size than PV and set `volumeName` field of the PVC to the name of the PV. This should bind new PVC to existing PV. 5. Don't forget to restore the reclaim policy of the PV. +{{% /tab %}} +{{% tab name="By requesting expansion to smaller size" %}} +{{% feature-state for_k8s_version="v1.23" state="alpha" %}} + +{{< note >}} +Recovery from failing PVC expansion by users is available as an alpha feature since Kubernetes 1.23. The `RecoverVolumeExpansionFailure` feature must be enabled for this feature to work. Refer to the [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) documentation for more information. +{{< /note >}} + +If the feature gates `ExpandPersistentVolumes` and `RecoverVolumeExpansionFailure` are both +enabled in your cluster, and expansion has failed for a PVC, you can retry expansion with a +smaller size than the previously requested value. To request a new expansion attempt with a +smaller proposed size, edit `.spec.resources` for that PVC and choose a value that is less than the +value you previously tried. +This is useful if expansion to a higher value did not succeed because of capacity constraint. +If that has happened, or you suspect that it might have, you can retry expansion by specifying a +size that is within the capacity limits of underlying storage provider. You can monitor status of resize operation by watching `.status.resizeStatus` and events on the PVC. + +Note that, +although you can a specify a lower amount of storage than what was requested previously, +the new value must still be higher than `.status.capacity`. +Kubernetes does not support shrinking a PVC to less than its current size. +{{% /tab %}} +{{% /tabs %}} + ## Types of Persistent Volumes diff --git a/content/en/docs/reference/access-authn-authz/admission-controllers.md b/content/en/docs/reference/access-authn-authz/admission-controllers.md index 7957ff7a4f..5e5d143ccf 100644 --- a/content/en/docs/reference/access-authn-authz/admission-controllers.md +++ b/content/en/docs/reference/access-authn-authz/admission-controllers.md @@ -583,7 +583,8 @@ subresource of the referenced *owner* can change it. This admission controller implements additional validations for checking incoming `PersistentVolumeClaim` resize requests. {{< note >}} -Support for volume resizing is available as an alpha feature. Admins must set the feature gate `ExpandPersistentVolumes` +Support for volume resizing is available as a beta feature. As a cluster administrator, +you must ensure that the feature gate `ExpandPersistentVolumes` is set to `true` to enable resizing. {{< /note >}} diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 63eba752de..05e55ab486 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -165,6 +165,7 @@ different Kubernetes components. | `ProxyTerminatingEndpoints` | `false` | Alpha | 1.22 | | | `QOSReserved` | `false` | Alpha | 1.11 | | | `ReadWriteOncePod` | `false` | Alpha | 1.22 | | +| `RecoverVolumeExpansionFailure` | `false` | Alpha | 1.23 | | | `RemainingItemCount` | `false` | Alpha | 1.15 | 1.15 | | `RemainingItemCount` | `true` | Beta | 1.16 | | | `RemoveSelfLink` | `false` | Alpha | 1.16 | 1.19 | @@ -889,6 +890,8 @@ Each feature gate is designed for enabling/disabling a specific feature: (memory only for now). - `ReadWriteOncePod`: Enables the usage of `ReadWriteOncePod` PersistentVolume access mode. +- `RecoverVolumeExpansionFailure`: Enables users to edit their PVCs to smaller sizes so as they can recover from previously issued + volume expansion failures. See [enhancement proposal](https://github.com/kubernetes/enhancements/blob/master/keps/sig-storage/1790-recover-resize-failure/README.md) for more details. - `RemainingItemCount`: Allow the API servers to show a count of remaining items in the response to a [chunking list request](/docs/reference/using-api/api-concepts/#retrieving-large-results-sets-in-chunks). From 014f73f326689c433b34660be914913e67306556 Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Mon, 29 Nov 2021 15:41:43 -0600 Subject: [PATCH 082/148] Clarifications for dual-stack going GA in 1.23. Signed-off-by: Bridget Kromhout --- .../tools/kubeadm/dual-stack-support.md | 2 +- .../windows/intro-windows-in-kubernetes.md | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md b/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md index f2d250c296..ffd5839c23 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/dual-stack-support.md @@ -71,7 +71,7 @@ Run kubeadm to initiate the dual-stack control plane node: kubeadm init --config=kubeadm-config.yaml ``` -Currently, the kube-controller-manager flags `--node-cidr-mask-size-ipv4|--node-cidr-mask-size-ipv6` are being left with default values. See [enable IPv4/IPv6 dual stack](/docs/concepts/services-networking/dual-stack#enable-ipv4ipv6-dual-stack). +The kube-controller-manager flags `--node-cidr-mask-size-ipv4|--node-cidr-mask-size-ipv6` are set with default values. See [configure IPv4/IPv6 dual stack](/docs/concepts/services-networking/dual-stack#configure-ipv4-ipv6-dual-stack). {{< note >}} The `--apiserver-advertise-address` flag does not support dual-stack. diff --git a/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md b/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md index c2160e330f..68ea3ee146 100644 --- a/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md +++ b/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md @@ -340,9 +340,7 @@ Kubernetes on Windows does not support single-stack "IPv6-only" networking. Howe dual-stack IPv4/IPv6 networking for pods and nodes with single-family services is supported. -You can enable IPv4/IPv6 dual-stack networking for `l2bridge` networks using the -`IPv6DualStack` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/). -See [enable IPv4/IPv6 dual stack](/docs/concepts/services-networking/dual-stack#enable-ipv4ipv6-dual-stack) for more details. +You can use IPv4/IPv6 dual-stack networking with `l2bridge` networks. See [configure IPv4/IPv6 dual stack](/docs/concepts/services-networking/dual-stack#configure-ipv4-ipv6-dual-stack) for more details. {{< note >}} Overlay (VXLAN) networks on Windows do not support dual-stack networking. From 22475d9cf190c9cf641e192c0e8ad7cd0397012d Mon Sep 17 00:00:00 2001 From: Hemant Kumar Date: Mon, 29 Nov 2021 21:29:57 -0500 Subject: [PATCH 083/148] Update content/en/docs/reference/command-line-tools-reference/feature-gates.md Co-authored-by: Tim Bannister --- .../reference/command-line-tools-reference/feature-gates.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 05e55ab486..ebed2123e5 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -891,7 +891,9 @@ Each feature gate is designed for enabling/disabling a specific feature: - `ReadWriteOncePod`: Enables the usage of `ReadWriteOncePod` PersistentVolume access mode. - `RecoverVolumeExpansionFailure`: Enables users to edit their PVCs to smaller sizes so as they can recover from previously issued - volume expansion failures. See [enhancement proposal](https://github.com/kubernetes/enhancements/blob/master/keps/sig-storage/1790-recover-resize-failure/README.md) for more details. + volume expansion failures. See + [Recovering from Failure when Expanding Volumes](/docs/concepts/storage/persistent-volumes/#recovering-from-failure-when-expanding-volumes) + for more details. - `RemainingItemCount`: Allow the API servers to show a count of remaining items in the response to a [chunking list request](/docs/reference/using-api/api-concepts/#retrieving-large-results-sets-in-chunks). From 9bef88f0084e2d3c1e43741f70a916f88635c85d Mon Sep 17 00:00:00 2001 From: Ayushman Mishra Date: Tue, 30 Nov 2021 09:18:11 +0530 Subject: [PATCH 084/148] Edited FlexVolume deprecated Signed-off-by: Ayushman Mishra --- content/en/docs/concepts/extend-kubernetes/_index.md | 4 +++- content/en/docs/concepts/storage/persistent-volumes.md | 3 ++- content/en/docs/reference/glossary/flexvolume.md | 4 ++-- .../tools/kubeadm/troubleshooting-kubeadm.md | 1 + 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/content/en/docs/concepts/extend-kubernetes/_index.md b/content/en/docs/concepts/extend-kubernetes/_index.md index 825484f50d..edb550bbed 100644 --- a/content/en/docs/concepts/extend-kubernetes/_index.md +++ b/content/en/docs/concepts/extend-kubernetes/_index.md @@ -77,7 +77,7 @@ failure. In the webhook model, Kubernetes makes a network request to a remote service. In the *Binary Plugin* model, Kubernetes executes a binary (program). Binary plugins are used by the kubelet (e.g. -[Flex Volume Plugins](/docs/concepts/storage/volumes/#flexVolume) +[Flex Volume Plugins](/docs/concepts/storage/volumes/#flexvolume) and [Network Plugins](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/)) and by kubectl. @@ -163,6 +163,8 @@ After a request is authorized, if it is a write operation, it also goes through ) allow users to mount volume types without built-in support by having the Kubelet call a Binary Plugin to mount the volume. +FlexVolume is deprecated in v1.23. Out-of-tree CSI driver is the recommended way to write volume drivers in Kubernetes. See this doc [here](https://github.com/kubernetes/community/blob/master/sig-storage/volume-plugin-faq.md#kubernetes-volume-plugin-faq-for-storage-vendors) for more information. + ### Device Plugins diff --git a/content/en/docs/concepts/storage/persistent-volumes.md b/content/en/docs/concepts/storage/persistent-volumes.md index f2093073df..8e8a6241ca 100644 --- a/content/en/docs/concepts/storage/persistent-volumes.md +++ b/content/en/docs/concepts/storage/persistent-volumes.md @@ -318,7 +318,8 @@ PersistentVolume types are implemented as plugins. Kubernetes currently supports * [`cephfs`](/docs/concepts/storage/volumes/#cephfs) - CephFS volume * [`csi`](/docs/concepts/storage/volumes/#csi) - Container Storage Interface (CSI) * [`fc`](/docs/concepts/storage/volumes/#fc) - Fibre Channel (FC) storage -* [`flexVolume`](/docs/concepts/storage/volumes/#flexVolume) - FlexVolume +* [`flexVolume`](/docs/concepts/storage/volumes/#flexvolume) - FlexVolume + (**deprecated** in v1.23) * [`gcePersistentDisk`](/docs/concepts/storage/volumes/#gcepersistentdisk) - GCE Persistent Disk * [`glusterfs`](/docs/concepts/storage/volumes/#glusterfs) - Glusterfs volume * [`hostPath`](/docs/concepts/storage/volumes/#hostpath) - HostPath volume diff --git a/content/en/docs/reference/glossary/flexvolume.md b/content/en/docs/reference/glossary/flexvolume.md index 91478fd1f0..aa885000c8 100644 --- a/content/en/docs/reference/glossary/flexvolume.md +++ b/content/en/docs/reference/glossary/flexvolume.md @@ -4,14 +4,14 @@ id: flexvolume date: 2018-06-25 full_link: /docs/concepts/storage/volumes/#flexvolume short_description: > - FlexVolume is an interface for creating out-of-tree volume plugins. The {{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}} is a newer interface which addresses several problems with FlexVolumes. + FlexVolume is an interface for creating out-of-tree volume plugins. It is deprecated in v1.23. The {{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}} is a newer interface which addresses several problems with FlexVolumes. aka: tags: - storage --- - FlexVolume is an interface for creating out-of-tree volume plugins. The {{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}} is a newer interface which addresses several problems with FlexVolumes. + FlexVolume is an interface for creating out-of-tree volume plugins. It is deprecated in v1.23. The {{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}} is a newer interface which addresses several problems with FlexVolumes. diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md index d0498b0c0d..25a2e64815 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md @@ -375,6 +375,7 @@ For [flex-volume support](https://github.com/kubernetes/community/blob/ab55d85/c Kubernetes components like the kubelet and kube-controller-manager use the default path of `/usr/libexec/kubernetes/kubelet-plugins/volume/exec/`, yet the flex-volume directory _must be writeable_ for the feature to work. +(**Note** FlexVolume is deprecated in v1.23) To workaround this issue you can configure the flex-volume directory using the kubeadm [configuration file](/docs/reference/config-api/kubeadm-config.v1beta3/). From 26aa51a940923b7718f04891bb53532490960769 Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Tue, 23 Nov 2021 09:58:06 +0100 Subject: [PATCH 085/148] Add CRI architecture to cluster concepts Signed-off-by: Sascha Grunert --- content/en/docs/concepts/architecture/cri.md | 51 +++++++++++++++++++ .../glossary/container-runtime-interface.md | 22 ++++++++ 2 files changed, 73 insertions(+) create mode 100644 content/en/docs/concepts/architecture/cri.md create mode 100644 content/en/docs/reference/glossary/container-runtime-interface.md diff --git a/content/en/docs/concepts/architecture/cri.md b/content/en/docs/concepts/architecture/cri.md new file mode 100644 index 0000000000..e8391ca34b --- /dev/null +++ b/content/en/docs/concepts/architecture/cri.md @@ -0,0 +1,51 @@ +--- +title: Container Runtime Interface (CRI) +content_type: concept +weight: 50 +--- + + + +The CRI is a plugin interface which enables the kubelet to use a wide variety of +container runtimes, without having a need to recompile the cluster components. + +You need a working +{{}} on +each Node in your cluster, so that the +{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} can launch +{{< glossary_tooltip text="Pods" term_id="pod" >}} and their containers. + +{{< glossary_definition term_id="container-runtime-interface" length="all" >}} + + + +## The API {#api} + +{{< feature-state for_k8s_version="v1.23" state="stable" >}} + +The kubelet acts as a client when connecting to the container runtime via gRPC. +The runtime and image service endpoints have to be available in the container +runtime, which can be configured separately within the kubelet by using the +`--image-service-endpoint` and `--container-runtime-endpoint` [command line +flags](/docs/reference/command-line-tools-reference/kubelet) + +For Kubernetes v{{< skew currentVersion >}}, the kubelet prefers to use CRI `v1`. +If a container runtime does not support `v1` of the CRI, then the kubelet tries to +negotiate any older supported version. +The v{{< skew currentVersion >}} kubelet can also negotiate CRI `v1alpha2`, but +this version is considered as deprecated. +If the kubelet cannot negotiate a supported CRI version, the kubelet gives up +and doesn't register as a node. + +## Upgrading + +When upgrading Kubernetes, then the kubelet tries to automatically select the +latest CRI version on restart of the component. If that fails, then the fallback +will take place as mentioned above. If a gRPC re-dial was required because the +container runtime has been upgraded, then the container runtime must also +support the initially selected version or the redial is expected to fail. This +requires a restart of the kubelet. + +## {{% heading "whatsnext" %}} + +- Learn more about the CRI [protocol definition](https://github.com/kubernetes/cri-api/blob/c75ef5b/pkg/apis/runtime/v1/api.proto) diff --git a/content/en/docs/reference/glossary/container-runtime-interface.md b/content/en/docs/reference/glossary/container-runtime-interface.md new file mode 100644 index 0000000000..11f7bc50f4 --- /dev/null +++ b/content/en/docs/reference/glossary/container-runtime-interface.md @@ -0,0 +1,22 @@ +--- +title: Container Runtime Interface +id: container-runtime-interface +date: 2021-11-24 +full_link: /docs/concepts/architecture/cri +short_description: > + The main protocol for the communication between the kubelet and Container Runtime. + +aka: +tags: + - cri +--- + +The main protocol for the communication between the kubelet and Container Runtime. + + + +The Kubernetes Container Runtime Interface (CRI) defines the main +[gRPC](https://grpc.io) protocol for the communication between the +[cluster components](/docs/concepts/overview/components/#node-components) +{{< glossary_tooltip text="kubelet" term_id="kubelet" >}} and +{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}. From 56035c1f8cc1f6072f34b424852168cd76d42ba3 Mon Sep 17 00:00:00 2001 From: Hang Yan Date: Tue, 30 Nov 2021 23:19:13 +0800 Subject: [PATCH 086/148] Remove kompose up and down command doc kompose has drop support for `up` and `down` subcommand since v1.22.0. Also update kompose versions --- .../translate-compose-kubernetes.md | 122 +----------------- 1 file changed, 3 insertions(+), 119 deletions(-) diff --git a/content/en/docs/tasks/configure-pod-container/translate-compose-kubernetes.md b/content/en/docs/tasks/configure-pod-container/translate-compose-kubernetes.md index 826021f1b4..205628b525 100644 --- a/content/en/docs/tasks/configure-pod-container/translate-compose-kubernetes.md +++ b/content/en/docs/tasks/configure-pod-container/translate-compose-kubernetes.md @@ -29,13 +29,13 @@ Kompose is released via GitHub on a three-week cycle, you can see all current re ```sh # Linux -curl -L https://github.com/kubernetes/kompose/releases/download/v1.24.0/kompose-linux-amd64 -o kompose +curl -L https://github.com/kubernetes/kompose/releases/download/v1.26.0/kompose-linux-amd64 -o kompose # macOS -curl -L https://github.com/kubernetes/kompose/releases/download/v1.24.0/kompose-darwin-amd64 -o kompose +curl -L https://github.com/kubernetes/kompose/releases/download/v1.26.0/kompose-darwin-amd64 -o kompose # Windows -curl -L https://github.com/kubernetes/kompose/releases/download/v1.24.0/kompose-windows-amd64.exe -o kompose.exe +curl -L https://github.com/kubernetes/kompose/releases/download/v1.26.0/kompose-windows-amd64.exe -o kompose.exe chmod +x kompose sudo mv ./kompose /usr/local/bin/kompose @@ -207,8 +207,6 @@ you need is an existing `docker-compose.yml` file. - CLI - [`kompose convert`](#kompose-convert) - - [`kompose up`](#kompose-up) - - [`kompose down`](#kompose-down) - Documentation - [Build and Push Docker Images](#build-and-push-docker-images) - [Alternative Conversions](#alternative-conversions) @@ -328,121 +326,7 @@ INFO OpenShift file "foo-buildconfig.yaml" created If you are manually pushing the OpenShift artifacts using ``oc create -f``, you need to ensure that you push the imagestream artifact before the buildconfig artifact, to workaround this OpenShift issue: https://github.com/openshift/origin/issues/4518 . {{< /note >}} -## `kompose up` -Kompose supports a straightforward way to deploy your "composed" application to Kubernetes or OpenShift via `kompose up`. - -### Kubernetes `kompose up` example - -```shell -kompose --file ./examples/docker-guestbook.yml up -``` - -```none -We are going to create Kubernetes deployments and services for your Dockerized application. -If you need different kind of resources, use the 'kompose convert' and 'kubectl apply -f' commands instead. - -INFO Successfully created service: redis-master -INFO Successfully created service: redis-slave -INFO Successfully created service: frontend -INFO Successfully created deployment: redis-master -INFO Successfully created deployment: redis-slave -INFO Successfully created deployment: frontend - -Your application has been deployed to Kubernetes. You can run 'kubectl get deployment,svc,pods' for details. -``` - -```shell -kubectl get deployment,svc,pods -``` - -```none -NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE -deployment.extensions/frontend 1 1 1 1 4m -deployment.extensions/redis-master 1 1 1 1 4m -deployment.extensions/redis-slave 1 1 1 1 4m - -NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE -service/frontend ClusterIP 10.0.174.12 80/TCP 4m -service/kubernetes ClusterIP 10.0.0.1 443/TCP 13d -service/redis-master ClusterIP 10.0.202.43 6379/TCP 4m -service/redis-slave ClusterIP 10.0.1.85 6379/TCP 4m - -NAME READY STATUS RESTARTS AGE -pod/frontend-2768218532-cs5t5 1/1 Running 0 4m -pod/redis-master-1432129712-63jn8 1/1 Running 0 4m -pod/redis-slave-2504961300-nve7b 1/1 Running 0 4m -``` - -{{< note >}} - -- You must have a running Kubernetes cluster with a pre-configured kubectl context. -- Only deployments and services are generated and deployed to Kubernetes. If you need different kind of resources, use the `kompose convert` and `kubectl apply -f` commands instead. -{{< /note >}} - -### OpenShift `kompose up` example - -```shell -kompose --file ./examples/docker-guestbook.yml --provider openshift up -``` - -```none -We are going to create OpenShift DeploymentConfigs and Services for your Dockerized application. -If you need different kind of resources, use the 'kompose convert' and 'oc create -f' commands instead. - -INFO Successfully created service: redis-slave -INFO Successfully created service: frontend -INFO Successfully created service: redis-master -INFO Successfully created deployment: redis-slave -INFO Successfully created ImageStream: redis-slave -INFO Successfully created deployment: frontend -INFO Successfully created ImageStream: frontend -INFO Successfully created deployment: redis-master -INFO Successfully created ImageStream: redis-master - -Your application has been deployed to OpenShift. You can run 'oc get dc,svc,is' for details. -``` - -```shell -oc get dc,svc,is -``` - -```none -NAME REVISION DESIRED CURRENT TRIGGERED BY -dc/frontend 0 1 0 config,image(frontend:v4) -dc/redis-master 0 1 0 config,image(redis-master:e2e) -dc/redis-slave 0 1 0 config,image(redis-slave:v1) -NAME CLUSTER-IP EXTERNAL-IP PORT(S) AGE -svc/frontend 172.30.46.64 80/TCP 8s -svc/redis-master 172.30.144.56 6379/TCP 8s -svc/redis-slave 172.30.75.245 6379/TCP 8s -NAME DOCKER REPO TAGS UPDATED -is/frontend 172.30.12.200:5000/fff/frontend -is/redis-master 172.30.12.200:5000/fff/redis-master -is/redis-slave 172.30.12.200:5000/fff/redis-slave v1 -``` - -{{< note >}} -You must have a running OpenShift cluster with a pre-configured `oc` context (`oc login`). -{{< /note >}} - -## `kompose down` - -Once you have deployed "composed" application to Kubernetes, `kompose down` will help you to take the application out by deleting its deployments and services. If you need to remove other resources, use the 'kubectl' command. - -```shell -kompose --file docker-guestbook.yml down -INFO Successfully deleted service: redis-master -INFO Successfully deleted deployment: redis-master -INFO Successfully deleted service: redis-slave -INFO Successfully deleted deployment: redis-slave -INFO Successfully deleted service: frontend -INFO Successfully deleted deployment: frontend -``` - -{{< note >}} -You must have a running Kubernetes cluster with a pre-configured `kubectl` context. -{{< /note >}} ## Build and Push Docker Images From f7f336cf14fc47806c90178fe92c8b833e44fe04 Mon Sep 17 00:00:00 2001 From: Mike Dame Date: Thu, 11 Nov 2021 09:48:52 -0500 Subject: [PATCH 087/148] Add docs on scheduler MultiPoint config --- .../en/docs/reference/scheduling/config.md | 182 ++++++++++++++++++ 1 file changed, 182 insertions(+) diff --git a/content/en/docs/reference/scheduling/config.md b/content/en/docs/reference/scheduling/config.md index bce8d36b5c..204d4124ee 100644 --- a/content/en/docs/reference/scheduling/config.md +++ b/content/en/docs/reference/scheduling/config.md @@ -78,6 +78,8 @@ extension points: least one bind plugin is required. 1. `postBind`: This is an informational extension point that is called after a Pod has been bound. +1. `multiPoint`: This is a config-only field that allows plugins to be enabled + or disabled for all of their applicable extension points simultaneously. For each extension point, you could disable specific [default plugins](#scheduling-plugins) or enable your own. For example: @@ -251,6 +253,186 @@ the same configuration parameters (if applicable). This is because the scheduler only has one pending pods queue. {{< /note >}} +### Plugins that apply to multiple extension points {#multipoint} + +Starting from `kubescheduler.config.k8s.io/v1beta3`, there is an additional field in the +profile config, `multiPoint`, which allows for easily enabling or disabling a plugin +across several extension points. The intent of `multiPoint` config is to simplify the +configuration needed for users and administrators when using custom profiles. + +Consider a plugin, `MyPlugin`, which implements the `preScore`, `score`, `preFilter`, +and `filter` extension points. To enable `MyPlugin` for all its available extension +points, the profile config looks like: + +```yaml +apiVersion: kubescheduler.config.k8s.io/v1beta3 +kind: KubeSchedulerConfiguration +profiles: + - schedulerName: multipoint-scheduler + plugins: + multiPoint: + enabled: + - name: MyPlugin +``` + +This would equate to manually enabling `MyPlugin` for all of its extension +points, like so: + +```yaml +apiVersion: kubescheduler.config.k8s.io/v1beta3 +kind: KubeSchedulerConfiguration +profiles: + - schedulerName: non-multipoint-scheduler + plugins: + preScore: + enabled: + - name: MyPlugin + score: + enabled: + - name: MyPlugin + preFilter: + enabled: + - name: MyPlugin + filter: + enabled: + - name: MyPlugin +``` + +One benefit of using `multiPoint` here is that if `MyPlugin` implements another +extension point in the future, the `multiPoint` config will automatically enable it +for the new extension. + +Specific extension points can be excluded from `MultiPoint` expansion using +the `disabled` field for that extension point. This works with disabling default +plugins, non-default plugins, or with the wildcard (`'*'`) to disable all plugins. +An example of this, disabling `Score` and `PreScore`, would be: + +```yaml +apiVersion: kubescheduler.config.k8s.io/v1beta3 +kind: KubeSchedulerConfiguration +profiles: + - schedulerName: non-multipoint-scheduler + plugins: + multiPoint: + enabled: + - name: 'MyPlugin' + preScore: + disabled: + - name: '*' + score: + disabled: + - name: '*' +``` + +In `v1beta3`, all [default plugins](#scheduling-plugins) are enabled internally through `MultiPoint`. +However, individual extension points are still available to allow flexible +reconfiguration of the default values (such as ordering and Score weights). For +example, consider two Score plugins `DefaultScore1` and `DefaultScore2`, each with +a weight of `1`. They can be reordered with different weights like so: + +```yaml +apiVersion: kubescheduler.config.k8s.io/v1beta3 +kind: KubeSchedulerConfiguration +profiles: + - schedulerName: multipoint-scheduler + plugins: + score: + enabled: + - name: 'DefaultScore2' + weight: 5 +``` + +In this example, it's unnecessary to specify the plugins in `MultiPoint` explicitly +because they are default plugins. And the only plugin specified in `Score` is `DefaultScore2`. +This is because plugins set through specific extension points will always take precedence +over `MultiPoint` plugins. So, this snippet essentially re-orders the two plugins +without needing to specify both of them. + +The general hierarchy for precedence when configuring `MultiPoint` plugins is as follows: +1. Specific extension points run first, and their settings override whatever is set elsewhere +2. Plugins manually configured through `MultiPoint` and their settings +3. Default plugins and their default settings + +To demonstrate the above hierarchy, the following example is based on these plugins: +|Plugin|Extension Points| +|---|---| +|`DefaultQueueSort`|`QueueSort`| +|`CustomQueueSort`|`QueueSort`| +|`DefaultPlugin1`|`Score`, `Filter`| +|`DefaultPlugin2`|`Score`| +|`CustomPlugin1`|`Score`, `Filter`| +|`CustomPlugin2`|`Score`, `Filter`| + +A valid sample configuration for these plugins would be: + +```yaml +apiVersion: kubescheduler.config.k8s.io/v1beta3 +kind: KubeSchedulerConfiguration +profiles: + - schedulerName: multipoint-scheduler + plugins: + multiPoint: + enabled: + - name: 'CustomQueueSort' + - name: 'CustomPlugin1' + weight: 3 + - name: 'CustomPlugin2' + disabled: + - name: 'DefaultQueueSort' + filter: + disabled: + - name: 'DefaultPlugin1' + score: + enabled: + - name: 'DefaultPlugin2' +``` + +Note that there is no error for re-declaring a `MultiPoint` plugin in a specific +extension point. The re-declaration is ignored (and logged), as specific extension points +take precedence. + +Besides keeping most of the config in one spot, this sample does a few things: +* Enables the custom `queueSort` plugin and disables the default one +* Enables `CustomPlugin1` and `CustomPlugin2`, which will run first for all of their extension points +* Disables `DefaultPlugin1`, but only for `filter` +* Reorders `DefaultPlugin2` to run first in `score` (even before the custom plugins) + +In versions of the config before `v1beta3`, without `multiPoint`, the above snippet would equate to this: +```yaml +apiVersion: kubescheduler.config.k8s.io/v1beta2 +kind: KubeSchedulerConfiguration +profiles: + - schedulerName: multipoint-scheduler + plugins: + + # Disable the default QueueSort plugin + queueSort: + enabled: + - name: 'CustomQueueSort' + disabled: + - name: 'DefaultQueueSort' + + # Enable custom Filter plugins + filter: + enabled: + - name: 'CustomPlugin1' + - name: 'CustomPlugin2' + - name: 'DefaultPlugin2' + disabled: + - name: 'DefaultPlugin1' + + # Enable and reorder custom score plugins + score: + enabled: + - name: 'DefaultPlugin2' + weight: 1 + - name: 'DefaultPlugin1' + weight: 3 +``` + +While this is a complicated example, it demonstrates the flexibility of `MultiPoint` config +as well as its seamless integration with the existing methods for configuring extension points. + ## Scheduler configuration migrations {{< tabs name="tab_with_md" >}} From 41547099c4a76d558bdbf07507ec192913590007 Mon Sep 17 00:00:00 2001 From: Jefftree Date: Tue, 23 Nov 2021 14:14:36 -0800 Subject: [PATCH 088/148] Add section for OpenAPI v3 --- .../docs/concepts/overview/kubernetes-api.md | 56 ++++++++++++++++++- 1 file changed, 54 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/overview/kubernetes-api.md b/content/en/docs/concepts/overview/kubernetes-api.md index 07b5d559d7..e1ddda4267 100644 --- a/content/en/docs/concepts/overview/kubernetes-api.md +++ b/content/en/docs/concepts/overview/kubernetes-api.md @@ -37,8 +37,11 @@ if you are writing an application using the Kubernetes API. Complete API details are documented using [OpenAPI](https://www.openapis.org/). -The Kubernetes API server serves an OpenAPI spec via the `/openapi/v2` endpoint. -You can request the response format using request headers as follows: +### OpenAPI V2 + +The Kubernetes API server serves an aggregated OpenAPI v2 spec via the +`/openapi/v2` endpoint. You can request the response format using +request headers as follows: @@ -77,6 +80,55 @@ about this format, see the [Kubernetes Protobuf serialization](https://github.co Interface Definition Language (IDL) files for each schema located in the Go packages that define the API objects. +### OpenAPI V3 + +{{< feature-state state="alpha" for_k8s_version="v1.23" >}} + +Kubernetes v1.23 offers initial support for publishing its APIs as OpenAPI v3; this is an +alpha feature that is disabled by default. +You can enable the alpha feature by turning on the +[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) named `OpenAPIV3` +for the kube-apiserver component. + +With the feature enabled, the Kubernetes API server serves an +aggregated OpenAPI v3 spec per Kubernetes group version at the +`/openapi/v3/apis//` endpoint. Please refer to the +table below for accepted request headers. + +
Valid request header values for OpenAPI v2 queries
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Valid request header values for OpenAPI v3 queries
HeaderPossible valuesNotes
Accept-Encodinggzipnot supplying this header is also acceptable
Acceptapplication/com.github.proto-openapi.spec.v3@v1.0+protobufmainly for intra-cluster use
application/jsondefault
*serves application/json
+ +A discovery endpoint `/openapi/v3` is provided to see a list of all +group/versions available. This endpoint only returns JSON. + ## Persistence Kubernetes stores the serialized state of objects by writing them into From 89e744666c9e2062ac39691d2855d7b962feca23 Mon Sep 17 00:00:00 2001 From: ravisantoshgudimetla Date: Tue, 23 Nov 2021 08:13:06 -0500 Subject: [PATCH 089/148] [docs][windows]: Pod OS field update Co-authored-by: James Sturtevant Co-authored-by: Tim Bannister --- .../feature-gates.md | 3 ++ .../windows/intro-windows-in-kubernetes.md | 31 +++++++++++++++++++ .../windows/user-guide-windows-containers.md | 14 +++++++++ 3 files changed, 48 insertions(+) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 81e53092cb..9c582b1472 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -120,6 +120,7 @@ different Kubernetes components. | `GracefulNodeShutdown` | `true` | Beta | 1.21 | | | `HPAContainerMetrics` | `false` | Alpha | 1.20 | | | `HPAScaleToZero` | `false` | Alpha | 1.16 | | +| `IdentifyPodOS` | `false` | Alpha | 1.23 | | | `IndexedJob` | `false` | Alpha | 1.21 | 1.21 | | `IndexedJob` | `true` | Beta | 1.22 | | | `InTreePluginAWSUnregister` | `false` | Alpha | 1.21 | | @@ -779,6 +780,8 @@ Each feature gate is designed for enabling/disabling a specific feature: - `HyperVContainer`: Enable [Hyper-V isolation](https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/hyperv-container) for Windows containers. +- `IdentifyPodOS`: Allows the Pod OS field to be specified. This helps in identifying the OS of the pod + authoritatively during the API server admission time. In Kubernetes {{< skew currentVersion >}}, the allowed values for the `pod.spec.os.name` are `windows` and `linux`. - `ImmutableEphemeralVolumes`: Allows for marking individual Secrets and ConfigMaps as immutable for better safety and performance. - `InTreePluginAWSUnregister`: Stops registering the aws-ebs in-tree plugin in kubelet diff --git a/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md b/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md index c2160e330f..1140403fd7 100644 --- a/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md +++ b/content/en/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md @@ -153,6 +153,37 @@ section refers to several key workload enablers and how they map to Windows. * `emptyDir` volumes * Named pipe host mounts * Resource limits + * OS field: + {{< feature-state for_k8s_version="v1.23" state="alpha" >}} + `.spec.os.name` should be set to `windows` to indicate that the current Pod uses Windows containers. + `IdentifyPodOS` feature gate needs to be enabled for this field to be recognized and used by control plane + components and kubelet. + {{< note >}} + If the `IdentifyPodOS` feature gate is enabled and you set the `.spec.os.name` field to `windows`, you must not set the following fields in the `.spec` of that Pod: + * `spec.hostPID` + * `spec.hostIPC` + * `spec.securityContext.seLinuxOptions` + * `spec.securityContext.seccompProfile` + * `spec.securityContext.fsGroup` + * `spec.securityContext.fsGroupChangePolicy` + * `spec.securityContext.sysctls` + * `spec.shareProcessNamespace` + * `spec.securityContext.runAsUser` + * `spec.securityContext.runAsGroup` + * `spec.securityContext.supplementalGroups` + * `spec.containers[*].securityContext.seLinuxOptions` + * `spec.containers[*].securityContext.seccompProfile` + * `spec.containers[*].securityContext.capabilities` + * `spec.containers[*].securityContext.readOnlyRootFilesystem` + * `spec.containers[*].securityContext.privileged` + * `spec.containers[*].securityContext.allowPrivilegeEscalation` + * `spec.containers[*].securityContext.procMount` + * `spec.containers[*].securityContext.runAsUser` + * `spec.containers[*].securityContext.runAsGroup` + + Note: In this table, wildcards (*) indicate all elements in a list. For example, spec.containers[*].securityContext refers to the Security Context object for all defined containers. If not, Pod API validation would fail causing admission failures. + {{< /note >}} + * [Workload resources](/docs/concepts/workloads/controllers/) including: * ReplicaSet * Deployments diff --git a/content/en/docs/setup/production-environment/windows/user-guide-windows-containers.md b/content/en/docs/setup/production-environment/windows/user-guide-windows-containers.md index ec47f5637a..177f7623f6 100644 --- a/content/en/docs/setup/production-environment/windows/user-guide-windows-containers.md +++ b/content/en/docs/setup/production-environment/windows/user-guide-windows-containers.md @@ -160,7 +160,21 @@ Users today need to use some combination of taints and node selectors in order t keep Linux and Windows workloads on their respective OS-specific nodes. This likely imposes a burden only on Windows users. The recommended approach is outlined below, with one of its main goals being that this approach should not break compatibility for existing Linux workloads. + {{< note >}} +If the `IdentifyPodOS` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) is +enabled, you can (and should) set `.spec.os.name` for a Pod to indicate the operating system +that the containers in that Pod are designed for. For Pods that run Linux containers, set +`.spec.os.name` to `linux`. For Pods that run Windows containers, set `.spec.os.name` +to Windows. +The scheduler does not use the value of `.spec.os.name` when assigning Pods to nodes. You should +use normal Kubernetes mechanisms for +[assigning pods to nodes](/docs/concepts/scheduling-eviction/assign-pod-node/) +to ensure that the control plane for your cluster places pods onto nodes that are running the +appropriate operating system. + no effect on the scheduling of the Windows pods, so taints and tolerations and node selectors are still required + to ensure that the Windows pods land onto appropriate Windows nodes. + {{< /note >}} ### Ensuring OS-specific workloads land on the appropriate container host Users can ensure Windows containers can be scheduled on the appropriate host using Taints and Tolerations. From 13c18873e1ea0881df9790e231d49caedfc7aa29 Mon Sep 17 00:00:00 2001 From: bang9211 Date: Tue, 30 Nov 2021 10:09:14 +0900 Subject: [PATCH 090/148] Translate reference/ports-and-protocols.md in Korean --- .../ko/docs/reference/ports-and-protocols.md | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 content/ko/docs/reference/ports-and-protocols.md diff --git a/content/ko/docs/reference/ports-and-protocols.md b/content/ko/docs/reference/ports-and-protocols.md new file mode 100644 index 0000000000..6ba447cda9 --- /dev/null +++ b/content/ko/docs/reference/ports-and-protocols.md @@ -0,0 +1,40 @@ +--- +title: 포트와 프로토콜 +content_type: reference +weight: 50 +--- + +물리적 네트워크 방화벽이 있는 온프레미스 데이터 센터 또는 +퍼블릭 클라우드의 가상 네트워크와 같이 네트워크 경계가 엄격한 환경에서 +쿠버네티스를 실행할 때, 쿠버네티스 구성 요소에서 +사용하는 포트와 프로토콜을 알고 있는 것이 유용하다. + +## 컨트롤 플레인 + +| 프로토콜 | 방향 | 포트 범위 | 용도 | 사용 주체 | +|----------|-----------|------------|-------------------------|---------------------------| +| TCP | 인바운드 | 6443 | 쿠버네티스 API 서버 | 전부 | +| TCP | 인바운드 | 2379-2380 | etcd 서버 클라이언트 API | kube-apiserver, etcd | +| TCP | 인바운드 | 10250 | Kubelet API | Self, 컨트롤 플레인 | +| TCP | 인바운드 | 10259 | kube-scheduler | Self | +| TCP | 인바운드 | 10257 | kube-controller-manager | Self | + +etcd 포트가 컨트롤 플레인 섹션에 포함되어 있지만, 외부 또는 사용자 지정 포트에서 자체 +etcd 클러스터를 호스팅할 수도 있다. + +## 워커 노드 {#node} + +| 프로토콜 | 방향 | 포트 범위 | 용도 | 사용 주체 | +|----------|-----------|-------------|-----------------------|-------------------------| +| TCP | 인바운드 | 10250 | Kubelet API | Self, 컨트롤 플레인 +| TCP | 인바운드 | 30000-32767 | NodePort 서비스† | 전부 | + +† [노드포트(NodePort) 서비스](/ko/docs/concepts/services-networking/service/)의 기본 포트 범위. + +모든 기본 포트 번호를 재정의할 수 있다. 사용자 지정 포트를 사용하는 경우 +여기에 언급된 기본값 대신 해당 포트를 열어야 한다. + +종종 발생하는 한 가지 일반적인 예는 API 서버 포트를 443으로 변경하는 경우이다. +또는, API 서버의 기본 포트를 그대로 유지하고, +443 포트에서 수신 대기하는 로드 밸런서 뒤에 API 서버를 두고, +로드 밸런서에서 API 서버로 가는 요청을 API 서버의 기본 포트로 라우팅할 수도 있다. From ef6668539c37efab4338ff05728fcdd3d97c2bc1 Mon Sep 17 00:00:00 2001 From: Sergey Kanzhelev Date: Tue, 30 Nov 2021 19:37:31 +0000 Subject: [PATCH 091/148] gRPC probes --- .../_posts/2018-10-01-health-checking-grpc.md | 2 + .../feature-gates.md | 10 ++-- ...igure-liveness-readiness-startup-probes.md | 50 ++++++++++++++++++- .../en/examples/pods/probe/grpc-liveness.yaml | 15 ++++++ 4 files changed, 71 insertions(+), 6 deletions(-) create mode 100644 content/en/examples/pods/probe/grpc-liveness.yaml diff --git a/content/en/blog/_posts/2018-10-01-health-checking-grpc.md b/content/en/blog/_posts/2018-10-01-health-checking-grpc.md index 21eb668dc2..e6e584b274 100644 --- a/content/en/blog/_posts/2018-10-01-health-checking-grpc.md +++ b/content/en/blog/_posts/2018-10-01-health-checking-grpc.md @@ -4,6 +4,8 @@ title: 'Health checking gRPC servers on Kubernetes' date: 2018-10-01 --- +_Built-in gRPC probes were introduced in Kubernetes 1.23. To learn more, see [Configure Liveness, Readiness and Startup Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-grpc-liveness-probe)._ + **Author**: [Ahmet Alp Balkan](https://twitter.com/ahmetb) (Google) [gRPC](https://grpc.io) is on its way to becoming the lingua franca for diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 73bf143a43..63088e2cc2 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -122,6 +122,7 @@ different Kubernetes components. | `ExperimentalHostUserNamespaceDefaulting` | `false` | Beta | 1.5 | | | `GracefulNodeShutdown` | `false` | Alpha | 1.20 | 1.20 | | `GracefulNodeShutdown` | `true` | Beta | 1.21 | | +| `GRPCContainerProbe` | `false` | Alpha | 1.23 | | | `HPAContainerMetrics` | `false` | Alpha | 1.20 | | | `HPAScaleToZero` | `false` | Alpha | 1.16 | | | `IndexedJob` | `false` | Alpha | 1.21 | 1.21 | @@ -573,10 +574,10 @@ Each feature gate is designed for enabling/disabling a specific feature: extended tokens by starting `kube-apiserver` with flag `--service-account-extend-token-expiration=false`. Check [Bound Service Account Tokens](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md) for more details. -- `ControllerManagerLeaderMigration`: Enables Leader Migration for - [kube-controller-manager](/docs/tasks/administer-cluster/controller-manager-leader-migration/#initial-leader-migration-configuration) and - [cloud-controller-manager](/docs/tasks/administer-cluster/controller-manager-leader-migration/#deploy-cloud-controller-manager) which allows a cluster operator to live migrate - controllers from the kube-controller-manager into an external controller-manager +- `ControllerManagerLeaderMigration`: Enables Leader Migration for + [kube-controller-manager](/docs/tasks/administer-cluster/controller-manager-leader-migration/#initial-leader-migration-configuration) and + [cloud-controller-manager](/docs/tasks/administer-cluster/controller-manager-leader-migration/#deploy-cloud-controller-manager) which allows a cluster operator to live migrate + controllers from the kube-controller-manager into an external controller-manager (e.g. the cloud-controller-manager) in an HA cluster without downtime. - `CPUManager`: Enable container level CPU affinity support, see [CPU Management Policies](/docs/tasks/administer-cluster/cpu-management-policies/). @@ -782,6 +783,7 @@ Each feature gate is designed for enabling/disabling a specific feature: and gracefully terminate pods running on the node. See [Graceful Node Shutdown](/docs/concepts/architecture/nodes/#graceful-node-shutdown) for more details. +- `GRPCContainerProbe`: Enables gPRC probe method for {Liveness,Readiness,Startup}Probe. See [Configure Liveness, Readiness and Startup Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-grpc-liveness-probe). - `HPAContainerMetrics`: Enable the `HorizontalPodAutoscaler` to scale based on metrics from individual containers in target pods. - `HPAScaleToZero`: Enables setting `minReplicas` to 0 for `HorizontalPodAutoscaler` diff --git a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md index d9ab2056da..2ef2b1368c 100644 --- a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md +++ b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md @@ -220,11 +220,57 @@ After 15 seconds, view Pod events to verify that liveness probes: kubectl describe pod goproxy ``` +## Define a gRPC liveness probe + +{{< feature-state for_k8s_version="v1.23" state="alpha" >}} + +If your application implements [gRPC Health Checking Protocol](https://github.com/grpc/grpc/blob/master/doc/health-checking.md), +kubelet can be configured to use it for application liveness checks. + +{{< codenew file="pods/probe/grpc-liveness.yaml">}} + +To use a gRPC probe, `port` must be configured. If the health endpoint is configured +on a non-default service, `service` must be configured. + +{{< note >}} +Unlike HTTP and TCP probes, named ports cannot be used and custom host cannot be configured. +{{< /note >}} + +Configuration problems (e.g. incorrect port and service, unimplemented health checking protocol) +are considered a probe failure, similar to HTTP and TCP probes. + +Before Kubernetes 1.23, gRPC health probes were often implemented using [grpc-health-probe](https://github.com/grpc-ecosystem/grpc-health-probe/), +as described in the blog post [Health checking gRPC servers on Kubernetes](/blog/2018/10/01/health-checking-grpc-servers-on-kubernetes/). +The built-in gRPC probes behavior is similar to one implemented by grpc-health-probe. +When migrating from grpc-health-probe to built-in probes, remember the following differences: + +- Built-in probes will run against pod IP, unlike grpc-health-probe that often runs against `127.0.0.1`. + Be sure to configure your gRPC endpoint to listen for pod IP address. +- Built-in probes do not currently support any authentication parameters (like `-tls`). +- There are no error codes in built-in probes. All errors are considered as probe failures. +- If `ExecProbeTimeout` feature gate is set to `false`, grpc-health-probe will NOT + respect `timeoutSeconds` setting (which defaults to 1s), + while built-in probe will fail on timeout. + +To try the gRPC liveness check, create a Pod using the command below. +In the example below, etcd pod is configured to use gRPC liveness probe. + + +```shell +kubectl apply -f https://k8s.io/examples/pods/probe/content/en/examples/pods/probe/grpc-liveness.yaml +``` + +After 15 seconds, view Pod events to verify that the liveness probes has not failed: + +```shell +kubectl describe pod etcd-with-grpc +``` + ## Use a named port You can use a named [ContainerPort](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#containerport-v1-core) -for HTTP or TCP liveness checks: +for HTTP and TCP probes. Note, gRPC probe does not support named port. ```yaml ports: @@ -349,7 +395,7 @@ This defect was corrected in Kubernetes v1.20. You may have been relying on the even without realizing it, as the default timeout is 1 second. As a cluster administrator, you can disable the [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) `ExecProbeTimeout` (set it to `false`) on each kubelet to restore the behavior from older versions, then remove that override -once all the exec probes in the cluster have a `timeoutSeconds` value set. +once all the exec probes in the cluster have a `timeoutSeconds` value set. If you have pods that are impacted from the default 1 second timeout, you should update their probe timeout so that you're ready for the eventual removal of that feature gate. diff --git a/content/en/examples/pods/probe/grpc-liveness.yaml b/content/en/examples/pods/probe/grpc-liveness.yaml new file mode 100644 index 0000000000..84d716df28 --- /dev/null +++ b/content/en/examples/pods/probe/grpc-liveness.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: etcd-with-grpc +spec: + containers: + - name: etcd + image: k8s.gcr.io/etcd:3.5.1-0 + command: [ "/usr/local/bin/etcd", "--data-dir", "/var/lib/etcd", "--listen-client-urls", "http://0.0.0.0:2379", "--advertise-client-urls", "http://127.0.0.1:2379", "--log-level", "debug"] + ports: + - containerPort: 2379 + livenessProbe: + gRPC: + port: 2379 + initialDelaySeconds: 10 From df3184bd527afaf2f68a212f287e853ebe654921 Mon Sep 17 00:00:00 2001 From: John T Skarbek Date: Fri, 17 Sep 2021 13:24:00 -0400 Subject: [PATCH 092/148] Add recommendation for Deployment when HPA is enabled * Advertise that we need to remove `spec.replicas` when a Horizontal Pod Autoscaler is active to prevent unnecessary changes in Pod counts during Deployment object changes * Make note that a Deployment that has this value set behave awkwardly if a Deployment is scaled manually outside of the Deployment object Signed-off-by: John T Skarbek --- .../workloads/controllers/deployment.md | 12 ++++++ .../workloads/controllers/statefulset.md | 16 ++++++++ .../horizontal-pod-autoscale.md | 40 ++++++++++++++++++- 3 files changed, 67 insertions(+), 1 deletion(-) diff --git a/content/en/docs/concepts/workloads/controllers/deployment.md b/content/en/docs/concepts/workloads/controllers/deployment.md index 22b95255c5..b008ad916b 100644 --- a/content/en/docs/concepts/workloads/controllers/deployment.md +++ b/content/en/docs/concepts/workloads/controllers/deployment.md @@ -1070,6 +1070,18 @@ allowed, which is the default if not specified. `.spec.replicas` is an optional field that specifies the number of desired Pods. It defaults to 1. +Should you manually scale a Deployment, example via `kubectl scale deployment +deployment --replicas=X`, and then you update that Deployment based on a manifest +(for example: by running `kubectl apply -f deployment.yaml`), +then applying that manifest overwrites the manual scaling that you previously did. + +If a [HorizontalPodAutoscaler](/docs/tasks/run-application/horizontal-pod-autoscale/) (or any +similar API for horizontal scaling) is managing scaling for a Deployment, don't set `.spec.replicas`. + +Instead, allow the Kubernetes +{{< glossary_tooltip text="control plane" term_id="control-plane" >}} to manage the +`.spec.replicas` field automatically. + ### Selector `.spec.selector` is a required field that specifies a [label selector](/docs/concepts/overview/working-with-objects/labels/) diff --git a/content/en/docs/concepts/workloads/controllers/statefulset.md b/content/en/docs/concepts/workloads/controllers/statefulset.md index 3f89da5989..018cc018fa 100644 --- a/content/en/docs/concepts/workloads/controllers/statefulset.md +++ b/content/en/docs/concepts/workloads/controllers/statefulset.md @@ -295,6 +295,22 @@ a Pod is considered ready, see [Container Probes](/docs/concepts/workloads/pods/ Please note that this field only works if you enable the `StatefulSetMinReadySeconds` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/). +### Replicas + +`.spec.replicas` is an optional field that specifies the number of desired Pods. It defaults to 1. + +Should you manually scale a deployment, example via `kubectl scale +statefulset statefulset --replicas=X`, and then you update that StatefulSet +based on a manifest (for example: by running `kubectl apply -f +statefulset.yaml`), then applying that manifest overwrites the manual scaling +that you previously did. + +If a [HorizontalPodAutoscaler](/docs/tasks/run-application/horizontal-pod-autoscale/) +(or any similar API for horizontal scaling) is managing scaling for a +Statefulset, don't set `.spec.replicas`. Instead, allow the Kubernetes +{{}} to manage +the `.spec.replicas` field automatically. + ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md b/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md index 27165d0ca7..ff9c6aa97d 100644 --- a/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md +++ b/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md @@ -504,8 +504,46 @@ stops adjusting the target (and sets the `ScalingActive` Condition on itself to `false`) until you reactivate it by manually adjusting the target's desired replica count or HPA's minimum replica count. -## {{% heading "whatsnext" %}} +### Migrating Deployments and StatefulSets to horizontal autoscaling +When an HPA is enabled, it is recommended that the value of `spec.replicas` of +the Deployment and / or StatefulSet be removed from their +{{< glossary_tooltip text="manifest(s)" term_id="manifest" >}}. If this isn't done, any time +a change to that object is applied, for example via `kubectl apply -f +deployment.yaml`, this will instruct Kubernetes to scale the current number of Pods +to the value of the `spec.replicas` key. This may not be +desired and could be troublesome when an HPA is active. + +Keep in mind that the removal of `spec.replicas` may incur a one-time +degradation of Pod counts as the default value of this key is 1 (reference +[Deployment Replicas](/docs/concepts/workloads/controllers/deployment#replicas). +Upon the update, all Pods except 1 will begin their termination procedures. Any +deployment application afterwards will behave as normal and respect a rolling +update configuration as desired. You can avoid this degradation by choosing one of the following two +methods based on how you are modifying your deployments: + +{{< tabs name="fix_replicas_instructions" >}} +{{% tab name="Client Side Apply (this is the default)" %}} + +1. `kubectl apply edit-last-applied deployment/` +2. In the editor, remove `spec.replicas`. When you save and exit the editor, `kubectl` + applies the update. No changes to Pod counts happen at this step. +3. You can now remove `spec.replicas` from the manifest. If you use source code management, + also commit your changes or take whatever other steps for revising the source code + are appropriate for how you track updates. +4. From here on out you can run `kubectl apply -f deployment.yaml` + +{{% /tab %}} +{{% tab name="Server Side Apply" %}} + +When using the [Server-Side Apply](/docs/reference/using-api/server-side-apply/) +you can follow the [transferring ownership](/docs/reference/using-api/server-side-apply/#transferring-ownership) +guidelines, which cover this exact use case. + +{{% /tab %}} +{{< /tabs >}} + +## {{% heading "whatsnext" %}} * Design documentation: [Horizontal Pod Autoscaling](https://git.k8s.io/community/contributors/design-proposals/autoscaling/horizontal-pod-autoscaler.md). * kubectl autoscale command: [kubectl autoscale](/docs/reference/generated/kubectl/kubectl-commands/#autoscale). From 6a684469cb9fd385e61fc1f75ae6b35eef332b77 Mon Sep 17 00:00:00 2001 From: Brandon Smith Date: Tue, 30 Nov 2021 15:49:17 -0800 Subject: [PATCH 093/148] Windows HostProcess Beta 1.23 Documentation (#30391) * Added initial version change * Added more information for HostProcess in 1.23, removed content relating to 1.22 specifically. * Made containerd mention specific to 1.6 * Added note about base images and removed annotation mentions * Reworded prerequisites section. --- .../feature-gates.md | 2 +- .../create-hostprocess-pod.md | 139 ++++++++---------- 2 files changed, 66 insertions(+), 75 deletions(-) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index b4f0b7c38c..83bce338d8 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -203,7 +203,7 @@ different Kubernetes components. | `WinDSR` | `false` | Alpha | 1.14 | | | `WinOverlay` | `false` | Alpha | 1.14 | 1.19 | | `WinOverlay` | `true` | Beta | 1.20 | | -| `WindowsHostProcessContainers` | `false` | Alpha | 1.22 | | +| `WindowsHostProcessContainers` | `false` | Beta | 1.23 | | {{< /table >}} ### Feature gates for graduated or deprecated features diff --git a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md index 2ab2bd3661..0c33c79552 100644 --- a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md +++ b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md @@ -7,102 +7,84 @@ min-kubernetes-server-version: 1.22 -{{< feature-state for_k8s_version="v1.22" state="alpha" >}} +{{< feature-state for_k8s_version="v1.23" state="beta" >}} -Windows HostProcess containers enable you to run containerized -workloads on a Windows host. These containers operate as -normal processes but have access to the host network namespace, -storage, and devices when given the appropriate user privileges. +Windows HostProcess containers enable you to run containerized +workloads on a Windows host. These containers operate as +normal processes but have access to the host network namespace, +storage, and devices when given the appropriate user privileges. HostProcess containers can be used to deploy network plugins, -storage configurations, device plugins, kube-proxy, and other -components to Windows nodes without the need for dedicated proxies or +storage configurations, device plugins, kube-proxy, and other +components to Windows nodes without the need for dedicated proxies or the direct installation of host services. -Administrative tasks such as installation of security patches, event -log collection, and more can be performed without requiring cluster operators to -log onto each Window node. HostProcess containers can run as any user that is -available on the host or is in the domain of the host machine, allowing administrators -to restrict resource access through user permissions. While neither filesystem or process -isolation are supported, a new volume is created on the host upon starting the container -to give it a clean and consolidated workspace. HostProcess containers can also be built on -top of existing Windows base images and do not inherit the same -[compatibility requirements](https://docs.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility) -as Windows server containers, meaning that the version of the base images does not need -to match that of the host. HostProcess containers also support +Administrative tasks such as installation of security patches, event +log collection, and more can be performed without requiring cluster operators to +log onto each Window node. HostProcess containers can run as any user that is +available on the host or is in the domain of the host machine, allowing administrators +to restrict resource access through user permissions. While neither filesystem or process +isolation are supported, a new volume is created on the host upon starting the container +to give it a clean and consolidated workspace. HostProcess containers can also be built on +top of existing Windows base images and do not inherit the same +[compatibility requirements](https://docs.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility) +as Windows server containers, meaning that the version of the base images does not need +to match that of the host. It is, however, recommended that you use the same base image +version as your Windows Server container workloads to ensure you do not have any unused +images taking up space on the node. HostProcess containers also support [volume mounts](./create-hostprocess-pod#volume-mounts) within the container volume. ### When should I use a Windows HostProcess container? -- When you need to perform tasks which require the networking namespace of the host. +- When you need to perform tasks which require the networking namespace of the host. HostProcess containers have access to the host's network interfaces and IP addresses. - You need access to resources on the host such as the filesystem, event logs, etc. - Installation of specific device drivers or Windows services. -- Consolidation of administrative tasks and security policies. This reduces the degree of +- Consolidation of administrative tasks and security policies. This reduces the degree of privileges needed by Windows nodes. -## {{% heading "prerequisites" %}} +## {{% heading "prerequisites" %}}% version-check %}} -{{% version-check %}} +In 1.23 the HostProcess container feature is enabled by default. The kublet will +communicate with containerd directly by passing the hostprocess flag via CRI. You can use the +latest version of containerd (v1.6+) to run HostProcess containers. +[How to install containerd.](/docs/setup/production-environment/container-runtimes/#containerd) -To enable HostProcess containers while in Alpha you need to pass the following feature gate flag to -**kubelet** and **kube-apiserver**. -See [Features Gates](/docs/reference/command-line-tools-reference/feature-gates/#overview) +To *disable* HostProcess containers you need to pass the following feature gate flag to the +**kubelet** and **kube-apiserver**: + +```powershell +--feature-gates=WindowsHostProcessContainers=false +``` + +See [Features Gates](/docs/reference/command-line-tools-reference/feature-gates/#overview) documentation for more details. -``` ---feature-gates=WindowsHostProcessContainers=true -``` -You can use the latest version of Containerd (v1.5.4+) with the following settings using the containerd -v2 configuration. Add these annotations to any runtime configurations were you wish to enable the -HostProcess container feature. - - -``` -[plugins] - [plugins."io.containerd.grpc.v1.cri"] - [plugins."io.containerd.grpc.v1.cri".containerd] - [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime] - container_annotations = ["microsoft.com/hostprocess-container"] - pod_annotations = ["microsoft.com/hostprocess-container"] - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes] - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runhcs-wcow-process] - container_annotations = ["microsoft.com/hostprocess-container"] - pod_annotations = ["microsoft.com/hostprocess-container"] -``` - -The current versions of containerd ship with a version of hcsshim that does not have support. -You will need to build a version of hcsshim from the main branch following the -[instructions in hcsshim](https://github.com/Microsoft/hcsshim/#containerd-shim). -Once the containerd shim is built you can replace the file in your contianerd installation. -For example if you followed the instructions to -[install containerd](/docs/setup/production-environment/container-runtimes/#containerd) -replace the `containerd-shim-runhcs-v1.exe` is installed at `$Env:ProgramFiles\containerd` with the newly built shim. ## Limitations -- HostProcess containers require version 1.5.4 or higher of the containerd {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}. -- As of v1.22 HostProcess pods can only contain HostProcess containers. This is a current limitation +- HostProcess containers require containerd 1.6 or higher +{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}. +- As of v1.23 HostProcess pods can only contain HostProcess containers. This is a current limitation of the Windows OS; non-privileged Windows containers cannot share a vNIC with the host IP namespace. -- HostProcess containers run as a process on the host and do not have any degree of -isolation other than resource constraints imposed on the HostProcess user account. Neither +- HostProcess containers run as a process on the host and do not have any degree of +isolation other than resource constraints imposed on the HostProcess user account. Neither filesystem or Hyper-V isolation are supported for HostProcess containers. -- Volume mounts are supported and are mounted under the container volume. -See [Volume Mounts](#volume-mounts) -- A limited set of host user accounts are available for HostProcess containers by default. +- Volume mounts are supported and are mounted under the container volume. See [Volume Mounts](#volume-mounts) +- As of 1.23, a limited set of host user accounts are available for HostProcess containers by default. See [Choosing a User Account](#choosing-a-user-account). -- Resource limits (disk, memory, cpu count) are supported in the same fashion as processes +- Resource limits (disk, memory, cpu count) are supported in the same fashion as processes on the host. -- Both Named pipe mounts and Unix domain sockets are **not** currently supported and should instead +- Both Named pipe mounts and Unix domain sockets are **not** currently supported and should instead be accessed via their path on the host (e.g. \\\\.\\pipe\\\*) ## HostProcess Pod configuration requirements -Enabling a Windows HostProcess pod requires setting the right configurations in the pod security -configuration. Of the policies defined in the [Pod Security Standards](/docs/concepts/security/pod-security-standards) -HostProcess pods are disallowed by the baseline and restricted policies. It is therefore recommended -that HostProcess pods run in alignment with the privileged profile. +Enabling a Windows HostProcess pod requires setting the right configurations in the pod security +configuration. Of the policies defined in the [Pod Security Standards](/docs/concepts/security/pod-security-standards) +HostProcess pods are disallowed by the baseline and restricted policies. It is therefore recommended +that HostProcess pods run in alignment with the privileged profile. When running under the privileged policy, here are the configurations which need to be set to enable the creation of a HostProcess pod: @@ -185,10 +167,10 @@ spec: ## Volume Mounts -HostProcess containers support the ability to mount volumes within the container volume space. -Applications running inside the container can access volume mounts directly via relative or -absolute paths. An environment variable `$CONTAINER_SANDBOX_MOUNT_POINT` is set upon container -creation and provides the absolute host path to the container volume. Relative paths are based +HostProcess containers support the ability to mount volumes within the container volume space. +Applications running inside the container can access volume mounts directly via relative or +absolute paths. As of v1.23, an environment variable `$CONTAINER_SANDBOX_MOUNT_POINT` is set upon container +creation and provides the absolute host path to the container volume. Relative paths are based upon the `Pod.containers.volumeMounts.mountPath` configuration. ### Example {#volume-mount-example} @@ -199,13 +181,22 @@ To access service account tokens the following path structures are supported wit `$CONTAINER_SANDBOX_MOUNT_POINT\var\run\secrets\kubernetes.io\serviceaccount\` +## Resource Limits + +Resource limits (disk, memory, cpu count) are applied to the job and are job wide. +For example, with a limit of 10MB set, the memory allocated for any HostProcess job object +will be capped at 10MB. This is the same behavior as other Windows container types. +These limits would be specified the same way they are currently for whatever orchestrator +or runtime is being used. The only difference is in the disk resource usage calculation +used for resource tracking due to the difference in how HostProcess containers are bootstrapped. + ## Choosing a User Account -HostProcess containers support the ability to run as one of three supported Windows service accounts: +As of 1.23, HostProcess containers support the ability to run as one of three supported Windows service accounts: -- **[LocalSystem](https://docs.microsoft.com/en-us/windows/win32/services/localsystem-account)** -- **[LocalService](https://docs.microsoft.com/en-us/windows/win32/services/localservice-account)** -- **[NetworkService](https://docs.microsoft.com/en-us/windows/win32/services/networkservice-account)** +- **[LocalSystem](https://docs.microsoft.com/windows/win32/services/localsystem-account)** +- **[LocalService](https://docs.microsoft.com/windows/win32/services/localservice-account)** +- **[NetworkService](https://docs.microsoft.com/windows/win32/services/networkservice-account)** You should select an appropriate Windows service account for each HostProcess container, aiming to limit the degree of privileges so as to avoid accidental (or even From 0cbedcfeedf1354176bddc73f1da6a62af939e50 Mon Sep 17 00:00:00 2001 From: Ayushman Mishra Date: Wed, 1 Dec 2021 18:22:19 +0530 Subject: [PATCH 094/148] changes made Signed-off-by: Ayushman Mishra changes Signed-off-by: Ayushman Mishra --- content/en/docs/concepts/extend-kubernetes/_index.md | 2 +- content/en/docs/concepts/storage/persistent-volumes.md | 4 ++-- content/en/docs/reference/glossary/flexvolume.md | 4 ++-- .../tools/kubeadm/troubleshooting-kubeadm.md | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/content/en/docs/concepts/extend-kubernetes/_index.md b/content/en/docs/concepts/extend-kubernetes/_index.md index edb550bbed..35669cc955 100644 --- a/content/en/docs/concepts/extend-kubernetes/_index.md +++ b/content/en/docs/concepts/extend-kubernetes/_index.md @@ -163,7 +163,7 @@ After a request is authorized, if it is a write operation, it also goes through ) allow users to mount volume types without built-in support by having the Kubelet call a Binary Plugin to mount the volume. -FlexVolume is deprecated in v1.23. Out-of-tree CSI driver is the recommended way to write volume drivers in Kubernetes. See this doc [here](https://github.com/kubernetes/community/blob/master/sig-storage/volume-plugin-faq.md#kubernetes-volume-plugin-faq-for-storage-vendors) for more information. +FlexVolume is deprecated since Kubernetes v1.23. The Out-of-tree CSI driver is the recommended way to write volume drivers in Kubernetes. See [Kubernetes Volume Plugin FAQ for Storage Vendors](https://github.com/kubernetes/community/blob/master/sig-storage/volume-plugin-faq.md#kubernetes-volume-plugin-faq-for-storage-vendors) for more information. ### Device Plugins diff --git a/content/en/docs/concepts/storage/persistent-volumes.md b/content/en/docs/concepts/storage/persistent-volumes.md index 8e8a6241ca..b5a6f234b0 100644 --- a/content/en/docs/concepts/storage/persistent-volumes.md +++ b/content/en/docs/concepts/storage/persistent-volumes.md @@ -318,8 +318,6 @@ PersistentVolume types are implemented as plugins. Kubernetes currently supports * [`cephfs`](/docs/concepts/storage/volumes/#cephfs) - CephFS volume * [`csi`](/docs/concepts/storage/volumes/#csi) - Container Storage Interface (CSI) * [`fc`](/docs/concepts/storage/volumes/#fc) - Fibre Channel (FC) storage -* [`flexVolume`](/docs/concepts/storage/volumes/#flexvolume) - FlexVolume - (**deprecated** in v1.23) * [`gcePersistentDisk`](/docs/concepts/storage/volumes/#gcepersistentdisk) - GCE Persistent Disk * [`glusterfs`](/docs/concepts/storage/volumes/#glusterfs) - Glusterfs volume * [`hostPath`](/docs/concepts/storage/volumes/#hostpath) - HostPath volume @@ -335,6 +333,8 @@ PersistentVolume types are implemented as plugins. Kubernetes currently supports The following types of PersistentVolume are deprecated. This means that support is still available but will be removed in a future Kubernetes release. +* [`flexVolume`](/docs/concepts/storage/volumes/#flexvolume) - FlexVolume + (**deprecated** in v1.23) * [`cinder`](/docs/concepts/storage/volumes/#cinder) - Cinder (OpenStack block storage) (**deprecated** in v1.18) * [`flocker`](/docs/concepts/storage/volumes/#flocker) - Flocker storage diff --git a/content/en/docs/reference/glossary/flexvolume.md b/content/en/docs/reference/glossary/flexvolume.md index aa885000c8..1f54e4dc68 100644 --- a/content/en/docs/reference/glossary/flexvolume.md +++ b/content/en/docs/reference/glossary/flexvolume.md @@ -4,14 +4,14 @@ id: flexvolume date: 2018-06-25 full_link: /docs/concepts/storage/volumes/#flexvolume short_description: > - FlexVolume is an interface for creating out-of-tree volume plugins. It is deprecated in v1.23. The {{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}} is a newer interface which addresses several problems with FlexVolumes. + FlexVolume is a deprecated interface for creating out-of-tree volume plugins. The {{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}} is a newer interface that addresses several problems with FlexVolume. aka: tags: - storage --- - FlexVolume is an interface for creating out-of-tree volume plugins. It is deprecated in v1.23. The {{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}} is a newer interface which addresses several problems with FlexVolumes. + FlexVolume is a deprecated interface for creating out-of-tree volume plugins. The {{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}} is a newer interface that addresses several problems with FlexVolume. diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md index 25a2e64815..9108ecafcd 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md @@ -375,7 +375,7 @@ For [flex-volume support](https://github.com/kubernetes/community/blob/ab55d85/c Kubernetes components like the kubelet and kube-controller-manager use the default path of `/usr/libexec/kubernetes/kubelet-plugins/volume/exec/`, yet the flex-volume directory _must be writeable_ for the feature to work. -(**Note** FlexVolume is deprecated in v1.23) +(**Note**: FlexVolume was deprecated in the Kubernetes v1.23 release) To workaround this issue you can configure the flex-volume directory using the kubeadm [configuration file](/docs/reference/config-api/kubeadm-config.v1beta3/). From 5b375a6c70e89a5f514c8767adab4895e41f0535 Mon Sep 17 00:00:00 2001 From: Deepak Kinni Date: Thu, 18 Nov 2021 10:57:11 -0800 Subject: [PATCH 095/148] Doc: Add blogpost for honor PV reclaim policy fix Signed-off-by: Deepak Kinni --- ...volume-leaks-when-deleting-out-of-order.md | 199 ++++++++++++++++++ 1 file changed, 199 insertions(+) create mode 100644 content/en/blog/_posts/2021-11-18-prevent-persistentvolume-leaks-when-deleting-out-of-order.md diff --git a/content/en/blog/_posts/2021-11-18-prevent-persistentvolume-leaks-when-deleting-out-of-order.md b/content/en/blog/_posts/2021-11-18-prevent-persistentvolume-leaks-when-deleting-out-of-order.md new file mode 100644 index 0000000000..2d55cb4b77 --- /dev/null +++ b/content/en/blog/_posts/2021-11-18-prevent-persistentvolume-leaks-when-deleting-out-of-order.md @@ -0,0 +1,199 @@ +--- +layout: blog +title: "Kubernetes 1.23 Prevent PersistentVolume leaks when deleting out of order" +date: 2021-12-15T10:00:00-08:00 +slug: kubernetes-1-23-prevent-persistentvolume-leaks-when-deleting-out-of-order +--- + +**Author:** Deepak Kinni (VMware) + +[PersistentVolume](/docs/concepts/storage/persistent-volumes/) (or PVs for short) are +associated with [Reclaim Policy](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#reclaim-policy). +The Reclaim Policy is used to determine the actions that need to be taken by the storage +backend on deletion of the PV. +Where the reclaim policy is `Delete`, the expectation is that the storage backend +releases the storage resource that was allocated for the PV. In essence, the reclaim +policy needs to honored on PV deletion. + +With the recent Kubernetes v1.23 release, an alpha feature lets you configure your +cluster to behave that way and honor the configured reclaim policy. + + +## How did reclaim work in previous Kubernetes releases? + +[PersistentVolumeClaim](/docs/concepts/storage/persistent-volumes/#Introduction) (or PVC for short) is +a request for storage by a user. A PV and PVC are considered [Bound](/docs/concepts/storage/persistent-volumes/#Binding) +if there is a newly created PV or a matching PV is found. The PVs themselves are +backed by a volume allocated by the storage backend. + +Normally, if the volume is to be deleted, then the expectation is to delete the +PVC for a bound PV-PVC pair. However, there are no restrictions to delete a PV +prior to deleting a PVC. + +First, I'll demonstrate the behavior for clusters that are running an older version of Kubernetes. + +#### Retrieve an PVC that is bound to a PV + +Retrieve an existing PVC `example-vanilla-block-pvc` +``` +kubectl get pvc example-vanilla-block-pvc +``` +The following output shows the PVC and it's `Bound` PV, the PV is shown under the `VOLUME` column: +``` +NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE +example-vanilla-block-pvc Bound pvc-6791fdd4-5fad-438e-a7fb-16410363e3da 5Gi RWO example-vanilla-block-sc 19s +``` + +#### Delete PV + +When I try to delete a bound PV, the cluster blocks and the `kubectl` tool does +not return back control to the shell; for example: + +``` +kubectl delete pv pvc-6791fdd4-5fad-438e-a7fb-16410363e3da +``` + +``` +persistentvolume "pvc-6791fdd4-5fad-438e-a7fb-16410363e3da" deleted +^C +``` + +Retrieving the PV: +``` +kubectl get pv pvc-6791fdd4-5fad-438e-a7fb-16410363e3da +``` + +It can be observed that the PV is in `Terminating` state +``` +NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE +pvc-6791fdd4-5fad-438e-a7fb-16410363e3da 5Gi RWO Delete Terminating default/example-vanilla-block-pvc example-vanilla-block-sc 2m23s +``` + +#### Delete PVC + +``` +kubectl delete pvc example-vanilla-block-pvc +``` + +The following output is seen if the PVC gets successfully deleted: +``` +persistentvolumeclaim "example-vanilla-block-pvc" deleted +``` + +The PV object from the cluster also gets deleted. When attempting to retrieve the PV +it will be observed that the PV is no longer found: + +``` +kubectl get pv pvc-6791fdd4-5fad-438e-a7fb-16410363e3da +``` + +``` +Error from server (NotFound): persistentvolumes "pvc-6791fdd4-5fad-438e-a7fb-16410363e3da" not found +``` + +Although the PV is deleted the underlying storage resource is not deleted, and +needs to be removed manually. + +To sum it up, the reclaim policy associated with the Persistent Volume is currently +ignored under certain circumstance. For a `Bound` PV-PVC pair the ordering of PV-PVC +deletion determines whether the PV reclaim policy is honored. The reclaim policy +is honored if the PVC is deleted first, however, if the PV is deleted prior to +deleting the PVC then the reclaim policy is not exercised. As a result of this behavior, +the associated storage asset in the external infrastructure is not removed. + +## PV reclaim policy with Kubernetes v1.23 + +The new behavior ensures that the underlying storage object is deleted from the backend when users attempt to delete a PV manually. + +#### How to enable new behavior? + +To make use of the new behavior, you must have upgraded your cluster to the v1.23 release of Kubernetes. +You need to make sure that you are running the CSI [`external-provisioner`](https://github.com/kubernetes-csi/external-provisioner) version `4.0.0`, or later. +You must also enable the `HonorPVReclaimPolicy` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) for the +`external-provisioner` and for the `kube-controller-manager`. + +If you're not using a CSI driver to integrate with your storage backend, the fix isn't +available. The Kubernetes project doesn't have a current plan to fix the bug for in-tree +storage drivers: the future of those in-tree drivers is deprecation and migration to CSI. + +#### How does it work? + +The new behavior is achieved by adding a finalizer `external-provisioner.volume.kubernetes.io/finalizer` on new and existing PVs, the finalizer is only removed after the storage from backend is deleted. + +An example of a PV with the finalizer, notice the new finalizer in the finalizers list + +``` +kubectl get pv pvc-a7b7e3ba-f837-45ba-b243-dec7d8aaed53 -o yaml +``` + +```yaml +apiVersion: v1 +kind: PersistentVolume +metadata: + annotations: + pv.kubernetes.io/provisioned-by: csi.vsphere.vmware.com + creationTimestamp: "2021-11-17T19:28:56Z" + finalizers: + - kubernetes.io/pv-protection + - external-provisioner.volume.kubernetes.io/finalizer + name: pvc-a7b7e3ba-f837-45ba-b243-dec7d8aaed53 + resourceVersion: "194711" + uid: 087f14f2-4157-4e95-8a70-8294b039d30e +spec: + accessModes: + - ReadWriteOnce + capacity: + storage: 1Gi + claimRef: + apiVersion: v1 + kind: PersistentVolumeClaim + name: example-vanilla-block-pvc + namespace: default + resourceVersion: "194677" + uid: a7b7e3ba-f837-45ba-b243-dec7d8aaed53 + csi: + driver: csi.vsphere.vmware.com + fsType: ext4 + volumeAttributes: + storage.kubernetes.io/csiProvisionerIdentity: 1637110610497-8081-csi.vsphere.vmware.com + type: vSphere CNS Block Volume + volumeHandle: 2dacf297-803f-4ccc-afc7-3d3c3f02051e + persistentVolumeReclaimPolicy: Delete + storageClassName: example-vanilla-block-sc + volumeMode: Filesystem +status: + phase: Bound +``` + +The presence of the finalizer prevents the PV object from being removed from the +cluster. As stated previously, the finalizer is only removed from the PV object +after it is successfully deleted from the storage backend. To learn more about +finalizers, please refer to [Using Finalizers to Control Deletion](/blog/2021/05/14/using-finalizers-to-control-deletion/). + +#### What about CSI migrated volumes? + +The fix is applicable to CSI migrated volumes as well. However, when the feature +`HonorPVReclaimPolicy` is enabled on 1.23, and CSI Migration is disabled, the finalizer +is removed from the PV object if it exists. + +### Some caveats + +1. The fix is applicable only to CSI volumes and migrated volumes. In-tree volumes will exhibit older behavior. +2. The fix is introduced as an alpha feature in the [external-provisioner](https://github.com/kubernetes-csi/external-provisioner) under the feature gate `HonorPVReclaimPolicy`. The feature is disabled by default, and needs to be enabled explicitly. + +### References + +* [KEP-2644](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/2644-honor-pv-reclaim-policy) +* [Volume leak issue](https://github.com/kubernetes-csi/external-provisioner/issues/546) + +### How do I get involved? + +The Kubernetes Slack channel [SIG Storage communication channels](https://github.com/kubernetes/community/blob/master/sig-storage/README.md#contact) are great mediums to reach out to the SIG Storage and migration working group teams. + +Special thanks to the following people for the insightful reviews, thorough consideration and valuable contribution: + +* Jan Šafránek (jsafrane) +* Xing Yang (xing-yang) +* Matthew Wong (wongma7) + +Those interested in getting involved with the design and development of CSI or any part of the Kubernetes Storage system, join the [Kubernetes Storage Special Interest Group (SIG)](https://github.com/kubernetes/community/tree/master/sig-storage). We’re rapidly growing and always welcome new contributors. \ No newline at end of file From 3797c338a70d1cf9ae9fda1d941ebc6cd00f99a0 Mon Sep 17 00:00:00 2001 From: Sergey Kanzhelev Date: Wed, 1 Dec 2021 18:57:07 +0000 Subject: [PATCH 096/148] grpc field name consistency --- content/en/examples/pods/probe/grpc-liveness.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/examples/pods/probe/grpc-liveness.yaml b/content/en/examples/pods/probe/grpc-liveness.yaml index 84d716df28..578fd080a4 100644 --- a/content/en/examples/pods/probe/grpc-liveness.yaml +++ b/content/en/examples/pods/probe/grpc-liveness.yaml @@ -10,6 +10,6 @@ spec: ports: - containerPort: 2379 livenessProbe: - gRPC: + grpc: port: 2379 initialDelaySeconds: 10 From 40e06a6fdb055c8df1f1d362b1d1b2d12f934924 Mon Sep 17 00:00:00 2001 From: Matthew Cary Date: Thu, 3 Jun 2021 09:39:09 -0700 Subject: [PATCH 097/148] KEP 1847 Statefulset auto-delete documentation --- .../workloads/controllers/statefulset.md | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) diff --git a/content/en/docs/concepts/workloads/controllers/statefulset.md b/content/en/docs/concepts/workloads/controllers/statefulset.md index 5197fe4f20..0778242518 100644 --- a/content/en/docs/concepts/workloads/controllers/statefulset.md +++ b/content/en/docs/concepts/workloads/controllers/statefulset.md @@ -301,6 +301,84 @@ already attempted to run with the bad configuration. StatefulSet will then begin to recreate the Pods using the reverted template. +## PersistentVolumeClaim retention + +{{< feature-state for_k8s_version="v1.23" state="alpha" >}} + +The optional `.spec.persistentVolumeClaimRetentionPolicy` field controls if +and how PVCs are deleted during the lifecycle of a StatefulSet. You must enable the +`StatefulSetAutoDeletePVC` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) +to use this field. Once enabled, there are two policies you can configure for each +StatefulSet: + +`whenDeleted` +: configures the volume retention behavior that applies when the StatefulSet is deleted + +`whenScaled` +: configures the volume retention behavior that applies when the replica count of + the StatefulSet is reduced; for example, when scaling down the set. + +For each policy that you can configure, you can set the value to either `Delete` or `Retain`. + +`Delete` +: The PVCs created from the StatefulSet `volumeClaimTemplate` are deleted for each Pod + affected by the policy. With the `whenDeleted` policy all PVCs from the + `volumeClaimTemplate` are deleted after their Pods have been deleted. With the + `whenScaled` policy, only PVCs corresponding to Pod replicas being scaled down are + deleted, after their Pods have been deleted. + +`Retain` (default) +: PVCs from the `volumeClaimTemplate` are not affected when their Pod is + deleted. This is the behavior before this new feature. + +Bear in mind that these policies **only** apply when Pods are being removed due to the +StatefulSet being deleted or scaled down. For example, if a Pod associated with a StatefulSet +fails due to node failure, and the control plane creates a replacement Pod, the StatefulSet +retains the existing PVC. The existing volume is unaffected, and the cluster will attach it to +the node where the new Pod is about to launch. + +The default for policies is `Retain`, matching the StatefulSet behavior before this new feature. + +Here is an example policy. + +```yaml +apiVersion: apps/v1 +kind: StatefulSet +... +spec: + persistentVolumeClaimRetentionPolicy: + whenDeleted: Retain + whenScaled: Delete +... +``` + +The StatefulSet {{}} adds [owner +references](/docs/concepts/overview/working-with-objects/owners-dependents/#owner-references-in-object-specifications) +to its PVCs, which are then deleted by the {{}} after the Pod is terminated. This enables the Pod to +cleanly unmount all volumes before the PVCs are deleted (and before the backing PV and +volume are deleted, depending on the retain policy). When you set the `whenDeleted` +policy to `Delete`, an owner reference to the StatefulSet instance is placed on all PVCs +associated with that StatefulSet. + +The `whenScaled` policy must delete PVCs only when a Pod is scaled down, and not when a +Pod is deleted for another reason. When reconciling, the StatefulSet controller compares +its desired replica count to the actual Pods present on the cluster. Any StatefulSet Pod +whose id greater than the replica count is condemned and marked for deletion. If the +`whenScaled` policy is `Delete`, the condemned Pods are first set as owners to the +associated StatefulSet template PVCs, before the Pod is deleted. This causes the PVCs +to be garbage collected after only the condemned Pods have terminated. + +This means that if the controller crashes and restarts, no Pod will be deleted before its +owner reference has been updated appropriate to the policy. If a condemned Pod is +force-deleted while the controller is down, the owner reference may or may not have been +set up, depending on when the controller crashed. It may take several reconcile loops to +update the owner references, so some condemned Pods may have set up owner references and +other may not. For this reason we recommend waiting for the controller to come back up, +which will verify owner references before terminating Pods. If that is not possible, the +operator should verify the owner references on PVCs to ensure the expected objects are +deleted when Pods are force-deleted. + ## {{% heading "whatsnext" %}} * Learn about [Pods](/docs/concepts/workloads/pods). From 94e62c43bf56fe4772c93a272866313186c3b24b Mon Sep 17 00:00:00 2001 From: David Porter Date: Tue, 23 Nov 2021 12:05:09 -0800 Subject: [PATCH 098/148] docs: Pod priority based graceful node shutdown Signed-off-by: David Porter --- .../en/docs/concepts/architecture/nodes.md | 98 +++++++++++++++++-- 1 file changed, 91 insertions(+), 7 deletions(-) diff --git a/content/en/docs/concepts/architecture/nodes.md b/content/en/docs/concepts/architecture/nodes.md index a57d47219e..4b3ee0e1aa 100644 --- a/content/en/docs/concepts/architecture/nodes.md +++ b/content/en/docs/concepts/architecture/nodes.md @@ -424,20 +424,104 @@ for gracefully terminating normal pods, and the last 10 seconds would be reserved for terminating [critical pods](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical). {{< note >}} -When pods were evicted during the graceful node shutdown, they are marked as failed. -Running `kubectl get pods` shows the status of the the evicted pods as `Shutdown`. +When pods were evicted during the graceful node shutdown, they are marked as shutdown. +Running `kubectl get pods` shows the status of the the evicted pods as `Terminated`. And `kubectl describe pod` indicates that the pod was evicted because of node shutdown: ``` -Status: Failed -Reason: Shutdown -Message: Node is shutting, evicting pods +Reason: Terminated +Message: Pod was terminated in response to imminent node shutdown. ``` -Failed pod objects will be preserved until explicitly deleted or [cleaned up by the GC](/docs/concepts/workloads/pods/pod-lifecycle/#pod-garbage-collection). -This is a change of behavior compared to abrupt node termination. {{< /note >}} +### Pod Priority based graceful node shutdown {#pod-priority-graceful-node-shutdown} + +{{< feature-state state="alpha" for_k8s_version="v1.23" >}} + +To provide more flexibility during graceful node shutdown around the ordering +of pods during shutdown, graceful node shutdown honors the PriorityClass for +Pods, provided that you enabled this feature in your cluster. The feature +allows allows cluster administers to explicitly define the ordering of pods +during graceful node shutdown based on [priority +classes](docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass). + +The [Graceful Node Shutdown](#graceful-node-shutdown) feature, as described +above, shuts down pods in two phases, non-critical pods, followed by critical +pods. If additional flexibility is needed to explicitly define the ordering of +pods during shutdown in a more granular way, pod priority based graceful +shutdown can be used. + +When graceful node shutdown honors pod priorities, this makes it possible to do +graceful node shutdown in multiple phases, each phase shutting down a +particular priority class of pods. The kubelet can be configured with the exact +phases and shutdown time per phase. + +Assuming the following custom pod [priority +classes](docs/concepts/scheduling-eviction/pod-priority-preemption/#priorityclass) +in a cluster, + +|Pod priority class name|Pod priority class value| +|-------------------------|------------------------| +|`custom-class-a` | 100000 | +|`custom-class-b` | 10000 | +|`custom-class-c` | 1000 | +|`regular/unset` | 0 | + +Within the [kubelet configuration](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) +the settings for `shutdownGracePeriodByPodPriority` could look like: + +|Pod priority class value|Shutdown period| +|------------------------|---------------| +| 100000 |10 seconds | +| 10000 |180 seconds | +| 1000 |120 seconds | +| 0 |60 seconds | + +The corresponding kubelet config YAML configuration would be: + +```yaml +shutdownGracePeriodByPodPriority: + - priority: 100000 + shutdownGracePeriodSeconds: 10 + - priority: 10000 + shutdownGracePeriodSeconds: 180 + - priority: 1000 + shutdownGracePeriodSeconds: 120 + - priority: 0 + shutdownGracePeriodSeconds: 60 +``` + +The above table implies that any pod with priority value >= 100000 will get +just 10 seconds to stop, any pod with value >= 10000 and < 100000 will get 180 +seconds to stop, any pod with value >= 1000 and < 10000 will get 120 seconds to stop. +Finally, all other pods will get 60 seconds to stop. + +One doesn't have to specify values corresponding to all of the classes. For +example, you could instead use these settings: + +|Pod priority class value|Shutdown period| +|------------------------|---------------| +| 100000 |300 seconds | +| 1000 |120 seconds | +| 0 |60 seconds | + + +In the above case, the pods with custom-class-b will go into the same bucket +as custom-class-c for shutdown. + +If there are no pods in a particular range, then the kubelet does not wait +for pods in that priority range. Instead, the kubelet immediately skips to the +next priority class value range. + +If this feature is enabled and no configuration is provided, then no ordering +action will be taken. + +Using this feature, requires enabling the +`GracefulNodeShutdownBasedOnPodPriority` feature gate, and setting the kubelet +config's `ShutdownGracePeriodByPodPriority` to the desired configuration +containing the pod priority class values and their respective shutdown periods. + ## Swap memory management {#swap-memory} {{< feature-state state="alpha" for_k8s_version="v1.22" >}} From 4a7a977901b668a069ec573d36b6ac60fbbeb6f9 Mon Sep 17 00:00:00 2001 From: Guneetconvent2002 Date: Mon, 13 Sep 2021 17:59:53 +0530 Subject: [PATCH 099/148] Fix headings for well-known labels annotations and taints Co-authored-by: Qiming Teng Co-authored-by: Tim Bannister --- .../reference/labels-annotations-taints.md | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/content/en/docs/reference/labels-annotations-taints.md b/content/en/docs/reference/labels-annotations-taints.md index e2fc2b317e..325bfc2d9f 100644 --- a/content/en/docs/reference/labels-annotations-taints.md +++ b/content/en/docs/reference/labels-annotations-taints.md @@ -427,8 +427,18 @@ or updating objects that contain Pod templates, such as Deployments, Jobs, State See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## seccomp.security.alpha.kubernetes.io/pod and container.seccomp.security.alpha.kubernetes.io/[NAME] (deprecated) +## seccomp.security.alpha.kubernetes.io/pod (deprecated) {#seccomp-security-alpha-kubernetes-io-pod} -The seccomp annotations have been deprecated since Kubernetes v1.19 and will -become non-functional in v1.25. Please use the `seccompProfile` of the -`SecurityContext` instead. \ No newline at end of file +This annotation has been deprecated since Kubernetes v1.19 and will become non-functional in v1.25. +To specify security settings for a Pod, include the `securityContext` field in the Pod specification. +The [`securityContext`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context) field within a Pod's `.spec` defines pod-level security attributes. +When you [specify the security context for a Pod](/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod), +the settings you specify apply to all containers in that Pod. + +## container.seccomp.security.alpha.kubernetes.io/[NAME] {#container-seccomp-security-alpha-kubernetes-io} + +This annotation has been deprecated since Kubernetes v1.19 and will become non-functional in v1.25. +The tutorial [Restrict a Container's Syscalls with seccomp](/docs/tutorials/clusters/seccomp/) takes +you through the steps you follow to apply a seccomp profile to a Pod or to one of +its containers. That tutorial covers the supported mechanism for configuring seccomp in Kubernetes, +based on setting `securityContext` within the Pod's `.spec`. \ No newline at end of file From 87f371ac8d67606be55fd6cbf6643b42e4769b66 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 1 Dec 2021 23:27:21 +0000 Subject: [PATCH 100/148] Fix typo --- .../reference/command-line-tools-reference/feature-gates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 17e28a42fe..2f788cae34 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -792,7 +792,7 @@ Each feature gate is designed for enabling/disabling a specific feature: and gracefully terminate pods running on the node. See [Graceful Node Shutdown](/docs/concepts/architecture/nodes/#graceful-node-shutdown) for more details. -- `GRPCContainerProbe`: Enables gPRC probe method for {Liveness,Readiness,Startup}Probe. See [Configure Liveness, Readiness and Startup Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-grpc-liveness-probe). +- `GRPCContainerProbe`: Enables the gRPC probe method for {Liveness,Readiness,Startup}Probe. See [Configure Liveness, Readiness and Startup Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-grpc-liveness-probe). - `HPAContainerMetrics`: Enable the `HorizontalPodAutoscaler` to scale based on metrics from individual containers in target pods. - `HPAScaleToZero`: Enables setting `minReplicas` to 0 for `HorizontalPodAutoscaler` From 4f96e391b4e921b6515e6c5adfe71ff379ad4e5c Mon Sep 17 00:00:00 2001 From: David Young Date: Thu, 2 Dec 2021 14:36:53 +1300 Subject: [PATCH 101/148] Fix auditing example Signed-off-by: David Young --- content/en/docs/tasks/debug-application-cluster/audit.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md index 6c4b433ca2..79e9b92216 100644 --- a/content/en/docs/tasks/debug-application-cluster/audit.md +++ b/content/en/docs/tasks/debug-application-cluster/audit.md @@ -147,7 +147,7 @@ If your cluster's control plane runs the kube-apiserver as a Pod, remember to mo to the location of the policy file and log file, so that audit records are persisted. For example: ```shell --audit-policy-file=/etc/kubernetes/audit-policy.yaml \ - --audit-log-path=/var/log/audit.log + --audit-log-path=/var/log/kubernetes/audit/audit.log ``` then mount the volumes: @@ -157,7 +157,7 @@ volumeMounts: - mountPath: /etc/kubernetes/audit-policy.yaml name: audit readOnly: true - - mountPath: /var/log/audit.log + - mountPath: /var/log/kubernetes/audit/ name: audit-log readOnly: false ``` @@ -172,8 +172,8 @@ and finally configure the `hostPath`: - name: audit-log hostPath: - path: /var/log/audit.log - type: FileOrCreate + path: /var/log/kubernetes/audit/ + type: DirectoryOrCreate ``` From d9f0097efd3f04daf4dc8f6f232242cc6021ffad Mon Sep 17 00:00:00 2001 From: dilyar85 Date: Mon, 20 Sep 2021 23:11:10 -0700 Subject: [PATCH 102/148] Blog: Using Admission Controllers to Detect Container Drift at Runtime Applied some wordsmithing Move attribution into the figure tag Address comment Add project open-source link and update content Address review from sftim Update future improvement section with current gaps to ideal K8s design Set release date to 2021-12-21 --- .../index.md | 105 + .../intro-illustration.png | Bin 0 -> 815531 bytes .../workflow-diagram.svg | 6902 +++++++++++++++++ 3 files changed, 7007 insertions(+) create mode 100644 content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/index.md create mode 100644 content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/intro-illustration.png create mode 100644 content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/workflow-diagram.svg diff --git a/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/index.md b/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/index.md new file mode 100644 index 0000000000..fda7be0401 --- /dev/null +++ b/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/index.md @@ -0,0 +1,105 @@ +--- +layout: blog +title: "Using Admission Controllers to Detect Container Drift at Runtime" +date: 2021-12-21 +slug: admission-controllers-for-container-drift +--- + +**Author:** Saifuding Diliyaer (Box) +{{< figure src="intro-illustration.png" alt="Introductory illustration" attr="Illustration by Munire Aireti" >}} + +At Box, we use Kubernetes (K8s) to manage hundreds of micro-services that enable Box to stream data at a petabyte scale. When it comes to the deployment process, we run [kube-applier](https://github.com/box/kube-applier) as part of the GitOps workflows with declarative configuration and automated deployment. Developers declare their K8s apps manifest into a Git repository that requires code reviews and automatic checks to pass, before any changes can get merged and applied inside our K8s clusters. With `kubectl exec` and other similar commands, however, developers are able to directly interact with running containers and alter them from their deployed state. This interaction could then subvert the change control and code review processes that are enforced in our CI/CD pipelines. Further, it allows such impacted containers to continue receiving traffic long-term in production. + +To solve this problem, we developed our own K8s component called [kube-exec-controller](https://github.com/box/kube-exec-controller) along with its corresponding [kubectl plugin](https://github.com/box/kube-exec-controller#kubectl-pi). They function together in detecting and terminating potentially mutated containers (caused by interactive kubectl commands), as well as revealing the interaction events directly to the target Pods for better visibility. + +## Admission control for interactive kubectl commands +Once a request is sent to K8s, it needs to be authenticated and authorized by the API server to proceed. Additionally, K8s has a separate layer of protection called [admission controllers](/docs/reference/access-authn-authz/admission-controllers/), which can intercept the request before an object is persisted in *etcd*. There are various predefined admission controls compiled into the API server binary (e.g. ResourceQuota to enforce hard resource usage limits per namespace). Besides, there are two dynamic admission controls named [MutatingAdmissionWebhook](/docs/reference/access-authn-authz/admission-controllers/#mutatingadmissionwebhook) and [ValidatingAdmissionWebhook](/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook), used for mutating or validating K8s requests respectively. The latter is what we adopted to detect container drift at runtime caused by interactive kubectl commands. This whole process can be divided into three steps as explained in detail below. + +### 1. Admit interactive kubectl command requests +First of all, we needed to enable a validating webhook that sends qualified requests to *kube-exec-controller*. To add the new validation mechanism applying to interactive kubectl commands specifically, we configured the webhook’s rules with resources as `[pods/exec, pods/attach]`, and operations as `CONNECT`. These rules tell the cluster's API server that all `exec` and `attach` requests should be subject to our admission control webhook. In the ValidatingAdmissionWebhook that we configured, we specified a `service` reference (could also be replaced with `url` that gives the location of the webhook) and `caBundle` to allow validating its X.509 certificate, both under the `clientConfig` stanza. + +Here is a short example of what our ValidatingWebhookConfiguration object looks like: +```yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: example-validating-webhook-config +webhooks: + - name: validate-pod-interaction.example.com + sideEffects: None + rules: + - apiGroups: ["*"] + apiVersions: ["*"] + operations: ["CONNECT"] + resources: ["pods/exec", "pods/attach"] + failurePolicy: Fail + clientConfig: + service: + # reference to kube-exec-controller service deployed inside the K8s cluster + name: example-service + namespace: kube-exec-controller + path: "/admit-pod-interaction" + caBundle: "{{VALUE}}" # PEM encoded CA bundle to validate kube-exec-controller's certificate + admissionReviewVersions: ["v1", "v1beta1"] +``` + +### 2. Label the target Pod with potentially mutated containers +Once a request of `kubectl exec` comes in, *kube-exec-controller* makes an internal note to label the associated Pod. The added labels mean that we can not only query all the affected Pods, but also enable the security mechanism to retrieve previously identified Pods, in case the controller service itself gets restarted. + +The admission control process cannot directly modify the targeted in its admission response. This is because the `pods/exec` request is against a subresource of the Pod API, and the API kind for that subresource is `PodExecOptions`. As a result, there is a separate process in *kube-exec-controller* that patches the labels asynchronously. The admission control always permits the `exec` request, then acts as a client of the K8s API to label the target Pod and to log related events. Developers can check whether their Pods are affected or not using `kubectl` or similar tools. For example: + +``` +$ kubectl get pod --show-labels +NAME READY STATUS RESTARTS AGE LABELS +test-pod 1/1 Running 0 2s box.com/podInitialInteractionTimestamp=1632524400,box.com/podInteractorUsername=username-1,box.com/podTTLDuration=1h0m0s + +$ kubectl describe pod test-pod +... +Events: +Type Reason Age    From                            Message +----       ------       ----   ----                            ------- +Warning PodInteraction 5s admission-controller-service Pod was interacted with 'kubectl exec' command by user 'username-1' initially at time 2021-09-24 16:00:00 -0800 PST +Warning PodInteraction 5s admission-controller-service Pod will be evicted at time 2021-09-24 17:00:00 -0800 PST (in about 1h0m0s). +``` + +### 3. Evict the target Pod after a predefined period +As you can see in the above event messages, the affected Pod is not evicted immediately. At times, developers might have to get into their running containers necessarily for debugging some live issues. Therefore, we define a time to live (TTL) of affected Pods based on the environment of clusters they are running. In particular, we allow a longer time in our dev clusters as it is more common to run `kubectl exec` or other interactive commands for active development. + +For our production clusters, we specify a lower time limit so as to avoid the impacted Pods serving traffic abidingly. The *kube-exec-controller* internally sets and tracks a timer for each Pod that matches the associated TTL. Once the timer is up, the controller evicts that Pod using K8s API. The eviction (rather than deletion) is to ensure service availability, since the cluster respects any configured [PodDisruptionBudget](/docs/concepts/workloads/pods/disruptions/) (PDB). Let's say if a user has defined *x* number of Pods as critical in their PDB, the eviction (as requested by *kube-exec-controller*) does not continue when the target workload has fewer than *x* Pods running. + +Here comes a sequence diagram of the entire workflow mentioned above:  +{{< figure src="workflow-diagram.svg" alt="Workflow Diagram" class="diagram-medium" >}} + +## A new kubectl plugin for better user experience +Our admission controller component works great for solving the container drift issue we had on the platform. It is also able to submit all related Events to the target Pod that has been affected. However, K8s clusters don't retain Events very long (the default retention period is one hour). We need to provide other ways for developers to get their Pod interaction activity. A [kubectl plugin](/docs/tasks/extend-kubectl/kubectl-plugins/) is a perfect choice for us to expose this information. We named our plugin `kubectl pi` (short for `pod-interaction`) and provide two subcommands: `get` and `extend`. + +When the `get` subcommand is called, the plugin checks the metadata attached by our admission controller and transfers it to human-readable information. Here is an example output from running `kubectl pi get`: + +``` +$ kubectl pi get test-pod +POD-NAME INTERACTOR POD-TTL EXTENSION EXTENSION-REQUESTER EVICTION-TIME +test-pod  username-1  1h0m0s   /          /                    2021-09-24 17:00:00 -0800 PST +``` + +The plugin can also be used to extend the TTL for a Pod that is marked for future eviction. This is useful in case developers need extra time to debug ongoing issues. To achieve this, a developer uses the `kubectl pi extend` subcommand, where the plugin patches the relevant *annotations* for the given Pod. These *annotations* include the duration and username who made the extension request for transparency (displayed in the table returned from the `kubectl pi get` command). + +Correspondingly, there is another webhook defined in *kube-exec-controller* which admits valid annotation updates. Once admitted, those updates reset the eviction timer of the target Pod as requested. An example of requesting the extension from the developer side would be: + +``` +$ kubectl pi extend test-pod --duration=30m +Successfully extended the termination time of pod/test-pod with a duration=30m +  +$ kubectl pi get test-pod +POD-NAME  INTERACTOR  POD-TTL  EXTENSION  EXTENSION-REQUESTER  EVICTION-TIME +test-pod  username-1  1h0m0s   30m        username-2           2021-09-24 17:30:00 -0800 PST +``` + +## Future improvement +Although our admission controller service works great in handling interactive requests to a Pod, it could as well evict the Pod while the actual commands are no-op in these requests. For instance, developers sometimes run `kubectl exec` merely to check their service logs stored on hosts. Nevertheless, the target Pods would still get bounced despite the state of their containers not changing at all. One of the improvements here could be adding the ability to distinguish the commands that are passed to the interactive requests, so that no-op commands should not always force a Pod eviction. However, this becomes challenging when developers get a shell to a running container and execute commands inside the shell, since they will no longer be visible to our admission controller service. + +Another item worth pointing out here is the choice of using K8s *labels* and *annotations*. In our design, we decided to have all immutable metadata attached as *labels* for better enforcing the immutability in our admission control. Yet some of these metadata could fit better as *annotations*. For instance, we had a label with the key `box.com/podInitialInteractionTimestamp` used to list all affected Pods in *kube-exec-controller* code, although its value would be unlikely to query for. As a more ideal design in the K8s world, a single *label* could be preferable in our case for identification with other metadata applied as *annotations* instead. + +## Summary +With the power of admission controllers, we are able to secure our K8s clusters by detecting potentially mutated containers at runtime, and evicting their Pods without affecting service availability. We also utilize kubectl plugins to provide flexibility of the eviction time and hence, bringing a better and more self-independent experience to service owners. We are proud to announce that we have open-sourced the whole project for the community to leverage in their own K8s clusters. Any contribution is more than welcomed and appreciated. You can find this project hosted on GitHub at https://github.com/box/kube-exec-controller + +*Special thanks to Ayush Sobti and Ethan Goldblum for their technical guidance on this project.* diff --git a/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/intro-illustration.png b/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/intro-illustration.png new file mode 100644 index 0000000000000000000000000000000000000000..c52b432b28dcbb02e7c9dfa75f365e6b5891a88a GIT binary patch literal 815531 zcmaHT1z4NU(r-&Cg;Jn+f#UA&R-E7jcZ$11aEcXoD-OZk-CA4<6bUXZ?h@QD{kP}4 zmwV3n;C-IFd9&G_otd4Po%wA-6yzk3UgN%g_UsuFKvER=?Ac4#XU|}9;Nc#h_)Hpj zKE6D61WE`$D<65k{rE<~SRG&@EBlP*@gDve%yYD7FMc<9{C^f?{tWh?`)AK69$%k5 zdy)10|9+YU^RG`|x@Nuj*F7xG?}p#t;BFr~(J)t5cT$&?;W4zeX834iYhcXaYHjzs z!81Nrp2u5jW2cWquGUsIjy$gXB>%MFdA$Gqn306&pC(S0{3PnK3Pd8d4#q?r3``76 zBm%FAh=}+cj7)fdqT+wQ{`iic#LUUbj)##E1OhRDSQ%^`Oc|NExw#pcSQuGY=pS3q zJG$98eRQR_aU}iI$-nv$HFh*~Ft>9ux3wYq-S0;OTW2SJ5|ZBo{m?zg|6i_Td>oR7lzN`CglO9NBb2KFA?`XpmF12sYA zgW*u=VBs_(>Vfy&wGP1rTXhDHo6V}v-LgPNASXK0^Z$PN8cJlj?TPO_PyK}O<-cEK z&k=Py;3@QB{_ABYgP?vyF!5^hXJl^Fvr2bKqp$}jE zKsXuT&3~WU(F}TYPI}(ggnpIU1B|4SC|Cv$urnU(eTrN&TqF?6!BU*$giP(a3%}gw zT}+VmXLhJ)l|T7~XATDcO=dq4D6&2+vekty^(=3YSQwtKVzeq5mB+HMAxx{}+KODc zTz%)t9FA@c-8(b+yYODYKQ6LoD@y-C9l7XW$V1guRNGa-N%9HhAM;;AfKa)dWOJPO za$m0HQf+ZE=Dp#+RA4iZziCFl|J2vZ=XsFfv}UP+tSuePcq-ixotHZtra5Lk zOmpiN-cj*!*w53>oTL6_qtuD?zqLH;3i=O=)=nK3ql0&75|OS@TxyY;1~jz?w(?*m zh{*Bp->(n(iN72M(d|AN6~s%w*KEBwK5Ml1pzQ7cId{mx!dQXM@qVhtq2+hKc4@zP zSWvKDmGW=u_FfuBlhB$cy%*!#y!i-tQFuzulzBtM)y4^TajV4a!X{1EvUg}yFI-KR z8x^UVQ^sU-<$Mvvp!1G3xAK1`L6!w8u=F2o7jp6^ETu4tfp^iZW?EJUWF~RUMIg#t zqpv4&;$vxhJ+l!md_LPoX*wZX-vZ-G_P-#5ihczzig=6KEd7>TB>8W9bTz|g_HPQ{ zyDCaF!TPpn-YhmzC@eoF_W86lo9&vP#qcZtEb%+X9`h z^pq5=_Rtm>#7(}@*#R}>Nk|1Db2P>v*7ARY=Xd^xP~RXlJLIJx1N-d%pd`0;uq=K_ z@3h5^I1<#=s#OuoP@8!1qrlV2y^d;feUKqaL;RBYcSztxt3Ig~OxkoT#dal$qkFrk zF8bdV<0}x=4)zepFDKvo?`!Os?1SG+ha)-6HeO3oOL8~V)|`)}WgM$GV3%drJD@h7 z*xcuLsAbZxUx{6@BqL$z%&U_VSNuzquJF$#js##s!~Q>>5XgOs&(>?9mKsY%pd?_&)ww3BrC07zn>~bL*kmli)Kn+C#=&Pfx?^fip?Q^E)5oswP9dJ?t-efZ#RR-Q<()kqW>%OBsGgL*Dhp9e&;>2eZVQ#QjwRcsipOB3-cBH>wl9nPJg` z3sn`=Vja*qu!P3Eo61jIcT(&BHgC13O5P0Q5IdHFe;AtYIGwm*Z1{=$$FN0FJ}$Ms zlO|W?Cx-4w9Zdmtb=sy{aY;rW0bvWGcA#y&&V_REFeYMO-Sv$~bCJNi0pGCG1=DNZ z0tEaqlJCDI*I<~(9$qk-89A-n8oof@QJxY*Nf99oDEe9jYy0^ik+2a9#?{c!e}x~& zp9`Eq@+7E-2nL+pm+bKG=_dVgx$h-@hfBvrZr`60L`Vm{dFiJk zI+q-*Yeni>mC7fZ^h6;E@(eY1Z0dP318n9JNp0(WRZ@Sqf?QoQITwSnCUimXbAwiB zX9AZ;Z2X(rz?KLOLCyuQ%o-IrJ!`2UqNJ9pcC51Ah&_*dwl`O%_p4J1Uu>Is0y4GW=PIFnPcA@or1gg3QZHrzdD}j|JWJJ3{UtIeC|M z!juE{qI9;y1_#gZyNJGIiG~t3q`0ozo*3)CFEh+tV=$J)R! z*1j+;lS=y*vCXa!_RVfd=$nn#sI55LEf1`{IDI#uHD89Q%HF6CPf&xSnORT-TcZQ}2rT8YE#xYK5NdvXi zP-V`Swga1AQE>B;S;d^s#`06^R_b%yod#dn!rjEsNOC5kaJ#0o zqa^|=5}j&>DG`)ohxPqkEojpqmz>4zp5R;L2$Q6Ha<}cIO!)`}!x%G$dGHLxUPo8w zeB>Voq)+{u-93h0M9hR60i*)Z0M6?*C3B=)%o&r(MDh&V&v_w=iPShnuu9}b zJ9pkU6RH7w7D{d*sO8>~r!}G)aXvzd?w=F9 zlhWEe`t`4YYYfKROFS?A@ACrbeb_dKl^m79pwhVSI~RQ*lEqnkOb}z|S$0y8yG|h+%u(oaRl~Yh1Zx3ZR-!4Wtf5TuXyk z%gVz`(dge#mR-BiXma{Qo=2%v+`g~7#8Kicq4m1|wXPeEI#xTV9=bl9*<>YFhCNV{ zbESGmw~-g5lR14F^Jgx{r25}HZZnc4te$!U@hq&$y6CdNq;px=16QglTuIMl9| zT*G%g>ouwN+Y1A($4%1qXjLtKvyiBOahCW}%G>ZGJtG76q(fBsLQ|0#KbqR*jYgMc9&*yG>2B zNLD;plrUkNG@)6D;q!nUFNMdvf<3VAk+6$S%dW&fz=%_Pi@~k!WP4YJ z6|Fm|gtsK~)1JKY9d`*xcN4Aly4Fu@QhmnCm_xs+MwQR;mrSeEy0A9)a)dKWQnVkZ zpnI1VU3>5Fd%*V%LF=_qCI8iHiS>_fparCdt0Toe5GCpB)0?)z^~B6P=0LPoS?CRo zj>z4rO5`Sg!elFt8tvZzJ~85P>t4;TINJ9lwrqd(9FTXdHn}S{HJLU@kprk@rNah@ zN*d_M0|8;8>>&(kGL+OkKr%>u5pLAnV?@#y_~FjmvSMMfWZ$H;k0`@qN1N~AdtRem zF=}Z67C(&R8MbAf-n*#$vHiDaVZHdrC*aH%izVt>fR%cqL$AoQcJ#Zf?VykcDW`H= zh+z0upBy_U2k+XqgYFMu#3mt9L!%Jy+~XI5CN!>D(JZ!q9Qly&<91dfBX{%T6QzHE z@s)aETs8}~>OtM#&D5?%;1B#dtS3*&V`pl~YqNOCQg5>uHWIFflu2CqRs~JI`_N>O zqe)0BU7YXY*4PLmHtA)NiIP#`xg^aQB_?DoLrRC;RJsMSPa?!`t0mSz@OL$expz-aV7s`IZbEGUa?5XW}ynO4m-|w(8Cm(Nw4E3XbB^HEW?PHA?C2JtHUMqyfvMQn+xH02y@X~d`E0s5L^FR(ulkW z6;V#7$(_Qz%HI{2q{W@t^2~62tNTk&miTNDR(=Xm;T(0K#M(_d+VMOQwBZ()*FdJj zMi-}O0l=kZ2u!CQER!rFflOL$+^kELRqZrw-CyP7?7r^gPME&E2Npbf+0R64s^=#z zP91|AZ8QER zB5zhXnUlQ0mXC$Bo8}`J!p=~^B!DS%HH#*F2RmAOsdb-&_!8G2u4^jSZ-dh?8V9rW z!DiFg=WpDA@EA9cyG3Vwei}Eh!ZD}F}fSHtD8^0uRixIUBIItRDdFRG17AuF* zL#q)gPh!vzvBodt{X;F&gXUm=A$%SrURBo+R4Fz<62L3TF81E#%K2>IOIm&x!X|tR zM@$F2Ej^|A1^=Wa0n-Y)vyX78A zA$$ZMYZb^IC!&-zdYf&qT$_As^W5&8#qPv5v2zgf#$9TRe8a#^N!9oKocJ1iz}T2g zsf&sIfhcFWE+6)&fOAUlqIhX^sIOWY2D$r-_}#?jyrJ=%`zrC%#fFMztzqfA;s@O@ zM*Uq=Hqxz|>lQ|-BlhWoJ(H?c4Q9?|u;CC?9058*i2#260;2@Z#? zxWW>aC?39k737la#+V! zqb+Z1UG&bZWb|Z>*VAk9ZbwDeEpM4p7!+M*dN*E2q@XH?C842rkKA=k|Hl;f1^i9| zyD1RlKT%meWLR7r{Gu31yyG#j0?u>p$l(MRt8S@O?xbrz;yd889Ny@1JVm=P0|;% zRjxNRUD}b%WkP%u#Iak%o+d4>_Q1lMEj30ci zB4B<{(&wPiO~B_9-Gib8u5I7lwaooQgr=cbP6l;|OViImuj6->8#-l!PD*YnY3K6hTE))-pcHM0?v$suB{ws}^E4M6TXdw>Zum|z6z1b0 z;ZPmxV}dfY*m=ru*RthsN6P7y?XaX3Xp?uEdeM?bsZGB12Q=CSM`?pEX=6LV^KP7O z^BZ0HKg~FYtsM>1mF!Vhp%EtN185UXtwmj)`EMt*NAE-<35BCCPT17B1lxinEi%N(5Gx_!lZd^N1- zc{+f7e1+X$Xz9TVXXu@mu|8`uth-koIv=iAWgDHUHrBLV^46K$kkOj6Q58X8TNpn{ z5Es5ssU4WXuq%|UvX(_7HO*kN?y0Lvr_0UQ=e&P2x--7M9A+N!G4ShqWrOLxA;+;m z;X+ZV-7nR2?cp5L| z)L`mj*YwQ1{5AH&>xIok=8?YqxiA#-d+iNp&p#=oO1j7LO42&Oo#08H#10m=Hdw`< zN(-=9WJCi7#6(s%(SzM2a^d#RFgwFu$3=h#t>{qMhduL6-OIS#iqJi(h9UxVKyA>LrYHhz3sixMCO$0waa!WmMM~X$y-&uM)SpVx3zRkAGD{N+Q~>x z)YCUrbymMjT?$ZjNtO9u!~?yOXvHW-q%&(thdV-!Jh|Gqk&ZijQsW>wLqqO%C`Enq zV)jKH%i^l^sIBNrzC44P>{`i6$^Et@ZI}RpiRXwga=|2+`d$U|1 z3wDMyo62C^CTDY{iUKSoE9rO#6xvFAVe{i2?KPcWf_|SJ3v*)_NTsXX^}}!c`4?Wa zwRuq_t{S%oVhUo(i~}8EdgJr{Zj^7Q!QiYozOP1{q~fr z|AWMO9sch0Eb~WJFi6R7fNJ|o%(it>BeHY4YA1rzoyY&33-X$b(mf>vW z%9OD$egDIyO%FEbLC=1R$J#D_-;!PE5ji2FkAJe%_af`M?k^^i+-H=t2`|=wuesBU zGV&Er_|S{6aKb?&Zh#ZnN5=BJXgyRXf*G>Y9(lOsw^J;V>cs-ABAFg`Ge2sNgc-Z6gCtZ ziz+gWb(K681vP%n91rZ|87N&pY?O{Cp4eFiB{7j&i{OP&*i(rGXM`%zMsPKahtrx) z8y;RcJDiFyG=?0tdGp#VEk@!E&W62wAJKbSR4<(x8y>nxzQuXd?^rI)1B@P&CbcLC z&!yYX4q%IwFXHR`M3EjdHQBm4s)Qj`>rczG4gI(`SE$EDEvGd#1_2?8)>hu9QL6ehvxgbiT2QIce~=+P=p7uo@f-x#Kpk*YL{W zC$y-H>4G>OadGyh!AIl?U3I&hE4^jBq8A6f(eFD*g+KI(8oA8#n@e_=X)0Njukhi# z@d8{U2g6JilD{D*2=k=#iy;BKG*JM)=WBP+AH?uYP{ibKLHto;>tKhamXAvkzbv1h z+s-%aBsB?|-RxN6b{VvsRf%36REmO<>~}uq@R1MyqP5C-zWkF093x`C*?wDjluXir zkTWc)i?E2Z%_lkj-Q7%T*EdZJo-nBzMhDCS4}n@Q=Fc@7qKE!+GS)$GGbks|(5#w^xY)OBO-4QwxEi z#s;m(2qjA;C?M9jSA?!NHut)DRYVRFhRl#aq^tu7S1LmE_lYVsH7`RunxYqpIhfS3 z<<3_iv`MHfNroO#TT7{0bdxTuHcPXiW#70yON#Oth3893bUTzq7p&3@D!veYRUa=U z9NUD}$W1T~XI4Rjn_6F5UXu^x_+eMo=_aek9(U(wYo{PRVe8Rxt=ZaeP|P4btBI|8 zbFHbPojJW)KI-gs+*qzR9Y?l*+V7#@=<5$ukC&~L%>L0UpxRxl=26W0n9>YbMMKho zvYWchBQ!b2+!(2S*kWxM(=CmqyCA#5lq;?1-5z!}I-o$zb2iX%b8;hdUHX1jT9AXX z#NVQPzn190QdyDX&%UuxtmB3~1i!lq%)XxzvT$AxI*elX9RD~-b>zns+R*WPe#EDWj|L;= zg=McsI7Gay=1)n?JPR5Grg@vzxd7VMUm8% z6I(>Y!OlHcO$p2{kGAM>-|gOd``!Ibq00?HW?5UK{SCvF2gu;nFJ7Wnkf=A%X7u)} zW~;RfnJrbPI%>32PC2IULVs(eB>y19!@D>hCX@@}i9y}mxR0ptnvg;gdzXN({IKjI z>|)wD?1D~Lk56^6$8pi|$g?Wl*5OXyE06MB45G%YZCqkT35gS?Gi}7kl~G~s^L2HP zD;55m)6(~xF*|7Op)&{1s^y&yEE=MI?DxPmIWeX!^=mf|=Cmw{7(q3S0?H3mwA_iT z=4i!WBaAb2_9*f&io-{sY?j3i-2I#1?IEIAQ-_su%Jh9H9&>STRMxNI_Dkxyc%ZU6 zyZjKD7VEp#Ee$H%6rcW|3W7diwx;}6uV;&EU@zb)72#HG|CFvD3$QN_QQk}r|MACv z)30A0&_7IlOwJ9q_@%tbA!{EbF=&bCQZz{)6C-v+)2!fA+zgX=rsBuf-3?HcJ=?t* zoY2B)M-EXbh< zw(Ej`8n*tNqN;^6o+sZc&ru->=m9SiNg2FM;=#+Mk1PL+4ktYEJwSQF5m%c1Lr1mE zvR#ST-pU;ct&*b!s7iOSNA0YjSqutc?|AU8V&vCbXBz3*(*N+4Uj73{g04unYcD-m z3Q+ac-#}i~IKUt*)EY>?<(l5FEtY9x^ERQS>07}ljCo9^%DszJ{^#%?Dxwu^)t6U<(+rBN(Z)AREHL;8P%i`UePctol8bJmWtM2 zc<7MTdw<@!P>fA7tum`;kGRnt4uDGb9gh4pGeN)2jGc4IQ!^6}%VJv`kS_qAiy;RU z?<5S#x`WOF(vE1O5jS9$cLG3)7`8~ z7Lb2UL@Vy!-cGA+b*mupWGr*oAJ<@8o1Mw~)}nPCZs1|cc(5=}yaNjASvY4AJS?3J zY0CzCYkZ2xFb)4Gqq~HFcehz#k^ptw@#uT5dAWxto(*urTsWh zlfXwO)fs=krZBEZF`tZ47-XHN6u_I^uv=nTRW%n@2k|Z~Kh2T94hSpo z7<)^(T4-p1<2wc&whQY|JJ1+)(uW$GI73=pF;fL&U zVp3CEZPtsP5UeJun4~5h@+&DS%Cl367_ewKgOiqr;MDob^eh1JYo|5#l*R~>Iadf$ zfDMsT%;)e`WNLx~5|6{B`F!mnd=ol4j_~yK#hG889@Vn^(9B}R`V|~@tn>sq+Tk)7 zjs(a$+Gk*F*t}fU{t-rZaV` zncSR};&Y}ud3!<(xq}27*T(Cf6-@u_5Kk{DVdl@CxfbLP8_+* zBBqkh2BzC3Nu=nn6QHn-MUC4cP#`mQ2bpfC=Q#%go&lE&k zRFQ(D;&x;xfo@u-9H%LuUah_OqzCG+f@P5eS5l?Gz+9&5G&H?fKhyp3z2#tzjK^5G z(ypjbTzT%iW|&Y;5Nl8cf%Z`aCN6ne4*;k;s<}FS7v*q^oBjtKYkxks7GYe~fCHl(>hKxAJe~^X0+z5iNy}kmo|mdVzEkO3>^73Q zL#exQt?>Y#xcdUm|J|F&bkznp5=w z1U**9n%Jx*ogtHeq&~ALoc9`!sJb@9SH)&E7B6X`S^YZ$YIcE~6YDD*@#z(~x_%rS zEXm=ojmc^`dSh{fYg8?HFN&Ye6s^W%_a&q>U;YwhQ^}KYeQqP1HtBzL7 z9SJS&5*1_WmWLLCvAaAy4^_^4%!HkxvwPZNe2wGMYoWJ03S`FB4p-1Ay3H(Bnr3O^BE-WvH_^ElV z*9Cec;51r^eX(f8p&#OMsN&6IiRN4H4R^J6mg=VWS38G6qSVR??Jfmsm@!JIOFQ{R zBcQCm4=e1#$10vsSC3+-cX`1ri}%GMPhXvMg0vW^2JHzx9z!) z*01KLv@u^K6O`4L?`Rtq=B1S4_FW~>;X{iUryJIyQ46Spq?xRm((@-}`18K+Wu32Y zn3=X4f3cbx<~Yd*76gw&)mq~Vl%sEz+CJlwIW*38ekbt_xrx}o&?$^ZfHV$03x%J$ zbP1Wkcbw-BI1ub`WL@&y^@6^wh>iuLu8w^wT%->3s#}FB6|B|~>V+ifDPY+3euxY8 zvkBHeh~^Q3QP*mA=p{)m{TNnQ?@%gaan&pZKgwu?Kd`*uB;8b&Cirog97!x@$7{W> zQ48Vj)z8W3?u4)_7J-kId^*3^oU7k&PbP#iuk^G|aVU}{hnmH)13%q!jx06SW4XL} zSvlu5^98uJWUE}G87UM?S7w3x2nZF{s-qSLUL-sex0P=bkXa_!WCH}|OUo&WWo0Kb z!#(p_E$aG5uLGdap$oBy{JoN!oXFd0K?FlXzAtm;Z)R@DUJrC{{iyS%{Y0d(+YfG`|IwSGYL-S{r792;&DYCCE zL=u$0CSni%in}b^Mhpa3sj0d5L+M>bA5GdHe}uA5qqR7p{VW zQGYO1|H4T}27K)bu!+geyYb3)CClM%l>>&V4o^Gk(xnd7NF^FeR@fBgC5sxj6}`~_ zKoVmo4QAujKud5E)CNuEJP_-;s39*%1j9OU;MM%OMpj^-l)L}6X1-@3&E{RWe8;4G zXK*QRa#k>ELFk@}u0CKAOI1U<2FdO#Z|T?>j={ySpeJg_^l1dIs1<+tSI4t;jH`a7DPBENM)=?-I+pm2p?q7>moZGY+;Rg1jw4klo!22xa zF{Ve1n*wi*;F-5Tg*caoC137G8v3u&%kLBbRM2qrDbBu~**8AuB6aB1f$XoQpEDM} z)DH<8f4#$$LGXp}?ToJc$Q#5sEpF>3Q{DI7&ytIaog}o@gthLKGGs5fxlwPedB59& z<&=k%$I;*Ewk*0bc)5=f2)`(EG{n$WzGG^|boTBx-fR>uHu<#qs!5{zAV?3^{M|j8 z?ftzH*eb?2k7?U_tlfHj8{)b{Has40)Ijp-Y)mx~IY)sS2hHYJ=~dDx zQVQwxRk_L&@~f}85O0nDNo`k>{jLzK z3Az7;dj5^*jzmx;lhpuAn!-~+AWZGzj?t;fqMp`R+G_fi6Hilg;=$;3LaS2SD#<#F zycK`d3lG@>tl0H&?ZidF4!5g2S%nO^@@DT$$?3Wq%U!1qDzWl|xMvVusGJ8ROD5>` zY}uL_Tr)8Dw!=*^re%RuK zdr#u55nRSiZpyHVe_}fK-t=V0h6N9*sLTRQZfzw!Uo{Wn;5Z(jJx0j>Hf>|wmnnEn z#E_{K*5S1}>w1vvqU}xt?!*1KlfU@RUeL>&!2sO;7J@dZ;aj+dvoH6EIK$w?&iH}E z*GVF@45T`h+0*ZGoN8}HDOR+d96+l7mtrM8D%QAwru_G(+mX*7Uh6a$lOK(pUQ@X% zY8%n3qMS4Ossd`AEKtxboHg1i=6@i?18fLdmDL8?z#0h(LXc=zmaHat9M0|bYhAL| z6rhDF#B$r#E6o-~t4d;)mvFB;wd02C{_>#ga_t(UD(s7OxmZn$un_|QkH(kIr?6)R z1E)Aqc_G%oxB^avZ=FouG0JaU^w7Wh-X*o9b~b8pj7gvk$NpyN(S4$`I`@B04_VX1^*OlGt>v8QTEI z)DEnRx{)6g)5e6$XoP6Vaf<{*s;L(!It~h^NxZM-Q;(PW8deQef%CJeZzEdJ;yA7x znTxqu$LY6p&$83X=g3~+mBJ)ZKg(Z?52KN;qpd2zcn&F;B_2#lYcho6Ahl=|^Qckf zgj*H2LT7KSa-q4u-^V+i2XzFi>2l$95P>h&O{Z5@wq4S+l~T*hXd?os#yWD1<$@-T zgUwcu5xci>=WlhCA#NJF+A9^B(DGP+keHk6h5A>yQfSfkw=G|UXEMsdcN6 z=WZ6iSJ)Bk<0%_27{ca)r{F$8SYIAZpgG==Pqs4BP#Yiuf6~xdqi(u9Kw1DJ5LQbu z2Bq!xN2l8zPeZZyOFguti2Hc2>`C+3?yO|y_Sm}6pKV^0D>*2n-Zxs%U-!qF+RHnA zZO;)VB~x?f>0;2<9e*g^?W-R zViU)+AkTE{#6n`q7}i%uC32A8Jym=0kWKt5b#vV;q@x5o+k5r8P5jiunqZV5j=@iD z*`0b2qglA_9u7vJH`N6;61w3MHLf8|)0DMxOBT3efRVswPVod!-~0oSt9!^Uzt zo)sHfFksIZmQR|F?e4UPwlvzo=Q5A>DR zY$Z5pr!6!b9NISvO{k|$b@jR&HRscB=37U8IIcV6V5BEcV`LkT{$)(dq7;*yC&0jQ zGHH@aH%$(@lD%sb!42SCZYSvQ-tD>^>eI46aUnhbOv^RnY-KK3e{l{b?R!KeC0ers znm!ornDQ88v*Ob(!t8JJdQ^O7ixbTgogR7_nVfbX@3`bEo@Ay!hpQBHJ*-VFo1~Fu zJ&0xnuh~YcR1Uz(u^vF=i}*D~bg+lKvbt;A!VIS`z8qVsliM~8aUVAf>+>QA226aTT~QjxQ2`6MH! z4}z$j`y7pCK%FWpY3Yqv&h^VEMI*Apg zdDyHHKpeUxw&QKjzv76+a?|lJM7Yv5>Y_er^;U$$B}e+5RY#a^`dj9f9_q0=?c|T2 z@tR_jp_k(X#NXx`T+5T?lQPJi>eN$qz^Y2h1q+Zu40f9A{<0=`ybBJ@0qNia^=*Rw zimZ#r6rF7jcLZ{#O+w}<$YhJfyMOqYL zhm%0L_Cfb7x{QZ#t-X>tAsfYYdAA8YXOiyGj@ZwfbX|Ys#0IhJ*ZeIAqfEvgXCuL* zo;gsFp-uL`zyLeX-=|-fO*dnnoPPaEO8H5zivw^;d`YvNcn!cd%1*S>l4*!mnz(h; zO55`$R@;GAPlLE=oCiTV1-0=cHra*!LnPX!xpew%EMykl=QiDEjHLIs_hpx7shPcm z51yGkr&ssR5_lKAM!^Lt00Jp1w0amT^@227bT-C3g4sM%|4__SjF83ioN zxo_zlu`Fh z^SKuWgqLiz{9xb3eL;TZl>^FN^!TqRpV^QL!E3MEod&{gdEFM=iZ)MTU7sR!{xuFI zK;PozS0yV4y^#VF_5CJ3i6T-jHYiy5g0a}lCoX^yu+U~H3RjYFZ1*8Ud&lA7%MJT!IPwNR?g{eN23Ds_r*a>U z(pq_bI^*k$2=;b4H^QKlf`HtOEH>oycd}}$cb02gZH}b(LxNsdJ}13Bmjh7@u{jOs zsjyUWo4@KA-o(xQ@w=7x>U<6A+11jPYSh#?UO<*Mg|GV z8FeadA#YJ=qDz6>6rrrc@#Q@rEL1=`ziuP?&lBaNye0g`K)<|=%7Yfjro zHL1jKcia}-aPP|MeX`+kJb=wx#j7cjCbj1hQz5BHvjH|MY(r}aVNzPTBT4fT$hMJvu^0py2>4jk7#{xeF2&^^we#v-SRFc+= z*0n>N^Qp$3=f{k6!{iuIv7Do}r1etf4vPnV!sJ`DaaODZJVhTiE9Ozf+k%dV==WVd zA=nwb*n(a~g-?GTiozvThgbbABFqv7K zigq!6p7Wi-D^t4HQ+^5M^5T-(SfrMuKuniet1|T6eKLrh z1%p9LcP!=0@2g$sh{WRvI%}hzi8Weii(Z&CFYMI>OND6bj0;E*JufA_>!b8Cjf4x4 z_QeuQ&BIAh-grmNlS<@?8r*DK$sbNogn{dnYfp>RrOy<~3~uPC$L)HK+B_iaUZt5I zk@g1Kj8;fpkFA>#--5WwF1~+4h&NLb3GM-1Z22@}y#UI2y4<<9p4~96Qda1OW`53?~u7SEyf^;p`n;tN@)f~8r5m)&Y&Svdq_SP zK5O)P2FD$mvtE4xXrFZ&LDU~J^Xu^dKfh=1!M7)7Ch_x!7#p!))G3^G#0A!1c#pQF z@$V29)$MUi}ff z%3g{<;^^awEAW`+#&cZv=;B87Ayy@TK0{nztGP9Q@6L(-v0d?E^?@SDzBPpC>Pp zp*1U~3@v&Uj3)FMmox!>(27a58zR1-AFVMd8?Y!D9ZK%_Q_V~KUCo2?Nso3vVXXIC zm^!{|`WOX0`~cA||YJI}C$Qe#X$ zIZvz{=yvM~AYftNkUVD1GGlC$0tfTG9OlYV*QMJvVfREkVg<$biV(zL(MfoFx;f%K zuv3e+W>39}iK;X^O}UFWkcx0kVtmtnL}CGyBGquE%&B|}-?sq!ghB&0WJrw^+1Nw2 z@X>MRZ9q8_dSNZR9+J!V-YqKf;V-XbPNeX&1AmYubXaJ4PVa2#CKw->HnMB9TANCC zGsTSFEro1>9xJ1*$r)x^^*$keq+3U2x$~(<-rkRsi5v@7Mlns!ke@bmUx$g8Ij4F6 z@9(}W=KNLJ-}r34dYjoNoK1}UAg)dlL&m{M?jL|N|AlG%`Swc^Rp@QVwPw5-qF)(P zqh9gw&&mF@7Ap1b94vH1u))Pq1PDZOfBH>T{I|0!YxJr>pZB<%nIpgW;7Hzl2br0h z54EYlvv&9;rx9%(8ZDa~_9lE3c!)x*ec7=;&%e*BDIC^O&M5d z+Q|Z}JaV5Yw8V`?i?y9g`c~pqv>rL7@!0bmEa6A9tkg7m-ynml(A&yIi?FD2%8Ebc zeO6cwT~qmpBeGc1dk#rms?&r{^?7*st83`w07yQ+@;Fim4O5W=*fJAz3qH7UE6 zp(fU`rO0b^2p3oe`-Z z()+8Z9M_xl-Qx{GA2d)ssmuA>MzVKi(JcDLUYIfSU@KntlC>|!LN&jl*$`?M#SV;N zDfa=@w0=sRAck|cV3s#XdBGiYMT64W2jlshC8OTgNOQPRTVZ$qhplf6kF;yHjwhIK zf{8t`ZA@(2wr$(CZJQH2nb>yHvGwKAd(Qiu??+#EcmLdL*RHBnYp;7*e*F>mV`BbM znWr70Seg#-Suk!ZpI&8uoT}TNPr}-5SPiO#|1wOdH^^J5NGaL<4gN*DQ*>{kHN(7A zeQ}{hNmQ3^MSky+R!!4@as8aYbAD>@MCj~Xk8@X`*gbDBJy>(w6ScrMOG?isN)lh!_y(KUsEpz5yp zb!IkiTL!#LA2n|2x>@<5T(-OQUyK>@AB@=!og31BuX7&~DFIq+fQ;JOweo%_bE3g$ zMy-YtcH*L*RqgvVj(8E3l}`*GSIq=HxQ_s4Y$arCDj4a!ldcOa-}BJJ#Xx#@H|j-) zGfUT_9Y4f+T#?bq-fsUv2r^?)=cCp_YS1Rnc37A*`BKI^JUL>952?8u-D z;?r2++OwR%(H_b02ht*Y-6q%d(Egvwt}T&IjtK|K$XV}CDE{$08S?irNE5&)s)20c zq*N1G6icYeW5iuUC3KOWq{@{19Y9+@x|s$dKU3;K#8@r~6L*YcUQ`HV9gBv7l6)7G z0L%8ggHif@1G`_n`-9*Qx~;{@+%KVj&he8_->yc6a+sHS2IrStEzmUSR}#BRLgkfr zZ;P6qtrf5k$}+2E+N+=zTd)gKNj#gyEtDcv*DANrUOpB}{Tb#KrA~#)_;ZPz+{LmH zmoU%8`}Vq!RlF$#?iiDu^5_SmrxU|Ypz-7o&Bw84zs)flxWT>BN@g_Qp`pRN49?R0 zhltDyY4SrMO>rbDgRTZcULKQmXZbg~Yw}*dfMy)Qd!QlP+pQ)3nCM-=mw1;4fAgz* zT&qEIn(XN8&MS)!7p5JeWgHQk9(PF?bkj;>MN4p~MUz-_F-=)kMYIz);kHGdqLPnm z_^+duYl^J&vBT>Cvxs3y4dzjzr7`ap!aau%t|gjV-@i`s+Rw>@`x$O7$v^zH6Q|Sxp+Q2*T711(nUz`F!2@fvPy(oi=(2tlgSUHm7D-|LKI>2hKJjCQnB67vcGSegZkfIaU9Pb; z4KDU>Tcy83P=M;8(1Y@An5K;XzQ6XK{FyoZ`@)660i4ifl4>cjP^m_nYXMwI`Wfqj zr-pJ`I2O}lk-&qO!<*Gw%bo4(yY%9YFilo;_WPq;heIQ#F~U53k|G&a-EqPw zMki{YeAV`l-mIV7SAlG5qt20=`A5`d4X$1 z5yhI#N=1l=Xff$jweW=yKARm|XFHJ|W07R_=WiYy{Kny`mTLTM$MQnDd9 znO@!wY?;Ys*fp1Q3LOkr25T;s6H!`{-SsNy4l@>ns7RWP5}1eSt>d%UFtZV|Tsk0F z%9u#9&=U(3*CMs+%W=e9=Lnqr4qy%{(vllJIlwa4dRovn(_fieGEuUhYMmyrM1?3& z9nLCfDpeM>bR;9Ib~)^|2xNqxSbDP%fZLwhk%oLouFeY0?(!nm^6J7imSVsyl0*%$ z&=(tb{mPEY*L&!ORn>q1uPpS$%RzZ?%j5Hh>c)R}nbLxoA{CIYXEWOXv%3!2e3@u$S1 znpYIFA0ML~DE;LQ(8NO)@h+=EFjnBFy=9qiC0d#kxPn_!3EKQ|xTfp)ivDtPUxPWWW`sXw)zwo281%NE(u-;5l*3Az zi+utczRA@RFuT}U#&V~6b#h}|a&@fo$!@Rm%^{-MBZW#6xD*v`cDYr@a>H&~66mnY z!b7EOw@!)k8m{mCFSzIZhuPj37w`K@8eL1#*&Xi+9nYhsEiO_IjH)_T80B@H7JW0c zZrHz4aJQ3q;_oP$C3{B4q(FM1WqC4S!9Kc=j(BY)OaL3G^WzkSF6lbF~&UMap{4(beke1$vL` zcaPp5@9Dwk^hn#121x`TH5n=~RlGotL8I_Y-B6lrge;FdL-2dTRFk22$@xpMTeArNB?qQgClJ(3+fd)`O z%IctUCvSr{d;frWcAtlZhG&C*r}Y*$-Cv3lg-=CEaM)txe=~GfKV-sJ-9Bgy6~udYxn`}I-N1hu z9e}v1$iYd3v?+FJhVsx;^#^AQyasF%%OS_ENzz5p)P&?sSODQY0t!W`^Sne)VZ8IQ&mCepliA<$7-*7A7TJF> z6Z$?-D4yfl5A7n>p-)Kc0aE6^>JwRqL#UloBUbD#4V04y0*{!8t|HVn3Kv{gs)r~a zEXn!>fai{>hSJS%Ib?v&j5x0#yRMBs(OqJ35U7??y1)fyj~b2^axo2?<*OTVOxDsq zN|g&UUBeJoJwSFVIXD!%)2pq2v-Ny2di^Y7NcN82h~5F#+MyrE-Q7rsQY9RK5$1>7 z`AVKNuBozvR{r}aYT3asplX(p^$X#4tC4>c1)o-F53HQT(KG+mg+zt)ERL+aDn5}c zV~pU6osHrTQsWZXA_hk;4Ih0@Gcm6&KKgiuRxi%_0Y`R>FU63gf*{{KISRb&IU^#u z!@Urn*>M0UC}j{RRN(@d2v89$g52b&E+Hv}edA2xRvLu@IiGoHGGQ#KbI(dup@I{6 zprXtR9WSk4dOp`f!fFc}YbT{m--y$& zw-(>|{A<%ulQh?$fZCTvdG2M7p~5Fm=}h9yckyG2723GVEaG6%fuC;5^)Yh>Hi>(d zW;8IB<(J>0(PP`Gpq`kq(tm>F4cTN5>a2uR@)0h)B*&~3@9ut%Dn8!5U&)-TV0Sm) zR?&7w!4ISZEQ%jYKA?gD}#Vx>`S;=oT)xkj%$n&# z26^Gg`>LLBQrf^l;;p7y=!)WD;Gsg-hvZ>*${!ur-9i8>mPNan#uQ6@Fhy64*(*w= zGyy;y4iN0nxk1bTzu4($wV5V8F-l5ZifZ_`P?=D6PqR`EL;NOF{=y%>6lE(Ux!}tZ zwFhY&<=@LJ3#ntK<9!oV25ydz$)KBiQ`8}sJ(2{fj8dw|5t2Dl0R&m0>^QJ`h0Qqm z>txq42}o`vPG9IceiB^+gl-qyY9({%a8ibqt|99mQ{@yG<+AKzJZb6EtoK1|hb@Vm zW^wM9n1+aFUSI%q^)jOt?3GPfg)5#!D$CD}N z!|1Y$Cm~*MeOXXprWJ*H*1m33Ls>p`12!vF;O4gage2|RXm~{vaT|)9r&}i)u9sIZ z2x{&uLo{{rUBC0=5iSwCVblxZ6I|vC>R;lep+7VN`Y$G&w158oj|9$lD6%JFcs^(k zL#uK?3*!z#>--JgdgyL7{yUSB{10Yg?^43br33?syO0tIQSsIe^A%N5)~Hg#P`19u z(PHs#RM%lqtFq!rQ05&4fkX0LJ>w*gpYHP(kyS@lcld!VEjfoP7*=NyI7g zJp}5B!+8?{h5AEkm6A6HgHS{I28GWi^^Y3Kfxn1!>SrP-4{BB%zSQSPuG8q2>m!Ql zXEgSw$>?*V$XA&ufs}S(wgtD6ttdudAl(U|n#*#K$!2Lq2t!&Ne207zGAC~O()YM? z(D`^HytvzXI4KBmb>f5})wB$JxG(V~xGmH-z@^i4GVbDy8UwqOn-o4{tSrCHu*$92 zZh8fKMx~zOZ&wAZKU@_Ed(Wi)OL5QxmgL(LK{|75j^yr9FxB;_N5cJn6#hN3#)Ohl z=}g=3-M|zvcBKFvrLUZUO#yt$EIz2hu*z->l{mQ)4=`IWaNdGlD^J(gZ$;Ny^v@Dj@TJhIiUi< ziv%hHc|HTh{WHOBqx1&hTZhuX-X-OAt98vajI#B`QF3RoI0)z|PJj)1iAIVw$U8&1P#w zjY$(Kn8xwy3``C_)ki)mce@ZPwH1J*c#RMk?y8&<1jW`$_Mbf(Jv&uOQ#Jh# zApmtjMy^7J851WqmP0ol6TgzIdg>#3k&T~+LKoSI&Co;!vk0YD7dt1_wWHZzk3^RM zsSQT+)?^~qERuAn#6@`5_>pVBFOYP!!0IT-=58EGJ@qKH_Ct=tdNJQ1{i+9wv|2h6tUQKs8C!q%X*^85eGe2~@sjRF!Ai z`67{vpcu`O50ngY#y5|3)UhX@?MoNg<#bs|b5xKno&ZVLS6vTzXP?QnL{&_;7z&l&b-7!fU+U47M(q2x z5B6j9e%y`1>-l8g8T z4_Plt>zIXlTq$|-xz*VfB8}kHiPy?(HiW1*W4TVGIaY6lv7)tJzHtVdZ>#c7`|{avUw;#ikf{q%;9pJ+$zgO2I4xO8OZ2#N-k=vaRc4 zQhqfhE#O3a=;g$!mg+V6(Dn{I(+cRhd6h@GcP)$@l_x93B5OI+5-K>RJiNtnnR%e5eG+%5F0XS^l#2M2s1`RjT+WRXA5}0V-WCNJqA!XPe3MEGMg6SA^_XIuaE%l41kJ&bs?E%XU2I(W*si3Fq&phSXz7 zrfLbvv#7367#C*0ZJbQrmwTmy-qm&6s=#*&i#Qg;CZE(A3p{uPy$HiNU$E@{bye1P zSNgM7f8_Z&^^flNZxsG;C5+l9FsCYn*-E)lcP6wVpkK{o`kgKIgB&CgM)B5QbdfU& zQsLPr4up56Shct*ioRAvOfVHyw|oIHYK>!?(6O9U8ETB+$>926$GJ>Il^Ka<&zTY8 zEH)9TRNihw3I%wqWv1f%$LBqyhIaMZChjPh;>Del+4QTqr^uGqxgXh$OB#ga34ny( zI*rop@eBg>zjqMw*NM=oe}9iL%UwPhVAuS(RaDa2b#br3Sq0mSJN7M67G#Ou>5I1N z561OE%+_j0v9wb=ixO$1HK1!cV2^XA$`3J)t9mVlTtUwi!xDE2=T|cu%!F26D$?^Y zm_UXSz>=@#o2#*dKlF35NyQHd-#ZJV#9bfex+P>A3&kjENJ!>-P3-dG?%gWm<{?sOty(aLAV!!wvuG*S_8>Al zz4R?PAYoB_woGx6lK7vyoYa5Z<-FtM!u(e$^OHzMcu9;mjuNPsgUHSie!eMHwsPQR zUQIerZV1V?P$G^A?aSCT5;*z!3SI(}{S5#{8^BL5b}HsYeyt3X%k*U6=GXDd6GNma zYn0(do~YVGi;6EXB`2Ofp&x1j_{rXR=eAT-qtlLE%MD=BVROgN>DUy1jP^XgiGXt4 zz9L9KZ&51lD$VbuI#E8xZ|OdBuIq#DFSl?~-yF>NBg`RxQ6Z7lp5W7t1d)bkGt^yO zdZ6<2Gr>{+IK;B~Be74(<9=Do!qU1F9DEdsEc_O`ue?w;TsE|WiawpqSPf$2#5I8$ zRHrK+zmPng5^pPtaQ&Nw%yfU2n{~CU=?pd5G|Hw zgoE!g3UP1I3V_rrj?4&ZRbQtXrpGnpVPy9B9!c?%?p8pMZI@8Ic||dlZkdR~NCS>V z5!Re*oS-T4o}6abwOPxs`4?GeL-_~g9X_Up zaI?Bz-r0AVPFSXdpIg;#Z_{c^AsY-xl zxQNPrvLu>#LG?3X@_9h5X)FU4u^gH!XBYPQvDT*{U-Y7OJ2KD9a%+oSE6VBKoF;xf zSQq_UzTeMzCHU6zJi71#rtcR9oOqHyzqN)^0;=h~4D?1sdYKr_vcFl$oIndcm@P1( zV6U*Zq8E6DxFppnYk5#vtwlVpuVxQfZ$49UKRZxZSzp*053Hc)*bLff2k@S-{aq;r0NBrT^g_swpa2+NgO=o)ek!5gS0U8!JECpK zuRPA!;M9oZ2AHy`Y;?OCHf+Ieu8`zxHgxX?mg>R8aBS3xu*Wx!haH}e>+{FG1GwKV zRQECEmIVhJ8&ZrUlrceTnMjf=1OZB(7qHIx!L`_gPQ<9Iki*B9)VoWe#?;v%pRT+Z zAJ2zqyRYa37EfE|S26xQnMiM83PvRc+97lVuB=5=1pG`Inj)%GDe9C&#mf;Y1(7&% z5aO?9@mQ9MdbYp5D^$>h_|v0G4@NEt{K|4`L!aVwr1N@?55H>Xu^6h}cqM(mP3Eu- z?tps(K+PR7HZ_OKY^*IAbgk0inLYL&h~@>SqA#?G51#}at@oM;@QlKIz1U6;Sr>iX zvDS)6)@lO^R_%Bg$$Y$9&F+86)`~WI0m~rTVcN)0X*5p8)K?4(@v!0D&f)y|Th^wH z#bOW}bv9kk_U`qr;ErT9FE5L4*+ILtSws2weV}aeVQn9j%u<0+B(=M`67d`(`n{KL zcigo^FLnCiY_0h({*BY>leEWeCfT|AZ$nFc3Enz;9`?H)Ry0CQcn!5O`TgN}H*M_= zI4?`@FR>*dstqJNwglo~A{2hoLtz;65G(jK=s?+bD&vJg!gtuM<;QQH$Cu5suVkH~in&R$|sB1{Ou?$`R$Ha;zF& zBn9aGbt)JF%LtOvDF=!~SxnFfB|GS4`y?c?WG7>E_lvOFu;cEWLMjp$=7m39VscJR z>FC3VW#$)W(Fi8BRl*lPPUatjz1vVe?z%g1vpu}NrM6+5zIh2{0M^!p$emTd01_6~ zk@CpS=$oG^X~aG(in8Y5ek+S1hUB&@o{!HsrkHZt#R733w|9HHldo-Ej^g;ZdZ=Yk z2&nIG4=5JW%!;@_7AO8Ww!4e1j7)hL=0QxPZi?Wr_i)aV zT$z0BN^>G^ylGAGE5(UXCQ_Xz8mn}_N{;bJV5ZY%L04Xl3z3r|XS&e8u&zo*(6T&(|nMm__&wJk6op|y2GD$cyzXS-q!4#O3=j~RBWTcX% zd6y*{UP+d)5IYm-xv`|{Ae~x}wt|c?a-MLIvF#N|U-d-gij#gd%8aPA{FLf*@KBoQ zFFLYR{CD-vV0g)*^_rn}PuT2A+MpoW>}5*w0NnET@kWX_2B3<=Lbmce^}Dt6Ew5~f zE$9}Is-B;vKA;=H*R?LPRX%_H^`FNjEhz$T6J>D&&^4X`f6Mde`_2w3Ody$zPxYDq zWP*2kF0&?n!r+UJ?R?h}ZU}6%6|zQW>J9xbl=83Z3B%w7Mz)!CS8CL!ZdK>|=dC1q z0IzYi)$ZEUF)nl6ByDF9RzU|E`$#7wj3?xa~0(Th8kmYKq7!IM1v`q}Lr!RfIsl;Mg<#Ftf!Y*0q z?)F-)8m9vFBLV6Z)TlSOIeGSo9p7~ODf=o}!l2jzY)nwK!0(LTjmn!@hp_g0v}wJ+ zm5Z)W3wgGub59nY9S$Sx-YAB}A+^=N&x%>d=@#G(0fZf3kmXxt+!sYV!`h5a!17GF zf_Cz|0|Mc3!PA+iVe|M8*nB81W5~CB9`HSBwUYh~o1`3GPrkKWud_OZfV51t=sV!o z4!dfjp9hfAk};2mCC(CB&#?_q6&!8UF3=WZi`u{%JzfQ;I@`}vgR!ia7Aumdxr*UC z(aRO+tRIv)D68_tz|r0x6>nqRo@Ut^>tK6)RKQv30^gBq;*-P$!&lUqwa!nR z9fv2mYd6hC4G{v1v@3Id6h+o9Zaf{;O-xuX$M#99R4UbkLehH8twqi6V$>HpY;(k)Jk?T>bn;eofTJm8C+y*6T7R}IM1zg!g(S}<8!S# z?)bBuKUz$9U9JzE6&ed$Y_f*;9b?%vuM@NTgDM?7T4OG zT&6TTg1CJ{krNWxP4&hE=~&>DPWF`Ss333_cH?KM)+m+nIL$|!Q>%fklB-t0H(`o9 zFe3dEmdhKZS#Nz~J(KmjP9Y)?Xn^Zy=zK8DL_;;xc&C!i*r7 z%-Z!MBOTaW>}JJMQ7ha2hM2h9TC8M0^uC+lPfcs3ga1~^p;pqW<|U@y($P4$ZSGF& zBYtU#>~Nde@HlLD#GhZ7Y0*nxo)P+w zL*Em8cns(1x@`ZS@b`haU@qk?Y5I0K^;4&K?0(No!QCm^J)A0qoz8#ahNA{v*R6`X za@|4u7mmRH^Kel?f!v()RtayPay;L1#^=w4`>F|wVb)5QJE@{Qo4hN}8OEDq)$O79~B0;@_J3Eq#qIV~CHbhQ%n*6i)oS2cxOf5FLRE^O2qMV((@PE3tC zfd0~nCdRuytMoMC`tnE*69;U{u@0MF0pjd^i|zh&jF`T)qVxOHKo4A}n3u*pKs9k- zgdPByGvK&tz}J{aRWEK&wbr+IK1)H-)H0{n+kj|3XWL#!n;h>1u1;cX%P3);)0dA zevNNlF+VL@9LKN>rZ2^|1;0yK^LQ_AjK!UFHuLX~3yIa$rO%)5T;1=_Ox=CI zuGnT&fV4TJT0+kd$1@x0Hc=1AAsx}xDfR%|vx)98087$URm;!Ju3egI{id+*syR5< z&aEmn(|JYb=~+AFA7^j@(7c$J8oV%i4xt81{^<`z#DUO#^$F>ZChU6Z>TK;#rh12H zRY1noE6!8gdYkNAy2a76Xt-#1WQ4X6oh;A=$(X8KQRu6X;}3I;Ixp2xpp~ol@2%43 zSF>L#L3q7R#tB*dM^*P2yZQ+L7c;+QS*?D zQQ^9Copf7?{ej6Yf9SmUD}UPM864QN=-Jw$1|h?%8qbSIP3r7GXx(nVbW3Lvzsf5X z;cm5G506SfZR)N`{0U%o)&4j5IMm=+m)sgtedV_Q+7CEp;9x@_NUPflD3qg!{N<98 zhxJK()!XgCJB}m5Q_a8mv~~Qhp@zvZ6{O4UhMZ2Vvr)nGFadQ2y$}tR z_y)WofeuNfLk$fl+pALrB_-Z!Xq&~1v9}<#GH~j+)?mFlApNjBM#E`VEd5#h(8?oz zQB>J3?IY%JJPJ`Mp`yXAEiKJJ>=oOfMo`Jflxt&Ef?12NF;i~`cdA6Ln7DGDv|LT^ zPH&E;wp?v&T*5Gzy$8oDC5uv%@GWbQOS7{F?sLUz^eYRKhBP!MAD6bDE9Tp((Wu%H zGOA_68i6WrGVNva#Cayu2kFGz`?V12@u@cy_)=O;H*OdCQV)TW@7Be*WxGmt2 zI)y?Ntf(-u36h|ia;?JCX{~pg=7#==g+jcWark7GR7Aufh#QlQn^0GkgV$=@e)>>) znC*peH1TZWuPE1fAlveBe&CYNj{SGB#ESwMQ=;zno0(BW$N|vQ-1%U8D zGl7u#cB*v7KfI+V#cR^H$N>%&o&mlDk+u>mogkcLZ?4F4t)s5`+Ka~qoBQ(>L6o=|1)N_92%+ne;|5~J;%#}^ zU`~yA+$|BEFY7eh8g$hqu`1anf%W9|;1d$@SeJr#%s$`0VXGfS2BT6!`x=w4%1^6I zC+s^Adm^I3D%mX9n_D4{ESwv-e!T#?;^c<-7QONmUe4UzpqH(o)r8h<4>HYRrr*y% zG?x>&Ial2#{kUj`+*nF(obR)KjBc8MFP50YR;ES=fuzZ%W&Me%D+428I z#s?WPM}*N-c(!)CY4@_P+x?J{yL)4ssfKQwF1O=OvK~{s{A{H0>(Y4~hd8SxZb<5O z!`aHVv|~jz;Pmt(R!7IBPdum4Z^xo{0EXzRYn59x3~IPV{bC&jjQPSV3QS<7)vEXN zRlZY(i64QLDg@keJvb_MyfK5c1Rq}w^Z7JklS5ueZCU!<; zpzNd^51!2A7AIiY>-Sgt1QJEsw&Dz(li}YQ3_0b`Oj99j6hC-zgTp{{8fk{eYZ36X zcx_Uj_DTt73;TBrZk01?Bk!9!9jzvk7B-p_8};wkjUQHfx%OkMv33yp1&>u6i6AbG zXe7nQ;lIMJSuhlfvC*@(cix|t-?u*;*qmFb(eRjxYBY{QHqx0@FZPX$r%)a!0XYr8S}MRvD6msTM{tct0cFYSJ5GGa87L>5=Z1pN5HMwUg8KXR`zi>Mwj_l-Q}@H zLc@$46DIT;*)(~*opPNe?@NRO3#5AcPRdmcCLzcVB-IW1VnFQLsNW*~iU z*5Il1R3LQa9aNMpO|`1k1?Fiw4B+q3MZlcECaD~Z8YzyLPSy`3RhT-M$`HKd#pEUk z4bc62Ue7TUExd#L$%->=nV;TDyp&ao>FTHV&+7J0CLaao#1~F&5XWOw6ZvEf)Y}S8B zl;N%|;mPsw0ZWwRj>6j)>{(E|C5k7bLk@!^CFWxW*J$C<^e8_c1tX9Ks){3M0Cs*6 z?MK(ttTiz;SF0y~-Ma8TM7Zfglqjkd0-q?O2SijtFHc-)aiI|CkTV-;-fReC-irfW ztPuzzN9X;d1KL8a!K5epF7A12EB25wh7e+Rs@Zt?bm&S&#ZnR25|&IFG-AviaM->} zn4=A1Af3MLpt0J?D9M|4UBSs9Qs_BX+V!+iJjtORl?q!G)JT`__rt39X=_m+uEK9}V`-A=Hba!T^^ZQV zK)mvLR^~Ac_n#w<#ULpI zO~Nh;RBRQA1W7gbnL{WC-wDqV7*}I;l`+b1FBpIv&0kr7w%+@8uwm5;5DL)w#D;v? zhu;N<=(w-oRO`DFTcFkL;nL@8b{VvyB)T6oM>`|oaUDytZYup*FM|i+UpEq3UiNG{ zrdA27hz;Em<^J$?bJJ8ucFQrs43T1#+g{RxV)vuG3?vquR~p!y&kVaQxCk74ma!?l zoT|}+(>HFhsXK~Yh@+Buwmw5 zv=DflISl_3994e=N0oa4H~zms*y<(2Yc{)Yyx4Q(fq%=~`&w*j{!+9)j!MM%=~ zl`xK_@7G|=>ZMF8K>w7HPp@rfHARnK^cq(g?WLNgdBMDc-EuS-Kw{eAgoD$`=s#x; zud#e^8HkJsS6xSaRPCoyKTE!y)zfGp+{X}31^(*jr8`Egsc8WBRb%e;8*1$ABNWr_ z8p_c*VyRC7)YNfQ#9GA}&6|AoO#pk6a=Vjb6x)exnOegzkXex`D{rRi*WkHUX-i?{ z)O1#koa_~`0FW_DswK=kYJN)p$tx1Vu7^^Di@|>)L#~Gq1E;8XyYWw^ z6$C^BU2YT_n?Ha1^rzN4T0%0g3g5<5-qP1}!xkxCMYxT0b1KvYav<1H3!nhhPXKdhePw5fQS)#ak_Iz@^WC)E^6;$W69lvMF- z?w4B$kx?j-dk_P+AU{zQfToG;@XdYH?m4D6xHl)fpO=3wRG&86GuK-7p z-{XP!(PQUsTt>bJsQAnA!E}`(8t0S*cG1=j=7=SVzU3-m`2(`HX#N%#K~ zAOLy1SI>@@qJ0Ltf7R3)zU{KSF(yZYZyj$mAgyi2B(HCIr+}iOFYeMo48eOBQm^0| z#4QRk5>gVn?c&N4N-Q>3J2a6hoE1O{XF!tR^wyX}^J6t6ci!$_?|v9p_gJ%Hh|swA zXckWX@R_2gmZ18vKthi{lxIL!HRso8S&_EnoW-Fx6rBvzHV9(TkAI1=^M#aJx|mI( z&F*S1RCv1iP8hg%ic_=U;|3SEzT17j_>A|j&9H5b8>;0(QKO`u|$L0L92?ViIo5$vf0rWAYwiK3&M=S zNAZajpLMUXA7QIb4&Ht5+dNpc-mg>jPG^V_Ej^l45U4->>E1AkHfgi*l$68hoHJVe zN=c#@&t5jYgPxILX0|lKS8TxTYc;yc6nOU6&OcxHl!K*kc$94Y>_K9nk4#ngk5 zi;ek}f-L2C)M0fOlT?s=AK^mo%S@dqtlQ$(dR4Qom1@NsW;qJbv-Sm3CjWe8n03ce zb)UumV5Y$9{owxp>xpSpd^vKnc~f<)OzgPq)OeMQmeb2&&7B%_7HKh2dr(`Jfew6^ z_ljPBp;~0Imzy)jX*E>80LRPB*+A*<`()H^=;%(|ojAQ-He_S zLZ#W2rmZQ%*+IJm0X3mu4x7CT?K6^ZROO&$w&ZzvVpCUH0s>Oz->^hV1gaM#__ikn zZm{byzhhq7L+|74VDL+f*jL$yqJ|b|gYPNL-PaTW{p;SR_b*JsWVEbemf%jww@fh~ zeXt&I^uGLd!*a~j<10TJL*05NkuybH?4#BG9;#kMI#0N0UC4#!28#q5o&kWI32{jf0~ zTL%NvF%r%x&Q(;MK2C#)RZ60#o4R@cJNe`vw= zvQJuY{n@}%>;KS#mxU;h)CPQ-Kv_9faLVLoj16!-c2>IcYL;y7`(h|3$h_nC^eLpj zlQq3D`(f!aqH18NGS8qV;cRuZ;WVh$geZR|AW#9>P?^jytrhDxc5uBsigM6{_W1id z`BtYG9>XAnpE65BSRV<~CZNV=WBzoXM~HL8sJpm%XhH=?r>E#p4VORDMvcWF{M)!#4DJKC(P4Z0(l%rQTGEuQ;Dn$ zA6sD69wkd>ZM4el(IG$*5))vVt6n|U-@WgwCpqVko>-azMQ>Kbv56H4=}!YKCcF9d zlrFFR6{XGtxTn=isQKI45DMPqh`!OLn@2Vkm3HG@C3R!%Fb1_Q)tOKicsf{YklhtX zzv0iW;3A7ng)79Ewf#nj?BFIYdiAY`jc~G4wqs7aa_4H zFEdOKEw=i^Ov;BkZjz{CkAJ)X3hk6n>(Bq`SDeXhti9XMr6fI+{x3q{&>r@AXk9uW z-a9sfJv|P<*U*u`00@l=aEi{_20k!gwniXsHbGEcOjaAm?U;3l5?0PCx}Uh9&4x=; zKz2@IJu1m1JU}$mYSYxT-?m`pC~I_<^M@W*;*G^9nUV%j6KvNGo@RFkA$eii`&BVi zs@nQ5%e+r!;BQF%9JIiCaPl@N>1qJteeY4l##{7Sq_&a^pvx7)@xLjT5hKs)%C>yB;gE8=R6)eUv|M_~ z;xhRhzeg{_YiHHQ3%3Mw>+gUOoW##28R!52>A$}dP_~Ui0%TxXey>39COSo|n_8RS zGyCC5^VklxM%NEEoXpvoBtRL!m4NAWiQcW2-HM`z#6 zC7T`n@BWdA>~g{x(nv?odlyPWG-Jbg&bw{gnd!(&BU%@$0S`?B1l|k~X@N0?!pr?hv-&;w{ z)EiTlTpFW4oYr>$AXVE@Z}ZMZ=O53}#%JwQ3l>Hmv}mcispe!=arhd2sgx<{%~A@z zW9F1!jqjf?lr1D};cX{WHY2bHd&x57g=p(}yiy>;gpDhec2sSe9mI1}SAJz*er-Wq zyz6YTxMHEVEUgC(>E>=Wx?|V;;!=kDOwu&?)ZuLw91ds<;OXG;P(er3yp2eN!N$0m z#5!j0C3{2V+j0FnUo1I72W<8N+Ekwc{x7HMONP(|ccR}W+5GJCflVS3F^X6UTe`+&tF_nHnSNpa#pM|&gxesPdfjV>BfzBKh0JBBs z*_A6J!ef*{gZLW#xrpu4r}8j>bw{j%Zdd0?ue)b94%b%0%?|*b`zzRV;_JFozPYPL zrETb$ibh=l6%dI0>IT@aotU@x=9?z#srdVPZOvNyLuE_dV+b2GA6NrR=f#Qy>lza@ zm?BXa#t=JDkx{P{em+E?9*N21vERDsfy2l*JzPDT7?bPET;T5Stv~O7-7qk-=_&>C z1ZfFG0Cz0xdO7x9G4@(#lrN*+ydHUsc|C>SELd2nd0mUXEab=M!mTTjC-_#hM3oi` zDfI0EZEWWA?FxN)s5W7&GRca~Dvk@YKgoEjSYPn6*_v{Ll7^Kc!YuE8Bn!Au5Ob9`L&kCg#YGC6gkj z9hpg^_p6f5_tmnuox5-+OV_ccni5nBuGRK#vzPlwU^m?w4o2B?y;On*t|RBr%SGX+ ziKPo}6}-9}Q&IPCi`D{I{rE4vW5ws=BNn=hf{?c(H7KN$$B`n{0YY$Q3VAJ^YF9(thxTV0(my=B;p9B8Y*HOu_VwA0- zwQ1yuM)Zg;&vm%446erqR%%*PLg@W_iVjf58%0Y`Pf1*^U@vvI(;9x%eJp*lK`Gug zZZ419U1kEnuQRb}D5cfQGscuJv=Y@W7AwU()|8e0;6LK=f41 zvOOoFHn_PxJ}x`Tc68@^2BrfB=y@!+?AVKz0)Zgw%lE4+fpO82Fc(gCzV1KA42Yqz zK^DHYgqex_L#z6s!R%Hs{PrX8lg z!FhnW0I6-2hACDA8oo7>&nJE`EO&X{H*nqb2b^acVX@jr1uigl#ew+s zCN6S^7Yb4i7U^v*Ec8Uao;o+37k9Vm9CEAfx6zq{Mr^uX1aZCXL8SvD2dnJ~{lLsy zm5&Hm?oV01%HO>oyr>GU*dV36O=5E)0N)5kzSdrOFiSvvp1l!&lAcL0_Jj*ycdT&m@@t$bbGc4 zoeT4^{nv=TCLGzOr#&2}NP6I}Wc8l`Q;RaV->kHf!tU`Uq^kC>a_3963|~0|!BM>14s&H&p9B#B_b#8q)QqH~Cs@ z9)(!6#DU+VKS0d{-mRl=#L_i4d(NNl{fH|GVA4if#T)po=Dh5!CYaR@&$8bElrs?h zBo3+uR6!>o9Q7?AX0WX=KI(p+;9BJs1x_a+%NyPMv(4Sy1To(b7-WI?ozsAXc$sLN}8clX%GgaeA(yh{rsQz zoafX1d46kFUF%xcYRHNS9%d2`y>pb(Skd_qWr&u)B#>|?@Q>>n0UucYLAL+L*nds? z*{Vf1im4UX%Mg6v=Vdyc(u?YZ_|{Aj(ljUYnt<{vDCG&@6*@%(iMzwI#fH1a{E)A= zZZb1i3=5I{Is+1|5&itHYvjKpEwH2GG<{Q+d9JX8dRW|xjUN8XPZm!?(xH2Z_BkV+MDbR|8cOKlcp8&H#QD> zDT&KltjZw^CMCeJ-A*fGk0-kjSk1c6XXC=zaFiCCbuK4ON=;vCf|1vTo>4w{?Bmcb z@0s@J&PnrD@<_EC(uMPHiM_~SL(-cfUl6X^Thyu8d5H9E1RPtK_1 z2miB8Qj8{rMHBp}F^TrZbqQ2$t6K%d0neL_*zsCN-ImI2;zr!O68)voiMR}jL<+Ri zl99G*BlAl?QNuhJam1jsP`!q$_jRmwcPO0?(!g_c3zYu)P4M+?#Y9v22un^EM!r7X z8x*Jc*YPWzOKhgbn`?i^P|re8%j4rxxZ5v=w!hdj|Nqo?Mg)%7u=~16HlPGhGO~Cc zM{v%LSps!7V_~kFKTU4-U2ym+Y6KzbC%CHze|3=+lvqUt(2@&>JwILav7M9szi>aWZzWuKH*n|acXIEet@rx zQ9HqYlqosBO~)&&S1p7)M3BN;`AzaCc#igKC*hMpLRJ`d8gds^+L~pswvQ5`k<0{q zR=?ytToXw=olDTo@pk8DUc4*ehMd30qYO09?|PVSfBWHvQRUT-f|V8a9|10vT!`jeY$%RBc)e#g3lgtX(S z^*heRzVjnmI`#NB)Z=~g>L%yU>E0&Occ%YBf1YOVYj`-AxP+wloTxvVlM}!=bb1Y} zX1KyL&zPD>?hxTh2Pr6#rcac^9c(Lam4la65%-u8e z0GJg1-JHfw$g>Oi0;&U(c89=kiFIPKAN)MEg0$7<=gVOHTxeF!6_DW+wyT{z&SnSC zUwhn+$^pQOwMR7CKtV!u>+-InT*k3AMkMXX4sO1;rrX8-$3`9iDWp2Jk$0c)hriHf zdp3)y1D2qoiWWcjFj}31t9%@zi;5h0%nqezpsjCB|J;trA)eN+7aV}>E2fLS+3_(u zB8i3Y(=B4n*GONvIz=0~wJp5|6Jk_bO*yG^Tn3fVcz$#fqOj`)cfU)B@(ve|zqWrS zh^;e7diu6j5;sgdug4m({%5zL>s+%R%I^o6Rogk~%cbFPzw;OZYer7A=F6|**JGsD zR4)==VHlV0U`<(MREnb_8(3XuDk$LaCmmkowPM+-1)xpw112b4-`v*(zMp zq=SK_PL8BdqlcA3|HL(ypNv+M2=-hc)vKm|>oKCFUcY)$?+;GAqrg9U&rSfj&UTjbA=cY zKUr4LAC5$*QvXWbW7H~Zc}~WvHhO9P(RBe>Z#{SuaFWXOTS;LqiLg>63t3s3Ct+xJMiv6#6A0!L(*4i-L{E8C@X6EMYecMKk_W@8~ z*F3&=bNg_sNsz+>V#MHiELV9P{+)YmcW**+!jxBNH|T0kLo?b4ZtgR{;J`=1v#5`A zZuIO(8aLW~JOtdznn%LXqq+Ot7>qL;lIT*>-1r^Dwc`-+oY{#CiTD*#{)enPtx#Y|8 zK!I2X5PwXCWSD7n6wEv{>}w8<&g&6rv8;XY?Oh89iVNSOV`hxiDVCyRTfl35_I>PK z@H{|Iik+}dpjRlCXX$|DA~9VLu~XiFC)H@9d!*pg#ittL@h6V~KZ=I4HME~QGE}=j zFNZT-N4Hy9S0)7W58f66M15Dj~GH??GZ6(;r#a3F>C~EZ3PFeZe zaY&0Ne}Qm!zEpJ~G0cS4H3ezo3%-JY8KUp;A3yLc24Q=9ZL3}J{a5ydQD{*r*NY4o z0F_-!MKc$RE)1POr^GB1IMQ%})lN1AvqlSq8p5RrgltAy*X4*Zg{}&=AC1dQtdtw5 zaYbwBql}1-%jl^Gbyg*c0wCa<(Lq^8U=sM&Dvz|)TfVRkExW)>R?~@13ki^RywKBQ zPdo8PXEWe#qSbRqSH$ zl3;CYrLGH*pj<$bCM@ukO+lvgeBlYxFQL1iY?Dio6bry1KMA3LgVD{6@%>Dv9y0?; zHazD7js#XW&C9TtK61MpkQOsJCiwi%wCWJe=%gue+mH-hx$0;|&SbpGSHZt_lqL12 zjydT0in%C+7X7S&yqqO_1TY4|=12rnB@5tR4Gpi%z$UN~cxIV^sXw8@SLuNuk7?ED z$@_iW-Be0-#Yo?Lzc2Bb>Dtu@?6&qlaQom$qkN2-8clZm&nTdciV7CnJat6UHf*5ZhJ1H;T$M$2P*@j}YLb18CT zYFo>M1w=r8i~*w0f|2SbQ0hF$xHeJ8w+}B+g-o$jZ-2@-bogIABkHENpM34OR+RH4 zR;*{071BH`g7>pXVbO^qqiyNk-G0!+)S7?L1TonbWr*g-Iqj*V-SoVsp1bFFp}4K6 zpEWd3r+S&#Dvir7Y&*J&47xiV^8Fh|xNv6;u-!iDoUt752SY{mDb4XYfyP5(%zZ3f zcyUw7%7CMADGuVIOyJ5c>GjULXS-u>1Ud+Y8NXw}=3DuyU&@T-;S#J^U`)zS#<5=MpK)>-N`ZqK4@UfEM0J|%HzX^Y z7Dt;7@&@Du7 zXhX9}&+V}kNq)uR*g9Ec4`Zq)JH2t)BQiwc+Lb1z13lU^3$UV%QMmbx&R3k(T#9+v zBZn_>0-RU@JChvuEt(ag#~so*5Kqy5y)N}mhi`_W*nl8-Be zSsj74o6@)AqGbiH&uUW#;FiEvDf}%sC~RTlY?LjHMsHizu-9a?mCeCQMD@0jg}Fic znbXJIR(h1Hvx;1=Km=>h>EDcc1x?W)Jm3Fw>?HwwTSK+4x*{H>KLr$HpKi5x;pj3G zdfQPi`K}kA{Uw3DwtMWhfZiVZs?W~kDusBPAn37lYV}Ql7Vq zpB3T;fw8vAiPnHB@ot0LBcyN=z*37aV5>V|b-tr`el$*pN5t~jdX~QpP42?)=pZhw z>vowBUl9piO)Z3kV1W4G3+@5z93won@Md7sMZlxZmgXEfIFh9iGoUo!0C0jY+pK2U z^y~6M1X@4&tt7s|r6sd%h2e_! z`JmK$wlPCXUhCL5DSzvX)1+fTQGUGq?s0dl zN3oRjkl=}SXp zGUXu}rPf4FhEU(@-GDc=u#O;QSnwK-vfDXm_Fe<>>3;F zRjFdX+g)jLS>wUj;vZm^R(vU1{W%XkZQI4-$ch{-DtpGnlEdao_-Whf!H>o+8=NPG zpX9qAG-La%>y|STiTKwx_kMYhe~@739=s2U0uJ9*IS3T(rFjK)%;$=*dnJxZ{N{b#dZ-u?6g2lStjgZI59KTV~g$) zPE)AbrlJ;Q)7XYSd%SGjHc(_k-8(?!4%ejo#YJEz_7-4N?vScGRzmm7(|Nu1IG?;_ zI})*cnX&XpRD>MGixYWVAEh_YXHBf*{0;>cdm$+XPyuIT9}Rp_*+PLt@;a&w#ktIt zK(ttdwUE$DKTIzV;9A?Z1-^};Bb4V1Eexq;PLsAgYng~$9KkJhu)u{(fIKM-b6QB4 zJoNM(7l|_o;mo@8$8T%Bk;wpypzd!hqriqIeIw2gF(y+2md}xS_#So~9EYI%yXZz` zu4wfQW9*h{_1TUNCmo|gJ^hhr|M#zgs1oIBTq+wa7WUJt9=^RDvwE&bQBlXxsI_f{ zz8U~-8P)o8@5D=TMM|7cbsX6m?fk)0>c;;$8@c`g+uz7Uhs;y-@7UM5mH%%$BrsC; z(Gr%?0p53jyP9Z9tvylAN~&wNQg-dGl@*GB@7=&VBOi!Ix_sGKR`P;J^*mNWf{2ln zKbTZGahIvWR5#*_whV_CS!_+X3LFWh;HSGTc8Ds~T|&h*l?K1-lguU>83eq(7*Bv# zudxd^!jIs`*!?><$LDpr@!FpV2^G$8JqXnjwJG%$PT*$ToI)n)_`aH~3sFGDK2rzX z*(!)a6CAcQ=08-yRg*mgjGfN77!;Ic5=GA#$tsgy%%q`$rXR4IPZvtm& z{DRkLhXMBta0~@+Xdcrcw@xoowgY)M3$$D?<0hcZaGl%(U5_%OL0RkABbf{;rwFMt z{k!j%h@`VUxj)9QIijDA#G{Dfhdn9LqE%*n=;79_sd3OrZj06WL5kJrTc(zUz3%_h z<gXCUi&P$!sN@|oxFFW_w^)Bnd*QU9w<@~;v88;Sp)O@OE9qYsu`4TCkUE+KF1 zTw=0+qHz0_4Xs~-)$^kd^iMEdznKQ+d!6PAJ(PPHAul&kYCeZ(yY{XPAoW-J>iO@ssAp$btQG%|aro|j!Bc0&rAR#7tB(DJA6idl=6AaoRlOi% zZxfKf!tC@ZSij|Pp~c>@#&N6?izz;}N|hmea5m(%31x(-qAK2p1}M$bhS);k%bIDh z(dR!KYa)mc8twSicVSdB^hl!txu6ZTCOv(_=Bv0_gcfq96Hl+Pn6=3*%CzHk*0}QR z!S7cWEcj&-B#|A@#XV1F{@pH110N^5|AsC8*MmEQA5~xBpu>Udj>+{vUm9{ivJ=WP zZ!?QAVoCJNXGW0=eFm=G=ufIP!(Bv*$)20z*#10_C@N~>0+xrcO-KUYM(GKbPBpA& zYH|b5P&UxfRDr{D#+>;^4UeQS4MjADMKONw=-WrM%DB_Ug{4Xw00NNE*A|gmXFRDc;Mj)Sz}2jPq+0N9`Y=V@b;L5Ua!Frs` z)C?_q7-*`O3-d=VIooo*1m}Rnw~ehqg}4qcG?^=so}jOmL+H%ZL%g7Q9G5wY;u!tP z3oEAFLZx+vWu^)74c$hS_aSs-t^r7cW@;(x*4Fe$)Qif)l0;@mP(1V%4{Sdg zJ+l_1W^IrQaR|B0dEF*-BJq`lphpQUJK7U4d6b^|sd z0W=&fF8oo8Qo>Pll+6;QDZs*h1uZ+{SK1dIVWKIr_9%*#q(1D2NCWfLm~lt31#`-kR9m5_=}$a zg)ijjDvsj$F~C+rmuk5jiTLyLV^!Q2sJbaJiqxzsg2?@ZhYd@?P5;%Eg>_?oe2Mq!jp^1Ujpbx69|@%=S28ewnzVP8C7m(g^)fndijFpG z+}NxNHOWF%pW6q#$^sK2odet~N9-MIj zSN(F8b0Fx}#lTMn%1Zxv)Vhk#i>QQfq?_Hs=w(;^WNA_9C?}K+LZH4K9{+*kd6xE< zM05YTDJ*5x6cr)7A68Y2v!%oZ&A@B4wcW=0XJ7DkZc{B%_)rxw6kTm7VIdPlKbWTI zlhF9*4s{vdpykB5CK|j;8bM60eR?=H%C9da7cq0{>^7z_Y&CH^l!N}6Y7+W$ne2&p z71NS5Cm^O^Lb{iq?4~u4_J=msh(UuWJYY!S3)gM=t6VLzPG>btwL=V=}zr@)a-&kPKSgrjlC z2an6sed9dba164|fkZWSUuycz5_>X88yjlie(vR@C^EJw6Yu&PWI2+4T4y>LDm`%f zPw>5)8tmEb(^EusYC=fGZX#7@QV@C+9f!93^X~CoK!8#8+&euzy+}9%8~%c2t0IoV z{#8XcAP{(jb%N!L_2zv^)yYhVh3*RD*Ku!IBK+5SJG#5SOJD}^rLFJd6pYH#F$6sBAd2;p-#)i$c~Ib;2}h8>tb%F7Or)byDX8cxSvTZAcOuPU z7{|}~Z1|y_tl)2C4fYM6$BC2O$_7QYyG*KDIrCv)dbw;ijO?~YUWPM3i~Xz|0&Rvg zvq&^asuzQQX1(aLF11{q;v+pk&MhIzPs&oHL)kMjX2n;@*do_tUsI z=Lr1!_h*XxIwbV6)KOErL@{1&2r+8StK9Omt|5PHiE+?O&b^uc!fHp!P`vtkb28N+1j5Ps3rjBwPbQC`>I_`}6Sn zW!(4kRBI#Uw&BEtu2FPIxO)}U6T1#fBMp_9Xa)5};8uR5QC~R}GeQ+R8FbH1b_F4r z(?mZj7EQwPQ2*; zb}n0P+~~*q%&cnU`~$g@zIlqUPZww?cw6;7VWOB+nuIsoFUaQAaGElQxbxsAzDivN zDR+)DCCmz{z@lNUXf#6|Zus(Rt90w|hel}xTV)f`yhU|L2^z-t==_UMGZ|Uz>>381 zfZ70yMOjV@cnPE8t8`ULC||F#ab5e1yN4Uu$t-4V`pI)t=+1PK{afB%cd40CW6~Kf zls8r3TgVz}0Q+?g$~-e++f6rVs;pvDx>>Uu8pwzO2hQPRS8JTn?}-$lK;PLkP2%}7 zdQUT-u^JY~MbG46CEfZzLR@Cc{WmPVPz%GE5F-Z~0$V=LfiF|rK5Tk>x_tpJf~!E6 z9FeRGu9f&wGm5We$~Rc=qRkQ|G&_|RRh&7W=QJUsI0ubklf7B`HA&j=RZ(f_NDT1$ z4>}VTbi;hE>zziiY8XdvW2?+A^IQjW8dd2hFvo5UUR{3|9Obp$o8A@D6Rq=syn~GZ zB%Z?|d`RkD)70XSrfI%myUA5`4OdGxw7t_IJEwN;0x`S9aF?B)uzaLV>$bpnAsW~H zvdlbQmwF5Hd&)OMTP>J)R3na$CKEg5AGyVL*t+SkRe>X&_sMq2!>`GSrPMaAlY=E~ zhp?Lvn`}~w`jL-C$C)+Dd6~pt-Ne#~jWay;6y2#FnK*P zuuYqhP|ou~;F4l#R((32j3I*0p-wahb8=K0JLv`U=azO;XzL0zLD-<_dSVhTn=5s7 zDfqDlHS;TMi9Md0DkPf+X`EO+2y~)Z8agTVd~sFo!qco?F?_~e$42O6oB=`oPSO|R zu;^DFCfBA9lJyGF1r9at$FHKi>GnGQs~&+ZdZczi>qed^!Idnkj}ma=FXDAg&oG!t9LQ)f4DrP z#l>A6wOPe4uiqPwB9z$qB~X+rd%DDdmFjqzw=%bD$Fjy*PqWV^iyW#J zs!6w72Or=xY%L3V^lB}RoPO8Ki=0n2-v^V83=Icjo}CL0KnK!BwVAh-8$b!w?RkqG z3IGFc{&+EOsqErWZ2sr=zz>1=JphGs{+O-zma5sOyVEoO`G)^~CZADS{i9f4DT7f6?HMi_iQ18v}V{WS2A+4?$}8wF6L+L1LU1QD7ad z`Y2}?sea7$0iYD7=n#mgY5FUFWiBa1z-klitc$7Kw(gZLJk$y-@KS6VgmGcsqb8^+v=VsOyr-(}Jh zWYx=RBv-Y>1Roz)(5p=5iILL4sN*{L7IPD(+C5rdG=iIxn5#_31O<=8#|%iPv^ts1 z3E%FtcimhvOmG^-jgb19Z~*jn=T%EdzvdLt1xDEXqOpbv<;<4pj~Iy0GP9$+@A3^u z@{S0FEfC$B06FQ3MMnR+NZmfHbVcjr3%D(<3oK!-a+Yvs39)PM`YS>!|# zDH>0})ZK*_{qcj6Eo_xM0LQCv9nAhg3Rt-!=z>ztJeqG4(y<8&)_-Sxp7UzDE>^&s z0-~k3LuzW-`kRwSB&y}d(@S|LQABqqV(29>v`#n9JpQY}2WlA;{6)|v5R%W2{*R8) zxfcC1q=WalD5>^C#8Nw7+dB_=94t}#h|g}I1m9YPYwSf;-oV=CmFqi+=}X!1QJT5Q zvt!>EW4$>$+PPoB0!o^81nkR5CHRnr7xQ|9qv(3rdL?luWaKZtjR9v(524vGZT!oF zD@e+cPcD*N!zK$DxfDn8cQDVvQU-=3ctv}qfk|uM#W3yYtk5Pqb2N!YK+2HKQ5oL^ zLqGKqm(N_|Ij;A0v7Dz*%`nK4>u^_YK4yqlQJD2)Icj5VSoYf&*=~o0Wfu(8=${8I2k zGGcgh*mzIVf~pfx;j+hQr^SEZ#?E2O&BtddWIr_sBEIqP;hL#p;%zIRq6KBg zW5@2(RRGld-m1_^e$Uk|0rhF4f6RnimbW(#=<8O^NDyJLk z6;C%FF8F#L8L!dZvx?^L9>V8l@Ut7L0M@O zfEw$fl~0Pqg{nmdR-F-=@=~Z^a0B~@q){eb5t*>ud|lg9YbZ&0P)t9x)jVBe%GB5~ zZA^~Ehq*p;j!RN;*gIQ|m3@kE)*-nH|9a>?_2DHXkUGlxW)PrdbJg0E zkHQ_(vgJ-I*J?!A%c55|ejG8!n9Q4vE8uybp<%0|gLcW0hQSY*Ke9*#Z$IAs@n2=t zuf+8z4Br{PjMGJ&56WrAiZm>BN%>vgyn*@8E0R$(GS(A-x)@D7LcL?8%*3E^8;q7d zTqPLpnm*rwWM*r_41zcjeAfAs*tKGeYvpX`2Xqks%^~86qY)g27cWD>x*lUl_Wgeh zxnlD?UM$p;c4kRb8TARm>bvazj@h+JPchplA0gcEAFjTE?jMdG^%aamU>KaYnHwKg zT=+?P=IDFs7({amv)w@s2{urOPO9MI&j{DZlV_1h1W09v`lzMA~B1(`-%RU`njcnb`%3%hEDbCO))T zwgcQk0y;Imi8^n)DyaB$bo$&6#FB|Xx6kG|ZpagydQ-%fV5la8Ku;=?Ou8+?9@Yk?&iMx4WSiEQB&_=>*H34qwbFS+?F_ z7RG2Cev0h)IL7<4ie$)G^v1&P@IHb}xOKtuS^=KaUu^#HlIE=yVok>FNorjtyWJI> z$7HtSlLlJ*Xp7~pKdI+YiFP7uy{YcNpZ7Dx7$Yy+XrNbsNRf8Oe&G8%{jX!8w%^07 zzD&|fAJq-(l1G!h?S8lKh5bKFj>5l~9GenX|HY&9s)SkfK&t~IYG575zY5!xNaN`y zYu@~D7|zbM-nu`!%o0^~wF-`X2*hGX-$BZ;cqR`Na&UeJaKe|RnvzRadwG)$Li!~t z#{!*GU_?xRWrDi8h1UK_ciE)VbZWK_y@x+D+E$vG-q2KdxkZ`636MMn$%9#B7?H2V z71#{>cke#*=Ls2LK{S^dee@d)F3iAcN@SHwY6%qe3qdUqH4o4!GuBs|K5f3+F#?yB z2z%p$85fuvnw6_;tYltm#JTLmM4qrU4PYn49Q7?yfu=3&j~tqHZ+ClZd*WiLmXmhZ z5>x^Ou~=RV_>Rs)4T zE&2hrrZOFjCNyK|sw}$q)$H1WjiPpBNCpV#@xU~ZfKQWk-P%+U2-|pwPLA4dvU&7L z)r|Z6&&_)NatFl(QfUV?=ugALxLm^W*rd`j>VE2h=#$b}I%$>&4nd7JCu$WGY;plIu<)t@iOu{x;VEU#b%Rb6X9uf*Toobugv<3l+(Hu!!bx zW9f-%AK)Aq%!fgFnBOL7u$Mjt^qAIL+sG5O4|;7)Epv$Pg3HswJK5*>yVW>+lzA!# zH5y?0Gjgk$$+?ox;?XoOIj^ClRHXCZGXm-8tLb7; zkU0H#6Z$E@H9>|k!0&fB{n1%BNVYJJJSUIx7xs(iKbk)JUDE(=nh!lh&))| z>43ThQD2F#r?1BNZ4$1$BJ#W+H@7g|5SeaXr*ZJn-Hc=C_SE`WV_mUZYE{XkDqx;5 z(dy^_+fschy1j(8@>BmK6FaZJS`>PL72>ut2EuhJnrKw%ufr!N7HER>+oHu4Z|qYz3$rCYHCZe6wRK~Mg8{z$A&^+@y%os& zs2R|M^~`bejJB_k6xzA_QE}MAWy13iCbwaSrp4mS`%}yQQF?6cE|FAEkzVvWxw_UA z_b5=+1(0Ce9`Fc987a?&+A?eg;#2igktUHaMcVNksK{hLJd4S2sPDmc?zV|k#6Q|G zlO$qyA~Hh~o2z`H>UGnJ?qfTNw3#9fTWXiLe3S1W#k)j@L&=EqFB*Qost*TVVCEJj z!kfU0uc~Mp3A=tS(>bpTU){K5XP7I_mc9v1;k$Ifzpj5>YMtV$G(_ve4>%q9sN%PG zM6_{Lrt#zTWFu;gQLnqjV}nTz6hn&`fe=_220zQd^+{@}kTS@lchq-%)5jT`8u!iZ zCpXUs+gb?)NBjui$rUte$eNusAI;kSbzL^dOfAm~^T)0%a80s+w`2{-H@9!qI;?wx zb7lzP0UwRB7!2|I9W74d6c(Ad7o_+C zh5y4)RT05XL~6XQJyU{TGYtO=%wz~N0FB+%M}=J#U+eZKVt9I7%b|;W>2$5begR)s zeNsrjShzV+^DWz1=5lbCWzfS*#|0hzvS+QxhNB9M^!2uE!@Z2o7-7szhg1%WnQDIa z6iZNdTxxvuOE_Ji*d!SJFe#~pcrhSTVsz4x8Ihv#xU;VXId6Pg8TtAl76*KmYfy%uK%Uk`sHDb^w<%x!TH z@Gr2f?QB{v(Ls)TWiT&jS4?pIvbJDw?N&Yz_x2u*Xpq84hlboVny=BC^cQL(oZS>_5$ILVxZbbNkcxa^ajd*H@NpQBRnS z8zoVZ{u7q#Fz{Nhd(1ow-w4zGNBd;V!$e8?ZbjHB52OPU_a!?iy;T$ha6o8Qk#U%Y zFGeaKhZz|6XcO^V?B9QKw?|EVx3>UC-a&4IsqnPdi%fX}_RNZ*3^Sdw8F!~G8o6SY~ z+L-3E0c4>VDLkX@3V>V&2vi2(h;sfC_GVP|%gSe%fvns#AGpeJXz=c!GN1S`SVgEt zKiDJ}g>nzlTkKCp(a)rUh2r4bfc4%GX$Pd@2as;C*%prJd?A4&qrp@MSb9vd!FLpJ z)Zia+i*v=LMrXsJFId(#oq!Vk7%f^NaWbG>hYob2OOjt!>+a&^7OlMg-QsiCVr0O+ zWiRo7)!=X!OK_$0ij@Uv_>M}zyGr_gaJ!K?PtyvMl4JX7cR=bZ>(d=u<+!nHExkkevr1W?~a zF5ynHXp)bz|M6Bc&p%Sp8T;_plTF;!+?lZPkfppgJ!_S(gKrSD}YIvPY!uWFc2aIzR*9r8qijiRWv(JoC zMdO7*LEA;+(jPDvogohmKQVOC z-AA|eXcrLYGqiVW7*aZR?* z3T73(sExq>4z@ougD$=gmXn5etF#^bB2~GVfG;asufsP%WaHQ`+s?Lo_-)sN5Q%ZS zB$8W>iT$IoE-*SW2u)@qO)-nW-6eBoE3ZKRmSs`tw-0xPD@C7hj{3lj*Dk}*EWE?! zG1!r~v!e`ex>(Kt)$mjJ86<%t=Jg01ep`xuBzmW1G>cn6y#!6MLMi=d>uo+i#0Znd zS2+~7ZNAYC(}Sv7FCDp$1ztY%Bf6|AxuqPPGVf^hrl8uiX@ybA8M4z?$6nmW)$4|J zo+MMUB0fu{HWHav`~?R`!z%J%<{bPy8Ry0WP%~x|26Rk|1?7~&ev`qVJSw5;#tX7?D5);f9NkV{ai8u zSL-Jcbeh_R*4%>fYY&}pz~_fXMwBl>iF!FZ{Coyn5i3=FpYN$qC}qe` zJZFy7@b&M`{QD2g>8(w82C3c;WQc|My^0Wgb|rYX_#(Tk5NE^3KTLiNutNbWU!TM8_zDBs6x%|i(9Wz}Iymt8@-K~l zZXMU$>)grJ)9UKVcHi}>)kUumKz$-5YIMp#9SffzZhXeaIy1U^#kX%Sc+L)e-oE(t z;vFaUq$Dr%n2C z@o*~T36A~A`6m8&F|xm7o9y3&wHS`wn7EB|QsFerY_#G^Fw8V{7~`up#dGYpol5VK zIOmA6x`QZ$A-jC}9x*Q8a+J*`Z2x>6V?|>glLlK2WhliEb)$kRb?|@_Joo!ntcF>= zGvu<8Lwe_jk3NA2p-7?V8yxg7kXJ0IeO(3>EFP>(`RadvHYT);V|PFPL<{*D{N8xh z%O9(5AfZB(6j5_i!$J51Dt@EG|1sd{-`mzo+w-$4HJ^iwYkl1H%EA*uU3!5ZBTCL zST{i8_v&ZA*OE0l?rwzjWdPECV>fKw=3fzBN7+U~4s61H%ZTm1LNTK!9OncG?c1 z5)WY=sl&E^%h%U7VxKYPf zMRHJs=Y)w6yeaZjz*$B0C&3!nEmYascr!LZSD))m&j!mW2s1y2SRKJ1l9>9=gc4?dMi-VGq9@nNZS~?+K zTwHI2!hAMjDxeV&SDV|!ch9Xg47l#Q$fB|o#LO>0jchAJI^yjzI5cPZ-e3B#jn}7 z3dWup9|pOr+UAfWK)eEAK&?KGJE=K(1>Vm79D$g!Me^wT-xUQ$TpP>)rd3&wmmP}{ zU0&zW0s9ofbt6AfjyIEODai})CXNQQu#M+1Hx52Z;N7k6D=qeBHauNa%H|dk+1&67 z*%_Hl`>>sXDW44WfK)hKcpsNK_#Nib+98PNX9ym-3ZN@2ub7y*4pfR97931LOonX>iM#HW zE{C}p*QNWPAAuhH-)OhVoVChnv+%(lYZC!vr@-n;ZT@r&ma14i#PCDpk)4sS1HE$$ z6^6xc+@V+ecvy?9DQbZYH;;m$?&qXmE6R9T9*f(Z?W1*&NWL{`+Hzt~4<#@u{9_jZ z>0m&om%Ns=#D53Bp;yBuTDk&|eiWycxuF&o%PMgb$Vi1gmb;#I;`~v4Czx+Mv2Kk%|1XFOuo@1A|+sf!+5Omm* zk#i(gIceO?BwRf;Xp2t)^!WB+H{c59zSR9O{Al&-zI{iVr5cy<+q0Gxwrv^wN_EJ) zq29COid>P%Ab9#(gQnFdw?il`yEfiH2^L^d-00`hXATbKV~n!zE7&d;1&4a4`h66q zVgeqf6D1@U+VTcr9>Dx#)@99-j81GVfhta6dqw14ix}@IQ~m8* z|N8g~qoW@1Ez$_IJjxx}5|*mIs(nYhQ6>%w?)LF}h@ENw7Q!jhSy6VDk!aY4{^D0+ zE+B`=tZO-W)xO?#Qlw*Dcf7qiaNmGgpX;p-*;I_vviM-{2>`aw`~v6AdLua`qD_%u zD>*1NP$qFg5-S5-4X{7i%mQ?1`~9X*ubvHBef%xrI~#w*rO!V6y+ta>n)sc+}^bVuDdCidRRM*wOv+vmm*y`kR=ye4+B`my7AAdI57x@?|H0B2A$V+&#{YgxM zzD;SPF3W&cM%02LXt?3cSNcL^bZ1c%1m zoyOfg0fIy060~vG$GLN6&b)j7e*Ld&@7lH2s;ad<%64BX<~z#Hs>$d%o70?Ux4()^ zN*Gkcu8joJl!9;4r5LHx#aleceJ4FdzJ%)ZOZ#tSF~?P6L#POsz3?qq71wrg@3-a5 z;Q28^p9q|XsrB4{pPq8@bvzza*(Ll{Uc5x>#G5(B=)gZyK+5R9L-?=XNQ#0amzO7O z;l#s(zR^T%~K=atghR6i#FrpQGMXEb=7<;I!NDk z9k=Q8#}X6P*~ST-CDfr70*8@Qn{_7vs%fT&v=Bg1QY0btDw2Ptb`(rlG35}K+sp8z z39w9Yz5QuSN%1JB(yYtn{P6Dx8Z z!Wv^zI;p68&tVC})dE^=?919>URL9p@1y{(?oSg+UJhr<2Qe|_VRHryx7Lpd5_^Lc z%s@6vS>}T&>LYxO*SeK@&XY-edRLR<1Qp-tj`_0!yE6SgO%jtHY`)K>ZW#>}QDW+5 zlYihTcQ=He=~px!PAgya-SO8qGN|4gW;!6?PZ_c&^AhQ9MrCA3GjYrJ5BXa9<0U$D za|ijqn3muYS}=q>t%fUEGwNhV(o?!xbdxHYqEwodKH-2K`k`Q)p(1#6c;N60pR5X9cYkyKs(i2`WeM`lsC#k z_V-e9@s6$7a)Y-P>T!u&-k3pi5ix&U>Q(cj64At4>KvlQ-a2vwc&}V3$KxxOCIrKD z1S9i{RR1svY^UR=jA#jD@iO+7o&WBTa*R+e7l4gEhSBRz3C`@-CQf6;kO>*zZ( z?|Tz({|};JgBKD{Gt$80uf03$9yRuj&NC|Y(iF+{{b8Ef`w+tpNSKHX0zbUpD=bb8 zCHSzrw?<>w7mf^>qoeIlf^##$G{X;m#a1<}6GGLP9UduZKasj-j2z=`bXg+^L9VwV z`i7!5#((pH%w6u(x+gsVR9*xG|jEm$3I-DFCtrams=FPl} zZ)m400_1e*M}h{BRqu5p-;=l2*`{H#hY8BYqRHC`G_XSIp&3adqmE~Ra*@&KQE8C5 z-w?bm2LhtkXvBHIa}(~S&fmbvL4y)->~L6L?E0?{|AN0SFOm}pQw$~T1PJA)L*9sC zEpv$XUXXYSay0fEh1qhG;fJsD6zC=@PS_|q31x5wI4H8@LK-z3{-;fB#(U6_GBDg{ zogB!;$+F-Y=`YiPz^*ZkHO;GnJZ@3b(fZ4WA(GrOrqzVT(xi8p_MZOdHCsrFgC{}^w6@(h;!21^^i#B$inIs^ zb8{#5t4eO8>14e!$Ig*26gFTjyrf;iZ;N*8|$Gc!Run>P0|`fcytMwS?K24Z?md4 zRFf^?ti`Qq{AL#k7-DC4T=d-ma-ZtTr^2aB`S%Hm*BBTF zZ%+s1`y={Ax^(H4)Xl`rjpJ)knLWiTri;D>A1fQ_*NHtIG=l0I2l?)Jf=oD>-rqs7tmJ?CqppCg-o#~kMIJ>A)23;g@}K?A~{tf0;0{rm^d-u%*B z+uu1jBr*u``T7W*&m(y9A5QkbwKknleMxs`RkIu}dvN;( z&jkm1?{A_L4fST*a*vBboMe#SFyQHOunJy8U>(61uUSGki=z>JkyASfTDE?9<3qsr zpRLM*9CZx%Vyyh_P!IG4B4X%jD4o&v#jMAexsBIimSF@=T7cxcx5JGiszDG1Uj~h! z(gNImj{0AwMB6QX(>YrNV>SlU2dREz<^2!lz-;Hnc?o`ja>}^pEvwwVVTW#Cj~TuO zyLYZ#zkq9cA2q7yXZjr4uK?E=3gz@*6hwS*Kz;v)$#v;F-jh@+p>RKSF&1P^q*g;e zVsvrz6D=nuszHMI%McNlankrXSkYs4povR~9GR>>dy(`$!RHn&grsAXQae4himC2{ z8QZ~ue24a|6x0Z(h$C6F4v9w5C@glds_7Q%&=Yx)!*b3u*);%%pWmdn~>~7_J?jV`}wt zY|HdE=%BwhWeX!p5E~RePmmYXhxYKj_9%moA`kw8Pid6pc!_=^4de1o$~Ka%9t}r) zWG&q>Jl_4jyL2f5v1sFkQS|EHR+DOdxRmo!z^5oAl`mR9JTGP%Teli!^TKdy@N6+L z_Wu)irGxW_KoKk z>Cv5gnt|x6WQ&TdJt#vodGp6R&-7q5Qrk>-s78Q>FB(ZWC+ zA*BGo$^pTcQE;O?RZoyl6 zA*}II#6OsW`i+@~)WC+yIT}o~EXEC*6wT@;KM5jICosg7+9LySw7T|j{fG#Q^^rZX z&sv34_n@2CWDrLY-@c>N^WH5ZU~Z_=GLFFVIP*Iaf<6wbfG~Bk$zC+kO|51U zgY7`EX@%{?XN=Q>Uz@v~ui&vh9d`{2WvAm7R#$dRGUW;Ip5dymyX1fA)b6_4!we#KK zbg1}EsFdgjzphux*@nb~+R;DKmX~VozJm(6+G#cx@oBy_zLz!iO+6fq5Gl7r7B{M` z680To=XjiM5Y-81I71bCGQUqQ!W=R1bV+65ET`NRXlsaz!c@WEnVCq1hmZtQ=2Svy zn;L2@IX;8%xjF-V`b@{m5VF4BLWB8W z)Xml>^&cTKLCw4nCMJE&;QrILjV-^VHRqL1NY{3dttkZ#Fue*lY4+$1<5{xFo#Yk0@ISJlL=HSlZpi=t_%{)f)qdzPyu!ehvk^si!D z_ygtxbs&Bc+Runb4Qqcj>Y2Ni+Y)nbeoC_yxiXc096b<3k+O|luP5qY#(aa}@8C8v zzXZ4O%3xaPpWu2_zza+dFO(6-iIwjhoFaRPL^3!GsCs-R7#M#n#vY*??XFn#TDzuX zr1fHXj)P!oG?(y2TuKK7;3#j%kgqeH3yu&d-R|(t6f%$wZ2KMAH3tg5Be1d!?jUI2T9~)HYAQx-!ZJ0{T9r(ir|L$troIrn}Wq}5Z5ccSL4+5Qs z80r}Grs5bwZUSL$v%z_LXwxZ+E@f7z;hB3a349Rd#6s`3%8wvx;@B1AZfpi*gcb(8 zARk~n7UGilE_txyyb{S*{bMt)R)@jkQfLlBlO5%8K!MCi?mDb%#i!GJ^{LDg)_Y#& zv9?wS%gAVuCKuew_6&$#xS%yrad5IR3uchMsZNF6PS748NX5HzL94Zb4S1!U8Wr97 zPRm*$RvznWQ=;!&SJ=}#?d=qvu9m?2SJQdOhc~8GkowbJAzt0;aEf=PRh>0^9p904 z4kPG27s*D-S}dJ^f3sx&P&kND@eUjn2dtU*mgP*K^uLE>TlofUnzhO45DocxbvSfh z&a@s5Gcaq>C(!`;`ADy|?PUu%4|g_qk{Purbw8yf@*6LgbU)W8|xI4U(j@HbSdY9poeD zgC1n~OL^yROiD5~fQ2{x%=C$C3^xJ~uW-E(0Uvf)s*i)1RJW?E7SR`^O{AS>oM8gx|YU&UILJQ;d8w1gU9)G{*urhJL3bfHN*Xo}LJ4rLg0DddUa9zcS+ShJ;riPez3}cDQ z#8`cAf>gb|<^D-&ip@|fs7qCGFR7FNZiY6ID^nSABsU0*J0nfd;GM`aiTP+Faih+4x6MTU9MT-!An5(N3M5Mhvn! zXVDU{Z6(f}+c=3J@hBW*bmsisH*6m7@L-SFcIGXn9N7|MF3SNY2k=56x!oaOgKs z$j_@2Rmkj>J+jrW%-fCELY*&$!~XOAkL*MBtUK*7nz!ry_#eiXnPoyru#Pr$PU3;c z*qDjB%`>(5R88WmXbx0`PCEBL&5;l7l*gf@-&JDE;;|j4E-w3)AV$74oJ zBE3v6PGkZr-m(bm`myhjG^)UhZUo0FJmGpQnRKnNZo>sL$wF%vpGcW4<}G<0zhH;! z@!j4)bl(-bdJq@fBFR-tSFBW+KE|KCUSq(gw_7*bAkrW4hO--FGny(ISvP4CD*@VHtPWJ*lmu3dVPuUFUCTOrf(;Q`IWa{Swlc zpA@ne(B)CdVh2J)ZN=xXTct6T4G0ucEKAhq^zGhTUO3k2fP1N=9j(u1C8|f zV=$#>_`vzrP61_b+VT?3Zi$LhLN9t@4av|{TbwU|5Y2D|s?;6;C$GoJ^2oL;Ck%@r z-zaRa^xK{VO~is&XR8$~v=}!x;XajqiJWp+@66FllgxWzaHnc-SXZJg*)ee_`+26< zV_%HmD?E2#8$G3L4)*%ZstEM*9E-~B(^fWTWk@sX-i*8YU*NY(vEEYY%Em+M`C(7U zSc{H;8i_z$jC6wpA1E(oGMMlFEZPY~}Hy zEjtT&K!%`bxvpeYcm)^ML*a-D>kdg=eIQoEK+N@yOh$UeC>Y$o^LUMCzn3D}0CW=Z zt#M?dCt^t`3!ocHov8?1kjEY?QjzRs)$W|-`6a_N$4u=Z>x$pUMd>8R)>XPNjy4N2 zlYl}SnwvBI_hL6ap1;Ym^s@2Br#$?rJPmsq4`{JJV8JNU{!=ki=Bt1Am^4#84ZB?2 zf=B5?o2w8BuJWh+gf#?(+f4$r*fu}sDTTDAS|}2%-L%gvv zL4m#L7rXgCi}bhco({t+KF1Mcezs$!bz#l>_Rn})ZP65skzm`aP2=(fkD~1uou`Z! z`ys}y+P2v9DjW?loATk+h>%vG;^~*|O8O)gPuTP@s_%O9rpLJ91?FY!cKy$URv23u zFL9mtwXssikM{x6N}6#atQxBI3EOqwGfi7(i#5Go#~Mvs@UW~pN3NX0pvB&*iGKrT zFN&ba@hVh#ByAJY52>a=AuiRZ}wjeB>KYxvBX_Wa|Vw?T*YZVPx5mr*o$ zzuu5lCS2PenP(NE&?VTNUk1((i3#cP+ODgJshTo+Sg}FN7p1sr8{kpA2y@PhiN;)A zIE~M$r*YASU9^VG3#4m8f!w-ZzaZ#Q@S|u_I(Sdi*?c$2^70$$I2jU6OX&+Q2ZbU7 zRoo4kVz6q#&9#7F>Hb25fa$>bansUP>)}dSy2HHor8l1{WP1{ffh^PQ3OXKlGRpz? zWkvRtaQV~qub%sF2s)drtjEfEhV}60(BK1j%jQaN#+OZm;Pl&8C&>-u+~5Z4qz~ZT znq&;uAx*B?tgNoUvh787R;};VBe6h7pN%R>nG}{lUk1g!4OgPi7t!SzDd27J@PV- z(GBmG2Fq2yb))jHHsm&PA^QnzQ=2|{l{{)l4=a$h_o^+#5-RahRJv>|vktyG}m zZhmYIS0AeqaV>E#ByMYN5FlxXhxp{-ts)`-OI~T#ZCLi47*EF<~DjySct?1-MAx*~zxieJDY%yGLa+PWu zE&IsLlG!-wKj7m-DxmyMSk7pK2s3ad&47GbM%atsT*FH*L1I#)R|)T369aSCpDi{I zkoQMRZXig0Rr!uly_S1tgC7hpuhU}71fC9`4!e(>U2zD|@c34R9_P;pJbf=ad~qh* zrNfbk)MP#JXf*+ID*hq=HM9MCJ=IVLQS^Qyn{=!MBK)kd-0?8orl{HI#FjI>u&9GN zdZ)`Ac$Zz1%3<&2>m$C46VyC3xrbtVZQs&iy6Ux_AabqIUwG1b(3P3GgFTPju;>=L z9e9_zA|q#$-AS{lCnHYq>!#@7dqMcIi6c+^zKyGoOB^b!dfuvS_fB)7;l0D}1EJHu z)tBl6JQ>e(Lv2{G(?5L4XZTiaIFW>7gBxRR2{MsSwQf{qdXqdpJ}QKu30t(9WRqVN~JJlBs+{9ecb!13&+)JyI&PxNa}4^^n9^1VGAP zmgvQl#4k>AL?G>>GOSOm@w9t9C|#OM#mHj)D3UW)5HWxosQ&esbHMF#&+>baXJzEs zL`TT#u|G?|zp3do_&aoBs(&!?%l9>UmY8?JU!^c#oz#d`UbjqLKf}3sKOSOW96$x%*u$nBCwMG+`mO78CWL#!d)xNXI4g7Go zSSBCv(Q`V|E}Y%_q6jYf--(Uu8%em99hoBi;qH3e3&5`1NO|GdQ>zu1 zKJHph4gx#1OT;RPs!J<(fxugnNx@(nr%wO=qd=3{Oz*R7vh+kdq$qV836Eujuxa-y zMUZ+&%E{c%=Q#?d`YJM7x0R#U(}{MN?lebPu%!(GpDFHLA52%*CSRB^4d1_s4#vNT zjth-xo_~Vs;0ruM-hSx5y~8IDM-2M%kdlsjv3sP_M{~JX?IH`X%no;XbhVT11}8-8 zPoqHqD~MEYp>0`zpn{U)kKRkMTojmYy)b6-=T zlyt`j8@E@VICQ$+8G&&sw(jIWaqvKPJ>6b3w2^`!r(#OajM0s0RRb))JzA{>=+${6 zI~+^Od>J>gecu_;bA5}4WqYZg+b?EqrH}lEgUqt`0fZ+oL_>T@X4WfrHjiZ5iXZ5o zxo6W7BH~e&SUCme`OZ2&cS0>6maihk)rYe5UE@Yv`>HCB*!*?3;-e3JAGa}mjd0sf zekV1$mt*;_s$00{vIj&{MO|&dWGZs)2b59ex8buJR|k24U00#Cb}!wV1}MUe)|hp* zv)QwBWf0wN<*EVQ_;35O{Q7(g$wT`w_?|PiZdD{?Zw8vB$o#NIs~lJ94}d}e)mEMN zm-nzt-0AAbXp38nE6S#_La%TWZ-unSfE2P0GVP1lkbM}s^1c2~*TyE>tFaXHt3ToB zH!_(QF9c0J ztnf7O_4%%!XzXM`LWjSbb*zRbG0nEHb}-!&jkMw*5Ar*ET*l5F7Teyj!dF;GY*nFM zP9eP^Z{WGg6A2;(!`ximN;h&-cI55U<5hnN(qF)yMWpe_k5V4wdgfdCOQEgHY%f z$Y1_QoRce>q-nYrqxIbr2Ivl6Xpuu?acA4#eziMoMPhm16G{iw5wnG+9b9$aV)%{E zo*JUNNlF^7yY$8!!FjK=V7h--t0Qot-L;IY?2W55%-H16VZRLD+m6-zwkal5gjMv|SyA8QH5K_=^eRsq^m!4;a}(`R*B zElV47JamGcV~-!`@-pvwvehI~Bz}}8CLe-&**O{xrK>m=bMo%(ec&hb`=gQ|E8gSw zrZvNlDA%vV&%dN^2DHH)>!cX1MNuptkMJh+ib$q-9HuctkDrgsuXg>daAmsi+;1rU zpras_Lt&-uTiId1+H{4^+HQqPhh=zf@EyL)7xCGzJfVHmmSq423*E%N_t$0Il`pQ60BWdUmRa)vlzr2 zTj=ewfDGu(AGV5lLC1`d_OA{yE4v>1k6-spxM0C8OIE zoK5zEA&bpdql5W|3GIx}N=yIxiEEVUbvgxJw1H zD?M(Z7x#rn8JXd$Vq!VfX)ZdcQEr;o@@Ef8FIJtFXl06k+uO>=!)0_2txBSZDXmY_ zQ+;+qcT5GV?Q^E3fe-%!xKGk5Urxm8#cOOB);~h@xMpxPAgs(qd3@#;!KY!Y_-hpE zA<7}z30eorMpAIIW<_w*jM?0kQo_xWugQ#UzpYM7B3vteIiyslKT)7aE?o!vH|iQd z_2T5n8y)H-emPD3ZZ3QYt?ld7Wpx5{$rjG!Mw~=`9p-`coBB*ruM8_^90{cLd7 zqYREUQbq}*kJ1F0rL8o|onoi+yK@C!b1U7*)Jsa4>@;QUGXDHte53yWOB~C6oJp-u z0}X`I2bHOrOH8L4>KQb4-nCv=Z^3lPR$ql(eKzdtX>i#WB;vQCFs=bWZ(V z?c>9fBJQr7z6p1`ai(DnKj*4QXUJ&O8D4t8q8=>jK9t?s5%;`P+neP4QGd3M@!h{F zh&64kmxrZ_)iC|dKdo7?&d+!y1!L5raE3Xy-9s5#_r0z-MKFb3!07Lh zZXB^S@x+lB!3W{b5eRF9wv_2_Fb1Wy)Bf8gi1Vj@5(@xX} zP`zMRTmy(-D1Q&$4DsHgn`K_!h+4mk>Xgd3O_&J`&^#LDv7ua_jHCA-O{A(oC?u`Q z50L2`Vd?p$m3mWq-8XAk60q8HKZ<}H z??9Gv4Jy6W)E?cLO+WY%JKiYlqW;A^47Ck42F)7H$j93S+QXaI$WB*oY}d8adfYSO z;@@d#pwn3KVs<+0&KQo0sl0IIH>4e7;G0>bKepdO%rY@$vF)^+$Q*xUYw8T@b<&mZ zv^Px@`gqEd{zZ9BEiIrI7QAF>VzV@usztDXui)RTAJgbSt@7Rx9H7(IWUtSH6)`=g zWB8DKRr{{SyVXF2&E=DzM(sL~S0Bvs;YF-zeYq61M4Uu%&`^m6Ci)85OlN_*Sa;u0TQ z?xgmPfw)CS9iyFcwk34B<}1;otMPSZ%#jaNWu1KI#bu54Vo5(6k()|mvaBy-S8Eq$ zh49$wx>oM9Eya9yBz=#2@a@1S+Dpkf(W6aGl=W|?75$~Z9ZLN@?=gS*!uKv;8ot5! zuK^GewV)j{5xgC&X#uo1mF`RHvT{`AapYgld9kK^#F1o%h`AcE?5(Qrs^E4SSCkQ{O^jOy2{)$t9;` z^tSca9jcX1ndFl|5=4%HgZgs|A#ovF4 ztJ^dtT2lk~$s+4gzbC)ZTqrFx;fX<=&ksaBe6i;pVuPL0_uYNLpKux?#E2{l9k5mP zNBVUJy8FeTL6f7OI4R~bmm_;)A+chrR)xfA(~cpdcMSalmG>ynZa_ZHs9#`aP@NBQ zReD4Rp*mG&6HZ(l{IpfD=wt}swQC#lexNens19vd)~h$p)E`uH zU#udkk*aj@s$QaZLW}WJF@@)C=3Q%1>%jbJIm2=zqmX(NgFu=vzMOj(dLOeM?-_Kg z$^I78<6%XkZ#$TsLw9e~@w4))@Q-XA#6v8Go@TWrWP%(LYKdvn>QHqR137;3c+mZ5 zid&M|Gz?*c)j4oNw}k?)jF@uzqo5^jRSCgeYS6%91L8z`($m~+oSF-ZUFUHNu{Tl3 zz=*Li+o#-j=@zdVM4shr7K!_lmIIxpp3<9nsqHcfW5;0OrV4jxb=uEghDM&w4 zjFk3Ox{Ianvvbcg^@>_7i=PQ(VyUnctLT&tkO@a!REjvD%iJ%%X!|ai3a2)La?c&V z(|&F`Y7}@bV$_vr-}-iRj$k*ZGVizsHp`ZT>sG~p&dd0p*`~apXU74usnkz0|IMsq z$-#-NFmGWs<<(~%hyTu$5?k2xyqe(1rX!%D+*g37EciC`fz(3e4NBuZ|(40 z77{~;wRq;QOA|fpvrw4wI-rFrTfecnggKr%(f)lkxSrMPku=DvIl=yZiK8lW9{4fC z#qUDmu_bH4r`9th)D(ANNYiO37ADYDxQwvRHmWzw1D71-8fvveB6bCgL8sXj--G_y&RUW$AeL5TRkJmZN>=Jxp)dH98zU_|8Vg7{4 z$ufi*1T(822AaFG-ubra43Ex4Vz1JhH(p#m6cEjUDdZ_NEerK_S8{w%6Rj@I3@0u# zB$h0?55foaz?yzulVcvoOX|6&$)}*GSG8&);X)f30iwjAN2!l1E zj{4b-MAUKJ9oj(yX-i9M(rxYb$e0AMG~?#M7tabkvOTviD-7=xtn{xPnn{R&1@pRr zIhXmQr=m$!qN0NLdHN+!OrjZ{?n0KAkFnypl`CINPJd=$?!T<${+MM%Z0~w_7_y*G zQU1~mm}FlTj{d5$8*^coE@(fQepTU8Nziub!{0fyDgLiMUWQAnI=X*o0nsq{C{c*? zCy}jvQ$gbcw<{i%{BW;rH5gq}j^OdDxk%-bgviC5%X-Ox08HgRPBoViOX+Nhk7`4G|K0_lFTkW3Dplz#$H;E?v&20(;)Uv% z3wZZMQP{5;eYh&4-Qn>M6rjGLHQU~qgmN;%HNHpkIgb@|VTsfAy?-;|%}PutR~%Ed zaKU^#k260)*uVdpF>!c65u+u^?N}w_Ui3C~fokn~$~d{PV5Xs>yu*$Kif=n=p<`ej z(nYtHUs-Py4Q6J`ai0-UxAIans3K~nyuI_;b5LwM;+pfPa<5>P6 z=u|%sk*GN24%SNno0A>2XIO#3Rv0Xov!KzO$16lVSLlo{zY)7Ld`f}fkl@wS z_sG+lzTth1W86-4L(K!{Wob&m=$Vw;1*6-VTI8kY$)=+A@8*ixB?o2UgC<`>*8O|6 z8eSE*njU8w)}hO%H8dzLkC5&-#^`%l{}~fhx7f}K6n>hZ)CoCLBW9xu3L?+{NJr*z3aCJxeEUri zLq>nI)>fFE)7*FY>L|s;&~mw2mi307;iLo|hOkO9 zllXlhOvZDu;b!B0#0NT-ZVZt}Z*rl`4f|+V+xjh*GIvedi*i(OWTI&Cy*3>yF)~Ey zT+50QD1sMvY(68_9TDwVl!YVK$p<`h=HlaXBSRsFd)yAwt$fSZ3cVV;wba*Lg@mz$ z!?tn+gt)@p1p(Txz@}SSF{7XKyS?!a*0C>iKJHHWj%4wNf1YIK311WNTp%aoox|I%U8yD%$w<|li>YdZJuU&pG!RjT@ zIOt9vIH*wa)h-42Jr7P7z{=vav{dYyT%C@!BFsYvjyY>PgAQ%x&Pui|i%vFcqIBqzq@e zg45i;X4RP=-FHhKJpOs7kVSkvHFTNDDkBvjnh=EjkyVGx0u3$RMz#Y#u~`ynM)8zc ztCLmlM<{^oUZI<$lLnb%JUC@!&UwZLk5tM+%fU8OIr)P{O>x6e12(#`{pg6FsPM0! z*R|M(x8FiNET8KPjSOn!BS}0?N51f;Toi?JjKN){-;w%fkKe<+w6uOty3}nE|1cXM zVbR^wq3&eE!M)2%rpemikP6Q(BH62o@6Wx0yEwIT1j4}|(JY&0o;|XMhT)etHFC^1 z%WEI9ny=3X>k7GKA90BFdGJoYeL!vlOrZb3lN{T(TPuv(>9CSbG5U(VV|lRVMK`Y~ zfsFT#QMw>A@~q9uO!@ZUNfsAnzX0Q|m{`Mk;?GBH4yhxNv7IaBRZHz8=+&PTP$gC+ zCjA?zLqkv^LRz1@cx(aI28r(5vH_;5-|ceF-q7>!vS~jsLwxzN z|MMclfmOT0`N{`{AJWUxET5*4V&)=v{n8E&!g+lUgC7AaG<@OPmC=a#U1W9F!COwD z&KJKCLsB_UHbdp6GxWRVuh||M*?k`qK)0H?lH?Hb6HvyU^}Xz#!npXg?{90EQaKN2YhvlNFeVAiaxl`AFg|#ka~Spjvn$+ zuzKw^t#>NSdYz(Ex@za_11;Sa6?IRc#dvP^Ejld|Qf;_R`EozA%%eE~ssGAbwFY0? zi$H~@V}AQtO@#A(`*D&K^xY^s`V4B1;go59wmrZ zyi5@vVVh-~_5Gkn`}#q9o}R5QUZY+M`|Hp>bAR7)g&O6c&OU=;2Vd7@^gZ=DjAu~*G40ZjE{=j#b)-8ex*5u0CmE$1TH4av2zH*vK?A zfV0mPpmtE1wRXx{wbWGEk*j9>PyFz?^_d@(){q6%9XB#d)5Fv_Rv&!V)-Z#-=qkdl z`1|Tr23ksvfH(A_*lGs0+7$+W?7q^o6DPeeU%wXljoQXJ$p`>Bf^~t>itCP^5LK((w@a7_a6C`RmD28Pd+H|74@n{% zgTYBAK&&kXC8;{ePl;76F%jV|u;%U5!NZ3IR8J3b5?DzAQ>R8{6yp)GDKg^FlvCwe zCBlkE+9^-GvV1pAqC{DZ6`!IT;)&f_o~Mu5fR(kKhlBGJJ%{~9QN5jAMJ~v5BL27_ zGAN0iQe_R3#Clx%>-%`wZC=kGUqEj-L>dAg(P-x@pJv348QtsQ$+oh=&g!L~LOAJX z58UB2#eb^x%XP`=`Z-Qj9JBJ*d=R$w%}$l(EED#28jGSxuJNCGnF^oWMERgq3E!r> zBH25jG3_*Mn{1oUxa*@NkvPJfgpqzqqnoP_QN!1?Zbq7TcWsNK-RF788r78LV?RKk z_0qv|8Nz07k1%wdfAF5&zzyPuYrtTD8;8mJTUIxCZhS*fV3qy%wDGlBu;F6C@0`}M z#cjLpRd&&ClCH5QNX9#@npL0Ed=V!ObDY3G^>V~aKC1K;OV%x&`D*t=RM+@tT)z~D zGz6o1Fuz^$zYmAd(v;wjFHo14d$J#@QY@dhknXQLY7aEA4WLj6&o4wmubxuQgO+&@ z5{gdTm9Bi8)w=0IO{&Y?ns4`84&0kI-gaG3c<)txIWCpCs)MC1{`h+;*lF-ZjJuB7 z8~Jan=jQ`NM91Zv&Z~U-F`H*FDJg`tB`l84ZwmvUtEez-tiEn)EmEyUxS1B=7W>9) z*1MG?fm^6)n$C@eyLM=Ls<#$wh&4;M=3ta7=kg(To26{yz3j7ZAs+431Merzr4Mm9#Eg9Wi2~aU-h?4(107773N41yn7RZVzim|FR}uzR z)HMdCBdB>6heQcoT++W(epplUCLP@`qzhl2kqgkCm?in;cphoxFjmDOi9k`==v zzg*qYVj#8Wd# zXD(U_0rTV3k<2u_kove=KSY`Rl26ZU#xHV*Pqn|vw2g5*(2?6z4WJFwQ?@R=iGIe{ zAjj$f2=&&VQDd3__yEjnJCkh7h=gyMNY_4eumHVeU#hS;QiIZln`wM6aa%$FM=tH& zf&vB@A9(_Vw%VtT@B93|oBibW$u{yLF%^XH?Ovfr3y<<*IM|I|D@U}O4CRAnvlNPs zGlr@Ir`*Ko?+NS=B?ps?2`B!I*$Ik1eB5w~qTDyHmu5CNB;U?nQq09g9oS;Koz?VY znmEdh>*h*)a^h_Y4 zPamniaQa7kWyLoCuuy*FXn>a%9Gzy}lW;@+V_Y}Hx2Nw|u_vsr+?$EJ&f)Lhb9zbk znKeetB(S1KQzRqp5`Y56Uts^7Jp}1u`yIvLU7yKQ-|_7qtZCGX{e?vaG#W>dyq!)P zJG^)rL*=*v4W&IU!%n7`)!5HQEbL+pt{F~CV@;sj&un19f4;?C{ zSaF9CyHbR%Mx-{Up$ZAnV_ zOh}o3I{lr^(9oaNClPfh;s6bdQb8 zOCA1ZU4$Wy?s#&fRpj%*f_&P9Q+BqJ;v*y|}x( z7k3FxaV@S7`}}wJx7WPO>u=^hb7tlTFi?j-7d?QIWpQw4?$ua`nc+w!fi`oGpaDD>mo74)<$m#j!}A0@M7R1#$H z*&>}Emp(Mq#xYo0ZJS=2O2k^A-tiyrbTlLJw~WTWiFX3uNF*oQ)K2sGoo>M!yx&K7 zXR1Y(+~bWtsO(XQHr{849cTJcaX!s8o)AqGC+c1Qx9#!C5+ieUE-?B}XS zWs;O5V})wh3&vYfW#XwQ$m5YKqu;+*!`(Yxg|>%3sU+I}e!2Ua;5?!71K!sZ~k`g`Llf={`1_`7+N`n#euYrbmu$&}yU-H+jjL5er#B;Z7 z{bhaXknUnf9tGa3>n69BsRJFH>3ZN<%#tGpEGS0RPvh;Jj0`vVia3HVe*a+46n*u$u54&w8S%2hmT4h5LeAZ6jYPoh zD3(|xjKwkptiXciiIzLvH)A$bOaQol^z&?U5<-PqHx6c2#Jp=LR8MYTZN!*qg9_I+ zvjB>GKzK}i0LiyYu4b8w97?|zgM)Q^_Uq6ZttZ5z(AQaR-W#Om5pc@S(FSPj`N zHhS8J%$&!cR^kUuJj_c%#|@q{&bmuV*cAAqoYEI}(c(D!@8SZgPTSYp_=_?ETj_12 z$~4LtqqyCOY2V~d+y7s08Vhyh6|uYC_KBZ8_$=34$(haV+vQtEOa)hiTExL$u^+) zGV9pu&}k`#p=>HYc4B5vMPOF@LAU=O}1u9 zc#J;v8Iba_utgXlaW+@h8U!2G9-}%V8>xjqcb-QZHp(XN+?c?4Hw)apuyPemOa#Eb z{+$R?Dib*A&JLc1eI6R9qPSQ$qd{8@ldUa?e z#LND_tYb2k9BQ|3by3Hb_y-)uvk_tols&1d~CBFsx>FfWGMD;-f+3APIkRpu*JI2-f#X3Gf0 z42c{2jysy|c^cOaYWE*ds4c$6UUV0#l<8H}+1CxV3pu|SKBQNyjgCOK=W?f4+&wV7 z`KZ=Ldweo4l^cKI&PU4cL(Fp8*QRR<1=UXU4yMZmG?;xz_Yp#<<)%I7RxI_jcQSU{ ze+^BI8R=Hz`LfqGH>SMXdx$|fbjoDHb=>cPs2Y75M2Jq3@Jg9cgB;G|AItdf{-_B= zoxCnQxqB<}dwll6%eVC3S?J^q!sbi#X{2AI=0Ahzoj*ZatS*e+jr*9*_Z!(w%J9n8 zqvW9gjmN#jN@*B}Ni&iEMV zVBjvAg;mjD_xxwc0qTi{$Y9rvOQOVYDbe;Y{P||za(U9CH#efit%9kyO;o6Z*jmI{ z^Y3&y+!yAlva{H>Ov3}NC+#yZCW#D`XbG-JZY0rPp@x zuuG5`V6Lb?BFB$OSvWh(hPZE^k?7~I9|Ub=E3I<%9z1VKnz953tPtFG)Q(rKye)6n z6n;jSj8=2-m3n0+MH;dc(Kp{;D%mr!b9mNUq1h`OL_UO`Ffa8D#4K)h)0Y$CSE*<0 zaJ-<(;2a&Ef%1FX%lUL}q63YNb3rbJe6p2?^)vAjOH1eBL`{~)=SI63utTon4Ac1Q zWtJ7Yo7cvjv>c*%8UOzADOxjm@y#)p>ls_xh=kF$=+>VDvZ(a^9FgSv&rNn%;6Gsx zcRLuNc>Iu&&!VeW3N@JLOix{X2zsk0i>U2x4Owk)P<#YqPKeGZ*0> zHwg;T`jm1QL0(F3qb>v);bCNk1H>cv`fHvOL5!pM z48824tZ!FBk*t97kmoY81~mIge$7Ubv-pw_r{W(|yO^7%LyOxBG(!FY1`A$ux2ui# zTgzT4=hM^YZ%(MKHyjDR8846GW0`zdKwRjbH*Z@dtdRb6I<^>o8rR{P2eX25gOEBo%)d1Tdy-zNT4zp_ogA{68I(#DgI zt^F@!CgwVNiNU9ua;+viWu4-Z1IBkrxvU8(p^v(ErCSW+G~+i1ZqIZOAbojCQwB5Q z@nxMM{-oi-sAB`&iHwr4Z|9t5>a_=pzp-UvBguUu=jR+YD>^OuoMft-P>7q=(zu>~ znQ04);zS3`?saiyVyQp>JVnUSIR>(Ir*^#nN0q5Q>YDZt?7^RNV6+G$)}J**?1{a( z2P}H6h!*#cEC@;A|7m`^Zrg!kMGmz*#kvdYPds7KV{+jsQ4iNSs2BCgDyGn`>b zH}!#}oSQ!W6*r-K>+9ga(_}WhS`fvLe?<6b$R@R<4y}0iCA4L9sGL+I=}on3`<75T z&)~~-BY-~<$w8$Z=kPynxb(l=aAiwLwSR;Z)Y5e{ID=Z@_qS1sl zu^9>rIPPgUXxqbu%=AoO5Vb>VGt@Q=tckw z1_x@3$%FWFvs~Z5KO1zFcU)i)UqQy&-+;JUwC`j(7`Yj{j@{nvN1mI0dp|$G#EgLR z6_JP*Dh5Ed9LuOXg`A!q=lkDg`#V3*s2NpP2)?wYHy^$eX02N9D=06Gm($J|+BGxK z{Gy%9q_114Sz;H8L3(LAI`<2mUi(io6``=Cfyk^_yHC|^!Ytwa9?t7uQMvhw4(205dXO!cq>Zx9* zxx0ZkcJ!eyrtP4NC@PBZju1nHrb4+^l8c4v&{HS(2_dR^6Xs_|U`WFfv0m#!Ee9Hb zZMEOfFKY<_Z(|I!$8V$Kic2e;!al&fW(!V5E?fG?J$(bDt$8uc@Tx*dY> zZu5vg{FC`l&dnp@QO%)y>_-%a;fF)8Hr3PIhtc+n85CZl(e{U7dK~8~ug^K*q+Ug; z_*m*jXWg@S${C8@FuJ-bJ3}&S9 zUz*3Qv9Pzxd&~#(2j>M`KZfsh6pXw5g&omMqi3SQQ4h!e@oq{w*KAm~19{9hRL!+D znxFc54&iGxI8mvrBWR$|t{F!yV?hwQh772GGfeC@^C(_esBjU#Sz0mDaEJmvs}^=$ zT7IuGzJ04Xe=XC)f@bcrV)V{)R^4**R%61gcv?*vq_j;prRm2w_wP*S5%{X_Prn*Q za{u?k+989=yD(A~dx4}oCs_4oy!wuaSJ7ocl2;b9`B}N7z_|&#)1+40R=;(2q~-~8oR#DDGi>g5s1{hfdBuo75i zy7cOnTPMD#j1}&Y^kvAuj@0+X{2}S3r=ya<(6`@O`x#Z2cP8!{zNsGC=@`9kUp=GV zf}o`@HI;;Bx6CtJxjDq=fm!u5LZ#OY8XInmQ6>p=N#mHBs+oHmBWG-y*MXUuZ9z}f zUGWP%Cv`VO5$^FNMQT@emy8P?Sd>{H{XYL$dS0?&pb?Ztrx0_T@i;uSR^5yD`{*Lv zFSTmQlA4~C6id6Z%z;VRt0Pcp8V!wfbF;^`TC+O2h+ne}x+*ly%`;LL_4YoanVQ2i zj{BQ38^)Y^${q*aP{omYka|ZeadANmEAj9C8g8kL;9`Kh_Xz2YImCuynZ3jb-S4MX@X=Y{X8Uns{oP;vZ))KpFOE#V&f0 zbkZS~c5@rFc6M`J>Ug%ASL~p0FBLXTr5mE%JRo=VxL{#9gOoog!bPn3DE?lW@9-YZ z@T~>R6lkn0?{w5}gS9rl8=b^|x_JlVaDDkOqA&C4mu=dl32HO7x;S76UX?L_GdEpJ zXJMX>GJQK`{Mj6*vBk{hcTRnHzI}yuUw31_=Z@fsSFm%!16^!VfR<~7&56Y={(J=X zP1y+VHNWaE`@q%3r%IzNEu50O2pJ7|Q#Zjc^ZB_^clDU;R8v5aLgK*s3jVdNt^dFx zco_cW`QI4M2>r+Nzl~CdO8GMKUKLiH8lyo|F2zSIN5vB^W0|o^kj$UMo$%qYtB4Y2 z)jO8C1z-Ix5yyt9x;73fM)v|8i?c(WhSxDj8#DE|V3yqn4t5c^L@_EUQBa%Utj~ny z93S>@PDsfQ$(X5OxtFiTEw@>24G4|j_CQ6KSu7<+naZJ@w~+v0yxTX){E z85rl|hNTQ5F8{nbWB0}$BO8xDv$^dH_{BOSV1*`a)4|Gd+W z>jg@7s!|DPY^WM>9fpuYXs{Yr}21G$9t9o2d^h zX<0fL9eX6G1DO^for|?oj_vpc7Cp26SEc0!`y97{m z#A^M7_P|hG_%W^`Vg!tmSVQ{!OT$8p(>*;6Ge*bXA2+pUZvW7BoGY6ma5Jye4O0YbD*ks+l0J z406z`pR4B&lfKI1N#=wY(%wej(48-8A<1Gi)G@<-%{EWfK49Jm+}P~?#>7~$m{4bz zWgk;D*p@aQ1Ucz}z#4}1{C`bxQ8jS&s@P5`Z+(NfUpkK-N)x*(5_0TkRCIjcFQlf; zf0hfc8@o}fo$~DdA?*X-cQ5nkjT#e``5%=d^)Hp9Xe253UzM}=4&k!%G^Y3&P)=j+ zge61?=cwZ;k4OnJ4EP{qtcFy=tbj=EUy%}vL}cZnyb9;T6;AjpaHDB=`oov!`bs+* z33|zT9DK%jWQ@`XKG_!XR#wCu-NGEPT4t(ptw#QCnNvR0aJ9&%83vdn|JA?aoc@SV zir{?vBgy-~S0@|g=-_ARI|PVqT9Wan;gXo0BsnshUhK?UFM#rx~Tr@aKyB{`AX zaL8^&hb3vNNB^%|_}jI|RDZjdZBqYu=b{AP_2#g3>ITYBqNNls*AHtAFHbMG9nf+M z|1+eQc*x&|jGOBhmY2g93;*+Ze}|W=@s}w>&p&hmPPSw3rAbTHLCm;jY94RFEw$AL z@i|X0%;zpc|1Alh`ynLa{-LD?ZZ@kY&2dAoE6Zz#7g$Hl^v#O-%Yo5T47U)Mm0oIU z{gCsIJi}Ep${%ZN`q0)(S!bZAzZ^rT zE+?jtq%X}W50`iA_zcfmdwrnQUg1#aBr;)DU)CiRTsU2V?8F?6&1ugRgX?kau#c<3 zj@#h0*i_}2n^9+;^N6%Ub$@Dx3Bl=dqnP&c(l()klMs^*oZ6aqovqrf)6et_Gpn;j zk#Zf+Ce}sT&oE4FjYNH|dv-9^1o~DRSMM~*(==BC(yA%o$0AO}$R-3-_n0z$MLnF% zqi&-iB6s9hl<>Vc$c1Wo8+{m8t<)2k2YP{(bq zK$ffL8>d;Rk9sE*{;d3j1DWb z+8Xc5Pk7Tbd1z?VJ*>$!X`tzkI%Bug{~^q-I!(ux?T&(F9KT{AVOBw(b&n+|i`lrX z)6D7z2Yk!$(2j<{-{9YZlrRL38gZS+S%z6jI_(05wZDVJBKzyCL(!&7ugGjl{{IXz zoFF4yYBBwLj`aV?jxEwau$;&fOC-tM(|5eVLZ$!$Q6Zs74|oXx<$iX`fJ3Jhx-@(E z`<2hWE+lD|*j&EHC#g(?C;YE4ITKcSO=8q-b!s7{0wjwB_{X!j+xH=Yl821>TCyl1 zA8gS+6-S)Qdkf4=(vw~`)%oW({%7lg z3v$;=3xnl_N|F19mx8AOkvp{($LDWl9Bk8%t54V6Xe_ThlQqm4>^NEQVppA(h}B#_ z>e=|q z2KCojmm!uW1J5vyruyXM&*~Ajg{*xrHHIoILvOfCz3yqxZd>ijUG31oNEg}1_g~+a z@bkak`lI~wD*T2<-$2susfi=kV5MN;Rh+Pu#kh0c{0~YD3nk9(I(6Uiz7W>DW@}9 z$Ow;B*4>qNe2HyTEvM~0`VWkq1MsvmV~zwz>X2Sjm$_tEPMGw7`l#R@5rRX|T>F3$ z{%OlMqP6kqmCmKq%zV;BHg~`N^fo51+Jn4@jHwZWDt*VW@20imnDHFsHdC@qHJ&}Q za;lm)tG~+vPd**65_Xl4yH2%*bEwn)S+Y){mYH6Q!)U;^*OHH>mNQsk0k~?-@%*GM z>wIc7Rq)-r=I!Vd(tRFq!#p@}P%I8h%D(rujCC0{urqFrn$h@%{2vdc(^3=c5Bm=i z{r{I2l{UCorH*op)}=`1Qt{#knaBV{hv-`~FAehc-#vZ^NyuD)2N+A`!5d0h{^t`Zj9qNA@>b}`aQu^Q+rMx3wOMh$TvTleRDh&U8 z_8Z}0a-?FZ{Z8lMY3(5q=C)bbA|H!)nUrx)u6)y&F61)@tXRx7L}ktd zg<>q_|FyLHKD2~url6I2u-uywcMsr=e z3%}tOajjm^P*}|^9rX;~zq)TECt&vMe7SRUkn&lUuydXNnOK%6Dfke|#v66IM&}FA zVyG^khwQvqo{p{^2^RaT)%o14w)otvSQl~W)NHHNpF@Eh3;l>VpnzB~86~Cs$DUEg z@%WB);k$j|n^i%Y-L%-WH(#-SK|j8$?0WYhh$iwJ8f7^W$E9sLzI6hFh^%Qi9IwI- z>}3)onTm=ZV5bjrmBrSxXPOY3S$Y@Psw&c3GO0nh+XKGC_k#QAi`mY3<(i=epzr3p1|vab+++0r?WB`P_ruO6T=@Dp*24lq1r}~ zP65?s-N#KX7KGmIDlGtdk+Fg-2gj7xby*InkYnW+R_rw#jB8nTt?vq1Es}9#O@g6d z)OT~_IQkhMK>-)j^gqA`Y&fQ#m^a2-82dC%WdDwJTxT+1Ye8&sxcVmeztPDs5TFAX z*x`muF@mWFGuQ*hsE^`WQ>Nfaeu#mp5h&$Hpa2+AX|0v{B6sP5B-f|OZ;d-D^RaM` z=EIoE^qoH(#qi0y*Hw*MIUq?+;7)&Y8XVj1npH9W%@!K#>tGtGca?vb8#TKoOZ2|O z6Y@LeD|uoGMT@-L<+@KRtX0!w`l5obB$gY`i5~W({0GWAHV6+5RzIr-xz|`JjrA`$ipY#) z83&am?q`Uo=+CuKRz<20zn*z^1XRwUPsk!Ysz_vB1{i=Jz-=|s+LumXg+tsuQ`S~? zUA`^MfVkd5BB|`acoGCEE&*BOk2fO_SFiU4Vxf;xFe+w82ZZdny=z&NV5+pl7e}of zA?so$Q=2H0I^NjF-f4NrrREf252-GG`DtfArmVR4ifg zMEvCMeu#TA6-W$ZVs0|ERdXa%x~rsIh8;t-Lry~5bEg^+s`g$wzv`k$uGV#Tg(GPp z|3S>-75k}@C(xav{xVT`g&DKR`ZSGfZAQ;36QTSC9SLB+i5d|amy?*`P}Jju2cC&2 zTnez>+Tm6pH?jV zdW4)-np6$WZNjT7;V`Qz?pdp&3=tL4+4Adfi^fFFU~dat)^^&C`Eqk{-{^9ji#ad*oZ3E;2C$s8L8FB){C0>j$5#e;kj1 z)=`8`9!5a)(3ZSYmu$_oO6;^3Kf^uY)b9@B8YfY*B@`&fVdT-;{8V-q6b}j4$Z%+) zcA<9cT%H2G{|op1@MQaS1t`$Z z$dmLcljScDh2E0`q1GM~){;aGo!5}nfhKrORNC@DN)kdKCrOqa>V&xp4HAftL%Zs6 zLsXrKEC9m*SPRNRtF?KZC4*0Vwv&N71UH)R728u%@Jq9gci9}2qrzL$@c@wHrKT7J zn4BG5yg||Ctp%MVbB!t@^f;o@bcgA{!SXulQ_6!6k=|PRv#bPc->=2S{J6@BdQ9yZ~Gt&2AV&Fy@ z8NR_sBaIbm6n#9|(qOK<7lccOm+H9aEy1v677S(k4DJLjUzAX7)T4s5A`y*F{eTp!H^o|aA46rHh;7I_100mJcuspo3n6T?@9NH|yL!F0b-e!{iR#M^kE}=MI>Iye^D;^pq z2*fRsO37B>#vQS}%dGsY9@ARs-|6kMWapJV3e+R+?w3Wi1M3b02P&Dz?>;d zp`haAkjFyOv7b^E^(6&w$=-D8t;gj#$~Ap4XFk@aZE|%CO4zd*t{qBrUL*+XB(KUn zc5&Dq(~Tunre4=Wqc~8ig$tZ_^m?wg95;GBN8rV`#JKavoCB^e@9Di9EI+6F z;qJ(QmqD9;s$P0)lULF!YPtjcO|-TMn&{RRpllWq!$Mq^0MfLTmdAsz&P=E8rpymk zDApI(Q*G`)0Vae;&QtLz*FOtoi%bL4t7EJMdKs8(QEvaB@Xx?~vG(}t$|U#FbP#lr zXTz=KjS4Btanv$`pgPzm`2CZ-Uk`a>clvyLmpn*`@lT}jV<5waK_fE`8&pONn=wC7 z@*SwUOYg`Aq8jJL!YzP(?aVzQ%8Xzpsq@@AT4>I?021_RqQoC?d|1w#Au{z!M_Ug^ zm-@8P)PF$A=Abmj@$)H)aS&!6Hneu|h88J}D_2cZQkX%yBT<=-45~36jNMG+2F6Tz zUp$KnRhV=?UNnEXzZ+jn_kh_aWe=~9KOZR_UsZIZvEo2k;>_Um`y6c0Tq)V8i@M)r z;kmA}p}2t%l0W)ajznR&W0OtJE?NnAw1<7Q&pe#6>n2(Fxhn%*qAnqWY0`3St;UES zVTE?>0zH#})#{~T_ra)oKhXf<-?Z+b2&hW(^1R41$c5@%nSh_f0`4XvRyK3jOBZ+} zwq6dQOos=c71$wCLwdup?+2jo;@u{*NMl(;0Z!4XVv;s|J23X6(AjX`-k{RW1s;(* zXISyKpos!bfZ_EC%*HMqR$t2F0NcSA@Gz}777#S~1d+uw=1Q)J+Z_yAL`skZ7^&NC z$lRDIN@4IyH;Q)?*Xnf&eO0p=({(Mx*Kt$s86s3F1vesnGz5Bg!8CX|Cqll=IH9#4 z{J2J!&Vf-W12O9iGTpFFN#Ql4m7=ODKXpj{O^}7Qf5uPMUeKOf1ip*FuvWaA!v2b2!}p21^p$+ZB!5`(3aSjtgZq z7=e@R#;z5bJw5B>`WxTQPN~Gsa5}i$pcAK_Aqgtu%&~#d`AK!{Gx(woK?TH z?o+qyr>@n?8F?f_?m056=Z)Onenl?oAeeqJPlv)=_5M1^qkV4{aI$ zD|pUQ)=f{Z#0^9y!&8nS8gG`9ca6Gj1dZ84&YBFcaE?C+mhoH+hPOi@Zr=<8@5_K! zyShGJ9-Ry*ty&@a0rauvX_s>_i4R=X8{XHwOWzYb+4~|&)r;TqaPpx4)Qhb53kg_f zxYG6kOcw)Bq1sHe5)z2|%ua-0EDQK~`4>NRcn$;XYnDaIH3S@d>*}8{5}7R*MT!h zB@a!J+N=gZ2l(A(b4Q}8sE(IxA0^RfF@#}T_Q|Aj?)*D?A*FKRih5Q^6fu~<4zAeh z0^Jm2mA=(i#-p@TM`k~%k+O}&%3nsnrb=er0S@4l9pLx%a#v4nlH1PhZdpE8Kp~ho<<)b@Z!^{0=|TYY_mrM(KYSR z7qC{<2;WXJM(cOMGF!KWR?BQ{_?+QFyA{B}@aCV-q!1{vV5kZv9nfD*VF7Nt=|lXbpz$XhBz(7euAHR0zWNLt#Ud6SMIAO8gH&4w{4dC7yT$Lb@XU5N zkLSeo)J_~@nkG`I*Uw3)w`y=M-sicaNvF!DC{48}EcuPrkXCMCdwO-Is`zZ48!fqv z3vWS(mRIjJ4-Kk76Yg>Gt3WTA85ilcRkwL1fJw{o)9FK&f%kqw@3&~FCr~MJD$0~M zlo}ug?l%^JqAegzh*|xfDo>rjP-;*YSSP*I6pZ%{fjnIEjT27t>CC!2fN{Et%N^o~ z_eW_@j}A^MzdO|jz{$&{RDveRSy4R)q8%O8MT~8l>K3_ewYA_BzJB?VS_|GD8iu$2 z*bFq*8?uQp@E&q+c^J4^qKFX;xjYuFSHfI~@NrkO;HbBlb+-9bQDH`hkm%_R0E@FakQ9DFGtAr9k z-PW{`bc=huGZJwj6jx1vPC0?p&rTL8x0J!mYFV&J`l3L-4oQ0UQy>B$|-I!;im2 zaCQW(rVPIhiOTev&Ub!{SSX2cs$-5l^SI}~!x>!|;5|Q*a{n7OAmO{InP4Qd#89VO zh^GIG<}6Z7t(XbmK-`;8irYDYDM0GD<%Mds8~cHZHg7`h*O~qSO&abwpUq zl+YV>C-zC1|5l9BM7&lQ;$SU6Kn4ZvTa*@JmPU3r$(xT;zo-DKvwNnnM%{b&R67Zu z+yo$Xtb}<9lin9Dk8!r`a}+^(JYUsvokr^0zcg1VKSm5)-0s3_t~@M>#24) zW!i00{YTx$1Ph5wdH{EIP+-6ZUU)me{^}>`kK7Bz8f~^u_T(5fXe_)e(paaf4lyqm z@4Iz zyn_Mu#OXqFGr@j4=27*|IyJ{4D-K)JgK%n{aoFl0BE@g(81B!7aT=S}=7;+7B93sQ~FMyn5Tvpx^3 zFNPy3k*>i1phIR-Wf|5NE_ndqK$Bz|RV~SB?=7kD#yfC^qC9C$mKd7uvcakH4<16m ziO$$8SlS&Jsuw4pFaOwq!hN{DkfW?K8va!dN>oSjjIb9Q4OpEWpl8nim{oB*y{X0> ztWJ&#pb(j)&A6j(j<8oe-{=!{xM6tFzoctcBI{>Z*MJl|e;ft{!W>zq2qPz!JC~7oxpjQWQAHAs3amM@4LZXy?gfvqO|(f8nfj& z*QI{0vymiJDO(OmO+cA z?)f;`!)lL#lu-r1afzC@`)hE8x{Yi7K%ZAxJgQly6C4x?jYgc|APRWSf@_FdPcT%< zx8bl7*-djf`Yx5(@Zf*%!k{d?6~8q%JsDNLI@>NJL`0S!)(9B;x`llEww8iO26_Wt z6Q%t5Jp}%i&X`YH|0xvH$)tt5rzMF%E-G!g1N3~DUqgc@a%imglVrSpU(p54^au^qMZ(KU;SY(tnA zWMsBLYhwV-;sF(yecrLsr;{`|SXp$3IpS8Js%dZ?4aY84}}BCp3hA#2fp5MpIHfCnx{-rk#vV0}*3l z7#&e_?*nc^DBu=o1+H*2RJ}u zQjVeV?=D@L@@N;VR477`=t8qs{L`$_b2999%<|}tn59`a6jsRpj)<@x4hhrIagpSq z&s1pv^RzJ{XuiDirhOOY-g7mdRUa@qQs)~>a!$P!6Gw9YiDOCkx8Xm@p=e? zcBYN-9P%r(CK%3o7wD~qp5Y+Y zHdL(C8*q+$)RyQ?_Vjh)B<`(hU7V{wPIHM%kMzOclV+`|cxdqw$>u(HNV`taXSyt# zW`3^ENPOF|ZXddt{uX|VZN>fy` z^p2_I9((_T<_)QL6LMNe5924FH-0m#I%e5z#ZSHMd{fA(^&d|bPiTLQ=aL%&94W(I zTj+1iDt6ad4*Kwp=>=7bcc?osIDPy{mN@7z#h*wr(g)m5+1&dG-gpdm18o_5%dtY+ z3Etjd*7okdqenYxSf|Gr9+Ya`6u21#+-|ofI zI^|Lh8>6gxu~v8dRXD6KioO*Z$&lk`gvq6ChE9MYc3ArY%<@444I5I}xl#a2`}_XU z>pm7gJhCg+&Xdri8^6O7=G>dgLvqk&RbzEBBFZ#?!JT~$3-Jeo)%7Etop5oBnJK$`CM5_Kol#cYJXIgUDl=Nt=37t9c&43xe;2b z+fxncQYIqTreSl-y_BIK>|X(W$jPXuPZV&PM4X44XQCeiR1wG~v^K1bzm%O^WYspQ zq*%u+Oc(Uc|CY;rK+mY{Wa}7r#L^%(pHt2mGk$yBI(af1~tvKfnE}QNI3;Xz)+BlgY6f%oe*srm_bmi_q_&@mHVxI+sdf zuQi)d9X3)y*|EK(bpvb;bW)!L@Nip5xjwcQ8}%;_z}bIdQS71`-)AqwK;+DF&*JX7 zUgQ^QFS9Y1NFO(( zR1_*h@_uW(B;)+~s8SS-liw*L)B9c8^-7jdu_XavhWXI8=36H!_;vFR-rknLsBx4T zPPy%mokP{j)y<2sh|k%s`{9lMm!yspP|`C_7(In=SN;>cAT*W}mFzPbyNY&EcrECb zgx7WA{yy{!x%4;wIY37)PWzN^{>rCsCuzYSQZho~wfET-*?<1J-LoC$GcM%5Yap_H zR;%c9(_&xAlsfm80^9^Ag3c|hS@qg~ful#_!ew|ZVaRA4(1~Vh%}2bu>zDtwTra`% z`{}8aR9erX9+G!pwDKEijAh^*sXK2*=9LY-133ElAOZN0I=D;@mwQ~K#bTC`$s92D zw=MFTv|PFL)PP0Ow|x5(@AWD_M;ehxX;#OU_Lz$0?cXqNg1___eo!a)vmxdp$)cHE&%6e=8}dIf(D;B*`f}?Phf@$1D<&!wnZ-Fe{ck8 zAXj)ihQ%~XcpRBHep?zX)f>gZeE+o9v`QzG$%@pgkleTMeuVs1wj&(Qg)ggpEOlG| zaC(=?)sRJ`t-uBDJO@n(+Tic>(H;4{)E`TSF25Z7+nt*8Izo0}YsGAw%)ab@t3ci$ zK32HFy<(Cfia{Hl_q-TrcEyfM>gM zua7ubuvm)mbp>RiR4Zy33gXOyqA$JU$`Ch;JCpjwf|!h&en)2oc@WK}`>_kPGCEJF zybdz)j{QJVrrRkvawEue;8}GngY1l~RkQd$qg_X(%5rn_!%L?%82OKLU5_;wMO|{n z4JLe^qN7_U2h~ye-0$xKj8kJl_Ma?I*rzDK29FY!r%k&H!?R`eF5{G7#!jwg*9Ket z0d9w3A~rKoUZTH}LRi14;BLt$B7Bjb%Hxuw>lHCH4kfKU8Z_um>GJAEZ0$&SXBKoG3G^LKF6%yEB95ap^-STRyk{S#y)%Zzwan?sK-pz4Rps=Hx+xo$z37Wu zxV!S_bMXjn4Px7n?N-l}62&Pvgp}f!av#DES8%Fwl{OBf*!v@8Q0$|j^SAdv*9bJM zxnfK=9qZ3C_PHuLvjwa_QuPyr{dz_-cVE6d+2XT6-T&~c=DuX{2RwgDmjhd-KXO{p zPZ%jql|w=ij+u%VP~0R|duCtKMIgoAVO?qRqVsKW1l)oQ!xK z@7@gZL2kGeNF6<+EWS_OLApF+oCknbx z3a)m}f3^22{Rq5=tLu%=cFJ*LKJxcloJm^l{%9t*`LuO;ad2jvt1bA#W-ySH(WiDV z+vu5c`5B72*}39=yuwGXdqdNaJTkJqqT*^)f{(HeDNB@>)%vga?|lCoh)%{O8IcuG zsqsF5g)m0}NRE69PXSZ`ya6&AAU3vGX@uJ8Pns|+5tc=AT2fS}fUN%?Q)j^y1skpH z8M?cql?DNk?vj@7M!HKnhn6mp?(Xgyq`PZK>28LGkF(Zy)_Z=$6YJjhb#0o{4}lAq zyPp~X!NEP5SpizgwE#GxDKmRsya5!`EYZJJz_k{2faJrd9FSR3Bm{)KtawPxiX$Mn zW+~k9GWh<5@*T&ZAg@vMx!Q(K$NEiqdGnLTrG7KkG?M;VYm3{r{~#e+Q(#2`peLiG zX@$vxx5bkdr&94x8det3xzW2asEi6gZp@i&0)MnS=uOf=EJ&2W5aD=$C8H||+7T^7 zw+6A!f@E<4EaURbO@G8E5D?;B`d`E8vL(iQQtZ}R{!XlQU^k)w_NQ#E7ycYX+&bng zQ@p;O>zIAAXnxsLAc56`bhwu5`}gXeh*LbvixjJ07{T1)oomP@jC#?stM@jiPjY_7%7m8*+-iCK#Vx(%0g^{pgUo^4>|B4@Sx!23~2Dr#l&$59BmebOpbEMOwA#lxZJ48u2aKaYDW;QUf zoK`954&iHh!k2k<_VCnH*K$QWpO~)q7F`asZb)38Qd!d;Tw2iX6!*|=;OTiuYk0_`i z7*-`A^S#RJF?A{1ouOi%(~er#XIExOmE_{XyRmml5nYZM`racD{tx+H9(*aYG?~=| ztcFa5C9jue>4`{Q6+DWJ`h%bRP*zRe9nb^bf`<=&J8l(zc|y;J&l!OA+148s$bTg) z1yu~o$hx9OBoi3RA!+wQN=*5i_$in;af~ry>O(H}n1-s>sx^5Vuak_dyhh3o$%w1- z-)Lnc`)ljK>pU$%DYIGr4)mr_K;kSY7#&o~3k(ND!O$1vYpew8??p6x18J7p^;I`X z3*VkxLs{P*JwcLZLcv1DRR(_q;Q&W)laz&B?3|rRht~)IRDgvK=-Wex z0ymy?=e&UN)I$XDzXX0VJ`N++vsG9n0az`5tG8o+pFb||Nv|*zc>J;?RZ-YF4*ZcM zf8HtCYd+4X+w529>h6j|g7a%fpR#&JcZ;%gm$a;jOuut` zJIL)4YDdaLxAymIK}ZKTe)_5Jxi9O(NljM|^6{CyduNA)hX8!ZnRXme?nvgHq{!`; zo~fG5XPLCv76?Co&NNy{q}o?-6BzmdoYmDObbNH$_=(TAoevTZwX5x=0)1EZB8IRm ze}{LGcm*gMfCF z#mz_G_)y<18Slr`V$Vq@%4JpPdo0r&BcY%W1&Qx{3P-uP9Qpx}`I}$wJb%>KWWR<0 zn3H$gj&^9QOy|lG3b={mu#>5hEhAFWI(+v|CXloIk+r?#@;*vdgmm7m?SuD@Svr?= zbOD})l7T#13uconm(m;iQ&Vw*R|nfr!JFH4-^mv)zCh|PuXIzo?dJ13$0rB0tkEDP zc>tTLZFT4(NG3p7^5&?XzER z22T(Qd|220;u{e5gI4y<*M}xBblCPX;E%cXV`D zG_Vha`$?kGVK$jA=LbtZdQj6i9sh&L)!9+kriTycasBipL-PEMc!j}AjDiLk7#Z%S z{BuvSig4V^na3WZM5AA}V1LF%Ka{=6Yvc=zKMo22x)imXY!}){P&4J43n&G-~Gf0DASHk?Wu=i z*Q8gJ&D1hinNS9wHqG`(1zz_U7J}&->2_m9DkuTsyH3_!p9jG(8^PQWI!bF;AR*pl z4%Pk5JlbS-@@tiH)D(gR%aM)#wL<2!DXPX$G=3xu7mU&-a1y|+*pJkiWbL52E`iTh zI+OF#9aH{c<9lbErQqLO$Rz$ZD%07BU4MR{~!7BQ61+dGxc;keb|-IbfQ2XVA-q@pb|=qIBq~wQpT9#=3SbGfHMMha#2%e)ZQTmaYdTxJ=>YqT zOx0Sz6oyT9BAIPj!&5x)fQA~O-p|wY(|~Nj;D$B15)O}PT3TAN%>zpZr%e}xxLWux z8kFaW?;UDP;b&@*@&f9_|-k1jojt-z%1v zeRh-CTBaKdPLoPdj?Wk%OO|oC9+L_lP2LG96`Zi*(7o36IA6WR>X2;cR+{O(?&)?| zm<$OaU2SsGXPp@suR2$Krb~&9hi~Nfo0y!PJaJiTixq^v<30VEq?TO9%<`vAcB2~Y zI|MgWd% zXf*Dv23hsP+5rBT+ek;Ttl=WY#KP7phTr8MClqKF#^k6me#(sf^Z{aJFBw)A zXL0j%<|_R9h=JyZxaRWmQ9gctvU@w2dkv3E@qhWj)dWA_&PL{7F>WWF(_j7^*e!HK z*rv*V^Ll(Y+}eeev(V0uPE{R!zCGPkH%taxnV%{c>;*;Djehs_)vc(K=sxsA;i>ti zJyv|St9LBE-yVAR__dr>&Rso(C*YnS=HHHOQdj;=QoP=X9oK@=ip7TFO=;I|a8100 zTp`myT}t+WU)@~_!89);OG4G^Ak%=WOHAJAvb!SSd|7jkVer2ovD+DA4s*$P$LZII z)*{^x;+(@d&*Y;_;^v7xQtJ;8+v_p~-Lgp~KM}S;l7(O@Qd8)A#v)H`*lptfoT>=%Uca`t5vK`ML&u9l zNTN;ysP6bFvpZJ3+#0^|s@U+`-L1b!H*f-Z2u}O;Ss{DTBo+Dj_+*U$4tbj6lcU;~ zC(M;h_jQYnhcjlkS#JBLMw>-P`XwD3Q9?U%EGf!r7r-RIc?^k2V#YNi^^nE#?P8)` zPvv&zbmcUokqHOG9W8zJzm}TiWFka~}tFIJ^7FETi zWLn9l!PbILK@TI9F~$HBfpt}?^Gl*zuBDn+G`p@0p_@UN%ao7aqr0@}MCqF#4ogDW zCNor(q4T!&^*7ya`*iM1SP*9)D7|vq;Fs-k7HvR5Z;w6>2d@y?dU@}34sZst1VTYZ zpLV(qXd^5c$?A}sQ9f@|<9$}{8hd9e$S4y`YaHs~zY&OVMBzD@`JjC%?Qi4PsX+hY ziIjvFv&Ux_AJkOfE|ZdoPMvB0C_~D_hEb9?$z6AiAVQ{^{jFQffBO4VHmSrp*Gs4x zNr^%EQ7Ohqi9^&}$H=utQUMF=OupdIUs)+{rX#f_D-jBs+b`swaF9&*p2;~GvbMcY z41SwKGQZ|Z5a?4;QQZWb@Wpu{oWO4}X5v4l10nnIuR@xgISs>=N&RVOXZ8-WIzu>E z6&ETZxm>5HzQ(`S@hOs{{NTx@vRZeYUgy$$B=2~FXdJ59FoN51h_PfjIB1J>?iM;=Dq{jkYHHWkvmzT7QwBXwMBKw z@PT*R(bi0RF)V-cp2WCTX{qA$GZ)FMPV%m$tK>Q^*jtjoX5>Fe2W*oH`=f-ugqbc0 z1`Se>Ct4$s3tVeFs6MqFUGc&@w>Ov#-LW4|yOuuHU^+vbW|i#M`%1j~ki$xH@edZ& zo$rW_gnq=;*cwJj6#%DVeo&s7W?d6T{u<)@dY#>@YyW~#hNq$ZzHkn}lnD+1d^p&z z1T=BLpr8hmXJw7TW6QsPUD=LBF<$r5HKG9)qzlMBBHegliG~Uu)#RYxgn7 zcB4hE_i4fIp!N&7guszBk&j_=GGZnSVFsJ;=d8IS-sMwiBws|JjRMh~i~RQ(pmj31 zEdIVSN0HExJIr8P5^xko(KY#ccK$lyb_#JI;j)DpTMJy@RN(j61l{J(-VM`b*X|oE zS^2+VzS;I}i$jzBZ$C5{_Yyh-)lOA|H;G?k$X~~kbF}|iv#n+ zBJ2o-waYk%#%kB?hDeUs5f2}4wqy#co8y3joLJJ>eeTMx#F>7-GQV&b1F9&d&!!wW zMc}J%;ERVd^OKf~T>1SlXr;lH#n)PwzmBt&so9rQf2PIbHI+yG7Syl}0b0!s6R|AF zbe6M(@_hiv%Vdhmz(b6ih=Jzr-f;4_87Y$>ksdk@QTh#E+EIJ@6A8&>YPQQ+hn<4s+9xxj;+mpT2 zsSS;lxnWiJVX_&zP!(scU9ShOt!}if_w{VI{@Z_)cPNHMoHOXyja&LcJ~X{%Lye8` zHDf$TjlE>toLMs4Xud!~-d447FXJJ~^-CM8B;~#Cn7WlVBecJ_Q-|gH!LjZTY2%^4 zw2w?M^68gZYYpZ+klQtS)${E9rqLCOs_J28XYzP-9B`uMkhh}3Fh%5YNZg@j`PclR zI@a*xmbdRq^r23~R;iorFGMywgSsDp!(}CnE%oGD)y#s~2!r?WfBBYdxcq;iB|8r# z5Je_4^xtQ3E`$n^AV9Em@*ZOohKQ4iLwTjaf^j9yVbyOJ`sDNa{VL=H>LJswot;7l zuBBfeP;t99f1FhZ9}ojw;TbhwMC$ScZ*Nec%agC{)&%zAZzr-(_jE#bnw|fw6*q_g zmh39!@2guHL$v6l3Y;y9fLJ6&fPw&Z5*ppGU^4bWfkW&Z$dK(%YcDk7_eL(YejC2- z`fN{t={~;_ZhiC z?T_sCGES=80QdCGLVydf3&!3_!tjs?@XX_us3At&if=V&>^A_XpXgo1 z&u&FBnP%KGbBzkVj<0DBkx=a2G{gGwC=I0W$!Zvwyj0G~K2LgkYV8FU)0;Wm z0ROFx(5w1d_K|#I<3<7txXfZ}-YxpC9ox5`vi@w^>`d@6-G=|kt>U6yNbyuPs<~^D zCyOX1DSJDY?KsT&Dr8kVJwIE`Ir2BA!t&7hfl;cw@2hc^1gk(fx1X#0!7;qa05S0l zm5@|(zberON1WDQ8{tvkqNO+!>JL#m(9YwlIo~4bt_t*w1wN@nMm9XKyUQ32LMy2G zH|93ihD@Lyf7ai-<$nl#M%@038&yb4D2#>;?cy5Ma<(0D_0fBsAypNkMABgcY4a#E z$@6T-mNqr>nG)@mzRkA{dzF>LxxxU&jx9Fn#*km%n8N(zxM8?CM-s8Uwv6Z|8^ePU ze1SLfxrVcV^amf@Z7{++VV=G6cAx#W;^*}i1gJV~$yG6`i|DgajhowLnTP+O13)j- zbxOo_?%BX|?~I1k0qkuqAl;YsjyeOf;QLOC0*GnIybp#%S6;R-z)>>C+6&u34`m`& zGry(OVGp9^p8U?6D3kR%I%I>BJFj5_~c^s{2_3N+&< z*QfZEkOrgWW<__`j|7o@7h`CA0l>9(ZOPwnQ9{;SKE)~z}%Qsw-@RRX} zg*`>Ac{4Ovz#3+7?VBJTjj=>7eAHxH60$>--Mz5g*7DU&Iy0i@OIh-306!m~I={Zx z0Ma}dUSi-S2>8P1yc5T)TfZ(FXTwSeOn9Gv!IlokCYtKR&eh)&FwK;fEq?N+O+WahaMKs7M89=V@GYD;rfeAb7Q)qk28%($^l_M9luScHjX!hd zXC`)}+D79=;kq$OO??#HNyE8L9NsycuM|ZXS`!wz(r=;SKzn;&R)Tr7mt!%&K%Bpf z$}fW4L|2v8MJeM3)#isZq8jv;>{3gObwDOrjh=@`kZ;clH-~@tQxvtgt5ROM`Ui5c zw$|~NXh-S1Yh(j-bc`HT?;)Dod3TxS>ibU+z7F{?3E6Ci#X5UKQYP?Ugx;l#c{ z4bBEc07(h`TG_m=CrFagE6P`QY~S`JhAVPoKP>b7TFdT2>)-xt`kP1)IWA!@FdQ1G>4~&p!x8 z6g%%yn!Ws|tJXJ|peGf&e3+4gl_T9P$3DrA0u%1KCoiU+wWb-={t@R2lM%a3fxRF) z&xODef>X|sIUZq_XPXH}uC(`>M08=+RmOiz6B@>6UNE2Jk_kV%sL92d4m#Y{J0zBp zE~er>u#guc8di4Ow5R8sTt9co1dbDJ4GJ6E^l@Q~6Qz2#EnvLR2;x0xb^5|hvihTV zSQJk5O8VS-iyQs#^B3z6ub1yeva^_sOW?gW^huXJ;omKH_&O z_|`80JEdOH;kJ-_{Ml!I-70`#!D_oV$!&FI#0%aL>Pid!pdT`;*kByJfm!#Pcel-={*#7gHK>HyxFl_i z@f-(!r-i42np1ZVi-Rn&C};tL?5ugkzJ1)!apmrxT>tCj8AeNClqH_ls$%cf(CBx{&eJAh&5nzd~z%M*&MX~)LJ zVpNKBKs}GSh2D^AhsYz`7X%Nz+`1%^bXBraLsFjV4Dcb0bJj2@W(;%*Uom@_D`b7aXE$#E;H%h(&?=3L0Gv(X}ku)cJ+NO%xN3of9ofJ#c++4Xx zoCYaiH;e?$k7}VWDFE|6C=tXIP(4@Na>JjwOV3w`7$#L&jt=4oReQ=&7;O4<{J1~1 z!qANz1r?~_DeO}BYJ+bmi&fVhgRNo|_L`hEPf}<8#adwR}(qjnlM#xz}V3ei5sqsE5rZBOs!B$&o9JbE(N8i9YG4iz8W`6{edw=Qt&F4j?8ZW zL!m}zCPsqhX3=~8{46O%%5;AFZ!c`xyVKhz>z2-7@hUmo0b1nH&)xx^xxHjAx#Ev7qjIw;$HdnRD=9IpLgpJsFB1^*^TaNaHiNF|yj2x5 z$BLV7($@@W>tsgZXa*8q6S2ssQSW5-_3fv>Ka<#4qcA(%p~2Jp;eFmk_wt4Dw3gP*6XGMHeq;D zM+<~sa=svX_vQ$8*!&W=1a<}6;ejGj5kyiXNww;l+m!<@Sl@0~p@|gl%Z&_QB%kJr zg-r+zJmOEit(tw0b-9=C9G-IZ!J^jsnaooGe?X$ZmNY#W5U~o_9+1d6iH1y#?zI3& z3$Vz={vx>)Qh@U73A*BM>g{$eq0&0f;=k5!yRi`PO}b5X7hq(Xe5ug%DcHCxiEY z8iw?&sO`ZAmS$HKT9nC!qjw-M(Y{KhG}Q+OvjX{ME%Gfmg%n|5|NG2t$kAEk8ysNF z_pelGW1PW184TZ_X-kLTmdjdYj6jlF+9sFg+@NM8R*M0VE?C(;iBIc~I})k#v`(95 zP9mIa3)#yS=aXNDYpjTU<3nO1zzPrxO^bFivHgliL1wMeb1-BBwsMLbj!)u3ZRQT1 z;Oi>Yts5F>dn(?~<{w!66l;pQot%EEpyl<&%FM)mu zar5dzC0!g$#sDQJEz}_1KEg`wO7Z$C)M@&wLc(`~v45kdicPRbUkhxH^Mb?Hmz$NfmD5?)Zm7@*%yJ zo2t=!FjKhZ>HMwqWs7ie$#qeWY(`{t=H;kfHdf#1>+hLwgM~}42V$2K% zO=fS;xlboW4yz|PZRb9Nx+i(4O~B1y0k&`OJ2YXo>~@l6cR}4R>F;$pV%<*jOnv{g zmCE*f{L*Hpjdi_BMkd0@bwC=ndt zUz+7f72NN{V#}$l>{4%U~W6lqJLsDG&AM_0Pe7dowJiv1-_QF@Q3<;Z@)X zAZ=4`ubsx3r5o}*68+p`bL+5Y|9XdOB4R&3=;n;*h>%Y?opMuyvg{^8ZcE`%Rah@q z_)jObjTxb+-tMUSxX9oW^;LM;snC681(Mk6HsSP(#2SYlWX@+MXvTljH*gI^D6A|UV+yM$&36CWrZ6Z`^LKu zH-@*}_9p*q0<6My5+=!}@Jsq?jJ zU+DET@MAuGL}kYKY*uIRO3(VyP>VIL!E5rzqFU#8xZt8(cDB~g7`NTOzH!@>6U&&IL4(Y{Jy8QX&!22sC2RKhvNnoJ(FOnYI6nO!8 zzZyLgiSF}6P7DVxf;$34bz;Q95$K@yQ}}nI!WtLg%#FhaYqG}_6gRf>GDE2_+xmrC zb9Jd*)EVEZMG~OfD#M!W^7)9D^r|1%@8yEi79K-xqq0B{^`KP0+rIMUFxzj0%WmB? zy~*|x_HRTXg7@*tx~b->bE@FQETYnyW3s;AvY9l5ON0dUDfadI%o-Ayc#g{Q6D1bk z1g+=T9s(b|JYw}B^}X*C;%WKYgPr$lh#;UO6WVpxv9eJ0Et@65V{0Gp=)+b)A;>;p z(eRb8{dq?2BkhGo4iX}MD_)(VjW1TZ#iw)=9BSlHMhc6zdzXdb!_lH`j{lHG zm7dkP_j&b-_r^8LN}VT}4BnS0wQ^d8SGo&&&;|>3uZI?5YGaeE*dOtO3-|jAY!75d zF+N#|FqM~D>>xq{k8xKs#7=pri-&e^r2Or&S@#UZlL^s#X2h2qzRzGn3+hpX=H-Lp6Rq;YppC#oBP6wuivTD95U4eLQ46F8O=__ z;p|PJEumaxTv*`Iu2(ipABOjh64>MJ~kvJ2edYeKnX$sN_a z8itD6SqugK)FGP2)501 zmIZx;r$+r^Z)@9Vb(TPH5V})E;Dh08nO+c(#HBAQ2Y=Cwy-xG9%^7TyLouT{&m)HV z5uh=f;YfVkHGszVeHJL1E1a6@i{>`neI&_ISMDDRrE?b6xF=OAP50^=AH-J4CB_W{&TjOuQ`XT``>h@40#BK=v?s_Peu@*cJR7=|IWA$D0;c zm;-yAW&3nZS1osT@aHg3WZN+_FC1U7J>9equQrtXum^yXy_|m{zYyGoc&BnwVZ&24 zZJw%WUty$NiQ+`ycC`^nhhtqfn;N-RZXNuYj93$q@kG(0omG5WS2TbfuaNeQ_XYBs zqV2Z}6ifW}9%1^ok8*lf>O|!QV7O1A$jD9!v=ng(XO!B&r6@?Cu_}o*Y!T4?f8L;V z+vbf++!-#b?%M#&Ws>SP7%Y{X!ln<2^Sdo=_(SUt?q0BiRsz>9Cft{#gr51`hM}m+nxHvmK;sRd{V(bk z)=fpw8L26XHYMp{s3MGqH^834Z-;HA-6A_WTH$Z+*Gq1!NtX8)%x~EK@sYdZv%SyY z?f;M#Fm+)Ka{X|0xjpZwX0AY=1Gn)^t+_@|adJ`wgpK+PqEZ>qzNkw|+VJCwZqpFQ z6M|5U{Es?EA?7(AA8?s-u1f7IR*HwM!N`}w@UGf$R3TMD&*r?H{NY9Ha;k!;Z3zh5 z0srMno}gHSY7|VHs%7^UzRJ|kTWU5RgI_jt{K3(=xjza#bSr|@{0shJJ|kgacP5_a zQ}x52$>vvB$!*`%!ekWUi27DgyV7))TQn}#@btqFK)wEigR8U3mzX-86W?SGteg~* zU7*&VSTk4DJ=nt^!xoIgSZ7+{zBrY!l9Q3Su62z(9Uxij}~jHdZzAERtolM=6Kx0_998slEg|I;>RyRd8QIGYfO*s}{X>!h8j_f~Z| zv-O;s4GNiQi(7kkq`U4?dsJJPeO;TPlinS=Pi>j z+cV7n?|BJ_rRxvCCCkZN1v%TRaDtODh9{urD@(df@}PF6soJFs3*ADHD#8Y7NDwQn zrCtK`Has1{F|EQZ5%FDw-{vz^36aiHHPYNTo4Nn>Qsv>60I!hrO| zy2SC)BYE&Ci+)A3TKZELDv@~4*1mN$I@Rr+yXJnbcsjvycl~=KKa28FS69EB4;;n zPzHQv5H4K1?n?w53`p8Jgf`(lf8wkNicItI=0@!Lm`e$ep&X)Csdx#JI;k}j8WH{8 z``-C|iTAzlrKsgB*VHBPoKf%|_<~!P8l@Ly$SSe zJxKu-PsZf7y>v@D|E-|2f4r-`^+%Po4lu#gt;Y$2_czSvAW{5xaVCA@Mb%C6yH^jq zF&az(G)+VM%n4L`9;U|lJQ1M9ZSsP4D|;obZGv*Uc${7_7slDba-3zh*0f&;yWam0 z+)%|_VlU;J$Yy_QQ?`%oICXu0-*P-)FRmg4Q{o(JM-}QzbG|+xJ&MIhm=PSbbO?qmSZE%QG)37%ighi?!GGSEC9g=hHESMx3Buh}&cy%eh(Fn$^aSI5?z zy>Bn6dA#`&in?1;aj;U#R)_I*-jh)3gJ;BU-M95v6nA2scYc}UbHneQ|A?gJ_y~lt z9?O$0N?5M?rXG1eQ>N{zWf7^R(r2zO5wio$2(${s-uYj^MPwPXaI!)iPB5I;0j)(+ z0SS0{{o$h0xGb(g?uucbkX4zU17ECAU&ewnXJ@U_7hNEAO_J13v`7;-a`l`upKyeb zH$`!(Fr2*(C~Fy}G$~C0Sm7ZbyeC8_Kk$2$Y;--XQ8>;#UN`;d^?DkT5;9)YchAiH zIYBHUZ1*HFl2~#zGcDUfix7zq7!f1)Z7rye_o>papIL`Caj%$kdyI7rikh8w{L^WF zzCs0B#i^-6E=oJ3BY1ZBF9Z(UP4kdjJVq;d&-}q>?N5G)((h8FM(CyRyrL`9@QitqiCZv9ixXX)S+U znAH}5){oLGh&ufI(5=SWVQ*S-(N?vuWy>SU|Bx8&F6d1Nk|@wW*SIFK!nfb3`d=3S z1K7&;=(^~!@D3m{Wn3Eh<1)N*;HFZLw5bTb1ew50Odrk98rMs{<3}0*=28Kb2Yqgv z0rXvd1hrutxTnE3OX?8Rj5jKVlTK*(AUgPOy_n6WaEz7T`9G_r5&1dj`-S ze#P-1?1$lTT2!H)RmS>=uz!ywD^>2|KG2V)?(u+bCwH14%vjy+4NI9JRlYG+y@;`1 zhwlc8b%o(Znf07`TyODu)715o%VJ@ide9 zEKeanqSZ)pKYWu3I5!v{0JS9+A3L)MP{cG;{4avJ?aA^BbmQ%HI75xRe7bR zOA2wxdkF9gEM8!ON=jOkn&C3UmCUaN632F;{CI zX%cYtu#=q)2Hgm%4@(5WgNqQXQ2BEKqGnM}IC||~*~KqpI}9s5e18(7lX(Zv^p~4} zcY_wB6WZ7AZ>4GA#wHXWCyw6-huAQVmj+Olh0bL4LWhE4mt_@_yRU8uos>wzN=M1=a^?@t1^V)E?8e5{+8)-SxCMup!@_}^C1-!HZLIgqg8 znl)V9rI_lPNevmoV{QZ70MqRRcXhp2q@=4?S3uFxCrKP#j2jDsh`Di`LsEF93FS9p z_^3&MQLJJD1q6`Bqcb95$O_W!qB2MXGk_?7au|J!ipCyU!r{YteB1UgpY!4!TfS>G zAh|Dlp8wUKWqDZCw^J77tk#Gu{arcM^%ZofO45AJ z>D6B=dM)l^E3-F=zF>1cLNN76*@y# zBjT&7xcLhKM-h^0?PzG|VyOO*aS(;f9T#VFEu|C%YUfw4<|N^1ODj=9c;5>oK)r`5 z+%wsJ4tIbEOD+?D=%Tu~c+j)lp$~7PRnkqw!{95++{#++S-pt z6z$&kEXVmh^dr=4JmX?{UY*Yk5F+RlQYT=6&Q`4LcT@k^%c&)4OyIexvx#;l0UnekE6``2U+MJgB_jsc1b^j3ne<0(maI zw8VB=D9hz8`A&KdHSQ-M3XF#4_tX}Hy6S@i!TYGjEUChBjKq%D+P)z@QkcX$+p{N36++Ux~*U%We_v$ zK-^3mjl^MSe8n90mvUnzrW}#PD$3zpUf`fzJPoZYpl^hI+viHBCLn+f1W|Y=r5nY4 z#i6%vZObt^1DlE2&o%mv>*kXIO)mIAN@BPyn7>4n)dhW$@z0En94kfg$EV{Ce)*jj ze-+xFvb?8dyaf>>^mhc*toyy?6AD<}BaqFhtjW_-sgI~1J{cXUYj&<<^5H5?hma4+ zlW=W@A)AB*f&26+dQdV%w(!|29i{hUfGq^6Ewb-J)Q`eDBS6)V8x=+lk%jkC^uzjmV)g3+I#OxlV!^Z|q74p=~`n z$s4iN?k*P>FOmb$@{&6oE*N1Tp^n7d<|aTKQP8()1?|G@ZhehZ$Q@DSCEf0Lfq7vk z$3Ctk1rEfRJW4H}qeibv7QFApEh9xmnOtzFRv$Cj7lCz-LX(xB2h_oME_dcbDfJrI ziI&ZwhZ89y=fxCk@q7MvpC=UL8;&}W41YzhF=3IYslF`LTR%Ib#i-P>zHDXc*NJ8v zyfj?7&_&fb`Ur%ml~@Y&%u1~(L*11Ce?zv)=X&g3a85*5d@p5Y=^W!!msQVv zVB(~DkD`RhKzKf-KM^|;l&dK{#SX9VH%WHpF1KIRQSye@wl$IZ$yJJ)x7ltJeIH_R zAL3XcEDy)$$JbpdsIWo!GHYV#Ja{vO_vRPnA!LY2m%=g|OA$Kc)2eANHsPJ_ zXl)ch6l~od-}g9&fb$m2j7O;3CWwe`;v2&0de%r3FiCDi^#|bz79F{JrH*AkMJLPM zpp@uCcjLDk$Fn08m46U@T{5Llr;$5PC{)hJr~L^EZ~{i)$&%{g@T*s@*t@$}$g)nr z$&X(ydDr)w{rlN$=;j$qW&`=_-EPmWd~dvK(7PWcS#9g0%+N4>P=xR`qZ9!-1okg0 zVjG*02|F_FX{P3dE#gZL-9JG)L*G3|K1G%Odj9nVrf3@X}0pFEs=Ldw={pHwt^V z6K`z7)}w;)`urPJqX|9t;h#R+S(lHLdKBHTIZPY-t^JJssF+++U7W<>q}mwUh;#ses^_qGYp=RSOv%?w=EhkSE36hr+& zEPcdHs@0PdrtUl(1|#046I?XFkbb~#>22Tvfu48_ARs>4Zue{6=R`7amTwbFd!eD_ zg(oLLAF)+P_5Q284wp5UnWfo`18+SWQ|pOKJ6aj)^kUy2NAZTQ@d^_|#_xCe#m!AiYEYt&>d^Qy#u?BN zKPaGEsV^H4t{_gH1+&SM6QHmmDT8YR0}@8>LXDT%ie{HXn?=I|>%#gbFuU1x9|*KR zyCyGbW<9pOT!gtp+U+~0`Pvs&C_%1o?+S=uf7`eF*lcmLzDQ|$`IYxEmsurXIgbHL zi;*!W>YFM?jYp&$I3@;TqBEx}@NzTTBrEY^v-w+)M3mYCg75ij zdnHoj^C>8a&WcOgiw}q~2RT3v=1uP`oA6v2W7OwyVGe8Xsb|i2AX@SN6>c3Tv}la6 z-YJOsjAhA)OS@ss-QXM0@mwBlZ7lG0u(cjfEt>%r&2$%T-9 zi|1anP-N_fvuVCdUqOwU-f|lFdh=R zk~n>xot@H;O~FmougO9asV71+lZRsgNGGNGCDFU^SeN@7+DB3$wUU6i2BN6Qe7>t( zzR4>_bYv*NUsBt-Qy(4`g1?`pM+g1OEYQl|bugIIleS^&{F&QaSGb?vv^ON^Rcy zU-$Pd{t3isxJ7tcbU4D*H@Pz>fu`P7(PGY-s@0s z`C!*MMDSl%#CXM|>XP3oSbK{u-k#i-XZdw*gk*Kn0Q<`AHrC_*o8S>azWzA0!)2bs%Xp3Gd}1>vtKhT`z}Nof~~2z(1kd|O;)HADjqUiHuLHUMdn2T zpg@7dH)IU#@*3A>wUOl!^-w(b^Fq6>8!7QUepD#i8WJkxh`dFf*7huvCEOHSFEj90}MM4 z2NKBjd|hxMaL%c;b5*9g<22!PF`>xm1&N9amM~Q761dc4z3FqT2exfIhZn=69mtkw z$!Bx}0YkI6sIEniMS_y~T!*wvrETyGWn%$+r82EYrA>J5(*sYBPudqB+#MrgBH$~K zMdTilR`I!%P{25IISR2o^0x+nSsuXQ#Sl@LaFfTVia##F@tO;me(Gn=saQpO zUp-+)??#$kQN;4owf1Bo28T*JGwSfd#{%pmhV2sBgF(YM$psd`gF8M)FyRmrF-&gb zRATYQ@bTu*5nuxr^rQ4g4r|6YI|XF0mSMv?BZ%k$e-(30N-$RtsYyw`LEu5>s8vR( zGjeLL`B890|`cgxao@oI*3cn^rKSt{~cS3@lb&@L;LlfEw*hZ{H=1 z?&I)|RaLQT?v7^{oT;8&xF4ocof%G@$=;MPyU{4wzpCbsdZST{ z(mhTKw#gibp$7io2n||d>sGMvDZ%ugt7ly`YpQ)D-L(RuK8JFY8-~VC#p89#dPy>_ zKd=18hTBB<>vKq|S4)-=48oWy+*L6m);w+}JnoPSD;N8097AUl2`6Y*@s6iJ@YH23 z|0@>zV0@987EujSf9=5p;5B}&%Eci}JU~Ebvvm3PmcK&|SXIJ|BcW)5ZO>|WU7K8< z3Lvz*pv1{6fwvSZt6Qywj7V3>LexCAI8;oCnXGt9Tl7@4*v;@cuaO%y*u7K0VyZ#ioKcE%Gi)*gh8HLKl(F zE>825-uHO3VJ~*R7vTRGD#amkbcHX`y6(Nmv&vr(M*33ef0@zp3Mk55#8`IBWSZ)_ zEIZFF3csc>wcqyQ{k3%KQoqg&yxd>DetBwt!3LbDTod{})4f8DypxFZ=`zo^>)5A* zjh{QeZU85763aN;a#QJ(QTBfcO(8iuIl@jzJBk?>ZF3N_3WF*1r?RXyO}@atTxS9ldYQ2 zpx-N2oLO%-ysNSq(Iv}oJO(0-T$(N7j{8Ub@5A5@r~=wTW>+jGe5#<@>)W!Xy?6xy zo+AS^)*92R^h@CAZi((nSPdiKWB_zud6pfF3(PM2NV2y78UiKU!P7kSuyS)LV193r zmaBBqn*BLW%n8_s(Tj$N5_z=Q7k#wpZrwkQM|UGI7O%ar>2TO%AYuE4<_$Z!tUGIxnnjTW$}>8-Abz`_O}rfmG@=P zSl!T62V=R$`2fOgHhxc3R22p-(i4QrfVpMAGKRFy&lhFPqa0xM8k*gA2@$0{yV)Cc z4AINcol#3%t{Tw4 z4*L&=l0XlXRYirqzd?!yv+^b)f6#Sa_4S8biNDmXn*5}$QQE)wByXE!S=r^4y49qU zcY?RU=poGkQBi8$bssxK8^5@VxUqS}T}wXuzEk1#CsVj?i{yG>Icnp4 z*bMTaMfKuBvmlbE(dyXQwy%DWMb6)|^UV)uTTXk>f-k&1wv0#TDNvtOca@-McYSpH zyLPGI89};4HeT@Fu}!KSTxQG|8K}EZzP|Osaqk+95OsKzQI{n7{n!c1TsYx-FY|D# zp7~TUq-6Jx=L{`V{WkmPc$3C@(T>p5%-?Fp$LHe^uCh1!%V+f6J+I;GVdgIPp1sRd z8h35@$$NO8-o~KXQF_7u`qnG1l~mY2s+31hY)2GpA;(TcRu=t+b(pjyGyG;uwLJWMrR>{s6llMTHp)597*lxkff5P z)BCcc-1+ed(zjUylc|ljrPFsC7$kJm)1MkzXaJ@LHOJcdFFAqrwM#Vr5e{!V_X~k1 z>Zlj9J19bIbALIgoq*52{?urck&`^G(6(*kX?whx>+6mY4hyKjgbSavz1uP`=nFs= z=7`+BuEUDngP7b*PesT0`>)JbSvm^YuOgns>9;Yy&knWr`ippmyc%;*-cDRrjob0_ zrr)&O_iYtN^Y@)j`Tk8MuxVp}z}lz4ac0)fNyq5@SwuIhFZM9Vu&ZI+L6}uL#0KVh zg6MF_A^k_}s7C0Q&gKYpkb#rib||MQDWQczm!cRv*~nf~B7@nJkvy%!E70L)`KF8D z!363yY3aaVV9gfZ<;MnDXB39MAuW+ac4`^6`Q$d)7a)I^z?94ufjKUU9fyC@W8=C) zJZ`H=c#!4En*+p{g-TZquvZFi;n6kBhi z{UvPyt2=>#5;4}W@dlHu`GKR|M;5&_hNIFRxQVFDltr~I2AY?tfSNK=h2%~E`?8*v zNA1aH|Dx6QAA91SX_lokD#T1ShKUSL=en`U91Cw#t+OIC{1h>Fa>OEo_y2`NF>5Y& z0G$lI=t;$bAab>>W_r~iz{ei-8rA$Ng&hTsvj2LUbkvQ zyc7x1pbUSw#RZfGrgAkpB75jUT^$B{i(xveOSmsn-I~lqH2udo>5h=2eSIbI>v8oC zn6UM|90Fw6#>#DPvrl8_+*Aibwr7-6^e4!OX!GC2l5&C-rygE=I4e1x6!F{x?kKyo zq&2{DyA>druqfW;(D5M4{ymwk)A#7g{41~sjEi8asl|pMKbyY+7UG!dl=+RzD{E8m z{lqL!X*F*aImmuTaCvUD-q{J;lhw9lUKzSm!4TcA`W}-=jtN<3GXYxxO1Kd%D%$HI z>c{Wq$w4^d?1!e;bH4^ylry+c(p^mQB8VPLy)jyanm?Y`hd4qD<*L02`kpm~ zPY!HFnQ>O0ABoEMFvXhJ^?(z`17zj`NXtsO!#e$Una{bBGg+;I*p4Io6_uT!;^ie( z_l2dpmQfc+`QIQcM+tv+ksXn2+e zvTy0QZR8RhsSmkBQ@$x7!ZQDFMo=FwhUP6-QZ+o=w1~=VA++i=|j-i*Pe!bYnrx`?+)BUR&soh6IZ%FcM zv|-CuDn-Z1iIY6g3=t7A*U>@f_Fv3KTDgwGa}01-Sit|jYT!dQCeywcE}0N6SOjfP zU6tj^B?tDlv3t1vyw(k4%f2*yapTvVE(zts0O|$;eormJ=J=j7_1hGddRAwCw6#eY zijm@e=#n6<(RvqhrS-xj5_q;$n{cVlHq2OqB`*n(05Df)PN!_Yjj%)35&dA>a@Kdd z=&T=1i`_4Lvy6=DX0GEkC`p#52OiUkn;Jw&^D6d|&y&tiU}d>j}SU`g;GxJ{!C&~t(;`pvV zM6u7%8rLP;RcxE+L_IvT<~1QBahAW%aQPB@j^;(a2t_gntv1;(8MFKFOL7JbU`S#% z^5-7vDyV{d8Y+@K$E%z=(KBGyk!*~A<7ad1A6fO=gzj-1jbG}qm=%z}-RUG2B-pL4 z?lmpW71rIkt8|ET=ttje(sZ)!>w??B_(T+yMwSS5GYLH|lhzjKP^!;CXlq9cbgW_5 zgDA=T>1pv4=yV2xXL&yU3?^IgvnE#S7&hs-Pm2VHvuX&VaeSFf09#S8r75L_)5enr zKS+!p@6!WAoO}6XNoFxG?64rnrorpRyqd9^hsAmP$(Pvk5%U&>ex*CR zd~t$y+b#EeX;s^qRt!4cYJ$?ZaQeHEZDX|P~5RiZI;Zh9Ad&rOtM_Z!7Jio*K*n; z%+Yv(oUcf~WjGunU&xvytqEc}&nAeTdk!8pX6z+zh&7xLgXuBUM<8J~FkA0z zf+lKzSs-e%D?r@&e=8Si#Tcx^$~5ajKfYWv{fW7G|AjYH$pkpb<`1d;oslp14E-d~ zNte%@MNRC{1pNK5!?`N)8yk!*{P@)xRzb04-wgLY@pLWGM6UqUkN%>GSlbY0pzt^? zY`8goFoNIjz;p3p!U&k&_mn@~OB)kKFO)CaOTg^m@^VQxICgY@-h$V5oz}%vp3Ckm z0@G_r*{>ci#-*7aR)0@hCVs0->#-w%a_b4eix?+s7`?RnmU4X6i-32ww?ONlYEv zum>Ey==x8*I!p|Fu_*TEgLFNOI~fGUbHbPwFiMS=^Pd}!m}8$KgNybQ#gOJ)Fsa&% zsHFgji-Ml7*XOQ3F$viU2Z9R%s2g`xHFJ|Z4N~&f!;++OJTBLz;b~T7l9fx(6}Ah^H}jt)kG0Tiqws$)pk>D-*b`<&3L3F!Xe{J~8c!cQsxR&BND{s7v# z8I)6lhmw1tg9#zC#kr-xfn*vEG{t7qrLoPm(#i6UX)nTmx$TPqHWLtb0k6oZ{%|Qr zQ+>fcv=CK}gx|mSwL>!ca=-DVoi(^#b7grjxYMsxW%1lEQQ-6C|6(M(54sYZw#zCY zb5HYoW+2L`RAA&4@6d?WyWm5((JhCy{u6IJC3oE3cFQ3O;TYO>`wP|I+alr?Y7=f} z(hWDDvel2I zJj)&l`MPKu1QAciuvG2{t+UpQ^+pltXq*0|hm&}IFrwpXH3YM(VrY~!0<6*tpJ7p43dfZn1*GM@DBS7;E zgq|hW=(;J*Uzy@^NPx}pPnduyW;Y@y8T*UqI7a{oZH6*_oIzcU#lEtZO0Oez4xda1 z{c(GfC>zT_4Yd=I?o7fWQe)NzJKU{LsqR`qk0M}p z{;<>@mIc=&Ll6>+`Eb72-E(#~s;$I$%?@Cd{-dPnvf^&ufAV}SDt$M5cnK{&5xrTc252@)F8BB{48RdgdF%by&CcpVR|QFq;C}gGrES9=hp$sM_MJkPYZ8@CXB(Qe`+vI{k@k&9wf#9?*$!{? zY1m5#VrUN_g@)3Ye)nJi`I@2{AMq)};nj?g-D1Na-6swBv7Mc5V_V{BEAg28a&KNq zdc60F6;au?AB{D@%RDz?o<}MBzME%?VX%(Hm7u1?!(65ES!`q!|7sy=)>MUN=QUSs z>R0^zaiN8t*1Q{6-3yY|6dfQg9K6QxD^2HFqt5P8P(|WBW-NQ7`0@!kH_jm4`Hzgi zw;fuQz5p`+$z|TF{p>s&=e`lv>Ka*`q`n^yMW9LRVv<0tRY{Pza4VX0Svfxz|lyVy8}3oc2@ zLDRacrLQ@V;#WO{*)xW{z(v$TlQRsyM@Ebcntp_!IUr{&`wH*Mm(^XiGyOx1X zS8ijp6HPwYX(zhc=!j|@Iz+!W>K`Jl&4?Wm=v#`FL=bktxfg!8LKt<8T zTT!=4CB&hr!UR&E4;JwbGzwq5)Ep_^(4oZvp^XKuj~b9=GUyx*cZjE`H=V| z2HHRC+tn_Ko*resKCJjSuv#YcOS6kwf0cIQ8aj~{udTnv!iT0qATv=2BFt}0UCTlm z?WrPeGbC_zK-Eb0Hc4iO3WB=Gi&p+dPuW%&32Usi>R03HQvRKduT6=2Bm?wm^uv%N z!@3;l%A9m}>BP>>PMdzSx5alaa&}5A3i*8g6D>iz4Bk-(KE~49e*c#QXxyc%p3Gkd zG2LzL`29Eb;Gx?c`8XC^2+z&Q9=BV{Zw4DW;P!SON52Bhxhf^sJk6RlUeMiJF-M#W&v4 zW3b7XY2tuiav=95#MHg%VO7jO6Dg}P=}2^MN5MnZJKn!;tobir_DPreTzecAz7=mf z|NK>|p`2oET%Ld&033Su$ zccBIwh9ZV_1L_f?ARtaj)6p)WF!Uq~JGO|!VD}goS`CVfE)t;t6P<3S7{AT*Gq5~yEc4969m@f70}ft!5I_f1K^x0E8@iaX13vK z_5?xi8UTBCDG~4pMwYQTqPX(KvATtNM^~)%?{6PM9Xs!TsCTCStjYKTvdKc@*DN?IiRwEBRjtgS4t;}uGyQ$K1DCBQ znGZ(8+cq5b)3}3%b8ibW&@QINOQL*l&w0)yJ2q7m1Q?!=+8_8FV3pG5K0@cT8C%eW zjBFK&W16yzAFXuQ3}gYwb@@^90mv6S2%3mwhzRxFcV0)%bJRsf%swajFM3dyMPi2? za@XFh=e?}_k`=t@7kN-6Ce9~zWB8EqQLY9HN}fj92YM}2x{Q3n<6sN^LRU!E9}x?t zna^YFZghSfSgPBMRLx1XcQW*`+~AGRD>@CldZE)dC|kb2KIzRG?hWSI@c6J)yKwb6 zXr@CJRAsf9Pr|u&#Ts)IC+m&`jb2r+Q>54kIhiT+eToD&va9wj7AhhQMwmoQ$O=0j zRhD>HN=vl-;6h!pFyxv~tbgpS$K3X?b0SHd$excp`8^7<4!O+Km-<=}M2c^Ya_Q`U z_!jZX!VF|g6 z@gq&EbqMH9hz>^2-OFKDR^O{LE6Xi@d)xTv;iv3jUniBsOVtl*!`)9{hL+92fz_dg z1k=dYRsL(LT?=}^NNZ}XH6^i;>zoZXawI=YLdNo+M(5ow6@IDl#MqmS3w`oe5}Yn& zk-IqEZT+8I$ zzo@HxIjc6~OO|O<ee==AA+R@k#00tDWP2SSH&aB~ zdBN2|pSOD`5x%m1{}bZbVL#-1SY!-;wQ|#OxUR!M_YH{-2o6|cY*cTV39!ewPmYxa}6zM_1H9i7BmqcA_8D6_({FtsQuU_pHBJ&Jq68<0JtS5J8 zBTY_J88QswZ~C+d z=P*nbu@7Y%_mU75TrmJ?%uR1E)BqYb{6)^V+CDH)M;qIh=L2U={jz zW^W{8Y(gh2rN4}`leKS`QkeD5QU)HlW7ovOZ!Rm&*EuPOQb?Df_q*&_ zGSd4f?;1miG|cZV_co(_c5;&ur2$`@8JRVa zMO{YtPVtqaj&(aVNFh8#kFsUDB-SrDShj0;$-5V~m2!R5Adp2#a~~|>I~UcB&ObM~ zPFt;|cehn~{^cBdrMNGeH8u7rt?Mp)p}A&KA)S+=;Aisrlr??bhlQHW zzL*2qzzXj|U;Uq8`EUsyHua!|J3DZ{3D?WduOfS_p$81&ck6c~+iE`&?2v4C2>LoTn6-_${%0BW-(ky5 zO_|D^AvjPRG-?@ro7|y?P&LnBcZqON_gL&8Iy(W zL)(SaGrjbBpn3G)5uqmgTVEnl*&R5^H;(^Eoz~H77(=!ZG;KL>BcWadpt|_rDX}?K zGRy`~Sa_rVu5R>mHN66Rd2V_ry?bH44x>B{JAOj!#SC(N8U$IquMr7*tLTTFUDVF3 zT_oj-i=Fji6~oH)_1wqsb^Hdk#QKM?LJuQ-nyvTW{l=m}SJNuWBVD8QFr=^l;qzO5T;re&ZlGM__INs`^r0oakl=gw z>Ik431DjvKH{Tv(B>c(ElDI(zyi=tO`e}L{NRnv+d<1Mx2Vh$ar&uSHY5%|kIm5IsEn10q_#$NOG zP`8{uZtor($?|sv0%-JK?xW7KUWR=oow}DRV?R!xG@X;bj{f&*fMw%%>`G-c6VyIN z;!toSTjOmP=qe%pD{q;j2|&q4ZtBnlC#5Cz>T zi@j&LW}{G>`|zm4^f`e;mqY)~=N9@*CKfldb$X7xD8g|W?cseRfD$no?rMc0qIA#C zcTP&*p;q^I^edVzhXeCmi|>l(>>@@5fmUMOjx1kDSuw-Ix4%TC%2chgKTA{8G$uQTiJD8?#jCcPQph}cpcNBU>nyFCv#@K1)T|E4q zclxuP*wk5jidSIBr6b_$ALABg`1os6Rz(St%Ju4pWq%}}bjit~ul-lq(ubmZvvysPG8#G8okVLWsjWszIjhYqW_dEYm>)LSxMpuFOnsNb=OUi94M(h~V29aQ(mqwVg6cM_uhPPw8R{zxlXJ)gfV-C*Xh z_FNAp+B8w(xYmVLzqL@gH|N?Tp-8v=DHXH#$k$ub-oITF|5z=Qcyjc6%dqL_q+rGT z+_j?NEbrn&+9Y=98VJbBWE4%B-b`F+2O7E zl5-n^UK`J7dgS3(5UOUdJ}xx)@oD)Y>CdhiNBCQN*FVfR7!lB_e{ozX=){7@EcDh$W58rv+w(5fDnxtGo!7rbi|(8b+Q9gpC3E<*FX;vzMG)R45?}ytqyD8= zG~(spUXefm3p=kBH#rB_CGS~+xd&yn5#PuV zrwsC-(o@k<#EP^I1bbUMWng>G_3oZ}{+L(4H zS{PA3JS$d@oua;x1DF~i{85&+`Pa<}0Dd^~zgJ=Y3a(+{17JhL5axA5lVXP}$U7_( z?p0(aUcJ6lqV08I6m4e_*tjV2ni8ywQBr=&LiGn*2cmtF=+LS*Q$h<#*Q4ez93;<8qn7~kv4&k&Gfuwz&F!Nh6_jv?T>~#QpT^ZPUNO^t zf288Z=D1JEc7*BfZ+Z(;Mjz2eX!}`eR8#{=R+n|~B3FR)pZG7?=wZPPBzt+E2i-5W zd!hW2{OM;2UOAw6hjGq3+f+t?rfBV5e}Ne9&bG-Obq&4sQ2n$gN8Q?C)ZQXl&s}7C z;exqCO4!u3?O)<_Mx7iwUcHF+p`*OzD9_c~^jAhQTlemor+E_fc7=RI^{I|OGw@C{ zJ01Qe|Ibupd+MV^-$;%nk8d?odmdI1-^o4f<_DG_o*8Wh<7*Ca2phzScotgz10KeE zG5jLuCNav%&p;1fWKK>#{h_rD&r4U;J8Zd=T9BwS=Me#ar*pnCl!=fV8i+~ikScM!~WDt zJNdV&!5GmoRooqsdC8rb^MQY|g|hM{)-muA`axNH#${hxU4U zB5&W!%|!*2^*#-(9!0hBZgv&zrNC?ZK6d=`r}s}t9%^pBC86_Rq*bA{AvL1bYFb?T z=OxmM$gJD+31$2GR}$<8@|td?krHmJ{hasNET2BE?0c3_KHW2q_fITmJHF3*4L8r8 z@Tsh4xt0TAjjrFGW+nPJHXtKPzX&U7=FNfQfm2qHX|v{I3^3fOH<%Dg__8GWQt)bJ zgujf&?Hrxel9q|*cBEFi`F{&YiTra~K*NE6c2<+ePL)%br|XxKylV!-EOyCv*a8` z&2~_Adx<}bhlAH_7XBC9isH$!#&z>J1=6V2bMu3DP49z4bPNCD(wJUyypuasww-@| zeqBh{j3WklEOv|*Om=@;;mqoZ_YOScf5n&MiDndPDCYgkx4(j+XQ|wm?ssKy1r;xf)9V~`K zr+}0^n&w^?lOFQ?=_jq^tfD}o@X#_-Y^kV%zY_=ReWoApCC>|iTk~rP(X6*!b|QYy ztQnhqQlwV=P53kA6yqKS+w}I1jDOFp1znxVL)u#bZJzOk%<3Hg?gZEgtg@Wmm2i^W zCC)x((?G1y_>jjQ>v}ZI6%*xZgFQnu=ijXzf|y=JHRG+Hg^Hp3t*-oKfp-cH?*2Ul zp7ij&v;Eil@5jk>G51Zh@#+jw1!+_-1pc{iy?D{}cRyxea10DxJz}1;gV!ZSews!{?xTcg7rPKcIU7EuN~^-DlTN+So-;v}#t)*^VQgTx-S?9P9F*od||Bl}`1)r+|y`XzaF^*2?!4I)8m;!lZj8 z30rAbu4e1|mBr4~qYH{ojeh(R$kwf?FCL^QGcdt)MI7i7lqcST5+QBUMgX2lA@C13 za~l}Xw5L4*!_7XML&A`)3Bbm3<$d9dJ&=;HRo5Ox<#5^l$;R7I8w%+v%(cSwdlyjd zx0_f=t_CHaWbCZET#AiB_p8CgG6bgaCM=;-eQK1&t`befB79;eJA#FNS>ho z11i=-2~{3!uW$GE4+B-w6SXuHiKU;Y9m#rYmr^_|A6`ANNgGKj*X?OET$d4K7HJGS zF@zqNsuZJUy8^2$g}tfhnd+^8=6fHns7hs2#+cb%2V^R{7JUsJy|mxZMmcoNoIi#*dnfjnNY-Jrjcc zqx~)&D~9K*=%Kp2{|+D0gaai)L+$a<`GCgfETiO@n=9mIFkBeHS68SbSyG@1)nb)Z zq-@9B*?M6?=I5Fbm@4=8#L7iEPTTI8?VYc{gR*^#X^lOa&4LMrC$lZrL1wVvy>i>a zz2nEk@}I5ww;wWjd1WKgt4SVA!a6LDyz>eUf=`C@&h}68Qj&4zqibR~9>q5**7?%+ zKxPYk50)M)biE5_Ja-vB*4JDaD>cO?EVR}CV7?V!`xo4&ChsTh%b^)eN>-eNoAa`Q z^y4eTwDu_c{}iOO`)U#0-5nmbAKM#FTD`a@%fqXamtrnHccd;%#^4#~i*6Gm1`W{@TYH7Ghs?y)vVE{N0rZo?*Xl4?h`!bxZk94l7^|Z8k+** z@0GM2WMtPS7```R@TsJl2{6P@X)H8HY&-Q#$nNxRxC43vuGVJ z*~AJDRhJXBDhN`;L?54z1}vVyUMHUQy%+S9B$Vl)!pyJU`PpGbq}lEVw~=7P8##Q} z(Pmq!t)ms!6A1^{ne<1jj^HOn9p{-PBOF#(`}5)I+A}xI>cZh5GD9$N@Yd_{@~ZDs zgij-QW>zEsLSY)hs>>`exu_qIYKICjjYq75(*W&6{py#l}d0;$CqKRn-05L zPngP?5vfOXLeshdmc1qz|3R^fSF4I}B+h!c$F-%a@hhXco37fRS<5fX=y>uHstecAea=6BOL#slwZjl9RNra+s_<9(sjK5 zeFNbuNQF>AO%HCy|MLEjSGb{L31IY1wilzhrKkm1_BYq^28W8+rWo~~F1zMA!$;5- zVf-`Nk2=(aq9Gm;Rf2R8H{LMI#}8H`#&gJ-~DV;O>ly@hVu3(nA7z!yogG9&rT z%Om)43Qa-lx$VWPH(Qexu1;|uozc8!EO{uNFHPn{OnVD* zOw2})b^&6FUZgdNC4QO{e|^k!TLx>ft=l8pOjkN z>@UNF3oF=Gb59D2A`>|y*hpMQ!N_8#Z@kAu1ED=c#y%bRDaJ#^&X)I8=L0a=P7fu% z@C5$VMr@XePVU5pV>p*P1f3OL#+@f%MLla|PIX@zGZyt)EgZrHw~6iLCb$ghEhE)@ z(2m4vdQ&HqvKHOv}yZ6nR2ZRwT3s3NIRV#aUa7jEMN3%wxJ8fPtvUHwZzU!TdAmB`DI<(_+luD;NblP!u5@HQ_u>_BO>- zlzX*c=bhYe3p{Rn@xw38@?uzE!=%#$L{m^td$uEWG<1$!n(Yu7EucEQI5@bCOp_wR zilCQ#Iq-%0MX|yjDHtQ2_ayRxq5&^@Ienw<_y~fbUDDA?F}476D*jaV-gEu2~sQt>4>v@$Dj~8(G-Sj zF~nj?SZZVyC*nDCOr#-tOHaaqF)w^=9!EU%%G#9Dr8*Sm89rvrY3=ml^*XW2Y>qpw@hEou?(f|U zAyJdfRkzuX14lJrDM3z)e#23&%4`}B>J`vXM82J?N-v>PV0@MGm`V!TTf@bujR$XN($ejw?yEodu5DcTUZW&Dg~ zX=Yv8%`?zgaSyLWTw-tMkJBPD=F@}_vF}nKBB0XefHmPcN@@ohj9#~hLPxBPBv7C# zW=Z6;$<6|+?h}U*7_6s!BeC_910=cd*I{gLWKtEDMK?xYr4n{=wWadGE8Ej4S5<=0 z4N-|>>e<`sYOKF~UkE5ansyXTH-Ic+Ji2rfuOer+oCTNqWrb>dAhkWd>|i;0wbm87 zmvpG{t;7B~xJ=W(w=K7n(N4TLYU8!vOHJxDIs@Rf0X`MB9HNUPA<5Qj&DH*o=(Ah+rd3(`)t9NSHFZEvh?uTi%?e+E#p%Y3ZjSo3J!u67~fO81Ka+-RigZ~Mflb>Gj~$KWT4}>*{V~i53vX> zaiF6_f@`n4eABi87kJF0H}g)uCd&)}Im$ZvA#fv#{vmWP@y8Fpn?$W@=f?kyjBBQ{ zz@1Nc^yI@~;n~vQ`k{mf{+L-$QZwZM^Vic)p`;MO;pNL6M+5-#;gaTjJ@7|#%yIOG z9(*}!Up{eEaWV04K5*egqixt4Wp>P6K#)UX4 z%|tT9xUK`nN*T!|bP!SP;h}fl4wtxy{ysb)2=MFr5Q*W3OtS1;{?0#3AA6G|`OCHI zPr~}M+&+}O-1BXO*m=>+ir&bLNIG@VBpthtBNglvyxiM?sxWtULZTcN!}{ZC z$ut2-vPsO*A7g~x9naG7gCDq|jY~!|6Vd=M=!|k3?Hu~bE}uj;dSk*#`Id)pSD)Q( z*xI=CE*7f+3{@!f$$i1md|arxJwwZq&<@2^ycOW=r%`BfF9hXH53XGlm;o6 zBkIk|aBGaD%dTbKH|((J03Lp=L`pA_b8ox$C;!{o`gT%{mMdq6b98CC{$i@+cpdS; zO_2jC)BW-YnQ}lCx9D9Dd}AYmHPl?a+`sy6$)T6PE_`ZSfa%!t)Ud&&9iMO2P2vz% zNdR8wf+ve!`n&Znt&kx;`B^W-GN*5CBn59|+F8ac5V)zz-OJ9WP@XyC1g zm7&yA<$YrhndQZx@|=()MEJ3an{_v$-+SaLM6~2`7)qDr!z^<8T)YvQCmWvwW_NY7 zRtPu*pKf6USraX0MX|umhCh&I1Mcm^&505p6iiYj{Y-a{_M-j$`6tk&H?YEm(CRl+ zs=}gv?(?>n>dbn*`#|aC?o85;o9wOvh*a*?8ly#Ixrpk0L^^5<9&Q@}dhGI%Tr{B= zTfY7=Ob0VH2OOILgP`-Qy^E*7)-yR#z+x^OyuO@aa#-kQ`^jq|w`xr8$(~2K_>W2s zKg}8QYpRb)WJ|zT`^A`l?e&L5k;{>UcrDlw1T>n;9iJo!eh`f<+M86^lFSMizsv2? zLw(7QvNT8KYsv57y3on|26m?5hI`&qm)s>FYx6fj2ry5N{ifzBn-IL3*AL0Rq%PqU zFbFIlk^aO~2j4Sd!JU}7VurfFV3UnR_{{U(?RGUaKJ1V*1aB@%X3K+VQoN%P5BDAK zXFf!j6O+>yZXv%iNTBrZoOFfznJlr4?f^e)t^sR`+~~bj?5QNg`DRmY?4~GcUtNKL z&f@kr$xfRO$b{t`HGoQoyg`0P5QC980&9sx$ z^?H9>xwGCC9+EojTeoN_NbBDf9=~lDb-7mqeazwrHcHfX&TbCMs+Uq8gE60<; z^y=F4DsF)9PR*d}zb)~g*$I1n0wts+AU4Hkm*dy$QWw~LtLFru9fjtH%~^y-tKb;_ zQ;8eg)D8ilL(KP~NSyj;L-RCtar@4ZV^xZuF#GIr6Hg)1ZsoGo?e%8C_^rb$i~Q~# zZnj$SgB!C>4SQM3`D?0i>l^UKY)U=a+r13>Iq}HXz^3hC6f#ufIN5=s!p%loc?k5-a_q@0;NJ*!rUmJN^xO`6oTRU+i_B;;?&AMNfUi-ZzkJ z(Vo1c&(}5K1vp4q$l4DRR7gf+br^q**NNz9H|}>a;kJ{lkP7x1n#QMBZqyPz7et;$ zx#?gDeFd!pBIkHJB?;+WKYFQ=c4+gb{{{}z`+On8v`B<;&gY$f*+a&$wkxQ^X|E7| zk9``;xn> zNvyXPm{~TNjftIuSff8Cc;YNnXxG~mv~syPQ<O?9fG^t<=f9W zcb~uO|6H@?7*%hyVnN{(zWVgcztj*R2;Ei{j;_(7g7-|3BWdiagHpDm7=Ff^V zssMTP=&?XX+k(Ny#AA|Jfrn&HS-zIA9H}!MIR3rOCmUrNTUtS6RKD;P& zTQH%*M8NuC>-|B|pNW$Qx^DgFWTTIWWnLkfooQe(>@?mvoqIWs(_llhI4L7C+8y@3 z50$fsHxi!y8tFUcpw6y#sChouK3sVo#Mv>-B{G2|vgU)zDbT)j4p|`T;9D zORgp)7|xwZ`N!Z|2+_QPXf;ch3i{&lA5_6|%4m6d+&OFP@xQM6x&Y4%LK4|7&h4F4 z7$}O^_HaBfC62RXww#tD8Y2acuMN}S-uX$6mwzw1@P*Px!fDL@#77`YzgBpkRhQ)4 zXCiShO^9;cZHc<%f3x-eAu@tJ?3Bw*ulrX{6}TN0vy~ z!v0pFte3@|vYp!O=k$l8+XV+NceJi+dz3C>uY=R%e!I8pjS%A~AsIoKPJetb)nJU^ z+izo~Dp&r!SLK(B;Kl)~aS@Ry5lii)-a1|@Ie%)sXmrL24RPlrU#zbCn;FH>aF!0T zjw^J7a8~cb^KC+&4HVjw9q=dO%d+g3#D{;96;XS#xJ6RIXw6lBRD-XG9oZMO5Yo^f zDrXaIv#{}C>Cp1e4*MEaQp-p+wV`6oQ9^eq59J$AW4xzzPMiC$K3)&sNQZYe$`cx4 z36>ZHxmo_@IdWs4y7#Tfm}`Cq*t8Z@-9WO|1WJy}>)>}gr_T}%7^-1G2f19O#16O@ zw>_r3IIZ_&5q|ubi}fVd?`^-@mWfj^4iB+kRhPkEOjfD_c~~IC^3&322J1QiZY=1@ zc@82yW&z`$?`OQZE@n5;Hc{)B#PlS_7!Isc!r;LmzUunuMFC!Mup=ath_XiDvsLH{ zd*w}OT)5mt)oZLRXJKv`cMHNVG$#zhqKr!WzlA_q2=m8Ms?RUNVc#vm$E~OK4fFRH zRyc81Na@4;kNbdI<245Rraozw>T8*5rg@%Ayu58^HHB0@a(y1z7X`%C7WV>P*u66( zua*rn+0T>mw%XtoVgZn;mXCe@`60Ro9gbLP%iWkpA9JyxP2Ah^xCOw^u%Gwe2B_N< zY8~YpK+%?tqh~hAL3Jw47{azqjAXx(Zdk7ShHcMSR0X*leqd^xcmmZb#iC>(eLhkD z9Y6~k6eO`7LK$TqVyfgE)K~vI|Acd&Y%clic48zM$oWNUE|*gOk$TZwaUg7k>NcWakA1kbjx8#h^gIQTv#Hfwl8S3Z(NJb7o2x5RD$~U7|B|N zckaJ6ztaW;pE@kl7xhg^661r`ybV^p7xai;-vd)b3{pLe3V{=Y&cDYo!7vQ$GDYzl5~;zsI&aV+RKP2o#nN5P)Sl=B zQF*T9cgv{X_RinJwW^KiEpQZ;HFyi)$tJ0jv(VW*jaTn_1$IIk|3>X-Fkwp5<|T-u z$uP)#`pzF<{+);Ht|>A2@bEMQ)Nx%7?rrRMI_B;{Y=yO5tKDfo_r}fWO&)MG`5f-Y zFfapaCh6#stYQk|`D*fqKK8aHxmVWB?*}T|klSt&4wsFpbasr5<5e7bSF)Px_XdTp zZ4e&2=2ZTz6xRmzJwJ*8HyHOpqM5s5uA?}Nsz23K0M+@`U(l+~u!NsDk@jBLiL z+~_2f1~5f;K$hPYju9(Q;`*Fqky}(|DpL&^rWHtfYX)Dd4a7cfRU^NA=vTf_D)_ur z&B^SyIV7_R3MpXfoJ|C?cX>c{m8aw={t8C>O)p8*ZMa==f`bOz&6h8GUWII`SQ_KziYzCq_31NMgG~jjbx`I}P--+% zygNcWDHf5^)L&Qh*(2GzJm;}Q0&|q4sL`Qx1IZi2JE-ZTX-@;(zJ?Mjmx5V z%bMgVL2ceT+TDfJp9G_bu5kMD+~Ru2*mvqGk<+f?0i|J!L=!MxW6v;-HZY-}Yt&CM zr=k^=JF9fYwNG;}&N?yb*5BCw8dh;(tz!4de@0Bg0QE~nR3qlA@G_}bhnxPRP`IXu zVT7-k*dKD}^uT$LzeIU(;FOOQ9=^W45ra3P%l9)p?+HY%J;}2tKt?E%LcWsbz|R6a z{2kkphO!zzWoCU&yhdbwjY&w_-+K zRjhUV;{W5FAyd5c^FFPKs|Rnu+BY#Xou_s!E#4#c<`m(k(ukom(zE4IrJ1MgHNo!g zaQQzYe--P0TV{i_S?>QU=s*4lW-?IC<}0vfsencY&EH@72u^?3>xPD#ungxnGkw>J zsmhUJN2ZHW3F)F+H*K&ISC(T0Y`}!gK^pDgicLSGUgTaO(r(Aw%eI){B8-Z27}`pL zM2M=cbEC!2ur?!ByQ5>?yi4fYcMli>Qs zIy@GlW2?qnru&f4|7FB^=3pZ5ihY2DwDV%UZ2L}tG-M!4i}-%c*H_o4|9CruS`vEn z4=?hk@6FK^PML%Gr$C$a7H@3xJ5k^$Jv5rz?t zvBp2h^pzm;U7flNI2VB#^wexS`*M);@|Oo2b!ZlTgs2OOOn@jJhzCqqBMDB5kHY(a z^hG?(76}JsY|Gns-Sr>qgMMbX%pXpn53)xI{t!FSwT{bjVF|gc<+iLy4sRkxJ6Pqb z@&;HZ*OfbQBNvY-H>L3WHAoJN$?}GCAOftvhS>2Mu@7%90?aW*YbuH{SHg5Xf$TZr zOB&1rwxTs->D&$*iN_XVczh2Dt*s_QasQ4~&)CwD>NZYWgNiA8fp?f@chocXThb)g zzw#?pRGZ9Uxn$B=bM&DEsFI8{xq#LY2!fNrfCqkn%d^fF8tDo?Gr(0f185jRMlg;v zNxP<|%r!_gunh|+N0$r(g7J#l!|i7s@>JyZtGEIkm(mCxSw&;0M^(N`@(qDb;3o5x z8(eS2&>-qr%sx)%Topu71f63rpPR4-s|+6gCIcbcRy3H0cRN6m#LkGy*c9Ef{)ANo zo5P8^7yVtfP*p;rHsZyVN)Fb;N-s<%kVl_WlH|L8o?D`7TiEqSPbjJa{4SO{8rA4<}5h68V_b;7X8J;QddEcW=N>dTU8>)#j6`;V)A9bv=T zrR(6e-`I@>a?dq0m3S`U_>IRuwf_a~1oPcF$6HrFO#Dkydjebi#s|2``9Jl}*dBCz zHTVCk_b4E+rF`dV)5wuRm!{P*oMto*(*3g>S`oO)xXs)5)AJ}A&W??S#I$pQ@WrF2)8A5;@4_JdJ#w-SZ5B&wzPj#Uy+ z(%(#kvZTBy)t=S66wb*PK&$Y?GHcpYSVx_X^H5gN@D9_%!%_~OxKJ36BPNTMQ8 z#V`SM&DyXMyS95*P0gaR$V4N<_?iAA+GHGJv>bX^gR$BZ#PL>QEM=mbUn^=906@M_ z)}{-8UYxFm)`NdqRhyt~kk2vtcBo`_Sfw7wIK%0V&*71fl^lsLOZ|!yXC#>wa)x?2 z32n9W;Wnexc;8;xK7pkbGuy?|(ZnDcK40Y{_*k*BEqK$J3DAxU-#brRQ%80@Bu0Ca zxt@~*(X2_2IDlu^v0CU!XR6|}JPRX8D#tmD(}P;1#y6)&8CJ6YvHVlHtSVu%AR49`gi-L9zQ-e{HReWM&jGcO$FU{r!*i@JqvmJG( zaTSJtMP*OXK}f$I~i<);zS_Gw5b9JiO@TRop=)~||nrxdejp?=`k7R;Fk>}Zl{ z;WqJG+jNrQ@KiEfixu*i`vOBwA5j@M;apowof#lS}%@ z11J2Y0B|zVk$a8FEXwn7l}yE30EOPrta|J*v+kak#C=L@nrp+mA)8C?kRviVsPjf8 z(Bkf&6ZX8Pi-m7hbq-&}s}NzdO(UPJJ~7NRSC3ky#llN&>mex}`m?O+k=k1U{^3gV zKg^j&DUY<2Iwl%b8-*6f!KSpCRM&@Ul9TX63!nLlqq0QL|BOABd7_Us?aMNH$&LSy z$|s`VylH~n>=Q3v6}3!b)phAWPCxu+A6QcBWVk;^9l>G>lnr@t5@RUJlPuOz`thaO zNk?A~%+SM#$)uw9oA4V;PpF*mDoNL}J2+i-;O_eb^2B$6O_mciFi)Q;0f1*mE_VRd zZL223{F|Q^eE2^FoP7YVjW;y=GCzT==fQvsuky3nq=bjU8SSR7RUmR1^sM{DqU~9T zZI?b-WhU>B(CgB&b;4-DHy9)24(tWr(kt;1 z(dAu<{Fiv3+Rz7aGIEgHaPt?@b#3n3DkE53nfs7g+5ppzl zyuEMdO{+oN$pQED8QZUQb2sYLGiLAE@MS6cRb240Z|AZC)GnmJ|EL9?5Edm7MHPKo zhXtT(r`MtXV~imOus~-y2JGe3<-g>!`hMXI&vEX8XrZmq1&KxR88@GIJb%uvVq|H% zs1F&`0;|wRiR3v~;x09P8|>A+Uv-+yVQ#jG=65tDYPW<1-*X&&!Y{DjaG_@jK&jNe zw*C)?;PAMY+>IZ>QScXc_fzj!BfNr?A4#O?VX!gia=ZV7hdk_X;_y8@B0eY=-W3(N z-vq|}-P0-5f17igzIA;+_pI8bJAhikB3~+N$+wsw3tm8_;juK=s^g>!K|uLk`yF{( zTw+N{MG#v5)9$8Q_bj%mp2nx*+Abb`LlW2-2wb#F_ENt!H`uplEMZexG?@~Z{O8`hT?N&H(oQHSn zTq&vtwKlBa$#*F028llrsrz&WtTP7ZKcbR*n3}KH-WWfOVg`H?pNOR4!Cb)~skKmE zO}Ml|5Egfw8g}_e&Ho9kab`zLiFPX` zY`5+Io%C$D4~2hUB-YO#^}nw33kg*iCT<)E&BiGWM8Kznl{&kAE9` z6WB0$J^u(YN*tcbG9bL($~}p>4uvfj&5(Q(XjxV*S)vNF(+Y#$>`H~_MIObYT$MZ+ zkM1Zy-Y(_~H&#}ZbgrG0Eco$PyOk#EZA!J;@Qff z+F(2o7)nx#P(Qi3e>gcU?4d<4?g1ASdaW!`d>*ilp742!d@(HfaeVMb7z(xr8qKki z;XPy_q&k~!KDND23CYdo-9{$wm)ta|b&^v{`U%x_Ad4iI(9wH6rn_{hTvDfsz5>;x|VW za8Qkx!{_g1SaF9OD+z&?rpNxrlQ>#HQF=4nA73$!%oyHYSl>8Eyq)EBAJSx%lmac=L=TeIE+ty>*yn7&u%@7`Wl@!28qib8(e06b_V&YsVwdiGDYYi&Xu7lH4v zN^SJ(4-g)j2MWAdihEw0BKtS;?AkKa)YkBwkb;roqUJWvL>Jf+FIAa3>@@{}VDo3k zrfU{najJybn&srXLSRy*jOs&WL2x7;p-KRnN~F&;#Q}X?psR5NvaNkxb2oJ5BaHDh zoy@{A|KS21vmAi9Q46VS82_&zRA};z8%O13uQ*A6W5hzJ8XxI zQioXhm5o=H7OI=aW(_BA5^;SlL8OdHyPvFy`~ZPPvJPz5Ai3iQ0d@{EbNl#7h|i&% zE@A40Sn}O18t;_QX3KrTipGyNxA3o`so46JrBae(<1JFiun>WHXlj2x8@EO1u5|fF zw`slJidKX`M18&l;!vFur!OI%Z8auey-lH6vGZG41+Cf~v^U-kj7(J3?VlbGmI<^i z{PLy$7xAG~d_JiyCAgy%L^&;Xi2`m7b29%~D=%)NEpbIV;H-$g!GwW}aCYa}Rcnk0 zJ2-l{APd%HN6o_0_V@p?V*45D4@Cozgt4Yu@By`i*M~6;UmL1fHgj~6IzIJnsO^$Q z$m+VbNc0aVPo8JF(U4aC9|`hlg5a(N$&)F!#hSJ3p&_HW$ux+?Ph~rm`*GE+QQ_Js zqjrLKY53yCbGc35Cflc|KHG>T!LjJH36(Rkh*GLnCNB-Q&~tCX6TfJNpHqJ?{MmVf z)mta^_DDk&0~r?wVFz0)?Im3VAguC*RL9eswHHAyE|A(_uf zqb9lYPT(MC)COM_t$(*^HYfbCI$GUz21K!LB`28h`-treESl4QFO{GAelB-b|3ioT zm_A(OfoHaLY1zbBHY*IvFNfq(B%O?eF@V#g@<+w&K5gdtjZmh=f>u>{rkMNK(DVeUrtN zgcZ$*ym5LTjXt`wfUnh)X*m%}_53mEk+j$pzC@;^7A$3I3qKq^9R)xBU{A zL2ThKK06B{*p;5Afl~_s4NuaC6(=ePl$(lPe~sKMxEo5L(*s&bcvt;&b>AC$hnNj{ z&@0x~X2-JM4n)FtqB`lXLDTdDeWWjMoia8zuUrk%ynWBl&zMrxJ_$?wz@qyik=JIo zyVQg2*kBUq2OmMTGCY|IJ`A{NpQ^#|bH78s&(R2rev4oPgbkf+|6eY||^oXG`-MAeEDlJA`PDW7&NX;Y-RAoQ9o)VOpvYixYN&`tSFCf#^Y zDscEb^(|Xui7VbLHHGEy1AbV1h8`-5E#z6&E9x5c`{(_`Irk{CL~~BUY9iX=BKkta zOw2sg#5HNxTFX%Ga?hppY8Fr*#Y;A_ZNJTk&cPC=8D7<+*0%sWa!q0nHBodbKVhK7 z9Y~x*v=TyHRqzk)kU6*#%u=m5GvNk_DVrK7321gY01_b2_SU1(eOcPX;BMREhyBax zTW5Y;%8sMyUUJkxVSN2+=xlkXDe`VjAG7@p@7SEhLPms+Ldcr2pkCutnYBTm<#>6( zg0_?WdoD2zl<6~-&3DBH*p&!x?llV@#Jac!8+JDv<+n9T0?_sXndfmE^ehs~C3VM(8x3-lCPh;A=mZw(HD- zc@ZoKA3KE+J6&SQp8m!pKx#@E@3kpa<$qFiKHONv64BZ6CoX^gcY^tml<}eK`b`9& z)@%$M2$yz%635`O?`GEO>cb~NX8EJAzZP0buWJZIy`!889}M85J3Ry+7dyF`o%q}x zCUmbLfzEm3ZE*XCOUD8^w)CbgKa4$4yeZITTIiV1t}zHuhGgM*Q2+2je(^*^f$>d| z{T%)Tn@C9kp^M9#3I3dxd)pmqRdC@19GH83mZ5WC7sU!~!sD$zB0uDNgZFN`foh_m za|x3G0sEd>l->O!09H8s^N2PM*&9xClucMVVAK1g zns(dQ>&$L@W#ifP1b-Ft1E~1*rAN8i_SETekM;fAUoi9|CFvts_-l{QyruW&0cA-R z=;G7JQ@~-FW@XflqOO7s9dr%+*__i(im^ujY2(Ick+##jrl;QX=&beJF}=56=#AN+ zb?p#6Ug3`0fb)T|jTfH}+BLnyLZ(OrtM_Giwd-1~!{IS&RP^gr@XpnUe)IzzRzFlu z$=~u!*u2%hb6@R$`AIfR6Pb6K8)t-=NSqvOZh}>sO-CjcL z9q!xFfgi)re(;PFZgD8dp5*LK;gk(geNg<;ywo)D=~{JWWJpoAKH-Abp4DPc`Pxzd zkpY-#-mm#Cux5DQrs$MO^l)m`-CliXo&h(Z&aiqk^^`&gnk7_B-CmV>S4m+(+^s@?@f-u<0y_{EHT2@=GPyOS<|*N7NYh5 z>-8<%iSOh#<@Ip#@eux>iiYRUfG}sK(~-rdO40y@bjWpwgWU5Xk59(kWwc&sY3XI^ zccjTO&))JassSfQm|u%Vhm|>6P-#k%Lo|j+YknI3ZT=RC$`JwSp%6ye%8jqb5_>is zniQ;~R*vexAbN#gQ@Mddw`EfB#~QH&*q>-^bM0XFHBP%)9gZrwSyhqPD)`3f zeGLkH;xodOL-V~$ETi3*gXi(K{n;6!db$Z=ZeeN&Q7cq%IFng9dmLM}K%TB2(HcRVtSwa5ya@%jOap6aT> z6#WfL8-MJ&f3aD!cs*dE%?6vL24KR)Boc=`InE&Z*kG@*gY0!iR~p#ixP>vjkF%qq zP|J+nPF2~zv;~9;Zoz17u3liYq+b^`XkPH|U?3@X@EPYaY8- z{g-~I|*(JiFS$=C7$QrWE~!B3tJ~9fBcMS zq2gVe0{6g#K`WfN_X&Y>2(E*0f$1}W3E=JYjTea9^UAuvIjpGoKklEYIe&EZ-Nt!; zK!FCfG};c6bapmgrbx-(?+L5zxBMR#E4`TB9-`lQ-)4NDW*#Pkg;4-(*o{z=rL$w= znHk0qdPA4dQp%m*JJF#ZH+NqqXq~t>1R4M* z7?U?FnOWx(uAUbQ*;ml2%YfeHLiVHe%bxE$%4(TnpA}TA$lGPv7K{%x83&OGcop;a z;U-?eKt{=+?t}an-r*YEq*E}i!gGq{pQh+u*_tX6p~AmRa(i1@u1~4plMfEeA3`$6q5|Gt|!Y7UUB7Ry#Vx{$U@ z*37>8-*ydlnk$*rf+xdPUKG~arjgn><<|Wv(b9U2G5T0zusus^K_r9-OI5jSsMOJ8 zZZ#h6CLl=~cZp>XpO&mi^YfBucCd-~V_Ia?o28JUHdK9Btn!pG;cJVFzf~N!jF&s& zH8)&3%uYlE9+De{p~~FINb)YWy+aof2T4dRKMj2cMK(UI1k}4Lr)|iD+|;-Zh6z)S zB}Dr0a1pVJhOOuNH<-K-s7IX)$lE;oO!xUDe*+;0rRtF!RJm!|VDS_P9q~#DmC`1A zT$mL7Y#o2d%~a;-vB1@-Ie}W~+03)@MMU!wtMzalV&#;{Bf{gwJw5R&z=p+xf)Pdu^1iEYMCOjiZ@1I~~YLjKxzlboCx>w6Wm zoz3C>L||00yfRr7b6sZ{uSBqvj6jARiEPYLm?EGMo3s(PA9;Uck09bA!Vi->C#L@e zYtZ(sl-@>f^8XpcaO8+WDQxB%0awRmY6Bj={6hPy2B@P32dw#>DjTBmb22-BS({6@uHtTVL zQ`P2v%f4~BB%W)LZG$co<XPi7@j|9c9NEv%`OiMKk|1T=m|d1dnHjN|Ji=uD|=;L$Y6j--U#4OBDMG zlJyY|E~W-=^rUrJ&We#m;Z4VAB=sO{A3TCF$^G-gzIhDLx`UnI+oEOMKd`4WuPJ=C z^VQHG+F4YlfGed3_{nf8Sym#985GVDXz;x3WZXafSnWLnY1)Gj8skzBtlvg~`bgj2 z&ih*dB|0%n$XH@ez_rMJB9}O1S}1t{T(Uf8@=Wvo{grOl=aQQl9>;S!GgZoqs~{fT zEW@_0;r()f&0TM@yRK>hyEEXCiXlua>14k=02kuV_}Wf)l84&zXHuqV9VSdM_*!RA zj|Gm9D4J$ki|H4;wsniMT-E0%I!XHo*Ls@+TTy*chvia0r3KDR4xsVGb5?q9`r?A2 zb;_dvwg9Kj<@zHd;TUA`V=3fwlg)u66J5H(^kmWrsm&*}&7`3U2yF5b%;vM2qWi#D zpbupr$_Ls*u+6HA{i~8v7$Scmg)AhToELt0>B^czm~UnzwSqrn%I%139lB0YKS%B(9;> z^GI3I!WM?s_HP6&zgZRKJ5#}b(oiZt>_{LELn`+nQvtCKv!`YN=8n9-UKD-=`6P~= zv~S5rwf5rKelej$SW66{7GJx*EeG{Qc;;Q$>|k9^@{TGGt*XQ)?R=4bt^_uS>a+$| z@CFRj1JYok{(LHE%Co$z;XVyRsH>V0B#L}`({ILlAixLzsg61UU^To;3*mOX8Ca|$ zO~>nr^x7?90sLsP7OMT?#K+w_Bq5x+v&dSw`g@aVMve6Gv`A<4Cj)oa+{9e4Ko={8 zsGgZm4^o7kx4%7MJ(y z%>tTw9#*kR=z;(DcVhpbM21f^T7jtwV1dH=H6ynTRiWEdqm>|g_)!|wp6A_K`n>M$ zA#!k6x{mx+syLvIhV}ol0Fc#TzJgH^cJKs3F$Ww@g0th3O?HKzUt`-$BB*w#@$F3d zN_rJg@Yqt;!$lDyN^+&h{5+al+B4Qip1t;;PMv%jW$tBwiS6S{o$dEWRuwf1FBQ%E zai*sx80#ayJAGXRTZ)46Y@B^>qE4gzyjzXI(48JJK!@O z4(R+i47_kD*6wY{r_HmL3cr6zq2wnNS#!sX*G6eorF~*Pj;;!C2^xOvsp3e+No_7U zvMz?#G<{&rg6~6AC=OPHn7-f;1;EOBM^@7oB;5$6>(mP5EhPMM$=cUaPq=fx@li0& zyW4FhRgnUK%}&hO(`T_$E_I3mGUh zGV%hZbz64hxx^G%peKFnX@tiH?6;r}?agX4aZ)SOgCm{lS=_=TUF z1^CoXx*u+eIuLlhg&7E9NTAJcU|iAfE5Rd3G(8kqQB*`R%1m?{ZNY&XMfTX{=gTjqa^evF+ywP z>+5xBNBZdgqhg)XU*VHF_eW-xiMgjFeWv0f3LN(hTaGIE5Q7^y=?j(Ui(11#ya}8` zn2D0kU=nYNH<?Fk4 zqA5vFeN~rc4UveZWZFS+>H2_h5w_AaVz4d%8(e|73e&fNuTE4k6-x?f)arEczQ7Kd zUPZ`tG#~mM$6y zr}2;(0HWJQaTzwQ!m+|-D_%O8@pGmrlea+jjU#JcN(-wPfL*4h+Me9Fzkyk1lgAwA zGv=V3&$0g~|mT5+5Y5{IEYOKlI*#-K)7Wa zsQCRh>$@62K#6WvruK#R411Wc_45>ZvE0mTc@u7{^KMZp_n1wwW97Ms9a2tiX=C*F z$1`Mq$4?BH_@#+=Gt*<;LB*Xa^%xBwPP}2UBH>95`{FL|PEHHIcpsanAgA?2Q z7L2-TDFZYqW}6_B)NB`MND_BhDFSX-;;@Z)W4p1WsbgwhEV@cp+9h|V1L`MrMtBqd z1ny?h71$TkGxo9WRv{tr?7BR!dS1a1UdoH(mm#Iv6C}s1g|x%?+{=RS$DKefna&;_ zV{gVsjV`TEnw=;X5qdt=sm3)<0|FIIkL|Sf7#NC3m~3Wl!t!eaS&B#V4xM;(O3-br zK|e~bwf--Dnw1`Dkbs2?jP|JD_l7fJ`jA813^qiw3tc`{4VsYlWjHQ{59vesK}r&r=SCBT53f!T+m}N zP(+cZ3H1QcG9jbT89+I(HO~HT!TjB@Rjvi9^Kd{)dwSz{9uM*@BL5}96S%FPF=A!L zIi2vI?D)CKyzj<4UkmXvwIZI++Iij+!ol#bHErJ!DhmeFM<@%nRx(MLUS$L$XMVXc%t6r~SJB44v@udQZ zqZl!P(xB(R5+y&OQi>YR!|c4STZ@wx@fOzXnLR+k01&O=y6OIpoy!4I$(noNo36V7 z_k+yzU=RA#3>qjviU8nImbD#=ewA>${rs8CBcSsmHs|Wzc2~bZ7W;!L0oJ8F*!E@} zk&6mbi^5MaEl|Sdvdqr+o38JzX-o^MbbGmbN=7g<`9c8c6*6W58SL~|;JH6>^H}V~ z(aG_@f7BBH{QiVxL;ij1R6M`7pkNsPZfXsrIO3vdob(~LZNEjmoU8QabUj%nX$75! zzTafOI|;rFe!B$uUZ3Yo8+*%)BKpfyEIn`LMfdwYpZgMIzsw#OdtitbH1d4(GrIg+ zB8JH)Hbr($T!_0rAy;Q-LcC?x)2kB&Ny)&G;^7xCBWzDPnMVlsQ1(+M3kN= zoG|mvwLuKVP7@R9f~Iz!5oKF3=D45KokNcE!AWG7WzwK3hDr=1n|sb|g{{)f&(;7` zt|ci^xBTUiY?XjbRMVgA3}w)0>hx*c0OP6o<^vz9Cs$|+EBDc zHN#Sj1673xOuj(w+2hZ-EPM2~Ygk83BxThChv|meh%Deji@zJx#9@){f7ar%!$|g6 z`YqDQlt&!IL|oPm6i`=T>=I)d((caIk_E)`E8Uf_1Ey!aBNU;b1KgGJk6c=c36BdH ztYEL6^q1Th)E-OL%U z>`DnPsrkm&N-}=wwz}6KBvNSHb8DM$v zU)0`y>(0=a(90F8u&BWoH!1j_qw(exKdA`zDFaa> zb>SRh5W0Yh3e{~9U-rH~bL9HCe#*SQ8uxd(T#28b;V26pHlg@`3MOT=aZa&LEAP)p z0oY*DgEhnt3Yn)G_VObXyI5|CFf@7i9fIvaBX1RJ0^1RsJpJb{0iA^JM+Pq`O4CK7L4_tYTO)-4|Ir=IU#H%Z z?)Jyoa=n0$^F(_!qIVO=#o!oq?ahMk>sZrHxIt*-F;9OPtGCO}u15+@K|T~Le+%!D z&o6>{Xz0r*(8nI?25^qsB(`*l#-Yr7PMxzJ;G{YCe0 zfogT-N7%8@P!eI`KZi(D6=Q_5<(AtR&s@SFcTI z(nvd>>t~1kL$m$>bm33!3GO_jH*R0ue46ziLiFiRpRa1#=aS3E)V-nua}J zP;g-Lnk6M?Gv}Ejc+YIp*%Zk=j-F7Ql8_Z+9(FO&?hRCS{n>Pvd7T2OL{~_m-7vnY zh*+Z(k={a+Wc?;N5`)C+nseeqU~qjCXimSTIXhct^kd+#*Hp-$09!`@6o;uk4wrjN z_#^E^_l|0j-;*|??+p2(lY;a5#mczeqc|gFv!!K2=*x8%Eq0bPO6lK**FY8-D#;Jn zbu#vut+7%gt`M}_5KrbW5Ul~?0bBGlwJ;EguMB@wwbS=a%|qRR16Ke8`Wz7v(dfCf zh`^5)D8Kq-h5deOb(i!ytAwIl|j<_bbvvPFDs#x~!hfz22M*{=~P4{^f_lEmz*?HuY{`yJyG8?c`z! zSxFkE@I&s52=Z^MlU@gJ#|fsyDt9!uFCdT=`k-{YGD zo(>X!pBk>`-gK(G0Q0!>eyJ`e?o^rnYJ@o(XC(^9N!dWyMcR(DQd7{wdEd=$V^k2f zVB6_aZP?(zLAHh8d$nzQUOP7}!uB}E?+m*U0m7M#J7OC%{>mtQ`Z>MqZgq&Psv4hv z*nZ+4#Ri!3^pn0$iTsLvsnZ=T?4oAqX=(0$RC>%JQt6TiyDk53o@^%hk+Jc1 zy(#;)@P7=sA0Iz(YqUE}YAAZOMKD(>T#TXho8L(!#DrRnG-W<^s7@s|!XB|Ex~=Dz zT8+oBN@QmQxo@MWR~Z*%NHh;TnFq~=iFNopFh2Pe+|~Vqy$Wf zyxIBU6lGnq8jlwpLqN=crmE3-mco`e* z#U=a_tJv316w+WZ@?+M}d7xdy8^Cr&$;MNDS-7%}aggc6fc;3%#5FXil zF+}91{;R(p$qH$iWkAopyh-7V6mMtyFJ^0yN)fsIhFKkU(n!>o1m2&m=2BA znkM<|SJ3_ffCdg)wujn{*@cfA)EXeP=6PrasKUzH)1~|vfI;zmg#rWQ^H7Px?Bs=L z8^eyNVwC~g>6%IKR#CC_R(+t)i7BHNP$}lB3w@}sk)32wS2ZvMHPvS^w*_T@r3*N~ z^}Z}adC(3{H6R#$eef-r(w7qMVubw)GOm~szsAm z>ADQy%>6To;&6OXffv*$9DYZd)AVSteJUTeO!1-4V zqOP-hq5E^#txi(0H13}*ukT?wUH-X|e0Jja3pYD<>)lBnYn^iRDdI(G)(bX#NYY{Y-~kP552s3TiAdEAM6H56-AFo{!xQBj1u*LF z18ddbAxvCLqz9UYJpCiqx2ve8{TA5|0WdM*p5X4j*$sV3`+nV9ZL@+EKHZ=U>dm=N zay_1G>wAcSoU6^(?$tx&dj)y3_z@C?b4YRBe@u;ybd*1obv`-hdR-bgfIr{>912&8 zSXr`@%iLH7FWaw7a=sKK?l*ufsr1lD`q4#hVyi_zWrD);j{K3{njyhm-0l~3cW2GT zuP--#(3f^^W4@uj&vx%@PZMJOIM>Q`8pz~D!%RB@%JH`dnX>P!)l#4h#zxG@Ry0l3 z&4RB`k~#kqFZvH6_di|I6YQ{Qv^kOy1mhH`>NJIkRIxgMK;>nC4FBRhH*X71(4C#6 zKS=X$8d0cizSJ+iL$|D&xPiJRm}kJ)mz9Wx9=%xXg&e-hYV~z%dHkJjs2`D;vK5QrXq zRXk}?vbrqfY3GJWK(=4cpQSz;suj1lf=Lc?nx_(Go6nxgjC!BGs7d}rgLO2)Fr|a_ zh)-wuOj_-ZC5w4u$*u7>IbuOs4*R=ZaA30bOu|N@=MQcl=NW@N$zzH9e#GUj3MkPr z<@fFDOrkir$DIgO9!RUtd85(xMl{4*#52aV8^`QuzCS|SoVVRK<8<6x>MJyYQ}HrN zT*pG^{?Wsnfj2T(4(e~>q%1@|j9OId-=^KrXGOt9JDeZSM(2Lw`Tl0cU$eBp$s%-_ zC{3ajmaxOfr^}LWCsx!fBX?IEfp7(`dWM$_u9IBSdyDzgu*(c+DA0mCl3|EHXuL7? zbA*x`A|j~XP{`G*t(15yCekl)RX^TF1`+qu!7ym?NMO&}=S;&ME;K-0^?HTfRreVcg(ERd@ocjT zSICWUJVa6vhksuk$MZ%*H<$Iqo!iHYhVWiY-2lqg#D5$7e@y)aS6p2eZi^Nc0t85K zhXi+b4-nkl-6`C)fZ*=#7TjHf26qV#6`aCdPrdux@9y&#R%>&OImZ}J@9LU+H4Jm_ zb7?&!=t3`8TQds7-*6r_riOT07WxYXf$Axg_^jaWz3a!BJBxL*U;l#7L1(Gclo=3y z^!%uR?7JQu{sW;KiLvdVD2{UZ|NI}*r2nlkKNbOrUH-2Qgoh0w{nG)5W~f@Rv=C@M z%mrf#zSlv)(L?hSWDUpf`Cj7SpBhQ#{#_rM>j-T^W@4A`&w{IB|w-ocMOx|WYJ%2k8gdzHz1i1)JfZGR2i`*tt8obREW$N^%JPPuj3R&V@ut3M$v^cuP~eLh)@07=m70er;$b|7Ex_OA=r@tcZ%t%QJv%w?NhE5@udg*4AYQq;yA&fgN0-tF1q zLGL87X$Uqf+g(Nsn0G6qhiMpCX-}=CeU~aCGqnJE_pl{AOJ&*u+*J*kr8xxz0D>(C zQt*r`!tazwciCp$6kIK`qiw=E>w%}0I(uT3+~ZcPDi|!|t_D&X{W8`bm|`(?%x#== zWP0iR*|_fm4+hQW$O{$gbkE0v16*OYH;}Q{gMij^69%}ri~v!6HiIW-(^`~Bz`qO+ zqOLTh=sBEt`tm@*k6x>f#0-g@AUP(ZQeAS!V2-g3IrK)SU$k%WAjE~+zeY$jF1Rz8 zea%z3p1Toh;QSr~Fhk zda>MC!)H6n6<{d(Crjd0^&IL6BzqEsue>-zl`Y1=%$D;_Af|dJ3;NR5!h+grNhBhJ zs|V|!Yj~Xu-TJAws%Xgk_^u|Tu}Skvd?G0+$-4H<5XS6)!@TRVPO|5Kw~eT=iT-i? zN5^-4;^+VzYa{E~)VYgPW?k1+>0nG&>19kLt*~<13%0_(Mj|1DAITL_I{&*6a3aJ8 z!pOx3A!$@J>01@pj$WXM`&AALmQFjeRP{j^X=S`hXGFaD}xk_O? z4`2rO;|C=|acHqiM9pO2?Gxz8N4;`=q(&f>Vt)Fw&F-9Yoh-{z*U0sIEh5w>F-Vhj>YL7^%6*_vNi9;LgT{{a!ha$akNeFCxr&K@r-qL{xyDe|G^iI->Rw$KAH z&&V=jZwZMUXYOUQZ##=z>9q9F^PLT`J30^My)v_MRjW|=#*4reo79_7zXQ$n3gZU6 zjJ&4=cMh|k*}u>pl{-CypWG^8;sb~`+J&Q-H!eAgwMfKaT`lD%qep1VvN15(P3r^9 znEBjVKf{(2Tv14|qs)Vsr13?L){*+^0A%epb>b zjru}bfCu2f72rmrh zVV9ct3gJ$;jrLWtR$N~^)IqR-Up-&F@cN z4FB{agwZs7i_H+ht2)AB3!cXw?2+%gRv!2x8`f-yNozg(&%mlitw9P#H_~?d=MKHJ zm@bmUgeK0~f4|Cg*aKF-bSc;Tn4K?q<7Gogj2u@;tid~u?ocuhwWVJ5iQinW^3IU; zBN5-IN~SyAxoy~OxKf*Z*O+TMOExOmFv*y1!d;6ly;&<w_?q3m-B`6(Y zCs#F>8^6kIF{1&x_2srID^r`5enEgDchbkrKB+FZ>%Jp0^X1#ai#4 z;7YAfZbbRh68oj@GxTgamx`cX^km!iGWqxlHb$y)MU_C3&uKA3s3PAT*n0mVJxeTn{%F#~{^$T#eER*nr<;Ri z)d?_$WP!UWNejjko3fEeruj#eerK%M?30&e)@D+t$$2dCC8YOF!}pBcV@OcA9i6y6 zhiHP6RM=;G)>9bK5xCmLxm5MtFh{pv9x>MTR>|Y#cx@{?zj`j4a2b8a-&m#_F@WZ9&=_Pd$;vae$)W(E`u;sSEg+z8324;v)uN zl+P8T?}akSSi1onk*(b8hAvOpTUFR~Rc(f<<8x@;5T(SrkQOM6if-_3$qE4OP>Oa} znp}$J?F6_XXF6q8(dlwo?4_dBHQ#Qpdrb4va95u6g`#zsICOG&SRe3V$HhOPBG}kY zkt!io#uvIWXZ*5dnL~W;xy_2E{w(KviDEbkrw`w^^{}4>&N=TAoDu+I9ZDvVcR9J{ z$E~>MH#ItGdQ~`wAhgVoItHMXx=sf^u0&wny%Z)iQGMPD&6PEE{VU!Z(%RHzFuXuS z_#ZdMkqGNg&38;^qW!RX(+J3nU9|<#jk9lEjF(c$uscIv;lG;g8pN+|bMGme`n~R` zHfBqbh_6lw#Blme`p~oWO;=1%+KcL2AU@8rcZX6XyD-ESS_x^58p_rEhApp^Hwk&? z*yQh`qVpT9S4`9P_*S00yxBDguEQ^}2~uvN^!Ky!UY{tUwvGhs;)F7Rm0wm`l3BTqD`=PY4$=MocoC#}QA6yO;hU>oK*he3s(dFSZI1roiY#kgaV366t6RtIBc$GEx#!{F{l&09K5iJk1IYt|7r{Oyz&<5` zFfb4&h;je^P$L=zcU_MPE^ZtVzPWOd|x&E&*s_lFdBCrM_=2<=KmjpgQ@+Y>)RLP9D%*|Rzf9^uft{+ zRZZ{C)x+`fc_ejSwy49!6VLUj=19%Pn#oA)i1PA<=H)q=Y$9Q7qKMC}j5wu>WDh_Vd4y~m@g&9q-fRPual7X%)2w!ka0n9? zV5|kEP&YWWBdX)%p9<#yc3L;xl;8mon(;~Gbij`6<@Eay=}-)}!SC+?#Nq;j;<9dL zsu}#12o5i572(m3V|Hs?jA=mGI)>|y!8Th+Xt?4$Pv!dLtX!jP5+uK<^HJuJW7s|S zOA`WMfXus9+hhhds;b*RX_Qt!zlOT=24`k#w;C6fQK*AwNKf^70W%iB6f~Tsv4-$a zOmaT&9z^AHw!uOi)1PNt$}bkrC6l;D%lz&YE=KE)cIuHHuE?YOrcDKF%yYtATpoy2 zN!Nz61O<8|6C4frW~xz6^W%_<%dNd zi7iS(Y%r5U6)azPTOQV57^grZ57I_8qZ>_h*r+-uXRVdKy#!84Vb*9|&Hi%p7<7Tv zTVpi|d(rKWykI+D#mXmH#YtgQHcs8eX+%}BllDFu8mW`zs_}`__iQ z7f!+x1yf%kQXS0>!5nLQhZfQjU6gHYfIe#g?jw+}!phpR;QB8Cn5~+@Idz&t>!*p( z(f45QzQu!$ierlXh<#Rc3XVQj`9`1XYZVroU7UDaQ$B-h9c$^$rll;b4!J8whSO^j>_q zpJ(N_oxPZ5*)Nd-*j^N%++fB|%O%?+*9M#^ricy*s4$b!H6HYji^t0sj3A};)9K=( zT>Yf=htHNbV8@>7?wIB0PBKhi+?+Y==P0Q;y2nl_J(M<-ZCc_r&KZ2MlY|Kg>a#8* zO81HwnzERruisRzOs%X~XoW(O7s;X0fvlz5q8cN(wacx~y)R3xgQJJ@ufwf9#P4VC zuZs1S_h-QR7{5^$FYg{2}4l88!tYU<7tgrDK@Q4d!?(S5YCRsL&YO02Ji( zeB$62CN}pbx$bw5UWACGKOfpl<4p&n3tx*+J_-J}Am#ei*cTj==IDKwK@{0Y&t9wTjdCnmnR6OfOcSAFbgyu{6?b|Lp+V+ntcbk%0 z3i&bF9IxDDVb7%AT>nfsekNHXSu@U5p$yUZ$IdK5mhwdRSoQO`kv+tT&WY%WfnN77 zC5H)BYVGcBXK3p&>sE#1p21M#DJ3Z~dzHV5VwHpSNwFXusyg1-Qu0|TYs3!_<fiUm za}X^|o^zGeQf_86)N^)p;I^4JkqND$=XBGe<8{>&k7HGVHpoQO2$>@{)(ih8-~{Sw zh99gAJzxr(xOI(MOjm2c3_OftBC?R_C#nDkq z%1~aXqRrLlr49^|@C zZs)&Z{oxDhc$9p7sHxA~Pzvi5pvY%MHosUs8ML=SZ%JVh%XkqrGsjk!Op=W+jx?{S z#K&R(?M|W<{Z~tWB(4_z-|UBg2bNWCdW``8j;6_XBR5t)7*d~jSM~d|&o=lU%0^%& z;*t02VkG+5{{GnC<`p#r=;fppATDHzv_kNxDajl0Tvpm&14sa}j%12W9))K=Ni1BD zEE+u)Lk~sd2jpzg-^>i+`}S(F13oI2I$h~gZOb&1$!Do#Fdhy#(7 z@xL2hv7q;RkYP6vL^N$0TzydT8Kq1c-10uqoo)89fa0M3Qj&u5TYKJ0A2#pLBG6xl z3=8vaYj>d(8cKytXO!(>*zGgWA44|$t2T(#pM5SZj6`kR3kc*WLc5i$cEHpTf|@IL?f7Ovj>MELuw81v(IoeY7g{)rpsk1McbCd_<90pMi^ z#4bM;|LAvzfD_$IXzyCrX(pg zUqS2mf<*%yZ{a|+IuOii1S(KxX01nhDT{cTSBNZMZBKoGCN8t=glP>asXL$3jb|h|9 zZ$`OszTv|rCo<-L87h|J^_TXPQ(sa`F?#$85?S^2SJZnccMZb9sPc^)_qna~gUP4M z8aUtoJ+4OVk@=h9Hm`!dEsK~OwoB%@#kB15FB^q>DS{V6`}9at>n73tjq0!wW8~;g zyku`brMQs5fv{wee9FxHY}wVl??xV1z*5Xs%#rnj@%e>4T>uvt6`c`FVKGojfaC8hKM>7WFW!qhs1yJ1${{3eviVjfGb*E9-7tc*YpgQTcU6#B* zb_0D`q4$nZb`v4o4rKU&BBHM_hH#uL0`B9a)LZzn&geLP1nJh7V6LFUP>~2cf+1+> zD=z-YP<{)@zq|DqdD}^a5~QxdF|FMs%?Kid$-Ss7!7hbGt+lAqE4JXNT3-ag?zmy7 z&T!B3Rel*J)tQU{@vsT@2K$I1BdQQx!2(`G5XPW&ho1L^1*8AmYuX3wlJ`nAQBpYynL zzkB}6eM4_S;~Hp7x9i7aa?mI;D3(Ccr&Z_z@bHTeqjzcc3o5)m*9X4L1f==u2krf# zxl$H)+M%3mn%e=xONTYGn6CCA!t#A{)e`+Pj;M9Cnqntj&mW=5-iUJAY6O`)$pq)( z@AW{2B1-ZmDCav_&Ba*sM@@(XOiABz4PoTCMlUib*mu5$@1Kb}X}>LE6dFnN(jpR% zeP`pVHVfcOxRgLLOlAv!jyZqJ%av}o9^zvfI)GdTGYdq|0X)v%;J4P(mr!^m{^kfs z&Cu$yxt^fielTa$!G1g)7++A!5Amy<5&M%0w=_I#-O$9anm*?o%MH14qU1`$owj-h zlDP*HeQ(c|s8d*X@sJ=<3b)t5QbwU`PdDdhg0y_riFbr4|32Sj=vH)G+}q0>DoO34 zJl#{)k%zXMZeBo9NwX&0?!rn{^u>{`uhyyZ>g)V=J6+ml#ksolBkr{=N%A)avI-Q_ zioP%3Y@&f?;|QH-J(w&1OjKj#wQ+jbed+h}gZbtdd;Qlg>Hmz`&izj0OuJPgsOmzw zBT+y+`HH@7=ez6|8jsMo_xHtqvy1l?Z`ETQEI2<@OXZ_U{s!+_E*B>0Ata|L_k*-k z+oDukiLwf%b*?1GJJ)i8p4E(FoVpg6A-epXdI&<##hR`4%oHDUDa5O;j6J_7-F4jsy?xnSwWnBr3NYaE~L zl*3+8!?e@4z@@qU$Dv+w*$A(_sd>?u`ZngYaW-xyh#k9kYn+v9<=hSLH6n5Hw>yzF znGh*$JvKji^@fyAclFG6&~F}Yc|x~|lU)!Gx)CSj6mu}&aFM%RY44$QY75MXn9>=M zt1cAF-Lo1XADG655ZfEpom{S*_J0;{{@-ZCivUeuv2I-has9eG{!@9qmS7L}k^*tK z0e}vY$^*q1&r~9aXzY{JOHj=~{&MEyIaNxIUP8dVsp>+kwdK_~!kCxi6$l}lVC z*(E2Wo)k|HlUOfXVF1RKg&4^bTZucv3@>sWCtE-)W1`bfS*w{)dbdZRkGsF`+d;D7 zXC6N!AyfEkv)>5TVWA&(e}|DobU)uYKFq++HB{)O2h&mt_6cz`4tq)6_8hC@4yh^% z;3)!q*jj*VI8Zwdfvz@f)F+TgVSeZ-QbtaRUeGUMfNzpr`$lU3&*tly#|X9XV+7Q6 zOt>2mu-v&@h{7BVo$#O@Z99yN2*1@oKqql{ntD#!_8~aFIX?u0F`T1h4&#T9e+PPA z10BL^{r3p#A@#t^m|8z_C@($;Pn@o`I>s5@bx>q$n8)iRwCxc4VEDuU%6K|-7|!wV zPr;nKA3_wqG431A@LZ&<4M!ym`%~^E9+d1$-4_3o7lY8Bf?rVBMHMfXj)Yzw+|6Ra zR)2)dPJyWgLiLRoj&aNF6Pl)UEf?0W(p*cd5c>!c_EnQsnyx@p9;7Lmp=|_2t_i1@ z*@xLLWvtDhPz=C;=J<=0fCx@>IksFd>=Pj>;*3G8R3>W^PpqOc+q*E)MgHbe(pVxM zv@Hcb9%jxk8)Y`Nsl3#FT|W3#QY>6!nO@VRM4a9>{)*%OMSj^!K^Ot{Nt$Srkm(BR z`h>M9>nGZTHHl7OnP>|@siTyOVBBD*M=K5(Hy_aKz z2g0mvBkm_L7+gr@%RF<;_?vCs=$n0>j{SK|`bW(Sgn&zIUH4zIZI$)SdT|;a0 zh!)p*1*y+uqv80&raC73fN^F;d%BoiuP(Nm9}8QL-Dd*32Dxe`fhLzbHBI zQn{A|o(eS)XWUI^?>J*?a)h0A@+~v3vJRWrS9sNBuk~^BwDoU~w~&fXO4hx_J-MK! z`(ih5v|*_`?#lB0;KJajud~c_;R$TwzcvloJY>^z&OTDk z^|bxHSCdHT_=WFccV8h6?WXWor^E3&xEaKEqOK%Zh01r$C0ML}1X|iq4vTzm z(a|Y&03IQCwXAi6ppW~=!-JKb)>;-`j!JgvSN>*eaHi*Ev*sY&y`L~T;n+Y&d{+>8 z>|dl-8aQ*0+rnxXYm4+%rk2hrM!5vjl46|QBGO04^~)0GLED;kKL3OBcLhC{MM{<% zqrhJ^ZAgOc9{#tnZ6_y&QRBUyUR~GAZy(5bl*zGC8(;^1qX=XtmTMaLYp*-Lx?R>Q z`qK5p@`WyU?ISO6=%rw|tGEa$5zlOpSmxHVD)5@SbnRl}0%#2J^PU!{mH%EieyY}y zkC@3ps+&;|Y!Y)&x7C_5sVGx%hM4Wf+0pe%x(lwfTDl)w|T>-P&LW_OEq5$ zm+LNU|L}!jv0{w&?#j|rG08j1+9ybSpC@L=H`H2JMsNhMDpX|Z@w-n-Vj9p>M)6rL z55ql2U(j9z!SgF6&ev5d=4z?@p}FXkMJq|EjQN_ri8{%ru(qGT6lBGGoXo=R;L_67 z&lFT;{4)=<5c6Y;bSGOJLAh}w) z>GnB9PHe=k<59)Cz*x=?M2!6$HiG%0YO>)EyqA_%g#82VH+iJe>= z0l0&O)2OapCO+Q6q|nr;H5lqTk5|x2}of;f90bjht|8w0@!h0@m`UZ>>1( zIWW=NyAW8=ZD-$kuQ5o+)$ zsBv|DOgn;u%XJP+;ahpT_6zV>0=)>DqVtRh<^Cn+laM+2Fwcosa=VD=GAG$mg3L6` zG(D#xS|%Dncz3+k9&|OKYm`%JS#hGDBh^9K_QMV#ybAj`-0v7wa#LY=f8sE@sB@YS zLOTTAA*;mv?x*6tXPM@s3f)X(le1f#SPrjy+`~&Tl^8EPuT82eV-6PivZQ=kqB8pc z#U9TQ;>$zRxIsdtX2)UtGRL}g_&II6gEFEtLwD96C2~he0+_18Y_Hk27FT?b>b4PL7{u!)>9@(icDv0e*=Zey#2&E47+8|0Tia_r{xtQcB}EPi+oepV^{}kvewuhQm|btx#G} zHCth&u2Rw7tW;}+ZqzErL;R9P_Xa@Pkp zrbx2dm2)Id`<=krgn}2UFJo+%#8`iFGPfO-0eZb&D-FXRXU^_NF9Eg3tapx_Y(IU>EL}mjyc{jh?MJGjkfo)1P8i&#stl}AQN^Voki|1Rt0Tpq|D z`Bk!^HTc@$)ix7s_W^|N=8_98bW)BX6Fd_3M~MlpEY{y7WVNkynM%0YF@IAnr%Cw4 zv|dJH^OSd-wu(onF1qiTuF}PD%4aDzv&EYDrqnYq9UHzhKi`~Wnf9HyqqHw7>A&Xl zZdEJa^8X6##kW$>r)<9OK7h3+>aZdYJ4II)9?h_c-ieM+`RiHROd@G>)r~9ieK(Wt zwGsHmtu5z10#p~ZGZDIeYcMk%#{OlPSz;=QNVi0Z<}M&ZK|fnl$6IMB1+;t`(R_J} zkEKcD?DIcoFjhh$v}Nk#jPQ+Cf=$xvY7y{=K?(MngDM{B1%s1SaC3SI-lB-iPhS<` z32;ShzK0tgq|J#lQNXtz%Qet{iVLMEq#9+B4{ipQ% zrQiLK&*pRPN|ek`kM5KEm8Vt7!YHEnyAxJct}oPiu6#G5_jJc}gG~H066?#$_^sWS zx0m`NYkBJdhU=Gm{NU`ZN5}`fAPQWLltJP{VFP$O|HYDn;YCn?obaRg%VF64$m_iz zfi9PRf}EEuzerIo`=T`-4rP(9>4}D#LHx9~h!Vuis7f>A2f7VyX&-G2u6=55P${hw zmqF}v>WkZtoj3;jh*m(B8j_qQY)ezYx)f8mtomh;pnrF~FA5Ge&VE^fNUoXfwU(U1 z>48wBO^otbDKtnPjZe0;?wZ?Ht%jx+C1gcL!mM?sA)m4Dz8dk^fO@_bmd+Ssmf&um zg<%B*f~wi2%9xu_$!^DCJOyn{Zab>$EnY`wNKYZ&Vwwwm7t<&OQZK${ zgm_y&IajGshWmMC=3o%Gt*$!aT35z8qcB8&Du^_GJr2|wD%9-cr%FjB6!_n@t zaUJeD_@-}~J!)YqxhKr8;g4ds)@ADK6dzJW;?60jpfFbhMI50gLuQ5)TRZ~k=WfIj z+(vlRpM>23Rq|7pEVghpd4$Pfjj=|5{;%>jq9(SNOqlT~r z{Yamz7PZL4WZ{_Q-IyJiySFNQu>?l4_8ZdXxaO6&Te7*y%&nq6t4Lc(N&rs-fH$bj zuin2Zz-iZEg~6>d=Yuqlu8@O4lWMU=EKh5te5mY};8rW`|KFN65XW+STSpsMf-zm; z_b2mKnw?4D8*{Fhki*mW1E{%3sWMey!2B`73AL=K7duxsZh>7-ed!e65r&`X37*?v(Earbg0Dg!B?%|LyOe1;VPR zbcCnu!X(n)yAtWr8P+k07P(hK95ZkUQweMw;0;ctKTBnzl6I6>&FW zq?Pgy^~yob_z`i z-$x%}VZr}oWxkfmZBefIt)6o!>)@sD3(ndKmn89`5W1U<8!@jHB6Y)*3Rl6sUI@$& zPZVO?B%%5iGXp@;r@?fh6hjtWO{l^!qM_qVWRVvR;Wez!H=;HRm$Wbct&pN~(M>B9 zs85(l1M&c=v__!_&_YTHK9y__kA#}q*kFzBBOS6Lk+H(a&%$kpzLxUEdRgJjhDD-P z3gPnx>VQxv5!ZIs_xH__>&0$|9v0-}oE{7v&{f*IrpahaZ_WhLIwEutn8K}mP3Z1o zVn;UN6bDxp(3J~V@lLqyV&)Zv$)RqUL1VRzdUwcivWlH3*fY#UF! zBEHL0NJ(Sd3JGS{F5~Q%@eRNa4Uk(ln>f;*E-+RuuzyB&+$0nKW$bLvTM>lo$cpaR z#60(Ks(D=0Vps(whPwqzouTFDhQ8h$zuIdu1H{6>3i!q)27%(fWBZlzvDC38^i9k) zPjo+K>PTrH>g(&1$)@VD`60Rhl8B#Vp{?k6p_U)!=8h|q=L*CeZtQXh zKzczb6f27pLkELd_JHx$?5qjO84cQ@qa}K`nf!bqq80XctAe`ZIAt9fDL}u82tt zqc@%{P0m?t$N-Uuh#Cb+Ug~;&dzG_3z68;`!&;rjs-LR=Vil=gOKB?(U3`4~iYuCY zYzz1c;*wFMF1N;Pxi+aQVp7RezOwAb!YkP+=vl<#Q9#Cmo=BUoYZ@@5_+2V|9suh( z`N}Y!bPQ|NVOn%lS84hYI=%#zTzy!h@z>UbE(m5(vt|$1X_Et&&OLei>OAN7ylgV- z5$v!G*eeUqtNnyjl5cxo9b=6{>HSK@^syPpVhb z+?b<^Bh6iy=c$akJjE_7MVz%SWm^J7F=>f;Y!>E%rU%^0;P0ijfRcR_VwJcKk{3O^ zT!$j-$qpk+cxtQMn%ua(Tvw}qk5;3)=p$^CO#+F%rX{uSm@Z}dyl=X+O{|M-JR7V` z(&g|Kz(12ruopv`?ZPN3SsS<+yc*Ue$a(G`sTouLGzakEj)l-?BmT{}g$8MGr0;GY z80ZMIE6c-L8A91fQmoi&FkihoxEu>Fmv*2>dWH5smc<=G)wSXO9>u+%k%{<(^>Z;u zC%=}^7~@>faFz3gDzuE;%f*UM--rj<$edAGiblZ8q+QU6amU^4ddeEg-POiAQT%j| zAqh_?zdR(bz6GQnRBsU-pjAgQ0UCx)$?1l-5n;Z8P!8ZZfy@)RE;*GNeiz;InpPKO;+o9Sxg(8TfpFG6qzbm(TJ8diUHRH@Qu{|H8VkTaNwwISnE zk*uTC915mn1d!wGZRbsN=?Vhj4N}TCqx1uDqx9$MuZFvk&6|nrG8ttA)9o!{5p58k z5|~S3%1`POx}^@!;*`_UHh=f6A4(My_ zo$-h2L&1Q$Xd~mdZ#>1+ z@BL#hjFO1PxlwGrtBFkYSL3BY%_bARReZ!fQpI9gOEZ#IX`CGn>1c3VPaJl>8w909D^L?oab=nwMqfZ+PR8qiuw>LnS{AFP(f9sZP@4@6C18oDvDp5I#1bnp~Wu ziIQzd^lkoD_xgNLj3~4_>)ZsB{fw$4AG@a^?7VuQ;WXkrESxLf__Rb~V1J!VBF6|G z4J*xyPI6Ke>=ir|%l*#X73G)31(fMqW>sY24rCb-?(t~{SmjzFRy=AmISk8pc@SqL=st+0^tiKHH0%8~G-8T(*yLtkV&89cu?y4r|b#O)q>R7$gdI-ObBt>tVRK1>yVflOKTi*XXJ0_x2I(k#znElwP zR}fTv^Iq&gD|SaP-&ZVe(eBKS%~*jBZeS*9GQ2F4y#)4})O?MRD$8-t;I~efyhV3q z3(z6#y}IN6I=VU3e?}9f6e>1}XUwPlleuX!w`xFnqTq<+3{tml-i~&!xdvU9Z&&{B zrC`r#@PGX-xzLOS$L&JRME!WvW`yGtcx1G;H1mRfaxnx8viop$m`N11*w*Bn9{CAK zQWMl!@g1QqnF=5Ag+RZXlIjCjfklDf9c1%^DK813k(y!q;|))MquZzY$)3gPa^Nr2 zZ2;r#P5M+qgdo6o4e)2xwA37Mp_=m(U=NFxA!|f9N5$DViJ%qL6N(1tnL-np z7a*ef+5rjy4mc&vE-l^48KG{2Q#rH0Qk^HoS43B;AO6NSD`r~c)uCe5yCt~ znPw1eAgiESmQ7;U_|ft24_`)>el{za#_}Myx-xG2?!D5s>v6*mp1$8U?+bdvt1Vwt z(FBeqsfqlnaYfw5yFa>k91YX`UTFoGpo83KQY4-H zKu0Vja_2R!tk_;k5seq0EKZ*&xePg?1b!HS2(S|2zEr)(WdQj5IK)L!X1tA) z9IGo1>p>Fnx19&{6SCP2Cd%d}dgj?aE$_zsrJ*IVoEuj68&3@Vc8gBDvksJNc9du? z0q^^lVW`d<2XIc_)XM2a8KpBuDR0yw`Pcib#8ppnBp5Kf718tdTdURB^i$0mmY^-S zwN#N-n*QEoLd4^yyvuXElb$nb6%&R!1MJU9J zuZI$bjovJ7@vTfLAx$b4&pbCpen>yfwj|cO0W7J_Ge}WaO)smSzm6k$=z3L@5LjV{ zZKYkbI8k|+X_e*lo87$YzUr2IZBNip*5a1-S>pwV?$M+PO(fM&Zp@Jq?Tq`}k^7cV zpQrDtD|F`0(15MNBMXU?U^= zc>4!8)T8ICnSr!zU!K2Dp)XrR;QsvnVE_0$>5jmqaC=# zxK?6Vy;jBWiGyU-bcx()r3EPoh+1Y&&LS%;{~kK~8NHExmDJiPUAr_QrwFz>bYTK+ z%e~Q#?Ix7#L$JVleTi=zyXFnzT0GD;(0$KWb-RTj+aij=?`xFWn8YC7*f4A)qJXy} zga{GkF5e)kTp~Y#%KzTOpHV>=2)eOwl{I&fp8XR*CPirI~$raE#wMu<3q!qnO4{z{ zO3!`#rx0rXCEEk#p=rR?weU<-FTZUkiAPgLT_$Y;_K3HdNo3EYYd=$S#5~Oa&Txn9l2Qbu`En5@q2&vcDUAU6@9D}|XrADVlU)6q=Iks`| zoiHyFx({+=&!RN`_6x?^w$9AJ>|aKy`Yb?U>=4`Ias!FuLE!2Rij<*Jr zllz@=KuArk32s6WCbiQ_ga>fSb=-(L%B`A&kMeDFZy0oga~NwB+d75u@gF4SZUfz*6Q?^y{X;Z=3i}{TWU0G zi5h~>&}W1OCFVBDf3c z$@Aa7?Q3->mLHcN*`GnJxxIsWC3$G_{#jeMVD%@>$HfX-J230BK0E4Mk4;(+N5~H3 zK~5qHjB@+^B4?xD3zj3hOqT)RZ&4W(TB7!H94iSN!%J5*>s`<-VD#HCwY|-Kh59Bu zWmhwmOc_}8N~mbote!lGst>h}3)M{FiYa~fY#zGibO)B4+8I1P%X3n3hmGoOOV0mE z0=N9N8PwY+qU=cwrW^XN{5!Y1nC+QFbkflum74AO2%Yohc667NViLy(jV?fQNU%S%3I{v{X+~Ws##w zE>OFBjYbJ_2HZFqmVwGBof}sN@bf4+1=D_lf*zplJJGk$*7FE!z^3{G50YS`ZM-v3 zwD~uO%Yg=3^Y;SSIXse28Wc^d2{Cu6H@KVeI{>Y*j^FJjlAxs!F2>@(qn}>dqW`ALy zzI)N;pqv;M6n<0oy$~afsP%{FI_-qu4g#Te2>YI+g1s zK6i{`^|zI5<5yt84WAf<0&5NZ?@ znmhqqOVyQe=CwX^l=^-=D2&2?BthHY2XR1pHdN~o0Uo&bz_k&Rwb;uQXyal7PL(wz zc7qlTHru=)kSv3HEo9EI(M5G|t67fynu(D!B=^yC#)mD5ekq1}-0-;O?`RvF5MRix z%27L3RgNJ+94|$fq@<+D^d0c>qR+3MfRi#yQHWDP@by%y*9!$hVk7+4Z` zN8+dn%unPff5)*N?9w+Q9~bwwn3iT<1>_ZwAuLtvI(Y&Y=wD6eN4>F3y<)Ks@Hj2ZD8*uibT?_Ka42JNe_;jxZCl?7#~dD50kl2qpZ!_zwk zMjCESyB$r8iEZ2F#LmRFla6g$6Wf^Bwr$&XGO@nw{hodP_Wyf5y{c+m^}@Cj5F$(J zMUKTeATN20G>$P?&V`Y#!!)P3UKq8oTXwR3lLVY*ToYbbMOXizcAy7=CtMez_cB-~ zbbP$k#?|`4bt{I-C4P4!zbNv2Ib4B2CtN@0)-0JW!zhLd_NJH#|3B`B360(aTLFVI~9cFQrLV?_c@O`XQB=et#OSNpH)Aav8 zTmuEaR%^Ckm%6H{Aq1xcXXqQyUuS0`-GGiRl1^yGGxi<`QuW1No+1$%!R?VP9b8J5 zpE%r}hDx@+|A_NiIr-*ON6Kvggp4YTJ#Ojf082#shkPxUfPQoCWoooY#fEtGK>oU) zQ^S+y2DTGF-3+C+%jELlYZQtZrHMIrdKtpeZ=yOaG=?_rCWUwH|KtOmc{tVyxu9f` zM8Y>T?heqG5S)*ZpH`2v(ayQzjMkNSW>-B4v)v5U-Y-fJ2iIr!U1mki^0v{bwkk9B zm)3Q^k5^AhpO2cm;b%MZ2fX#nOR37a0L?B1jj5?0ViFMY66u^d}2IH8q% zr~)l-Z?_NC-h5lPO&o+Dru^X`I|YD#W)aXN_|we^_m@(^pfM>a^TLEv0w=P5ihAQM zY_@8QaOIc9G&4dhygT_jDOK-MhE`cZ-BaS!7QjW8XwK!0zc-VMzPJpoTa+m?=r%hJ z*yhNdLopTkCkIb6EKEW=b%(|1;{AM^L z<%1F#KfI~S#~`}NtXto-2a666RAgE?MQrv2FK`GT{%-x`Y39RkZx#se+EUuDaGZ|i zcXD!hd=x@&t{R7uCZK!DR=u_A$v_|nPZ{WQmNi5 zQoDbMB6i#Lq>c{$)Bs?!T%;xtp7p{X)zm4|oiK*(*HN;vc|U}@!W9$~4Kum0lD0&8 zs)Bu}(uQ}Gex*!FQE!|=+CWZ2kYQY%=q=4Vd`&zBvJ@inB5mBBt)`n&-&|P5#70|l z+!=AV5*DP$Xgwv>aM82Y?cFddNulRdQ>@QUCBGzT@sSG`^8Nm<`Z8w1f!$ZEHbIhmKF0~j7 zqhia6jn0X;AvgPEmV}H-nipnPxcsFjIg>pCan-}!&+khuSHfD70D-Yfo3J7wU8QC3F3H2asF~=dvPQit-P{j0Lqx|OzHo4GlYL@r*lF=l zrXD%RvEvG;BvY)?%bR%7_^!pb(xMOioO&s$MDUZ(UNE zx56?Gqz@Y)1XkBxH`8m()Tv6YcGJz-dcBEf>+P5zGRI+NiD&yIx#iHA;|P7ls;Zs6 z%Wimik7xV)X8j!{Cjxd#fMTgqCs--~8ettIEO96RbD;bns`TNhKnj4|eY>Q!Kd$%c z;Pvz!A#%)lk=gLLU#zwK%h5caZhNogG!0?^6Vl_v#`3O0m2nx5%ZZBoth#Ex>Nb_Z z@Afy7#ZO>P0@^I|;2C_P2*Vc-urFm_kO9#5F^hr|7&WjsS6#gbCri1nIWxPXd5p*NK}8Avpm4-i&EK`$lR zWl%Qc-tNgHwyju?sdTQXj8iK?pVn`uWLya_dQM9%KlCU!OtRl!dp{~}v|UxQ7v*TK zW|j#*!UL$JMQLLIF^2Knkl?T1K}=~D(*W`$-BNY3t)fMsu8-+?`*Oon%=|m`>dM`u z3b~ZnnQcld={NhL1F{#nB3jZ+J6m9iVkwnFRAy(}pgXnAHpVFDxf@xlrEtg_OQ^;! zUCalO~zGNypY5jw8uY5M;r6#`$nHfp;cRf+ui@^Bez1RRulU;T?8CpP^ z9;t+BD#VkW^WM-s3**!u44+HgEWYixdx;IqFQ@4I45s7)H>*?^YFO$wGm zHgi_L5m!xVP0STk4BP!s-9T4*NRF_WTjD#3j}L(x{(Wxz|0M?h6GqAeK$KZnIt#Ey z{E)W$%T`hjdm{&W13JTod7fEww4kG}=$$vAu{)qVzr)&%N3~?(bSf8n5xt~AO2N$m z0A>EEmuY+!J*7*2W7D2Ru|xVc_ar9=rcb=fqlX#kQuy7~{HxuxxB&9VHyir)&MO-i zz1W{MeEh`$H1r@(t215}?hk)v2Zr3dU&qeXfxvY#Is-oGzRRm>Az4ypW;&=B0QKtV zz*U99sp$zh8o3zuKSi$JQld8Q)5d-MiEz$gG)D)!kH^=?ZPxWW6!iS?_oIF@c)#p^ z;{frOkH)cW`=+K%KkZqaTy%Z_ZKKbtT44l*8&R2wq^gDB7qC;S){7>`c|#|&T*f4C zGkniE3_Uzx+TeD?(a?*Is7-q-aCUZ{49{&r*eg`3(Gm_umdCp898Wq6)%uh?<`@K9 zyz=82l6zq_LDl7AE~9t7<%j&eV}}<85SST%Y#tfaNYCIO!SLY#aXl7^0TELMh`PUl zpcJ`;o#VS+N)qQ+I#F3~A^Uk0V*CE$PlJK6SCVXS_e_4T5Kc%_uwE_{l!>4{#=i;8 zZ8XKAgF(&9&k$9tp>F8&@A}*1B)7!ulW>u5=9KlVAF`7}-zBz%E!@IV$m4YUj`hEG z)Dj6cQ}C%J2rLhgTIHNH8`Mi!j3hXw2d1w?%Uq|YR+??)GaY+rjP{q5l(^RtI*iarvHhs~HXcl%~#$F{g%6eIoJjm{ngRN7*R4 zwvfUpvK9xTi#v1XG4tsD4b)}>k(x(D_%{gdQG&tAD}`GGqGNyDzC*AL^H#m!8ugR% z!E+bWy7-|xzJJfkq+?ugdRIQY`(GJ}sI*Ej>HHx2Ow^A?W@FZ-1(Si z7T8aulArj-*w-rTDVwUa%DeMZf~>5ZnBRSx)4_dM2pMOFX0o8ClCy_?p?nns%6w?A zDLTw6e}V@#$BdGjkO~%5m-2l6Zbxv>jdVv;4QA_+NNHu?<0KT3=Tl!g@yF!IV1AKp z?L$3--ctVtYCVFD?pT*lON$Bsb1Aof2?!*4wrcs%b)FMwxwb()lY2|!t|Gjvs%}e5 z=Ulxy+Vllfz#cB-xt1{EBV|Ua(y<11)*9aP`8HX-@HF`4U zTJkfr+Sw&n5iUbpV~mNCgpBw;xAf}pvh{tkw#Dh@n0bx6>RWlk{*Uq&SzLA&we&yb zEixQbu4EpUId-utden>~VTT?;@cy4W#Y}ctC6$s}uK*^8GWLidEr_~@=G(~CC6hpx z0C(zwd_9C5o!y7b08dzcR`@;ZZ4~j$GiM2g04EpzF&r=~dZ%3nSGDPH;x#C8onIB7 zA80}$t9WW6?qs6$nd#7IM}pfTvlGZoF{vFJ(KK{-T4j~xo-Sr6E!;$epeAI(`)qCa z^XH~O#CN|C^HPNd!EuhOko8s_KRN^zAAIHxn0Mf9o0d&DgV(Mc!rU5ONoF1N%_H4y ziSKL4H|9|wD%SVH(f(^1KTPlK!PO3Goo0W6MJ`+%--DR{ZIx#)({U;s{yZcMGU>-C zZD~6iU#-YS-U6ebki0xa+uqUM((*UCk0Pgm?8oaHAde!G6o=;;QSAM0Pdl?OYSnCqz1+f4}r z`5|h-3HCI_yA@EsZtxnb0*%}((jn4>h|LRY8cR&gKSx>-;@P;-Zv<<2h`j8$vA~R- zn})&EA2&H#+Ttzomaxd}0lX$eLOV<3&6u4MHaOK6=CUwb6iEsg@*2v0D;a!R+%Dm{!#e&1qBmrw?cm;Unm!rZTA56^Lqpn8u7%@>< ze?Spk5Wa4q2{Yqs0ylW((98R;Ugz}9rH5y`1{Qg8cuObOH-F{ zw_`IzJ zK>EN)SxM2NGwQ|O)$gVD*q|^`0$)h-iS4!CH79VZ@3r))*EqU3_`#r(|7?va+-VM%{LDM#JvW1|OU7(E3q5{kSa55iCJ2d1Uy4p?lC8%iNAN%&KDb z6VuW93M%n2AJqOk?ay=r{!DcLXrz9#pl-dFwHS1VU(L_wElluKG|! z<+g_!IuH2&sdc;d{37PR@kcD!cNW-M`}BR>dLOMjXuIZlu+(cWe=Pl z2Ny&F7xYUMp&``@kx7V0BU&>E#d{UXgA!l)^6&qgt&{kpX&z79;)hNNnp^Xe@CPAd zkG`p2cBiLD<<;4m-lAvq`%7lW)8hGA*_J6t+il(3Vkd_!J%v0y$25n0c2p?7hwJ-V zwKuZtMkrwco{{i=Z3ujDbH^#&ZFVR@jQrQB*i024D@?{zTN{_dW8hnclNW8NyJ*E1O0qC`Q%IH#J7lN4$N9!N_g+TJX740NvC zKA|~pD5>z`3nE9fb8}iM-433&cfVRy*WpB~Ji>LFRx&f!jy10X$rjG(`-|P!vl^xq zVXnPft|gKJaLy5Mr$UtWycosUcSn@vX-9@F&ve+tCX+`v7ar#b=GIChEVB-fUkWai zP9QU{q=E7%DMb+4B>syvMR&SNK6fqk>6V&iU^RIllPguSvAwb#uP3SX`2^ZU-rTzv z7OMGj-?`Rtw|IG4u;xDWct=StgRai_{79k)@w^r0+WFRLe=?%8;G6JhfM*uC>YuA< z;~?*|3^WM!YpzToYp_U;-x6dh^IOfdC3GY2vTDJRGg(IUSz)lwdB5hqzMrAv_F8Ld zWZG-vZOYQkpxSJx@>O~b_U^L{-^tf19)8xXux&7cNT9JS)oPav&eA>xRY#C`E+*JP z4l03H%Tb!I0cX2%DUqjIeB@xbb=T^P$)o4w3L(`yG#Q+xgTak$`dfP4`C9K&by{`5 z*5dq~sdn}d!y6F%xVW&!>79P(0C*Jx!P=%jdrtOWAx|6@NT*3xM)G8j+hUQ=K96OGFgaDCuKLy^QD98`!+_J z?hHH#8qp)?a&fJOA>;SlUeOq9&I3bL4ZcTx*7-4yrc^P|bCxtn;9lPH-m+x@iX3q} z>CVG;+rUXy)&Alc|76Eg$_EA4+7dHz z=%RLPUYbgYxxH(;xrmexMDGr`X{P7!>jV51wsT-c%p2h!*G>Pf z-~6J7W%~Tp8PPROd}hP)&b*2;^B+Wnc8AYxL4^x|D)1W_ve!5>h1;`rMZTtjLv_Gz z6g7H3v=LeBaKsfewx>^pu#>)@%NEVjFn?5~k5+HV%C*o2WF{gI@KCeH=f$SMU=Yhl zs25x5;z=ZAY$L%ex7AMfjQ$bX{Jw<}{M(3F7O+={||ek)NLQ9agYbP$g*0<7RKzZ{};NQLa&vv2vUJx`zsCH z-$AYR%0T-A5&MuVX0c)u1@)N9FEHeKxlY^GrDzPQ?Z1hrX8-+YmJs0S&NllY2@<=>Je&n>K&( z7%VdZ?>4(XxsPy{_H8?^!I%Qct9Mc(M*GciDhn3*CqM-=ATaJ%bhnG-(2kn#b{?CY z*>bGgmZ_C=Qs|F*3~2VLw-#jn_P=UBL!t^oU}319pA&2}I?xjNpnk3Cw#lg~BRXsS zd>*O%gf3>PdJ3Vi#_RIKZJM>Q6vy0|Ho@m5cu|& zHy})=-BRnWNLU~(09yD3eC|;Cvbz(0iFLW-oa}GPN9R)r z(>tNS{+sMgSu4?p&V}V|Wp+rHk$9|rU`lX3>$k~n(eV;;78p+md}z; zUl3xo;91FXh4Vsb_v`w%YCEuYrzoROTqc>}$i!(SDQj`nbTKI%4XgrOM!(Zz_t`xx z@(*Z-m5OErzqem^MGpFT2kpL9KhpKwbq-(0e$+!6UG)4rbn?2 z{#9~o8AB*uL|Gh*@+j26xt^kCX!pSEmm69JG!$^=o6^$_BS}bD*(XC~S4vVHLLz>Q zF^si$AOIaAHM<~$f-BRgjsLaD9pF$u)>i!c)zYB4ONqn*&ND#&yNcD)#4x2X+z!CV z$QrdoM~>(~gO3V>P7CrX7ga_ClNxup9(B$4Y20CVr_6g(%rPkN+USdmK|e9r{jT-} z;|Lo&-2Lk7LvzLL!n^g{b1rE`_1%cLS83}Gw*IM$;rs9)zQ@4-wfg)#ED#kkV$k3& z5Ty~)zW4R<)Qyqzxi1iTob7?&hlm0Sg&vFa_(vQ+Jof$l4dhIdDI2n-lAKV1Q%@@8 zNlm#A4Uvt;=H2q2OrIvrFLij3v2g>y2z*0DQcZ|LpenAltEzi{FK>8Jm6+qMwKngU z3@zwI6GHU<0Pj*H@KS*Rd!!f z)y`EZiVgNGlg$32Q-ka4DEgpi1O0-je{QS`R1N*kwjg|0;K%8)9PiKil?ku)_HC2|$YB)l zdwp)ip9>d(f~kJK(kMt!acm_r%gU3sGcW06R|* zc99K^UZ5hI<5vkx=sI%UZV}f*FR7dD6upZ{hliLTgA-S2tjQHt*hS4hd~DJwi5EKJ zs|!Y4}+U~>z+5Z{xnk3foyF71<_pDWs7d!sRCSi{2eOK)dWvqJE#%VQaj4s8$t zy2F;;`smtxyVm-HCx}MxU)4Q&nI}JQPZ2x_V z&2Lj_g9wH0U$sBZR}p_MF?cg3Gw8)^e|@j~jYkjwg|PrE0-8p@lAGacypQ4QmSwp| zyelQ?gOfHus#w%;=zU%$&oB7*ITVI~fdyK9L(BM#rm_zM?)~-x%heXK;Q{svC zOQ9}6r>)O9->u&J-F8g(NAuRS2FwH^Q+*PE<=VWirEF8W{eInPkvFh4lLvcx+fikGib#R*&{nr3E3J0?a6`5pMfZZsRK6Qp4o8>VY4)P>yezcbS)#~Iav z;L%WoM-6duLvK(!^vYF-p7e!9)Og#eIoL*F2`-Bzzh$~$^dP_5S!h;1Zu_%?)8{Lr z*kO*YTZyO`_#qww4{_co_N!;gBTz+sNK#=GlOK$-vV{fWh=cN9-{B#+0*;7{f4-jt zUl@QZy}|YEyPUn1YJ%S6Ji;U7Cilj{H>Ng58xKcB>hPO>>h7$4p z65^&Uo5M}%K57R_2qs|AMDz?=y;sPgG`t^03zO$P0$zudlhq01I{*rSAg|TpmVLaK zx_86c{DJO>sMrxg*o+|Gn6+*VKUfs}!0BiZ-9LxE$HnTL<9_9(-O><(^#ef# z>>rSblpP?(j`S>zHy?o{;UA$iL$Gpy#2(zQxg#}q?$T3kqk&4`98y``G&#rI8!35D z))IfR2#qRvYx#wr^9#5uzeLQ6Qwh~mw8geaSQ#wW5Ou=g*pPJX{f5KT?(5rOnht@4 zj<#mLA5FNy&a|8Rtm_Bw7dIwpnj-41)^dj|tw-Uzu7efb_Ekl$E4Nsg-=&Lp*7Q^h ztJ=!Czyrd})X~8dq1nT8 zvD;Xyy3huWEO`L92VqGJX_dok5h$lEb(3i-cf||B9q`;+jY9El(ZK5Ka+!O>70Han*y7PNqEO0K|P2w}V)=!S%CQ{PVv zo|FJ!_?#$nJ60cg+VJcu@1kpRwHUrR-tqsqZClEd+Z7=q)(Y?OV)J9DrzZ_qR*-F`<;zQ#&KP1zUoDUCqqxny#E@PjMY;2(USV%nLs zZOa)16r-n>VE5^EKAbjBcFk{TN0W$C?B{$%$`3JoWQBtGg<7=VfcIrKuO{m(sOy={ zW{Ue#EP(=M0izRShHF=ib_gisbFpT>(YoXgb}dm;+6R|W*87o#!* zog53DK_|>5p+8?@q_uusZQ4-lX@E50-rI8@v;IYL0=2J0)Y=T|6OfPr2J>UFVfStqrgr+MO5t2+?--XWtBd^K{8#0QV?E@yw_g;?WQ%h{Y7jBo<7ee&FsG{x(mWgvQ+LadCI~h# zduys;aVmGO#99iN>k(Sx2?#38Rh zHJ>y+t0K3of=gp1#1sw-IHwoo!1b#kT4VpJ_e9+>`RrSDdvA{&n%HgMKk>HB{Q^12 zElRPgnUGSJ;eJnQxTBv>8RPc8_T|lbr?fe@iDbAdIr^Pq;T*(svZnQzO}u_uby)TE zscC=iTKH!hL9FM5ic3*o>Ti7Zw1H|uOaswxM$)~d73^J!@o{CBRHo2`mWS? znmENUGT6Gjm}?PLnhVimT2+8LpYx;x^>S6YUnro*y+I?aV}+@K*^;`yxbSbe{`7oN zg&skh$2clUHdYPYzD<{39?$8Rlab?C?$aAyA$RG66kq5F7C=w472(T;J^ADKinuEP z(4ljAVa2xcs;0Q}sPDtE5Rez&6CaHb2{OY-u6@JYp|-7DzUR}d{$z1aGfx&| z238Yw{b^$IxE2_CPe%~Mn2rtvu8BAbd9&ui;d3f^N{Bk)F)zTC8@{4ekP(;QWyVut z(4*%cq>iAYjO@jBJEl$DlGC!uQUlg!De1XTT~l;j>L|?S2E;;S%Adg>FVfvcKD zDxhUz^kQB1h;+PM+WviHi__^Q>$DmRm8}o9M@z;dm0wBp&b(l?;}=${87ULZyC?~! zuWUQ(%nvnKy%6B-svpvEYP^@!UTaGB>o9Qp;d@NPr4dG{38YLo?KBs|cNN2~7p7y%Lo>TIA*ZxC&}`yl);a*Lej14y$=lU{i)9GvAH;XUeojD z(;c>$sAt*7rRE5d3@Nzn&G}e$+k0aeaP7Jm@w(60Hi_JSQ_5%=L?13a-Tkg3*v7H- zc>}Zex%%bxI4uyU)6#FQJV}gMY3viwOJZKDdueIV&oTN^9=H*OC`k#99)q?kudg-} z4C;7z^Cu*ovpjW$6X$q}A1CEV&T(t(5YvXi0TVOrwqBb?!WGQY66C_hP;;LdvUpO* zX3)LCQ9fJum(i0puVvc7%!)b}M7z?Az5h)4|j=*G~walSV^mkeM(h?OG z?pURvx<F1w1a9*#?0zM8ldJk&V)s*6;++!Hyz5Q47}dzG)L-Ro)~Ag z2AKd|3g{hb&o0+cuVP-ro^=LbgS@C`&cXdTEg7PKn;SmSTSkn+i zQG$x?#BP9Zo-8m+FNU~bMLEJ)<*#%-SMKq}P@7j(Qifc=+vc;ud(>R6baH`J;jCR> zKYv+19p};cuy)UMm8~OO3o=`B54EjEdXB?h-*6R?k2Whj%Q((6aQ~~}?_phMI8b?RGxQTVG%;S$?l=|DPM+1)`&mq{BL0VS0&z{{XPpko0L&Hr=n-MBZeikvp}D2wSg57(gS{# zy6;1_4SGjP{^MO&QcG=UmdNcd)N1ZEFaR?*qb-QOy(qe;f+{G$>@RrR_b>Q{;H?>2 z)6)+0tnv1s^(+lIRme{rp?}t8RVjc$r0K4vcdMj>f4UtLF`TCwnA2Ae5qyp245@WR zSOmNBVt(!AeAT-RuWv^w@Z&OM`{2ht&9*#c?_0y`LbePXfCltiU3Uu<|6G&jf8q@d zn;f)fwHqE9+TXnPQS12VZ61!y;lk5{*!dV>@FsjTni85_5cc1CnimLEz447mVCX{n zHl@GxIzBFK1wEex@fibg1L<~>R;KeT#b+-%->ST+1f%otF3?4TzkUY)K_#TsqS{W* ztyLMKeXjfz3Zr7ohfWR6WCcRt1hKHWFu@{CO4qVJd1dl_1gf_n96UpJ(*J30_%958tY|OQq$AQuieWVy5!9>=a=$*(bNEyt|p=O(?&y6_DA=F1>`qenf&_jtR=pDh?-JnX3xY4n8?rlj8kYK-_b-^{~R_ z_F5pdaD{4lS3*(XnLlz0mQJs}>m(kz{HLI4{hhUqAZLufETkBj+)n;>Hg9c0G1oDZ zNzcX8E=d~O51Vu;YVI3_^wj$4LF58hN0jJvW&gnUp=gaE9Qa-Q32=$c& zG0#&!v$DFL$#$$_^AVjSuFqopQh@yqok3@d9YIH43-LwY3)*?FWxDk547Ey~8umU3 zP!cQy(*nWJkmb*O-Y8vJEDkLd`ci z`VI-G(=&z;`8OkDKFFvy;(A)b+EE)EwsCC2vzLzS~?wfT>&nF}{5Xa|$ZhiB#j^EH? zBR)1f|I&nC7QznSc&CVicRXQPWcqPOO579CkI~@rviL4Dhl9oY6nZDD(i_~*V$g0Y z%)FX2E#`kP69}4r3kaJJ{Xrv}+8GP3mb1uG?d|D&qoq*O?shn^TllEUAwEK;#}+u| zBeAvSc`t~oCUa}IOaB4{8xMi`+PSK?3iPQNIl!MDI&OB%Vw4$a>>kd8E;X0=pQqA& zpYbl&?#E>PZkPY3f^hxEK+==5d7MA{pZfZIyCWzkXY1`z29@Ht53@4~&CFsA5rL3! zFJv4h1P%qUemO-DCO{e*LsvhORm0P?^KE|%eEgWQhkFo0xh60~)nTPokYGTz_1<7ji#SKPuOP|kAcmvr^R6&8#YxiLE`J4BI z7#;n5!r(>wZQ(-RE+c5M#NcK}w_kY(7#5;@3N?_fQb%-ddtP^8_#2RBd%to4rX0YM_AXY(JKA#`@|Xf1udQ_7+T2bkw$S81wx0ISW4-v~ zvc3GlRv!nce~kudDa^`XiJh3|L$upoqx$u5YZ0W>g7EgL{<_0=_ApvCPFC}QG0~9N z4bXh1G$HGuYl+YHMGFs-Py7q6UQ^`nw+On=|r_GPJys=Y(ByZXDQeUKrB@CgM9*NjEiyPw|ie%AGC(W*#=4l8zzDQ+gwYC3mcJ zSJigJqN{O7FTip__s(>gVegzJ`6rRm&%+Gw{@j_AuBWn7t`|cH<4{LP_Y!W-X%Ba8 zpF+FO?>yu_j?K+tI7koL>!EnGvlZRP-8X{=ChpgVENa10NP9S?K!}j1)(`l} zsYIih@lhB}15>4Dt4s0uEi9$E4HOUWBOc%Y z0$|m`IrJo04?Va6=22OwGL|yYNc zB?t=(*JKbPsJ#L@4N#~wN!iLOcR5W^C7k;ac!-8_^-PI|nIen0<2-)&&rG~E) zZ{CBAH?KLR=@$kt)O{8yvdmJXBrrB`ZQaCY{^)H@A43+j!@{a*LFkTYTsB8iNqnjE zeefs4ecn_iB%I+>(~Y8%!aoM!hT2Y#-qADfVus(1u&<1E9}mjZYk8G|;*aUvq61UnOd$(~dD z6zdKx>!?A#q!l*Y#|7NNV`?Kp$5;@f-qpHYMM9v*pA?3U;(_M(!m1cW{gasQHnY}^8ANN2BIWgl~9z-}Zdhh-WJ@{D_? zBi}Dq@-#9r^`(skgyfTPkJu(Wu_>5kaXqNUQPzQj0@86|W?@8dtmVBQTb1mu-Ur=I z@*wvy_#cVD9oh8VLT4C%#1$WfnFnuGhQVq=k5wUq$OCo}r`v;fq z2z{QfFXOkB*ID7${O_Pz;ddyDU5OKw~g}S^u$DOx(Kn@(m0mCC^Dq zhtggO1~CvfO_Xr&LM-$gdeH-kpyUP?4s!dkx706>%Rr)8?8SS|K+_nJor zo=ov9%&?2KzRp->TI4!zwm41`jMYo#$OXI{X=0orS>>q7IuQheoiniypG^_&crd^w zQYQ}Z^hNP!DB?h_Vc{F3EhJ}1!ew6P#yN{k|H-Ir6Lit+$THvsU+Ly-z3G;7+Yb#;v=RD*I;}3TxaV{Ta04YbeeJ|KCUF}v2kfwCIJD0^6~M1 zz+v$oT99R0t-O*%(YZQ8$zM-R(p4N?)qG*1pPw?W9v0D#S( z*|j232Zfx(m$`hRNv`q8fFq+a1G#0-EN>ML%F={e7XxT{Pk*DETg3N+&d&-L>WEjr zp!X?dP}B+)3^1THK+*6sSLGfKBH|wd*8;Q(*R@k^(L>wTrq_or`7Q+%XkwOP^3*A>@oSoU{x>u3$+(*DwwO?`NnYH>KRvHWUJR4Jy5ntz*!1Rq z+7){rc!hf2kKE-KSs`tcy=<%{FGevyLZ;(>M2W@|9eI!n0tC(0?$y&1YdYp6eai%Q z3-Jh!5i+g-`I(>bDN$sKCG{N^3EVl<+xTKnpVl9kp16I)KlIIVumq+dN$gZq>*fq1{y&T$WzN$h?1D8z({06g2Yb2 zl*Y(}LWe+vBR+15Hy0>`>6Pt*fwU1L#T zR{-4-&ez3+aG#20KD0YzcmdQ2gJxyT05hs(^`T6D>SjkbjTt&LxNI~$SLLZbSQO%E zk;PXWhR~Euf$jpx;h-P|0vgkQBKi63g&zapR6(rurh9PA!PRU&ocwXS2eXZ0@V*^P?QRHD z2Al|P(OsOxIGcbq&g3uki zbcIMcF3K7W(!ixJ>HxWdz%8iL%rR`##f45GM>o`r?@8bF@I1k40v*@!^oGu;!2ts-OJ+Af^4VoWlDe5`s8}??<2VYJM zxxzb|M^yk-AJ9(%9ya*y8|)_alo#3e+c^ZSp|?MhLDBSwI{u?UygHiGzgQ2C*P%WfGhhz{b>;L zzsM8GG|w3#nT|5j{xx0_)vwn})Hq|ct6MYhhMq2AM=B;^cKa@gTDme+W%@RQDcXz( z8q{5#iAf>Q$^Z96 zJN()MQG*-Lb5_>A9rMsJ$eA0Mg1MjVC?%{cm*HO~X`Djh)2Ov8Qs-gZJ|Hu`>t8L` z_>tH-l)sMMKY67!>^tfKEp6TIbmWS(ICS|Qw!AORtua*L7Ji$2kVfF`?J-nfh3g79 zNC{wMd@pkA`Mon|Cn;-K!7y9(1^i;e6h;C@OGEewiF-V)W7EQXbnV+vT!dhKrJl$J znJNEi{2h+ou52Vrl{fVxG$?%-=Uvr!DTEH=o2 zFbPk)KM6i?DkNORafIH9N~*F!1PGt!XRjlnI-jWAuI_25SC3ao-;W$f_O;o6Q(R>? z#>6?+V&V3JrvlKY3VuHo5S48pYj7>^m7ojA*>15HxxknbZ4%U0q z6~r_tQxU}Cw!E7&y7+QOtY!(HOVE8`#@;u!xLba%kUY;Xw8aJGINfWBm10k-(-g}* z{Kxdy&gQt}UEXFp<^-iu9lPzCbEo;yyGq2ra?rS6ug03MhtHZEZv8fnom{VF*!(R- zcoK~t>4vu@-7goZ${$U{i9w#j*D}@QB^^F0U+6JXJy#+lPZdoOb#NMbl$hRc21DVA9JBivJtN-vU)NDr6?dhF^K$gB&?~sy@f?)4<({ zlgyx~B8ZdX%)zoL`Pz?>4gDcd7aUkXo9ug*GOP~~3{o;QYgm@WtGr`%zs!soh?ki- zlH5;PRS;#>p~s=Ui(7D4wNYCmg-Qa$I5}5K($s+gNhCEv1^pP(Gyv13Vr1~~!;#p8 z&VfE7E8f%fdZdodTrX>&dx{fvUZ0Z#Xz(Sw-&$#Dn%i;vR&UeV$8F`e=XK5d=(geg zHBF4vjFeeov`rh@pT~DUF+Xj$Gh&F3z#0MMF8t#3GPiwC@O`H#oR9i|tm!UKW>$_a z*^z5XbDh*VJ#lXA{!X8D8Z=#Msvl z)ic4syX`}=S&-ZziGzZOUP;RKmcj*fuB zOK88}a?4jyeXb7E#G~?!Sbtqt6_bK-L1H1u)e&-a%me2}tyf(lRgsMmg^n>BWM`6x zxR6YcJt%f};d(B?d9!zsQtca(#n|qJPQ^xgJm-J6+rZduHP!SI^lp+hNmqkdyN$VI zG}W~&^$iS|(t;FERMQO;@62GoYaF$~xv>Cl@=xQOdx;yvQAx9E5&{z(C4{F`cqW^M zx))&TDmtVmt;c8(b9>wVnh0^lJIlAcW)qU>ca4XZe-;XwzfG{7GN#U|>uJzJZpfrC zkIoV?JKPo&Rv~GH{k^B=N-8O5ZZ$xhU$75OSskJc+Ikch!mhHQ-s9i><3&|2BEgOQ4#_f2+Bk%YToUc_`Y7K-~LSB zIne~!`e4#at`Qkoj5i%cn^do9ykb#(j1Rh$j&t%Y|Eu^^?v-w^DSkeR}fEX?{9`e<8eivq{?0JI}Eeiq|;3+vsYET+fDMZ}C$J-VGI~w3dpNnpe)e#t~+< z`8G5{hFHZq3obXZ%Bgh?=T^kBp{hq?QKDMez~i#Eg~{;<$b`8-FjO@Y%(zS|{qUvX zyJuKHt=+nv@_Vf;Xl)x!WjmQdn|N)pGRCFT>)mAEUwAKyBxC4uKGJIl#IoIqd`cbw z!x&rx55>K&kneAk^>Mcc!7kzKxi`PqWJzcj1@DCDfk+Dn$de}Lu>KL_|9?!q^M4&- z8}++m+fI|lw%IgRlcup7+uCtsH@0o<*!GTXHMaHUdCqyxd;Wl#U*zSC1#;7N0XswzFuQ3s@h5NNM|N+*!?$f2X6 zq1*Dh)S8CYflLcr+xhV}dDXHw&!rkty*WQ6P-v6FuSfFkxtQ6z=%K@6d-0OF6AJ>k zb+VJK!cDFFD|JDhC%voBFkq`4T`6aIAFeN`B6QTNzg0EtJRc2K`N+*o-=C;>a2=jI zU3^1W_dYb{5!|k8R!dR8QJHOp8lq=E=DBl;Xe}VK)2P83YJ%K=b&K8$!gJxXv58!a zULFq|mG9waxH!RWQG49ce_xNbu!a?0bFEiR==tIM{N7=p8OTw z$pA_rWB$sU_#Ye5NuOC9k$TD;xgextP+F>VNH1@iNpnMcEVqr*Dt&M5DoeQq`b_>7 zg(yMq5j0`@OA(E+k&$mjB;YjKILUD8N@LAey+Zy1YE4bi4gD8Ia-_Uo#7$jLmEdJyM~TNkbpnA9SydMBZYq z(z~9tuT~bjs6P#rJYUzbuy*OdO^)dXWlgc921Ef3M`VKT5OOk5IbQi<$iI4Xz&iR z`LIrw9P7w(+ur(9oi3jaZH$93XA~^W@|PtH+4HPSf}WSvcJ) zyC|M@rk6{f%v@o2IxP3$o+C}YpVhN&#UjhjxyCr!f$xJH-tOm#!19Eltr70*#?tC8$T~~O;m+*+DeDTQtScwM1+}%Ymkp63&1X!i3C_`!s%$_Rx3d|T z*)~#9l87=pbBI>eMf1N4DKau zT`rS^<@MU0sTW~q6!t|y6S_tL>Rn56C27;d!mT37j`=UX)arBlHj&+OojK1N4cGKv zTnMv&>L;mo-*w4Sp*&t<@KU={e`Zu%w+)P!FTIVOjYGV!SN@?^Zc443Sz?w=pLqY( zn0D?(JH#Uto?rdLijC`&$WvUt-~{binS)AD0A>s&#^ zY)})bO|sJB47Nn0(069a>DPCj?lUJ<%NPPN+?>d#1r4?SGV*A%{p89x@t298eT&zJ z;xrhJJ_&5HudhD52fu6zzM3AJ*lL<`J-&nKyOeKbKfJ?crWq9UMBe`YK14y(lAbnB zZj!)RIAfP*My(h*wn@4%(lmC)ZX|ok$ofdp)~zH}=;kjC8EbkBfQ)#oSk~fD4_a)t zHC!ISTAG!3I3vqd`0-=Hc=c0~Y8&Js4w~ehIH{?A9#SDPrA!@&X0zTf&^h>0Vxa|u!*AZDwE+vT zi}1SiN>yqjSM65I)o^Q1e}zw5-}QsW0<5e0fxOt7$Wy%VV|_PyA1<8;C)S1h+T+bJ z(E7BSL=J!A*>{7IEFfnPCCwwm1pXde7(+0@qYVEQ^b5{wM0ga}T5|qePSX+=W)&?F zerldIh9=)CHzs)bT6hj1R1{gN2kBNO30AHIwd@qkZNDw15w>xX-*8v28PU0{;fbMA z6a;$4lJ=0@uyB6W2BzDMW^Z`y-nEz6mD6*x_-CMS{XH^@W8`;l83f1)gV`RuA`L8kd>MVY{y9jf$K^lz$Lx{rh;N zp_L&q-K>w%%2wW5QhvHKwe+F#UrEMBp*br!G5S#(7&Y+}Hj?r?gV3vJVGPdd1uZNZDw}(p}k-T}wCfCHhD@ z!lQv(u%VLC@G(=Sp7HB?Kk*DZw>R320zdGdsJuZ8r_JW|BnjLK-aMzGuIcLEO(^!M z`;6|k2%03JP1ea?rA@qN_vG!U?|Dr-zad6&2-{VnD+2#6&6mnXv{!7-EozUnlN~B< ziO%QK%38F6Vt0-~+l^~(+R>TI1|Y5reKB=wV7l1IQ0GZygSpqreU=mKbH~pEud3%m zipU>LEnnLfFA8yUKXI!AL~Y65ICj-Uxkb}fNI z5i3w_Z|QAir^xk}A)TEg{R4~+;=5I~!Nu{gOVb}QbE!$1I8#8U;A=61e7j(Z#>xgrxoJlw7)e&$tQfphJ zLCAU0-|>m;$VCsMg1Ir$U(kk*A-G)8jNBgd8r&bGoa|vgS^9o%!?#Nx-^on_PH&6- ze`l(eS>~w%@^7!0w7nqq76i;A^0)?m%k@00Jt4u*Q3dz}FYNcXd18LW=Ea9hSpTe_ z`-avbqV*e(fYDmdm)VIz8czg&M%o3dOqCCwUxXQGJ*f^>vXoxmW*V+VeMqnjK?5E00GovVf25#;lXf z>9A``X31=OVIQApdy9uW6qV4}BG`{VOPf$OYMsUR?WdsYj!H(h)QJm#abinq)r*O7T{XW8LCSP90?DliCSoP zsp)}Ww^dIf4Pwj1eBwZ|U+KN=TOa!DF~@Mga6&QDK<90#K`&;W8afIZbI5HWOwP%l z$Yoy<#}>9kG{@4vpisE&kLEL}mQ+Ap~F)EY+KOudQn`brxs@vCTQxv458P z9mSuuBsdg5vLx&0E^vpGdmO8whvODx+ik-(`Kdv^JXu#)oaDf>QajW$pP*A9MvnRa zD4P5%)l3jo4`{pADN$Gcg_N_P3gK3}G%i#m(Fzi(6e9*yvz;obSn%1jy+e1_y|WkC zxt4z2SPS*CsI5+XNu*0|J+{FzVXP4>WWu$SYhI@dfjI&VE~)r>;>9i!f_yp>u0HeG z9|_67V<)Pg-I^NH;>l)))N?d17;D zCs&fxtZG2V4XW_yS%hYpCr+eTG5Kz@P;UZu@yEq;#239L>S@E^bZI;}^EXi?1}s`w zum`aD@mfOH|Bf{-W)krVMoQ(yBZSVM^TZoxdW|Ow=y^s0VN#~5K7PI2b?fWPeVn7x zC(g%&KUg)4wyFa^X{$k)JvZ^SWpgnV91hCYbs*1`8N7iK!$> zNp_YA)jz7-kZXC(Mdqtob^~fZXr1k?21rs9c;F zeqs`OB4R~cRPJxaxOh2rw>DKS*mPT+l}Yv)dnc=}#*6H__skaEj`DF#Ct4kGXg`!@ zDNn1$$F0ZVyL^oP6Y}+Jm3Usb@(ftJv{6xsckio}?T&P%950`_m|0HOU%a8__=tm_ zG~aV$I;o}z^zsa=|b@^dq6v$@FZE`j7ec zns)qh>#j{_Gtv?Trl;&5jmM+Z`psmV>?e}wux@Q5Hn&G@Kfy^ zAZzJcr$WM3GN3qB8+?>^Ju_sucVd4g!#~*G*SnsYto@@jG&Mg%&^KpS_f1_m&%-lh z+l?V5mC}usuPAwiXcL>~`eM@;P^W-EW%wbT@hMllpq{;Vu9!O0iHr z{|RR~Ak!zR0*EfSad>`MARNIrKnEp&(fIMqpX`OT(ca$EjuKvEI`>bc~A zx{p%=m{`2@KLti`<-7GOxmWTD_tX6vh#IyX&dsPpcK?lcy032w`L%Ieoi1}+t?iFp zy;^cG``NNo^eO$r7e&&n6l@iw<=|3z-?k0w+BTiHK|yx6y&&7O|m&C?rDy8DnJ^Z|~0AWrP8 zRZJW`dcu~CijxERPVS%vI2BL5fc69GO&ottv@O?R@m&9>s|-$YGw!de1oCp|!gTTC zeQf8kJ>=bZOv2j6GCg&#=$QrU68G9`RYuFdR0cqTizXu{_kYUUfo}Wd6rc6=z#lw1 z1ZZxUtOH$hf^SOX@z{u4seETzkbOtkIqNvAp&nTlgVFn?R~m+K(NwhW2pRlFnhL1s zb2U*t4$|m6F!mPxQ*0Brp+7j?ks^=WiW8U%wHaLvoN> zRmYW^feX*Nz;+qu+ya_3;Nd8M(-TFnLe zQ4a^ID;)V9vRsj-f`a;Ty?c>s*~-4`{J#5V7UA!^Vie#B(1WYay~Ap-^Y*ZbrYwNV z(&0+=u*t;rqj9*soPO-Z>+H_8 zG26}ZB8`ms=#~0RdU`vp1TsDAa7Dtv0N^d1WT*I#N?T4AHgcicuR2Z4NE`hWQgcPj zQXGGh1JnWKj{4oY-68ju730}4`w>b*`}MvGU_Mm(K*ff<^(xy;&_e0ryjb^o;bX75 ze(1;Ra49dJS*3%DV8~kOkAwH!i70CN7Qbh|$X^w`o_PivT0`&K|(Ym!Z$wHD8`u)@FeDOTwlK!SD*sYRFr~cl!NTAr@6Uv?zv@J z66^e7dBu!jiMp}82pynrzMxf14Pu$$?gkAcx|_ZmW%Rx8(<7l1z0SGE`m9p< zfaJ8>o6`a`)sfWGoZXN0+cMS;zfsS1aD-y{h!wG+p5D-G89$CwAMvzk0Vst(n*QEL zZzf37y=lORk{T$vx!^(^iY;&+<9qqeam{cuK~RmYWT#PI~vkseGE{k_42mU#sEm zmYH`Pi-o7b@0r7V1(g+R%IKD8-DjD=+baX+NM0Gq=bPWGZ-kbEb-cWMn%(O<4ZE3I zP2U(D6N4hzJIlR}s|$L#)JcaYYeVkiLjwO=7G*?8A9U`YvPAQM_-65~BdMu2Xq13T z{QN_G)Dd#gjgS+h@U7z-oZ}D2tO98FWV|T{mJMPT{+5Fe8|`qXcm;`sy|KHHu;bFB z&D#rh5P%wTR<_rXZzsy?!Y`<>)^ij78>_ zgT22OEf1BCBW2=DuOjrW*6N!zAA{W2#y9CRwWG5=64~dLsRy2l@9EUXN*VUcUdtT2 z8eZkJL?XMAO2K;PAl$xi1PV7~HV#vu6KZdYnzz+xr0PMkt2rT#TiI=yL)5*>O(n3Q z!s?U2%xTAdqu%`X&WgVpU#vghdGbH&TytrUMp%izqJTc!?(SMQYJqgN`cFf zPAU5Mku5=TY$2IyT;8gUIOTxS?<0HEHuDr;1t2W1R-v~@mV6nt{MyR%y&&AyU3CG1 zwB73a!r>?#~_7><*$e5}IfLuct&o5VnigJj-BK>%(H=>X}rMh5Jb_rdbv zZq_cGd~Lt1GB$svSK(5W1+3p>1m59JHw0(Im3sW?d0TXU^~bYFc-M=YFWcD#q6V3W zYYJ08CGj5U@BZ~AtIat`^;zGf4e5AZj;#n;Bl8{A=fmW^(B8eMch0 zy^4TlDj#8esqfs3^KW9CVRO#dBR&Ad&jm^06E{ik+Lq`Y@Irv^guit~dTQEv-fg`m zAb)J{V}4F8Kf%D-;f_>zr_EIr{>%GtyzxHjG&X05aGZtMZxxeWfZT9BId3 zcZM^V_R-U;(wqv*0lBS%!;LJaO?_b(JTT&Z{o3MAh=rP5ONM!%X~Bz0#t>+uVg`P+m9^Px~IJtm6~S0utYMo2aNM;;Ry7ZDQ={y zV_<_++LznHv&M%wD@8oYLPRpgCsxC&HAT;2P8Wr@1+DrhtUpnk3 zB$+nuJck0SPmNeDbrT5<^7W6&f!Clv{oyF;RGO-BYT6>*UsB@eOxDxsrwUyVIBQDdt#9&lQir$36;4y&1M8A0QqbaHO*Dnf`8hFT9v%PFtkeosoz(wXqIeUg;C#Lrm=*g zUaVTI-9@|kM}=~|tW2MprWLJeKC1BmKk1B)E*Yv}hyg!e|B0aUG8E7Nb79rRFF~#P zB*1+bUH6)XPC=Q>dCd}epsG@+In-WX^`E(_Y|6*t|IStYyvj;HPs;b`TJcI$6e?<) zBf(26L);5jM;dNp-Y1xFsvYRb@J$e%6mx&c$>Y-@I4MGgbk+xjtHMxXa<>IAIHb-a z4#2-TA>8<~h$kpul>Z3zmev+1bVH1DAvd8Pb5)lJ^<*f=QDfy~U_YJi5gbC3-OZ%v zOTZu8b5(bU+@Eb?6)R?i+j*Z%yI&{?!-GT2W9<3ma!TH9@;TY;FI8n3 ztbSXm9z4YH-&JSYRqvw3L+-`x)gP&cN7^|!gXm7`t!_yDtm=Yo=Po5mi3UdJw8k^ze zG}g0WQU=D?t`J6;0h~V@i9XjhXHSnkv*qpCVJ@?Uus1op_#MGd2y77;5bnninR52WC>k8L%r<6`;C8TaHGjJF?T{CFYu!efJHFx=Kt>Dk10lSG8?sq za5+pSgcx7n4xQ@*jR!Ddv>mLX?j%^G-6zP)>FQ?E-TKixvU;zwf@guQMCy5&_5e+; zHe17Fe<$VL>kmwJDAn#ciVOSf0QcmLhWt$?_~~+Tdk1FxN?%+8Sv`D@FCn!2mcTYk zfpbHI-Z9dfI-5kPP6`kPN9)50PJxWQdRHGkN(kYmJkV#i^W7lC^N*z7iZ#(eF{+Ws zW-kohpvhvR!jawa!_kb0kEk~;?pN|k`Soj!;)Q$!WxH<+P_GaA6Vt#%0({?ys@vAd z?2W4-ua8to+#%T!ojF0y+`KPkNhN810iNHG2@$?R0F17PM6F3gRs$BKm+R2FRLXx= zDhq1)y;z2<95AW{_(h6A1}{HY$OY)}99Oh45SuiQR?~>$=6jwqd0o|=)24YF!kIk^ z4iB*kv^Pm`f*GYAxClli`_kRke|g*Sw6l}EFo+gr7=I~W0x=oTtwI>IurjRukmFI! z*Pmro_0r0U*McOV?wpu^GGEp4WHibMcSVT0R7Yt*hdXfPcCugvv^xR8+1TIrcRKDhyVk z7Wo9jv)DD(SKikEWz!qLyu(I|=q{(j8M_I@`98rAmN1}+>Ny_6Er?&oba;Sj7Zd*1 zyL7cQ1dpY-sKDYPG^KeSI;$?zb;{2rt8*{hh zpUc;x{Lx#24(Qtltw0JTX?q=OaP++FR1IV+igj3@J47)1>&kObjg1o{H0IzBeg+yo zgJbnJfA$o;H%PKWs6Hm#t>!5hPN}y$m`*yc+=1KNR3AC&r+AT#5wxQMY>#ZcHxak5 zaHkBbLmkBNmu|TQ-?i^oH8@`_${XBPrJwZJF~L<%r(Y_VR~yc#hvYj+)w;%#g?x_% z<@C=y9O|36r$=>Di#%Sq9DE?(5_;@fpFCK?VnO+1Ur*c?;hT*2NT>KS+wUJY|5fff zPCA5b@svEgfVCIceMD%Vw z^hxKsP7<3WI=$cTAvRWvtDY0?|0l$+eId3l%QYxLKlo}wa#lo5FV7&aT#OExjJN8L zwWvU|_^Om1io;65*lnGTKw*F#;9SmzneTN!0PaT?ux7i7-A-v{b#R`UgOFBTz-pFZ zk|xy=s@6?K7egc!>MTG}C{Mu^?bd~m5uOw?Um5kjUp8Z_z1)9%LhBOQxb3!5U9!%z zs4!stBje9q^fk+UC-w0*`_&_Z&zpPWX-lbJd-Iyx?+=c3B?y3z&HO7R(rH*nv5nR| zvF-L=<%hx{yUv-u!tA9NogyzFmO?=YP@ls@kNTG!HVq_w_sEoghWG(+n`*zrrzTMB zKUmR`kIo4zOGR$*-qJl<;a;uvY)107z)yZ`z%PK^Tu6bxy2hs%1tE^+6)Qjm>) z@tDz+aPf9gG_FStO9rkaYH9<|ahTavCOZ`-hX34jVHtKHip#%zo^0GOIByvq3Oz8O zSazqOBPer5%I}sfDvhX(;IXix@UzqUqc5+PLNX_%rm~}o4_SsV-}1ja%6ikPT2hPC zUz2}n^RuA-p|H*;h=_ygsbV7ELL zbTuTk&(7XMijcRbha_EgMh2{BSrH~KGyR%`gl{W1r3oWlsT|&$s15ahpSsxf#hsbIowFIFIowJhi39Xn5_QmVGqEE@i__ zCi+~W+dC|TGaLcWkYp0Zj8JG?l6Z$%*z5fx%W8x%-X@Dp|F=!n2n!G$o-q2S zWoe60S7JiFckJ`_y)~{OCOOa!ckxY0*l-F-y6&>di&qOIa+`bNi>E$usZx z2wWYmHWfeOUO?7v+^)LXu8Oy6^gb=XuG{FjM(aMwA^ys_WVfj_;m3+Wno@yo4BM^T zdHj!chxekobGS|gUNFfRz2^yAmEa1uARswOOaR~ED%j^#@O#eU_gvtlu-YIYUR3=y zug^dIsJM<(T8{-|b?-BjS{MBb)RpU&>&Xk{MYX_k?0@YC;tKQC9e8U@n|LotH|$c4 zBx{W$D_?q<^$NZ{w3;M0U<$OzY2AhDB|nEhulk#g{o{3{tg8CNu`wiVNZ*q5wI@8z z>{1jN$5Z}wLRtN(>zb~G6uUUkMQq2AT9g1{6;e3F4`BmE7Eg-3UX+afn|eI&wdm*@ zzT)5HW!@Qu+=~9*Mk)Ad9wPY>^(OwGHP-(VvQ;Fu&&$h-5}nD>o=%NqW+kwI5 zBS6cd8l#K*s9;H70Tsrb-F)izkLL_zF0i?d1qFOQqs!i<^Xu))hbi!BOh3%d`(^cN zdCL3CdFRVHK3uM|zy~tiV5$9)7+0~9e(2319_u&Oi5RG%1@NEmmn6hL&5Ps}2UAzn z@*vfVU8&SA3@Hlz}J!t0p58R-Z*Q5-0W z5L71O8Ji-Dx;6)aXtX8(Sb=?BMusM=q~1F^!22%MBHR{ekjsUyv36aQXJi+7h2x^1D9@wx+9zd=%hcYdoG=9%|s zU4V#spsu?`T80|e`tnDslU3cRBF3QcLn#8;rmHk8*V-S_FuaF!*M;dtpq{ExVkxYR zmm<^ezArQ=Uld{%j>w z0Dr_u`!@bR764I54dgEp==Ji|9AV9!<8`&=jo1+HoCSl56lk>VLT_}R5(iCaUJo6| zhI=j~a@r(kI)GUqz2-fl-Sg?!xx`qB{Kzy7+ETpDiV=C$SOw*hOZghtuTlh@Jh?>* zpIxY1f6SB4{>BBAHx4g6C~^!6jQ#Ux-baOs8c2XCqo&j9gp@61)4wh)ZN1i-)qk;N z(LeL$Smak|DS1@lIK8Hu^>63T)@oa1UCm@NNLhz3R7-Z2{RGLl=mk%>>0D=>z;+*b zLalorduS+_b4m(aDtPO{=$5O!^GnK>8#^pWJ!B0zQ+?lD+y>1u#HxhU)e&F7L_C~k z4hVZvF09-}${tp>m#P(1L3aL{?gf>!T8Rxodlt=EIlSh8)D^W`+=j z3N`^tG?{l%5qsYSFeOIqFiYdQF02npMj1a~Po0ut(SBh(%C!yGJeMep?G$Ty&BPap zHj^lGXgo{LT5TMv$(o0NH+8gwf)yhblyN(&(~2(JN=n1;5ijubVet5&Ch&FIQ@;I* z=v#(vSvMrdw*=P5fyP&TQUnu|=djx6K*rl$fB2Xa*-J@EqxAA1G5{$R#KFfv8ii``xeYG!3@bT!(7L7Yjd1OOcB20+vX~J1PKfQ477vS(Syz>7GY)pny+{$P!@rcKyeo&OcA=WmR z*VWJnAE0W`aWXoTz}}u1LF5oZQ$1klHbCci{=rl+AmD7jb-z z-1>#FyZojzi@l5elheQv*C|xr6AXQQ&FUk2axY}FOX|HJ@K4XK< zo0bWHP!AoxZDrnWH1n`~QK%%f_@dggf!n`&5p2FVbm6TapZkGoaxqF;@R6%lta%!{l5_fE*14 zkxLhza>CI(Jy-r^(4!d(%_rgQ8E_Hfcy?>?|LFtGlzdxzy+M{P_kN1W_#)#D_{`4W%0| zXpbeehB_PGITosl#)dW*8%xem<{TE|@*4Fy*ry~{)#8iBPgeWy6J?U{+wIx~&%J2h zeU_1fcxrJ>-dh<67%r_@(@6ys{7`<;ms7yj6FxPOWDE(6buO~GQ3lMV-r_x#jg&+^P@rnV~kU5X71R&nyENm&D=G?P4#n2Om z{e~3$2l6gGLi(2q{|RhOL_19WX`wOvYoMj8gUCkOA%Q^*$XeG{!@s?j)7FA)T_aq` z%B+qgvT^Fl2iXsg1LcnuS{|Fyr6kg($!T0 zZ==29L~%s*XqiEKJJ$yr8iryym6~WX;K6#ujp5%4e>B9!6vjBd`c)|57GD;Y$#`EC z$B07p!61dF*Y@@rc|j7LNvhXbQquN8Rd?+3PlIoSw(#lsSG@| zD)hzmYubxY@<0ocfxD_}6wSWlUOP}$JS)n7JHMJN`!YOED1<@qi*52BM|rJ>6mf&~m+14n=Sw*4jS2YUCm^k7>BwdLG;?c?h9 zj~dS2{0buXvw*60Csh5@`bAFOkoauJ^6^99Qkuxzc2)aI7HH9nWJhvk#n!=&I*R}F z-YUABUR^mnsptToNb}w(lI$QdycFL;OR)=U@D`~T%aEAujh&i?G270oDwr7+OZxQw zm=$D)tT^xtMz%3hs$e|_rTX&Xs%Mw;_ma4&)gAp83G@H@x;_cHiF{kcd}y^s;>F5z z!vd2Mb~o1p=98I*y%PmQHri;-KXi!dYv!V(4@Oy#M8YVZujA$WwWnK(u=zVI z>_Ri!r11HhITqa8_8N_+pvNJ|k-s|T?Y(5sJ8T~p(AAG~f}6grUiA*h)wc2z)SGL( zuT6Q=>h(kSb-gcsFbh9Cu?+Oih`&~Ly@k0yZinm�cYlY(EI&+$6IMoormD{Rb37 z8!V-O;fFf$ldCA8a^&?31H#?9ZB<^!3x8=@RuxV)k>LZ;SQR#-AEF&ksx_*A4F^+X z)WEF6)$Ojs(Wx;YG6Md^mTHg@%3*NO%$VRTAl__om!&hHW8JPDJw})>26xFBImZyu zSVk_NK>i!VpcF>y(6r@G;|H$#mz~C!dx%TYaIgFEeq?@_PAkr71HjguXsDnx8dx({ zX=111rp!lBV`8Kt-j}BTY%dc?dzZW>law@4`>KFST|U|Y`3I*WImc-9Y49q0Y8Cp! zTI$av0=EM&b0pPju%0@zD%n+aW8U{}H~Vb3+1+jc4?6FSB85OQJqIy@#A7H|Y2~29 z3lY5kFD~+i7L=isAJ@c&sPx&!4N(pHgN?v;^_NAnP<0rqhDj9UVHgY5ZRY7nAHD9a zMBFP8c$pFZCiY3XfHXsFxYjUr)(s~VoYyJg+d#2L;+e4&NfLG!b)EUU(l*!T4aC<& zZnE$_;}e~aU;{bu4Wjopu4WkE*$ka+eF8HMR+@CGaToUZZP2n%3^`VVvWU@gq}tpp zp=`IPhIyIMk?o*2BwMnzx?;65uZ^Lcg}1qf!K4=&NPaw%b;|w=hru@3FO?*mX0+)5 zmM9(w{l8Lt@+c3G(Yi8cwwzcUWq4LnmDA}iTx1nLyzs)D<5?Aa`RkXpDoS2G>*~LI zv8KA1&(6B+-v61^UpQ#gx%P0h$Myf^#3IFq??nA81YMYD)~{ptaubI21?T9SelCvT zyz{m`U%{jV)l6*S$wcvD_F`vQ$DY3k+85_9#((Vkx4ma0eJLHTUx7MWMOo&?9FZZ6 zngfRN%*2F;0O{u}Bqby!KV`gDfW&Im>>bArr@2S2+`rEu!Yn%>4TNBmn!=8dx#trv+| zd0EAY488=6C{|?oFds|_lO-#5p(Ei<)%W$WrCl`Kdtj}(boQ6XkPWj?Y}!tgV^4U$ z7+Q=S99H{mq?Vgtm>;?gG~wl}>%o5Gh0_uvpxBIS>^}F5|L*v2z0!mxXnyQu8PJJq z(^lwP$-BB)xxWT?&+*G0T<8>!YaC;yuUw*1)!OA5tWRV!xaG(T$In{L%uMGTCdw@N7G^en|BJN-FC~ra(%dfYH#vFxj(x2pJAl= zj5jvTiQHQ8-(2jH{mjH0E9Af9wIg#~&p37_CrlwiHE4q0y&MbTH&J0*TjckIV$uuX zew!%Net#%9Bj*IQV^s0{@>#|343xT{6uvmO{TRL1xjY=_e?h-8cnO(%LL-$2`Zmv0 z%ge{uM11M)qbCd^-1J{Nx*i^kZEgA9_hz%BtAYD*?%R72;Hwvh?cN~Xn;lK)z==n2 zhzR<{8U8GUlZe1u*TF~9 z2uPy4RI{XI;6ce3vxiow@uHF1Y4j@ERrnC`vLiIs{JZ{;3A8%be9@ctnv#Eze~2ZF zTQFzTBLA&gXDG^U;HPiXO^vMjZseVC8dC>&34~x_B@YA{bi*Pq1%C}l8lIN^Dzs;h zJGsCyJL~0kmiY3X1blx}Y)?;A(^Xsltb?0h8wOsi6Y(ry(d=YB4uxUSL>I{fdo(N; z!LUy^)Cmdh^|QN|gw4@vkqGx;i8X`sUh$I{W!tVZ(3j2k-Q>C4=`J|9c5(2yeYYAYpdB#7&q`T4!Z?!_qlKjJBJ1X@7Ffe6&PiW3ev-_b$?KCc;&EY|F&x% z&}W^8$%4MkjSpYe?WW{1F?)_k5pYkR@?zWU8h>+?ufLq#X-N}Slk;5?{~2$)iu_$c z14_Hln#!DiWQVf))R4hTbon_FOM%)@)ttQ5I0p?-y54>Cr5gaJV~9wMg?tWaF#3H7 zRZvK1MY=PafN7A~**UKewz`1`{_=WtM^9skik_wv?YNG4`TeUZ+ir*gV|rafzNoE* z=1iQ6{8)tZ>#vxG{a;9 zK?6NX4-Mb=k({EXWci%xi0zqUgV!Z6dSrPwfn&GqK?{!ZvSk1VZEPR9Ek)445J~SC zac6uwU!&w0#GT*NLO7Jx=Fsl12`g_U4`Fog{=pct)B+YHNMBNG5^NHf#pP8ZytX1L zBzps&AR-^v#B%rT41_w=2f`Z0T)EJp4pEFj^&L0|aFMtIA3fI~fi73yvxPXi`(LkBA8`ac1 z3A04+h8F+fjn^D)uY~y1dq2zn{A63m9m&T+{tCG7Xx)C}spGwCR_k~ag4=B| z6Ig%M4=nU-ogVb^2KB34`gMb?%`5hw=$wGwM#mnNyV|6H4BoQ;h0S*J0g3K3-Ob*HE1iwg10r#Owpx`fg^guBMo5MMhS>^Fz`*p_A{C z3WTpP;v?Sva@f=d4fPenx|7AYR#^S`Uz=_WJ`A+v%p`922Ee9(n&Ghr_wIeg1yxQH z8r~QZ2~cE+N z`BxPv>m32tGYDKzQ@KQ2qG3@*$6uzlCB~)7fdaZHGXW20dMITGVEVo^`7$UP`fQVZ z?0yI^>$l)X@Kg;FW)8eK^q8kxaR3wj*K5oz_QaBcBA~wp) zLt^I$%<(a8#bU|gC)MY7VQl;nQ>*TdXxJDenX38eAWW8t*Wef)An!pOm5kH2jc|s| zhmMr9Phc%=5kOr;&tQz<7=P&+?Nd2SFK8wx1XCBAg9ije2B;Yp36#l>23bB}=<$oG z{>Cfau}og8`K3B9q}EM!)bq7JXw~CqnQ!`=bx2BKccT9;Ko-o#H=4pR__v0v6=kMa z_-lP3imIEysA=2jIe;#4F4VqT^L`tEqTc9%e&6`8u;tf#ehbXteQ*}Mdqwg~5rq1h z2=eab|Ir`_W&Od$2bl6qX+6@`3s1~;JX`PMn`P^H-Cqs-CQEt{7L4@fZfVDWiiW!@ zeWAj5yBW3IqvAZ>?6|Wl9_FWd_kWl=r}#SG=*yqjXxKPuW7|$++qN6qY8u;W)HJqj zJ2^Qgwrx)SGxM9zT)#K(#j_vmz1I4U4%E$NpQh6mlUSMv_!@ww@5y-$V-f7**J0)U zezuC^d^zmNE>A@~iJHz37ajm^#l?Z2g4^VH96l+(t?!M&T+*2HsJAq0p-8+f(5?s@ zGFctTS*Ntbqkv{V^`yCwb+|W&3}KvaDuO54df4~*8Jnt$>f6N%9zMCE}2?`Rl zXO-c^^|_4}AJu+z&_;CW#W@ZmY;;^OXPo6b@vIz>j&-827mjZkf_C)3*BZD`?jXMM z6>yaPLrYm#10CP{vgvLo-``K6ry|?`&sdp;DZS< zT8UlS>3|?26TTb|6h1MHCO#)~ZtP{i51*X=WCX$Q)gdHpXb_l7G46_$hj;-Ezt`nnzDKv}loQgv^-i zO3Equl9@tB!hGaArOUcO=iCjb<`WC=Xb#)dote9;6d{s4)5ftIjd(t*;qCh=_L#Ld zC5P%uR51^6aaGJtzZcKv$yQ$zEK$>RHaZ?Afgb~zdP}5CsLs$$LC5lm`@6K_i)d3B=idb!c+cto|iJ|R3E z>kYT@arOFaEnNZ}2M; zc)OL1URV{)5}HhH(3ZQh3$s}c1f?6grzxl`b1ke8t4A>DxAZ~Dr#(6&sd z_}iE9m-#W*@bv`U4WTCahN5;opSj2>U-G%|rBBK?Ti7r;K`hBo11vR-jPHC63kho`Jb+wG!`*{=y zk$*&H6$dcq?|@(-JP6GULFy3gQHI9YR@YTD?v6~&^@j>2ItU6D0PV07r{R^xi(z%#((4YIV3rSs+0cw~fpL^0)U=DEDQu5vFJ8EGT!lts|Zh`aW_`=R7 z7mp8s^MP*$88tB$hc`rGQv8+`QT5a)TR(P?lBwsW#JyHq(ei z(H6Y+=;5JZ;%-T^A8sqG+#Z&C>86W`l5F>jGk>0tTH13g69v8z6F>!Ty!QY-G@{Y9 z^_hv(yvt#w(22G*<4Ozeu;~IC6fXsKn-XIixF`JEE*0<$)%8VEwESQzueG%jgw@0$ zJgl^#i^*I21dd@&&_8qkRG4vy@+`eQ-%Xp9s)*mV_;vg*dX0jsyK-5C3WW?I7Oq)< zt~S~foErFUk@@&k`k4g>2TTasXNxk)+_uWkSUWY@@bvyw28n8PGsE&%kd$ryR=+@^ zQNXDPv1teOtpL=gBclrF__L?h;=UmnINSx({5WtmM?oa?o2j2=!^WbHI z)pIjrr_MAd4s>fiT%Ds&`EnbDgOp*P%VVHoXWF;12oyyuvVU7_X>Px~Hq{%NKt_l^%&e>bz83YmTnSL38ksb~ujHU=w z8(~>C*SL-dx5yTTdbi2ZmX^3D8ukaf?uSA(|?e)nK$!_f1CMO=lS}_orDAi6*3+zIqHq) z$z?TmRU)?b7B{oQQHV^K#9uwtEF<{6toQQtpj`oufq9`d)}xeSQ>HN+5_cMP|#j`x#+)rRWJmL zI{2~@Mz$4tr5GR$&#Yji-Mg-*`}?dCyD9AtN7Uc#AemqU8YQ+`MHEB;>-2uE@Q#he zJGA?Ph0^|xnK!gc7%c~r-lzt%^L07lK@RSV?!GkNo?)I-f@(K3Mh7G2@YqrzrUROu z&I4$b_4i}<%&Vt^yy((AZdJ<4Q2TFo&47jQKvl#Qn#AI4jnGCFd?f3F z^F8Db&#MFz|h$pw;u}aLaRRq`(vZ z=L2&L3qoK)Jdf))apgqfWU?&=f5$ebtW%%pye~uLwA43E9ZdFZB#)_4A!WqmuHwaV zbQ~Rlk?0MQ3Y=2v`I<3TIQ3KnR4H)N3A_S&t#AUfPpWNYgi#K=D@&{CpMc~l4uO}p$Ns8 zu1#v-*dZ_6!^;5(=dpiCul5{|`SA?YtS@M7CR(stReeF@hO3Z~+5Z-oIqW5sbH4fQ~ z+V72S2VQZH<(vE^s|}JbYU+x4UVjG_V<|hi|lH$!!Zd#&E}0wR3Gz zg3&a>6pDmnYkn8Sn(~+9N04Ds^W=t)|JlLbfDcqE3t8S5rJj<(z6oNZLx8ZxW}&zc zvpw>!%l8BW3KS93T1b1)xsi;Oi>ZKn&7{}kjA*ui8><50PFUDc;pAOodd@arm_}G1 zr$#66R31gXQdf-J6g;0 z6Ox?L5#a!s4SHlyMaO-FVz@qTAN~aF$WOdg>^Ve-?AXO>s?UvDv2rb)*y7kM=OFLuRHvDeR;bJwJb^_+X2rFs~);DZ!9e>^s%CJhsy$dC8UJm4uG85 zi2{oHA3@*i;{tF>+E|eEvw@{ej6IW~zu-X#bAJeFQ^iN`H~;+$Pit=ZEvlZShUVB^ z{VKG|sJ)69{vuV(s7l19pJ&=boDoxT%jD(25 zY6o?$U}D-j-)jbAOv$WGrpN{Hw1A~vrY54Bpm(Jszvk?jU%6Gfz&hym`JlIXgE+Km zR-JK%W#})R&ii#z|K@oHa;wNNT7o8Kv&*}dcm4(2TceM70VX*#JRWqY$9A?kSK@zo z!rf^-5QFo6@s_Jm0i6ClokYLj%)0|_Cf8gq0WSPZwRVzblUTzN_(%Of%P|u& zyC}$IR~9WG2@O8+?bid+(KxenM4q5^MzgLF8|v1AygeiZu)}v0O{bYTSt?qqvU)XNl#({C=@1_&ycXWYcYu7$|6i7x7r0V%zzqHQ}T@FIZCI z?cG7uaC5qyuoDa_y|!hP`q`ZYM`_$Q$O4nwh#w0Ba`AAg68pfmyML>%ZNi`%kFq|t z%Dv9v^!3gRBndUi6k*5l-5+vij7q;dj!LNbyXSyn zmsU$Tw2Aq*4XdsjPfKbjR2I4hJ}>&F%yi3F1v87C@ebBm1ow!HTeDn*LP%ZTF8*+xKVIPa8gg29Je$FA1e`D#s z$@?Kq4|`MYw}B!pMeoG{ohz#5M>^OTsugK1m_N15w`GED#o{hwe#08aR%>?o*E%GNh-xGg%|+vECSaPFaGBo8h0Y??djMZTi9$suI2#U3 zOv^EayzD97H{%S3&(Has{7`zLLrP!)-SQ2C7VvyvLo32qaU^X* z1Y8><<$K^#9zy)GE9BuaD!+l}eF0??C?vVNZ0)m~ILTRIs#eeDLY?ck_37bH>mr;FZ1?g^^y|5= zLC#C8-&hGx?X#8lOWw;>q2-`^0h;Jv9j?9w8fNZ9c{TIK`N>x86M|8*^mb1rk{>r@2aqTmF# z0dhg{SkcxtRG3`7-1V$psUbr(MC0GGGCNirJuSLj3kEFmwats{cIK*zrduq%8C@QY zpoLia%z3RdLu^TQ(-i|8>uMH_W^Ewb!_KL#jh5G-HuQw~**v&2>tj3*j%nL*moTMr zGBV^*ywSMo6u!^Zd=3d>lbauL{hQvyU>7!c!HQc}xV%J2s$!axuFo}}Hj!M6OvZhb z2JNzyGz5*`(C%5$G+E{2pAPD>z4DDCHmV(9LLvP&K-8sY565(FAHOMf#hP_RWd5tX z!6a7$g%*uQ>Vtuyc7zWM_vJ)QV>!*`m1_Pro21_}G9IF>`UQYjt84z|6{>MqlX0+^ z#Gfs7$g|;NcToae$Bax{y>hU-6Cd zqo2|n>b`NSs)&hUiNIq+R~H-1KZuUk)Q8+Rlh-T1VV{x+`VFYnGq*T#5`qqEm9r@X zL5(hso);|+OZ|-hD)+HMDIbILg8Gmw#8aiYMl+bvVaw3)cg`Rki&++px6&*2Sv1z_ z7d5PnHTAq}B*P>m$vcxhZ=G?vpS*P4K}XHXTe|#Lsj?sW+UI_G@zaO=5^!t#)V>2PK1J% zxVWX@8Q7cXZMsqXc7f2VZ&%Y?+aBHT^^fOq4g=faocOiV@KVg;`d~ttYqMs&X`{rg z8%xC@7pk~n=?3?9peI(vZ0@NPiv97wNo^72px^AeWa)|j%pmzv@29F3`r9tIN}f3y zrd7y*S#UpB)(2#NvOD!cz9Nv=7xp$cwiD42*ani%J6Xk6u2>h&^9pO9ki)ZCM{e>x z4lsaE23CUn+ds$fGe%u}@^`aXyGfXe*V0`@o7WlByR8c#Szf$YOUkJE^Xi#m1#mVd z5ID$fNhriY!qk0Rtfi+t(f@{AyuS&sHUa=j_ zcENJPO4(u<)W~Yy%{xCx`>Uqgnb}M_uFzhX#8K2=)Ysw!dO!tgo{dS{jUileKHs)O z`!JM8;RgGLDcnE*iD9BBjwX`{pl%pkzC5a)4r%9$wMENaeKGN0J?duaf4TMi+U3NL zGeFe44B2em7dUk2JfYPb08`_UG_4^g@3e`0ubb9(U|R2m6{Cqd8;q;MC*AmHC-O{w z7VvXGai~u*-;jCvT~p9Gb*IF%phMLJ;f-^&zIV$;{<#{|0PbP}cxCAe-j)@f>ZF_1 z?jBzwMx-$ekIlK+O_&(^Iwwx6*?`(e4}C^l*NAN;KV@33nOLK*mzWb)P{dp{#b+lX z?chE85w1Izj-}*a3tWk4CWZ|Ppb7J;LI5r%GND9UW3O!qp@K(r|GWYltZiy<15D-% zy^^(VdjcN{y8x8uxj;`H+{;2$Nl&3X#7hm5*NzkM&l>u}`GT*qI=+!ujJ!ONd~W0#`;?NNfRS93@ zZkxad7Q2Nung8i;{_it(CBG*pROu~SgRT64L^(vZ`Pz}mFmnBvgR;}X3p-!UQ(4Q& z`TSOsIUha<1@Moj!Gi#x1=Y0LcDE$m%88g@r=lf?=xOi3vr-*O>Wf94^LQejN%Qrp z{o?YH^UNZ#%nL5FFDuX!vO}?gB!-IT@gLZDI~!jkIS@WGjQL}mb@7S=?Eyxk`tH6Q zkq`C0AmCp^`G(w2LNGp(Av~j&ro&@$e<^^gDb3X9?OO?+KfHu5M@hSGU@;hg4)o69 zAAqn)x=P||+Rl4@SKMi@rXOxJ2j#P15{cNct6RorPZ@`ArNt=><0=xyA`PRuKyv7Y z!+f3R2apoEVYk%0&C!R(AQ&Z9(zFPJOEqd?=my6Pk*ebMm||QuyF$MT(HYmh4ZT0S zB!L2UQ*~E&#owRX0S$IB>kv``&X3&roh7IaWpDvRnL0*SC zaD9Sq?|S@CxAhH^&bQ1&i4lpH*;0f(u-uDTMeG>U&g4^Z0@3QwQjSdNwf6{l0-YB(K@>@AAhHICjnSd~9h-tZ$bY5^oAd z0vG+$;i@;YqlEul)&4^VkKd_XKD?Pn7K_-3u5aFz@)Q0#;M?U|J$gHzxs zGbcygKvfq1sp~{ZaoqY?y~lR>G_ClB+EN5wp3spuF}-cmAeDZgBxCor!wr!NIgys& zFu&xZvp~Ms?OG(4o8VH(R4oCFs{5%oE!`;z^fL7>S7 zg@|T3IdtRh+EN!-4ZGJ6=|R<-i7;??Z_GrwNx)}f0el;xamCW;dES<{aX}M1>|1W}4jg(yS zk@>Lah#pvW|O05MIQ7+#CtrhnZs=}x1LZ5Q(6r!-mACI%qhdy zqru1d3(ThBRK^}%v~%82d61Xzuqv?F_h=#VF=bw|whIct7wW&@us0ijegvJ_R0HbUz_E;ad~5 z$<9`>;q8?JL0qALgU*&~Vvw)(KL~${*sM8A9Mr)`Dj{6MSEO$IgWPw$Xpkzx>%U2= zqGxNq6Klg-qPjen1K8JXRXGmiO}-~+&R~C}nQKB{$he>;4rqvns$!hOP&S_@>R}`+ z*!I28Ra~TR?$T`KD{J~UuS0Fy57gk9{b^giH1dPdkFeRfUe529W3SOw=;wj;smV=R z%Gg32^GL_+!J3eBq_Kc4uSG<&Yl^{fa`(<3$woKlT-KR8hd{1_=Qf_$_sBu1I$Bf#X$j_7Kan|T&KA8G~XO)z6{*v)H$)~k66p(xx}Wg zaj?5A`Tq7pEW_N5A%098S3cRY+wm z6169PrB_{3zgrIy&JScu)!5-8=Kx2L?`^SPgGw@+KF%FQNz7ArEA_{z3x_iuMxh1X zl0{x5_Ij4h4ez~A?g&%x%i!NVCQ;cXw~GJWmHMpZX?hsitxDSbx>W#~-dE>f`?pyz zz^4PJFsBjPkrMESHixgYe8@xaob%iQsi&fUiv?-eMDe9PSmW{JpZ$fxKWu;6FP#7x z1!%13p}y~2DN2StYpg7sL}HCIT4x2bJVE<~n3l{6fxjH=YTxdTV;Ub{uS{t%Onw8R z<3_!3F;N^|=aGZ*MN*oqu`RD(x$ zJRe?0ImKb=d*La_@P-2AD0@Q&0P-aEsVLnHG{JYUcs5_J92mN?o{UR?eI5i!V2Z9# zw=0R^rHnp(i(PY709gB)B)zF{c`lNpZRO}O3`_3BG3qfRXaFaiW94q*z4h~!7dR*2 z#je1AW0vi6e*}*j57ipe;!2^xXz-iM@JVEV7w|+2ng%GNupdyC%|n*pfe52ry{;r& zb%}&coJsve2q6r5^$X-0Gw6)^&RpC2N_T2PZ41lRzs0^59|d#n5n1UO=mGb2d1Uq$ zI5vj2(_FKbIiTM;bs9<(Yar8+KHZ#gu#b%>3i4;NxBsB^B{#D37c7Ok(dVwX z%z46$XaM`@T3y+gz*d=D#S&^`h()Dcb(`b=ASt@1&#dimITf6@yUUe`x`#G8`Bd># zun<@LU5PpapWQ7&+xX$G#PO|3uhVpt?+zB+k2jlE)noTF0vPp;vjjVk(>vJ6H}nWY zhiR(!jbn|yMO0bp=~>+@+KPrfWn=EYO2VZlqYpH?gEptaP^(@7+Zk}Hp#xf%*k$4J zHI1kvH2e6+7@rJHmd9vs8sD8bL4$^mK8>72f^KL`K{MJsS14WAUq zR+|wSCXP}VF_|}L{<6}e%bnsXn{nrdt!_Hv)&A5y zpYZdXCB*K4D4oj$cc#g9$Ie!v7J1%wC~Or1^%~85*~u%Bxxp}W9fEF#Mx;i%5zcGQ zdl5t5r?j21y(lM?ByU8aS^!7x+jbg6nl%#kC`4w&HGIw(!>-tv4vsQ$ z@^6ydbq_>shQ>#^s!4yz6_}oKj3dqW+217|^&)~2l{a6N@_Xfrb^Auc$TvZ++e z`n@L6Z#V3tr24H*pk zKSv6RfB!m9?)=p>X;tGH!}zNlbTCnW13_0r(+0V4eD<7?<%klBF%Bky)k2#vN8i3< zBlUMxYt;^CVuO{OjNh$CW!!^(d3QQ6hil?5OZpICFkfwZ{V4bNSLvq)q16aS#hlzC z!#ESn8_s_H)5p3fQM^1C&;POj+AoMspQk20R=xyr3L?p`xkF@3I!f_0i0J{S=e}M1 zs|I?U>UM!wC;v7TntX`nkuUFD~;FIwwx*cmKq{RO5X9q=&s_u}YH?Ia#- zrlpn3FE>!;0YiM9(Y60)+fpD;@=p45-u;h3Gp+rklMf_0W{a9b52 zMj;U4m!ne#Ra#%k-n8Z3kqFxt9y%Q1?S_8@7Y4rcegz=tVxo#*$eY zqXWR+rf3Bt)hH>U{D4q}AcTbeTf4kh!y4#?MtEWmWzaIneT6O(4(Y1k0TKR1$}-(m z{*SUvna2WeNch?)qdApm;y9DdprXd24rm`uM7WF`z8kIuiXc9JZ}6Q_2N%`PE*4|YDFyIN623aASXbtAVO-u-FRCHCguJLX4m#;`{m~u8e!jwS7a4O(!TV*Po&w@qpwxYUa zZMq`lxF*LgU$HVf-Cd}*GwqyuXKW{9tqeUObq^yXWM^0PEw~2d_Bx-^fh! z_WCLmqGB&Rsj2Nvo*e28lgG46Y%lveqfPs(HGHFQWD=jQU>~I4P~ty`^=Yk;g~77_ z4r4=fMEFzYS_hK=kGp4z(?a8JbRh`+fh(+mM*ZXB!*pH6H6w5a4+h)tlu^hR1}Um* z1sl~F8cdxF6hoszRt_dCY^BXy%Z!esz*@Q_f2t3dK-scL%R?+u?wE05audj^1Xcie zPWNJ{cwHx31YF-4ID|`T6k>nru))BrS~d)gi9Rp%H%F_EqY=(c8^g9gkAosaF19+m zS5@QMEz9L6?<;7I&x){nYyg%SVs8~TDLXQK2fcd5^I?p%>uNIUN^+x>aCte)DyB9i zU3&HlrT8>SZd`S?01*=*ABJTaIJ)OseywhV$BgG0cO`pT7%5DV^ntMEs2BsQHYD|lV1tbd=;Fsg3$ zm0_wF9iHeIpxc?Akhx6qIZ0E`sA()WfvfGCz;-4{Lf!n!^xb^lN@-9UH6IwzY1N}( zvXPh+^XG05cYES)&-3otsCh!)*C?<0+m?KBvhfAMuogG^v z)UYj{c3uLAPOv^a6!%cATr;!0b@^u&cSi}%`R;@$p@17_Y@Q!$?3@Nu=Pm2zIc{AC zU!eYdUXk(KEK^yyQ0N5x^>~M%wWM|(%6RfX8|o)lZe`a}1M2jQSn8m}C&*BQL!|lc ze)jbY%HV>>D`hHCzrK14qgZm#g;IH#_cR6D&4`*+x)IDq*Zg-#? zGc(c9sep(YNDtM;*2c?+c~X6zpzGhW;rvyGINcd9(pQv4_hH!Py-{&EmA?RG$((Je zxbZnZ!cxM@F;xg_k=0(t&OB+4OzBG_G0zsOwL18L4R*LtP7RH@cP}J1ZdH2H7%d~4 zXlkLuM&og_Y*!lGXu4L6OLx}1z2%VC3QNHW$MIkn!Y^3&AQL|HLz#kcjt!Dh%FW(} za*td8p*wN;pol+#(Q>6Vjy;?2Pbb&<$nM)9aP^SU4(tW=5T03v!1F{XWTam(DV*0$ z!Ea?re=9_8&g9ywf~4m#DPaZ0j4w-ydx-9IDO`jXC}u^IQwdsmKAcNb(|w2OM_c-b z?F(UI<`f%rUB)Dqnou2aE+5+_f+FvEJpq+*&GK-x zXVxQK=Y{pj8;hWf_IF&h{A|UCLv>={8NBpNXW~=1&ZavYD zy{ab|vXx6;TEM!rHEN1#RTo%9dF-RJ>8VVOVu${w*(P}z)`(lr2CP=c z{3@@`VON|Z{5$lv^x4eC^CocWUcqNl?jHKmXT~h;Ha15PPw@?7^E~oY|f z&QMG-xBIRq|IMzd)BEd@-8@4>vSi=^8*qUCwe`UCJVmoMJ8)=bNg;TMm~b(S(MB1q zWvViQQDa68bmN+Mv}GJ7blr4Ga3{@N_OH4db}T-);}#Ef0F%G&6%#N?HLWMy?#Zh# zuTeUkZTxbiR^iwRB#rl~Cy}mVp(+(J%=<#sY%%$_-G~rB^Y)e;=RrX)JKkr{Ev~=y ze&!Wtpk85emJ|I_q2Xz6x6FB}T7ZF%q(=C>--A;JPU; zX`0aZiGhLgCqg&U5`N+d&W<9Sk*2C(aL?H;Hi+P-`vUP0>}L0?2$O6e=Wy>tv0Ok* z(o^CVIx$P>s(Au{sU6v+5AaN9_d#eqR}w;zr`{N&mP0rr;uZ4fnmoV}`e3O*E?j!AVijnB?a>mKem%G1;!)n5*)}&h!Vn8V1A&mpDwU7M$l>Hrpac)P~0&%1xXA z@Gb~3qK{!{@WMZip~%19(7 z>F$1Gi}#geZQCQPIW)S+cxAV3r^WW%Hg(rkCD(S`$8C&O$2pF9k9q?*HYCm$Z{}HZ zDleLMfNDc$;HOP{%B^LleDdg99E z0%>}JH~r=ktH0=0Hdga<@R7_H)pvEp?q6``Gg*)Ut12X_10&S29DgG13!W7j2cx4& z@fOMoTwg#***-G#D2 z3=K~nxbw6!o|%rN>6M4t`|WK*2mC5$EH7X;745xgb>nv0_azkYqAcNgbU;J*LIRZx z)owOkMQX1gxdmtaSo@eH&3n|eA+!iVY~aCw-)1o{$WrJ|$lSHQh@N%BWS^AO*mK~ zhzB*>ID;J+Q0Hzo8xuC^__q&jnWU0X3iX8z8g95ZYe(IpLLPKfPoW`p4Q)x{&W7wt z4vI9oM#Yvl;c!u}nFXKC@jmnqSLQf20ScJY5~~~gM>;);>e^&S=0C0 zWj|93EMA=y}cyG}-Yq930p){ykwk(o)q@xS@U9dbl3eSMREb;!2UkepuT0&Ds3CHlZ2`}_|^L~e0+pI2z%#p4*d)4yP&=c<;Nk%Ebs{D{{Cot$-6nCU-qf1Y@JZe35E z;A8t_z9^;Nek1+YNcGiXAQ`h9!Bb)~nJp#}!7~ z7F7nS*m)ZbgLEbe<=yvENCsbD&9ZeL$ANY^{fyM0(7;rvzEb_6iV^>+3=IuN*_+SU zZjd%7wC4`iw+FiamOKgcMmXdKIf|waCyMB!l7v=Ya@W~eXrRtN>+0gmdLq9 z(Glx_`eXbc&dB9Ki(eq5gaI&C6p<)wD-U-IV2rTpXRk>B;})5l6kD95!eLq4^g;!f zlvqOGgKMK`LM$vfdpDpdnAP(q!IUNF4I<@7!Qp{afmSZWF7PceF)>*DV8Gv%)W;{? zd~b&#dv)b`ZnXV;bWWG7-8DEZ?G0$=oSaxHp@-IAm1mDRAA12YA7>FgCtZ zjGTjBYqY>l6oW$jwAvLjAx96c+fh{B-*`6d zIKXlWd%E_^cCt@PPLeIysuUsE#3to9!rf5mg)8CVpIvGy(|VriBAgy}RWi5j5z0&% zsd=Q!G+)yXAk+`eHE2&3<@sS)N63yH;B_n+<}OF487)cdd`$>m!0VYhgewix^g>g0 zkKRjV6#(BW!*3;oLUL2BxUgQWES1-9&FpCXC=vhmCb1LXdd1Ya(j54N|0xJ?S z(_YLw!9A?>ukADEJbsBvt?wt){JEr0zD{=X7KMFaq?n%$3%DHPC|_VJ**oXvTt z1{H$8n9P`sC3Pl9P+D4;o{u0XU@X5oKmg!F^Z(SSAe`tG?{4EV#|8^%nm_BRhw@nt zzgp_~t0v7EnkIA`X+e$$$|+>JwAYYga#~4d5wM`d^Fig;^o4GJt~=6_xar{p-0q$N zJ=If8$#!6cRCP;7yH|BLow~fb+yS(+9=i)9}u(#MZH#-1F}>YhBmWC-^;gxOG65ji2*3 z6l$W$B(2icuOZ$tjyO_C^83rj>&6FKLqhZQB^R21R=%%nAn;>)Ie_bZZR1tsVH8iJwu~5 z!fE$rclK6`9KSuYZLq0(OJdJCdEh%ar&nVsAB*(xX|5@Rk)YQPdt-T4@<7=vTLO<= zREWm`;sb?{Q-;tL+d9t_Bvcq-ien&NUtCAwjdbf2S!9=H7{exG!O>0%Tah2-2fP)2 zYGFZ)ai8`y`$3<22#a+bYot`WXCb3w?8(!&&-`f~neQEXS*>LW7O8*r&JEk+Gvn^K zqI;c!r$|c6t&E7#*fe~z%`4{p)o3>P`ql_CO_Z1ZmCDrJ4|%}(PVdQD zV)ZAeQM>9)wTo%bk8hxb&3D^uq%V5>D$?>jW1M+dd{_cJ#t|4xm^C= zee=@;Nr*MlYWyW}9C}_ZRQ@rVD%M=Is#_K0d+LD@HgmQF{^G9dkyMVqfa}+I7`(8Mv%N??m~8Rgvpn7HCRSx=s`)qpF7Jf%t1wVhV3nb$v3yUb^gPBJ1Kqw~vFWjHVM(r`sK>F(g{K z=~FyRNpZfMu}+@92@7De;@C&AFp2U_)m+;433z|g(lLl(@;$$~8Y{1+Y!MKS()KVt zlJGr%+lZ-t2X!mBC~=C|1b($Y6W!d^Y|Q4fft_b(#DbsEg5tJc<$|_fpzlO@-{n`G z3Gc3`V2KXL%pMDaMVh3-{WdYqdAD3@W1~d;B5Tv9MXVRh{fLLgIMGcn@1E=gi+3&9 zO`ZLuQxp!cS#-L))5Z~W`37C!>7bP}?fXqzu6H|ymm5z~jQ_&Zg8iM)aBM{7IU$0O zmp@wT@hIT|AV?@rD1&YQ&xLm3Jl-ixf}iX4`YR*mB`3*0NR&nm@Z-qg=pTkf8T}Ek zl)rw$|2`z6=%KOQ5s{pzAQ#Jhj)o%2PY*;9qz9G=Ow;&dm>fS~qAW}7ksz5Zaf3+I zaL*e}#&Bv<%3z?2ZNH8RHGF*to!NnO_^i21 zEy-x1!n5SKX?UFan)1Xf{os+^w3o8{aP-YmC%ghIUsX{x2cAGEG;HMx&f7*cNHMb_ z5_qDe7|p_15p3N!ko6rm@jmAtxx9ZOOdDb8m%;tRmrEcdW@#-0`Ed8?8OaDfdXXH1 zvr)@ENh5g)Xv3JpP!rsNyPN(l7St#E zBad44*i4ozdCrRr*6_PrGEjTc5cds;WB-9&>a7E+A1HhMhxN)abw)$t`%Z0u%gbz{ z;(2oVtH=<~K1q~9N~7wsoXpo2`^~L7ISh`P*3Kgq2izXmo`vaB6lMZzJ^J3&o++_C zw0b-Kjk$CGqJyCN#Ov6U zs6qUihb>mowLLoKo7L?YC@`>!Fu4~_R-~tFMAs#avf{eq&n{=d>%1q_sXHi)T3gbG zoG^eAb@k0_^2>!wLp;XLjSi%_uZOjpM9^Q9;qKCVc`Gb=^W!K?Z0rp z^W=o$+m6oT$63v+S#_vottdy^!cCjocH&u8|(h9wXW-Xg(R6qhj|4Y zs}Y$z6zGD!+5W9d8uB;Jl@@alE+fjOW9^bNxF+PTja18tnFy0f^M<8YrnbK4;ynwo z_uemFj@k#g%hG(cXcE8yf2>%%&Iz>Rg5Ot&8zr=@5~FsgoV<=6Yahc+qlZ=&b;e^Q z&~FeYNBo?7RA1FtO9BL>%G?#gR$Zmn@BsM$lQ~D`l&ok3G0bsHg$d6d7(7TrQvp<_%-mS{lO0IiRi>{oNIvn5}?&SzC0 z`uB72o2UKm>K_?pz))|O=h~aw#ZH^q(LEJQ+A3uKT6%4L9n!>n958#jAVxLV45r%t zp9bP(d-!1g7eE1jUvqfC%TMYVrMH5>Mx3`Sn@C}&> z2E2i$-SLlb4`%;px^x$GiCeZU)~r~}v~;@CEqN=#i_(#!?5)V}EMHuHQO-Y-6QK^` z{l36Fo7J;@nY1HO5k33o6FG>%uCcB3Y8rgv;5!l^iU1r|(Y~&AwYXtxa7Ukyw>dzZ znvsx6~mp3{vGkZu~+_NLYN)MSWJ-?yk5QN2qfM!sw9W@)4ErJi- zB+RpGOg*8l*@w<_H|-);BD6;WFD;*(5mL2cUTbv4!=;{H=L)-C`8%gzviDp;iSAe> z9Vfy8tH*p`^gy;^3S%~#)skS97RMfh_=J(fvx8mF-XkR2&VAMMgKFrJb^0LI;humi z3A`S2N^Gc;_a|7^4PIhprj7Z*2%BuWyL&N{wUugjIm0~9j24qN6CcC$)n)WX`1JM% zD@xd(x@0pD!;>D{hUyn;X1)Hq+YTfm^sbfZaVEVsm6Sqg%_P? zdDGcu8s84Z51vW<8RaDUALDehCB6~982M58n5(c3AHVLWci|CatR4UVy$gX8LKIkP)WZ4J7|tb zkU94jA^qIoJPC>#&wy2JfWTV4<4;w1s{V0EWoTkl#Fh)G=41A`smJF8;9vQpfnxt!LkCAL6BiCZBoHq(hND(Jr^Rm@vj|4V6VI~=(O#MLq=gdQ$e>Z? zDN{y4fPxe%P`&BY)O}^6nAK_twJe@I_iC&?IlHM^qkPBa|`M{iQdz&mNP$PGr3EJID8^ zf-Xmg9uYrmZ$(RXzALPZ9D<}O-RK}PiJgBpQ-gC|@2X^z+4edF10M7aR3XV{5IGjK z^?pwXO@ywxk6szRhZ^mj?HC<}wC5SHfbVKb(%5!E^rL*IYf|MXzY~?H5r`NH2znV+ zk4#6-msTdxA#;Is$P_^=fEw-528VqO!t2J#`uM}CfxS~J)@u4VUg841FRAx6zFUC~ zQ}6}WQm+fNs)nGBbhyDv>k56>X7rOaGdZYDr(86)yz%+$%hC;QSXsKyS4YFYFnA^T za-4gtXwEU~E9KG3hFP?m$&s7c8lev8*NTv|Xvj{6t(e*7Gil#i@Rv3zkrRza z(q!Xl10fN*Ixj0s*O9zI@9N% zy2UXs7HA=9wF`>}Vhk#4)A3%hKe$2H-<{*vcU`DS{zfnL0#;l=ZM&v@K_cU>;}>T& zg9A}O0#MS=Z_;`jLRO8@_9=N1_y`6`{E1()Q)e1m^!hK}^YpL%UZtK>D_gkWAIPS- za8<}BBF>)@b7uL$%38^($sRFjRWg@v4e}9B8*neimxHG7J17{rtuiP{x-4;CmU>F_ z_L+Lln|qb-MTgaIG<-wRH$p{)u89;&tK(=t;kIwfy9oIZhIKnhp$8~%<{FrBPodYe`VHRC zF*RNpW>>BqV2CyugW$AssM{5q4`#|=Omq9;Jgb(zi_vR3dwXJMuc#7O;+viYjY6i4 zjm`iBeCto5Jj?9=vMlfvYVrAkd~9bc=1aX)cTaj+3B7cF``i8K4#OPg+gLs#jEp=# zT0X`%g&W04xbZ%aaG%S-Pj$yT4zb$5!H*`QkK0f+{~Swn4*!9x`ftyi2KkUD_}3I# zut2abH^&}ENgPNV?39i4fb zrb#Q=A#ya$2#}_4H`?9!Hp7XA*eT#9?JrmRf1{wLryCDsrU7t0rlUwR07(Ep^fTU> zB(J(JQeC_wcr0@A?bncgDV`$#=Dkihf2&H}m&4n!tA&qUywR~IF$|1++B-*EhJ=)* zPdu+G1$-IbUth2cO`SOoW`g;{BiFFxv!k%0vm;o{pztYdoeeN*(IY7SXwI=u8_x`b zNuQ4L?K|oa2}~elqb3Jfe2-|+D5F206@h@q?%i@vMbF}(Nqc{fF{OMa9@{_TzdWycY1~?b*|IC~S^$XX#_G>-)!z?}Gp-h9-kGEyqr;(v%?J zG5&tCSG!%bowhWWN2udlV4#_$W;&G>2Xm|+tnGqN!CXM}J@gQ@>ouft4ZM2-t6X}m zvWw_*X{Pwf{Ctw5LQNC{n(K^(>zFnJLJG=l3E=xk?1RpF&x*?tT{jeu6qKE%=l%Si zn08}|39(SOtI$TCx*Shwm@t7=SKwf?d|MvKadkFv%6xAgdY&Dh4*7dLI}*y1W;cmi zV58!cYAa|ODGBagxyQy%fjCXw6EL6|K@c$boAq5c;>;T5b@vH+3|Zotu(ckYk3vwy z1-jXcgi)PA0!PRTBA^J7yT1mbKxP^8=sWQke4O)ji@fDSse<71OYFr{EaM(IiMFeh zUB5Bisn#LxT6%yr>#c47>>hgUeww4i-$Fk03oLJO)%YXYgN(+L@I0NRh0ZzHg@;@6 z$DLy(iaIY@ET(1fQ**9Q7@@1{j}b@atu{xM&1|Hc%PgffB=2i@cKHG}&`5R4+9KdVE77t7qHHXS? zN0S{?-bVpkHpcShz3Gha?Zs@hNk6l!-McrU>3oS-^PS;sk14Rx2}BB&?K@%c9mjs1 zzl@;KO+^e_z7jZ+90Fm+WCb@WkLqW#cj){newHEPnN=OCL;pB>tfrl(q#wMOiLb4@ zo&ZFzsDAF~OprBHi~pOM@KYmT#BS#-n@s*ClLI<_OX-e;gqdT2b^! z8NKlM4|ZPya->MO9)y`>zB1Y>UND%lAuw{<)A~8h0RjjQ{{ahHObd zssi+ftBzhY_Xet6D__c@rp5e$p#We8sF70*(H+4K^)gv9ILGqi*+A<%UD`?i3>H6D zrfHTqSt1JAeLor9IBQ9(Lij_$I#D8cas)l-<<7;9jI4g-wfHWP>;T$$m$A) zSoekl8X^LbFOfZARc(+y@u#kA@25N$gR>2poQs)%Sy+^=lC!-jvNE!xcb9!KdJhcK z=|>TQ76pz-u=yC$)mK~&G@)JC99JHz!eA++8NJ?HQrx5H4e-jZ!0(e6{Q^&>AGTT$ zj~T+Achx?3pGS2CNsWaU2M8(FN+_d<{+=Hh&iH<(XM=uKfkd$q$j>4` zVOtvr6#fadALEMQ#upgc@iFj0;YYRf##Ii3pTcXJsae1SHD#^cfr&VO(~daXv%` zH{~ouhgZNTx+`wd^Q|Ey1TcDw^epbM)(m+akjKxO8-uXJ5cX(36S7BW$mV92;`FEO zF@5O|Vq`q;B}EbhFi8jtF5L!iV!ZladX0Y`Cl; zSXN6Ay0b>8vJbJ{?0465JDc5U@iCO8E(ghCls@sd6S~-PH#Av!HZqD79XJl@qiyGA z1ZCE{ZQtjX_vnkOl=x?Vd89NNkE5y|S#~~0U|~Z0O{hlJRPc1EqrO@^94X{17c`U( z;<`7+zV5!jWL-};K$}9`wUN1ModPZmlW`oGH0e*9#~hg!h_^LSEe)i8X(hp7U*Lcx zMF^RQz7@q4WVVyqE~h&`ti?*Xfg>T6;W6TU7=W0AgolQNixX&hdqy@dQ6VmOajTuS zI;Y9BV_H&aJ~$HZ>Yllb;* zK&L*uBp=1__uil1&)%g3cHu+qL14|Y!4y0(UBrE_Fm?%)C~nQ}h+CaHKfQ)8U?6#A zAQPMY5X9J*G44v>xawN!bqZ6N<&Nnm^DyU2V8w6vOFBk{`r)|luX^)|&Zy3U_D5#y z!jo>1OogxKpt7)%%Zx-uQCU06(dy|X_a{$>T|qvS4xUbwUi~(OB{9mN#Xni~3FSOo ztUOWqZ!SVa3xlyX%eB_eWqi*AgB1jSkx@XZg$m)!=D0QA92OS5IlHi|sk_5PjJC}! z*BrLnKhXtpm&$-8-VUXIaio+RGW(`2kAgAG%Hj-@LzA7}JN`Js=SvsXEoX75VFOLA zBr5(J^Th2i|l;Q=)P+KU@_;r3Tkoqa!i zu#1ao1U#=r7mK4!82uh88M6{!$MffNf#QXPyBb&hFT(NPHZ8T{JVKj88vptehjeLs zKOCBY=!RZdi-@Oz1gG@<4?ZC5t_Qg4K~G!T{&_Q+GqBHDi|Ot@nZ)kbR1no1bhlAD zeA`cw9YaWhLYY+bg*}cVtJ0jv?Tjtg@8X)w(r*SP6z?k^cT>AW?|tB~Ca_1mUW#YV z#-{h~VQohPn(xQOM*yeufmM>Hze_}qicA()l#~T!@JYJNsF~`w%|2*hi#<-Ec%oO4 zMtThoe=DzoY*sgghjdT}PD?2mWn@8>Y(tT)Y?wwtP8SR&f}o}sK0A+xRNU<1O_``o zv0u8UvQ`=QlbLpjQtLGm=^8PJ&y?RByBaD`%OI2O z0cTjP4YRr(z)vA6mHH^)_5({k_(@DPc^3q;C-lcV>IgekAlc2LjVC^@JQcB2; zj_~O&k{Bupx{4Vgfo)sPXmD|^ zPahS{hVV;8+qUTtgXFSrOS%Y!5T<>uqb~mNkiKcS8{8eYF|X=F5c*&{Uh?aXW;eXJ zQ43;I%UIk@gmS}v zN=6kvq1YV;I4i>9GN!Tk@VGqr{Db&%QKQhpeq&T2s~w7Lb#X7Ag}JTyHI0TfKFX1% zM+fYqkm}(X#@d9n}Uccq@i2xeb{c6hhdT zR2%};iv;o7Sk-|wL8zhfg|4*6bX|rd-w(B}Rel*QEw(asC56i+4l09JuheQwj+*?2 zPWK_dqkMXA2tORwcw|k=%}xoS6jq2zF}^wA)8??Axv8;l#|DCcfZ$!vxv)xP)kuid zP%t?aB-LsNj$CeT#a8Wn==*1wwlzP-DE86|gYvcwP4#W6&V-`yhx#WAw}ED#rs29R zO)L55fsvMO9ebv@=C(D@Vls1Aw`pfb2s`r@G3C+wWAUf*r|V9o{qBH<-F5A1zP9gb z|7K_haVUC-m)+2`Zsu2jWL(ZRkQ=^{1Lo@j6L~x|zVxmJwq(C4##%=vYZDXKXWNjH z+x&jtcJ;Zq{7`Ct8(d@Nid>{kn-rO#`}%$Ye)M>~%JyP;rvM!3$mb@RbDC}JZM%=6 z)`UmT*{TIfa^Hyp7bLYE(F4hTsk8#y5PBc^O7g#1A1}j2H1Ve`rwEamnVNFQO~?*) zUA=ak`qcX49VbGuT4axU^77kys_xg`5frw8`1z8pSK;nfD&*t;FYrYt+cFa;` zCjF%5TErj0P03?c0X}ISy%K3P7ZJF2O-Q&m*@_=#rHKD%?L=OFcTv2Rz|^oy z64^d5Sqg*Ut<+F!D=Us-%qjNn_k_x&J1AyOi=yQxhwLo)pEHl3*MsQ}kRa9zLpZgL zILK8|aV4$ID8vYpN?N5Ykhxn(f)T&Br5LE4WyozwL>`fBIhx*@F!;0bn)N3fiL?M? z8>r1!=e~uG-V>W&H+D#+tK(|_G}2kn&E|#4z<-&^@V8bYSWSeRzU-H@4iBEAlYp|e zcP}3Cmkp`a>|Uz1sdr3?=`Si-AL_rK-(#HBmB1!k12!$!)%>zlwH_^DY1RQjUk3+Y+OC-2_&I zvt8lKB`CgpBzWHzX&w~s?chPyI! z(sB%=H#X`c=q8JNcgHflk}Y;2LWVgPpZPnuzog(pGoig!0*o=9dA_ext_|;UCC^^# zxSZ}ynKIa%$&3%WJh)jIWa)P}#(BEZ*S;XP z46>n4cFMMLFH7sfZk(bn7~Jm)54AOTB42Js{%r95k3&0;(ToW5Hzl_umln(spn^`* zj~s+VSO65_WV^4y``UIgmf_+R8&JuqN8eEWg$ytrxH_UM2Z$W*San_9Jfn+XtNKN` z@6k(*!IwgY%J!H7y^euZ84@r4-h4ahg^{$n>ZGX~hC+PtLl20nfNbpziQTMZ7mDx? z*w-j{t~mB}&W>54UDm2zXU(Ly=Ww1~qYl`8#rN(G^+3Dz!GSyL;Lu=GV0>P4F|8DGgW0 z{%T-OB7Y1*@AE8L##RJt&KNJ2u1GRXKL*5R|1PUUv8V3OT%dvQJ-##(xAqGacb6Tf z&x7v!@AjL6wyW2? z8XCq@#L>UnQO`x)iaYX5xZ|7UT9v;sBBpStx4t}mi?D(~@L$7ngio6SE}7(>Apvf6 zxo<=>vIOuy*l|ZIcO`av4?h+9-glPvxBq6;KJFiOj;D0P%d0<-2s?3EFbqvSX+P0@ zy#8+sx&UUG`uZD`XKO^ISA0_LJVx*f88FU4BemdHtw4kx>_)}K=_3K z)&tf*Wcj~gC~O|s3aPc2q7r^PbRK&rmJd^D>gX|LuqNc7s6~tj9>d?22?1_2`?)k2 z=ZuSkUYR-&kyIpFk53>&h?5$m(UAfA>KoS>;8pJ(3_HEJ8~hM!O7|@JMgin~(m$(x z2XE84s1^pMHr>Kd1U?=hNnMRX)bswqO>>!m9JbD;z{U%c>*Nq0c5GD%IuxWWmWDzn zcr_CpqaTI|jEv`F`!5szf30GI(LDqhEZmbnco_h|3&4r_^3J%%BuML?FS}TtLN$mb zLBH9Q?w6cg8ctTikh24`iZ!FGVlyCd*I^a}EOryr9i+LIFwN$X8g&H67D{|23u8FT zjW;$h4Vete!X%PyVSVD@VYxR-_-wL^V2=EMFi-BmDvu2aOXe)AV;HqzsSvdbtn zKI!>H73Q|pB^m{0PihYXGfch6S#R+DJW@@&=bU}F%i*`Pc&|i5=6>78j)!LCmN)K!n->_}agaW(HHaPu#3erdx`q$K7>ge~k+TJXTbmh+XnQ`gwz znHt?k68I-3m&%zmp`>4Ld6ae#~1~=J}a`zsh#SHVP;Kyh2BC zeh(>ayiV{?-l#i>(N}$qT8Bikf+p@RJ;g^@8bA`pV^Uxnr|1?8#wvG;6H;U2*oXtK z4Q!IRxSB#lcv!vYzHZab49Q)DZTyz`)Bu{%eQ_}O{Qbr|DOP@SptVQ>U-!3OlYj$k zLI>^8S>3(Qq_jF84N+7Ab^s={CuqLcnXWqxOR9#h)|3qRTxh!d&J>-Y2j|p+W3cQe z-1rqHC~Nbkh|{u~x)xVu9kjp$6ULkI`yXJb{O-6f9$flF5E`!2Rh=&T9;yPiz@bHk?<0qjrsik5r8^A7HO~VgFHr48E-ZFj%|1}&m?c@yRGa1+u5!=P=JU1an!%ZPwD#(2a5#|fxk)o z9GT0lNX{kcuL3A|&63o$UkU&EQ0TV76$$3@y_#w=*EY0xwP7gCGuMH9{j;xe&@>`u ztgF&Hw7X#@vTE!?tvB^uNfu#GBEs<0EV7`x*MkI(9^mh9Pz-8m{S<)t*E){8G>EaN z8h(&^!!rILi;`sSN7&&bzI|ub8i_;8P{5c%@GLes=`MDhz!c?}ZXv_I4YlBe(Y%HXM}AG?cG z0yxuGzatk$3EY(3`L4SPH=}~2u#FQ&nW+z+ooy8Hv3 zSW9d=2}wddNFqa}XIC6i%(vLV&yI#RoLt=w)j8s4Z02_Fe&C`3lLieXD_lF}N!gW| z%IPmoPFW#_irmQ#h=P>q37j3wzs0 z+K0ja_T{H_507s{w1uQn7HJt!L{l)T3mzCq?E{CGZoiwTx;rX`%9E4H`62z8uyoN- zDe18BG;p|awJ*!Vs)Y`Kh?xiEQAL?BfDWWwJ^a;MmkiC0kZ&+PE$hC%a#8v&u_xba#5V}%M60*{)K}n{4#xBUF4=hNxJF5;^^Z2 zNas1)_eQ_f)i6V6LqodD>rC<^Vt;!if;+r&?D}*FOm*<(&U4!cEDoQ%GcZo@1pY6Mw zeZ>KL&N-mdnib6g)%_w96`}{?53@CKbwh&}v>LZq&W47j2pQ%ky0W5)nb+Pkw9{9* zP@*i}bi_``q%@U$S$BwcWxzF05?{Mnw=0{-#b!%9imgwa%g~p>5^h%oLF>|}G0`Am zh5ATj15n(CQ&m(c>`Ac(&UIx~Fso4b2qJZ&%Un{(;zGrSP2$*P!U7{gRy^)bB2$lF zFlUaN>>LtsNNKaOlmw}=btmGXSPR9E1697NPn{h5Yx!|e!2fW z(TtWe!Ic^FOoA6XUS?a6OF_(3>18wftAkqO0=`lXmVZ^(`F7W6C<5ubp7NsJc#G=c z3==KJV<7qdfa(auXlN@(bQsKNAGyzB_#jGYIW2~{CBt>=bqw2jRj zbz*}LQ}q;p&@lH!_K6FeYzP`lCIIN{WHUqPmxH7+w^VJJxLK-L7XWC{<4!XaL`X4f z?dXAK1#{8LsWmx=(UKvnWtAb4SUkQ;sOT6j2v_>u5*>fCrv2QIg*L@J#~jN%ufLli!}CPK!vVKDQT4{dI%CKtLd=p8z z>nBr(Eq-?X=>)AMk`gMX{!J9H@CVtpK;16ixpW&pU{cKOh zomXeoM45M?Lq~dfs$sK#h<6J*hL>hLxePlv2cGn~4cFVeVTdAkd2PdskD!U+Fmho_ zGSf9P6zPV)!tG}ilm7R0ay~cfwwN`W=Qhz!^}EX{tedQu)o)wg!s3ZNQYZ=dR9p%U zIeXpka4`yU)?7zz-wIS!pQ&PKGfaE%Az-@|JNmdZFbzR3WhleVs4-NVW8VxGfBuEW zHZo|dZbD9L9s$+`jr;3R+jF~(3FlMurH_?fN#pvD6hr-c?MKriNJ|H{B2VYwc00+& zLmi9>u*G4|FG4i*MnEyo|M?)}7o|6wl2*3_XwaN6EVCZ}+x)%i{h-pi;l|PN`n*4{ zZ8*Xi0%WqNw5R$vB6|jQ@C(3_3Y`6ylL=9Wii_~6&fn;|fe@s^HKS+chd|tHTVg1(HVUV| zImm~5kU3haM7>9@F#A1{3G|yUx9)teOMA}O=Qf$+=4dFl$&fyqAfRAj|NMY)MJNC! z(&HRVD|%di=AjR5rJj^a(-+luGtr~08?o^#3nAL^SS%H0*ewBW*@8UmjmdrgvhzfZ zngu^i>UX5WgPLa4w$M+?F zUzCZYn=@kGu9<(u-K&4%kIw|5?|{D30Wu4lTkIT#Nn&_;AH36vD1XWjM7+kjfF#GdT_qq@>q9@(q)A&3Gf@f<^W?zUU~lq$a=SqdXPPm4uXmUzmZ9XtvAAlmNso%i3S zO6Yl6%p)q9eYBkue8A31v1ll}z7f){g+;j0NWdQIGhgqxbP;y61o>6ugRi0v-%m21 zeEyJ^^&yyo}UGDR{{HWid8C)5KCl`eQ0_~|$0zM(!!6^LMiR6tR+VGff0u98^ zmYZYNL)9^CZ%1qA@O=9N==Q{8=AafTmS&VO`rcmF0OI1QSK7aAC93zDjCJAiZ~`RX zWB+`Y{^z|*Cy*f9+n@Z0Fcmy9_`5Ldv@Vrmqx>kxp84)%?RLrLrz9QIH2>yzO1atZ zl{~%>zbK6=c^lnk+$}q(AvUpE?h@Q-|5scDNBkIrph$4BzTr?)@p1wtMltqBj4W937onI(LILLi^TDQ%cNzL07E!E&Gs z9rMqIDYBwphM0cP79`0Zr2KIH{ixRT*V86nX8;LR23fhITb#f%>~(H6qa4Y1=7VjSfgJQ*k=T2iJShe8{Oj_rlCFon;;k;`l-kQ>1q@piP@DT+ zU(>pnf$$K^5b(lyQ(7t&+P@&on<2h3OG&tbDYaowC)l^nncjRqK8JKq>3GYyXGPgM z?P>3)*Ww!qaj@x<|cbNboJ#g-Gy76a{mtis)CrOE&=Ql3)u$hza{h zM`txT#x*aT=1{hV&MP&oXcnbBiM(Up4?f;}XUD2_TSQ{bN$vKSf`f@-vp1#YS?O|B@Sx}AgP(e({t$5Q})83k7;VwG_8+SXPQ zv}g1xt+iTr4c;Iv^{BEKy^wfAq$LR=m0l)5~);OfKf{_A~m3WX1u!EO9^ zynJk&!vdvNhaV}AEV?F}zzjS`nqyeBHzmegx6BEIEM%CO<1F=~utjGo5yy*~^@nZX zOr}c(6%QARcmd9?%F@`&`2)jey%X_k(9{j7vX{S1$R!EebCp{+i4&=RAJ6x?Hu1{E z`hFKp9gNMnl#-$eed*S};^SR7Adp)v%44UFXYkFa&{%GL^%+AA#Gk6d{CIzEo^d7x zRJCK1EtxWFS}F-)Idz+wE@`MT*PXW%qCcBob1*RQqwRva+9=TBj!35P^nU>`@6_C3 zST7&u_DJjE0vN$5tGDQaCmy&eE^}V%`&@578H&^Z?l6;)Z4lk3ZAG?HE#TTSI|;AV zl{>t1)#*;<^rr(sz2>lBW5jN+qaOsj@Y|jVE*;OUL=q}}#>E3G!CW#RBi{K$6qy)&LB|GF#oKkR@AX2le^5Vm zF+$BoNGW4Do3J$AwBOVeA|u{1_40BQitLH?GR*r)f`_-2cD@UuW$x|&>--bJbN@jr z`8EFLd<QUw=yr#bq0l4-%ERbl^xM{rZmPB~pYZcBO}c!Ezu4o2Uv zWd<+fOwT2DT&ed^_HYt8U}Y4dHIirD-V&YGIZ>C}K9bvaK9sBr5?^+6GbvBns*M7kXW zv>TpYxB#Z{>3HU^lXF!uOgbHW>72F{%DK@lCbjSO(^nSfC-WKZ#1y1e#U@FGb z;6sxSwv*99lWfcIm)7nsq|hM!42}yOg@B!}Vl|&|wVLl&&t>nnIzwpI$*3RmA(&=J z%S`Y{H(y-+CGn4G<7w|R6vf2cmQ#L-(W+=nvl6sm4xn(E;TPrA*CU7mVMJkBRB)AF zbmKux%Z?8A^*If9!(e+gga*&KgPSXe#!h8 z`grdubdN4HGSf-(72iGrzwhf7`936na1Z&~Wei#=-uDQ+!Jgq+fh`bI{2sTr?YZY& zn7uZjzbuOS8|$e{OJKw*?_{53Il1w6uq;8mrV{BM4%P1$`zH&!nkC0}3PQ(NAA|_G z4_&8>;X#H3L9`dhV+O%`WV9ry=3!^-vN7)B96g3&ea<~KZ6teac|r1Rn-->c?c=zh zl|ZZR+Npve$V(n5SqiT%vegjoxg~cW<&-a%fdV$bri?P}Ph0ArBV%4a91+S=zuVR^bz( z%B_Pdo8=Sj^O~m}7*<>6jcHpUnC=Js8Y>7+@rE%R^2&emR!Wy^6Te^`AJw|jXslrs zr%PQ-(2;eR*I)z4*Fr@5N1g?hds?&}pSWK~v#Ud(Zq*l!Mh$zq7r)iXhmzr@@HLC@ zYS>^DZvPXoUSj85BMV9Eq-Qm^%(WktLMS5Q_Q@Bw>TPTv`w?>|S!p+0M}V%I;qrCvTJxRpX^+6GIoGAD?;Sk3~oU#ov)z5P^U-6d;uj>tQ%N_AIcGr(%#T#%DU}vLBYw{ z4I{q8xD_H0;x;*9-HuRBY?yiF1*sTYy|O^D5;msriZ&(V)TGP@fh4YuI@@{e42gL5 zU$D?i8ZBqzqk6V^-?ptO4BTO5Q2ERrRpCJHH$_PP+ODAZ%pAnX7OFWo(vPHdenjw8 z9mP_4J-_bh-O6LfeawN^a#E@DFmhuqg|q7?$n)j=X<3q=$9im;wyUAoIyMb5x24g8 zVFRn*uf8JU9pXJiHz^EiYu`tR=oHpc{hn8L%^~t9|6S|HvDNE?fIGv*smEUp^NS;G zna!Z;_8bneFRpP0e@_LB^7njpwQvnwo4_q`!N4{piU#fP>d`(GC5NLA{o^l~!0XP* z3+?msc1Fc03C6uoyy9%)|7(l>S4reYAVM5lu{k|e%mn?v^pHc_2U=zLr>Ff%<58<& zUiboZ4P&=jKE2`UjTCkZ#V4gfYW!}|Z;HDSIlt05+B%6G=p;;npH|hUtxp8@p}>lZ z!gWJ|4h?BeE*KLNJp?vL;#ynRL7q2q%{R|x<>MO6mY-=mR(_@ZWAkjJ1M}W1r~gH5 zD;+6G;)@v+t3e1*VfBO8!I)rI@0@a80=&AcsyPt^)*u!7es zojJx{Jv}VsTi&V)(yQ&d8zu4}Tna}?0r>5n>FuzqBNo=R=qM6#X)c=4wn){(3ZJ5+ zXz^PPu~8@@T+|xr6n!3kydRGAas!Me%rC24u2sk{QQ9RC|GuJeA)qB>jM2UiUe+x1 zc=-uJZrL01%6*(ia?F0*m3PV7f|W&h3M(BokCM9{#h!IP-ag`VTCcyE;G7o)a)mT~ z^ywDQbnujhZ>+)-=cXszNkF-^$Q*tG&B)u4kC@3P-}n8r8Az+c>;6J|CJ~*`T|vwLnT5iIlOEDM%QKUO z17ggdlsdz=oQ)vwUTWYErd+||p>ZFERg3PF+r$)xnke4heSR8&2zH+$0(IBG)QsB- zD1HrDQ!|v1LCz^F7Nt(K19>Hs)o)qMDOex|J!7HC@sNeo;^HWe(U9IBh{NwK~&|#~fje1>( zAbL;5(F5chl0^vn6F&{fL3LZh?x*G_K|LgE-!lcw;7c^<=b!zlXLEGq!c9}un_aw4 zwQp1=JeX|9jV4oOeGCcm;eQ)f!v8#CCgwBNC9Rqs7PE9A-*4aMkf|Ww(WaZvw`4_m zRO@AJL*jP02W7rh#d0y5evF}dXTJTMMSt(iHXH{_Qy%B}qJR(MedUFn;V=2&lSi4z z;r<)MY$3s2$Bb^r=LHCh-iMt41it=MAr94x920K%;Na{&KYq`|o~QBRRCE5C3U>mC zK_j@LxxBQpHblH>!@^!SKvl{4_Te#ZVagOCIQ36P1gOGC3PT=5_JQGF0N?$s6*rz_ zwapAEkGh;aZb!w;O1Omk3xhl=y%8*48W-^#i5`rE3a$>b8Qgj%#JSvZw^fAo+HW)c z)}wJqyykk=b%LU|-QR$YC4f7lmCI~lCLw?-2kPKEO-|vTBn;D=uV!QuA?BRT@iyyT zsPu;>s~ZAxzAsA`1@fExa!a0AbMjT%vP<Cc#NY&ZBV-JrJ;`HtR)aQproM!#72E z&ap2LCDldbt5yz;!Q$4{m0cn~{00q(tv2Tqc0~D2^QeLNh*s4$U#Grlc7iV|3qPKw zK1e$Ry2qh&)}+BNI?rPt?~HR(KCin8n=edfZ|@IB8yp|ft1x>Dx4`rug0p(j6rr@g znRsUnpgvezbYNS}1%mG@A}Kj5w84s%ySK-*cqpZV_`Wzg8lyl=EW!RU%O@7JW18{% zc(>B~kcm|w6>K)dGjvP}7|{_aa6)4!P&JDJf>~l}-9e>-GRE0G5&5K(O@TJMzC`}B zBMGjsog{BY11CH)olRqMFJ}f3AMuwuX!-t;(=!rZd6-rN|I4rRJPDX@ebZSrsM8mj zaPB5}%3Ewf?iUJ`?mjUZbf`+D##fKhy%_J}ofWestuCp46mMJV%vj<_R~W*zx5%4W zOKbhT=u?*OtiHkjYpgO^(K>QJ{LDf|hm-l6p14iPG=v$FHB$C0fIh_|2>wS#02v#* zX<{_BCxvs88D!ZLrTtd|7yJ&;9^LS)w>5qZ${w}gF@kZdrIHYee5Ld}2Bpwn+XOJq zi!)r;A`jg>lR7MukwD1D4?uS!JJ;FI(*g#s7}!2&*=5#IG3~pYlszEESBzS} zrr@}EkqvaL`g7}+f|ZgN#89)km;pHj<90}hvPY(SVC9@rjn0t5gTkHFyHw=(O=WTz zaT0RyI@%YwX@wwcM%=9h(w1!s^9AAb!g7wS+&VXsLTqy4Nfz`@q= zWe$H&yQW{2XiuiiuqNfXkbV%e&)F)wawpj6NgZZs4zGiBsEwB!wPTj-IF@!$&vegi z_7Vy&{TF{maz<2{EcfzcJSMlYW}80fr*;RtKgXWf$e&zrQZ_|5G!pId>nsdzZJc|n z;&d;rC|n6%|6m!+6?DjEOxDi4^8eXT!jd5kd_ZCu9gBnduW(%U;|q#^y+lygCoc&4 zu}y_tE7GHd=e~f8TbCC?C&{Cz7)h#6$mclP8--hZvUaFwX^p2D zYE@NqPvq}~Y#n(N5t~24n~yk??ezDTa5E`cPz*Kp77#Re-L<*}Bv^Ve<81kbSvC^B zO1At}@KQMbyZ)a@Xw$(4@--7X5+f}@DFwp5a zV(sCP>trB3TcQa7H|i{{>QwH;s>~rrx_Ny7{qkVk#1zIyAgsjEL5J(?_N5M;(EFW$ zcgm*c3$eDkC)eBS^}_82veoV)>Wm2_MuJ6yAe#Gn`{+cg)@wMm`ssZmAU6FJUqC1Z zV+&?IXfx^9*xw0dYG3+GXcEW!=B15m<(PwJQbWF9TkzocGp>tc^ouz<@_IOMv7?-^ zaH4Xo^u1@}*46es+q}**+4%0ooXFE1i=AT*js5l+Wf}*_K{aR77B1<}kT$zW4SSkF zRvPg=hG~S`!p`oi>(o103B)OZpuSa|c*NkbuGxNEL>dLZCIAv1<6rM!@ipfKBg8sX zKSnLmAU1Z-x4cLqv6-zSq<3nCF(P%MuH)@YXa)a1I-az&*F2@_4sf{xZ7rz<*grZKvFpZMW z)MBK+sveukabIqw&F)9bPDAG!5w(PnbM~+U$i98mvrJK0A7;@k4#2T2G-g4$Atr$R zc`}4v;f*x=nKE;h`5QNjs5rmD9JhvRHxNFNdesN=&~esPQJh#12yS#$<4ZP?iQ^1S z%Vi_-Uj0%j%FYBWg({Vtgmb3J?H8Hvg(Wll2y)VegA269SziTK=qr=1RfD6<;D1wJwDUIxHE(0@H*!nIexyvSg>kTTmX`7EI=|9+Mz`Wt^12FIM?^dR z_JvmlWq)D39Dcba=CXm??KhXwC+w%~6_uCR`TbBxhVpuaSi^mspL^YQ@LMVXtK9PD z=;dCr96Mi@ek6qg#mee=jKdvwLwg3io!kRS`LqSHM(Y~pA@pys*c}@I;Q0%-AWS`p zx0Vfr$!~7Gl*W=@AG-3sMpA})9TPo)3kb$~Ob9}=+%krlqb*>0xDGkE9R@niST$^? zPlu4xLi-NE%Bu6}5;LX*k6Lm#2ae4z$2TH7PwThpv?GS|atxD$ha944QZuvnQ^h|E z@(_OJr@zWx+1*JCek9bhO}F;IOs>jV*HoFH@<~6C+Yvt#tY$N;ZGK-b+)#Ht@)UmR z3rV^-er@)!t-`ud~-1~QleOQ6%s%6ttxO8L=ms*_ut0n*21}WKf=jLhf zt1G)isSgkM8IiD(xo}Q@i!o+u!oWAiIo)$(l!cR6CK&J5|FTBP+n!9qw0VOo=(?#R zA6bc5TD4dn7ruiMa8*NeGJNR>&_WPHc_#CAVZd@jKvVh@Ach3e&ss#nl@1*Iu7r2l zjKMaD8D?PvyjUqLnwGi|#W-T$1Jn;jzdbkH^H#DvFPm(&KyPJ<&>~9A<+LO{13FMV z777-EFSK%SHOhcuf4ctdss@O;EAQcGIZe4 zaV={7iL5=UFd|j|Fx~!_7tk>w-T?QP%i3XY8zhDDX4E z&tq*EhlZ?dS{8y*=(s$E>VSFUVd*@iAN)J``6+MC#NWVwIhfpQh}FuM7w?g#s@E|@ zx{ci8^q0)3Ond%URhYIZb>)*NFy1j+LnF9U1fHsdJZ|*o`m!^%&KEZHUg&>g$ zus{E?FY3B!9PVj6=Oa5nof)RHd%<`hQ~0@x*QK6*L=`^nY^a@6K$76!K!LOHcKF?O zVwr^iflHxK;0u)tI$tjV1%wIx#v^5asM;xmC*!Z3nDWl(KGB$0;pbT~qDyg7H(GAg zlUBtTk<`;somaO=<`S4*wQkj?{=uOnXkk6h%O;=8qQ`xKL%r2e>3XgJYcp>8RDu#d zJ0k+PE_r)gi}Si23C%aOUqYi*p;uu-czds9tax{OF&CAtV6ZqYuVnS5=!9woDXt&7 zJ-8oLh}W`0sl(=TkHSX!=G>Fj4Vy*#fjy&P9fL!J3R*Y>`(oEoPHB#PaDV<|Bo?|k zuhr>BpG<7L^X?0Dy-ZX!O8$Gq$Q?QxXg0H?or4BetYg1Q!w*+f7(UkI}>L|1o=pGzxxW zM;FEsk+9P44-W!m0U!)8Ra0$$p>&x_liAfK5$kfQ^tl*CKXyR1gYtOtHErmEP6 zUX@k&tE!3RA?G)DN$4R+vC9&`{6St1QxCd7w|`JQ27JFCn-6Wa;rf?abu!z&#j*w$ zDgXdv=5`YXXkRx0x=!n8EfW`H6F4o0p&sR?BQv;Gj+z<+ycFtOfw<;NNM*u)5Q!E5 zj_9@Gn9@o#yJi|UTH(<;CaArd!w0n%ksoAn^m_lRrS7LRH~KReMz-^9-1~WRN229E zPA~rhPBP*E0%T4u@%WJtqLv6@$sC2bU|E!ur0pu9c-Bj$qM+J-2!}^&MeR6vX4oIfPYrS+iN3 zIyR%(|6X4284Pz0B{(E9+GOo_<83w?8<~zom|F(+F_Yo1nj}mvq$ppPreE|OB6j0g zmnN>WiGp`w_3|$czNsv{?@t0p9hjYr1IE@~ZAL!Xa1Mf!%~O6#p(g2KBI#pCk?`h_f!m5vIgJ0#u*VDQHf%-zV& z1~giVK5l*zEBisUg_$f$!i#^(9rCqVQbsQeEKzNUesVuuLEaU{X)^=`!xx)tW%0R$ ze)f(WG_M`Ma4-SB=!P;EOylD*K^OE{()!t~Au?q${`}oY{2fIHDDOz`eumX7D1zw?e8xv#5lZP!;VMvx*H`sqfWx zm)>pT5f|T)Wj}vrxi^E>6*#0g3w`XSeae(f4O76{5bT$dp|x~`oZ>2@wYILlSp61c zyOx8DQ1sbYcgVPCGEJtAukcBZ77T3F+yJQK~9exnQ0b>g6(pVX{&csh8P`i-{H=&hclDxh*c zN|q5v?Tt+5k=btyEQYsbC=lp<`Mny@#-VEwRb$9=Ga8iLN#D=bWW?ks=w}4W-y4^; zE!Yz;^wGV>TE^B?F$uIteT1H!VRa<8 zZ9+p1Zg^iC-;;|T+B>uOXeQ0fx27%&mLEPWC zfcTT&PeWg~u+Opgu^%5{d0?sx4_^8YKXdgfG^y39b+2`+!S!LNVZ8fN5%}gzH+vEA z1GHpR*?q|}O;9>;KFM-Z<$ZTa*j3694G4+(6)I?s2S>b1*#(5#K=Dl#<4|74u81uE zi4B*7x`TjF__CDV{`IiP!|XEBFdsny6d>Itw2l>+2@P;L@eQy_^hCaHY1Xu0j97Xc zHmPR%s#Z7d`DeFzA*FJY2Acc{USA@;_g#P(rSRx{%fS8LJ((5PdBM@Rho$m@{J+=M zR`AXY=x8tN^%E#xtJvO=KLX7fstTB`NU=XNtqe;(6H|_?Rr}ZKd>F6oPMfH(lVZQG z(e+oexG>aXCeu2NaAc5uf#9Qz)fWqi&Cy+rY*Et`NzdS|9v*hu@Bkr!*Dy>YZ%S`@ zAJ4>D!8?x@`i;c(DZyB0vyq8gob;Rs)Sey~*e8WFm*9ausBu%yuDOn1yF`^RZv)lO zqtNOX_7!90n%x7SoNyrsid{Lt8!C<(J{P4AQ5{QwBAfwtzG#AxOS7JiCPN7^C*~B8M;Zn6fz+j9bgkjN7v#QS>Cn^Uke)`6F-JF}^Dk(5)DD<14s>07+CbYrAA?eb@QHIp!PwnaYo*8~v<6_K`)|bz=xb3aloS}toY8fr#rZKQFUOhqn?tAjJE@FiOH*R7v3axJfgd6HJZO`cAK@_J>q_8~fx<19)Mx@sC@`zprv4~t(_OpTiX%^&e?9lltwnJKa#2P- z@bDW4tC}~PxZH~xYv12=gi97^_IKONm z?^YPh_)hSaS6Yrc#UohYnyJ9BFzmx*cLKc}rLxBQ_w z;yaVCpDm&b$W5ml`F>Pqof#py;U7tKe>!{pd}A-Xo@q4%Tgj``k=W#96Wo?Rv|A*< zsb*UKc+a=O(j4`UnDR+O%DE2)`+&fHAiu*erP$)A%8B~!BstA63LwkgHzHti%w8{e zp%&c?rWdfI$33Wet`LxeYD>nW?s_pyv`8ua@7?AxmN(lrQM{EMTH#F<5F!uzi;~E9 zbgO*@?C%y#o%ctbWOTHHnFp(o2nL2YiN_Lvy~gW9USFjK8Z8u~G04XCO*S?1au%V6 zX76#$4;lC)cNPVp%_)IRUgQz{jylH90CNvm)K26fCxy=wfecc0vj7-j*b@~QF&e_h zO^Vq8c_a7{!taDkDte}3FqRigni(9-aEAF?T{37e=x@L2CwcYI#O;tw6&7enl$M+^YhGW8g(K{SR^B0#7)7E({w<7t^kLN5%@XWY zPo*lLcO@CUkkM3h$p_GZqe9b%C7}B`B9@6u?IctHlv}^Jn`-?G#Y5i2P`W>t21qPc zLoJaAvrki8C*UcF%oSHDAWY5VpO&;Pvo5!6S&5uQYpvcbh)|Iy#}}! zG5Sa$;*-tM4!6fK=8J9SenW`asWAK@Vr6C(axF%<#7O-r0LSOLRaATYjW{H0{K)S3 z6nz#&m`}F4pdG&uazD!A!Wdxy-lweVzTvxK+^M}*H;XJ14)Ka4V&>=sr>`cRr;YeAx1zhR@Azmp zw;w)vXuo%k9e9s(idvwHx=44L`3wb8ZG2YyArk}AE||5{f5{Sb^qRq8o2 zfGX)J$+a$ub0$1F+Sjrvg7ZDI=aCwO&wC_6b<1mCFDyOH2a@IwlrD`+qNUuRURrFx zQf0E)>E+0mles)*M9p)V4e^7s=}3TPekDr)Bp=#M!lkMP$+{$g7uaXECzXLWYTK?0 z0;d!21F!c9jfSA`e6Q2CPk&NNai7%4HrC`9xzFU>PHtZ=k_Qp>)!`oSrOBdX@KI#b zw2qR!IG?R(3c*Gr%yPMk;+} zp_wVbQ}@^qqlaJ`w#p8n%L6NWFBIN9!B+9PSKKv_xEGYy;00T~!0iGEn_Gva`VB<6 zqI`T@K;jR7$U2j32{Mwx@uTbdafrETMdsq9p1DCnlsm+&57^m67&J5a@R3CqEOwRq z*6)%Ss4%Y3-S%T3MQavCtaY0uF9`b=qSQ#3>Bt?MUB_}$P+0jm?H6vUyQZ(oPh(VI z=}mn%<1~!WHEM z#5dwE>J}aAPcbP1#uOL$EQ)t9JN1lk{-OwQrT6Rj?66Y;+j64f++Vx>J}QW}UEfuB ziyJ>gQz_}|Wv&(SrUuv0mE`M-qPX?%n-WFp-$xWvZ)1_IiT%l2B2w@*`JzYnI8kye zn$a9&h-=qijdGS+uA6;rZqdHGU$+9Doc*4dYHy}{ONqYrQ zxbk9lw*JIog*vs}uWMC0LM4-(Zl05z)n=e99*z6!hpAaArX-x>Fs+ru=7MfuQZaoX zb^B(!T^AmZ;_09jCfozMkH76#8{w>NvG*;>&m)eoXkI0F<%*xGPO>!N0MI!j%cO8S zcE(y;=rDHOvBoyN%1<@$0o1BB5@#38K-=}F3+|;$jO;)Mt80?{^JyXAE5tR!_4g|z zE2Xd<&+(Z)g9y1>#~M0rUt^B*l|4C9^5{SF*kwFX==|3q#`}oswiW7&dayYJeffYKnN=R)5v~)f`c~ec4n+^Tu?$^*#*1Ad%vjtOApTSOkbFu%YcSE z*$@3f87av1Z}x8VXz(8vO}6`)V^wRK^RoI4F36%G)FI;cP-3B7Jm;a9m{hW06+w;W zd6=4_R$rReDV_Agt3y|mgL9FZx8D;Q1^-hqYOOf})>TA-?&VWnN!f z@29VQ&9;Bq&x&2C$6N-XZyqj7&FOG!Co)xJ59BDz{%a*{%BayQa%u^l99)c^@eB;%GK^g{(Y0ZRphT4QIgIDQr48b<4G{}@kM__JJy z6Eh6|NMF>%b;Z`k6nBu8fa6ilCxfr8JodAg?WhC!e#_%cMz+mlLkd;0ou&; zCxB)1`WPJ8lp_=AmlIwSJl9obOe5m1BFsU%h>H;Nj#fQMT&)ZzX@P!`@SP${>PR!-X7CHpb|=QPF#2* zXk2nQWcVsSv~lX357|A_ErF+4zSL#n+2`jXZ263l&MlF#ea=^1Ui~M|Dy%k`xkh^~ zpkqBT_d!QLjr}Y<+-K9H@x=l6&e=|cgIP29QZoPa_hQ*&VI8eLMjA|9K*Hd-HJ`dr zQX=5N;W#FaY?|pj>b>|J>3HnH|2DV5j;24fXei(;xgiWL+)<*@Duiz=OgJL!r1%Gom&)u8Fh_7U!&~jq4z$v)8_ZCyj*Vn#wtaxU?hgKKcDumT zo?3G05RRCPdAmHpF`r$oC-P^{p8jl+?+BV>iKhN8usoy=`1rHM&@y)d0oomq`&XdYiaI{{lvzYC(4A_Oh# z3KPVZHg9fIfXTH2pT3f$D^=O{E(yMw8BOlcG}3@-=z~pIZ|(nOVrk|Py6gW`9NZO? z0kR8!T!?s3H3lb3fxh+SX5WK3|u05q$PK-tgu|74oK+eQs2Yx=kCxkrvhy zO2OiSQmJhUe!J%L07R?b&a-#weAk51c04HXK;zwfI4L7iGA73>+TiSPf@<^pt`n5+ zd5XuvRUJN((3!BY&P-MlY>za-g|R~diLipqj$cU76fRW8)~}tpjn*L4 z^{LyuRfB%ngxH42YzM zxrb)ZiqrVO9*vW%;>Zp;%}{VW+p<7gJc7-H%YevJd?=s*B7Oi|uMw;v(b3$oEiOi5 z`;)o**)^!R!;X%)#y}Y~KCx^Z*lq!d@Z}N+qb)L+)Wr$#eJylT<{7VkJiT@EcD`S$Jm%vO=0akWb})Xkoh4ts z5bm#02APDb)^miQ@_tn{(U~HAqWfdJ=N3E3{?5BGSKzvVExXb89Z$5ajBP7Bv36=d z*I;ozovxVJ$M~I>e-7IUZ!uQ8ihCKI726$&GLkk^%Xdc#{FLG^x4tt`!S)*HI9FtXY2uQ5o)8If5MNI ziVyKBa&IW)gkAS7F6}wq*YEF@A}GKA$A`0t$fNJ081|mjF@S1*q_IDi3zi7=A)|Or zR@ZfOnSs<_6fAc9tDSRuf=9g5;o}|Sy0l8GX8q+A7|aY{QaUbPR2RE9nAI@Br|lF0 z^Oy0JsAz$0eoS)Sc?`9tfs!*?Vk_G2*W#@^;?UNcWA8Wq{hK|!=lAVi`cfoqVfZc* zz5G5-0`Z=l|2e&}JSj=ym07vn@ak5aXNo9WT#NE_xMov)W5pCd4(VjJ>L?1up zcJ-eLfQvAdOcU$>-bFU)w*aC8KYoPm`G?Zy;%9w&p4%0(cz8UI-~gR|M5Q6Q8cZq! z;(6j#u+@q38DKQ|PRvrYrJWMdOK6igaVW935CW)_eFG;mRkjggak!c{)%%$07<>sy z3nYBFIcW!raX@k8`FtxCUv;|v(y*VQCjAhJZ3$(Ho0BVHm{JhyfR~%Mt{gpTwTu+b z+_(Idi-AY@J8<$?R=Nx*-E3ob}@zu}+iLHD2UqQD|S6Qo= z4<(ikPkY~y^k?-o0$#e+?O}LVQ-(SMM~6s_Gp11K6g4h|WLU!qV3f|;;o7j^{$`Bd zDT~E5`gmePe&C3#!>{g`MR9CqT2Tjlbc0K4u)5IS?}_b%d->%HEas)fGb>U`zAxnF z)yN#O&>x7vGulqZM>HI5xTdjDe>hIdz2l<9mO=@_FuP;fsF~(=5Ae&x+1yu%ywwV4 zgL$3~OEq~P*+cGFM6VDfIsG#-)Fl3i8bDUQoiq#}H@g<(Cuy7K} zs)mM(gx|MX$9I`?tkrSAYpkfMp9u7K{>u)aTjQ_HX$2I?A`FHzR)TUEwgKly zB4wvw*`VccsY*?5RT>6>L*@If{OmKx#~)1Ut3%VWl*9g9@|67hgbQORoQKA1zfjUl z6K%#;P#v~gS*7<*W{4=zj@18Aj*q+uBLG#;qsj5^uFh>Qq3)?YtFX26N&aX->t8g@ z3wITA+3x-em7feAsH@){mCH`7kWH7oVin&0%bLRgP`crBdo+doVbpK!5$?2K7^^A+ zpLgX-Hq2Kq5vp&fGVz`$J|O3CGPV?JLPcNG)k)Z=?N>Ye@6SIBIBvi1d%v))kXv!r zP9()1^rCi+pNR zSgatzBr#-Pm{7#%_^S^>>6CJxuD0n31r5`5x)=}kluC$7&Szg`!%4seUazyC03t$b z7K)4}J767?Of}h(%%qzEo(IKxwY&w{cMh7tUWp+ocM&>ViGErnLb^}mSI}|@-{>Pf zK#jc~tYIi57Om8TQ-!t8K0Q{<@Yyt`c?gRvC4kN~UkQJqL+3J#2m3?MW+-X&h_JK> zuDufNoXid{NHbHJa0e|-oYdUbi0cB{)M-r3$;mY3!post$2FojpwcPHmExJ!mQS|V z9j3e;-RS`I^BtCGO#D`IaY8 z`M%j&+`b^)>2bpi_MU_17~2YSC86rZRTK!T5dsNwMMn!aqHt>aHlT$zO@H%CJwfJL zQ3rT30m)65>=(u)7XpVF&n)BR9f++KubE~Vyb)sIx(VXz1zo0~HoEe=C*IfUI$XFp zg9ibVfQAnzb3AgixxjAk{U(JN81K<>NAv_j)a4AbCI&~B=gxgM&7^m#ZT!i99Kc&x zP9psq==OmG0>Jpf>x*KsxS%xgOL(}3yM?Nfj%&y;*3n27e|4GVaJI)Aq9(ZO%hxG4 z9PePzX*jjMj?W`}@F%d=UDU6QJx1A~eh}==>VR+2#NH(zC3{(d%sW?r;F@cM!(1#W zIWo$BM|aZDyq{2U^sXuY4=*{C>2mGRAu9+dm^cYdZbLdJ}#- zwM+fXN{h+)sA~f?RL$qtuOvfK+dYeKq#W!L8wFtPW+*(_&GY)QA0Ql>(gy$P)mZcZ`rt-&8@kLp6EZttSQDm)5g!m8C?%3F({sH1lV+&Ek+ z`v=T>3Dejq<@U!@LU#vR%e8%Sjg~z`|5DinuY=UW5@$yRa(dY5wlUi7XS+n@Mm5gD7?(q zuY@v0QOe{idRm*eFf-(9EM zgvi#>rY{hgB`G_RtUiDsvLV&qtn)+r$&8b&f+~J1{JRrM{jlrL*mI;Cw>R3dYWm%* zi2?^cq43Y40D%0lWJ~vKyaY6sbT~aJ5>__j0 zb{qs1Y2u5JFD&;dB{tpqb-VJkn7&J6lJz@fB*3P5a#O!>x{4tC_W1TIy9<~16aM7R z!^uBZ^o1`X%|qz7<_-;?q?Lh0z{{vDHLJV~Lc9j08;=dydGrnW+8toQ2!AQVxAkT& z7Xyhv+J5$(I~rl#rvdU%{D*v!v~Uf0#KWx3_w<(jM`F+fLzs@5hs)Q9WIzf=)NL>? z%*5nzy1;KyUB5BpG0!=C{lAQ5-~iaW619xN@?q~|gI4FW^Fc8D4K?TSb9_V2K&wjA zF$|&{BZS&X`qJ%>9vp`iYn_|$N`N~vvA(9U{kbNgjh=*<3I81saSoyveXfk^!ecJb z4GmGuxLvX4n)#Xp$FHU&JBySWf=`@3u`Zb$@p0{+YSPPFZ#)w6RI+0I!i!`fLp$9t z@4guL4XXt0P z5YlAtEhPQm`QbBV76-EB3>R$sDrG2f8=*J2 z*tiPX!5qsWdeD^%7{6d6m{}bXDc~DB|4Iym#NQza3kj24ysoru4^|uG)_Ny^P=~CSS zFJBAccyh6QFn+B8$?rZ$>jQRX3kl zCCYr<>f4hK(qu#*6~o0Q;jS(q?zu5n`x+ymt z#Ea9-Fdal#S@#>W0oxQM`2f&1i}RUu4=;|m=<4fuLV;-}r&M-@H6ZIT2n=A3t-H@>`ub&LgVcn;KaxbqV5K$o}(V(bX4Kf<+Evr=W)>kAzk6%N>~PJW$An%TvNFYGY#KpRm%tZi1tCc7 zoZ{R{W?znlp&N?QG;AT*46yok=0j_<#K?@#umoYjkd9qUnF2>h9Bq<(NYo$#MNkYL zGGqFJ6dbFFYP3Svr9Gbx5L2JvnG(K1SF971A9lo)FlbmaybzX01E)d<(uLVyx6sUa z%qpO6ri;W$!nmmF|9i`bvm?td!yN!0k``e-^ZKsdH=i7hOunzM3|F0I*CPva{E^~U z6}ucyg+@@*xB^Io{T285zL9y)d)}7RP+5`pygA+}tE8&$h!I|B_R_MY z8i&I=jr9!tm>DPiqMhO=V?go$<{VG;S zaetJz!cyfe(Et7ZJy0Wg_ySIO1f;R_WXVVRuFN9aCr0Lr`X>z=)=Lp-gBg<~@O6j2?OYe`Iw2^0j!z5Ri3He-b-&)- zH#czLs(Vs@w`xJMco;V2jrw&`_VBhtmW4k7-4YZA82^pRyhS+zo%%stCyJv_DvuW-1q5q zHx=Y1*ONY62bLh-Y(ArIq=LYXHGDgean?5`i&&f}*qhknSft^!>igI~JUTiH(|^C( zCB>M|Owaj3cKcQUZDX2L`Epuo`bb7^X3SP=ttnir)ibH2nDkcezkhx8G2boyy%+qo znFhiHu8usO`bGdeC7I_3>z!#OB9ZDfr9OiW)cp_lO@wpIi=wf*O*9P^EGOL3dfS%Y zcZF`RTxH&5Q%f++#KXK1%>>Ld!i*aJN&N`n?sf&{qw6HrIZxU<7;bt0GT2hR{ThH5Y*(F|R-J#l=e(uDQ zlItaaqzFnpqke-+wVQ9g_Xb-;OWQtk&P4UH1wdIDd?FQV8=@5YZ;@d+2y1}9ch0W} zPvAohWp>8vzRU{AN07b~d9>mkHdYx;Jhb$GbDy8Es1OK{f_q8VYMd>1@d?qs*DWDB zFWf6{EpCjcbE=kYl+6lr3r51yMposkqa{}5Mwnphc6)dLzoECsGwI0?%L*xL2u^V8 zcbA}bf}B*pEPF7YXcgbjkQUXSOF#^<8uNr+Q+ZfT@~T14O0wTorqEQahhH!R>>5UW zH(1aD+wyFip3Pf%tp0fN{`A1}vEE4`7Y)5_v+tkXeqV7^g%~9PjFEx5Gm^oJ!uUSSG|Dt04ACJ7YJW*?)@-hwCmL?-tL-M~>bxZKNi@W~_H zfy)D_Tz7{PRgYHJk9CJHfLl;3<~zI{6d~jED(sBGZ*DTwdvTE0nFob;5KBQJ#S@3l ztAfzJ9Aj_awNu@rHr)A)WJL7{nutCE2r7MiVJg#vo#U(s=@RJyW++TQiTENtwCm{$ za{ICn^5Cu;&JPh5=*kXMW$e)69GC^;a+vR>o1ePK+AJ%eeVrOLdWOkRvPWEo{^Y39 zd3YU%{}a()D8lT7?Gne7*wTeK7F}S^{rYF~T$K+2kgJ7j)eLPoQl_a}T#&YRwRF5h{T1I+mukVp$ zVXhpg$0n?XOv>Jd0riOL!%?405I6*Xr*#A4;fpeOf;YR>zc_=rkApTPin}_l1+AfW zBVoC(b#|j2k}ngv>j@c{FG%3B*GgN8daKB(t^7!CQY;W zsJnSjw{2oOw3n#EVt-vHFl(`YLren;$D)D(bh|-F2fWt8%>ox0N1ROQ+NO$Rtm;wn z{Nk+0-k1A;qXU2wNV?0A!!OBf47{^wYnKcf9j$#EE(vEm`0p0B%p?4-=Z8Nft~g`k zM3J=6GwqE#!VVch)9*vjAo$XjY@usB( zn>^@*GcizYCWfXY*@v(dGj%^7kWF}IeoPUz=Ka8Zv~XUo-0CQp@oxfs_W6#q;0xBW ziVREBRjEA!&B@UVsJPU!(c!Dk+pJHiUjvG-GwFG=>Um1}DR8%neiILg=D{If@RdIzQorqMQ~am=Xx8 z=T$Gnf@p^!VoSiuZnY6AZIeObb&LR-pTyIa)>tQPG53e0f=c^K?|&&qA9mdr9^Wd= z?^sZvO*Jm8Y?G#`j4(YHX+bz5LW6+D;QMrFw1k%$<89awQ8M39s3=I=*N?aq3rm^; z9XVkNSfX*hKrN|2OmXiQhY_Aa)J^CnWif|Jb^|(cU&l1!LjJ!Lfxg)o!R1=B-w0@~ zTL7DEl(J^nbs74!%6rRyws?@KPyz8Y<98g`*+x~Ap9{Ehd&;FB<^4pACSoB+^Ux2g zxT1D~rkCF{`Tu_MnK=hvegRMko4RuUH9Ysy-Wr?Kz{?Mkyjln#p9p@xuA~$)Jw((`dI3Q3Mol~Gwt$HR zEG#RE7QHXMkeuVK|GoFl1%yD37}K8~8a8{6mS?_VRk;G;`m;lUG1;9c$d?KOK*5R6 z@{F$&Q|rVwdQu;>-5ivBUWFI7t``;>yepx5qPbY?1_C4A3g#tuSQosdgtMZF3{bJl zh4XQBw+1LWJ9s$ZZ{ySnjn8o+PxS0erp)Y+C~W;aHDMWLSIGNwL7mT5LY>PKXV)6? zkve~CARfRfwjvF6|BvBUb-$+P%E+o|s~6-=b#>fSHz84n;)reX)I;+XG*+XnX$!0T z?(1@+ zLrQ~XiJ~!Qcr-A6FW+jHRXRJ#e@n+Lj$i`nmn(cHpm*Lpu4tdJY1{*CQD#{{o&AT} zf3}OFJ>Q1*)?}X+_VRpsp(i)U^Q@k4s`a(bg?^+##Cy=i!Y#f7(k-jx!_4Jd<5d3J zf#c2DhCX=9nlI$*(@1Vsmo;n3CKYaBp{psMh3#ZX9_v>U`_c6GpHoZ>97L-Ih7QcK z=daSKtB+ogj%!uEe}rTgF5Y9uiB=4oJjDaS3CVe>`o|@Ld7Z8I?T%>6Mi-YXs5Wg8 z%cL~D>U+D5+c_KkMJC?}-YvF$^;nK^?SJ5OFa0(>8IH%1fADMdG^I@5aD3lhY0rIJ zdAke1x|CzoT|lkD>vrZl?FfI<0jxh0wgu{4ssP%zM=1S~5%4xEYGmrNY`C$6YR{7Z z7p65up6dVCsx=NYi4bTlo7xAO0UvwN{a{%iP4WtRJsPW`e&3Vc3&4`&p~%d=&o&22 z4^ajfAiSAnSZ0~#MXJ)mfpRqlew_mUVRYK0%6yNA`Lj5=Eu-Nciqcm$06D?c{KME) zw&0qmSyAb{FOZ9iL)``$*i`~Gs`yfr8^OK-^dO{8V7@9+Ujpemjcp$2RbuXz9N5Dd z&LDRA9)2i`?vl-v;%|kjN8-6#akB>+0)oxRx}_puUYXz0X@6DfETO`w%c^1tv$15p z$uu(MPfurX2&{^Q!THK=68XEH^%1l`bg#T(O-{i4enA*aIDqP70Bj;`MloZC2(JZP z9B|8vdRyVmFx$nA`RFYD&+$&U}xTxN(3vaj1+v z=*kfKN5wgdugIN5qPnHs8l$@ie)&xEz zjrs~UX%Q{oE#-t+l%dCn3)X!j=9ANxv%lV&4KlJx*G~j+!`W50W}0^|SLk~t2#$5*sx}(*@||VujWktx>42dlJ;RT} zzHSGwjW2xTFVMvdxf3R-3^u*eeNy_L0^90JmueQnc4*XnGiZ60^cfk69X*Ba+OKpv zb!OW+8K|;)*&8?0g~lcvV5R;;ds(@T#B|DdAptX*%D&u;(4;;cy<?)A^KxW)~0nTbl| zS)7LUXfG9sj`@wO-O)37T^x;Q^@+@iOm2LML8-N?z{8t&bFo!(sLpc{#$~OJM{w5L z=!pw7FlxJcvct_X8osfAt#+=sl7Si%Lq2eZTt?I~M#V{A|0SG2nIgsm64*nB4*Mc% zk5GAiz)JM_BOHO{uc!9^Q&Z$f-Jb$6j2{!!C!1|YISB4%nKXTwFkwCclcwMEm;L|} zG|M^$(*V3U%A2W{+6~ZMtuWelwhETt5@AJqzw8-rMeBW1+~t+6{{AF239Ml?)2OkY zqTc58GXv@_5OCpBAs!kpW0Qp#C!!?JEjip2wgAwDZE-j!kOD|HKH%F@yYi@=L0n3} z%wPNbX4ELcu~4>C%ok&##(6`Nba%^xAwgljF-BR%A|>|~qfhmmn$S(CQzJ0nr%iVV zk1B17cne_*#bl7PQn}+{`Clkc;GEG}`_0P*hy7o9 zdF^xdU)T-)boFc5(THeRykU0NSMWYftBZMH*TPW>yVvVk*`OgMT2uXMdZf2k=zBFb z-T2cYD_~$m2!(6?C$t>GcVA<%w03s75r!BAJL-AhG@dM+8L`k3bkD$rS;dd~nK*D~ zRNWY@i`V=tzk6ZN(e+#)wbg8a3!ze6w=T1~ZOCIOlqQw;Y+`9lDcR*S(g#afHFtd& zMG2Q`k8g}*Dzhm}Pz)4p`4HeVD9+cXJ(62^|8JBG=M+j_K$rx)yg{pXihHrESQn=~ zP`{)@BD{1j%;prW&iP>KODZd)H4^(n zc$2`*1zg}(3`m}vMzDs8T%oBqmD+hgBD~GhqRKoJYi82<&tWh#9@?k_{;gj6s8#3% zS%%y*WO)^CKd{aZS)ar74%Um}-hAf0@}JoAW7a$0d^Kx_YVRu)n@oQK-O_iJ^WQe^ zp3u=?jL+K3EKr_0Q+RST$r<34&Zyr>7tk3sUTTsKs<-76ox~fS{9bGX`O=m@TA$*C zuVR zI8+~y{c*OYBC#?Q$Wu*~ln#^I?v-w}B4arIvskp~$N86p=OQ3&-^1dgI)KEKYaFWVl*~OH@Jk=3?(! z5i}HaqSTq>-!gFsvpRTS5*1whbh(rL_gP2bCCw767=C)>L$x7y(Q|%*wVHG9A50SM zC^1uzn}M|ofDXno7L|;WT^g{2;oKK^;Dx4fDZp)4x{SEYCwQEnjU%z?+m{uII7$n? z5(^OGaaqc&B43Cemn$*zQ$^#N`juVB}m{a$R!3onMBqK8Yf zp=A{VyDUtQ2VYta@4cr_CvaSuRd9um*uYdjyh1|k$Vr24~wHY+@ zj1023@nR|rE>q`Vl&1_OtO-F#G*60MeqS3Dvo%m#?3Vu!FE{iqASkJmNTlUHR>&(i z=eARV?vz`qaLemVjl0;(i0Z1+0xzE!Qlg&_?RrIC1${9+vW5D=j%D-|(hLXQHW@L4 zsRDK(N7tZDTXWIf&^6#=g9bFJRjwW-h+I?IwI_T8;X@`KAr;$PlC>=i@{@S*_J~S$ zj26P|lgG|0QCeNN)p5XOp*GjV3@kQ2&T}UmF3B-sfA2oAwGpRP=d2gbo!feK;;!YB z`8E`ToSe|rN4aB4?k1v*6o8^Bj7S0R@T7g_A5HC50uN_#A8c~h4SWi#*(myph;eUn zp*yBQ8wL`3Qb;P%Y{tEn;6#UrZpU2`WzlW{xqbRQ^VOln<1nK1ft2o5tm2D6#)f>B zW}^7#H*Hf^gHNwB=T(MsZ}xB{{aH2|tfHj%;X7y)O5CWE$6BLC@9bvwZp| zu?YlnV@}cXG+2dGN0U0@Z2gtn;e>C+Ugzl@rL!VoNrFG21=!C)5qtm^VJv!0m_qXr zcTf6-WwZN!C-6d6k8SvX$Q&`3mUdIL*^dW&(*J|o{1ZQ`!7XAS!d@JU27_%Uw+JT zpUWRuelgwgP|BjwFhjnlykB&~$-7JST=70T5Kz_NU4egI$6sk3EDtN*Xdd`M zZrmPtUqRozSx&PQ&OIvi!|g{%^MxW@XIABgqpsK8?ZTdKvkY&phlK6wg_MN^WZUe> zU}0>UigX_$F?AelnbkC_y?c4heDL8d9X~nhy5GGE(Z!y|W5sS`Fst$eS*CJIO1IiR ztI(0|nkp*3#JM9fstA7?P10##Vbx!@H%r|r@=1685Mn5{*ip8>$=ehzUjc0t;HS(> zYI(EHgx6G`Y85E4(WH{DBwjD)IL0kSit3uA2q}L-+cUCuYj5Wg8m5Z04&Q_^7kOEN z&KjMevx&eIw6;hFGC47@ZVCIvr-x2KN1uNvkN-g^D>8F|p974r;WL z4nJX0YooH%d~BHGLhkg$8;@d;epRCcE@VG&hVA0=cCIQWroiJc!|aiugy*_`&5=*}TViY~NxfPpk{o5bv*o11X7k zJMB84*(iYH6y4$$82#ahlWo0~y*pPu);R@g{tb~y3pszn7KBDySx-#>VjH33EAY-& z8b-ywBl9Olcs)uBwt`6&gJRYcr~|A&zr{TW=sOt7*iQOs*CC5)ROWKoB~sdxqu<^Z zTwXevp1F4E9A%QC^>O=N>l!lSIQ{4#_d3qspycQ(hDdX+71wfhFtgL_rejoBsxQ#F zKx{MKDJ-0)xr*U&5|?V}=~TLzseH9fLK_Kp8~784Z@$*s*s6>re=hvnz+8N@&uK7H+SM|_Iu^`_~E2md@m;L z*&M^s7(9znKJo1!)t?RTYf#)pB*S%Bo7>pmu)BYbK;M1!7!L|LFSbOAaSMQNAQE5nG8A?euj>p>_ zw|Z_iv8^ilWrS&%r2R5&MV{m3q)&$6YwJILCyn;0+(^cGNWq4~C+qNE*#fZl%Js(P z&O%am_k@G@?|rC_tfBG*#Am8q;MOSL$2=^6{>)16M$^S58POp3a6sGaHS9J1ZZHqz z*~!CSbx@%Q|4wdU2$4^{X@w08^0afQi3R3Z-Y!>@q=97 z-1OZ4$JIG-*8y-{`o^}cHb!GMw#~+kt;Wes(x9=;#Zk=UvF$%B!SOpea1+PN8V;f#UQze>={PSO9LA0g`U?TVTWk1b!@9}EMiQhv7abIx)pF+nnmz&1wQlMh1_tU3Gv;(l3E z&EL?oii=0FW)wJ@gy{pg|8n|FC!TW&snk6(nKj)wbV1FIsDNjg$I1$>OY{kmo!F0osfZsO<7(op^(qwx_l3wK| z>~{&VVjMgK5V&8pToQZ)#eU1vT1$);6&@f5v)=|y@ittSsIy*#;(pW0&{&XwmB>y|zu30<5jETJ)2&|5?50;Qq0UDQ+q|uQ zcni0jA}zqHY$(&|oPjAq1@I`1s!PYxhs~AVb7Li&qHl@CRHK(z^m5;9c%mTgIhhq60idVkMas#73HwsrTv--#6w|Ixqv5&>%QjW2x z*vh^}vZWT8w)5&hwPZ};2=8?f_qb0{AenLbx2)(w3JzGhXLA(HrWrO22#D*Jm7dB7vPKDTyzY0cGrn|f>x z@UO7l78{&2hL)%yy`rq5bNd8(#9NEyomC4~b7WNvBn>HuirVl=S>yTvF9NT_n~>5=1U2 z_JTX!!MBV4Zb2JX#G?3M(wzc6Y-$wfXrEH#2=qw-l2sdx=T4xWZQ7Rxs_*zV;(o|f zt|>+lvZYgb!CRbSSbPPoP!38>MJG#})naZilX(4<+((2i;avx!(v*U!(GpC0F%uua zEmv|rU8-gRKf(-76T%_DEx3~tUb{Ynbc%GEz|8qy=9(8zDJc;&7s1N-xaV-~UIMG> zT*HUMFA-`1x;pPOB?OTZR|bKZVpN)5fbglEow80L0cLxe1Mmfr;;CN?aQB^je;CmN zKRYUWZ|B;yO^8s}&@J*W;1scGxG||;0{uqn9r@s-N+r159N-7~(a7SaC$;LvF(=H0 z>}p-2Ec$Gf>~UDkbiDImq>%Q8m)XfI*L_tPDBJpWRoxU;GA00%1(&JmCjCcW9qs}} z7-f&TMP~ks0e_&-(BHv{Wz`DSb@OYO$1ERpt410vHR=TjG(@EohN*GXKGA_mp2Q7gN{;)R$cl zh8cJo2h<685LMAq2#xpUIm|e}S%Mcml138vG_HJJT59VrW?c6JZbE zf@SJn-+D8%5ozF@+zCvtpN@uY>+w|KW`V=6J@toqtHp!YY_Dv4QXFzALG20W0|q=s zE?{}Arst}8&2umu53gPFoVB>5729s}YuNGi!bvs=RLV2TjO?gJ=MT-AZ-{2HYBdyc zzF0LR9VoFm^PA>+m0dbimt@1c)oYio`w!c%42(;;)t;Z4UAtSELaPS`wr4lIgTjx= zFCBSlNm?GyaEK(JfO+EkGSGA;CwI=%4pgQUkk`j)=cOatFTT)qhWw8@FmP>U%$uKXG+HY_YX~n(#6_dbfzPjbfF5h*!zc%Z_iNc>!as;Vuj}g^hGQf$Km;23rCtiJ@m$tL!7;$7Ize%?(*UVdYG{fW}#dU{y^B?i^I z(3YpGo#a$|V>6?Uj9@;-lt1kYP$6m_dC-LTDZ4WEM*3vVQI+sw8y7 zFFqM)aoG*Im5&wb_UmTCz;G`l`&%M=@lTd>Wj^P^y&x`MrPL{Z(}~T!IIDY>cv4o7 z(;Z~r@Rhhk_2N!@3ddVn3o3@E><6qjw%2K!kPS7>jpPd_hkCON6yxdv{WSeXdO1)& z;YkPY$}U%r+|%`9C$)f+s04k1l`Q#FTFxl84a>LR6METWTSSnL?B-+^Acu$L7#!bG zFZb9Is=~Hnfup_Xb`+qU0mF3$%1)%X4&+d!f>8@<1ofuK_BbqG}=Dn7o2~;d)6?Bakao( zU&+7Xj44nc*&|=WV^K4zL?K?w{@jUY>sdDjeQV&-+6=<4DfrARLZl-k>4`eY!c$O4 z7Jf~|O7!D$Q_1Oly;mtGZ+8{E$M<^t{x)T=esjuYvfIsKt(R3GIoPRR#kv(T@vJ=n z%L&FGL%WMN@K21p?n+6rg}=CttdoKX3KS!1ddW3w7F_R6NdaF!v8Ue`ngFnOf=*vpfO80thFRL0e}owiE%0mNFPu zI#JI^eV;d5;&lHJ`*ja(?xZhJ1hb+Yb26T}-4rWxGXIcC_Wqb|ZdDV|KWQ(wK0~EJ z=hyq`Z@@*08ICz`yzR#*j1r2JP3@adG^s;>Ri7JWRPG4SMaf>~q5ND(d%*(#nAbwC zZ^TL7tc=fmYI#G!;)J3vm#{<{^8lSn8xR%wP^XxMkx?daX5R11a@XSfNEF5jP|XMn zZp!$#F~1HUD+b`c{j2a^T20*M3^V|6ZVk^f^Z;*Q<@@+QK}*SwL-deFBm8ooMs9%z zRcur%u^ci+YB%&!LX~e_^0@hQ;OhE2TSaI-<<*j_5QL_+Z_7@iR&YLtU`XQUZW2FH zLH5Ry%j&B`On-@73!+}35(5O@0o%S+yPiRPkD3pt+0wSXW*j~Zb=8ivl(hLbrjgr; z%7ZX_DxT+y(n3xSe|w5*9tj5AtZg@OR7DhV)H&GgCs|Qii zz8Hk0TS2~EoN9y?VJu=8aU`AB^xB-mizUX_Go#7WOsFIy1@1g;2#udI5QnspRH8V; zpVv-$_JS=aY+?5q39s+@b-G!;`M0Q4P$V=S+#51Irb#NYBqFUY0>huW%In7?7yUZ( z2IwgKB*z1_NE${KTVire^u@=MGqN@1tP6Y~)=mt5Dt#LfDY6zdY#r@0;BcxQf5_(XZxBoEZIkn9(VvK~=VM(eS^uLn4w4ZXmRXR{!bR9NJ z17jw6WG(fUIb^Zr@3_NQ2{Y1H1Y@7L4*mPP0kyD`%pzshlH>YjHDkrsI3Yq$yGRAF z=d1>9k7Zpv71efNBO(z;zYvk9$*72Ue({8_tc1>;K?6f5w#{e@7w(Bs$p2vniXY9wl&za;Gz*jLH^m7L zT)#!2%>z&Xy{G!WRZC?vSjhqG$JTUw2+U;eKGSJ`VX9OP44!TN?DZohA#(b|3esXW zxh}$my=W?nORm#s(GZ>v7wjbwh}_lS!tKR4?jN`VFK-QlHgs8IsYB5W^qb*r+NHXo z=6L2N1zP{5mPd)>C*eaU6Z z0ZiNEp*q{(DSaEMD`5EH1T$OTo^W1zxp8M@W925l(Y8nlnjl+{636w!=Bk$gCC0MD zQS7&Egyz{SRw+t<$0-|Nl7!;-jCERbZibdUELslx`x8Lv;QeR;b!h`7Y;#dudUJmJ z-G>G3YPEBkpw^@e|CThQb*s1|iCYv70leVoko<$BZ98a@_>{^o&e({S5O%MLycPzz zrfGzZP3FtxSj?Lz?o9wVLk2+`QhW8XU+V-2nez)HC{9)vW79A0 zca>sC6OlyOVzg4IvQCIQ*J(-P=Qn!Z4tJXkbzYyR5-!Xmc++UaJomak~2?nGPyrz;f zc6@LOn&^fA7(-l;0kL?{a5NIB5NX`XaXlc3_DqANFF;+dq1=4+Z^b-4nLi|;LMcuo zO=7f-GAxXpm+&i44FHF#~5Xw&&wDRpuuEbuXm zooaHZy+#YxYu7s(Lx?tqfcFyv1T8vwJfyv=BB(=_vuE%^Pi*uzb!^;5WA1+1x=Xm# zz0-)X|D|&J3)v6H(wPN=V_cx;PrERFk^tG!Iw{0c7@OUQGg*B7Fb0`ic@}tm>YX8} zyF(P*GQb8~d{Kv*TK<2BR8KB6GDR^W_EwB2mHYv6-R0>Ug5yMYDD9nAFpM=Ad zp#)Ha#FXkJy*Xb~i>B_Dk>aI`ymF;JX-)#daWj*h8g_^dsWcCsufWA`=>pV57Dro| z1%j3^CHt_a0xVp+zjl&|t|_oklt9HXrt6~|8cc=xmA@6K3uYk;(9U+j7L#qEcx;CY z+WpK1VpxMs64Trsfju70@o;h)f2%PWLVwG4ywOqMNy3Sr22xzL*DFTQaFIN&!1kPk|>|ADMsloKV`Bk3+5Qt&%S%>y^8oMZ8ew&YWjoN z_y0wS$mUGd)7#HIh$~EFb|=su>F>SEdhQ1E8IVRi17DH=by9VPf=Vz3dpu^mOyPV0 zWuRa*UL)a3QsK2^1kF8@yT=kgXZ~yd-yZXMj|do_$Q+iWsY=JA49W}OCv!H#4c&lFcQVDI3yXFt>FCnfO=>{r^M zr9K<9sD1u7=EHD|0px%+I7hQ<+TTyvfeVW93J*9?TrSmyQ$J(EY;%135lE8T;8e9T z{T2Ij6AzQSYz(d=NgbS6nM0{Ya=dKGo4EFwRv$RXXk70OQ+|uy8uYOn9_>koV;osg zXEE`tWGp^~ZH?_ZZz$#Eq0J@@2l#ZfB`Bxa|7+}5=X6uQg`zVeHGsYB0A%|5)&7t> z{NWUTufJ+jD=5EOEqB6|?yB2JMalYWp~HW=G$`AurEB*i!O0Ru#VN@$+Ag4Xix2Ya zRW3DJfz~mYbKl_K7lSE3;y#Jk1c*Sgz|Ys4}3j*j_E|X5gK{y76k7{2tr;y9kDuRg-P8-j5xFcW<{sHtW***l}9^m;$<#FCdMnrrnczvY);~|M0vM z4YupMwM@H;?OGdhn6&IrdaQ*53;Tgh<>N#KH)qIe^5fH-Lx=LmA41u&pLVMSYfEMF zx(W6hFjFs|RPisRrgGy942@%;#S9R0Y|f0?u2Y1pNchktQ7^_hA#b^yPrvPGFVkF& z+5ka|s8myU*UH~+jDAF6#~D9~EPV5pM`l16^&)g{3>1TLl%=pqAJyKqv7S*Z#AnKZ zJS;~%acdKjeaW?>2jWTyT-6*W1Vp2dlZCh?4XwNS(dy&%1Veu;P5T0&}Ph0iN0O09EbXUH9uFjnwBxO-(37DL{-wd0cuVM-P-q1l%@!peq^dTmPLe z)r-CU<8SI76KPl@E!_!xU~zI`pfE+*%f7YF6G@h1!KY@ADZq3wn-Q;W_*6p&^O zpuiAPeW@49qdkZnM+b0lCrdHm`EOUKSOm4u#4t zvO-g8psyI|#JFaZ{E1-tWsEcLFG-j>7QNU;TOd_?09B6HvB68m_PgGDXG^2D!nQ=l z%l-WW=sfUdJo#;X)4aOUn2Uobw|Kkvh3EA+FEB@07{bi0CM!tK5!`w4{qi5!;TwG$ zm)fRVy(!@fm3#hY)+$q}?F(kG0tw4$m3NK5@c0Fu>drPEDE&t8)V?_3Le6m(;oflv zIcSncHMw~w>P40+RW#AE&4`jB^bJT8BLUZCtICtNxMhlspt>!r;9G5y1Km#Aayz^V z54$|-`nvTfw*ud`Mh?Sg24!$M4_eONpM;{eLn_UYRc;)AUZp?kyp4f!FE8KwK);^Wf1h`^dc4g#9XY_23xlkgx*93&}WVXFhf?4 z?JJi=(U<=IrHd5Hu@6UoLK$7cC-SR*$f?g5!!;Q*Y_tMwHB)(7G5JB&>av?m&0&xB zWfdj)U&v=E=3#pYBY1fydXITlfEm>(N0gae_KAB1Ylvr*?P9qX|LT8vu=Hu_N)RT$ z2U&p}iHljPdI5J^r#wmd!OiEiBkZmVHXi-#JAU?jC(yBXHR~` z+PgT=`h7@KcxM>-ha9Z56GDplajXLPYCOsQ!9S?YUWL$Q)246 z&)-MxQeh3i)}R#4R|~!OQD)Dh-PG-k1pz}l5ha9f6%e=e@_?BhFa4dfSU({UuF1m8 zc}vE)Sa}(Pc2^&&=z2>Atvy^pu($aBl+tp#dH6w^K*F&Gf71*;)1j&xgqVMuJ_#cA z`V`9;)&H8x18?g}%R)6a*lkFjQuu)W|?k14(8@|vZ zcuw%^G|6wcWJD9#;7;i!9Y4l{za&y2(0BCmTR>P^_o2(-uHC+_px8}()zJAiM#Zid zo{cvG)$;+2N@U~X-gWV@Q0R=JAZr3H;aDmf|8v_hB5Qt3DKIv!sF-LUqG^2L0w)@e zm!6{XtRfiG&PWR}%@r=ag0c+!C$6#U1*NX6z=DkO67zG_zvgiW>_D;|^*Ozowsb?; z?)t3$_207I54uPpi%{kJMr<@L5tTY_mR4X|p9Smq~(vrSx5zrNe} z#C`rn)~t$bt7OR23A?3VzdT3miI^qcKc7gCOJuv-d&&6ys7i6oJ*o*sfa$yZAu~dU zbBY_V-J>&{O)YiKxHCjNY(OPPUqhh;1$sl=1-FjFf3-3QSiymCG2G1V+UW)YZ9!cM zQ><|f#BYMhRwkuCCl`P19pyZJ{O!II%JgEhi!-fca-dsiJGlxw(fk^FRqeYAmaBM$ zEHYym70+C$2|T@+5)1nz@(g}d@aBp~$baUTLMwbIKI znwyREeNk3J)s=IKawL(R3EpO@bria}YbZz1c=iU^wh>!VZ~VV;-g;iO%B@(VuB6C2 zu9JNiNa)~dwm)F_!)W-OHNfLxZ5V zGv~?1w!n{V`W63a`uU(S8s??dPERoB*+`_lq@>K%9D)4$0EKBz+n%<-+zhi+}UWF$`wU#jKI8Qj0D}++Py+P`g0TE)}m`OG~6L#uhbsZlr4cr5U>zxOtz zP|C+=;Y3_H9KcxG2&N^$WgqK#{?pf#Ll5-ltfYGh0Z^H-G zd?Hh>&nG9FjylTIhC@W;kJ#qy>$hZTQQ9Qr~i@E3Qh>F!xASTog;;FS;5 z{b(j}Gdxj?czb>X`JGD(k`s8^+vR!@d4t)!d>^x=Tl@Bf_Vz*G_&z7+c5mDF!$dRU zHR>7V!^yb(t!V2p*?_NVXq#7Oe-4l!Z`W5D--o2JZf$L`)}OdY`aKl=){qJ&0Fw7c zquudtCEzR6FZD%u`)b?B-2RMRBH-qShzES~KpJ9dQg8s(ki*5GIze2wUg%{E^k)jj zR+I}%6wQ@PXH>v%im}I?T6?*TGwioG$61gFlA3T3Do17 zmwTqP5*iZ0q)=oxmF$*aQ16bju?ySDVG{=lN<)Wl-MUsX6`M3)`O z$E)ygT#D?4*;zAkw%f|TEw(4H#)()6%dvo*B>k#W63jwz_~y*N>fTI4J;|8NqhmDU zV%pK~>m$xF%J@^If!~D@sD4dW*&0DL=LrEsS`I1_>~_tnXRD$c7^z@`%JA7XJkjVRj{ zm3`HGqbRv75c5Qw4szYeGV#+NOpB;qEba?9!sDo^(6bTBUbW!hDXFKGarJ&ola{WM zRPVaBF!nv=8+3KZ>VnQ2&tu1$Kab7H(^}Dz7D)!-QVt!@d>Y3 zT3;Cc&@GM~L$YxxaS_oC99Im7^#T5Jd4v*uIH@FYHR}pdtCw3lTeL}}%aeetk1mi5 znxk+GZEvGuGEAw=Bs6|qh+h#VzfK+$eA{hSZYeQFX@Q@!G0J?$7Sr(=Gi~|%QDKws zHRYX78?9P(ewn}MVb&_3O?NgY`rnp$RpXyJj6d!;mA7{5=-S_lLh!2YqR=E-00rq^ z@_EIC$JA~g=u7tpR#?4oEJkSJ0sAy)eML8Kug%pySp8hE*4j;YsK`!fCSjB?czAow zhW6ekm25MyI6Sw*2>@*?I&O@M;*C8_JB!Bvn0cEdvo8of;sci-ZE z^5l_#3cwqxY19DHXTLiV610E2P5Iv}03c7UNkPld!+vD-wqcIyXk^1dq6Odz@0>@h z-_7dD=bdgk!joYN9^mNf0lO6dPth=x;fH@s>0$?1)J%z7io7m?`L!U}ev#&JEJjBwm(O~By!-Wsdlw6o0DnFn=SqY-}Xi*^ToTTS9k^htJ`f9F8A8{1ZiVa*Vt^h!DT-Iv7nT)M`Oo2KvrD35 z^86#%wtG9X^cM+9+FOjdV8{3#I$ije%)6`>y)S0=t>>Q8^^l3ikf2@8UxT4q$xY#rCX!y>|Zz@sSYWnC`PzWZ( z;!zwZv#};Qz^LH3t(x8sUy=b(B1U)s9T;xJsYRb<3&n^6|F6+GX*h$Ki;*}$@JiZZ zVcm%YUcKBbW0H@*Ww8 z57p03`L#N_e&^h}J^HKx=((YbtN1A^x!mZB1az%SG4vd85*iU{WLzcvoQaLxPkB$R`R^JMNbu0 zI8g@54NAM(Ko?H}N9+HtuGth1}4`v_-+L^nKqvmeA zmthNqmHiw4^oSBN&p|@m9tg7NGK=XTuVOJZ4o5hK;nB>3x^UE10cF*CfTlLrmkw`$D$w$d1MyjHya8Ah;t9D=YhbX&w zGzTTF=TJD@={JFhX`XFj=w7$Q!O!BB1*jG2Wm1krB)=y178Emkhk`Zp^A#9@8@qqK zHTl8$`sT&<>JotR-q{I;&>C(Um-fCc8+Eujq&uEB5|@1aU7MW{>mM!*!aoCz<-GMp zlG91RD}FiOSX1JCXqi>nY|jaJc;ox97vi28tqm|grhXlnXUbxD^P4vB8ZPDYFE6$T zNX}CJqiZ5o9hz73EsG+`jZ}qHiXqgz$s!V)KTKU3(qrCsYjqAN1h87!=WWZaki=== zBsuUNtx=jxfU`ET#3)AYJjQvpNF;-6M5iOC)q*vc(Y&R7M?GWQCvPgKMx53E?6{jD9ohRP!trl3Ap-l&VEr@??-URqPF+^0*$c#J~CxXW}+t^a; z{_Gf}yhoM4;cWyV$a_~-`TrsM29B`uW8?2w9KvqbX+6UQFEZ2wQq*VK7+)C=TjHtSqP31_~0F>x%l7HRaI?^L{$_l<|5(n zH^!g?k#RIUuW^rziCDA{H6b+^DL4}Pv(sbln~jccf+NM6e9ro*3B7I;)%FpnrNE3P zG7OW*sSs*tR=jpHRzy$f89wwSk^Wzc=dEB=@74(F11iA8^r_5sT<{=@_M;%08m&~9 zQ<)Ds-e!4D+{bN@yC5A++{s_a;)y#o*0E~Ae3?gkav^y!M7$*R-6CkR2oJ4SiLaEg zNo|>tKIIrYG)`pLe^^zl%ufYU4IrS?mBWC-)+Nm@IcuodR}%2eysx*vKw+IRdea!v zw9zE0n}aslHs@v?^D|P-vaXDJ{wAGStd8a6!x`+s*Guoz1J>1~@!Af>ip=s>4-%5& zxjqQ+j>XcjE&PJgmo^?b$dN6;i#zd)30U)|XW&*LRL^wX7zNrIEwr2152(xLh^gI8 z-+m3BkrDSgKt78JNU&DbpZWG@8+8*j__c36%M(PbaKdjgNlK^%Xb8fPNb6oWqWJ_( zQ2=X4L=xJHCL4E;SZO}@@S)w_<#3_QW)}1G$~qu@`yxBQ%{4x1n=vU zAM!NZUzb`W>&XXDEB)&=%#Tl&s}Q)#j|#2xWdItk{!>E#YCFt|NS?%^hW&EQu@U{l zsZ_W|FO^PZ$?g18UwF(pJ?4}z3ClXYCD}pTEd1nQdE9dbtD|y@;|`l1S2kB#OMDq`~O9;nd!ux%#4;inOxz~!OIWYIEc(mCLn2+-^Mqb+M?Uozh zE3zBTpbnf^ryJf8iD4&@|(pK46dk{)15aZ|Qw|S-a*II~;Rd2%ED#gliBf{fj z&c?Q2D4g?+SjVQ}M^_tGbIvz2=I=_#{wXxOjpn^f8jsI3u4pO2M*Ktc`0gz_3VYaF zS{HgFZ3TG-6|O%LTdb-C@~>VU>pMxW5%C*@nrqxPQc(Ofp}W+SRw}b~K@T-t+_Alt zVULc9ZRYlGYQosJ8U$PTHSD&4E*9qKtmvqY6Keq*xopB}J^ncpb?QCjld>)~NM;&B z1z19Z@*&*yw=MxWF(2ZEZF{FAyxP69P(GFoFGMxqGqTU|tpf6!P^14ViE-j|T)=83 z{i$5smte#SN|~8@o<}hq^omor%rBnQz5c+<^}Hg}cQWlSbs`_ZbWny&#-oO#&~$%3 zis;J}^LyN}IM&GwBsQs~m(dAaDjLWC^Q9c0EBnXvzcsf1d;|&H1l9} z^bxrv02|B8SYvR=de#^P4V0*fW%4x83F6V?nYTKtf^8Z4%$MkQp+m4#GraRu68)%R z>YqWr$jRiGzy^=;c{oY2JXVF@B#)7H4U!8nSk#6?tkv8SGnB?rXB>C@;ur8iI*mPe zz_>n&%uoBOR2~|PRX26wM!&sSo7BZJq8qMdqNYjdJ%1+pXx~(Lh;Hr9=cCwIg1cll zxI(s&xAZ3)YI^VZOx61nM<2|)J-+mdCD%r zPhn=+Zf^fJ{Ir4Sx$bJiole2N zE>Be&$R`KKG8=!8v_oa!rl=Y=2WNN*7aBB9SEvzumgA|yszgXL(?Fab@I?*}RDUf7Q zbyJ4?nEOo-McxO(+B!hZxA~Qol5s&F=@pAmlIC5PPs1?eMH$3DH6H&T2ZBfC@T?2d z*&dw8^7@|KW=oyXy-@!ZVPT|WSrnH2^U|;nuLFBK*ZRsZ!W~v>^s@RtF(rz%Wh;)u zg>m+9;py*dN0Z7>-g!ktIC`tP{VIS)_g!pOya*kHyIOM&y0#i>85??nEg~|x=XboV zH(VpWurfxFQdM&^mpzQL_d5Jhb63yqRL4&ami4iJE>aCzwXfc)eZm5uYhPgR`fvaw zZC4rMJ_$=DT=(E}b6eSJcYGP3uCVxA`sg!yhp<^zj9(2V;4uc9MX|#K6z2(i;}b$L zyKY7%Pjos^+-rLL*VApRzzb0HrrRqqZ*iJjz;jlt#kK| zZWM(3@`qg<+?X*#@JDa85j#B|v}@k4`$a|Yxa~?CGKu4N5nJ0R02TFc!Po8IoBI~- zxq2M4Y7Y5JV;d}Dd$ffeNaqQcHHe1Bz@}#iD#^1hU)k!}%q{kZ$?Iluy=;V(J|wM{ zj~x6W8L3whcG~T1OIX=u*?GQTPx|-RdXUEy?fO9HA0|one#@R~k=)=aa>gFU*nq09 z(0Q}f&K29s9u1$bOjB#6@e;IHMu1}Z%*P0Jh1T359tt8>`vx}}K`OJIidKRVA zuGgUx`KeN569sPU*ZugfXa52ZYm|#?8FK6`G#w+V_vB4VgNvsv1!Md%tNkmf%fRK% zz<`I8_h3m}7Fx#wttx9^Az2|>a6RW9&=kc}@Nq52zB^~6YEGBq@AhMrB3-hb6BmoG z&5XwNvrD+Umo+m2blj7Z+-QXUt2fktwj?;oa>xJqf-C}Dk03M16d2{Bwx#B5Pt6`3 zVKFh%5vNk7KO#VF{Df7-(#16y7{vvsp*fc|2GYz68XS2Qg~sn$!d%c-a+GLA^jE4k zA;}@u(?{uCJ<12Vi%si6pEb;AlGvH|PnMw}*GE;D=@^VF2#Im*eFKngv9hGle}m_T zGirke8#e5%?4Kxnw5;!ZN~E;aZ4w2l*4Ob(KHIo_jw}$Y#!0rA@Tqls^k~r-6tlS z(J`-CnV@ZYF6?j8L+~D;6CP$xYcD=-eOod3ktmBl)}!0uY3{txF`pO__TTX(Kf0_K zw}lW;$r}71gq2I|eLqt>#|=bG+c$)@b@brSBd;s)`z+gn?hovJ_l>@jGnxo-IqbTa zIg(cgme>mAPew!q8;+jTVtBPTlNPhAp_~c7a-GL4!D77`!$f}q$lOrP*EI#B{K@J; zBojrB3}8k?4=ro`__SBescb)B`FjOTDV^QZe~`gY>zL87vY*qqfi6+FNpM}p;4L@= z-M2Ip+C^ZEH>b1=ih+72--xrrI*pt;Jo}B-bVP$%I28`p>)Q{3_3n|C3z`@GTn<`m z8PmT>+2QrSK+B2mqKf7MQF2L510A zIvb5v)FSgJBF~|V>*jm1s>`}|8W9`etmdn~&$#bJj$Y}bUvFA)dyd&I1S#>j_lo|r zAZ1T~Yi$ATKE>QVC)piiQC=qg$}>8pf4#nIyuA$EPamsH&;WmTcCABab}28 zz+fK95H)Pn%dA8pJ{7xd@4!z|G~_#2g3D?q7o`hmD1D4^WC5`S_FI1E%glT6Ngc7e zyIr*=?*nsTAb}AUsnmt+!)w=<{=4btD zF)ysJNul?Q#_CpfSgGelnzx?%&Y+g<8m)%qdTu?gUnmX2>F#mnA>@gxVF{l2tTnSa-xcggmHtPHA@r)N73Pz$aYB$9q11$pombD(Xu`*HnZeEEW_3V)NO z!L`|brZr~i$XKbs!JB&LhOsG((&b=k($X{*mc^xg8!Db)}ehI3_n1Q&Ko2wJE(YmShoIqj&$$ zUs12;tTh(%KBt#dU%vX1=0m!F5SwS5{I4wah*Aoqh8IUjq=3K;jA1XLs?0v_#k(=T zWB%Zi{4;<^jf{*?`!l#+diwIrWWLc2_~Dj#6vh`iSNS<%A$qLwfFeM*S+oGxbiQb3(kbNn zi1mmGcw#}o#C%Jami&ADXCJ{r0kXUPy%ZX(S9KJU%#I~EQA~_2O^OQaDnG-zp{77b z$dv2$Tf7I!IThOkYr(k@^~BF|8A2b_dTR4iwb#V^6l(ms!@di@i8^!~pF-+X5@JEV zAL?y$$7rn;hCRdrsykyuBVc!(XsGI;hz#TH2>~k#OVM@^fi*9X;iPf1BJ`OQ2JsxK z)rl?WYF5h5$@9DKq70BvW|L{|@E&=ks(Ejz%I~Ug=PRCZLm!G-)9`sOOD9h+DQ`Ew zgV_8WppC4Di{MtVdywpiY^R9cs+ekw7w&t&$Ny;mpA*l5UXtzde`A^qhJeDTe zc}%u#S`M_Sa3zySe(!sky;g!N)J*iuf0w$@_e}2f3JNY?oD~I^*BZ?mXB*>#l8NXNgHkV$-h3Qp6x!g9utmv zj$XFo#PL&%Vbtvv*+xw&SEn^I^SZl&v|r)IAMQ)hEzSVSz5ctF0s#+>5H{Uc;Q;w^ zz!b&yxR*g18n++nYT#?njioC{#@dSFojs&5cu+1E>>AyC&YbePddWgVPeD71zANeo zd_<7l<9eL0y7YtdGvMiqyg68F95~2a1*)7bWj1hkWEV$1VzcqPE+DCtrSO0$WU| zx&Fur2PnYS0z8{H4ZqMrSR4e(F4t|Me)&Vh|A6Ahujt2RyRfc^Q23>RNA(rK0iVyioxb&N@nw4B^(6j> z&Pv%UC)fUebQYVssEd-_0{5GK^8`$atW4ZhuWzs~yd-uI;$8x#w2%(FhD-G45omEB zodLokl$RO+PFzhrTHRuhJ{)OJ*ITP9`+cuxHo-*w2mRJ3C$dX zPELz8G)E1?Ev!Nn$YE$+(A=*sR^vJ1Ucg+AUN|BvIHxJenMQyb$=`b$MwTXWnEfOT zJ}H7DV@+xT6<#Am;h~2s#tBRb+E*WKX4y`@m=`6JqX4|?c3nJqo9mq5f($Yg|6zczW=N6K0 z-G+Ge3ZRB{yB-S5w?G+5&=-%rPJ0~+R6^D*bzyFJSl$>(Su-`A9hq_u|C5MmZZgK@^*!)2MYa@TTNrI_V%1cG%2j2(bTGr;AYxn^~2^ycH1T z#-f>u&+({~pDdi;>^wd7l3)LTEI@o?5iDom6JnC;&tSaIgBxud;ibA^&9oZNXVJ?X zhqJP8jR1VOwduIOMY_NOXxTKD3&+a+iV;*}z?d1cDqru9GF1!=C5aOxGa z8EzC{wuCIiLO!)XymuMK`+s7=#b5y+iWACn>kIFpM@La`#j68|tCCwMJYId1ocggy z9agJU^#ke9T}2LmBiG`>;p;92@QBD#sG!f%pMx6i+^y_#-eh<*pZ{LS>Bp(mO%zoV zCHVpnvUl=`YB!^ia9*#jtIhU+B3?Ks4QO2#gxI^1z?wGHU~2O!69gD$hV5f^?PmnV zKQEJ6ukP2@IUBxpA#hhh{=!werL76~$Gx$}`ZFCv#?Cq$QBZKXVU15n@(@GQs_E=> zK6ZA=w;CT^(-h(CO+^gpRo$|O3`FA6oE*C2G?DV+)|$pdfN^is6Z5(Kc4clCoGSqd zv(352-qhkB^udP+q=qB7TY@o7t3lRY1nyjJ-W>YWU4_;`$-jum3t`7jncJcTm?N*gh*n+Pa?ENl(UHHQE zRunZCop2K6{6dJEHuXY&+4L;K^!)v5%^?AA5DleN8cq9E8a-?g?!5l{9q|17bMtl* ze3KhwG~+Mb2YmRBX4G3dwjU-rD&0T|`$8B1L1motvz^&`6sS-tcxMhGTT ztwBF*cHWJ*mXRi{4gUQvs?I7Zu4wJDg}VfI4Hn$pLU0dOxCM82C?L4Iy9I)~Ymh*2 z_d*JHcbeOO-yYqs=k1&^&K`U3Z?3ssC!`XnV}7TcnjK#)5{b&_$1er1(f9BqJS81X`0gIe@ZyWHb}~wv|)r^*{E=`v%|_%NZ$#GbJdFecMJUZ|F1~ z`n?i0L_0*|P#(}ZkKArLBrj{3>gCe9ysWS|WRC}YPL}n%3IXQD#<&Y75)GQLHzA9e zfg+7th51ehpDAw;g8R0cTvh4DyLfA$J?7rG5y`+FS$v7G)AJg+ zVjy57dZuWp_{100I>eLQ#Mr<*Gl60FRP#bBk=Za#ijDk(rdD@>eRRCZ*S<;~jw{(Y zKCIr&1qpXi!@b-_9YqEI_qwWIywWp*RVd`_i7dwu=j;61Ll zGWq&P0>HaxPf;e5P3`2XrOy69iR?5%2>Q(ACRMOBMARYr=j$!OW(P^f!}XkWb9Ye_ zB17;?MIrP8c7Cv*hTM;UIiUoDKaLIAG-A7z9XaL~-QhuF;fiB8#g_1x&MSC}$p$30 zv*C`1mko;~;6NLmZCLt;f2h*BLI_VBW%9DK?QEGZg;AVO=lo7bMj zvZgYLndO-Wg*SjU0aLAQWE2jxofLm@q+rPU5SpSlxs_wjzIpsF#*>r1SPl7 zZ;{O@tmIh|`L`fB~3I83xTRbzE zlUy|dY=~g@Y%`bQ&}te?jCjRfj0n7i(GxW|Em1D(ay8fMJy>*@n3>!>+0yCztL{ly z&vZf45g{u9&}Gx?=~2oT7-@b9yDbAd+z>J<>G(&Jc)+#jqnP#>fYC=Cz9ZaY`P>cz zuj;o}s>Ho-EE7b^NEQ)dTsz#;pNgk{WY?F#5|;Rf-mDTXa@Uqmu z^ODPAi{GVAnhJ^UEo~?&!#}jFvzd=u(#02I^RmO}9bM*}S<^&K-g4Xjum)UQR$<6J zDkhNgbL{=}?d_OhtG{Q8#9@}7cpO0y&!+$CWRQy2$tT({9aI|oJd^fU6w-05kiCx3 z*rSw{Gk&4%AB|!Ba@8MIWp{PF?JZ%rKRxkz(C5j7rJkQvd;+q4F1gHdreT4PGs5id z^jgTNt937hDNJUu+2Kg}s^I9+x3sM#U)?zHg%N&TRwxwzeTi;z0CIhum8Rq@l4k#M zP-dvP?VvX!0}@s0ALj3jR%qE85E<5(Mf#0T`%w?J(3AFYAJsSSnMyt9f?4f+-!l0l zmDkV=?zvbxIDpzfW%KST*G_ytiYHumJ`Z0dAKKGUEcrr_!9iAICRu5_LNutqax!D8_u%WF)fJzZ(;XD?ji z%f6Csb+Owm{ZB<98p9-TM#1sg2v(!cN^j~Ge$bQ%eYENdGirj`bvL>NGE>N^IFuSC zsm@S;+O1Glm}?x#2UYsY$81RZ){~MN!@d>__6L1f&@Ey0J^?1c?2(_nNL*F;WX;7y zEOy|=4m2VGUUluOhu6o=mnCw95%Nc%MUdexjgbr#L)vYTFa6qrI23c<Ig>x;G=2EIDO@}4RSK1Sqlt- zciKUphT~?=Ga8V(i8qZ`TXE5n6ir<-KTO;2#tvhBb(!d)k^c?;Hggr7+RXBMOs+}u zAO_bLl~kkgFHWyyq>Z>a<0xZ>^x{LEUawEHHH!c2ihZEhav{GF{-c4w+TiBdtH^b_ETbe4k2LDlxKZa- zWNE)`vU5i-GF!FdZB_dbP)}R|99IOw6jmri_|S~_FQWk?s>y0Fz=V$(>?pYVCpffIx4?oP~#1vKTW@6YEKh zGQ}&?Q<<6Jie~3|1x$G&vlj%qO**sU4GQnlMX#|(W~TGsEH5=47x;`uXZZAJlDAmw z%v6fyFoQoO6h1!e;KrugLXigmQ`2I0bP+tEss1K?OO};t-_y=bPvG2rUwgYzdC(^|kVB~9q3+&1G3B$% z-e|wq^nMN2_C6ml6R=-bB;RV@LI*h1gc?2xEW9c-@&HiQ*?wsPH^L+x&T22vd|@3> z@Q!9vqa5#dmhPacrO9}-a{!DE9!qRzXtd&4(w&?ZLCK!(mSe*n12y6lBx}?DybWwZ zr>Ifis6~Bb$Z+_slb>TVs;l`)b4uR&(22e4tX8*YZyE$0%I-z=OUre-)oAjMtg{`Y`un^;xfY~B&v z;1>VPv-c~5l}3yU!U=*tVCUe{)NGuyOY(%0$o8A5FTaEcge)^);2xL;bUFU5u;(G) z4T6uwcp6K|+V_1xLf;1;31wu3l%+VjwnsoA&5 z8SVRVF53rvixk6Rlz7EBSg{~yQDT`QhabeCiOG2u03MmAyv60+F%~=dlOvzI?>H6Su84U z2ySO)ez#(!J6ufZsL>Y{89U;iLV+xBY-2^vXFG*=Q$fG!F?nlcDfK3_&6imQe4B!G&ei}H9BIlYE}+} ze$~#K161}XPk#ea>DNZtvE)HZXF2W<+lulTz1Sx2SYy!>U(#Vzs6?jTT9Hw=Mp|}E3r$Z z`>LKhSF#(ZPfJU7dFFKR^L_iHahVHY%9BJL{aoY8xz8Z>hx>B7yKGKZzLEco!2F`M zno9@pY)gz=4w<=f|GXnC#VyW!jEuRVjjBe>%gRXGQHp6L*Om5=uGfoQEopgWlH*Tx z(BsVUk0+J`h&)E)M{?^4Pr+v@QIRxmm&z(}2$iI$wt`Gi)+0m}qdm2BIY2qO5HEHW zdujkbMq+AAG9E0rYeiO2DgDQSUZY!w)G!iy2D5)Z^ygHY9fZ65tT>o*h;cP1wH^(K zl28it!AKL1wbM(fo;@WVZ(J2Mo~<+Wgk{T1hrapGCyEzgrt)YJqSpO*Q#vO0;N=81WV3QByTq86(^lr8-^8*Z{ z`>nJ8tz$v_9!)ICBYHu(xH40jz;Dah7P2+lqsLCR)I*s%h$?UOBWC06_GaS!rKi~S z+~SX^iJVx96Akmy%_YWrI@!Agt;tpu_cO{t-csG%_%~9IlV|@#;?{D@MAfP3K;~bp zWsvLE*yqdeXa0vd%%Z3lC_^{b2C+8R9?VU#D*UZgxN4s#hquoqyaA)A^D)T=ytv(T z4>tkFn{SG8uO%7P|ns7<~z$S1`_XOZ%n5|GW2 zF%KMH?98PNey&7sAO9me>4j^FDp}IB=^&G}*&^H;ej{|BCPDUTl+lDg7oYNe{;EQt zI~+Rp>i<7ocmIT@0dMbI2?gVX(}PMB0ULC2BJxR>m=`d(JWR%_s#CPET|_`WMUJxo`btcm;S)FwCLGO$H8qFrD_!b& zRkX-NlzlIjCC-p>?U$*5^56<}T5O2;jM=3_GWQNNNYVD-`{t%%`Pn>K9sj)U!O~QM(zywnL?agjYue~M}F}>xKSrfZ&>%3 za(`@JXac@qbjC{ktc#$VfxE=?L{n zIfO1uYU~vd+3y!R1|O(|x<12_6&oSt9@N4~fu&h1$)5H@XaG4NkaZ+v;SOk5m3}Zq zUP>IPD!amjErY2Qx!k_N>!Cd91tlhviTurMN=l@VPEv1&SQrbUu(3NX#$m_3BHeve zC(cG~#O}N+)KUf_a5{(z9bx>wMP$(A%MbNb@tUH4pw+H9trIIfZODJb%PWT^*$!^= zL^m?XgJ!DR?OZ50dFq-IkUQ32{rPjZONL5LJareh3Hg|TpS&ra*jSs{uWna3s5HvX zmvjf(l)bWqc*-*1GTnV}lQuO)=RwlRlbtbWS6aj#x=gs18k;*_j^F;zY%JHt-p=48c0gMfiYCPFan*DB*^>+@zEljBxYo(* z*<2J&L`Zgc_?oNF!~?!(RO{(m%wPW4Qjfll)Zy-=Yg;yUf3Upa!Il|@ zy+B>&pf-~31ACMRhtH38eR_?UA5*FbqGsVQ?oUL1N8UY%a4zgr_c_#pl8kavmzK5K zy1g>yqz<6=LM#fPOe-G8T-ZN5D^^T%q}t(<-wG8DHA(J@>`le1_I4vIiI{DJ9H4}F zcTK1GmWCbg-A3Dp2^twCR|I})?X9fJHHdEM1iP9-Q*t&ie3z2jG6IG$s#3I2*UX5O z2pNAZc}a?EcAXB*6+Z_Kh7#9@Tt$#_dMFuIeH9M`Kce)99Mt}NU#uLdML3lED|;!K zGcR_k3%uCaYef-;xa5huJQdu;UPsn%GX96w@S$-?@%-<}_=QF#9|v=+J$q~y&{?Tw zK8u%nxpS9aGsTks74|j=HQCJUpNGb%^((XHw@u?The|-3#R?6g+MbIxAM>^EB|FOR zQT<|HhS3m2+(;DV{zN><@`;&!qTYqjaf7vdsbAj`#yXprGR3MHgpU>lrRquRyrni>$-6&hj0xM|4?Z3VJA3H#7KLaRZ3Bk#l-oT zRz`?OI}icRY*EEXHryC9(Zr7y5%rK_7f51+Dvm!4>Np)zs5h;zHC6$a7V5PF6>sR>z_*A7EiYS{DT`~{7qO8-!H8B52{g~ft zqdDp>p6`c=DAHHlDpLV7ADv-&u3hepaXU->_d5$2}8%WT%G;p(w|vdF{_k zf6w068&7h%8hr!Be6IZ>W*#?LP}&Gxz! zosa^EIsDAsEUD+b?DF_it7J`5hp@5kGaRc*B3LjZxB>7(d;2hPf?;9$%yZKOy3g#1 zbVWgagUVXuD%C8phAD;Nfl*F|v^6MfECSn$T2B);g-KFX*082uUbPnwh0G~B7~jQl z&3Sk7)QTLv7mtJ3W4r-(p?HV?w@7W{k2}s=M^ndIlua$`fvk-W_%u&GQys zb&`j^hH=m?al*)$DT@Nm02%S-9DVWYSn7mXqb)Zr$o(RC<=DgmJ>WpgM~RfD-7Fj_ zHrsud*o{33tW&*vEtHXej3*wIvV(l4GxXa&lf`wlKN57O-Cnmic>4(qZ=VTE1aY8C z`YFM|Wea5}@~sJ0UP1P|iumv;Zjz2*E8p^_PDz~8Y^@Rh&1GR;X|$FPH!p~rEGe;> zFm+DUfd1GnkNaUU@`Hz19Kml+sg84X`{;ENTM&3Ucx?-acoRSd!!MTVyfyW*Yy9?v?>BzwUmeeKQ^@!e(C zBDNGoOng|Hj^*eI-9AGT$aJ>m%iLtY1`&Qqyv~J^{=_Amkt3{_=l^89tLDE$_4RgN zut2QT-M(iZ+gCHykx0cc%^$jk8B9H#bFkN_&5)FG*oQVrcfaVxEKVUAeHv>OyW`pn zF^|6Wj!|T*De*dQ;<6^C5TsU{YT-h3Qad^sOK<*5eiHfN=tj`^fGT9xz8wBvsA8-{ zj6R-eTo)~FNet#%DNyZao(j4;=GQ~@#}VYfWR*_`Cwj{3U0J}jUzqeS`MdNgSB!9P zR}YXmwIwdQpt5dxkuQ`6S=?zO`W1}16?66KnWh6~N5FxD>rqm>Nhplbt&S3^2Ix-v z3;zwh$hB}r0)lQvSx%d8^fG5}G2A;uJvln;EMCg;^R|y^QDucVl3#0gZlqE6q5X0C zu^`re2-~$DnnR4fRxl!;Zog`fMk%`YS5sEn*UA95c)d_4TwET+ZEK5Ytb!q}1@^1C zOgV0kwh}fnGg^VWELKp8f---5}_z;5L5iZB$QFkd>D zx;FGr5aO4%e_AEh%;bN0bmHKjRl-mURYelD7+7AR;SFWU&nBU6Z|2)WoGc3l9vN=5+|Y9l2kk z`{SwcbW`x)6V^Q@ir4|e=-QU;KU!tm=#eqTHEfxE8bBdSYD+?Ni#I)Uv5iPj&-dlC zPhv{=qW!O3T*ZEHo_3Nkqb9=^qZHH8dBiL_>@#WZLC|}+P?dg?Z*E83{v&9_6-o)H;zULG~nYmY8TuqD0(mDsj@GmFC%+en4@RFPpOY510)A@;aHtp7i`TZ;&3HE=KF5y{+p`vhIpW z7;|$sFEfgN^^d7h9N^usw9*f;tO~V+1iVUSElmhTMo@X7*^D9KrK)vH=@_BcuB{(! zuUJN$>k?H5*35@&(hHJ^v$�iiqj>*Yt04IYGv<6X+iM@9yXB;--^aTa(CrjIvFK zr{)HVdr*3HP3Qk&wJ>ADTUQBme9H1pXniM1gIQxfDrGh3Ieqd%2>Hi|bs);A#~Hl{ z12S<>DzkmPgKoiA$mh5_2;Rtn(hv>37E#YT6;K?<7aOlN4Z_ewpSB- zjdsDiiVWcn6^GK0t}chfImwIhParv`y!0e_Fx3Q(!rGmdHLE+KL&^;1{*H6ld}tl8 zyWNft54MJ_He(1L_qILp9nl|y#mgri{7KUg!_HqNh;m8FNQXZi5q52+z_k}7mOYRs z1q!j#^^kHT+F!UJ?bfv74kBkndTKWZi5l;DVn?l)YL|rC;*Faa3s&>xH@?((6dm(Opzw0`Nr3w`RXVu4`z` z@q{I8zuVw2c|uuu$#1Z;yqG?!f4#2W`G^&!^{|rr3Ic~pF#-jx$&nxyL7#Rp zA(N9V51AgGJ>prDUIF2QtF^o`MK&I@+jqKF-e_a%eYcKgY;-Ybg0`x@$@;zey&8+d zJWV4{L?RDzC5x`w$i!oM;-C1VL_RBHT=cYx_Iux7VDkV?2S`)d1ncS?sRwH3R*NaS z%Pi&;jj&nDCY>j`81m1fA@g{%9Q!3Jsd@s&IU%=aADXq5O|vjp z+OzmUaGtD{1G1vM^Ym8n%Q%1k0QrGYB%X_|zGbaR3}=#`$m7Lr*!d|uBYAMxVmxP3 z@P+yIF7gZ~HW5m#bfx^&oh2XF`IJB&fg1IGIx7fZe5%DN9uXS#qi zJ+fd2OHF0JHGA&HYyn++Zj%wf^U?N`L)z;p_I$MJacAm1vmYKK)H-T5sjfq;*h-!C} zi+Qf^o-Uz+b=$veyge|G2%BaouDK;{1O`yV{Nn0CsGpIq1GtDL{D&9&=$?Mib7i}S zKg$(zz?mT7B=y9;Jaq5acDB72h{P-f17vd(d>A}c@qXdpemo09Ap?j*nb?S5c1uzO zJndxSBF^-lf4rqxB6sRkhpuo1z%#_`@@GV1262pJXs7f*Yg_W|qbdv}%AWvo_0J*4 zY@5|CUl5Hb%-eDInNQk&nXSO{;W6y+c2ZQXO8>=2PTAH}w^glwU){R<+P?kuaI;wY zJz9B#{VE0^)I&6R6F_n*yOXZQ1v=eFGW&a)P;)I@D7H#6eFediJ0xhJ*YXvNpyHmS zAM0$$xjXMkdb$q?@&&oE^Sc$aP`g!5^mWZ%(!FOc3=EGTdCk(36WU5kFklaT82RKG z;#cMEAI-No{78wjIdW{;+ydcVA*);iQ90ZfWpd6YIwP}h-o+Qr$A`k!K>wpu^zV9R7CD;02%ikB|&O#je zl;NufTW%F4%&A2tLLr|UBoG5}B~mS7GS%ZRu^%*%EvjF?a{oaQ|GLS^xOA3N9I*HDcUmEUs<@y@9(QjpQf1q*-X3`Gt%)#U-n&qVh`?G8rGpwPN7iC;BVq<9DbiOr||xw(soM z0g~5uGv@=FYYsaVM#PGdV^UhwgC?$O7>ZP~w3huv%JfplTerrh5NCpP%UX@nH@vCG z4c@ggNjlLnyD@G`A)zmng~kyl7OkO6A8XyBNix&RQ7ORifHnKYd-&qd@;I%-rk^r^{}1T zhhvA|QZ`B02WnU@*O+yqq^s8T1KBFi%gk2CqYeTTS{psfMLrybb~9@LCTZ(E>Q_n@ zxst>Erwk5i)&DzZxmvJ^y&IkAY= zGHp`a`y$Nqj)R&{$9!vi^halgxB0XJ_Xj&3`~Y9jN>FUo9V6ii56z#1kJuC*OWxBW z*@wpzTj>_eZaZ-T-aW2JA|&;wS`Bh}OLOqDPo|Qd3{I1s=jbb(OAx&g?XHY|yrA!F zhObq+MXH8#*Jhvnu*~-It|K9x?GU?{Xnc9hyqbsJDL-Snc}Ek&<%%=mTQC~@y$O%J z{}~}S=8(7Yi*aX@NNj+Jpdqba6SVJGi!FwKqZay1U-M{v*u5Uo4q%G_{Dq1xj>wjF zahLe{@AG@+hWGQiT2{nh3Ni769hH&^wEaDusB)g@3q=h1#K5`tz&K&X+KvR&FlNko z+bN;fh~XaYVy>6y^&BLTkhkZ9T1?s;58;Yd{lvO`@sA{6B-qEHRQLRiI5ki&Y5t)b zYyjUD&I#|&gYk0n%Jp{A)!5W$7M}=kW0bg1^-?A6Nrax}nTbuRpTE-fSF8}B*7^hd z7Lb2>Qa#F}R=K$@(ic&7(vRSUNcP2Ri)y`wX_WDi?ckb*rU(3?yzjNMQoBnE{cQzs z8O{;3YJF7_I9^w@0A2~iN+~lAscnwf_5Y>mzW2xN_CbDdEC2f6YnlJ8%7Xp?jku#Y zC$kyhO>paT<7QADYk0`1AMzw9=wlHh=>c0VauHaH&LJjECWJl~`|$Fw>qd$lqBtBO za@&X(6(f3hPlhVR+jv%Zqtk7%-*k}6!fXHhHL(siv2>#ZI@JW4EW?9u7mZ}wMYuGS zs3}}iyoh_IEVtJIJvfQ_ST)c#DYZ`$R1^1e$xZPEFE(UHysSLTQLYO5W}N7%?G9Am zo)+$j=v8FduT@_sDJtBg8BmOrRMtE}Qiv5Oy^ToVRm7lZN9o%2vz_aBNR9F%sek5> zMc4xpDYS@HLg-i7@AjcI<6pf({P#?clR2sv;jK)RE+@5+&01`e3V#Z<_=ctxnb@n% zlqf3bLh0Eck8S1HN|LBy@BbbC970ir>^gncKZbI|9?CNC=B@*NW?O&v$~5$$CgrW& zHbQbodoQ;Kmo;SqnqNSs-+;v-LFhGns`(qw&Ke_-$eu5+(C4Y5!9l`DO)&W#VH&q! z%*~F6^;7FDTE6h+E?7(}qv?eL68%`aQ9Nvh_y$S8C45x*eu2r$=PxxykMrX4A%3=9 zaF65tL1~K42g7c?**u&?&qrNqYL%%ZNKGsw3H)fjP%vE)Yq3oDD%&{`mz4bHS zUe(r%$&&w@=+F%H2C-u{{ZRUcD&J z;pa9@WBJJe38^AfD4<0xPtmY7=_`%Th#33^{StFy&-}VWNKaRhR~=Scg|$;SDt7f5 zdZeJ1kx&uixHtDNt$z8dedp)t-O@cD!vUrncuftyWy-F_8w_h=K#i&7Qqt49XpN!j zIQdKb>fm_}rIe6z+iAgHzD{&4(q?K?{FlCP%;(?2FBh+k&t;+|!S82yI}UH%Tr1Fv z(UK0`SsUAe7pw1{SlCgg%T^DU6WE2ZW;28ADR*&!%=_oSQ?s>tOIY1EA!LQ)Q!uvGDvd- z0zT3!T(%!>PItBUzH5Q9+#tiwp7yg6(e0*8(FAwt-b(aWrHa(=VGa*2FAHBpTLu;( zYQjANaNX;RkfTRUhyRC17qvmw!)u2#d~K@LK^03i+eEA692$oFs}Zv>b1#1c1c|)1PuKlwYZY`y|{e6VPCf{6^aSaOk0q;wLM<^Z~!`01C9$rn>fXnRL@~4r|b{^&_^A$ z{=jhFp8~%k%?C(MQDa^m`+R!LqW9`^dBCgY5vj1k>%ipfe_Wec$`|Fh#?v=y7M{Ob;a z)&2qJ%NbdT$P0@n7p-V?Grc!Fs!roR>55IW=hx?Y1(&mL!$N2R3K^JvcpU$$5=W0)s%ohw4jq>%iymW{6*q06!&<&+>n$73U>V7`Q4vL2e`P_IOY~#UESTO zbeGh&Ot)7e4iKJ_qa)DH1VtXtg-B;&6EC}B(WU5C0pHwf6Hhw?x8ggEd8@p_)Ie)? zvoz>0>$|I#hHepIVf4;(5XgJ$C9v|>)`5A%osC~2Yg&%0FSO9aw@hqW{Zs-j8(@Pw zVGq47f{xkb*38*3YAi06xWI1xk|>N&8IahMuEP^5+D$0d9V|F{RPyNtf{p8_V|u&dG7kuOJSlNCLiaB#c$W~2~ZGvIR*^hmbD zQ}Ug`HJaPEpo>e!bq-A7uMC2HaFCqshef}UE28>336A2dLhKlU=M#BH(HNhaGHr{f zw;*4@DYs+z>!+8E&=UpXsWeh?m#i1J*{kPDKeE2=Ns@}j|HpX1CfkvVD4%WOI52eBq@#?|VuLl#3S`-&O z`F>(@(xkw3O{l^AeFTza9$oEsFn`#DbZcC9)zU^-@3p6buD{DGU}55L)Z_U>(H4Ae z>q`}}zFn+msYO0f9k~M-QL}P!|*pRKpy-K_yxPpA^d9d^Qz`XoWA5A z*kvw{7l6^|ImZenk#q>vxWgg$9oz7)I3+8a-$7u~7nQerD2|;k7+Zvcfm`VprLqHP z<$F+|A|NKXU`wIMM0OT)Co_RKx2Z@Lq4XT?+$;xJtQ?XYi1VUj*sF!5$^dg^ba8_rlP)PRzX^yoK9e^%oA*?~VK#+&PW_z0;}?3EJ8Y%7yYi*j*z8o9TXuDU#NTGkJ4 zbV-46+7^C^SZJ9|x?9g53qq^p;p_s;4n?cl1)8iE8vUksVGcT5V5yJgfZZ3TF0kpV zdEqKl52*eMwF1{Ka$ovNK{nOgnA>T}gnl;w|Jpo|zBtd}v#dZ@wv=XaTVwp5I6j$4 z8pyN4)-U;8ZM(#q)i41Yy5M3z z=|qql?!e&*kCs7w6Eo{d9Ld%VTvI6 zz4&XY6n3HoiF-8l3-3dX>r&6^r`Ys#!Z0(PolpE!gJ`fa0JNLCh3B*G$LqiCWt+!% zh=s&x`NVz|&)p64x8Wwcn!` z?yfTG;CY8$OW9}>dPyls(;A92c|xm(nQA#aKYy83p5f->Cv`om@pjVOX{*Hw(9M3+4A(?T~RWwuAq~da(O|294mr zyhG&u%p88s0&pyvR^CVX0q{U|c)#5&`KU$pU_f(N9&8ALd)s~nlK6uA%Cw}m2Y<@Uon?+F4 z={Nhs^bvcibP>*hi(}O0#8y?yl(+yY8yum`4xt39J|Q=xFD>#H5`XllT#}Y{-7VSV zt9%bHmlDGOCpT}S?&BGSGu;@B)s|$^;i}y9%QgBU;&UP?I9%aB}sBQGRJNpKH)2~uTI^>*46e{Z`10r-L zu*Ns1ADuZ^Y?;tE)wSDIu3-JsSpJf>RnCA(1vqpTWp#*ZJ{h+J6k9P#yuBfoKjh41 zHU|H41N08rXo~C2%~%>JFM|Edf^l0@S1Ie4hnv4*Woc7Vwkh+}jOBAN2-C9uiV}0~ z*SB|wmnUC+N8Ar9rW72rqsxgsw&G|~1_D4zv$=efZ#s;w2Y2VA#Wa)t{&wWeaAPJL z$6qg$zQb;dDp0P)VbnXn{x#r$8M|TP z+$qzH7H8=NRax@(`KIsxSfx@AliIypltO}UE_mM^yq`Zbx`LwSBs^uT=Gy>y-Pik% zLZ1?k4?wXb`0OKXWFac+A^NDl6876mr;2o zQE~oB)^rJ}MQ*{nEp z?jY;7Y;GyoJ@;_<>f_KuZPY~7o3;PXqD9Ye@m-A~d65wyhKlIH{k=dJ>a#xhcowp* zEo=-RfRPGi(*Z;}{^5&9E3Fjd@=)Md^jbKdXMc^H*I`LlI^4v~Cx<4hefbm88N7M&h)n?Z1<19_GUY|jibo3t=U;HW3MGHNQp zxV&K&gdxZPXPT@D%4B7o7a#T=Tdj!no{ACoehVlERu<(Chg#5YL6w(NT(dH9jLRC+ zL@Bs9Be7jZ**Ixfah94T+Sq5$2D!JJA8dKF1bjrt4^|`Y!t;zw_}O>Fw2G>cdo5@x zJ>bSv`xDg2V2Cnv&-h$n0WA#A-}%KbVM7%x433QpoDo47t>G!GjF=44jqyzQ3*+sh z#2?^N@iCQ=!oWyCF1(GNyUN1bve(K$VdXt|r*@?Zik9oq4eXO8FmG1`Vo%lYndBRm z;RKZt8jYK<%P}&g{2o!83TfwIl-NZ$Zn8!It64#Y6QHH^E0yiXu6RTzxl8k5^Zp{d z#vP5#x|qW0D3C6WknOUywUT2?+*!QsY!ES8S8X%7v;u4IzD)?lGIhGpq}P0Dj?XG< zrlf`f>5<+>BqFa$coqh4p_jL$YJA7eywb@Y?yLp*aMBv13y<>gmD>xzV5a0w%5Hz#b& z^;s%RBsgXiT=FI>5ev!kGcIPF%oY~=(B7-(*mv%hi&c_nU3CWVwkG8k1OE;Gg^G~m=8gSS%BNAAmvo3#mDd(UbPeA21O`PbfOoy4N4JV}`dBh^WcZaYT*YtUvGZuQp}GTU1c7!osrC;U3wZ_Zm^z^-CmdB-_2PV|cSK zPfPKe`h%kbT7_clO7x#;hFF{ld6*s>z%9@RXyrT4pEgGr`9(IcBGuoPE=QwkdKnaN z>c9uF)A(n9(Pt&k?R?L>3GL-HZ^lt=tq?jXVp1I5d=6O=hOy!FqkJHjUTXQUo_V~I zV>kcVOwlu_db6m&c#f#m>Q0RN{=JE*%u zn5#!vTuLsiAj}9#j4bzHIt0zN`_UfuJ!gLId=q%jh)J7%CUkF7SENkPfok5mptTTv zB4;Ieti`n}S8hGirxIL9$+WFeMC6r>ACVr)+0(2)%V>X}(^@r`6YJSE-LR+Yu`XYo zXowwLi)3r>X!O)B$uGE)KkoEzi@U(q@|4Hkhpn`)qNpoHM~WPft| zHcYJK&=aF1-|-{ACM&uQwOi&ZhT{?zZm18*_vr^hdr?E(Qff={tXM_5ok^|`lb1nt zXCO#Rmt*v<=H|<$`uDbhQ@os-67%^-)exXvnL;0|dGH0e{FH#omzG-h7gO>hICell=}DEJqFNTTxA1udVfa@O zmNb!^f$jF^B8DulpU;?ADJ{*kS!tIi!5lqZ4i`1wEk3g7jc^`_KMVo&_DaB*D@d!C zivSkH%{vc>UeU)MRq%IUhM{bnYmEe9oPp9~WH9Jt)D};!?f%s;)S^tRHf`}5>p9=@ zbE*&aA$nDbAZgjl@RwiDznJQCuvX4qj zS+?Tra(N&EW1VGx0Y#|JFg<6Bn2ulveqVnxj+$IVbJI0he_M^Su=@EN@sr!Nhh5f3 z17NEY+L)M1`FcU)De-6+jtPraE$Q?%^9L<#>UYVDf2+;^i>I?}h%4NZbvMws1$PS} zIKkb6yEpE^AvgqU+$FfX26wmM5Zv9}-QhB4?wOykzpVY%T2=L&KHlJ!9=iOxNb`|p z(1AsHzw?p4?M8ttId*BPvjcYEpw(B3}J>cLh+@43BkOz5xT_EfjUbC;5Iz2Gn zNHq-%V{zuEP1-$2CM(1stO&4G&t)(rAM~)eg%TF7SydLiHg;s)`Mfk%S8F+#!j)2I zGq%-}PLXos^yi+V3CeUnkH1Su=P4L{UPG3DVI+C)wPI$Q1X#opW5O4d!ZW+zMA zzwr|pV}0#?IotarG)bB^Z2Qliz5D8=S!KiBB4xbYz|`-*&!vyCw44utPB;3g0+849 z=rH2G2pO%L1MlQ$@e{xY@?anq^x(mBMTc=`b2CbGfCR2Xo>ctht{Zlqq*BD5nLJ%oL{9LUR>BYKdYbcr3ya(Ct**cDOhS1b)?wF%e0!x7bL&fnIV z4*dXCRl3+mtS=xXPK{NE8-&oCi$B@ssyxX3^WR;CXcDCQ#4pgE9Bq{|;n%bilI<}@ z4o0^Hj<68_3wHvt)lXz7MW4nXgjv}YvOA-%%mY`?RJR>%uNe&XTY8w?PXVghkQQ?5f4W`F{0fss_ zS1Sa;EI5I|r{@pK7qMSRESAk>;Q`oT@6raX17{P|FMg}TRmd?XV)gt4@g84t!|L^t zTF@4R+j)89Ubn}Uqt|~rL4D&lOku9zq1L{L+JU)EDEZ67{`|bQYfOwTtByOs%h+C_ zw4bc=mv&rt#SDT*$I+qPU0KdjOoT^RpEc6phcYcKIGY?L@8#r9UXVjkyJ{)_MYkAJjsA#l{3Ah#vbCvmuMMqK9o3)L)wKfTLtVMsD zlD}*P<=0S^4Yy%qpmu^7fXK>@{j`>hOzx#J$q=#lFu;+U{%o_b)JdKP)lFO$cE5yM z!fFrdj&urp4%PSJlCirwU9T8ZZfus6d3sBHb1}N|yUF~bc+PICQ|DmzE5V`8ev(BJ zZR{88ZI#P=i&K-AeN1#M5f@lx_mQWGsogY|i|Q*Ix3O|bJ{FP|~m7l60|i+X!^>U|tpbv=&Z z4!hwxWxu)#%F=Nd^+-sj60tr81u{bU`mDJhxhBV$HPrZl&QFMb70S0D+Zp8cljLQO+PjtWa zWCSphFJ7!fSTF~Rp;ZygXe&$i*& z>?4J}6_H@8{TdEiD5^-&BsOm6J#O=rsad{per3y3a9UBFg@_$HKTYs?S5*$BJigxk zqetR-D=|tO&-x(hbbXZO(5=&cJeaccg`|AXxj;rVpP_N!*zm0l4gNkNmd@TfrH_%U zfm&1hHu{7Mwg+BNSr?IiHbAlov9xTMv>_fngq4Qhi`(%jmSP;y{som!;Mg#!KX4edzFG3QeR) zO>9Gn|JTxyZhv3B*8-*6ih%)9bf$bElMxCRZASk~9T$_7BsORuZhzZ1AldzEQ1G{? zAG9s7@gdN2nDrW3w)VyPNR4<+a@l`=3XhHp$ihIc!JC!PUw#;kkuAzoUfiRs2!pgp z4~Kk{6PIc0f2O$iX)+fk`n~y29sk?+*Ob+bOVecmfxi@YaZVx6;R0dlbMv;p_ArDw z+4Bgxk#@@oc46EMZR##$p-uHrL6Ve;-zl#nlrKBT#!^R}=4?YkcFz!T=~TMbK!&^#L!Gh2n58QnG-GUd;I+80g?L$2?z=KJxWjRR`OUO{-G>hYm zm~Yz*6tm}AEQyGL>{5BQ6T35w8KG5AKRm>D2%6KtYQw5V{Tz<$7)CTlsGDah0jisM ziXMwmo9y0CaVb%c#se-!LKoA^(@*+nL7fq-edPVxA zmXr-m(+(-oHAiSJB$AFSuOuhP0|SE7RV9eNXIfe4&nb9>Stii6#)+CnGwSbZ@Kr-x zNj+wS?C-kNZ6_`#m2PRCH4><&IeQ??tNb?QXR)C8H==8ft#fn$oU5Ab(Y3RRUV{f zqY_>kwUiq#sp3Howke$G(3VC<-qz8Z-y9=pvpRfancT5;B)5p!OCJTlJ>p3@Q>?yZ zP)!;9dz?@K=RUE?Kc%%=>zPBf*F3PpIZvCXpHZ!2{b|RQLhW*HX}))rNC`53?s}$w z8rO-0<;lFL2i3+zr9Z5k@E=8(o!>Pt<%_3r5@b$Pfy#P?VaQ?z$qoBzzDcIwOs&e2 z=vxV1`*wcm%v43mWvLFzCf+Q$IF3uJ}TuK7ta8Mfx$X zN|HX&myDbfBbUbaH>sM~6?rO`yqx9Tb0hGJG;a0gWmXO8P+}rE z2+icu001;WsrqZ<3FAa0QIGZEScxmL5M?JiG8tb_BVl@Nh*P>d2`F^C^QDLIchKcd z{>PdpH?>1bOOGzU9@n)vuOko_9Bf-Hv<7gI2cpv=?|}}|0oedxyxG%3*q5RJ-iyx; zzikZ#60g}-s{&ZVso~21wLy1%mS>cu2L5Jzgr~M*UN1r+sj>g?nYHS!^a!9RkQL5~$YsJjtoL@PRBUA%`e>~~ zzx<0}+ke5i!K9nsmkQ+AEwm<5;= z1qqAs$J-5K+kVc?oKyNEsb5S1-0~SyAx(smAQWO-W#@XV4o5%7=DTF~fZiQrDE!mQ z06CH*T7p@UC-T2Rc8_e!X{@RGOjPuJV}Ej^`KsvT0cXD%YZz(rVLNVRyd|5Y#c-(A zVmH8P^>=ngni;~uoTkeub5VD=eWEGN)92yDkys=H(&TM%VG1TYEZ6JEk*(CNQXCf3 z%(D7_mr{kFBWgo?Jemhdmm)l|tL$p|#|>X8b$ggjCtq+J1Z7EIHmTd~C!`whQXc-6 zcO`Q1tipd%-Aa&n+r_b6qaw-pcK?qs1z~YepQcma+jTHD%YdmuUH#SRzD{26-lnkW z8(1+)iN{>;+vHDSMu>=(tz{sNyL**j%rm#H)d4G`W`T5^J(?9PHO_KO2nYjJJGi8tMyWdoo46c4TAQP=?$D`YrW!|3-oQ{ zus#b+IZLRYbjMtFXZ(JI{M5~k{L`r5%k#~WTl(6A2Bf-4%yQc*36=SviG%gYk?&lj z*5c^Kw(y8owoabl@a4ous&t*-Al63AhcBnm)H6Wr94DoO{*e*Qvr!`IhTWQe7srJd za+Tbn%Q7_HUq7i&Ze7az(I4}EDVRTb?&G(9J3TX7#Ol+rNMGbebw7SdY#r@%+kGcV+evGGa}qD7_ozpuGiC?*~dOe}p~k02ar#5#Vu z)$FeP46V~rGko0)@rwCs{|{xtGJW1<`=^t&U<(KD)L(v7V8j`qHIdvL-a(m?!DN=m zZxK+p-Lf7})7uYAXbcO4l!dm>=R%};>3GQ4GY$sv=Qyqc?|9G!iZ8|ANdm>b!>K|s zG>Z_`8*G!@QPGpb1i-?pEIPX9skfnecx6s+vrW|?zet)%t@fN-)#7`@a5hsWDMi)98{oPQk`eYOyXh)KxXZ&$DRZ)6);~bJJwr3$*(p`4!uO zwKKmd$(PPP98X6q;DJspLUV$%%Rj=+KI!3m!c7cE6h$~xJ}t#>TL4jEn(!p84Eul# z*7Og$TRRu!qS-EeCZW&takeFXTOsvHIH9(G8-!s4iLIz}49U+NoP;AJaV;?h>OkXs ztZq2|*25QrM(I#N2^FS!bx$^<>|%*>-31d9g{Xu36`PDH`kTQ&SJ!2_e@$mHh0QLBi?JEMuY=VyzO-7hdOMI%%Bm~W z&C{)aV83i#CIzN@UyUE`;oG7aY0@JS+bBM2!S0Fv^23WSw=|mSWf3RbRc1?a%Q3lb zBhNN|EUAz?59$G zods=NOIVN|Z$Z<$-dFFOav}UxI9_6Z?ZptfCwlL|ZEt5I)=|J+wX(oYd!Nut5h9Q! zt@3=JX0HO+QlMeKa8>~5G-StST<2JzWOeD?TQOfA$Ed(TmD%I~mSJ#U+fH%e&SI>x zw~E>EnHQvthpb=go2s|y`|T5yxjzb^IzU0to$W}sGob=-)KqGnz&tWL5Pdhu$&@Vo>R^C$@PY>NbCUIKxZ} z=1B|WPBr23Uu zn)q;7^eaYNo&g;EzZ4e2T{eXW8-9j?Qi7}d>80}>nh^51e6%dU^XCp`!lit#>?!m0 z!`C^ZbX)bP=`2?*i{btsS+eyV0+O8%&>e$m*EdOmZDPEhl3E=D_gJYK^=`rYYm?3s zE`d5^op(Oiyf&Y-ABQOSU}a`GY-C36M-la=eah8WZG^&4xJo$>xb^0S8zQm zT@k6nnOP$_2@8w_LTIziad*O1VM}^F_G- zDd#y}0$I`?j8QGsgHXYv}Ek@@fK0+bK&uPfvEHepDX zM^dDGlsxSlEgis2MDWKg6rX$WGI^ob*xQ8^2@m!TS%-)Wq&Q5ML(knsZcg*rJm#YH z7}hF5oEK{f87cXSu`}eg%;ze5rp^IG?;}q){I}T@bFZhL5v%87`H){POu2U?Qy+y| zAtF&1ahw`0JWl+manS^3!aU5cDFX`3TxDgjxHzCy6J^9dNxMJ_$uyYIT2J2D?)o6; zW+KIymQIwqdtL8054VQlE(!_<)5S9w^)gFr(|iSuwrLdSiX&cb;ynm`vP$wMx;j3= z4FG+0T7joMS^r)FlWn|M@)p@>{bL?R%p%*mzs6}yZP>r^cb5BK;q%{_PP4fzGKmEb zN!@N8Dgj$dEbg3{A6AHvzmp4o`dSwi7xu-K^B|$3I4rluYYSL`T;;c+PHKhtJ~q~- z@g8`sI9T)uw*xx$mXtgTi$wxNC_Ay%-bV6BSWo-0sEhErXwKfbzMh%Zdk+qc)}%We z>tg?i)OCU?mG^o_p^Zl){0%l*k3kE#f|fHAS@iISc*^%(u@PbKQsUQu)&kas28*C& z|M2d5r;1xfM3V`;0%ck=X{0%2hpl6mYGDGD7dq6hW=$p!9~h3a!nZBtpBnJ7i6I7M z0L{G%uK>Yy1V*O*d3~ABo&;Id_!BL&a4@jnGt={j#o*TFReVG|dgfih=i+eRHASnk zKb=;{r5$fzwgDHEAaTm=2XQd2ryv-HT77Gaj1kg+?Gl43Z?DofC{SYia^Ed+^m}l76U)n%5b`K)5j23Qn4X> zm{czY&v4qj3Fl#P6*IXm;j0R#6ta|Vxfc@`Lq%dpf5*}q&o8Pql#+0YonD*9Jv@<5 z67ruP`0n#FL4ziBEHEIJQ5NR-;8I}%I!s}~rC>JOuJE-xuJ-A51+;y%DRY(q+7tB_ z*AA)obvTHrE(cZXtb$kKNaHcs0D3}WLGoWHP$P)il|hKZy`oyeKFjA^hP2LZ&uDHV=`J=#1AgiPgKQtq z0>ALu$huc(F+CfYFi-|O-^oF>%Zq?d_Gms`ev@PH5hdB5R?GBa-ESVn zcBjE@=%8?;2_ZZk_4aVJNngbt&vCyTHP-P{S*hc{B;=7IeeuxoZo9{|xbW|k4n=7B zRX*-G6)rF{iS8gSc+#s%ympmz&T#)|bEu+gHJdx{GCevO@Cp}|^EFP{d8hKD6_Zbg z?e|wgb6dfWyv*aSkJSD8dr=*?PYmo$jvQ6f5&1cz=05RohSmMU{WsdXu(u)4w&7d4 zmB30dc>I|2wiwfSyNc6T2=c?L^X-b?Q2G~KX8t5n9I2BiZ*7N)K8?Llc%Q4Q8dV>b zBP3#BTFEVQt!Q&EP2MakRfEbx{Z&w0yCao2m5q*5b@LKPy^WP)kY2>Lv%@s{T>lAI z9`P3;lX<2ftX|@#RlX3yg?D5xLmcCO7m~PfP^iXNT|L6C%*C4#lkxy^R584p9bXD) zhkn}rsVN(7ZiRh``)?cQ8`!BVUlP7VF>7rN3x80a0=3%>3G|G)$=;S8YQsfOD3;C0 zenS_#Wnqq22Jua_{0eRo-zwV0_u+2*_n1U_wnb=`WTYF8dDxvNfYX*R{0*{(#G$I4 z9pgf{Il{1!GVl_5r*RJ=}EXTJ?Xv~_3cb9wZJLmM6^MVXk5 zG^pw0bn+#kqZg<10NbzOv4(y#jKdK|DIZWg0%2~*J|MZM;2vo81bhja(vKg<1XanB z=aNHp$o0QbLjXbJL=$v`X#joDp3*O%6CK#568t6zEC3tj$ib)@d6g@%#D&&1$&vW^ z60GbFVLWDhRe~}9YYI0znN>!JI|^j4OU6K-iOp}oNLNMDnB*`ld#d__{jZ$^7}5Ox zJoDGDBOE*XPmRp2u|Eq-hDyxzA`1shIPq&GZeBfL3^`7%otdnR%K`o*M5i&@f@brB?}vEbE-N}5 z+V`U0^N^_|XPO%5^|8WS;-A&S4TfRAsL}Y|-SEN!v+SKAN^8g9s4eyUH5t4wag(W$ zrzC(Tz*}}1;uHhD5X@B0pGe}EuaXkvuD9r@qQftMWYT*tqsR^?kV|uXunZ!6)U1`U z$M91LExwu-D zW@F7o^6m{0E%=;=JG9)x^0ZUb=O^#$$^7w+zIT0ZB=9sv3S!Bl(0E^XsJ_pKLU{8T z+&y54+d2L+=VCA@0d5|0HPv@TAM^z@ICNSA&?#KmpAfUk={zQJsbx={INN>MA5S)Z zXhk+0uDyI)U2RL;Bi(4sYc}Qrd@V1A=tt` ziMWWsNzLv^RCShr)k=~XYX;y);`&h=I!(|)fRAZ$5ECmd{-W& z{zxLm#UEoJ@atGf`=UGi(^caz$+qLLL}#N2Y8e3I(>fVL4`JQ$Z2Ay?2X@Zn;g;(Os)8_cZ4M!R{mcn%E#W3Q`VO+ zTh(y9=L9d@v7`3f=pvT__Xu~Guo|!Gc-}rDdS-FaAGsrk4+M`9YAWN$rwoGK*k$Na zM4~Hr1E#4UAR4Chz+?T4s>827>jx_cDpGWAt@>Fj!Pxan32*_Hb^DpG*w$A^9t|Q^ zQRGGMHT1e#XbZ? z#6YAAAT!cJvDLXfQmTu(0%C{yZ`*2tb;YBz9(@L2lH#-Gh$dK;94k=Lxcu)VB>Gy~ zXU-|~4Fm3W$?#7fKZBDqWe0{nRSeGF1h-AW1m5T!$seEM7ytF>gq4~Oy0SFxjzk?R zWh&N9M5x+2BFKdZ3&>)+mHoX(dC5dr!1OO4_#jnQhj<^xX#2Gf=Mo zuKvYc@)7G+S@Bs|l%wLnRE@-X0pc5?e*G3pB1SYnE}hfS4Zw5CJ0S$DaT^>rImY|| zFE9d(>$Mujv?N<^R63(NzD^j+fr6BLl?f-@f4am6$pTLGBb4V+Tqp8%3OmFv=lQ#^ z!mAPHTI)Zo$g68ItQ@Opvlqvb9-5a{N@u|O7vF_yib_U@ z%M|+E6!r%+?v-T5%^qdy#)CMKnhpjN7p1k(6BtZ(oK_8XB+A=cTui=dJ_(Ks$obs5 zu)mJp14Qrde)rN;Bn$xTW%J=fYD9Vw5X-ePB8*CqU-C4d;`=N~6{9Lnji>XZ^QCpgHb)tFwD`_0R1ABq7R#OTRjSi(pwQ zOz#qL0|XyhoP0KhmU@Qbv?iQ18=bmGv*eP*tJ*4x(mhQ(+-dvmefP#EHxPc~>f`-c zm-I%t(TvnNvtO1-!=80AJKD1PXkb*Qk&XIm;ECPQ!~B~1^MgZqL9GSd>)jdE>q(FO z(}f}K;c20;bNrfhMji2ot*10{()crZ~C91>JI!^tGi-BQvC+17% zoakVSZb62u3=@o(Q)dDT7&ni1jdynbwrl&N)d#Vbx4G8CjmSoo7H@w98LE|Awb`Y7 z)S9|(_6edjZbP%^Tx_=+Q(3aQWm!w36r@-g@s%!{vDfvF4~Y_x*+&zUBUA@F?eKaz zprp2Lrmj1;2Cv}mdvo7|6PH*!6`43*J8i3}DVazMo=mCTvIaQC{$(_nvKy7nM}}gP3siEPDO6(nG7+MHhu4Ko+$oLt zXt(RK+dPEaJn9UGPbiLOBW4;OLN!y}^xyxb7EqOhgy@3eQB8_*jeGDG0t(Vx@!Gh! z^ouuGH%e;0dyedBu+p>t>>?bFo9jRgiP#q!!ZL={i3vKUB~)>~t0?;Ainc3kg}!|m zaN{}cnk5mUTGkskWY08=h2}Z9G5Uvpn5~Cxjy;Kgnj&am4#hM06KfNjH%Cca?W3+| zKM&SSsw&+SHlmy}M}L)Rz$}tMejyXY2|K=gFccZ&qBCrJO9(I*P?CDC2plK;s1M^m zE@vUghN@fnc}C$K(LPn^ntbT#;uk9@Pnh^TAH#1d9t$Mz?b7bk7j(+P?VZ`Vo;BcZ zyDjFsV6`*&;?|}Tz%^XRH!%Tp6@d4z+_#cs{#fy!xelr+~B<>Kn%wQ)u=F zC45 zyZz*itg6W{0ugvYBK^!62XNqrTOE+@wKQBL2AJ$zeyDB^Ya4gA61BtJTVx9gjs0BD9m0qF( zDs6>x1D~SC9Scfcq5yi18pz1-h)9MIboxi=jW1#JG%F&KX8^aM-s?fmVKI!h=OPjE zQvBZbh;qv1v|swWD)&qd{cmbWtL$%6Nnodz%hWeW1~|N_R_n-4`~pdEWYYCImDp!y z=w1qrKx;NRJDg`)nx?beBTD#}(p~yjTvIn`M9Cr0dV)MIr{MLpQwZqE2YPThK;zv> z03@`afX2Z&{r=jj`Ski~`t+8zdUKXGKmA4`v%lDD-5{Va8c3K&6XzKXa8WUh`H|*L zuxWJ$l%-pn@+D0dW$u28@I&aob%Wkq&kNR`1lB+A`U(Kiog>-# zR^hI-Zjdr*>IT86eUo&Q->BRHinp)f^fdc#BcguJN36#+dTUbWn`R5{8}|~Bwq;R+ zqhmmA-UsWDt^K~Ato`1Wf0gT`$hIh2R>2~x4&$k`A&x3!Asv?e0|q{c@w}oW=;hLw zdB#^(h(=03H3WL3=!A>(IJ~_pI+W;%yHUTcotYT08*F=J@9TqFl0q$4&%i^x=NxR_ z^}_craLJ|n>2{R8ZrZ)DFvGggOG&&Q3R_xuXCGOgnU&u+uzxsKbY8UGt#?F1RQOh& zX7TfyU1*tAnakMWHhq*fg{_D43bE=ZQ1_HzNwohbzd9_DPqO^mn~%c2EQ!2$(_wD( zIaww2lMCm5Pc=&h>@&Jz6Ho2Ro%17MPT7g~4%REpxQJFo*v!aah#7tD3*FNVy>AM- z^1kIad8hH#H;&Auc^L)j0}^0&DRC3w_A$UUGS8Fn<=L&p{u%q-c>V``Dk$d)Wk6K# zO058GGawv)JJvp~TJfEjszcMhH$S1nb>w18`NJZtud^2ah3>!NvN9A(11|P2o_kkv zu%BN8sEHK;^j1GY=f^A*C2jhff z!3yzVNp6`G^bRur`E|xluY8NQ|D$ib+reACcfs@&!i_5s-yPBs&Q!cf_A#F^PKFNT z+Niz$3Nn+a6Cdm2vrRY zz<@f?a$~B4>6tenzNm2SQf``r?z(QJe>HRH{>0rGVex|maRTvXSY$drvwMt*%yN%| z0fK2r=T0Akd*2S{!*_2d&y*RUrcA6~ZX?UL&wGYYwrl#x?cG+W^AiK`Cy=7|hc;!L z@S2X<=j57M4EhQvx0aHmwDs>uz5HUNihB^#%GEsHl0dd;M!Obi2a=Wpvt`1quUox!g&tREh;@X9`$3%UG%r5bwPG zX&ogiI#Wd=jHm?hqgJvOPH2gQUse~e1{AVGt6JQhM7o-2;i4Z&wN~~MJS!Jyu4b!{ z?T0k95Sz&lKqQVRUNK@D<-cBSF4(vwc6^py}Z#D zMt`g`E`EfIQCKW^hNTo)!h=ajmDQ`iBwfk&PV9L)auInVU|enOHQiytycxHC)4pOd zAupS!|JrxU|6Wo&5*P!F@}b27bm8{JRT@?kz2y8u>|?BCzywV%eIssM3&5I^3%94P zGKdw*DuuM!4&vD2?u_R}lvREiwNUbeIv4#+^CQcyDS|X)TcLTN+Ms7=3;aj`t` zr$Mg|qb8h5myhr_m8dlpr#_Y+ zZ4`*T_TgFaZ+UM{sq^&#w2L>2cJI7cTM~c(3o~|wrTMiMrF?QePml5VCyy?EF1`F` zyx2@AobkEH87tt~oct7FWbom5FxoVO`NEdRbaZRtUk+a_&G3PR?w<-gc2>Wj&6lUbb z)4JJ8p-UpRsQLXagUB-vIa-D69$|`FMaq5Ukbkh)xbcC5MXFboXMIw@+jZSUbfNJw z!CP{D+AzKlD1@)4iWm<#45|Uhn0U|^8g$12zGtF)Kg%@B$1AP?->Z*RzMX-lgw|TlEJRvORD%X>tf?3vDZp) zBVNOp#uK;J|1flSS|~ycyU?SD>Uo;*i3Iy8BvM)nRBFY%O%XSS<%A$s-~>#>y25Vc zlm>adbgBdJcu(}w0b?lD2>2Tro1QO8aKsN#Rb-mr8jngYb! zy}VP89+HS}F3`dgsCih`4>j?t1jxU(Z8u{hjwmI-VqERl>?yi6o6+0oujaG~-`2z6 zY+ysQEulbzD*DmJwbf@m(aPsn zH4>c2s19k=s|@siV4PXO#_i_QGu^uxbUI(*bLRlx6DM3&ND7%5)fj_<5222kzPcZQ zzl~Sra+u@qV{Alb^SQGzZye{Epcd|z@c#XSWL1sI_@!<$dX0RT>R}Mpc@%h9!{_#n z{+@TQ?BVje1^4C)M9FNzYns|UGG9-CA20Ci7#uay$2Cadt+wEHAhczed z>m56a>QpkwS6*jp*$pif(X+>HNev~dZI)Z0x5N=!z@h|yHuoQJBQ7&eWw`Uc=bgQc zTG^d=j!VNUo@s>a2i6W=EqodRn{u)9VQ3>GZtkx8{tfxnK)s zyP|MVoIW5oYi+>nUIJdhIPe%l9la}On81|?;xtmVWmQOHa1JH-XSLtka+1m;t@Uv9 z%;JdzaB#YZfcYJ_Zt_z{g{CuZ;Sx#8zz@Rl>7)q0 z0drZX;mdf9dfCAyO*SjeeK~BL;|&u0^ldj4v1;^GrJ29eR8z*8+!EkRlMY@zw|=3% zcM#e$Puc*xCWC+H&u2-+B9hA9PnCAW(V-Cd#x5& zYM$Rn+du@37B|+p|L#UHZmx*48OX{sW@eAcSv=cn+PuK2{Q0uow zp(5mj^gwIWCcnXuPVmhWd)@RU2J_A3R~HgFtMeS5bszR4U(hnadNBEGJkm3c2u3Rj z>G9x%Zg7TWwe509(3frQhTQ?1n}ZTBL{fhoEiuX*{n+vv(@*P>f6I?wXCFY2x8rGXvS?^;{-hC^hm>#SR|vuK;ut<8@k(#W@`|}zNg)c? zTTaLMVtY_fZiiAJ|Lr5;fbNQx{aYPz(3clx_~4qKgO1?B3J9fMx0OF8oeQevE8Z2> zA7LpP%>@3*f@k5(6w(veC0ZWdWmsVGB8a6 zpTcH2;0w9oF>*n2vSZ-T>AVdl;D=z`*i=@H->OI&6R8Ml=JdRQ!& zx)OvPujcqWxVfk?YKrMS^FK34Xb@xW&Wpn~o!keB1N-)Llj&!8so!G5$Qs!CC=}$W3m6}reQ2<@5FIYC^?w4mjfV3cs(YX|c_iAp zk`xl&Don?iJ~Y%5*y@8r#-H8$x-hs0KSDl-b+}Jx-CCVK&HN@V%TzF@6r^H*vElCA z2O}Mf#xY6}4z#spQ5pKDXYv^C&1-M_sJ%#&nE1=0eH_P3q<6)6bZ@58Q))&rVhAJ{ zw9cX}#MKl0w=gJ`QHw^*^muMz9z>V)Xh z=rOZm71>p5XLMw!gLF+c2JDCy@LMfc+Yv)`9C1n7E29QNsKsMc8BIfAG9)_4D^=p` zF=!fagLcimO>E+7<5N0Yx&CQ4&0by2E7;?mu`qxs{?#Me*dhLmK443r;p`Un1s z@2op3c`zY!Wm(8Bl^2sl{@kmq*I$>XULeHJ&_?FlQg zEcN8Jj_Uo-k)OPBzw8Q>P9gT#beQ;7gTZtsVVuK)OsJrf(~8&k7m;*-WbN@EXH-v*GFg+uUKVln;H8t}WLUpu$;YfA~1Ba=))Ix}TBj zfE`9k1_>*|pyaN{z?G~tE-5MXvC^ zkU%z?V0o=t&F*tV`DBQKJ~JVrtIo_yISu0`5Ynp z&u$1$x78{%eE0%}wSwPV7!kLB9xWaCM0p20MXd^X@lVO-R?mX-l?_w}+oDbdXa5vx zBl0O6X`z)$m#$YK)M+O4_sl$ln-**N0Mqt~MgvE1{-v$|QCq`6km$o*dPz3)hLeSd z+}ZqK7W6I-qY|SUQT0?TOn!Gf3fsV6oO$FHvt+RKtY{)h(Xx|u&rFkR`Df* zF+>GsHbVh0@lh^CdOy(PilJoQq?WGo4#kJ3LI^}YKkS6-EE;Y9tNBU5H+L$F zdCv;jN=E7TddJhyWF7Pto05^)403!!`euSV;HH4-MkvHM;w_745Lo_#ls!m?h@R*~ z`^wljSK+F4S}@%|s(Rc*=vGZKJ0)OKj>0v!wlSW7(1wh~`&)#NGRmf3S!PHwDS$st zdK`RHRI=wvTk%380%7*EgAerz_8JUA=td!9d<-M_5-{(x>47C$yMO zBHAyfi0Wnk(i&(hZH%vYsOq6!Gyv8}gA6FXoxQbL;$vG9%bVtCh8`i2^IH+WF5Bm& zKkjr5hF66JM7CcK@1Cepf;_BcpT1>O23fF~rhULPNLytA+!oL+c;TKDW*eGIR)nR? zw$8DzfVmzm-keYh=>qb*0!a zGTV@a@tX-wk`gDpkc6z>O0J|7^gzXUB*Sf@KoUltm)v5=^Y3mbE1E*?y(TQ;S7uTa19iTlRr z_Qh9+`2+986@TcCkO`{ah#7M_pL8Vjzutf2GGGT0CNCXU*ehWe4-6>NGwD(ON1OFV z*3kc-HbYT@Y=&+N!Eq7QMX+%lAY?;Yfyp`l4$aEPu1@+MMax{Ht7K;zsqBi=S&Gq+ z{(?CRQDV~G;1>;@{cmkC^)m?*zXdxJA}0O`Bu5k8zG;4~CPDS94AK!h`r9>XmeVWF z?NS}GL3nA4oQRaWV_2hc(ELd@hx(BbN4iG6NJuW*&CC27bh^w5weI<0E_uTuVjuVm zHQE$VZ-(hntcL0aG3Z~o?4&hK&=Es2qCXV9glr zoC_HmClzfMFdh&Dc(O3EbicJq>qZ~HjOVqlz7;rnIA^qW8Xe;&&RBI?!Go4op>7pw~E-2{P z`=O;=|A62?>krl3qJwS#rH{CXO*?yM2b;}#b_%3AHO?qYgP~s!Nz&ixDvcF~C?_k( zFiv9$O}gd@6l+_v9PHU$SuoU~bb})2s7tST)E6TK9-XE?0%Nn!jmjuIW38Wc*a3Wo zz?EK0_w%g)&$J4Wfni(%L+q>u)-Gf>Ksij(Za0=yKh0bhuINV9+P6`FGn7GY6i_*) z*?HQBV}W}dswR-?12yO^Wb&}um-u0hSy5ciWVAhGf~$5W(v;3Eu{{6{I1jC~z_hGt!fCaF1#EY%@k8o~ z+8&J2^&pFeo8DS6f*P#->!f2QN^(VSsbj&YYAty2U9-1a?ICE3?t2<-eGiRPYF>EY zskXEft2@yPC6w~P2mQF-PdO!p*=2L?tfJ(R&hK$gzwNr1FOglEK*D(7zRm3vn@?cR zkNkkVkCom3k9T;y#X<9)G4WYEp55L#@8!z`Ou6ezXk$2U-zBY`%co&zEXbb*Up&Vp z*9GNtq9HoaO0jbykHu75ig>##*x4z~j$ftwf>I$TCSZqY==ra-3c^K4RT&ME`hU&# z`b;3A4X!GsM?AK1jW-7a<#{D!i-Y zBaLI zu_Ag|Fifi!P5(Lw$*_~oev5UA%}Kt1!ajP%>vc8Isp4krjS0# z6fR8%kAx`|mc#*OZ}w5MDzMNoKjV~Fc@bvhr;-gNrjMP}rXM?i{YC2(e zR*xL<$r@3|)As&)v_PX9SOa8Lfo{tWHfPWVF8xI%zR$sTAjp|pgh!C3Wt;@2qDhaq zhy-|W4LHMZ97?}v)XgV#65hjN`${K**(DVbIs{4u?gWT2vDMf@ebb6=)tPr8D^VrV zU`xzq=vs&Rw%^7pndg6O?dKArzl^#=X+xlZ*LE38*e&H)-bGoz(I^!42H}ShKas4Ay#dp#44HoakEeHFuQS@ZhWCz*MvZOT zc4OOi8aunOlZK6Ln~iPTPGdXy^1SCe=NH`Ty03*X=NvFtJ(+=r3={4$!Om?LPECLV zZuTMf+#~t@NC%C!S%iI)3~Y*y|4#k9WPmC=;IM#ez6eEmiD2WYxiu*jhuNMFUp449p)7v#2t^1k7;zarG3c_iSw%uM zjvtk4$|KzN>?o4GFzpkN%rzkPP98_f?O`QOtm?Kk8HWm&EC_=Xs6tnNA)#ahGHt-I z9b4Y0OUl#j>4QC2eD%*R)CG=kDosiGln8Jg`+KWmtz6tmMS!} zyXDaG+cvu=RMz1Wvw<@lkEC&1?B~#4SCsqxNxAcdL}gWu^5+b`($jSDOO^cBqYb$w z&8dcq*csbiwzM6-H^==R>f;G<+sOmrJz}l>#Sp^o8{JL*uQKsA2L$dYf`Ey=&t&bg zUEDi)#XITE8np-1Q z@8m1lI%N42ngKzli7|UJQP5J+xO(+j7{J^shsUT+DFwz@QiL`T%~oWIjUXMKZvR4 zvSC3!T@W7lLUHG0A|!SSgPT?xTA~=he|@>s=^_X;qx#mzqkMhsC$R6Fh0D@-`<&qK z{4t>S>nm$(cq3o%IsYvWpwk2Zw&dTe0s0k7&8kyX%`{$7F&h^?^vf>J3(q&1*u8u? z8hS3tN)F(*D<*$VKnV-YYt9%)SLnc|ASW1Lh#UO{%x9X^!nZ8LYszE_7QQ6Kn(y1H| zv_z))4H7izUS!q9*9BZn)`VovnQvrBWk(w|hmMz_V8aPW;{t)4JFC-@$JTif!Km!f z{xrGWLW!|XqU#ujcM*s)y>f81hoH7-o*(lB2LsyP{6!f@w&NatA%Vj5($usAZpviE zkWYKuyxIytcgB$FTI}^xD~^sN^OmnbSHZXAFWL>0MwPoixiYakm=e-QI%vrErEwGD zWluk^vp?dGh0c?15W@H0aQBHpzsaml++8Fj(4P2AR9Yar8j}yj9Ic$s%n2cPl1*=+ zdq`nvG4Np?vzV8?Ll;O6A_}NuJ4R2uRACRKw7}NM1wApG0{v}ztlqht;cb4<3Dttx zfoG}xNi0z-n#RkznQAiEQ8eEd1~`!EgjnPYUHI?+xl@Hpf~kfjMr*=aV}FG7gVfs* z2j{NbNzw7+W-eh`{6qDd9yktV8HvzxmSu5mXTH}2nbUbyi+Sl+e6~Y^>S?ovZpdC9 z7nKQF-MaRPszF3rBtxZ>IFgKy#@}>8CDlDM*yJ!D9fKz6w`c3$guMX>q6Lgu|BaJV z$V4bpWMm<-yU>!*F@G8(cbKh#K)?w@JQitJy^!l8ps*Zib!DyQ10Jx(FDLal!KA3j z#UziUIT;zCx<-jy4~}8bHKN(7GEy0z6uRC)&CAhf4RLufAR0DYBNE*7qpTkkG3T02 zuU#76-49Y`p{a|17FP`4hh2)1TuNW+MYPvvIBeF8N^(mi#ze`fF+6!Ei9VF4zh27l zbO&2Xx^4JKy5-mdF9sC{`~)mLo|7$7|HW?6R)3KObG&^{Q^y-r?sdM$k8=foSg4;A zNk?9be?_VHd|pKHvo}@fx;ROnK9=8n3^`F<`nRKB*=U6PmtXT`um`71gba(njN70& zCi*5D0T5IC$ZXUH7m6m_lwRXj7mf;5r}D%Q3h9UDK2RfHu- z(Es~K2zwS*e^VP2u!#mRg){wQO>n`aGD!Q3;qUj@nzOzm%aWANU=h5WNQX9rMU&ho zj}L1|>C!?iMNM(#xQzTCJ8%7VFxeLfZn5hSPHGCIp*0;G%m%hF$2uhI9z8)q%*ou50`d9T~uZP;{(Y` z0o1BPcibd1$_mYKP>g(9F-$7j&O<9he5Br4^0#4iq-)`uOVrRHpoATc6@OZRwGNV2&;Ka&>#(Lb_EfPwnbYBWf26Wv-&1+B^0S6q}LVyLOJD^ zcH&@|Mj*d8b`XWt#r_`hUZ~y`?w2b<_F$DSsI+LteR*47eT`kuXd2q+*I=U+fq)&l zpJ?YpE2#6`ext!?%U=xq?Nm}XSRgY?$gW)hiFo4tXBP@ zze0jT^nG89Ilabdeb8V2bRYa>>1g>syG^VVPP38!ncCTWxkn9jGaC?E{Hh zz7?Rtpmt_tY%0vvLu-xnvrHhC!qEytf7)v+16xtxf5y$5wz_|ALlI%MkClgUhe6Jd zz~SZ7K-YUF{#%>E!y~~u>3>d2jM!JBiP*|73^}~?CGn&aQU5_jfXv5;o?hcetXxp) z)bEM06$ZbXxg&@UJ|<<+n^P^&6M*H8IG2nmIgfpyo>oTjY_91TFVTebH{Mez?DB~j z5EFniJtf`=>?e-O)diDqgwBC2+xgU*?wI6%ZUA-w2IF3ssiuB>#u#4RjX~vGkCbAV zCQB>tXHA=G(mG-0u;%Ri5C@E@2J?Pp) zXu!+RwUvVy**U~*0{J+UmeT^#H49rym%tQ%%D>~-Ml2q)uMkPcQOJy@y~>AwMI?eW zX*4`zU0N4Jpo&fF1o3z7MK zy?M{}@2;=9qI*OgUVj#$Tpftp^R4O}A7a@#?MC#^pBGCfnYE>*nhca-RqQ$hykT7# zzC^NTSdZoTJQN(b#7S%ZNrxgN*VQIq>QCpo0m`4w;f%`bDs0j!C{___cQEBA%`oOx+gjqd_#_8 zJ~+Jw-&y)@G+w#NYggFXfa-Dv%mGcl)3)viNz?%4Lx%x+$RtJ`}jV2xHq)3U+*HKkur zI~3jgPC2npy-w(Hvy(%z&6S!ps&rSKKZ~JxHnah{ZcGz7y-}f^Y^c`{@A~QpSmwR! zaYb=?L@@LjldExpz_1wwv$M&?2s6f$=>Sov8=aNBh1cI9^{B%QTl~Qh1mv?(AIlE_ z%d$1-!XLCoeXFEqG2t=>j}(`ZX{N^h!j$_PQe(+jTWbG|&!cP%P6b~}o}jMAxBr2k zVsAxIrPYo*ELBBAZ`*3Ucc#gJTK5}}h}HzCkBFCj?{#pud9L*j4cm(!;z_N)B`637 z4%rNtXhEF6Ju_wxHAiv2Q=aZwUE#w9{c#%h{xT!aO4LAgkmNMucp;o4YjQ&C@yN0e zIGpXNk6T-J;5u=^CYc!<(>SJkQI%4QW2hH?en^)#7~j8&sO^nsmhiDLIb^vde|fVY z%lsSFqy9kyO?ltvm2#;ah1}vs$5YAN*?n~JWfpFdZ{uUZs(Snb$n#B#0+N4~C+jzC zHOo#{Zd(fAl2h!MCH=pUz~eVn9CSo7)#Ot`sQ0rUf`RH2pr8z-^(BIub#Vcs+S_IY zm)wy=$r0n~0mcf&EsC*sm-O^B&TsIJ6G058mIeTVT{FjqT~Dt%L<;avZY|u6o)@Sa zobLFb=I}(NbM zOK1RUdpI9b-rBl91*h?hFfo(>0?cHa_wVIpF(X|x!c~^%h02V8Fw^dYaV&a|_a!6I z+N2z6dw3y4QEAm#>zz|obs-@UC}35_(8jiU28Mr>29=6a_L&GXM#I6k&64SOn(Za^ zNVbm?QLRa86bzrHmr3>g_=bL>AR%y2p)4XgfZh&=?!fsrdxHA{t7vY%pZkJ1$GmGU zirlZ4iMIcfn72E73e#|C#i;-ukJEM$*iY8Je+4cpm}dj`ZrNsK zf;g@FjD>=ts=07)vSzY-?3MPotcj!nWKeOhZ{#sl#)ur^cI9!Hn_NBHCGfHSEuY>Y zWhJx9Bt8lK*h(qRF|$dH{Av57`s+z*-8i1c7H=gDuegWDK}@ZOrzXHP_gy?#P7PwG zz?f=dRJ4f7PUF;Mdk#p8&ZFl6$zRa?j%dad3s9w&VL&`dr8rrzeZy88If&v?cpO@- zh~u7%L2RfHeB6dOxDsG%j=2s5@nNw9UZajhH_!#bol|#09Zjotua1O|e)mi}!4&$e zVUP}vN#>?G*bgzxeorCFu`u(nhO?~HnFG^!PGoKUJ8vb*zOP$8zfDfkE=FMIF7r#) z55s5PDg6@BCji_P_q$IGyWKHk&F4}4!z4t+Ru#^B$YMRS5-H=guML>1?{j=WruNlR zI3?j#%;M?8&wn5iUZy=X8p~H3XxifHK+2gl_g}=&P=lNfNZZHYyh*W0u zwq-GT`o~r=DHt-*;w?DzVCseM&<7LNPoI3u92rm-Iv=m zaaNDsz{Vy>>V=ep^d{kg(WK^8QyW7IqoGzI|3{Yd+zT!WcT&5pKTnbr7x?NB2mxn4R z5ePSebROKLt#IKEA04jza$gB|R=1eAM{Xwu^E%7!!0d;%>{8Ylg31tq7aIPqbQdpA zn*)tJg#XSuzC0)~@&Vv@AY_csZrqZ;W5W0@Jcn+8lj_}@<9jxG`Ac9^X8jI49NBLO zAw^MlA}DZGAI$+n)ak-ioTAB1db)4ObKiq$7$Gt4h{cnn0rd24PDprJ%q1M(>jq$? z1(h))8Y+czWlQ?Y;`07LG39=&D9nDK}w zkOhzcB|(9+QF4p_Ks)C)kIJ`KP=Uh97oupwQRIT4_@#gZrbt9+x%(|Ce2Ynd0{V5` z`AK;u=1itx32f-$IOKp-Y(ET^DNh;Np;OdfXc$G~Y!|3-kTeF;oap{}PkvO2cpd5| z6FtgW6i{~oD8tdxG-LD(8*(f0V}0Aw5N)Y~+Tzoax6L=z3G=FW}8RY=R4m3{UPRLqu-pbB*kowtFp zeIxIYo94Zyle9)E1u9LDqk-oJBYM<89M zla$4KWL5gSM%+vrDF%C-o#8E;{k8^M4dey*w_0dD2FBWT4BV(puXw3>6?-^U7(>7% zjB!sagRizj1Z~*N#=KcVBY_V}b8IwG>5(=7ee)!qbWYWA!fEzV=>hwF!_)hF@{|lm zEE>%&^BbkXEeBOavZ*^`B<3U6$W2Qm*6-|xSU$yxlg zg|{>LAeaDsx%XZ4!-8h&+>u5fJ(Q%7M@j=PHx>lD? z$S}onN_%M#Km^V`9ejj$lFd%Nr&2F04=X()tQ^(c4CtK-KTimP)zNsIx^vc4mC!oj zEDTppK4e77b>tMAeN9r3wBzFz@>}q3>ocClUYA~$EodZ_e{f%C9rf@tut4rv9R^?D z$W2x`&8I)xV3takY^)8Ao%6Ol9s8t2#=`a^x5*gFDD5Xq(Z`mecWw71-9>-0gy^=9 z#T&#w+-CE+ElCVTTZaA?D^lKx7mm}=Kd#;sXw?ixdkiDI6wmfa{VaD$wz6^{7r%KN zl%9%HJ0`cw{L_`l??Anz<+MjX=z7f`)m~-0t269z3})y)>zN*Ht|i@XUggG7b>|cu zQ`s%R(A_5!A_;epjTQNSd@|$fd^)-R@ySHdQ4qp`C}|0!orcx_Qh&rNsBS`oXiqLS z*k12Mg*ee^HcML@(omk5z_YF}hK1%2_Hf^4cGrG-oI*bp;j>W9rXf`O6Y&iwR>U~W zRQyD*ks^Cc^#8v8b(_=#DUW@{l`0#GH4Q@OIx}6 zywI>P_KzHW!G|q)?70q#G{DqFeio%vM#4cZFc$`DoF3=Q1IvACWp4)Z=ig}VNW-g9 z=+bkth#eNeJc{0g7=b@96og?pJGEJ;iORl%o5(}HRZO)p(1(}fjWP<$S5W;s)xw#a zRNkAUEcJI9mC)RrvRVQxMimEa5y_QW_%$lJP-8qF2=n`s&oMwau-3QMN0J(Mw`=Q5 zJQtKU6w;BUC7J(2=aA`ykF_JEABbof4X~mnz4vh=o9tw|1KppWY(SiIPqvC=l;PJd~p zl1y;1mG3Dl#6rh{?rmu5Bms0e0ChR#Eul_@+S8B^= z2f-ypTUU#KWo@{>#YnHC7(&{HO&;iX{c_x{O%_o7~KBoVi% zyTVjMs;$}TJ4vcEMS}Eai|GqR!ubyhD_iyQlgyKoK+^;wMWKyLJuiaCsIq1_R}?BR zDirK)omA}NP)XB*Ax1tvOZlOvP2hPL|8CY0`}(q7H@qM_8|Wf@K$h<@RI%xddRag?ulGoBi&bE&}V|`!TUU!wGGt2 zCJ)bA>DjKzt^IC9#^OqMgKHUUxxH#>A-sG>`+zc0eP!CbZH`Tr2p4KWJ(B@fjl0L( z%s})zAM#K*w6mTMWvT9s5cw^-jwBX_Ip=2)v&9hVtMUUi+M08I-?wj(B?6(WQBEhk zC#3JwgQ5gUQe<6^J0+a`YeTgBHM{Yw^o&kir%yk5T4&rVuE~eK{+aGUt%+<1nLBBW zEOX6HYzAU6ArLlZE$eynpACYiW!LD>F~6j#CZV>pgj&|AV|xn)xdvNwV>U6<5caG5 zHmEV2O^x2Yjdn%JR%^lLtv;;XP@i2cYmzNB#y8g>u3nXWjJ!3oZN#npioqM^rxU}o{BU%&g2WqcexV$82LqkB~l6}by?l95GeQF?<%t!ahUquKj=RLIH$AiJ)? z+y$Ib;gnIQB>b=stDaD%bSPg_7(?0qq6-~xO#L}#CC31Sg-OJ$kS`5~kLk3~93J-f z^G!HBW9>43=;oTpw`g}1;~|9-L;i?Kg_o`fW4HD*N0qOwMcpq`B=~R&dwEUqc?FRe zs}K~CFE3*;@p!2XGS2KnKBd)0>!hc^3KeQr+Odz>{6N@Y&Ki%eOU_ilPM}2wj&GyY zj&FmvP;r?5l-7e;o~GL7>1FAZV^Z>Fc1b#H9yVT%4}Uf)mez3v}9%wM@H0Bsz7Pdpe@=5+$g8v zc=rf{mTBo&uz6==mi2a8sNk=6+aUuxcZR!s_z)c@#&Zzd3AKW1P?Q9< z>j9L1S=&K`LNUU`Ue-jy+ao(D68G+-qLEW5iR8i~;bzpfu;yoh$%FUe6GG_7T4a^u z{b&i{cz78h4xOr{1x@mSE6OEMY8lvIp8`%pt5r*?`|No0M5#D{ZZ6NFN31 z@buDwcW@0x^`Juk!?!nV{<8ts`B|KZhUU{Fzbj-mhc&`0SBDlBdvt3JEoRh)FbVQ};gi+V~ z#&gE%I5BwId&iU8YX6EgFHf`DJsSMWD0X^&a25GC)SHRo6W* z@52H(68&al3AK;(Eqh9D&TMklBCS3u%p+^evuw;=kbLrhjc|muqNH)`l6l<}@6J2p zNT8tFgdC_ueE{sD|CnD_qhRA3(%4(VW4y^Z^q+Yw7TjQeS71EZ7)(^CouEk{Vpu~?Ba9g0fjy~d5C*N`=VlozSiW(I&Wr4j^@QUxV%;2cDv*;o^{lnW%rxVm@B6 zu$ASD)k6xvUXAb^PN7?yuZ9rz3x`hYV`lHxS73QWxgC}P>@$_Y$EDc?F`>-?PJ`Mx zWs3vyyNLpMBjBoHz@L(4Nut#+f^Ve=kA76(Y@WQ2fmWZZ#&bL+(he01-nCw~`Tan76xqt}y&x#u>0UkdMa zERRy8z-NYogwo@AAG5w-QNV?&9Gx``PMaf4+*xO2=DRV0NfZB{3#7dQhS}fW>YKq?G zd7Jdx^fR*6TKX*1zI^JjGibig0a#|mbeb?cC_)eP2n6Jy`Csy5N`Z>{n)3SLk^-xr zjZc;sFLQW08LO8NPW>6O%?Mm%72~NH*UqxD3|7UQgNGMJTD)($wt}C|D_$RZo-S-O zHY!fUQ_Q>wJj*LOLE22{JE0%Ua0!cnv&82RX-GS<&@<6Zf{gf8{Fqd#1qs^JH(ePs z3pN7cC|N1KHplIMSGWExn@O(_W}fZlaYNqKZonbOSoY0L9(7oVHkHhB9$RG2`P1_{ zZ%Q^~np@gVS%J%0YmPy@=?49lE45?%^pLiDSgu7`8wn(BBJ3bnTKJwAwD_N$ylt`r z%3p)jB8GY7brtAjjBOsfhpPt+`}(;OjJ6t9xjM#N?P0~Bo z$b=7gM%Dq>5f%FG?~5~XeaQUvxHQZiYn}T!FAT59DN;TAsefTioEgRh*B^1TF$a3vm;1hTY zzxoQFK`JaoPQwBN!a4^x%bHdm!0S0om|Cfw75*p`{^4g)cv3QnX*&J78(7rOl?89+pD_uGCZXx6UyHah7B2r z31Bzs8)JMhk$mC#3d=(fTIT@*P}zVzwn7$XWopOJ!;_J|sj=TU9e?Okt$qL}G>|>N z@w)2>&fNOu8R%@$t=(kuc{Z|RlOBWDV>C%rRe|3bYusw$=60Y=vxvU(H27OF{(L6J z=~%1wBm3~ew##9cHG)U}BJv~(SS|Ve#7bW*KKl-Xm`O!GRviibCBcbgmN2+u3{;#R z|JxLIl#o!zV^|w3nx_tQZ+^&1y2tXT;brWiM^<2Z2maX%6ik!7jw?laKbtq$7ag1? zJ_q{)c0`E)f(~qSs<{_W6?jYQyIh2I&y&Z0TH$N*v?S|8%X;#xtZI#Addpz%lx$un zJQr*-iXm}YVem$r(>(_>u)ahHTH~{xMmrma8vE$NeH};4tMFk3re+sq`8l?;>y>pXp9v62|ho@C6{y=X=I zEips4AWb-jaOyv{dtNP?;J*8-X>|3?q;T$=)NfEN{DLQHW=9(aVx3@!j5qZUd z(AckJaC+!Xd}wrna==LAX2|k464X`gTPMdFotOuMT*M&`3*or1h%0n7Z!zUyd;n^* z3FEXfzAYbJIdXP#aFYe8!T{0UlcBLcnAYMM1BtR+x#l|8uLP8T)|zle#$^GP@L{?z z8NgooTs3XKliDa=?=X;kYtB*9gIa#Fcq2;&& zF|8jRzKV{c7gXCZZ(3LV8e@@)IOHKno$gMxBop+Jd8}0S?f|1Gm%8et-*-3kFk`f` z{Mu>D_i3`?aWCfyiav|xc6%Jh{!pCP(wP>=ZXS>PW)%oS9`Fzx3*<+h;S*SX!9m=t zu3ad%vtv?N-tCo8NNX9)L*P4la6N)o%zShUdOWuNbiPBGUTPgCgQ4w#U$q+CUj#QR z3YyZ`uP|3C!F5ej(Dcwcn=Kv$tQ5pP1nBG=c{HKxCLqg3g0GXGA}}W!L>Xui`0Ffv z;iIo@8XE=99mAWYcZ7HDavkkdVuo<<{q68Oz;)>ChDCOTyFjQHKM<|ujswaJ{Acps z?fn7vX@ZlVccSpqBm{h^&+s3gNMj{lGO#YIG&zxrl&%|Oju*rmTM%sM_Y4=#v5}W0 zJdW438>c5T?lZd@UU9{g;0eR#_MzoktjL8)=w%GmwIaJ1@3jMM(BmeDoQ&pwj*d1` zhYk`I5q0jo4e58{aSz2zP@Gr3&rnG@Mv=op;p!Vv}EVk-YWWRVzJ;BMs~U%Fhx)dIRs$C`J$ zS?5E;c6Puv0@|dzlj3eZGix(s0;s{q*0~DLU&(l3<$64Zuzd3q} zvOKuNI9{T!$|!&0EWyGdlg7M1Sn9Qe1Dyu~GX}lQ5FOp0&I!j>%a8CL3;6Ys?-EoN zGySi61imY>fLd6Z5^`R=Q|M~47Nlja1o{3dX#CoG$v|s(No>gCU+E;Pvx9W?iCJ6;@F#j7)s4;!B9eRK#1c71M#nVYCjMfTOh@`JJcW@ z)8_mOg8E>&o*%Jz##OsV?l&d8qtO3=sr%d5%Dcz^r^+D(7M^dfXN)BaAB>0hmzoU4 zn&7zY6%>-y>HRx{`8SRkEBf8}1>fa;0|cxr za&vBeWVw{M#}53$e_42`eQ@)q(qZgk)Onp6U4%6Qzd$MtOluFQuk8bs{~iA+JLz3x z9D1#w@?D-pVSD2`E`0k?MOMd0Yp^_)x+gfocE}L@PJ&>OGdv+lhM|;AQg3-*AI_Js z`JuUBBFk9s8G0(?YpA?9q$G6lQh!$EgYiBu{c{k%=~b&L(e1cIm3- zge%qJMFpaj$BjH?ZprC};aju+|KA+=?U)m@r|~;|3n+pIzn8KV(%OAts!d^eIoRBH z9s83Ls|p`}V&O8d>!5b#_08UKj)#j#(p4>i^EqMb&uG`12>E3+ZZ{)KxPjL*uaWSr z<&!w~p!6usSX6y#K7^ z3xT~m3jJb%9MQd(|1AY_N8<9lI>SBlu=dBwg%M^4fTydFLB?Ai)W; zoKTM*XB{=d+Tk6R0@I>#C?V}p*mTNicu)<}QeOkVbMm&;)uri}I7jV)LA3&O|j#tKwKv{rAdhahsZAZ@!s zCk^9!rJ)SwgcfTQIGCQNBJMJn2PZ`I1n<_Cvo<~JFmb12yIf9q==G`_wjIB5`Cjbu zDh3A>Sg^!iT6tP0gZf?R5|7X+mj8Q|Ex!ENbzp+ilcO@G&N8_EhFE)6FzQR2Yn>{x zYJKuY0>=dPG2u3?k&*NiFkBH?7Q3#cj(vr8jZ!dqA|aTX| zv3f*b&=ogH6)o z&Jy|i?(4eGm*BtPt$Oa0DASjC{k3fiR8YpDDR9yz{hSPw#XeOh7}pgt(Mg<2!PqG1 z%0a7s*7aH(Oqg)NaG`P=J9_?~ zaaBOWZtmP6wsi<%_TJaO6gk8FWH16p8kV|nA4-hnadsqc6oeaBh;&k)+UL2gyk2S{ z?OVw^2A?n}AN<=F#NDWA2{1bZMT^4a^+SBa+;NDbRsM!t&3)x|f57}8=Q`AD?vJ+n z&!2@+7}}Kl2_Vp#Nu}sVlRpqeCFP2{qZ)W@o>4WxS&A5V!!`LnsXr*x&YUbKzuy~T~Sz;I(C|eNOwAU6;8Zx;VTgchl^!QYAS4>$L zxY-bIdGN7t+|bm_we?1KT~t3?Ju9)DEhdQ4Pu!{ZAK>e& zuk(GYvvtzkr@6$_&8wmlfUL%6)r}w)q;SqvIv|0&PatHVu(aR*&V#hrG)jy!wFjMT z5&=fE_SAXXgY3m|UDqt5)ud;4xM}JavG;u)l)u%<#du6B*@VC#)$E&1g{6lh|PVOM{lxputKYrsiT>`@BI}R-oWZEx1b*U)#j9&Rq21Kr7r~NJ`RK&CI~o0 z&xz;u46qC!f?>~GDT(4rv~;@SWAlIp*uk@{Lg8ue_h`c95r8cKchI-_fJD<@7K{`) z(4QEaqVHRsKBUO6_Ddm}PFR#;GC&8<*QRH3CU4(d zcD^Fmd6QPmn^B9`1c%A{Nkv)IZiBnj9cXxHkW)bBzalY%{Y+iJHi7#Rkcu!#BlffC zjQ_pu%&BIT0NN^ZRrG+i%`NLp~UZJs8R`C0c{)BXjxsFqB`E#JaK_ytngFZnrhS2hTiePdmZ$QZ( z;blL~2Y?rH?E!xgp(R?fJVcz7V9wPt18ffMxwVH4p#$Q?+X)d-W8?c0vWg>&Y=d#tPIeJt)VO7Gjm&sGgw`{ z9~bi6y9alM-FS0hr*IJV#Ed%=10$Yx2Hb9fx($SO+z0%1X5O{5-7nL~+r{+zL2d$5 z%yXjrYRmWw^`rDl#~hf6_A4X z#e@w#*4qAaihQE*95vEdL}IR<3z|Z8LCOvY}8047aVw5<9MxN;Q zn{!7Y2W3`B-+krXpIcx2BQ&_eI`W;Xh`09O_bAC%$<~DG6>4jan-Q^loLR#r@*d$1 zzZ2Bv$A~U)_^ZUcSYF=n-{>M>MIL4S5_*01l^x>T5xTal_}&Um-y0w;qXwny3KlJyme|>^qz>S zg^%(}eqY@nSkEePQ^q6EQ{myngcA1R&@Z4w`c7@sl@Gi#1~LuX)p5T*CHR4xng7f3 z(B;Cxv1E16Af-?8=0cd;@Rtoj7n{v??$0LSHrvL-opFcK1qLXk#ZXr_5@BdbOsv!v zn@%8i46M*opMlP#<8bXwL9CoUa?)8v@(K?H4VTA-%bngy9ns;eRyH5xwrdP(4a>*0 zw{g_fOfoO{5Td=_e~RY|X6R%rZ(0=GJ>2}_t${eT-7E*#sgEK+J3$GDS?zSSWr5A$ ze0_tAYv+@=W5N7F`6G7z%ah!Ps@^C$3>a6J;iP^?xpU-p)DJMfxj6o$41U!KuCxT6 z3y&Hc_$JE>0%XEuX@}^Rf*6OK$c*a&QjSllqK3H8MpQ$6IF_Ksiw~z9NRLa0wT8t1 z&0=^Dg)o$MX-Z1s`p|ulz8;r1-sCo9Fj-gxw9A)U%4tDG%yM?|M>8$5>b7vV;=5Mwk^sz>1`7FW_g$C`!xLN|6ckVG$H9H z$u(pwg>x44xu{i()vNSNU(J-cPvfC8Js6?lVE#e)&3N^Fs=3O?>HdD-A$#xCb7Nzu z(`825;BEqn>K0!$-!)9|ELYGt`B$g!vcVpxBD1c&kL>WoVGNb%a>Oz6ir`$BF!V@X zl}S@5q~rEZ2}@|wsB6D!j&iHyBy10IFv_<0x$RyQSFL zRBSIoKgi96355~;duF~DE0*O0PLfD~6Bu zWFB-nbN3}AO>Ba3wWMhMV&nS4m+3tjy9b(65!FiiZk*=WozEeqDS$dyZ8;hL2n{81 zG`_2|zX+!<6B;@Ia98&*R8t;j5+=|I0^!aa{NI z0-eT_Pd(Fmss3g!f$3hUOR)FA!bk|rGnwu+?fIj&*E0LqStZX%wA6({zF;jr z%J->_Y=nOSM8Zg1Qjo;+2@W~-{+EUj1P=F@2_NpM!V>TkUxv?02f&>KYCSqT!f#OJ7E-Y&n>;L;Q=Y) zF~j^}L>XKGz9FtwMABm)lbPq@d|UKb-h;SnvIPP|^Sxue*w%%t=QAIhLWMXdVBza) z(>DgUDE83}OC?FXhQfviiTDt73==W>iK%EzNa7jBWx^oNhKum6bR$3EwKlYFaW*Lp zO%x+EvuPX$f&(&m>LA?62CoPD*WZ!6V#Q~~z6zb=qu*cn6z%-MD~~9<7`zo~rl6Vp zf)@X7+uzB=LvD#T)CW}{E1bkfveUsgUj6Gp9xWU4?lPC5e5af1L8k0~>P4ok|Ja2L zQedW;=}e19jd1ra->xQ%(OkaH5wpE@LdP#*IArN{fpR5d+*8#V7zx#O?M>0T+2o$a zT>ej+_>_B_lg6~?(2LtVDbyJY+KIgHB=K?x-C5B3g2!p_G5S*02X#_FDCFR(nGfR7 zH)bSdZ1iZXHv09X?Ir0RcQ1vy>*0p#xzfR>_Nl}wM2_2g{Q7U`J7sRGchLF9-j2mM zknQKeP=t$aLveK!Hj7=&vbZ6ZTX^qOrYSl$a<x`6Vqldyh|L*^UT4LxA82EF z0qi9rJmApVQxSvdeIh2g2Ity#2!Ijj%1pQeXr*;b0?|YrXG;wccgd+pCuR#Jf+>5l zk+>}p5$6D&D1+dWA~5I~6khY}mV2@H`V?%zejOxW-B^v`Iv)=ZZjE}d22cPAS_qeE z64Neyt-Tun?;!8%R&A=My4$qnxvcg# zZyTV6dgcZ0O-!cu3ojfCzKk)P_qk!B{S!oXbeCHzVeF))74%c#;A(N$Gp)9DnXZFC z_~)sNFRM$X zBf`_aw0$G^a;`>vhC_>1nVLvy7DR=Gz_OM8wCkzB3$Gx2f-JqL#NHBjxfs3h8bKs z;*#K`^!c1c%+S6Foe8*3`86MTTaXIh7^?90X2ZlLh7JNZvB>e<&N_>?*$00y}O97}1MwRl7~*O5OWaVnUo$+pWP_5aZz1e+aU zQ8Rz${yVWr2lj6vQw6XdP*t)KWE> zp3l=3g-sI+`ZH}ImQ)IgOt~5%`3#B@1DN5oU#MhU**F}ZLMKEDyW%>xM`~R>FYI^l zI?=abdNuM9O>NtJCSyDRx0?~=^b9;hQ_h3yuf|n)13_oQ3@;1>k2oy+!95iG6k2mg z4Cc~R-rGQdq|ijo373BJEEb8$Qu8Qd*dJ40EOFJSYz zviw|>U3W=o-C@gLphp@Yb&8c92FhoLFQGPYp7GV6G%$bCLY{2=Wow*z4_dQpK_0zZ zIQqT6a<(Au+rp4b*P)Y0?;rO>me&{&wI9UJ!QTCRfqSaK{u%;Ei^$`uBz_TaeeZ*L4Zbg(!PQJ} z5Bz0boK&+Ie&&3y$RIw%a<(mIcUkf7U_hP22Yzi};_PC!>fe@yVX`!Kq;Q}+_vx6r zTecS(!DMQ`bsin>$Ov|q!+5_4c=q~tmx=?cZY5pfP3!wR(e+S}{sC%r+AnJ;j+36& zAH|si)`dT2pSIK~?U^;Z&{*iEG@}J=D!@Ivn5q;i(`4Dn_FqGN(T2SdyAV&%t}~-D zVCm`+d0Y4=Vh8Cy^{8gAvv{dxc~@U{Rwjz38|psRb}xDWaaQ zFD}13krywHII+TC$sx>e<(0cFgix8trJS<^()iT&{bPp69GaW1>S4piR&Bz-Ecimq!<)WRU0s|dV^&b|cZ4eN&DN6r>nw)v?!iR5gO?+Z{LvVZRLk8i-H zFu=cCP7Kr`mfI7w12MSwe%EDAV|k-!X;Ynx2!k?m7^qNCg67()-*|x#abVp%?6sA< zF;~gbAm)0*2cEAuldKCFxN0@4wKIH+(~xc(#uL+8B z*=>A!Bh!5$?^MYDL3G7Fgs)n3oc(OL44k{Zm91-jWBq?(ofKtl{DZJ*5~{{6n*ZVj z#(+QLjxLh>j?Zs7IX8!IcGyNKJ>23rK5Yt`k{d9g2iakJIbY)I3d-0$43lbUC+VSw z*6Gp;C{ z4Z<}H7mdT;GX5j@oN`r(F}4D`Ya1ZPIHdNLIVfI3?m6>*Dt?0~O%nJ#mS)zQz7g zx+!J!J^G$ku=>cb#5<|i9?@kHNXZ%BLv0j+?%BNT@!_%kqie;;M16P*@4AfL0xHd>m$=UyxC&WbN8y~%^VI5$7Cb$mByl;$Wd5-VnGpQNOf znzd1~{RnNy2zVa9{Yb4zXoxxA?*Ba67)7a^-W!1y@!kLf10LU|pW;k}(L1J-ft{1x z0U*&b8K9*>$APeobI^q0|8M!*6amzZ1Mu^E+dG5!uygbF?9TisjPVa=tlTf3wAZdE zVl4`X`)(0URZ^dE$W>Nu0o%gqI7F0Fo8%LtaR8e04d`x8`9$<66aFR~h$*4L@|-9g z9+!vEUw&iSBl!ej>dZ94pM^AS9~b!dmb}Npn#zbc-r*_c!gY#}7SS?_Ke1^g7J}RQ zxBLEI4%w*)OPHEp)a_Z-=-VGSnWE(A#qdT2a#JO;i1cg>#}K2~{7EXSs~v1+c=%Dv zqWNz0BI!Kp$~W`eJH@2h59x0Ak80~Z(roi1xK$2RM=-4mc(zaur3ap}9Yi3hSUkz% zq_>*|7-QSewsCyA&jJP6Y-NJju10HS$e5Ec+YSn3lSRum=szUym>&$?+}R#~dAM|( zZ!BztbWipK96XO!se;IR*(r%CH>S)&c~gx}h`W#Z|5)_F81u=P>jaYoeJ?~&zr6uGA$W&S#hJdL*ufmDcvPeuyS9LqJzH4$f_4CZ6AHxSmFmAwIrNd3E6yyh2x= zVE*aOdZo{bzOT zm+po+>s95WOqvlzlzKX=$g23=um3om**f`!h5vOrvvEB+4ZqILs{MMB3vYMG$%Vjy=cAxd&fp|DLMjXfh3 zM*M*)oJz2QQ$*#I$_!b6{f&HpssoktXI9Q0QW$)s5kxc=Db<8!yALxUk8^Y4Vj|h> zTJ)GKV>&=DNf6T)UWGeyS`vioORY7_GbGm-F42-^19PsR#}~#MOnxskxA}1J+!K znFRWr@4u2b&MoNojrAixTLc9?{J=3t>Up{1+I1-J8DS%78v#+_H^CT!vawtq-(7d9ASLoztZ2x2{xv2}QQMKO=JV}!f>ewgwrd0(E z2*UD1@F*B>;IvsGKCRFWw(HWQ!-v^=(i6r7onx|&d^CZ}ZeQ_};N0RjE14*_#PjFD z`6?_&YL@J7JGK>ygzMTFbbGk4>(2Yw ztnrH1{OiKMkv+n~t4qNmAzv0XId-l00s-|WEuw%;>=mw=lPCGc-J@`7$2}$OG|8=v zPV3ivx1KU$9?QL*z(d^C0Gp)K|4rg4iz2EWIWl}qU z3_>IVOeflwI88gDV6Y`ZN1a)=CW!jXBUS^-@>mr^n4ve;D$~Bl$VPb(!%JjDE1Y?r zXHtKfc`Cmn*QUdIM#FMsPVV`ez`?q#8~NEtRb1@A#(8*86XNoHmIO2ihoi+33CG@| zx+&@}dg|DkBOW)(xMyXf-{#5IJ<_-PeI^m|4V`7#rBN|d;cDQXcYVmQ1LL$P5y#!p zUBxfCR>eE{@$LPT?^$1Pv$^W2g+Ldal7+Eed<(fM17qdSfgv#Fb!u_>ax!DGAR59! zz9F%`51wIjyNjKxb|cQP@}4EYEDzMqQ)D<=>Q9R+wWqesn6 zo>);E)^Wdld;Zz}N;4&QXSFAoe)lU0yyH$elk3Zrq&e2Fw~y=d&jehoGDM?6e%__F z64&(obceV5FgRG(cJ05?wVv#rSTHuw5H*dOp)mX%5(l2|I`tQ*xO56xSoL(jZW6B) z6bOqG*`X=~DB~(CI5+B(`l$7M11L}v=rv}Xbg<;FcfkvE8mUL)28AE@8%8l(Y@-=4 z3UTw&s}LJG0mgf{mZ-2d?Ep-wYoCViu{sh+b)0L~7rihV1SGr4MxFASHf|{x81s^TAG8wU+9xu zMg?xmoIq5S{~%L1wNPW7 zY}8Mo2%)aqXd|?fTNOVXRF{*VBv#~i)K1t#4nFC$huK)~@C8ur(I_T%e%?d+yi0k?Or@ajv^BtU8H4Cwocq8O zv*qd_w{c1KTr~nlN?`-JhVos76A-~cqdDmv+FQTM;bbMzKAt1Cwb9le#QbQShTT?+ z)jPwj5jYBv%kZ$B52xHVWnzReu8f23PWjihumawVM)RRA5qNoCQ^L)pVj$cP)cJ-U zXCHQJqvcOnVGfP<^iCSJW!PcEB{nJf?Yup`-q*L^zZm`l)*A}p*Nbv~<&p^kAyN20 zAvKr&h?<~a#WDGbS+z~Y=iSjBuc}mp9{qJea%$}`>v`w`I3~c~Yd;nYLN5`Oj^A+i zyS+ajoqmkxT3=(_!LqrkK``#u+RRJ5iD|55`w?qxRju9$>tin^c+cl|-T!Gm3T&O6 zE^Qd`QYo@o>{BsO{Fu_f@o|;MWW=H)?Th3K)ZrQ~0c9%liu8tW6fSJBgmObyoGtTf zlSqaOhhiTM2{<08q(hJW`&t+GL1ssG!}z7wX)MDrs7hnQ!Wb5UO@B4D1v=hHLbzP4 zpANTAA6YFfdpf zbhk+ldRYub&^6$waK4Skabtt@NrJ3=1+B8o9#^8?+_{M|2U+O6W#w%L&BLcEow?Pb zn3L^QZ^oUwYmW`}euU|J*dkLklT9;LT3@6LB|!bX91Q6I&-0HxFdZ#CB{$9IL5Ui5nI541qi7^= zs6bmdp5FV(%%^&CyHV$lRd#KhF1!SHMgoQ%&|Smo=Mz6kaE#a!*}yurgMkdjl!9*O z(L`Kn%jcj^`!U5hM+H`J0{S_Ap{b!?1^rRbBm9e@OdMI8pczu5#?{s>*`=5euieit zdZltf$lr}$)en~QSv`K==3S^xGw8WQr&g0C!sVph!B zM-vlkF(l^Kd+Pgx=>2~HFY|1PP~Rhl6`_5SQKK?k1-mJ!NGrxfOJFjGx)p|w0BJK# zl{Ao`S2-dQ`Vy(I>7l8GdEe5aj|=n%GVPDdI&Dvdem;?nY;;7`pW1&v{7NMD&nyx{ zw9hN|4~;j5Lf;Q+|ClDQ=tq0k+?0=pmD{#qG5ic8RlynA$8Uwk#clb35zFDPhw7M1 zloXb3`;gDB6J(K&e;ZOxX{tDes8_8JA>ZNHt`n~m&?8_2q}!f6f)HjKoBoXq_Hivg zk~Wgsndo9`AOPA-uralvs$tr2&V^Wr!}TV|l0a1jPGO~ugpr);-r(;lmaA09RLz*6 zZ+&Spq)UDiRw*@kloxD6Qh0cvXamzY)f6AU`{D}V9}W4R4&u2lv##A6ycvRl$KayKBJu)hQqNKp4eVDq%(^ah1~aLcZo#w? zecl9SE#1xe>+d8mX>D-8zZ|}) z3%#o^^2JM%%w92sTcGes;$E>RYU;(=@but4D^E`DW1kM(^M<$I4-2|nKFl5s8o8=| zV<;w&9IedriIuj$6}ugT9}`UwK#ik>A)Hc1>+k$u7-J}J(+)H0-yiNoJ$_lUe;m*y zv}eD)0ONR`gM0~Dy57K?Ac60{~a)MFlmxoJ0r-j!#6-whI~bX4kq^Ej1*gQ|B#o8xcpUjSuv zFX+k<oW!?U*`LnYKGV65~~_~O$MfwTjL|4 z+b+%(L?Qq@-_^fue`CVPBeykgRF|^4RtYfRHI3l}SJ&J&nMq|+IF#(51MCF_WFkOa z$_M9tBWOAufK6a?SSW*$K}yA!vSb(%GD=jY{EUc|Mp60s*y%zHz6pug9LwQ+l! zq&=w$N<}lf(e{(=wlItFSEu{Qn+)Ek7ANmMpOSknKQPBlX8!7mZ`iZ%b)5F|8L)TM z-owxlh0-h=KY@P)X1^(M?uGJj3C(QnW{NN8U;XX4PWY(6x?EO_=6vKTPdcsm+a5$Nq|5hubwnZG z8me$ZM4(En(ph1siXnY9a#gUJjRq>QBB{4RfaOM$^}D< zbb z6yG5NjY5r%_sq$!iyxmI_9z>+wvxn%DCCc{x_Z4Gz zBU)3x`|1G?3wQ2<^_VI<(^r?vC)G9xs%;>{wjm_w`FjrQiMOldHfF5ZAe_g_yG%5e z6|umsTNLyJ--cZ&1nhJt(Nnnm%++jOT?ibFH~rEi(lupXsxZKT6!r3Q&C&XmtgTg) z$91~;c$V=*ZF;BqQ7!K2Judsd9YKHJ-qJ51^PxnNA1`ZT15X5L=h`mDD;#Z3Ahn$D zIB>2W9f14LRVc}+9Cnu1gH;t-_vpj|iS10(0OID4pMbNO;vyKL2mP!ku?oS`Gs1R( zD4{j`KSnBujLNreaAKys%b%N>=|~h%ZlBaZ_x=`>cmw%J@a-*th!LX>3s*{G^tzh1 z#O-ZMDlB)&162d-_A0z28}4T4bUEHgbhG~SbHq>^+;Eww9^A=WT}itu+%RwiP%`yq zIG+CwA`T1kOs$L_bs-hr1ayMxd%Ulkup2YIfkEytKUlI`JBF>r6P#!ysV$sNwVsGU;7jl?7E)?+G48ocMfZWZfKv-!=!Y5j$O%o6KNhy{nJlmS?a$_xdbXLL1C{VO=qC3glwjfPsHJf^pf4FyhRwmR5Uv12BTlXE@VX<;`mli8Z znPKwIY1doeE-YvvHa;$Feh@p}X1dh=iv#IR{?;3j!8{@u!d%}YZf6kIZVUQ|oV zzfPk+OShHKzuu&Aw;_LXydm+IeY5-i4UT7bs}{%vnx&0_1}}WO8}~o({P;SAIrW3I zo|}h@9%XWB6Y(JObQ)cCmnsu=Hg~Wn2Lm-PRL}lOaryCN5fDL^_t76nrX*8~EtyhW zu<>X{9u!FRIs1x4cJA(8UZ>c`A{+iinUC@(`#Y?zL+1MN%}<*NIT@Q){yV@GHYxvt zvm6{j>R2totee))DV-<#&L6r}K1~!g4&zc(!NrzW-AFU5x(>mGIgSIW%~uWzGkk~{l1UY93zOiW?X*)Sl z@S6?M_1w?$ZLMhrU!0q8s>>G6(2Z6AMz*rugi-put$mZek|GUtwxXL3%SchTlFigh zXcd1)&})nD+;2tz7f+O6EEbYO>uMZS6mE=7B(Ktnr zdEjSnW2c~7Jj_OMJaw7U_A?j^%r8-{NEbU) z=U#m*GFNdO@avS?57`@H*$-!xq%C($3}r zjgG^g{JT!EGC9R)qxHbTkV8=axPLpwfz=ZQT1g4jO;lT#9i9E^l!3E1g>itzK~G2v zw{AgZzPQZ9F6d!fWB!^ph3$Yh%klg`!GBHqgsJ(I6Ir+q#bF=%yH_@#QN8MRG4ZK4 zT?~}Ilk}bMo}PHtiP+7f-)2&2?UiYthu+-^*hb9@F4QmpkjdF1@|W=k+T;(XhJTofOvwK6xn6s2?Po6obq$ z3=tkV#bJdM*c3@`CeSDlg0|Am0-$xij&0iecjqZ|>7858y8G<>pNApw$<=rNSN8{C z145umc!rUZD&8ulX0@}#$4jdwWG2M-i2^qE&CaV{;rG11&;dFb;ArMb0~m6cQ45Q7$9mxu ze~b=J5Sl$jfO9%9O5kHXO8FR7r?`0E{f!9@B}?J0;Ij3QJ;Aw>|N13e-^3>Qwuu7p z;~Ze;N4P0tsQXs~>+7(Rzp`hkguQEt+GQFUiDD;w(~kyKH>sua#E!h*R@}F^0`pc^ zSxVK4EXc5)Qb>glORDe-|7S`7&*l1^RwGLBNsG`y6SoRwYJK3Nzgw0xf>#_L zCo8j;AxF5kaOV0)qCcJ(fU*W=qKr}O8DOwW(?!`}o7&>1qpFXiLd#;8!poCAUVv0# zU12lISZl&342=zPu^(bvRR4ovsKK9W<`*( zZrVUlw20lv8~a|I$Bi82ma$#l6Ld1+#;G#3y0Z6s;m*sd{CNJx01 zaZRk!S|V$s7ETZxYBN&a@RnGO`UWDzwHF0F*&06O$8WLKr_+IB%nN$68G2&GFj#Ie zc(;qE%Eo_;4&2-A9>bIXQ>V{xN4*499YvE?Pv0H1pjs-XJ$-YkO_=gIa~y;Cj~+P6 z@>{u*EET)^GT;WQ^+*yi@h9`WK**tpuHCMeLp zfHIk=i8x}09Ug1Mp~~0(Crq>R!<-olwHE_B72yC);z)S0#@Vmfj>58MEA`D!_b^$h8vaw&TE;c z%~M?YM={)D$?QQ<>#vgnqek;pB6+g6XmAozTp!mJpn>mSxfZ49pfNLwxbP5foM zd?87Uuu0K*pG$To#vGrYZ06IftNNeZfUsTfmK-xc$r(oBkBS2)Mi|(`8Q>nGr_v?y zB|~>-QU-MORon00Q}6)p8%YrdW`I?j+*)a>EC}(-L}o+DjnEw^+x-%J7(h~$-!ML- zJ%r7k=Eu!zT7ll`i#~>a^H&2|t4Em*z;cvtZU{`kV~gE)t15}B%gp}5|1d4Te#)a- z9n=IMwCV~0eVd6WR$ETm2ujK2b9*4P#ap7B#p1CJQ7iaHPvkcEwZjuVzz{Kl1hoK7 zPtqlrk<5LE1HFg6!SR>Vg3Lm?5ZY9#s!@|-@gb6}Xz{Zkz;8uFA`8Pawv(E!g$BII z=X;a7O=3Yz{O}yqZt;)`j11t~KyI#I+YFBG_w;d9=bPe&1EkXjEj7Z>9E^pL}(52Id z6=sN-NGUC2)Vqz66j4vzo*MVHL?qn_b)S=TpEK#4AZ&!Ng|%2-noM|CnEL|Tom}JS zRqU32&&lJny*KNchXuVKnCygz))&yxZQOnmmf&%{-pinT$GySXOLN|w<}MQ{1{9yu zLtp1ODn9-3bi~uGPrQE3bftz~TSW|ZnVD(NE~33VIJs2pUYPr0{651aR($?~L+BhU z`~o9us2B65_9LOm*m=Cm<*a?sxgQs=he;QP@Wy4leQ4i&%0RbZ7~HLwp)t9q&W{>! zhXiw*%NyAPsSQ_eEKm9l=-j2t*YU7Nu!g8>TBl;n&aKKLG36kQU>ek!zgL5DV8}$X)`uS?)R+|UMaDFO@9kgr0x9BpE*C>PFl?Ye?KcD7^8uZX07f% zay2+q@HEJv6kwnAs=m$N;mYAg=F9yKT%TaQ!|eSu4khJmP4?oPaRv|5S1a4opL%B5mG_m`fRJ;$diBJ-u~8?dfu9Z z><+j??gyI8t}ny5M7@xNdW^LJJQL&dE(ms?t4ku}I7(t`ZE;k-z6>@Nm3HJD2Evh4 zk^+%@FL-rm*vCpIn#gI2Dy0j zS3nhzrMTQv{H7joxAqniLbErOfzEQ1R(ZkMJm?>t=JgN)J4aN?>JSex=LCI}m4MKE zRcR6$G&NsdykxdS!^IGG*=NP3J&mjKhPVRfuIvPrMt-yqmOW(X6Ko{@^7%fDi)1yF%!#PcXx?09gDoZa;{ijs93y=6`y%70{oPx)N{SjsW1f6IDjqi2lr}8%lrKby5j!C4*p3Cf#|Zx(`D)K6U&qwwKzi*l}xj zUflPvesHTLU9*LN34E;|_!DfWDjxhc@pgYaZa|T|`VM-s%RGEiE6cX;WxuvxST!4( z2vBGqP89@#XT~Bp5!J@of|r@y6c{axhr;iD@LOCnE`%%GeKClv=PXe*pHd$*hsbxn zVNEy9F!HwQ#2gvYYQBc|XV*cGzE+KX#8OL-_vtwAYh6?ApQ})IK23MIqn?dWvqmhk=`Gf z_uL^okHDQwroUW=rvVDsa5mlPKg3B$Av(6*37eE?F1pPlp#|h=I|cLe6x z>bFuGex&t`{(gsu0pOQPqPA!B}lL$Il1o9RCJsL=K>o2*c)NQuO@2u z2;IE6Mb^1NG4n$__#EsJHq6bVr2SD5i@Hbgib@nhB(H%GSOV&Ptu{vAffSk}?UsYS z3ODzd9ruXyf>eU&#a{t`T&FNY32<;SRN#Qq*W~9v`EO8go>q;1*6Vn|x9j4J;&Rh5 z!xjXWY&E!XfK+9tV)D!$fgvcyR<0YT*``Mry#hT_NORS23p1!eojF6T65qKcmH#NG zi!91z#k=!n)fxT~@Q{egJ5P~fr(UCz^FoTDjTMip(&J$FHJCk=e+{xv3kyeLART%? z81Eh`ul<<)x?42So<_6tFbj(}5e{b)L4<};YZ-?VOt**GW(kv<*JHp6vNJg@vT(Wv z!K~;*dYYrAHIwEm9bA$2%Z}QG`ad2j$?}aLssU4Zb}LlfpjDO?UitM!@Ucx)#QCu> zF!u!goNDJT-fZ0%+E}PRbeEl!Z6AYq?UmW~tH%}A%*G0;(k5$V3l;uq=j0BV9CsaE z0Tb-gJ)RBvJvif^=dus>r!zDQp71>$-TMg=imQ#9vB%eB?DL564SrX3mC5PyI6vqH zRJc`M*zOC0-<74iR-&UuU-_mKQpqJy4P1`I)?au)vcsi@oifbQxWAfHJtv+;I&=a^rY_1EchRVYc@d9tyU zt<7&gutuq!#twt3{?$#>PAuHp5?A^5!1G*ve3bTW%S@(Sb> zf7!tor%gSruN-B)I_T6eUZPiL;$Moa?=$8RY=_r0T))FO79DEn_eX;et zEe0ni`#sZco^kWs-f~X*o4*fpbu1vlhsup6X9xqif^T!-W4hxUJ|W3XuX!{mTVimi zN#F@r$q8jrChvov|B5Vo=?JuUDo>w$r)``J?kFqDF4c|#6b@HJ2&E?DyHMzX{0!NS zrWJM=dDNMiO89ok;2ato_08Y-u0X#gOp$NO!tHa6DMm6#QdAg{g~1;XSD?jKXuGMz zF_##AY*j6F9Qo?6f31Rrx}y;j-j#ozARR;u@qiy8roovP{Hics%N?e(bUFWC1fMnh z+NmcM;glS2Vu$xH6mo`%Cp^htOPkoOKSe-guVU}Z8%77h3Oqv`JDL}6z2N827_#~K{-_fUzNFj{UmzLufk2fNxXD0 zX(0P~{0IzYH8>?VX_fSD|(mqg72ek0ZaOYwR#{%CrPG}Gq`Q-LM@gW z5?H*!Gh&ZP?L^RA>3oFzl>r2_jlZzSGZ$ATp6OYLEUcM#ESiJ0on^5zER0$+T`N5>EJ+6M?yfkV+KOI_Fz9OAl*7x*!=LqzKp`EWal z)Fu@z6mzj3JApM8kJ-h*Zt$$MoZ_SF+tAs|x0-DBy6H*WYBZATeXIR0uJ}~ZZ^*Bw zNlj$~7&BW|>?kOQ=y+aYTz)`a*T}swuuOcuxkpy+N$Bo5)}EnBUd;ZKEe_UuO}}#g zc0Jy)vHs)b0e+3wb9d8MWpi?q{M3&d$Bt=$`f|OssaU0TEx<7z<4R3N%dU83??z|V z(ARBjgxtIV=L^9p1kTb|Es}Dd5E_R&=X%PJRtFc9f2!#9f^L@PtOE;N`{wsg_=#@b zD{H9gA!AxUpU0ELm%#kfWUqBpN7jDRiS9YpxKlIj^T1MMbdyW024s~q<8t%{TaX%X z%Z%0~wwx(7F*;M!DI6n5Hn>8ZbJE*WM^8_d*ZNohyP`&+_q#PrTHXWK0G@;GqiV6i z7-M`cJmoQDl>0i(!ya*#?s=6eK3xJ14WOQ&qPOu?@;`}NNo!^7`Px%x-9Is7{m9=Pu; zp@46~fcC1aN@AFe_QF{ zpHRkMWS@t5tx! zXzGb}V|OWS!1;q0aBFtISYF445rfCag1rqA?sB!E<9U%_yN)lzuiZi7uv_-8pG4>Na|*rK z^dZA7XjO&&g{#NFNrv5=pYXI#tF5cRcDd9ykF_IQqp&fB}4+ zl@J#5szU7CydT*&-|Om-{uKAx+7-XB8RQbQ6+8;rG z8$3XY)4SKBZ#2O(0Q_cz6vQn6nq1p(`=&8K*+Z9b6k1Gcur^4E zpQaSwqg@bA>_=18%nhfOWU>(#lPe(HZ#^O6m>`bRxl~LOCnGB)sSuBhYPB)APx8vr z*Sl$mFD#Y(`mN_BLyg!g^VMl3+sR&RLCROtHXGuCr@;<+`W^Y@v6@D@#_nX!UQ>tv+7O_D>~ zY03TO$mx2Pq4xbY7{JH7OxVoz*zr*GzTBm0>I4KM4kOG9X=%g`Z!#DJ+N(}AlcjQE zC^L78TmAeeJt%};-0Y9e8m#`YTNf=SG=WvzN7IKtl$)Renn3ZY)CI#*l@-5Q<`{YD&)lYOG#W+l>>Hd^7=mkiL!W)>z%b$V(DmA9cUaqfYv|MYwR3HoL+Yi% z=+1cfr$o#z9~KfFIx|#NHof;PyO+=HyAP@qe~X_7qTQoLq1Nyho!1Y|V%xmbUtzp& z=(DG&mMphf@Mk|4|6?U|!L7$lUFjsa&N5o1*BjU73Ljfp@W6VMcqFAe^UK0*i_*Gp zQa!(Jcg~9@ch04&nBZj2W9Dqg*dR>~ShDZu!Jg}NRJ~GvV*0(Af^~fDk0~$ zW80sdS>nrj(uU?q4=h94o&2ifbq3b0$J_JJY%kHmmr+mFKe=Q?l<<5emzcBH7-X7$0LC9$jfKXD&%CPSF}tL^fsh-4AvAb)Xw zkzFJ{^y5l;jan|9@QD71%`8~sKl3bVo03%i|Ic$yNiNKTuAgJM^fJ_cD79~vUUp6_ z&3ENYME0s84Egj*{KaJX`AR&|{^cf{qw0w^Y<}z?GX6H3E;}Lcymefc^(*gw#;DAT za`Xp}_H1|q^rMhNxR1L9-DPIzZ1{_pQ71A6P$cnjLDWgn1NMJCqxS#mULyyYOZ!EC zj4rzS1~oc#kufULY7PWvU0eR}7a2Y>5IDl~N38c8CKH-~G?Z-=z@o~Ud}dq;anVNeA+;m@q^BrU+Rz7A}2_WJq-h+KYBRglyt`7DjoBtOP&z$FS%^N;IDH z7HhReai}eMLWU)9>WH+Rc~x26fQ%vu9~({^pm(z*NAz#jbldy5Hjt!rk9qjh;_f+( zGMTC2NMlI^$B3phXiuuG=AsEOb6jX)h5 zK2=O_2De@(h|)yf-Wz(3V|MxMr42Z6Ynrl5-&H6uX}b=S<1ydi9~+YjMJ<0W^#F``~fBpf2T-OPrlPe-eI)NLzyMe z{{8UL`=klYKQoyUTHS6L+oDRdnR-KiwD~mX zBA-ZKJB5G~(%6m!e1qDeI!XWVN!m|7tzLD$a#n8JL;h;Id+0&9u+PQ7ir}8KP=e8e z@upf&U~i(RgT+@Lzr?DU%zej=Gr~jfj*8098dq1XWSu8|>(A+f{MlwCD(Cjg=dHEZ zUAAz$dq@O>enY4C5fgYWu@mC@k+HW+$-yc5@oWYr*1dhOoBR+;Z4> z7wZnT1u6q`&GE!}2RA{Yel32=)%f}Cce5s6O2YrdiFT~2l2-mVgfs#<9&u@IfjMim z30~ue)!&sl4*i~6sZwsZ>$h7kPqX;jp_Z6o8_sMx~gFgp&HIlbxiC41!FwiLGPY*S+eGZ^5C6M z&74{p3ASg3#+@ zqDIx&#vF9pQt_kKn`fj4QdioFG3jIfNwe-+lFl*}V{0@o8$g`~@%X9~vkn8eDin6C zUc@$7fTR8Xu9i*6Ht#rinFA4(5)7uR3Qqi!xVj~L(ST?L1x-42qa9&k9?__AhF3%{ zduHTWSxQ3sOwERpPI41ECI zF*jeTP>Ne##qqh@sf&v0_<$Mp-_f&z(PqUBLvxqa0d^%*2;PD{L;*>8b8Y$-$ zx++)XcNGnWv-}P+;`yUZow;Kh1Ni6M61vxHR}%S_#*`n&M!>(r1d9G?{C_l^WkZx* zxVC5L98i!>LAtwBN=iVaySt=g5Rh(=?v(EC?(XjHu3>n2_Ph5#xWC-jTI;yZm}MXE zGxY-Kr-rjm!VIqZk9PrT&?nnAH|v`&`rJsf9#$Nmz0~``z*(IQ)2rPN`$R&_sfrme z5Fy&!b<<>w$!U%~FPR>`U*4Sx00^m+vhrtX!g-b(8MKfS-(372?B zSh1{gDK49YUa9fe@E;Fn&hpg>8X$uqPx_6*Gutvn@$0Qo_Xpvk0g9unDAT%t*2}yJ zg^!HqrW-km+4=G%a1~yH9Mr}uLnW1ALkdWq8`f;}-kg={Wa^@EuWE01Z$EGd6-U62 zdT)u>ieRY95s8ssaFX~n3#n|<)P~t@#NrSPz?gQSt-_Ubdm@op+4LZTbGzC#cJKSgwBL3FTxn`qPl zZI#>DYmImG@M5Q;Ml|_jU|89yJuy=;((zgW9k@2E57cJu{MCaj9}v*_FnGaB?Y}q* zS?n83q%e6g0ktcLpWIyi7gi;_UT;Nf_x}kp;*Lltmnx66Xtkfdnb;2e6}`+DHh_GU zXKO6Jj$q6wt_&t}Qyzn?6g+GIvjYoKdMOupDFic2yj@0_oITM-nMVbD9_w6fQPY%^?K?=m-oCHgSLauy4$X^Xd0yH%mLTZmVFk?eH= zY6vFjmvQeQez@RAMH6pgOf&SdwmPXrBzQ{{`%pQG4Y>5yAT+4DkEPNN1%3%kf^zNGVZ0h`_-#KgCqp z>+soG;lKX=ZoAU?kYvqcFo;C^h#=JRLvI9q7%tJVIy<_k!dW3g)S@R$&v&!;1YmmD zUHbcralX97Dnr%JM)%N1TxfKr$--fvg!V}BgX{vDoF#gNS9l3!fZo0mE-f300H;H5 z$j4hMpZOVpcM;A4RpO?^J+o296b;Q+>Y}E!yRg9hL3K*b)oQaH=dJA*)3h38ST7xO zM_9XtV;A*KX2I7m)|y?O3;qt?~LL`%V4ES7y6o zdcxAMJ`?oPKbW+4NMiICH6WNCR!M-s!2JT*&&h_PAdt2ahHpbV*LQa+FoyMeM;p>_ zipm9nS?g{}E3Y4>*12hIkL{!2M<;xPT-U0rf7V`iEz=ub-x0J{{xAYe{B(XwvOR_d zQn`2>gnM3(HX~kSsST5(5$p*zXqV}kuV^X;2kXroHtb|f)GEN zShCOmFvY>8pDF3^$UkBN;N`!Q1%H{pX!rJk$h}C-skjR(^;aV2pP%XQ!c1w6`_<9))8CT4aNnzhXj}_~N7tjk=i5@JP~BWc=OnB107OYKmd89#0_mw3J1rw4G0*cpf{YTozyCOE?B zSHcV#|4I6>kvX~9t zgBr$*#iH*7i6T=u^J9ZKrqD#@3PJHLfR89IB<$o=v0~j*nSN`6)JW>7mFS!!G}ckUE!)_e`!->QjF|BSFEiitb~I|3tl=P z6-OhPkb~Kdn~_@dO2T`CFPP%5Tz>X}KZ^YIH^OCt7O%F274_K!!^$XKl9S<9@^QFn& zm$XzyKhpxT9T0tY$wogvV!Qzuh9;03ACeV%*#AhT-Qc@tt4Id1rzWy+a zn#G~Khl7GHErQJ1nc}Ch%T96^g6d$-LCVFYVsmp=>wUsQOiEJ7>04rI^fj^+DsC&j zp5w?*04ve;P&$T)9)CbK{cfo(#82r0a^d6n%W>1n(j(4IZGKbq{WQtgc=(&V8Ltxo ztMo6pnFwbz#BI_lt*K=DQw5y|h$-V{&>?OG(tB~MPQ7KSvHW!dStR4JVK?cg?m^3{ zVgHl~*(l4gc$>G%sMHLek;o|EjL3V23LotYsN|Dnyd`yod<)MaX?A)!5hoC4K%!-2 z)Q?+HC3B;V0kPnQ7**c-AN=ROK*FDTZWiQGyX^m=tO3 zKn(N=0#YTI8`U<2%>v=gU$b;EL&9_1sXM5dP(I|Pl0&eJd8jlCvc<++qV7k-NIxic zzH@Tz1bEJ>7Ax>nX9wrjWU2URMNTrWoa^*ex+2hndnda7KB7T+=Xh*ZeM6yUyuf%$ zm#LKoYm$MuR&h*%e%Rr~HmsFGBs!)#{G&^sd#zk@d6|&B`EEOmFujZqObK2>mQVc$ zpWcS&rM>%W-UZ>HMVBr!LiS~KXwyr!M4N#l5y13?j`0?Ea4KLT9IB;;D*st-$xYRX zAcb)S9$vPhNA|^w^Z88HOC`_yt5z?+SkhK~(;cA%Z>?p1wlO}?4e_x8?V4z_9A<04 zGC^~HdG`Xzqnz1q{k zRNMruNOs%O6q#9^dg!d$9V5-xBsxrOXSOFD!TiF`=WhxV!jIVqJG>e{tOYn>-ElKj z#A^U6>CCK&XSZs@MImMW1d#^d?@VIn1jv!$l!p*S% z&cW;^BvPF=vsztI*%gwi0-4RaFeYgJ{%&_=c_d&tG8OncuW18V*_rKlv+%e*nozzt zMz=QbMoa`nedBUlu1g$cd2CVf@HvQo&m-4o1&VZ56mm)a&0LNu}vhcJwyf z#*e|Dl&I8me?|1g$zs9r2W@TE!W-nIbGLf)HF|s z3|-=50T*4l9K7rBoBR6gLb*_-6m+)*7gr+#i5hx72^2JJjSp#o82~g!@qa8Yh!rB) zR=n(_FmFDfdmw zL8zl7C8ECTr%vd*GDq;-c{IM59B;f*&XsE`j?p(LC%RS)8QAEo_h{50ZXB5n+DUsr zf$oGwYv=FI){!3!Bul~Z6y3JM`ih&X!Ykw*!u7>5n@EZO^lFK93;A}Ko1~3N0*AzJ zSaC>0P!&}Cs)u2sUft$vzpU2I<}M1ULcdU7BlEGPPnRgA$Do3D&7YIettcdUr}#8Z zgHumT>D44KCp=^Os53@4u5}YAgx3@38nk0gOcR?TT;=hTI}U$^YPdkKhl z^CWyGZqb7n*TGr_1e*TogcH-@=M?kU+cmm|Gi+i`@72$9PNu)D-zd)xrog(3VewYW ziK1^|)0b@1dKprz?fwCML^v1T9YIXTSk(R0k*sd^2EV%TdanK);Andvyxyj7ytRa5 zX)@5XcuuAN0rb!z36LA-H4H=aJt8uD`e4wtnz#dD>3ts}EQVDjeiErW==c3z7z9cp zcGE2J+F$N`@4fPOed@8#yLPS~H}?Zdp;cgM?}7*^Kas2f)Y+K;`iA{IDl8*_o2 z<>6OK;tN6Poe7_eW2@97*akhjwXf{eVfATo?v0c=y&(&uZ+Gs zsQ;RVp@;ZmK>}fZ39sCDU(?mB0Q{q|(NhL-05f#6<_K-@2@ACNIVp$Ag5(s4hHT1e zPgG+9eLQnD&-0&c?Z~XeL1_%OQ99-qzfneS4X^xhCI_`#p#6X!z8iR5`XG1q18QUP zI~74Qd%6K>oX~TMu|D0QBLg&Se1Z?x4~Gj~v9*20h)~|y(HCq76y-U;7~hWqudpw0 z*>pJ|c(WyfWgi2{a!h^}IW9Z3E2f&G9$NmDhY5%hANERwVF&L@NetDF;9<(6PxtDRy#`}u-R*}aCe+AfD{O2qQ|S@+Q=7;Z$0TFt2T zPIc`(r-(GB45fskdL*t5{@mJXBX06LH{;p9XQ63H>zs2;$h~!R|A5!CZ`)!U3HZr@ zuUF_I+#kff{^X)fxWcVW?D;Ok4SGO6v#NDXZ{cJy`EX6$b(`FMeGiWX0{_@q1hx~r zFfP-{@qEWR!Y>jeykjHp)f?6zzY!JEzEldsGc6j@Djef{`f$lRvx z`WF!i(R~t>(3c6XQ@>B?W83h!qO>km@tnwFB0F7sq-}O}`COKIlnK2ORs=tR-&%e> z>?n#O=zKpdD>G=o)tb03p$tCvAMUJfx)C~7D-S&EV$Tmq9Vp7keE5iBa6n1dp;ahR zRrXpI%q7g&EqgiQ=qf3B+0|Dnk-<11!2CLrB|ID$Inw-DDpCHecqVk-_sB$s%?S117}y9_koyH^k^{E4&x$u z3c+NvP@enD2efsiRG4bHu%R&HzgAm^5j}5qg1fSP;>Tf(ljaKZ9i0dEb6#1l_GhH$ z&PYJ|KyNCt=Avny&D6T?*cWi?+djVuPqAvTGM<$zrm59mnIKWWpP<1zT;~{9lK8(S zXlLl1KkJAF@;=S>8B=e?12ft2l2-(;BjvtzQ7>rgGG*o^@2qe7a?rBpQTp=9VXUcrV4wEzA?&)xE-~T|x2X`Lb5{_pgcN2P-r0U<#Q{PjRmaKFDZd!Zv6cP~j$Tj>;r1F3Bv>LT|CoGyz4OnqnTT;0uB z$k`A^O)@=w`_O$m_(W`p$z0vsIzKf7dkT85*sn-@UHI_xdi-CsUw}y{Faxolyran) z^e?fq8YSSh02a$`)s1J8);He4YW)_$4u9L@xZfuzG=-EWx`+^T6*Q7TydU3V zDI33MwW^n&eO1485Lm|Oj`i)#muUY?j$iv%U;fAU0k1pPPH3;tn8&xE4X)o!DWZL5 z>$Q-qirXc>bu4lrZQb7^7wa?li5r;WI2SQVo9P#=@;qWBO^2MG z*R7Qtr&XqA<;w7$TP1(-4(IV$;*+G0>Xl@&TGNj>_{8qb(} z!qIlzFR$It9n%jzSF2%jo1;)xzF*6U8$ZEAv+H$LQV?BDGgqN!EpGkN>-z>Fxs8{u zi(VeBGF?}bx)nwj98gcZ+HFODGXl3mK`Tuf0#nvh8G>h1IH?Z0HJoHgAop zzdAUAGW#SgTd7U&?`xse^Bv)_$ei`7YhVZgrG5Yi6Y+Yth?zD;{D?PAg!WSi#za%^ z3E>T$vw2aK3nWc!KZvGZcMZ4!J*4aOiHAZ~ihUEvyZovg?6IJ>DEuO_9?kB8^1#Gr z^PeP9QLJGC`e}l?JpUZEniZoYctkW`mHp2XGPDzXLh2&c^cTFGS2u^= z_2|F{V=TZU=KrZ7VzeQq0xej+HX1dv2JLHr83ctuUdnyiELEnQ4T}(F4I0&Y&zr1K z10(M{1%h)9Mk_$@<&lS79v4T4e}Jga*ti0@>pb8uVSBm3`LWmA%!hZ8t!_@;{d9oh z^%LJg3JgkquQbi&qB0$M*t$C_FDlCyx|VqMZc~;83S3obwE=ChwK)`H6uU;TCF8|* z(e_8ylaNQ41{EQr(zRB4->1Q9J{IK_kHS^SjZa{ob%JiCN1lfa3XC?CmBKhvp?s2XK zGEFe^J^pPRO#Kg5r5`i!e)aY4 z?ows}inU-_@psQ$=l4V8F>mu~#;x&u?NlGV-s47QZ4C_(3u0uQLx;#Nh>jCr?=wmarUF$bZ}hzUne8Vq zx4LO?v9CUN-HRpe{XRm`Vpi;t9ooI_>)4K$fGRK-Y_F@)0+_Sm^(awGd@S(&nxN&a zm7d5N+Mx(9&A9)-IH?ss+;oF|-0S7MAwrXHg!(m&DuqW(pU;h45!Jx#;Rj+~W=?{y z;~TI3wcb0Ld_=ikTVA0XUv*^EQWi=y^mI2zo%h;h{s%7R&1+6I|1VsO;Mt7l^G(Go z>P-~7Q6!&>zI47GZo{HahXoa^edy>5na~NMMtqnS2dT8Y)VwjD!JczPkpk&*p6G&o z`%9lt<*qTYRuftK(G4@MO5~=~H|wU>(L0eaa|2zHS1zq4=iXDyMHZRr-4-g^Q=7Sk zN|&?!vUtsG9sI_6N|VJmIgA9_n-hUZ86MXA{!5 zN7TxIpbYDqZ4yH|J%lLEPKxWanmKD@KS=bavwnCyOMbGg{=*fjzL5bNda zeLIq)Gc?6XVHEbQ zlQ!f3Q6{+(Y4LEh>_SlII?W2eVn=6;xg^=Q@mEI>^~Zi$^b4-1?Mw&bPks%(M2SJk z0CeN)3rw5QVpY!U29Ob>3RHh1sRT?5tjh{o3zO#SYJxr4@2Z6PPfLM6>VY)uQC8?c z`D?>!3Z`Rz+P67<qQgEKMc)U`jYvx47Q?b6ZBbj#EkEr`tnWN zw<~{+9t3;ecHa*6)3?Z~x0M0PUNo|1wLaXga0#5_%@zY;vd6O*VhHjkFI{pMKhR98 zDc9TfkW3nC^6v*=9%?HFMgj+_aBxWxxiw}+lCH|!wPfb6Gm5NRanJPMHB36{O4Ych z!>817?7outyS-$rNCZ;RqoJfOg$7>m)FK6I8ba-x;%mMbw4aISly-Rkbip63)1AT) z2@lh|UtxkEHP;_fa8I#W*7$B^r=-MV&Zkv+8u>k;U8IlB&*4-UgyyWv?(jL6I%_N% zUI9hCL!&=MY|;dkzNVWS&shx5U!{s^1td7s2JP)cFu)Oh9zS_a87UCBFx=Jy~55l7Zl+qt_Kvx>(J%lw1Ie!I5s;jk5b(8>ias@#$lqO7*PHoOTDd%ag+ zU~?SI(!#N@GKpu*BJdW$_M-s}EPaI)6|5p|ELXjhg(lXUjVDpWvS73NpOvEs^d%54 zjqD%E1R=MDMX;To`3)q6c}`3pePOd`^n;e|9Itx+E;BfBIn|EJ$nABO*(eL-YTHup zrmA#XNOi_=`+m5}oA_$kI=1)8+#^{V(*~w!5psRvs1oBvJxx#UK*0ls! zIwQPj+Nz31%URTz8;K0zIqVG8MIz`#_p6!D_RV<;C7`abkp%=9Gx46>JO6^0qpg*p zvc7IJM66kRpj`?u$Nkm$b8VSiUBSBr+dLoQGx_K}buR!M2m8L@u4oZ?xT$UW<&LEwC-+AM z4fJ^x(|cshX7sW{_@JoTh)P^k!{M(*h>xK%;b*SNl-WwCNjS?LzA-&O2w*e)nu$oT zJK5 zL-j@)9NW-u+xJqxHU+}bNn2Y12--?3e-U)uF8_!Nu|}uuZvo-L%)dHhQVaSM(dGW| z+|?{S`Ilre0af&@IF}#}r@o$w5uPsZy0F6zo!O7l`3yHv_XUv@xa~AG66$e6Rj7K) z=5pMda|E644^!f!j<-i@l|kX*sTh*sF;XsH$q1dPs$`a6J4sv{cmgiI9ared^vIVJ zY8{by4`D9F$#eRiQJpP`0a_dU45DyxUd%JY3eo=2(N8qB{d#5YsfpuI`o-Y0=MsZ= zz7JluT%dZz9xDZrU9bk7wcc$Z9z{X>-XGl1LU00zM5r5kQt7scx=FImsb$;ZMKV>* zxfbpX715e#4_aa$8^3o|LL+!H9{l01J!aGLGgp>WpI^G>bq z4y8H*S4?16L_Mw<07=1PYRxeGW=>wgq~3qziYD{tNbU;`owk7|zi^B1tlvk!R#3OtOVn=-e`K&1UK;!X;Kr{Z;13nqMjvtl z3S@AK)$5l1BX;b;<;cJNbmAlYko_qAAOPX*&H|j=_3zJ9l3d&deC{?O02%1LU#$N8T`Ak;iRz%XSzDr1eX((Ok+pwRrpkJlHN4HZj$EmFzKTX5^`F-pz)KJDHa7qO!r+T%|d0!v(pBW8b(r->T9cJ@Apq3Of|T8eOoK2Ph` zgP4^sznrwBok~cvl&OMa1QL$i*AEhvT*7q@PjF8@0vI_7YbuGtpsG5YBP@nqlWU98 z7hab>9v2Nl;jCV{Gbmqto9o>}W=`%6$u;fW_I#XpD`DKgPAfjDH=hvyBjTIWME24j zVbk#RJuLw-qC|CKD=hA+Y*_e}EGpMf=!2-}+XL6&!NkVU_9ny%IZvq^y zD`a24n&6yHVE?(q#PfqC&HjkM{0TmPkh9$TO0;b_|CQUx+y&gi9P zDs1niZYGmOZIBdv^5rF)20X9LpNUi>2j`^E2;5BA6aUC_uwvvaZ;$IA*!d;0y3~bh zK{$5I^;A;E;AZAybeyxsVvxd@B^z-z2iykg($Y^GJYmO%VYMGs^*3>+VZS5c+7bF^g%$AxX0h zeRudlml|wHPR?N}2tX?$+s16dE5aY$pt|O9zeV0;i%a1&PJ=w8@E0kPTrV}Dp28n~ z!XCQ_;0>y0a1bD}MX@pL&t4JpHexeb3PAPh_R$TOQ^8c7+UI9?argr%`F)Cp3p(Q>qxH^CRRr`jCu2;JOK`sZ)u#-Ekpw~8E(>wV9XaT>+4!wwszZZrPP`B_$U~W3>;hf+0Ba9+L7-lwRObz z!JJ*4V!c#sbMTMn@ABvSi<_p@Wuk;7LtGIo{noKzMJx?lC0u!rfC&8?f1wrmbt}i* zFu77i)+3fKf&NR@`&c`b1FItUla-=2C-yTt>jEP-`xqJhjoSLDA7v)yPGNp*>J6E> zV`Fb6j@NaKjumR=KXJ(^{etj8N2#fR#rl=bKl0Chtd=JyYV|X3*B!4V@1x@7Ejg0( zyZ}f=#D^3X_R+|Pzgvjn-qV{|-)z^C|ET(OK%Su&JBtlQuUn0Fp!D18_-KO1l0e1C zr{%nnpTXSC+ao6C(YeVb6PbMLeOa4FwSUG7#mD!L+$|JFs38zy-T@uD38!mMzQd)) z1_r4=E!zLmo!$@t_cjYITra`G#YoN&Dp@O^Q$l{Jv`n{jW5fdp5{; zV*9F^#<=4vst%M2Y%=bWd%4(GD-u+ToyGcFcJ3cZEymMX7|dJOnI1)-G@;j( zw}3Gn>-n6!VF8?#OvJo1F%Q*HELP~)gA6xmyTH*anxYBWejOTt;tf9|J@u|!&kY&I zB^gJLm{Ck~iHUTjuXXOYsJy3M!GQS}y*8+Av*X@bZP2Uo?@1;=@UpkF$f_o(IfhM{ zxNqBs%%d)$ms^Y}Ot^Je>=cJPeHvae0Cp$#p4=2qn#;Tj?Ahk?e%&lg_{q7pZ2Fx% zM<93ANU}{@aS_k&H_qPxq3MHcDb}ti#N*FoBCVqa_3OEU7U%=!3M8&BfENJtIjKKM zbb$o1JSK{u?dg(Elv{)jA?3PTeDNCj0gWRh_FxKT+}F)(*VUX3vtUFM^=m}qh)vp# zz^l#|AHGd|Zv|S!iY7D`V12-&wEEuXRW|`t0-VGdp!XkAJNWu(H0O`{-m>jq+6mHt z-LSp#z!Qv^AVlky_NY@*n2zwp99tDnyu>(oPJW&F?>kyr#X#M^qZwPx>OLaDwRK(? zHw5(|y_ORZV({NyYIn+0S^*txRt);J%|%U3$ske)Uxdp=<)JSc*^Z@LJ={dr((Uvf zmv?IxuKZV_r5{rJzqM7xiPSOLky@{WzPsY$){c}wY6r~-G3~D}Wjp!h(D7VLdb;7` zh|jJJ!_?6YF|JkWYtM%J(qt4R2K9ul)UR||LNpT(f_08{cW2Q2ng`jh*@WB1GHYYV zH)aEtugg~!u0A--Q(cz&hu2IhBf6dIcqYOgvxovJwGa=}V19u})-YDu{c{H_{J5;* zTuUvyZM4>tsl47JuwiFi-|4Mk>bwVsdxzy9+>egwY|Az_(fv$it8l2ye_fxUn z2U-k+t?BhsokCf5S3K=p_dbG$4*J4kyui;RjqIxy*P6T3-F{W=H-3Zm6e$_dG@r4a z>-wXOmRVS!00!25`-W z$#I&H*zu8wA9*sPUyR2>M{W~#Q0SLI*e`}EczL6d%KSlo9K6$&_>f8Cde*YHB>^6P zPUf|i@A}>!{xo6jjW~W=TWuDp_nwVty>l+^T=AyD3kDL zbavw7Wjxx-Jr8YA-Q`SS&05nPwfEMH25G2vws73WOewg)_=_?L?7ke%5&Pd3?+D3llYE z0tDw#tMyx6;dH$3++D<0C(5R`QHrB#%>Q1B?i|S!$KjNTjClesRn7y*0d9Dey}Q*g zpK3Ep=JjxG7UtcU*PagTrm2OW6)hfaqF~T~tl`$0z6iD#6Pi)`M?tN{TXH_t0fjpF zfP@pn@TaWeYX*l5JbOkeo|}vzM{_?`GNT+i-!D8LT;!U*na=-|6u*BIGNtxO>A!e? z6K|}BipQA-Evl|<$Xi@E@EMmlgCAJ$IWa1whFnZVk_t9iL}YwT0iQ_tI7}p|lD4$< zux&Uxam(6~v&MJ3bU?a?FiZ}cvG?!Xa=~_0dMv%fB7GvMCkdgKSYfg_qw@OVv^*pk zo}l8xCJ_WD#z_wON#)c}VX_i+rE-QUONN5jVN-KaHyxlJ5jp+gUW8lv^WmYswoOX` z7u|aZzzdzcxL@ua3|}sjiQyVf?G7^;y#%7!%a0p-4ZP~_%M1slg;$@0Tj&fPg*FyG z^Ry&Y@0z=j5 zUOdgWicp#C_y9raIB7XbaI&v(ov5q{DI*N=={~CUxO=PW!`4nP(%-0nw{fW#MaxMk zpyV74VWR*Z$rp!z7I1*>XBYkmen8tvQuyMA0wTtFKDx0B7J4^2hgwTKMfz|NAe4$4 zMw@~H$aRHHZNd(c$0kbOu4r4Lb>u=G)4@TT3?|+dCL((=Z!V8|FxX139sl4|wq$Bq zZomdNw)DFiCGmJS-^=*DznND|M!VIynlc`VvwQHGKL&%R$Nqyv_UuSvo zs_wg7r~B{GJ14B<(5#LcD+F&Ok2$Nk9)ks(*8YhN7IAtme_Em?S5hlMUnKegoaGX6 zTX1h!n5@=899&;*OPoLV&ZwW%)(Vojot@gs@VDE;l77gp#MyM5)meWjc z>=#SW#STxJod1SyvP5X$ljHq%GwZuY!ov<(?Y;OmZpm6Y+Y{~BfmaT8*KH?o*^W=W zq5nRenWxdN;xUo1DYoHQoOm;8=in|nK6uH1zNlQGCc7c?k|s*hAvKjczB1(&#?j>4 zbcnJR=ChuNQ^}btVR#pEmE2+RXi-0u;U%KyaB}84(*S;Wfj|co&B8ZEdjiPOzp%F@ z^cs=V#EznlE0$bvhyMp>(5)s_o&QhL)D4tEMI#%}pk&Q9{mf_B5^b)iHO8*^PwE8Z z_F=3exAx&EYWge_Qh2+$lUYFGdx4N5Q?~_NF7uTz_p`Js1{64`YjM7_%7wU|zcUDm zBR-(^gxB4_K3__;Gyep!iu^%48d}CFuSeD0%}xn|EBal?xYf18Je{lP6Yuel`aue9 z5nvSA@km)WIiChN=6cP#8;B9>MWn%k0j~Zwzy?IHW~o@QfYS(2Xa6~e-6^PtdmGl? zNdly1{9DYyTr)c>Rz*%{rpIk}LWrzwam%T`a)Pz%fc05W5>kC^=4R?yFn3litX&UH z;tN5RJ;4f2&96=aDbD(1?x01i0%B4C-k9kkuF0kbmREM$A}J2+1KO_iyH;bPK4~VF zM>^DMUNS;|D5(J`)TOwyvI`Vb-3l~Gbl1+vcpz~6J~Wdf$HQEsovt>*F(6SO+)8ujM7wpBm8m=9h#GFEok7!af5E5aWem)74a1p zYd70DK8k{aFY1{gTrN@tW73lFY@y$OWfET9!-{e2kXq8OFj7B1hJ$TswJpjq=kzqw zy@m+q&j)Z9{uk|nYD1T+@DqVgd&o)13_+Bg!Y8Mmc+Q`hM~J^4{B{UAunm+nqo1pv zvn(JbTHWoeAE51OSvv2DC)pTa=zHbRpE`IZPKFF_!!3CF znO^mt$Hv%C{t2+t!_mkuJ+Rx*@j_Mxer%g{KUguxaRLyw$wqLrUr?xp(51HKPw>kJ zR;Ov4x9&R$sc+C|k&&=}BBULf52i_eAU3S@n&?R%ceWr9?7upnUb^sG42lg#@8kW$ zCv}hJHkQH-^;$yVs=D}|@b}-a+VdB|E{%4vR9&GLJAgt)uN|t|@2kn<;(rYl?RRAl zGo+DkN=f2R*E@<9%GNBlc6~X~h%j`d8Z*%XC0w@zzRlO~ebHyS857f4Bk`)D=fa0~Fp!=39GNTvc1O?zeY;7h#-YemTyW->i ztHstcu9|VF064uO(kWrhP$#h`D%M?$}s_ry5}a}E79YV z?+nKmou=t&BrNtN#DywpAC@yGf@wJuFS$iu2Fjmrtxl(PlN0 z{agK6IgoCa$HM30o_V_P?T&eRb41UuBBm#_HhXY))n-t>Qw)P;Cf;}1msP{8`#f*5 zsDtHqN+;`C;bhY*~F7Pfhg@r)5s6f4~mj!PpEkIF#f7_QP0PU_=aJ zRnte|Wkpw?J3ZDu`v6n?lzKp`)j*Uos(v0UI7MzgHS0sR(qQNK+*?6#B&nkFeaL*{!y7{})*kk=H`yX7%YKe&8l>piIOVkEx26?Kwg@rD@Ss|64QjDh5c z#dDc(ebYXfuoMN7HEmM=TSOu2KkJslnb#GMyRlhD8k;c!1i;qb{F~tuu}kb}5bzpq zUb*j9nP$kM1p6=4I#?GK+=;EkGK7WEUF)yypM9KIVzx4KWL6xF>R^*&Jky*WyP-VK z;YXhEKm7O;;uQJ57*b#&ACA*A#?@zR@KbzFtR5S=-9mfl$)x(mwkYHH_*n*~1s0UZ zXSxZ+R3Ul*Vay2mws#hra)^xwC2{`NJE>J2sju7``_MsVTx6?s&a0On$@^_wN`KCR z26w%d@CK5VJ+Z~aoj#<~;*HjCZz zQ65SCQ6!K7aj?Ke%~>PCas7I5y4xDI`jGPlf5x)|UCJL6n(_om$qu&$&F*zR=!o=^@Fwx?d}8{Q*&XAFc+n&#tEVLg z4X0_$S6SL8K?( z@{MqR>Rk2hO+|SPexVE+dK+?f^pr z4#%e$LKr5c>r6bs`^R@E@ND+4|b0; zVe4@Gh3n8HcgYvAcjQM5TUxk8v;gYjBHg)Lm=T>u3dRSs&;D(-SL?3R&*%I?h>Cvaa^?x|C_tS{%6@(k|KPNF*-XzZ) zuf6Q18fMTsT{1axb33`Zd<3>zzH8-l?8s^jAK}gxMvhYB( z8D49#@E5P`o~Ju<3mfA#cNuAY6(ypQ3`s#$dJ%xpfQv@!shevX$GNdE3VYGCoN@hi zEX6>TmF!a(d3NBjyzg5kg=dTRd1p)dq($EwC7KgsQxbfF=j98M{}c_#Fdcm7tq`U% z%kDyVt3$NsxybPEO5e2QR?Y2Kdc_fYn7e~NDajd4bw-)b6yt9M**aMOQW}7xS_>OH zl@g~HFxQ|eJ^o(EFj`AZE-c8Je^rs)MPjiK4QPLc;bf_&W{e2t)ZQ~f)%Ut@%mndf zP5Be(1Rt$Flif|W+E#yel5SFY@{MC2xfr>2`dZqqIctOJ+wNMMI`0aMCiP0;x&Wh1 zdNSJ>@ViGeH%oI${G=LmG~X915~Pf_StOb_ZD=L@(15W9Yl5opI=zBW+82+`#?yBy zmqhs;0Rb_ov9q@C%Jvw>qoiszgG3)DC&b36ZiLskx+dm14L^?kaaQ#MB&+Lz&&vNapN_4|$X zYvGq6@?yi6Ys)C z-87@?QIbsr8q3vALw%cD?9ESRI&kH1ok_NAqUWmYzF!jilKsB03hV)1RohYGPy!W| zUbZ?4GwNI}xplLIKUVu7;vWWn!LXh<@~x<1S~8pZ8~0b5oaT=$wBvUG6#A0+-Ln`4 zxp?$9$0ioG$d0)~8YB+rJl6C$N>g*ng&C z5|h}N6{CwNe6^CRLok}!sJpxOc-$!#mTwAtxvEDHVcVvlY=U}BO2HILtbDkFm%p|J zU}>>O3^j+s)u0mKa`{E#_ap((6lW>@mdgk9X zvYiK016ENryg?el_C2Nt=4Fb4ym}>X6!ylLO+6lWQ*6ssRpa@!cqgXwq)stL)kYt| zQNK1C(lmk!Fir$N7~mj%9o4ZqGYae6Adx|O4a;?p`Zq*b#N6xX1FCCS66N!HKAwdN zOSC~1%TE3IIUz3rX-3&~$jaQvfRvspKngJ$1@R0*IFTs6d5lg{Uu82CcXB7EC4p9d z7)<8V;XFBWz?N2Kb=|lFTdx58^YxzQbei!+(PopFK58e-!t^_<79L|fR54mCv6AS= zvJfQ9%o*oYT`&X*yW`|rdKQ%Y&*;j!>NkxdOmw0{y}}#|nHuyP0_#^QzK+ayIs=BNChi{&z{S zbR&J+xSm8TN$G6tROesCaa_wD1$f76eyo%@8p(MRkD%EO!fp_9cz0zx#dEnVOqOLD zk9db^9I_#Ljy38YBIT4W*caUlv~$2GW#oFd0x1?gDNfD0Q;LdA#XNMd*c|zKediyR z@<48~A$`^zd?o6t)hQ=16S)PQ#OpWANZa4T1$l#C0>HwO7A6d>P{hE-#7fu&m~+n9 zJMCXP)!?sT6pqf2-*iVgCw$Z7(9 zZTH}$&u5~*3Jr|88}QRQEmRjij{BBAkonEZ!-JqZo9%9H`yNDs9Z~46c#}MK3i=Q< zEz>MeC@H>QnoYlIvWTs{OZ;u;Griy*ptC{Hj<)kHbGG%C%U^=Uj!{^puP}Ur7|ghU zy;`W$DeLP7^-n%pT-IOd%=WN?GChJZ{3T+>`Q_tfNSCF9;HSc80+u>>{N=?#Wcg(E z?%9#Y9}vaKfI{SzhH~L+wt&V(41^7J-&NT8MpofE=X=&0vNhTEf$ZAg&8XSjINiGq z&QZN`a#m61lYv19UjO__oCn~Om9DRn+SAJh5or+-~mZ&VkS_*y%? zt+K8O>n;%+OP>wx2Z!>8A_?H$a#b|tIg+?OFJSAUdzs?B_0`k(V~jwDsEYUQ<`jl{ z-1;*2G`la~`*kMTlN}9iR=g8V`b5hb@4D#%!YS(YQmg|?C-85Tl$zu|8>STozURcG z3wD|=t;uG-Dpy@0KH2y#o|bD)-yP1Z`#=Rf>^a10O$VWVJX?RHchuHW)^P;$Lt6}b zk298zo)osa5~uHI=j_x|{`)w4kLPF(0_hMj7zjXp2YEyaqv6CD29Z5R<_PgCBIV_k ze}duye>uE8cRJ+|ti)R`X2O56e*e#z{*CZRAquwgLznPuV3R}EW|<#~pK-kjquQs} zC4yOWgVw@Lz z82!!kc#crnf{=KI;Eu#f0@B3d!Jtzm{Q@Gp#1^6P$Fb+Zv`%AfafF$*2TaFcB3eH_ z81pTf5_5|9Z1aIe#&5ohr)##g7!-BV3hVL9gv6x-52VK=obN_fs3YOmEax2F^`< zZOz=(@J_!irK~UFHfLlQ($=1Dtb$UmcM+EZpr(?pZqwaRS>T2riPXnE!bt;3i|3L# zV)uyd!nQB4t)qf!l!cc3+q<$-MQW1@X=b@Ag*~_^yGj6v1*m+08V$v5P**{iYHk25 znnok?y0ehvd6W9fyH2gCEwPBZ_M$aRzPUXM9PV3JA4+(5hPIK7+tPWC9u^=g(kQm$ zPr)L(9|>YLN7ibsB$M`@M+EX=eHW=YBdI_aHhKqEdZ= zII4{_9ktiA%gU9JEL=u%!yio8|5yT+&74#eTHvEwbEqwF^RQkZEVpx$6#zXP5K|=x zoN}~J<0aXb3nB#+0e=4=rpDp1DVBCGdA~bh37P|)gh^j~;;}6_<_{AW90O#4lRyH- z``GJUpKsVZHer2LgYYz&^=-a+=!-t?&FNen&yvf2*EC&M`LjKvg9xZzrw7?PN?8%H z@%or<^}@>Oy4nuiy4kUl^6Pz7cho10pg_uO$ zQIV)9uz-{8_F3VMu__?Yd{oWoxCs$SXx8I`Hf^j!Iw^rT`Ee?tmDPmdp447{?(3Jk zkN%%M`3`kF#61iSOjP0;wLD<$P8z2!FS$+77OQ2+MGF}+bq|kpxi?$b2Y(s+ojBG- zWuT!dDtmx2-xHOGnvF6k`x!nLPa#FW222hl@3e1Oe!4%LOQxBSh-E&bM`A)pnn9l| zagEdJGAJ+C?zR~GJ{ZW2?Hr7kqCR4@MqRwJhBQl8;9}GlY3p2FxsGta)KLz zQeJgw-uvx=_dm;JC$D{b+2Q}v1*Um6y2Q}g5Q%MOI9CJ4y_|+6T)QhcX{#!XFo7O| z`uhBB??u)NhqrOB;$_0G5vT1AdFE*oA%;ejIp2XqVFIxXf?flWrHS7W-3(yOfOc5y zJ8VL1!#ylvd1+jLPw!@BI41eaaDY?{#w}rO=y8GsDQz#Je8!kuj0B>VHV%#mtdEL? zy!fp8@lM10B1YZFtz@a+z4!%9Ft)58K#Oq#8$pE_$Bm7frHY@aX32@8@@X53W*ENS z`RN*fzFyOby7(~vL|(A8w*msMkOX+Z2b4aA&yxX$aTS^gjY@T#q^(xb?>y9ez2HDD zNU6>Qd(1@V-@&s$<1xNVP1G?Z!3VfEfSL)hRn{u^GI7pn*xvPa=V9@UMY3YmYbM?+0pQ>Ay)O4@lm` z+_Lzjg&qdo&tb!T)>nYY6?!y~RMPPNrB;25j&~mD(c| z(tO=*@eW1sRHna|PY1LT_(c@0<>yn|S&#uQ^VVeAW|O!}^DB1%$S@-I-KI^L4BGs< zw&%)D9I$Y}JvBvnIKSO!d}x@Pj_z@Pp$jGXDsi6I7pnfq;2YX{8rIZCCGXAnu;KV9n(FeTzPnEAoE6+njz=G!Cuc-tj&Q{vZV^$IW~5< z{YakyuP82U9j>Nc#{IY&RI`&$_{UEqQ5#sq=XF#t1)_0= zhn4C3$F9zoOwHFD3_dUDW@49zME*a40%qg!&3MV*z=wq?JA3ezaT)oG2T{PQY?=SH ztc`#V=po4ez(aJ89=){F!eHL%DLn8#B7bV5I=ar1kd|($_E7Xq|@=sw5~3^@-ZH1)*Zm&z*oTyAY|X_AE7{2*3s|3G29csp7x!A_1}@% zSuX@iE7fwh9;O9tPj-DC?4pht+kCr6PaZPXqh3y|Wm(FyUp$bY){%z6>+FG9O@n>6 zfspzM>^G`cecXT#{`iG~ctrTbPQ0B_0M$cX#kyxdJoF3H-eXf@=HiwT2+c&s*<43( zVa0BFXFWde;gy;Qq+98De_%h#wWTDft|#T8d30Z1si=0c)r*Oj(IYVHVFrMII_(cil2 z=Kl#{|Busj&Z$c@2qy{cr$yyYfB>oAIsRsMmetP&z~e2{@7>vTXo$E`w*)8?jhYjm zbt4>hq5mb!W@Q{Q0~;N4T4>dd((Qw#EpPBSIKdFasrah0iwdv+@O*$F4{%~q z{@yGA7SE@pO)Gd0;2pCO`M(3PjERgET(5LH6Fnf0SfE(g3Xzs@t6{4r_8OY$evj|} z2tj<5@R)%FB3D0fbJ}?!wXz$Zb$%aiTBh1IPf+UhrW^5p)Pb)y`&nQWWYpaaAW$q) zX*KEnGMOBC^Cg<>uY}g7ErN=-3!FSp&s)StHVHUt!P2r}RFG7xpSJx!A+9m}DsIr46_1 zC)QvA8Q(CxF@i3X$ArCj(rSk`jlJENjSBZ){A%%F+ot}X+&s+gJA3WMQQMb>ch}^;?;zuPp z@vDO9z}%NqwLFD?!ZkpRgP$(^R|G;T|7|*O{;)fhxvJ83aPVGdxxAVP>s=^*-n>l9 zEbNSrYRynKw82$Rvn0_=7yg|Nqldf1@H*kk^dQj+uN|=Gw?*o^x0n*^Wg}=PwNzZ^ z`C}ZFnz2`ZO=#>#)V-(5{R}VjW3S^z-T>+<%dl3<9oEE^o_FB4XY3|{6sH$_=!k1? zIp4274wls>Trq>qxn$kfLq>P{zGQgjKpecD9m(?^(Pdk=C=RWP>yMo?RU`I|@-~SV z?$2l+HlS}N_M=MZ=d4#Mr!~$3mKpIrM-Hz-EJeO~(P}V?7d})&N1J1tT@URO>1q?| z3jgbmc!xmHA`+NK6F8N$9CO(=ec_(0+G5~<3J6rdQ%rVy>}|YS9!42HH@QKh;#4i& zlIHm_q6rGr^J55>;ZkwWzbStvSdw1(0G$OgVozg%1POP{))d0IyEDk}xXe^Bf1#Gt zBXqT8aXEBk>l`0jM+N6pxdC&8-rOHgQiK%;Knh<$pveuO40d$7Rrq%wdL^qV(eI>P z)EsocZVQmwRx8YV7lXtfL>-`m4EtxeF%pLd@;DI9Dk^(Fp4Artkwh;5{nqWPH9m2w zU1u0}{n=o;aAhUmd0l^l0tfAdBihnW-&2G=tQy&e4Y{sMmT4gm`lhJ^_*iPOFt*w8 z=u@ytf_(Os*3i#fW2;%GEpjGfbz&4&EEkIsKShRX?XS3XiU9=bTbtxjoSXkj39^Q@^%&E8eDD zUiBAs%>YTIO%Vw}MB829SrOrN$5_;Fm6lnVKK@H8eF3wcSu4P)qU4X1N#xf`=f77* zG(T3S@qo9=5m}q4$bKACIX;bzQ#{ z*fR`(XLu66hljuPC%Lq3+P`Q<29>hjG;O}AcUC}~P$9AlxMG*TiLHmlju?>}4=EM# zXE_Xhu6#g+hn)VZ1~qY>99HaEo&(#)hMsQNC~6qLq%)vnm%Eig*+YatPS8@X(AQST zMOC@^=dSQH+U4wX7=^R#el8bz-`cr=`Nf@wnb`$JhFjHzB9N1nU#w0?Q&6~#=5kSE zoj{0%**~V6-1Z|XjIIqhBS$Y*#dbWA?MEK;$GasqCpc@cC`>V?dY~m7Lwu%`|aQ9oI!e@%aVLpqJ9}o^IVBENY18LAX5e zjG3r96WykvALwbdIbKzfn>iwC>Iw9{BcJS?3Y>D_`h{xfZUATqG(x%=kQh8QETDXG z4wh`b^<7s;BwZnyO#Kc#!!{iAA0w_voZ#BS^r(4h^S?{1f7tL?K7wteMtqqEe8t4- z?fg59I>XM4OG!Sc?21;Qq`bP#^-p-a>U*GcQtb~+<{`+ z0b*&;0!IA`{(M|5wGbq34P$jk~2ptP~Fxt#_fw@huADv;W}US<#O`# zUaNPuo9IWBN#!b<$4l3Xz?rJf&o_Q+r?(ZCcddtCcH56UxZk>iXNLL4swejvLRj|d z4h*-L`xyeXpH_q_T;?35BXz-@;|nFQaCl_QhF35*iJV?}0T{mwigk^e`q;nMd`T2;k>k>S*JaW-7} z-vr$Mkm6QJCZ$TZ(^FS80g)c3vt;)9>T?LArKjr(O@WsShvU_+$-#Y-GJWyK@!~}~ zAmJi+qiwTSGe0%jZGbEQHFi^AR5p4DXTL%7_|`$Q5i!*y^{>C*aIRs)4TJUZBU3%X zx*Wgex@=|4acS-6gT=g2Yn^PeB7RV+^maB3H2@b$3TPD4E*JI<#x*EwlOs`N5ea~4 zM+vZt+jVx@{bv+bx~7w>`*B^KnAIlw5-vc1X64_K%$VVkiW+IE=o;`n(AFfZ1Px5F zKLk)vcOl0xMzqUM38j||NogPL@cpdF7hPSlE3S;GoOPGGnIChzUXngcWjZg}&OJfG z>h8EA0^?g@UI792K{Oa*q<*cx^-9D6&G+t80`t+mNQqc4E9Aw3purE>To%M!JR#Od z%{)l`sF11gc|sp?{*N5mGw5X%vDQzfmzjAlwKf(73cCPh&AQ}< zG&S}pphLfw74vYc*hEdp8_5BYN2w$Vg=wquUylcg@^5oYhp>=u&RHv1+^fR}q$8}Rarj98DP znuda6s8)^rs3qnM`b-R`h+ZS%UoG}_)Xv)u`L80aoO$CsI|@HTE?~Oogj;aZQg(ii znE|l!6u_~KHmMvS1NWeY8y(oin=xzhF3fvDyw$d$m3D2Vwnobx=4yLu%onk(c<-_3 zlH6}9n~a>c^ebg9+7I;P*;d5db`MB4~+d3obD4^fylSLmiX#Usi=4 ze*UiBF-i+zvMKKM&YLy2djF`~fq<_rLXDW3WLCu+h~|isamDtM9-tOAkm;zOk!4e# zsI5L;lg>5u?Y~B*ZqVwv%9?JB;YzBXUo|po)Zl=eca)3K?E|eJ%kau2rj_h$utb=~EAQ%B*> zzCREyYF!{OaK}07V&7Pf8~?)c^P`-9y)biqN;y0uBn1Zlka5#MJh)N9hg9>v<6tW~ z3_ebh?}oYFr4EZ>Jxwk1!enS_-6E6i<>L*XiM-lnO%?D=!zCwB*0%MxuCvjfchjcl zAL{b`|F3;pZh@BDobzgp$Z?K7Xky-=SYh*rj|C$hlBKnI20R+FvYkun7+S`|AbrM~ z>1KB5vW&L7ydT&^dFbtecj6A?>BSPEmH@a-Z&0w-f8(sBxaTEK?d`+QIo%|H1S=qQ3ap;ra-2T@#{w8KNIM}bLTvLrJaEE1C(I!{74^7gSHA55 z{VdN3`;Me#^%bw33&ho>Zg#@~fECVBexg@FP ztf@d!cY9MgTd{v}XX|n+8IOac3in5P@Qh{?AiL`zm$$!&q8ljw9S6?cmD0 z81W+*O7=zq!dJu7?09-A4Nul5j#)+CW1bcISm8Xl}{)5*;U`(3OdJyNstg;n^t~4q-WYCzwG3LB{wT8r2Wm~ zo_CNN(~F58jzjRkVYrPVwQWUMG49=xMYaGuY^W~R*J}7djjsK9MtlA*m|hcwqD3V8 zRvuW#s`Ph!(-@}R)o5y~F!W7_0_=rbY}m3-gcCe0o+ZIvrGo3O3`q(eMDNqQ-;o;IHq2^c{z0Ho{JudlP&sH z4*Ia z!%1)R)>HJKu$#%WLY8ns8<}!X;zn1X?UU8@lP{}vEU%2y&(jS>zSULPxT+TqAHUP~ zYbRSAZSk+|{Zuew1ojnZxqq0dSEfTIeVkIc{uDDE^wB;L-7GHp$IsU`w1pkwn@huz zYVT`;Quw;1W~N21gAG2ac@r}cDA5_cB2UEJDL7dU^)H0piW#0MeSPa>u9ub0g&s@H zl;`bA9zW(C8rB;WR`WAt;}=3DXXF;xW1_s7A=&ETl5g0ZJKFE}yd+=Ws)OA!p|g69 z{X&)pKlOzJZ~TBO6w*+O>fMeIZ>F2;$1-2&%&=hr4K5j;AagTIeTtRkT<$Ex-uwRf zE$TI)zxApmqC<83=rMihKk2&krL%IK|K)P93<4V&%4?BoV6c&m3b~59=$75B)ZBS9 zP7cPU4>1tSV}PDbY4W`nSJ&HIIt_|#@P96ir0C(}5tS)VVt&PK6DfVD&X+yd)L*WK z_klZHl3!D3n5!zd3w**<#dn2y#~^IAzE>OwDRqM?%Pib2y~5xf&2W22UdgDH%&7#{0&SXM2;`;Ds#j$7B;gY za9`M62ANcojtkd}nk2YozpD3Op>rUbFAtICL~@BFdY;-N*n$XPe|-H8*^!PaPs`O> zf=|d3`1?^HMbX}w3)seICE*Z=X|E!ZId!dRrym%m`i z(gqfujpgId!r4x~l@oq|X|PbExA2>`&!VurX6IAzY{!K|*{NQ*)Cr<^FfEZq8ah@+ zAyW?sRDyEdnz<7EUWAb#Wp_ayZ?S5+!c&A`0TSO{Yb%Y~%T5C`akTsk`Ml7$kD`=! zDG)w0qgy4ZD;Y=ehXtyKFt|x*l`BZ%pX- z3B#{RkO<5l^u0o`0KIYFofUEGhiwsR%^$Eyj-vt4#9U|mF_tRf-(+Hg*I^j)>g6V} z36=0kMOY*bq+F;`D-QS=Hdvoy3o4CQ8ni{Qo3mN5f6S7U`mI}^6Plra zsUqptAB2taXdUiZv1CcP51~UAr)2zuu4ajDKM&F1b8xQ7^9Pi|z0{i%d&@GuQQ|k+ zV`Wz-Nhnt}CHVb}lmD%FiE@W_s+^bQ=|4ZTEI=mFmV<>zHSHPQ;wdVsMoG%?yh7Tg z6F)OV2U^VzglnzDYwu!4xA5%a=LxMou6NHDmO(W1BWYhIT2nXD4|};#s1IM@b^2SFssHL1 zxP6M&lB*vd$@f>bzkso_K>lKLN`qq*Yj*+4Jva9BvpOfpmG=c@m{~I5_YDh2MODgv zS9x-7O2V57*#&Xn!_l}}vcT2i#^I~Af#R9p)neXiqMWR79QVY-P&zhLc75T>>`k}d zeZ(zke}=;>yF@Ko(txu4bv}C=C38e2E616)#;5VsvT&kP0d>>Mj0U%#deV%~d>j4s zkT2Ml0lNP`F*q`Z%B`yZTY2CRd&S_);JGX_&d2~PMsg{UojD3`km5r*4$mi&{uxu> zS0Wp4X;?};5HalwSx5n1nmB#aNxEimIfW`c9lO1w38q_g=Fkrv5J}m0-L^2~u)CSc zyH1>2cVbP5*s&dKrHY;OuejwNm|Tack2WWOli7w$egT;{s9zdJ4e64Jts|zwG|}$p z;;)KZf_&OW#;-ZH^yK-7m!2Ql`H9%Q79NFrTPi!<}H|>W$un%p% z^a1HAavQJqRwpGmou>G0f!o>TFa*jT_iHA$ z@{tzgx2oSaVeIVx-awZ`_p6YW(kp%}VtcQbt869APby{?HJSA*)D z!_AV9&pw@P*cUn#wyMWOsR!iFRSe2F%GC4K`qigmJZ=Juf`9y1|H?tXjLhyI7)AOT zF3SlB*-%-JL{{RAW3~v@Cw|PK!pYYr_#kh*YjmQ>eEya|s=6;qQEX%l;>?Aj$;0N*hCht=Opc&|2pX9% z1bXPy#&C=q*dN`9jF7@194>jo7v)1PTPb*@W5!EXp&Y>hi3fbeTCJrDLb{TwOYB$u z`a-~KPl32y4y7a}h3ImCYiZVua!tbowHich)rGN`#Dr|3%d-#LPHaFolY9-T(vCkE ze{pA>0+6(MfY--BsrfU7X<7@T*rwYVGM6VT`#Z|CT^z_jDfH9fj^vCG;+NeY>o%r{ z+09aWw_b(A5O?ib)=-X7yLoCY9uC(F2@V?1i2= z>|xKVrp7yP8gofaVab{!ICBFtepRC?-=a>jPnu*cyJe1rMqcZiXS(H57oxg33*EB#8D6yCs|5vZ!MkoO+upSczhh_a z@hJ9Gjg@+-PeNAYK6G{uh?!bqZ)8T4iAOQev(PqIygVNj&Fdmw*s9 z7)A_6&#BE-94paH97BiS#}Bj8LS8CoZqHbag0%NjX4h{$BxRT&096r)oVp%+4UI`= z6#!V3Y;!*Df3ik5iJffZM*vry-c9YmM`JTK>4D-)baIq34I z8dg+YrTc$2a&PYZI&6%nZGY9xYGrdnqQNpyvqfR(>{Ib;Vbd~OhUwVjh{nl z01#7eo%BHO*aZ(xva#jrjkRB5R5?{=lT-J$!@Foomb<8nm11T$|BB>tC%5`(%qkNO zY70t8vo^X3;sD%N810BJ+pz$BzDcZ7@7}MVr$AM zaC^@F;qeZlZC7e5K`?9#y_?rH;sY2|t>$JT3xZ4r>JL>A6&9EPkcQKWb~&v*j+^8k zE|B3w_TcQsKi)^b*Qs+Cyb#eqh^83q71Wx{S!l+P4pajDdMNL8%~}`P@rP??EG^sf z2+w;84D;^{Bw_Gl;$BwT3R&>m1!6gz5cT{0e-XG{TXFsf%Y+xFFG9@?FALZ2Psu0UMkJX@^we%jyMyJDc@3?yXy?^p_*^zB8 z7GXEJ9@>JbQ3}VAFKEXAc>Ij0eKv*Z0DdxFm_-;~==QLs>bE2MYQkW0X=}_?la*_+ zo|9fpKzgK8ak1J-wjLfZA!IPq6P*xCK-2ShW{Rmd`G`BO!>hmHt)Ta~McTnYazMnl zfRR_a&z)qROJ?e4DdpMo#YnmpJzM?~etj>Vo7-v<>SUo=bz6OeALX3!ulUNxX~qQ% z1Gn$*?fwMJI?OxnYLM_m{U^i9I9~Cr`Clskx)VkcP>OI+pbuk=31C77gN6arou9(B z{R{s#H6W~%{dQknlOAy@ZAZg54HV z3%>PO1}v_5L!S;G5!aPgNOHIy-j;l4Xj@{br`TN#Z3i&0aAj0xxok??44Yz>{L*S4 zj!n5N97nG=OKHAs#gaB?o*idwCm@5cOGEz_p&6};X+Su;dwQsq??S>6A>HB|V(`@v zUdIC%8bN_jASXo$B*h0OyqFv`DVaKL7N6xmglpCDl|W0~%|Wt?=GZ`}Rs@Rz8+Z)(rA11H3~SHU;E(#JJ5Y-c zm@1w&+jI4I>hbfX#>|FVmTBk{=|&^N_&~kq{_~Zis6SIoU`0j$T%WFzHB5Xw_&n+7 z7A!7s>uAjP2jXq26P~Z@RySlH0-;ocTr46aDU@EdZgQ2h(PZ^wcb%u9(yaAuc!+MzIM06NUb~FCB~w&{b@*WED{w{o;Putvny+@xkf0 zkG_oT)Yo4jkOZ#lQpFxy+@-JW`|p5&*{~M0FzyDP%H`Nvcjse!_4fdK>v7zF^#lU$OK>Uc-9@L9QkKPJ z{*~ksJR20qeh+_C0tC)qp(vd%EAr2g0sP`Fjsgs1eS<${{aG&J)}lMma7A0YRA{|G zWH=opXhS#amF3K=rQg8m{z>rWom~SX{bF$xZwsr%>*{0@=0DY+_VmsLn6UDfp-;hp z94^wpa{C}1_d7;_NbWQrctcN?_VVt;{w-t9y!Ffoeaknu=nEWKU!ScGn0Z*J6YY)H zY%%#Ebd0)YMfbCzn{59^k+0Csx9Ln;*iAN&hgMHKvya8Lejnw` zr_)*9eBnO=N~QqkY}@cCvS5MzLl^G^q7V?F+s%e#adg^&|FKDc?PE9dAr#iFS~xK2 zHp@TRLyAs9gU*T1J)h2Fu|crid8sx7`KD$0{TvKl4CbmpClc%R@xY>a1enD(cHgal z?cd%Y$rp~b<)`htZB`rh3ticbae*4%o$74`>31#ni5p6AZyJX$vP5rd;jeEuH`ATN z4@x5!zaQCwjnxc+9hY%$ujSTHflMphYj?$$fwqwqmO|BzhEsjV_`?BHT~e^{=Xh%L zME{+8DfIjBzT3E{>SvXI52>`rjj>i!@B3`djs$z5- zVS#t|a^9mu!XaBwW)?u`Vm2CcWM`Bo!$6okz_unlC1-*jTUnt75eh(`QzeaPaXn>r zaR(5FL=s#*n~8#lnQH@{tdYL!z$%8IY$nUv>~(UDgN81U$A4kAe}kaVU=6z*{b_*{ zh|}UIaZO}JQ{UiV9YO5bPV_e)>&RcR^cH$8!Ie*>!cxYxz(=*c!BD+Adn!d;)UF*| zySLU(F5QPQwfalca$?!HIuS*RNOM|K$P;K5jS>Y#?No zmD&}nGFs$|0wCkXk z745)WF-uO&Gz6bAPG?f4+l*^q^Yf`tx(maNhpXWe4g|%se2^*}3N-N*xx%}g8~mDs z`&lY&C4~BeS_Dq|C;Q@b{c%@ZVaT>o&#&u&-uf&RJaJdEw!(1&`IhcB_lUc*40x2{ zE_NbVc57dUL7CQN$=4jmDr;_xDy@&HhNc@a6XR>!qzjtzF=0R<$={HkEEetCYn`IONW!Y%k^&-M?}k zq=d`WW!f}Bp$cs${~!hjy_C+*MNRIS!683rGphg65223=W?;h4^LvF`Iw~E@SsRbQ zLKdL=?%61DEqhJre(flNLF0@tfUDn9vL?aeWWqdgv5{GmYG5l-{cXkOl-)==(8a6q zJ!I_)=Gj$2P>8*~sF5nZej&oG{4jCsd^AITk|m@lO{X*s%o<=is_V}4VF-z-VV%`| zZ_WWv4B9UDpk@MF;azkc!vrE1Lv6nBar^@d&tGb2694{Po%iGahFb*ob=|Nr??-0= zaNTcMgG2d$=iHKLF=*{HR9Nt~&j2t7_{#x8mD?)spkVAd+$XQyn1atz2f!ID{`&+O zs*0DOr~I@*)2S_|2I%?%hD)~|v^l2+zn^vA=-0g7@U5Ylj^w1-1s4~eqqyg$F`~F?`E-b2c{II%C`iW1W*8+1$@EI{#h2fok#HM{pAHz# zHhs-c=J6+{8}2|3e@%v)`V*Oqc=(XD#@2$EqX?|TI3-X>D1|dZ568UPIpfc2`ep+J z7UzAwZD}ivZh~Y4f^{Yloe-^>VG6#VgUSK^usfSfpFwquOG?-;=h2WPTn2CrgO@By zC}Qu}nm_(Thc2`T73_tWWIBEomc<%}a-O7Z1#Lx_URvG+bF3OW zgWKN?pJ-}0Nb7`py~PSVFg=-_|pT`g(3T=DA9%zCPUw(XZrn`jdPZl)xPJ>pi> zo1`Q9F?coU+emC(c@A^5?&Iw+J@Bnq7#inhcz;{&4ZZBBF5s|;3|fq2+Y zJgE^~hujIQb2YEY{`9AOZhNRiS8+V)Io$5|p*^HhFZH7*n@9k@H&(pYe6#$j1uP`j0u5X|i1moIms8OBFq zq=iN80Y5j}^W95(z@dgmqDP!$B{M4-$2UaK5b>Ezq1a-*6Se&zA-c)@^m6CAvRpClbr>#q9LfNwu1ZWH)_;HhCP;)uWhdHqOhJX0j%^Lp)l>K91k3Da zzg4@v_5~K+#Fy5;*H89})90#636ga@mYYfG8MN0HfeV!Ox?u1mTHW7z-1Z0F(lC&Q zYR*WCJ~$K7DbgX3aCw#9d7BPA{(@2obU;zf*_DSMKPF?a?%4FvCke_4FcK70h; zcV*hHc^q~JoC;(@-mu+*51__xsbO5kOle8m*bf6;3Bw`hChq98Z$ z1Io!5d@5NDN;n^;7VNP^vN|ddCs^aiFesS9?^IHsK7jd|=9yC3R2R-oo7H<1}| zbp?;p?eNniSDpLz-&~jxfi#gS%&km6pujmA-6*iz>8PG~#UGPow)5c>8@~SJ+sRAD zI!tgFyL1h|mrY%v4J!dP1*hcKS~Wr1eymk^2CTaH`u$EEm|q*QC0lgpbYbz1H*8bL zI8x-Utcm-;ytcI zQ_p-{X~FlNAP8MM)?cF#_C+?GMczIpaE^1+y;iB)WP==dZO>@V4TO+rv4bX0i{U4f zbnQpsJ1@rE0ylj_I}n?+hKtsw=i^(juOUAe*f)7XOzw`k5H(+?Z+!wEQ_h~2ZNE^n zOJ{rZ92q`rML7oG(dUGP|1~EB-mU!hSZ;9^R)0SW9vz_!>{*65=jwUGcOyk^p8SYC z&Fma4mK5Gi-cRbgZP|@r!?2j{48-4yUuB1*h-FzgG7ct+VM6_iRZAkQdvCu zr1Z_6-)EwSjfORwQ7VFiWNoCP*J)36(XT@WMc&AP|w$*GinyuD|Q$ZAmwSmq&p?@K3&Ac zz{f7=%`I(;@T=kD-mg|W!(;bhzGIsENU(EvFP5dc#JT+@q21&StSUtIF3`Dt~{sLR$c z&l58Txp8|54wQwyJ_l|z__FA;Nkf!j#D3AT+;R%MUO&5+wM=LLMS~P*F8mExtrhn^ z&Yb-a4+0U!JNZ2(sc&ghl#B<-`CNU*H)lPA@|lEoJI9+-MpH$1F;gPJ<=BJv9`fU+ zFCQ#RVa=>y0K|Yq#Wz0INb60nKVzvx4i(?qS*XvLtsld+viO)fP&dWK?;9Q%6e#v^ z4<9~KqJ#}Lj^J7iBRc}cl$kr~q{}`>RC{9)zVyy|jUx>ga6htC{ZNs+Bm)*`@IRFz zCY(0d9v&sG7k+l;*7WM}Ku*(vwPF4oZcH3)Tm~^27Q`CJKK~{G1@5NiK>!uRx~{U` z=#Bs%`Qya!!{{26Ov3%C6|RO-Mo>jXzwr&Ve{sca?K zATYw9I&ijVBk9qrdu=^9Ucv2mzUwj z*`E^*(_#gTC$HBdB(SoA^-|%{V@|<*JmtIBYjgRfMtv87526%zatKAkY$l4Z6REp$C?9^Ub zDK4sG>&JGl(&Zlr4vkyhcpgu2QDJX-*2?7~@j<$=tVuuYkD1SBs1^=KYZpA4G1&zt zaM!~%D~D*0gz$lSEGNxBE77K$9NaQ)vc;9W=AkbUZuW*6?bjw0@?|+n^(q~g`@(0i z6t$4epnfLHD`{(yss^#`(N}&-dZ)wa!V-8_ia}=rpORijw~~6p8$j?@WRWTNgrvP z0;PJna)>>1s4=MB^*UUR2MmlkYDHf~erLT<@xqTIj!Ou@WWyb32qTnq$%(ApQ~ov- zQM$w;x5yvtg1B{W8oul|$k_i7w5Dk%W7J3jC$n+!8Dr($R3L~jC)Q#1{GEFNtD8rp zvO8fAhP!WsQ$UzTg9_UFsQa&-PxCcCtS1+Y;1i6=tO z4KFQppvXh&q$lr5mEmf}IlI>;=*K%~}MV*YH$ zT*#M9XVm-v9fI;3Ya__^dt>LYrifNFZ~Iy&eom95#{d{9J5z+_YCtzFGqY$tE*Kz9 zXyP0qI}n7I*1|}~6CQm*qiy4@o8`@E6uCN`+w@*@TX^%wQALZ#k4qhxTVM{rKsM-P zEqw8G0>4@~cDY{h(|f%ijQ00`i;_Y}8ZT@rAI)3OB@vH%eBhiMK(*w9+-r;AQ^*AB z+*IQHTf+Z)0%djT;Lp?hcH0MPQt?ut`Mc`S+4d-Z+)NHn29o zVU#_MNTkf8n(krKIbYpE?*<6{LVb-nEik{$evpQ@`@H8MCE$NEW`4j0=BBpkPr0e1 zQ>v=S`btm5of7YI6ouQz^=)XieOu^t=Wuq!sBJerJBGU79KrO6n+uvBagTIgy^fW& zKX70N8oMs-dVfQ_vUuDk{vm-N8{nfGgr34|6YWnPFEGegihsQVz0`%+b*-&IhINF% z(n9i(+sV#^8zE|uo|*ONde}tm0o0+Kbh@0*fdD(}9?t3W@Aeqy50(8bDFh2Jv_4P)7b%bV=#6cS6O97R?IQ<(Vm#}foM*n!G~@y}DGz^K#Xd`2ot zx~pa94KHoLV`Dnpx12U~gZam>kh*69=Uz|L3^E~>t_b-5IWI)SXQ#RI8yJ=Cj~7cj zlZS&<%Z)91oe}VzrNEa(#(%-Ue*l5e928&nj&(!l+{p;ojz;18eN6nB{Vg!~+zgK4 z%!zdf>n%7QJL(RWeTD_8JW&*2b+wWUN_FM6+U*WZyJlNW&(qV$DzGiP8uADA zZllLiLex0TL7|h8qsf9vf~<&>BnCoL3z`PZUh`yb{<8Kt+E^DMCM_az3>wr9tnV}) zetf1VgeTACmWXuK2rTDHPw$Wa5E)yxaA+$aC+>NMy`;4Tn&8G53AKyspRe&HA@8nb zOA$H^P;%a|*)S$U`A&4%z?82_qk4QWZIFd^6jT{C^NmysKcVhlN*Dsv~x|~Md4U);dqZ2>FyZ$izuDAk0XCrMNr4sHizKeg$kE+f6eTP2!2##_eZR8K} z!hKr4zN>IZtFS0UBp0L+>FKu4em+HK(%GndPq{X0iMMwhjZ>99MI*Rz%0xr3G$%$g z8p>&3WiXx2VDv@?cg*5StE4@Nqj7;!vGMjZ}U|Qv2F+C$hR!D zZKoFD@uClKG3CLxrB(y?&StBSoH&o1F|_hB5^@~HN3L42sch#?Fx6*{`FYxvg}p35(p`??6c2%R4`3({sd z_osoaio+!YO&wEd!I%Vl1t!HI&*^=goxgH0d{|)kScSe9)1nDr*D5M{qqq~-X zeWw?GF!zgj0x4$FIvbNV;yE$xT^r9#AOaq9kpmm~Y|^ zbe+7$NdF7X2h(7kSd=WID~zeJX9{{kjfaawotoXidSV)3fbOZ-yp$Q0vcsp=_P$sG zkuk`eX*W?EA*Px^Obcm3sK+d}P9voie)w+fC|x;uu&&g%B9`=BkOTGzc}TOS49Q9Xm9_RaVLKM(DSY3ihg$f~d4<-bzU~ zLs@DIhgy)sTJ6;Kv%-8V<6fff(|%q=XW_|{)+#6yZtd6SG=<|zEU7${GpwyFF`u+C zv3r5&ED;lq4K93VuBX9>@g5Osm*7eBdM0m_GsSNvmiZJb8{P;W@Hg>Z01gxFASo5P zthq-`!kt+O0so)c-qReQMd_rL^Me+&Jtq@h(=#nn2jd5ipxrYQim+&}kDJ@;H>8Xy zm49cy{8%KEi$tu!D!X<3<5gR9g{wnUX>>qZeI=MmpTY&(49Ax58i%%|q3nE2a~ zhyR3owc@2N=)Oq^WxlmVd^Mb{MNk8=q%7gh+q0N@uT;G(V;S0wWCjotTJ{UEWuM!% z!dR}C;!vA~=`hjXq{%3{xMt$TK)^utFo{q1wr-lLL8-2(rZMd5sB|=MiE+0^C|=5Y zVulaenI8%gGkssavIAHB9MD_?4s8sl5?v6|1e-4Ua>3w_+>L!Dw+5_&Ck(<8=-GmLUHdt$eWsD6Jcn`JD! zU~Hjxn#uwk$|IEDQP|~5X&>x3FK(U19OF7-z{PCx$=2c&f^WI*8 zNJd<=e~x!HFQ%XQ*~lpX;|rqURW6OxG$RT`&_EQQ52mwOA~jOw8gXrrhO~FE>)vnj z7eUu{KUw=wWHa+9f0|FB%;gvKAS-U#)&Tm2VFK^9wG4tstAd0d%hvmu*-x=9w=huF zm7Jotmrc5dOyuDRWB*t0_$I3lblBwdv~i91^L@y`M2;1(9@YI)wgIOH{KR&4PzDl$hX(MSlUOS}ySLgWJok#? zqxG6PT-;$O(2LP#aX=h@af>m#d~;WS-tiH6vdc~OY<-M;WsU|ADEr;Ma%HB#1x}Mo ze44jmQDqD?v>a%|JKAsIgOxz?KZ8*~*%)R!UsF`Tsk%AIS+xkU-i!R4r?&$^_aVDJ zNm35lWm+8|f^&y0<-jkV`=Hl@yIq3h!I+K-zTKm9K$%_smR}dTtU>G2Po-Y)cdOTQ zI@UP3KA&M4izuY2D5^+{0KUxq#cTox{Z~&J;c15ud9MLiCE!7h;+233LrML#J9M9T zrJcrj9(6)o2E#K<3$bHelQ z>>9a!a7y=sxgD!yVlJIT85-r4WK+^j+cKcr^G&dxmGmiT%RZg%b$-I%!>lAe`5BS?U%|u8GI@F$#zvr%V@BYI3uLJ++4N8 z+#@pnZKx*MJo2$w`fS^NPXlCp}ejEzS@A=wtV@j7&be zB2mCvX+OvzR$P9n&T>C4rTm!}F3&f4J~nHG`$%T%RJ5`2 zV;|Dg;cdO6E47;u$K$NK2dnX0w!GCPzV)udPp@&Ctf`*x3h`=0e9{>C^IFR4`VDT| z&v3mLs9(K3UuR(BV(lx|hu@kzI;)&M@eVf&2n$~~?<(0c+nvc%{DPJ4BPl$fPC!zP z_Itv=^Hlu{X*uait*EMUWot3q6cb`ej&BM7r0t(j4IQ0JNdLJfXoFd*hy&)QhsSq4 z)XD}Gp0w~+;h#%vC)(!o+k2vu_W84Q$~qI#Dx_1~CuCnx_AvDuPS0rzurukeEo#0B z56qKsNZf_>v&r$V(uQ1+JrKPp=Poh7u&3BAzEARk(Yqwn-s`P!IL4(gGQ%jabNMB? z@IS3Z1pLb*@0y?ZOY-rL*S4|8^wlb(m*L;W|%P!B|v6ISv_hl~Kr3bMucj;G0b+MD%Q_8vOEbs%7 z4}?Pwk7Ee?V;$~OC)a=b5aH?pc%LatgV(G9vFZiRL|hlf(X4C1YiM_X`HX6v@oz4v zqDn35%Hra9?Y%+du9W8)R*!6y`Ig#sGZtyy%+bK#`x~%2z&Id}1mPJnt>%dpDc~sV zk1(y$E=WaVwWKi5UHpTkvba)05j_W{DFig=zrgk@UnxnBgHc0eRbLc=ZORk}qlq_1 z8?fnmT1_feca4m;*zLhgzlLXp{A0t7VnJlL$+fV^hD9ov)YLfJ!9G-{O!)LUN@h^V z>g<>O)ZW7G(EAR_{%_bCW~vlek2=cYh$fBEw(u6zUur?H3O#R$9B~8~Tf|f4MT2Z= zeDcYb<5OdS7-~4DgXYP><;7hK0T=33yf(dY1nbdqY72RP9;kFjMjP(d^*Wu0 z`x(X>z*F-1^*AWQ378uYB{UuUv{69I2HjNwo(O_4Q?u3@NE(Bmfm2LF8+4G7*}N4M zpw-NhWPqUIa7e7fc^jlIBewQZAN(#V+5vkwgy}Qx?`n8!?~q;aFY@KL&aZ#PV*DK3 zs0z6HuxdG7L%u33T381|a+oCzTu-+Fp0_R?h_$0jFKTxsVsffP!!RZS!i;)Rz}-3h z5Sd4KnnkR*=|(+wNJyW>^m%=q@}575RlR(S6Xpyi#OA6{J_PPx5^S97{%f+SuJoX-$bg4H*Ca z(3B}eS>0p!#pJ_VCQ+c6rdQ+0=a1~i$%&a4K_{D-`cvf7d5y#mj;p(TR2)3GV}E0U zTH`@QeY5CGVEYrfQ6ryRql1n>ZKneFp#W=T-7~uZ(JS$-eb@MV2qqKGR_$pM20x25 zcxp0FbB}xT6?W3PdOkmL!xes)vssPi#4#|X%_qz1A_^vGcAI4p>6INYL;|>=dR9w% zm3tU~=U0F|_q1LVy%(O!12GT`9ah-3p|m8%x(U$r4aGTdB)7de#-VMT86F{jZNhS6 zN%NL{Tz+AkWX+IcUFE^f8@iphaXH9qpYIHxoTlM)xNrpAG!{Z;4@poArwd21{ ziFi41HEZa?n=gB#2$BNoXy% zTgt-S@8ZJzqXveSNi_T6KzMYr>ur1!a&gJ!MyJHAI{svu!WkV5 z3t|8W8xfI}@m;TsyM+RMB_;ETIZJh4y}9wqf;#0Sp)q3`oJt?a!fZ2fts_srq{WXl z6LdH5ZmRe4V%F=l;FA7!>Jn%|W(-aUkEhI(Ew3W?MEOkJi2WXv0>CF#L6?B9RUEQL zjVn9+BR8QZ84~w}6|=y__hKL`cqwCkHpOb-BXg3EJj1(8RRY!=b+{%if(fn=3rhlf z)f2~qt3<|qXZ)OW4xct80V_RArD$2PqV~W#{`)kcL9Jp+1(jdV2MXHe$}$=nB4s3- zAJb~@mad*0TPd?FHXq3FJin)7&PC?pQ?ZN#fR%}nMWdr^)q-bEMR!mVy5?9SuyMY7gs{8Umz^eIHeRbVj1 z7)XhzRnDO@_`T_pM&g~wdxIO(n2MRv+ zq~ry?6rGVQgFz3_O3lnx8Td`Ux$`C4pPRjQ6o7C7!NhUTrNtm8-PsAai(s+DB<0y? zi3Cv>Y)=~2j;e~0b4&`u;pPKpZWATe%K#bJ!Q*9~g_d}&$2r}Ja^?GpS8*#G*peYIPX+vHdhZd zdlEFprXqr&KdwBi7w2n{rgypDBDm>yruWs9jdIzu;dXZi;%84xjivO7}*Vqj3X?4 zOcgV%kNN}}#^5<(ZfOm73F_QRT?yl;GQwbR7C%GOO9wQpGY%(j7E!hGhiP4hC5Q+P zwoE&nuf+J+AD;0jWM?K|@IrR|-n7Whj|>v_fx$TG5}U=ciy(M3 zc1V@cV5VhGLlJ^Ty4y&6NG>Gp*Us2u#E=C4808n`pWLnA16EEh{ui(KA8zq){#*O8 zTDZt!&iL;vQJ80Kq?M$q=V|9SIr-e1NxJcj1&5_Nk3R2~-`@+Zy~FVRl0mz>E_4(V z(SKhd;L(X1f|K(>;TOWUyPxRm)bBv-58zcH^Os0^X#XEX47rV5zH{V(O?LqO*9}d# z)1ue-%C1`!iD}i=w1|Ek*>E^l1u^_sr@`_#D_VuM*0Z1R(SMj-m7-=wE(rjZYm!4| zL@jV>wb+OkdD@u;r6A*!x=c?N7v6q#d%@-pwVazLvaNeEYt7*6rbMVb7e$Wg5R%A%Hwu}4m3P2(NcfOKTFel6h1 z_ldjEN|_M07=(8SImgdNkDS-^@8Hfc#WNtr@4l+%K6l&duW7{DrdC7;e)-&6h@WV3 z?Bdn_f)DBZgJ*nu!BP>no^eKvd!=~No5&Gzcrf>8xoAnW4)I+;F(ZnIVz{L~Ri*9WiP!$x*s;bT zmh{yTwPG~}4_+XKQsA7S`DPo0@wgD>42N8ngv)0{egRJPK2#lfk5)_<^(JmgU=q}c z*C;fY=Zb1fkl`LqrteNG3eA|>FY0@X@k3&CfZPhI*r0xmtR|{jkT*Lcd%?aa)$%xL z{2Y?)AnPk3pOcy44&k?_76G9#Kn_ULbu&cFIs6}bU|dQney%+y{_nxspk5Ajs}q}_hRYsvRR%oEy2N<39Iy4RI_`8 z?f72P{+$*3be`)NLkc(k;)rAruN7C^Ob`P=0&q8 zv(hcRqfKs}T*^`bFnx!rekx@wHpKcBf3)sUeE2kWa42lF=G5_j^#lKO1}oHPxX?#@ zO$)|P|CaXEN}!PozxyM6`?5gG^&K`gBI%A4r(udgb+M+&@WuY7%f-I^7n6+HZ=iB& zs@!>ah4Ywky0kSJ5{C6gTn2zfDcI)sxboxzrz3^OZ!yej%uUxZ`Bzf=j@gyBn3Xll z{n^-8GLY<7_zA+gl5iLlz)oENo0)`c>lOj0I@Nppegb!yl8QpBFw27!!q&UeeiU(r zu)`jMj=raAB9iYHtUwgB90dYIPRjDYm9K0C@AyjzyLf)4flvX+@&s4wzD2%GK$gv2 zjH&(JShdSL7P4+{co+bav4c`e^jRsoLDc#@O0h?3)>Nhr_!xOvuCMDv8=7yIFft_xyj)Sn0@f@*FXs0#WKE9LM+%B!ERTU> zu{EF8#J7_Q3? zuesb4sdp8D@hbt7huyk*vFA?~5n$>JDKyc>xK#(LFCyPjQ@V1pu8m{nJEwmWV{{X_ z(s$v3N_L1{iMLTjlEwwemaX>ra66i5R#;t&v#u3v))oZlW_b`%?=adspL?fU9w}Yz zSLA;$XY$bgxHJwLq+bbtAUMDy<+axboseDs5xrKMGsTq=!ZazLD&7V7%!=2}(;3YQ z4w5^r?B97i_IO74k;Y}^%0BcVRFVt?HMh+#4FSWXznqdU%fqzuA$W>>=NIh!aZ$D` zqH=j~*JV1+LC{TFf-%Cdq)EMb9zg`>_T+7Gp4! zn^NF0smB_y#(lwY15lO;$}I1DD9TG(xb|2fi2u z?9kaRcZV=F(uQesnIfcvGcAM8@s7IeKHy;MWBpwi`6FOsy;W6onlTPqYw6<63O1=f=8?VcnS{H12c6d?>>%gA8C|eY1eYU>3;A! zBbJ*hV|$`}O6x2r(^w4Us%%K=Z?Tt)8trQt^OtIQmzMc%=2R`>R`X)k#rTzzCE|NMv3k67w*HkZ zqXGiE0xZKnyIymX+kci_KJFz0bGf2o$?vkfE2_?xWEeDXYy0hollj@t!h4V3Mhh33 z|3~}#j|TWG#5xDC!ru;xy!)4hT$P3SLMCqH(|>KgOz`wHS!t;cPB?d}+Rd$zpUaDM zdFVeqe|Qqm3=95fHsdW0kzT?rtA6t&(qqj^3P{MZjWy!db7nRL@E53im4S60unqCR zh$UfIUbnq|icP*R+29jHc^VNB=Ds$YyMfBxyn3}%AYdIt1dGqnE#IL+{j?m!66Dn^ z;0t@%CLzWdfARQBK>jOchdN{)hK{yaf|N1QdEmDeJ16T&wuUlyID3H`#8dLAe z6hn3fwP8gxvzD3i`}nBU)p~OVdJTTLLy$lKsx?#>EU3oL+mYnoNQ0mGHe{J?zXyyP zn8EjqlCy?|dk1Kf)vDim>ZE0==j9Qa*_`C^-R9_ko=_7j5CHY&TWWnsg(9{&ia7pS zU|}WT33t0q(NZ1dICD-b${!?fnFMpMEkl#XmNyt(cLU}fT5~L#l^ot=CALw^$rl&I zx%>=8h#)w!9ZpTE+4d7u`U ztAY1lB%;AcS}{BzT~fAPvpYUPC~V3(!iP*uvn4r@Fiyyd_WRc~E1+PzpdgLPEvsxFu?Wu_g zZJLCn3`t)_->fCPdCY1~@3g16x6$70`-~bff*p*61x5mx0ipZI%TZqk)|r*=Tjl!N z;mXOmzw&hT)lqb=Qhk;qBf;^8mz4``gegldjnLyWtZ8Jit6zDB0Y|V3rl?tKPN5%r z1(SG@DKBwml{t%{bFqBpiN8@bH4c;=R!5ZHaF%@M#*<5tZp}RJRA(ZN#IjRKw;OfJ ziq*h|Cc}9vDAu!B0)zM`Sy$Gi%CHn<*i}Lj`zJE+{XnLs_FwzIpHH&ejU1Tg@klLm zNK^t$sxksOAN$@1PoeJRxFK0Y&w#Y6x4TU1;m36p8#iRV#dQ zX+a3*neP1B!`lC;%m2Xg|3LHfs(+yQlMoB-f1Nw{#Ag-SqdlIo6@`U$6BLyf{ zdV&RLhWaD+HxV#iXvv=UR@DQOZ_9YqQ(NT0^v%5G0q0b3wUzm7#xOV`N1w=;3pYLV z;XYS}ZF{*s#iev>w_imzFSQ$uf&lM`YBCFOn99#dR~7_8I?CYYLJpaCmQD* z8ge1}5ZMdVUH_y@6K zlgqAjD!qsXPzBWwZzhxwI#J8JzuRt_+q9`{`fNRG_BA^)K>MPG1%Mfbr-G}9D9`wV zV<`JPBM`s&knU?x^Dv%>+OD#gV$$UlVy`4DNCJIahi|yL=TI4~^#fKILOO>sv`7XZ zQ2{&$9`TU6;7uLD$>vMSgznaIX~FEVO(9A!%SC9gy5N4Ev4#Gb75g~$P(3#7e>MON z5OTiP2IRp(J_}w^x;(VrXw8VaU$(FG_v|5a5%#tq?3DroX$)Nw<=H=F@%oYDIEAML z_r$QqspQ-HSiywYIpnqqk_UANV@#f8QWQM=5w@BZr_N#=!hf{dH2>W8j&2|GteE!g z(TU|BvLsmZ%mg=+9ReYQHNn5(1Y0r=l~P$b(#^;ImUR^S*||;RN%_oQJXxt$!nuYQ z015k-SvO9|3xDypuVb8h_rbW?L;wWJ_BA8^igc#ir>gitB^+?yXUm%tr;e`6L?E)@4|yWYV?C-{n@5ky~Ye6ObO z8|UM*iMG_6zhN6Ei&J7j{hH-nTmndHG1+y1Z6hYB6(qC}NQb*2p?H)wLnP4>Pn4P3 zvLM$6eT(6_Z0dSTR<3I>Wt)O0JU~v5!Nio%Mo^FPVO=v&DRf0B7PWvDgj6&#Qe1On zmI!O~uKkEaWIHer@g~{-f>dAOGI@RIt{&(>6jEiS(19f{&5rkwqDS^MX4%bujqIiC z>xRMVJF_8AkuaI1tAH5aL@|3i3blQ^VN*XDg6?ZUisPP#Z))_7uHDy|Z5@>DBQtMA z*1;OkgxIbS%lv1kG)Ch~H0$5FVhX0&Y~Du9$i05o$9Jc+Fq%W!M|YZUww(Wcnk3%b zc%5)bIuZYxbk2@>FzuT~hX0;eM2fDKF2Jf8aphPNRwPU1rwtJrJIc11h5>eUur776s-NkJ03?~X8De0Tt^nsn< zBy)n0pEE~E{CI7hA?&NXAOzR7hyVt1B~S@t_gTX_hCuJP6M&sC^qCv0O*>cDOBTXHrx7?uoa^b2!xpv&MI_E~t$ zn3LZ9t-ssx?xfHDJ6mu)i3W7o5oLQYYzMRz?u$VKAJx4~KFep04Jo`9v28e-GRTf`8@G3IzfsPhikCI98Uo#3&(0*a+z#&-=&=xvNf%AiTB>` zi4U6U+LV#!9pE{)eJs4Q{Po21B@W;`$Trs}SJ^^|Z?0EaJ+h-jOudRYzJZiW6k-;% zxb~1}@W}7T*ZtSMLxwEA#CWc`?N8yKuAF5dT!pup7l-|qK?LA{yU}9l7J&Lj7k|zR7JYv3au9 zkakDPkHYv;LT%9QK%&|Oy6d!ts`}Gtm0=N5$IAF_V8U5klYdS8cgBIH8_a?3WNwb2 z!5f@HTL#1qgJ-wg7OOx$N%4-Jgw8PqBt7-kzC&*_Y?EltHgLA#uxtBN zdY`)?Ai%3{+W_n5dq@n^1nV}v#&DEBiEInC_ovv-Jo!~)aY7TV#Hr5EYUIVNNF8Ep z?JASr_lUd9-u1z}FkGGw824RkQD>yPkM2`zXNJVrcE*E!JTb(Q+4;&+xk!=9O2q1W zyzp2W;RF-iZdw74e`Y&0{@<7R{XdtP7Ed=q^*^}#?Di|AVW`LXxc&g>XTXz(t05&- z*j}B}eLq2V(YW}7Yw0@C-_M7_Nm$Wm?}sP_rvIW>Vy=xPyL7xe1ke-A>%#mD(iy0# zSO@NpJoclmU9T1GhrZtX72Q-|Oyd2qPX&63?Uy27hl${@gU<77;L z;w6^V_yd$uBG%DRce?EFf@18sx0l<4N9#;l(Xfuanm;27Gt%(`&PGob4aPb{5I?vR zSr3-kKNS^5LKV#Qj=%9dB6t?RFX;4Q61=3G6ZhNw+ z1E}6fBfCiR`UFUj*@d+c)#oSA#c}c!vkTcNCCJ= z6)5!tzv5yIP=V0ehFyefW_)7x{!Lzz7%e5cq&NCLZbVflY9;SS{{#vl>;^cPd#HTy zHth^QtEuw3(K(Kih9!8n9-c0T3(QolffePs4h`TB!7tww7!uNw^OX7Y6P1|?6@O1v z^q%OVOck9LH9eP8u)6EV~J zOqxix@ft4hLb6fD&5avAcuDl?v+T?PLNsfXZS_q7WFZPVpX%dv!03Nqe*>u%7X<34 zy5eS2dWh7@>I&3Xu?Q>(U@2N=?0a|Mfd@W2G+P>dYCOUO{8oz7B#JMW7%W+=iJ(Y-z5&GrT0;xWS3B z$|spk&S-u|=YfDPSE93_t{fn}PN;L6qIfO+2f5Xd-xF_GO(%yf-qN-=UkoV`y78Um zETrj>)&Xp@>|`g?c1ZLcB>1Rtq&g0FUu_AckF{+#m>JoT&Xo1)b}{d|`Rn@^gqlgC zVDNQruTdKOqd(&1_RybT?p<{R)(m}3d|lC_fS>=A)kpI$ zJ#EMcd0l->%Mv#|I0_>Gw>JQ!?@P1+nvx>Bv1g_IF53VH047yLS=r(CUadM!d-cO< zXSUtTmbh91!5xvYW6MBYB&!4oV30J3Iw14t`4jO5MlR3_S?Fo|%B`rU>a2$>y94pG z<}42OTT0sYaMxuPv|9y<86xZcDuiNj?3mFJXA0*D_$=QX<#|OuEpH=ehJ1IAk`d`X zNwtm|;}0H8h;*?(6{}&af^lC28kZ*IUG39%eY^ycckQ$@%CQK9E(w}R&&I2$<-ZAk z`3Bee%hV1KQ5QZ%tub9U9BY1Tr+<-Ta{ATIIu}6?8xt@aCQiCqg^ewe9=ne8IW5X# z5o#rJb%H&DhcOjgHnUk_(BYls);!Q^12KS-aQqPgx#dz8Nwguk1s4zS%m}vvbABbW z--M!pK=Y}DSeSm%!?-zjTWX1Cvjz{VkA902&(h}qtH9^s zGiQ`b&|m%42G{xW*G+&H)*neEc-gZF*9rQKKOwe+IR)_b7CFTj#XNUCX&8Lk;t;2!l_3dXTv6D7% z{LJOOt?$D77@CFmt453pesNv{b;=zmK)Sj;%KTS55cNpMCtBlEo*I zsSdZ`KlAK0`xyu!P2t@m1k#&qx7rbiV+Mu_ix!2`4@bT(M6yqv6HpY)#NCwxj7+kq zKEnkO32e(XRb7JcBm;~knsWyAzUZAq%*Qwr+?TqkA3u2QFDk#@zPaO!YM_fIX-+G< z{TdVcYklz0y&^nHlGlm8FZKRZoRYBCDboqfo^bQT}DsDFGYxj$0hI%JN8VjO(45) zlNiP4*mY7^{7&`Y^m=N0`)$U4hXlDLg%0960%1HcBM))~5X#g1_V|ZC2?F;~dU!Oh zATV)=l(mLQX|c5o3Qs%fyG?_J7Lw!V)zz z`9*@iV(*=Q?4~QoXDf$Op;>Wd$V94;Nv$&uCLmomx{GR_9i8AH=Xl^$dmU%iAK{EQ zu9)NsKuPy`qG*v7OC>K7X{Ej!M{?&9)#x^m{P~eJjc^PP1Ec7Icm>CEfW#Dn0;nPv za6(ZPz0ie?E!`<6pF9{=n@HQx{hMkomGpU2q|JIOb=}=Q&~^+Zes#;KX`tg^zK6cH zk7&Pc`Y>1o*hd;L_WC@Tvb4Skkn55sa6=3d)>KKh&ojTi-z(&x9;Zj4O6Kcm-RJc8KCy?Ll@IoqPg%Y*L&i)%bbDyk4CvGm&iUjk?rPd^_3C zwoVw41RvxoVH0eK43xPqlhaiMi{R=;`IUz3X>GS8;PwzR)VK&^?i}?pHRXgI zyecZ%orgor4K1qHb+1NN_Zmztvhw!Dc2v1OLsnKiL2B_H%Lgye(*x*N zdL%l=)_-dp9~XJRv@n4UKymueE}g4U9x#K-l35&G2&=IW7|wmxfN~_PWN~m@Ij$q2 za@m*PHAS}LU7}>9wX~VrxB7sQ=nM<;sSvpKy?N^&AFZ?o(6i29t7$RgN=MDu&BnWG zefeihB@GQDMMuKh?eMwncdlk0d)kufHmFah4#!SuAB+IAmLcqb>iVj#^u=Wu$YeCn z{nf42*`2z?6dW|0aaw|yP!}92TO0~t5FA8Rs}E}r&yoUq>udd~6x3oBU&Ychp^^T9 zrjBJ+O4@X{(W$twq2nLiMqXS5@fF*I%IM;O|7W&N0FP*v_2CpW+Q}jLpohGa5SRmv$F^t zToRjBaZ_=Pb$6r$m(-`V4&ipUw-M}8pN{K!C6jH{SX0gS8A+w(=TqOhAF$4LKL%@e zf%M08(gtOJ9}O3(t}_u7eu^=+Wfey5sq2KH%1`!+ z*K2NDOJxuh(mF*p)_nM-pPw~|^iy18_V-&hLZ?sMb5Kn;8r~E&tm0pt26+n>6#`a3 zl`$Xwe5A{9_L7HYS~1MY`VAzXti3G{P0!&1&HpQcYr7URbm^DNkC1B_p*<^AaOz*9 zi<*_0Ohw8gdgS+7Lm#k=dXxyj850EApr1xjq5DBEPK8ZE)w9)Po|STseOcA`$eGvX z_U0rNYrqb`5F4TLA$A!?*m=ut^T+la6x5JXkuUId^WNw?%-_A|%e-A%wSKigE z;*H5o?b_U2@V?skWib6;%h`YUXZ_rN_~(dkEW!WfpC5VF%2=z0+qWZ-y>kgdwh1-qbNM zxSwxf!xcVYVY1HKNSEC}qr!s~G?Bg_;M;QWWaHSrR9_5Zyopp8_Tx`K_$5OGqMaoW zI_T=Ahu)9=E}ODci0)EA+bFXGsPo7NuWY0*UWTy0qqOJL5j^i6Yl!|f~nvc5ZVd^nnWH4=i~;62z9B?Tq* z(ZVM>zOc2x(Qo6Ei`0Xu9gLlID>Wl`z z+UtiNw4Zz&IW@@0U#}P$Jw6j#^>#hUO0dzjuk&6Potn&1@g$YCtjBNXB-{FP%{C3c%p!X<{41*t=I(7MU} zba}eV2P1tR=AlVPq{9E>0Y#-@6wS9RFv$f?dyhE(fp*!X5^OuS$geVmz$#!LN76L? zQa}32#`~Xi>Neqog?yA@tk*zUKjn^zz!6lpwNv%T5caZ)t zo&KW)yLKtn4Db?thvf`P;i3aL8d$EMw_0D&mw!$eEE$0)+rxM$nuk{$!c^>f#*~dT zA@d|)MtRDLJMKwH?`5@@TW2FleB9=o$hAdzEJ(E7oFS$Q;Gu4;y|(uEw&R|l`8v9; zc0n0}Ln6^_MZs?T)E&O7cw~V;UuVqxAT3%;6i8_x(tqAlseP^m|CL=AkF7j<6m(Mh zdtUo$Ng5mqo$oA^@`KMtOK%|rMO=Tjr)H4dE)TY8F|+9Oy!=V=w_3Ei27-3HE|FGC zqSnK~Vu{na-$dLeA$G(C26)fNdzYAO{%MybXhxlaXQ1-&Oybfp(nNr7asP=>8@cu8 zWneEji$8i1!OF!2WBk%ZF5zP3qXdKU1h!3{$y9aXtR= z(k&!Ff4co9|JipJ;^}De@rj{O>#IrYYn`9G zYhl|V#*ru*BpC(FN=59sEeNM;&k>BZ(u|~s3r31VWH$sDX|7QNfKI=wWcM$QQk)fl zD*#|_in3it1E`X+g1j9C`kvx+*)#jDjf|4c_^Xp^NZ>Z@N<7<{#Sr`-+FUvS$d(bf z;$K##z6H-W3U4Jikk`->k-qzP0d098s3;betUT4W+?tN`e_iD#!mbw2T zKKx6}oY&R?*Gipka=Oax&q09Ys_INN3285{-+GJ|VyclRK{0|^Z7?(QxjxRc;6!9BQ3Ah^3raCbSZ{qKEh?R73r zb=6#aw^MKR)7_68oBCK|7>epUi7nUw1C@&wW2%qkdVp1|q-a$2<~+?i;n%w(y1grH z&8|FXv;*T-bvBmh_}7?RRme6vAp^-K^CUiQYhdQNW3aXWZ{l&coc8UOkoS^rNoZ7n zJy<9BE3HXkTDX_l{Bq=lB4M3bCpq@(l*;K53gGpC*Cm+}ATae{!aDgwcU8T9sbG$ajjjvRj?H;Awghb{ypP0qu9L}Gg z9fM-dJ?=^UVaT#xJD^fzt}*`>cEFm8(C`ljz_#-`6|u~P zg2R}Q&_H{4Fw8itOnk5%nr%Yj?B3sPea<=xUM5yJ!OZJ@J2(agA2Kr|1%n;Qys0f< zC4r_MUtGEZ$KTm8`=iMR|2<8H8HcIEGK{KV2DAp7kukN!P#(U;Q!45m*3x8P!BU5RH%f#dY9~9mP_8mJ%_+QB__Ze4)1a*XF2a~;4v=<*sHT}$`>mjbgm2lbB!xmyOeEyi-rVW3!%1Mo?6gYLztgPt#nc*x5$d3v9b0_(>)akK4CKtILsfYF&kH}EHr$S zP+CuIE)Ub zZsOM5U#5nWGBcyPcsJXXBg&OD|2*n;Dh$}@)V+op25Ds_E~sUhj!3aXj0-+@+0MB9 zR3wABXN2iLtso-U7T0Fl7F)Cv>A)?Ux1tdp{+zM-Z}NzL$t2d9Cf@v(>^@2+8~&rx zd}<>=VwrbG5+(Z{mg2GM9suIf&mc*K#E4Kob?(Uz&_q+Q%ySg(%%1IT`*_suq?oOy zz{1@*9$#v8>NkUg5WoFhq$)ftCw-|=@W)-J&I8Bqg?lWMS4VsfK{~xOJ@EFTtxpNCW6Dwv68?mvjc#Yl zt$!`GMB6M6YH7b*@=vv}WWq|uddczuoSCQVjNj#-bp)Y))-gtZ_K%y~P^1we)hR%B zpwminO|98{K0jwXCM7vzWWV(GkBSvwV2VXFS?Y#&7$ZPxgvm^Jw>Kd&m&6xzTNV_% z<}7cThj?R%{mp}Y@9g0A=4QmE(g)dq7LkmRtn7VQ5v)*LN6ve=I!|`hkaz4xiYuu8 zRQ1oc2S5o1uSbiUqhU@1v8KQ4k$0_>;zp4GdTc|R2TSIf-ZTJUD6kGrbhfu?k#LbHsR!5bzs0?VnO&aGYO472gB6ZtcloWFipo& zly#C}OH&ai*k_6Pf?S>VT{6y?@v(8!<>f*Pq~#2#;($3AGDJOp)e1jt3k!>!h1nT* zczAANi5;q+_9W2Q>ZH?Y< z%R$FD+d9hjq|XMet&6Dn*D_ABuR>|@ETU>!=u11cT*c9epD;G)J?`uNerR!w>DBgD zsmGh|IwNCR47M?7I%`4=pYwMNj}&&)Xv%1z6WN(@@`-G`;G>hjwJW$^jhQq)U2&dh zOJc^OCERcos8o^a1}OE5B%Mn(kpt| zM2)F*NCk3O%9~{=7P$wWtDG(gjP3B4=pK3KvhEK1g+fGW$hyPuBD~y0FgxaXWSQM|beNr*K;jau3k zFLf);_Q^4wN<%EAU3q?2a zw34^Q49#t|h-=S$zftti=C$rhJZ@5kjQycf=3y&VHjDdpa}qVZ+!1$x*sFPRT8Qfq zU*t}#_zNQvzV*Ur!BHpJEN@`2LZ59W<5AphyQ5#N&!6k}cPg<{j-$#`oa=Y6=;~9P z9e72=+f56UQWc(s!ll7*@2(bh8D9xvcM7Dwt0Jg*9+)jt!34-qh9k`BGk$P}lqR9hd?2crQFFDs(O^=2@Wc2Isk8u&UXk~hnV0VK#R|h_ zm&Etp-#PYpl=?0;F7r)Pw^E<|pY0kv9z#%stLNu%w!)aa(iUBR&Nr}^N~m6wHV#}m zFhD3+ju(JPLq-~SYS}E5EDr@IFS?%2e5Rd+vf5W800fk1=RuxuiJL;BEXeBF;E=oI zfn$ZlqSvwRqM5yMO#4iQZTVdJGvV#y>&HP$(lTO-TdWnnSZ=XoRl$)MJMY-gueaxQ z)HfbZhg^atHQV3t}-R8el6EeDFnm+zwRt?6kAEaxx` z{-f)HOo&Cj!9=iuFa`0&!lvFp*4%W@HV5le+-=8zdKA^`>-qG{Nj)H|x)&lq3sP}V zXjz(t6~T$7NK!Cyg+it{h=lYFlUW}phr$xA@BzCMa0D|5uPlQN$5`gBN0lEk_0T67 zhVS2eBnp`~S{>O7r1-T401vo6P;O~bxZeAQQG!s(%dkM`IBseH!cDFa8u> zZ5R-nj8Te=iR<7XQ4uAd+~+rrufT{7klv`59&KvqOOW~P;$q-avV@!XCLF`!Ry~9f z`c|U-&c8+(8+=dKe%KracH=42GLbjf&q#9|Ts{PlS{*Ujb9)LVuBOSy z9-SMkR80G;9Ey-xLS}6b;qR&#a2G}o)8b!k>+g2ITas&)P`OSb*Qt{mGSpTvu;3PM zf2AWVST3G9${V6PJX}(b`PKc+TMw+GWsfawd-#saVfHc+Ut%J{tJf{*Q-&p^(>FTcmj*E%Kj*=*sTSMTHyppk1){IFpMd>J-udsf8Aq~(wE=4%TsDNj!Q_r5h_ z+?J=?yU&Y>UK-qE`nbyjB(F7pGOv63ZEoJ_Ewmc{;BNd8ua%E)vA0zg83ks9y@7BK zJ1y2{?tfXFJq`+ThUaagxVa63rz}GMU}1GL;jLDugDQaV(~`E}V^|oo&khOyvB6g_ zn+N4l0cG>2zx#)OFfvj<1gmCOap_MxVFS?EEj8j@=PrrtbzyVeDhZ3qRdsF=Egj-p07)7j2Luj|8tRB_^(B74GL4= ze{1~GIM=l}v|68FKj zC?6I)ZOQo{3RigM^ooVSUR2lkEl9&i)~`beDR7Tx>N~VN;nJ*g-{2=8c8<9&G^H9| zr|$O5TzJdlIXlDwV43}Oy}2L92oj53@yldPBRY=3I0(-q?7LVr2m@aKTZ`VS$$}Gs z!))`?{?>KN%Y={12eK(9>d=U8_Ky)^14fHz-U- zDx>w>{=16oHKizK-4=JS8qc|zy88(Asbo8yXI5^@k5!-I@sLvPk#$1QebK`_Nko<- z@$L;~1Qb6vfV+lQ$pOD#$&u!7)1O6}ZvN#aTUi58}7U|yQM@B(xxR2GMC224Q2p{fD zZHH^kGB@Tjg(yRkeUk7ooeucOC#XPnDtMW=`|Mf;%@=kkq!P9(^Gte@F#o$`-qbj` z2>*PuD}lQJv9oN8e*GSe4m~zs>BD&pdi0YwdRnlYnC--xh1eX~0CAX~wjy{i>BGV+ zcNJN76P4kM$<)UknSn|ocQbZVUL6lgGVVzvem9TKo_B&#(V2xb(mhv(^(m{5J0khS z-nj_VxZ&|B>xRs5aP)ZWp_@CaLY)Cs6c_pfzdLO75AWVo2@iO$Eieebk<6Z!)Mn>&||%tWe1(_s5?KTV1s68g+L>x3 zwwZU>W~xM1wx}=g6icLoVUy_|$=!ybI_`yE9kU5{c1L0A#5Pu#wQ&XU~+6}4rNNzrc}&aoGTuoaySKT zn=q(&27*<&y;Fnn~zxT}S4wkV}4utK*gdoyC7#LpA+1ez-6Z9!=T z5zV8634K^*BPOL1_N!yQ-l#d5wZwhg&6&me*8fe&juI+=Ug<-nlKV!vT1_Bza9E|* zTf@5TgJrxi7kK%x=0O%vEaGM?#03$zK8U;&I#5DQjqT!B6RaeT)NksV?&;{pDz(q4 zGszCjvAe-9--3uuPU!tCmy1P%3xK$`N^gr*Q2Ts_V9(l0!IUY4mBLRN>zl~>WnAA* z;qahJfM*4zq_b+3xA5>?)UG~9{3NyaxfO4Ps5rd1I@{;4Z{cIT3|fFz*vGR6N7~bu zxY`d<;^dM4_gk@RfqSF&EOBK|cgSSRtRE-(v-D#Ix_8|a;QyjkKHhXS@V(+C_Pb|$ zF>#Q~mIQ-UA12|``urc{Wp$4NK`=d9L0_qHKy>3@xCegeX(J{~`A-6AP z{NCOo;H^}ps&yOde7TN0zsZwTUjluXk~G8s^RFpB5R#$OV+vT^gCKq+5g4ZrUhw-n zt;|&M5$VKLtOOC>ecEn7QPyZw{_eSAu)g=(AOFzMeLXQmOG46Fna1^?4;FpY zRcf<=WI+Q>vbG^E_>=n-Ju!aY^G1KH_X@qXbXeM32;<}FSa;CbNpd5O9wgL#qspw0 zHv40{!PiuS0kv}SZeD^`%ysayMP z>rxq%n_g6@7)rV_{u|XR4?#F9q=jJFad;^0_!UXw$CSON|@rd20T zgcO&l{O6l!gY#x!$a#AY|El%!#Lfq_A1O9KJILSyKtEIPfpG+#q!5f*JHlsB0S;zX z1hYJJ1NEAlbjC6DtS=MIjm+2j42?P?ScG4UJTJD{l3Q55&$h_Sq+8rW^;X*-6+QPL z9r7y->a*j>+wVkUp8V7G&<-6_1@2KOQFoab(+%1L`feFW?3*gSm>}>!R86Cl1HOHq&f&=2QWgP7#`cEla=jZQZcKL=F4DN-+K?vUPJAyI@7)>=$JM7 zI%X`~uYoPA9!ZD&!Tm9gbs>(D(%NK0j?LX|$@8FScy>@uvkTy*_YpfM=YPBaoL$I% z1s8{88PUG08DD)jzwbegFFmWFz}{xP`+ey%>G%fXVgri4(rP|#yZnR^&@`=;sRu{S zppwE{r8){fah*iR;(HmmyV8;XKl7_y{MTc=y*%AI8h+FJy5{3ezs4x7aGNV{Qn^ph zYF7B9p0cg!nJ(;Jub)o*{od!GkVI^zx_DaUGKdtSNs#RFpH3T;t|L)&IHrv~;_=e&^ zEXZz`V{;YcqF1R!)>vAedRo77*}?eS+A&++ES4+cpr7eGk$tjQ;ZmhT32j2M9ibeE zfk{hY-;g+;txj*$*A%XF{IT`JL|YggIL}fZ8~+UQ)92O zSP^ASqHpm{U*_SJA4ImJyqU_MHkr0(D$R*yLLk0m*uD}Xk6Wa_Is*FUcy$IW6$kBM z1`c(aGi+b4cq~p2qBzayEA$hZZh<@Wx_1nWjdiHFjIBhLzX-L4M{55Yvq91;OCa(Wen0v3-15rIH^E}`1!jn^6PJYio8V0Zz0i&J}{cPAE< z(@BJM_;7j`tXx^^6Vy>iXz}g3@Q+i87U+N&6Kw&CAr^9t@r!!;gRz2G+>TaI+ajV} z;w9RhCemR^kS(9)C%prT>6x8wZOTbhT`S(ati{mSlxF0Wqy%AkSQtuoVh&@)kfYcb zQQfNdoH1UB*aF5O%jOKx9KTes0aE*c$HnNMIZj~l;E`%RHJ$iNz+&#?m`u!>y?-L8 z;qEB&J4_SYo$B;-&mNAhovMpCHA#*)^#1@=sPfvk-G0(Fp{^Twrk?x3+vK@S+1bsG zzf$F=IM3fXxz+r052KNVDffCTsOqU$=XcEc5&X$InDW@n%Yfq@ zq`0hbn8VYUVxG7{_00lEb%QD|D%%G^gz16Ii4}@^>xj4C`_|#OMRhv^@I=E2vLk-M z)ab)7j?d^jR0R0C&{=e2O>kJHbPf_qGBjQq1n632o`g`zSyXtRpJ06n}$fLqE(B!kFS0)A*l zA?)L#l5@aP6jg}7k1KGzeE-^1m0zB6=LH@O5d?^6qDg5RXNOG>^QuO`;SZg`_+v>c zzhzo6q1D1$H>luXdiY6_Q0o&(G#u^XRM8cVXw}W3LIBZ(C2|#+vr%6bVcd&0EEYdt zXkpsoxpK$j+5($k_UUj?3bdUe2KT*|iJzmQ^igw`i0adUQ~g&3@a$lefh+e)wxs6| zRv*D%(qKI5)6?1Pvqe7VEUVn&i<)$$CYNm*=aA4*#-RRL@!OK%6rH9w22V-~FMJ7m z7MWvRL~}qi!zciDQ>5W`>Jby=)NrK#xp5V+$P?)lx!tMbb&oGB8dFW_%FE173HZr8 zmKHiDdbJ89tDzuf-|$=iw6rKRS`u{N${a|`aqCy<6$Fci?%y{e6&@Cc*|Mr<1vj^u znV#HipnQ6H&--5K(kZJ_CL+qm*ay=D`FYrfwdE_BLWb|7H)VzJu!Nd$rOZIPWm{RU z*gAinpOXLb6nJ)v=?Z;#uL-=}!YG5hPP{Q|8h(25E<}Uk%=?gE2f@#IBd@RGtc@${ z%`-~!=V)fZ@9o$c<|#nL8nfEpFQn#wP$T#}kUf^_wDzm?W*O)SaYsWK*8T&$H~kB| z594Nk{s+7#iMF0y<}#xGg&`@=YPQt8vkEln{l}ju#7~W(`N(Uk7=0(m&Cu z$p_gn-D6q=*y;M@GcVY2(+hsC5r5ccb%BnXcXdM(c3qnJDA+7W}9Dpnu zCwsIxY)nJIym@tbXfr(CyGl~kH_pyS@DiOF(`&FhekQ=R3?HEKt1PnKk|XmGf&4bL zuh-$_C)FoAz2+;}BW9O$c_D&2uNw|oFDQ#}Xfd*5orX|?$Sg6h#8OniMg{F0l_9qO zf3jcr z(Be`T%$NgmfbvwmH<95W$Y7_vz-^fgU>87lFx4YbOwjJ(KskP5BpF@L+i-1B=R<|2 z14UD(NmIeh9DTw%F-HbHXfA+s^T=8(-T$-4)00Hj&@9u_y-~e|B>mt4tFYg02OI zmyz39f2*GTQKcPyci*(p_NhlE>uA;@Rw0q)y`H@!}%%YO_5$WJkqg4cjp1$^j?i{2Y4-$; zrtsI}9@N$A`<4kIpVXgYFMMdHuU4sF5chduA&lM&EmyV&%TKg6YcH(CRGCGBa>p%l z4@rJ{jE&b-sZ=<~|GSKlaXPg)|H1X^()0mOFi+P!`ePtWF!UZ-EX1IUCTsMp#p~uu zcq+0>x^>&kxRb%R69z!VvWGxDI)v8k65!Oo#CEJ3zYgL#3wwl3Hz01Q@5<%J1=QAN z*!o_@SiAD&B@xZhLUR$_yp_z=MO*?ay2x~}{W)soz{w1UFtCOrU9kc_>&or??^`Lopdz+NC39-~t zEBfw6O;ZxX+ziNS|8cC!X5Q(B8XEhllRajRbRm-hRfviyAd6i^78id%bi>>`S*o)a z2;N{qV0qiX8^QAtTNlv5f+)e21RU;xI`2Cb`RIKn*$g)O^+S^0`!G?%8_D?)Uy3ZF z;XPLpZQhHg0`XsmEIQJ)nLTZFa>~gjv*F%R1KY&VPw3G-Ds8|6wlj3mt%V^S&(mh< z;5=0Xlu%*jMaJI#^%3f^Naw$@nrK-DHV=X$=7%p~T|@}Dc+X-df)a6lh{R6f!AkKc zw{I3I)!fszPA|!QUXkj<42wO4v=}KRF>c#lguxsHB%~!`pUBk zrd|p-P1db~znq4(^X=s&z)M>3=S=;ie4Uow(f^U|F=4vfci!>pWGV8*dpxQb_e?v2 z&sqXTwD1UAB}K!ZFIKs|QBn!&LZx%QqJm>gRC6uV{vXWq5Au2YO@8CoNMip3j(mHu z?zjiF)HU2S6bA0(g%qVRL=^IZq%AtWTI-Fz%D34YxOT&WL_Wj(x23w@^0vg zd~P0Gkd$!Auk*}MceBZ^z2kDd!nBSTI}7_q$X{pVGA!W`1uJ`mn~rBmov@A4r(u@M z4J~Y|-&1)Ii_xpUGv4wV?7uMmp{M>J2T}+ClS9q&v}%9sW`_{48g&M2LgGckL+$wC zvFI8qnyU-n**2|bPOEK?;$6^0=w{xv0C#frv34wRvj;$^Q1-3DEWS~hHEAglyNb1`xep2IrG<`eud9~UZm5K zl~9_LRnn10qKo8lLO!60*1zU5SSx_wLE%~4h>3li;0t{7m%ng>I@ROqrE7gE(1=|% z0>@JvzoN^wG>h)UJCtHDAO?tjXjV_zGp?h`6D#~zGgX#Bfg-dN#qrrHltAr;YwBsY zt~g23ETPM0_QMvv=0tHT4}yKMRamdqCinXh#UKp?7l?{!X_D=iuv##3B!rJ?l1Oh! z;^ER8HbPH~Wo-E5?me3Mr7)nK&A_7Noc7w{F(A3EE~SFVvn~P_`Q;M1e~K0M%Z-oP zO|G`_K3i7njsQWdW43^rir)kunqi56H-#_2__WP^awm81)RWsESA{yc%kLoXHaNz* z=KI7gQ4Mx{BM$Ye8LFmySdr4z{d7R0D}Uzb6v+9=ctJ_4Ie(!!KHBq*Z~UwZ$4A4Y zb5r+Q{uYBc2~~2J_9902H=P*+CnRCo-Iryg<4IMMB*UH*d^ae!_NH*9idZJjc=CFR z`h+fICh6=p8EhtXw^QJ7Rbu0Sw#QDHf%WfmK{(v1+FL((Y-sQ zKE<&3vpllt5D)*p$3MX*Dcl;ktrDL0gd9rf9vRUy@jMP4dDYR9pL(Eoo!R0b0(I#qy>nUqvA9-~Dyl%1VtuDaO z#{gPqwo$YF?c~3qmdu@?2h(PD&4WY|D%Mv&Y6(1A7@g8D152d~pHbX@+>ur>cqh?Q zihN?Xo{&*h)&M$&yk)a^>;XPN3Y-?%+usB1?!cxyceu=C+TJ6WQ)iS(+7cbGL~@$` zWMYC8rZ3F^BR*f@;dWg2`{{e3xXt^C*Lz~BV9`5cK882LsXyW;mj1r_E|>3olS>-) zhwhTK&qCTb9uRK2Hd_MVj}DH=&@f1f?rRZ6vx25G00Gcn*53pWHmYWeBS?h#Vs2Hp zE+VE|zQHqrZkVcVXKFkH>T|#q4L`~Wg3#mA9JL!uT2L6;Kj^Hne5eH!btzh456%gA zrZ)FTtdm4Ih-F-*SP^Qe_ZiRB|HKg-_&pCOSzh#r49nE0qPqP=>`%s;+>8Ne@olZ| z#_d5`o8e$2U;t>%tVn$w84joO;&^XZC%1~0bXg;yjcxmI%7VrsqG$Q+bHD6Xpf^x{ z`do3R*Hp25R}@_S7Kt9Su2Mz#6FioK>ea@xydu9S3R-uOzIOsO<6}_tQxZ4`t^*r5jf_oIO z?&s~@-<#{-;G+{$3~HlCQNjqf(pJN#mG0DO^nOA=)N9a)PUo8=Wzd(p;TlaSVgKgS z(5)@oqbBFzO#def!ubBH7U6~Frmz8L#-?R}$ytiNymxl zbtH2(f#PoK6@3NNLHhjd4w&Pi=X$e#Keqr2*74}1zETk4!t!Bt)y6rRHU~|`=sO|~ zdv4iBz+LT|@xy~br~W86Ga=xpuFG4|!XCFe*Us3d2=o7eOJ|Rz!4v`i6lpn}WtbuS z%B?DF5(3LkGv7Yb*yQCvR{li9S7?Sq24tT)ky6QMPk40&&4K8u$EtM<6bO&hMGK(R z9u}smt}#5%ML8T=opGCt(tA>Eep2c>`i4^ByGciMZ}+wB1B! zobRV$`~yp7Z6G-dm^D=gt%I`F=N03RVBA$dW#W>#ZcWxt8}!}cN8Emn5-u30VKB*s zV`3spQc9FXf|*Ba5NGu6(|pB^fces6u(-S|dx;!T1+-K1PXw;dJ5L=UZIS~F;u!S5 zev>9HC$%t(-2U-kbp6&nzSz*PBXoL=t=TH8C1SfLF*Sq;1DM1p_s;u?YEb3GMPt@$ zbe$Dqr~4MGqpr6u?pQ}Mh2(1oZl@0JEDq$)9m2h0LMw!2D!;Ywx442neWqMAlzqzE z;?!HG!F_F9SvASFbhWC=&j4%QXEaiLgl3u}UZD$VXh@ZVD5pJdn^nM2gSH5CTbM$` zJM-gF=sw14{zI2bRp&a4ZZixUv&KLSvzWShpQqJA-~>X*CBd)vJ}B<(!&tnjkp5f-yI|NOPc%^gEoAS^YYuY*l?7Xx1(=Ydwg}%vc184l?%xR|N$eq%gY_ znBd>m*N>>#`X8fL-4^{1seQhQA$p%F6FqHTRDSbwL{wLMV$yi?svcA$Rxeaw3`o06 z&{g>9%*$`c)>1y*ap{CGSW$?kEtD>JPZ34(;-v|6ZA`)i@CvnLQQx|%5bAaKT&Kp#L*HNDiFd0kzVI}+guDlJKn&H{`@PiA+4_-20! zJ^4JuGo!x4#DgJ6l9;WW9l?!Aj0;s38>ash_@WX5Qq}LYJk)G{EPah<_B+cuoB9=0 z0GWq*Yp=FUg@T|m$6{ouHk~YA3n$;cMo)A&QU)qW+*Goji61;)%vgnJG<9BuJMy?4WQY zR)(jrTX(p(KL%=ny+It3tbX+2s}v)|=GD(OMlJ-F=An3YK)6b`S-p5m*tg zyZp`w5B_S5A;k;IiB6;rN}!eG*deA6M74PA?|ud z5QJvspJV?w;3@fG4nE&tC^b~iH#OC#tjHk!`B=waX#MvM*LMUcSp%(?Re&P!bl$jA?whq%Q3XQ~s?LH~M=sAB zKYDD)Ab!KbW?Fes{SrjH#X(RwgQ2x)`NFH1U;N_dP8@tbqZ`he?Da%DJlrT>)CLTR2G_=Aaz+BQek3pTP{kM)b_d(GPHV#=Ockl9h-Ug?hI8Bt^xd-V12p=f-N!YE#tRWEXl zbxxl5r-`Eh{%AT5ldG-3AZFTPfsF9-EUF+%5MsplzRrEkJM65jO3%r)?%(z)9%!hE zLjA7~Jqgo-<&y~Dv+2ME2&z8*n+ZDsZ3-xT0!T;t2)%2FbAb|4j_vDmeoa0c-Nf8y zCYX-1hS=0IiLfjlKKx}^gs0|di+_?e@!Qa zDLQ%)I#Ba(Ulx8RcmY<&fXdyR2H$1WMG=ln#w<=XL%zwvQ}b0}aB1q#HjD>?N-J>f zk(W4i=Xs_aw=A2lYW-wdM4oLlk9FkCQo9>~aGkIa9VdeZRK(fe&xqXJu|(`uKVapg z%!)oSw|g%&PFKU4RR!Wt!l@nRkE{$^+zz=wKO(f~7?5B8MNppDvp88tgm-apdXi>5eRR;lBC#92P^t15ZydZ=BP6eUHC0Z|kCMBz&PwJ~z zb@B8X2Y#^enn+)*8@T6>812 zi1Y52bl0Xu6;n$?rc^UtNctdTj_Ez=6a{-9VzLR--yA<11Vw&m6lkPy`HO=sa6Q9r zKNUz?*||)OX-%#?m4S5YdK5Ej503#{Y* z!umk*q*@GjO$nz+jOJ_B(KDFEZ#G_fcIiSQMgCd<9@TVhp-S@3VkOb3tv1JD%CDD) z9F#&e_gEObNsXGCvx(crxxJIR*u zpF5`bznF~YGt7DaX-d`Bp%~Zza~laWD(O=~<@%jyNNW8V`F&u?c~4J~MH*cbTH%~! zTf@3Z=7`6T<{uPyAyp+HHHF0`K}SQj4uG7#kb{TkM#JP;vHAM&m7$(xb#|VG0YOY zgUeP8xn5e`NwaXuOKI?Lm4+g+#OdIkjb1=qFF2S=e}B3u_+ho>pfmO$A3cC8Ms$nU zf!@#cf#0LC{mOGG;(dqbT63hH(2tnW+6XV9A#fO`E!DSW>m;uAC{18+vA<~ju&WWm zpRP%lz{)-3i$kFYP8&9O!qdLbNan#-m?j6}O2lHOzfi>F%mv8ru_8pBX6i*lFvf(b zqnT0W-P=>Rp}dt#EAWAn(fj&x404MK$&ejWnjVFkaO|O2Kkd1wK=PI^zc3?XhgyV; zP!I6}ux+xJ^@Zhyo=&*O*t1V2{q)P=P9$u)g&^4U7gINRL@RusHXYdQ(m?a6&=VUgDu3%+3;#e7mb;aLM?{z6Ef?RV6f zW`vMm{Bg_jlOA!3cTgmEhaRr;3yebPBoZl3D`Hlrh34<>Gl|w-l26ZCn7uO8GUR;{ z=Gyvc7E7ZW+bi3fZRN&xS6t8?v@$@D5tjIMqLzj@c8xWhIapa0ePDxs8ye~t8Zf$d zjuzu{ADd6Qz>E?pL!c`nj<_43%ry7<*GPWp5};o2Q4>}F$XX9WC|rz-Ny`eP+n{-7 zTB<8n{Tybdov8j}0kUtUx%<#s%gl!KRk)12a$S8;t9r(BPK;seL3mtmw;LzcVJg+P{}y8w1&Ti=eEi$BhcTJA_UvS7?|pnjZ0h?& zzk>a~wpa&|;hN4b539XmDb4L8MERIQ?LOX=_@zcHh(GB++LJp6)xX@y7HkWq|8;?R zBTcy%2_Y)()gZxON&^kto6toPt#!&ux`sQ>y5LK=tCNqE6sL~PKD}v6hy4*ZjKFg2 zVxd)({)k!|W_RN7@8O8Z(3rSrI@g6Sx76=4beIO@lMsc0Li{a_Q;4r;uZ3MnZq@$B zn{y87+(0+pa)kkTi>&MKro-Z941lDmiFy~b6woeRF(wrA3H)6_W4b70M+2n431b#$ z3i*jgQoR1MD5R3hWtP6oP`kVn`{ulzNr<{3Ywoo&uz zc@Y|^?zI9+O~EjT9ZVO2*_blQcf_<{gOSHI-xl|g^yMKI>ep2PGsYNqpUKTqf55}& z<#(O4)^h`ThzrAvsDJ5Kiw>G1C@L!suXdRQVyajDjD+=s$xk*|k-LCmau+yz!#UR> z*?b_JNZo^Z~95w>03H(aY{FP=7n?&do2JzUBcAiW}_@mO2CU3VVa8bLH zC<~2J5pGd4Q%u8_mXmg}0oI5)b#j&Q(J7|+x-{$;Om*r0ygAMPWF~^TEx2k#?X1=v{_wzQN9p9ihAN_E$PGT=W@dOF@=SaZNaEfidu-kB} z>w-7J#dI*t2WKGwN0IJ}hVe4)$)~W&R#^I4omiQ5Gm2~Zh?mSg1kA5nzv6g3ay~eQ z*Uc|7Z$n@>-t2y1PSUZLS|K4}lrbM;)*C&O42;q@d-+*LrPJKa^JT{DZrjF6t5a&D zjkfWXCoYuH^ECfnR-IJGWzzVJ=FIE{qzC78&ryzYx%5bCN3ZJG5sy|*G zCO^aKT$y$?2v3*BfpQI8I)Vz>?@X4;ctwi*oVBgvhYsTNf3Fd1rGNbZT^{vNn^ zuJYJxbMAFoKY#ve0r77cUc(&Z84L3&S!_yA)k4KtZA}|J`@PaPsFuYMSrA(;dK)+2t)L z(O{Qx+AYhRZZxkij<`)mrrdCNmu8Zzn_aJa@bj5kzUT`a`v!>E$H=VQMYi`x^3S4~owX@c9bhsD+5(l*P+_^~bm5VrI*eO8z}K=5}vf3{}p=9Jj+Va?mi z_D6)(Y%iwca0}yinmg&NSfBY=3RUuKQJTfim?*KwQD+k29V@?6{A6dg#@;Ln=!g)9 zTLB{Clvd`^`GMN0qF)-T$Qauo{w|9k=)$|;;qdW21TqhxJC-u@`R|rgz=jTdgsTS3 zm1Kg!Z+dt3zb+<8R{L=GJM2@l6KYK=;_Zy5+D73UNQis0uf=)LYS7st9x=O2;B|%S z;Wy?%_=r!;<5e`)Mz3PLutb#+IX%JlOI_7-Ntw11^eY*$F~^MC=;I??OfIErB2kY^ z7J;WL8Y%EE{!R~f<@J$i7ZjGONgvYoUvO|o4qBRmISzFiSB zWhK4&I{Q$YYb@rnEe`6C{) z1a}YaE(L{?;0f*|IEA~r1PCrc3kY7gJC}d&cF*4DKHR6(+In7N%{j*SdhfxaYh(aQ zkG=M)>KR6z@3H{pvlqhT;cl&b3%!1?Xaa_8ZqAuTG|F2xk@eC!2F^)y0d_Q-*DjUS zB)Os`4Id5?$!B*{7PX|>x7SBAjAH0R%7YJ%6P^51{%&o5*vR^WgYgb1mWhZ8DD_zI zE#L3L3(HoB$K}N03$C_lq>U+8{)Wl|XorX_*2?MCHpa9sAZzNT!Q+FqMHR>Ll7zEq z(~!_jM{2~v@&gkvflhSJHnJUxC&4N-B`cR^bsBs>5owb@rVE1#Olxp4oJguw4mt2`yjtvoFh^jGk4&%)`_ z*_G$O@=mw*VqesIJuY$Dm%la3@@$L<3%?a~>WOC-t|3Le&^Tc3`rcL^!wibQ_Bpm{c|z<7zQ3-$XQ5$1UM!cgB+(DBo-+cz(^Evqs~? zS3JAoG7FfPM^{jQxP2!h%e5t5h^9lddH*Ug=US+u60a_w-_zQ$H()NSTlRta0-~+ievf(n>owL)_C5L7pcQjO#T0;8-nB$We5%5seyv&9J7fTGupi4m8N^)W`lgzT~eZ zt~cp`%(sSNX*^PO4uL&gTsnRU+PEh1Ec0FWdH!k;f)ykg_;$8j$orr@uE3J z6>dRKlwfUr{hQ-apS-g}_(D5FJQ~TWWw_lvr&gmhxqOwOp`q=&%=D|AhKny5eY%}k zyTGfIB-+t$nuEh+OtOyx`97WJ>o@?(fGXt}YHAS$BmeuB=_XgE3#hvY2?Hofz+NQz zw~Kfwtn?QWi_0M1giA=Hb1v;tr0;Vycs+4*L)lTu(ZkT%6+d3%^jfL)oF$t}Y!O0^ z)Cy?tQB<-Y=sfuBye2_{&fh61Y(gvAa&=^VaSetU;8s2MPM`oj7Lg>r356~V zk<1VKyDghEgP{`%X9UJRJ71H2LUX7($AFP zcsAlAZO1=5nFv`pjxB&?(M96OHSEf? zeHB@N;VNr6qpo72BWNcPlJ4Tnz)CG%nP7ohly1_+x|->MYF$?~EUHQt`4>em_Xz7x zWDk+P_Hpic_lgzLo&CATq6Y0eYn*>bgXx;!-A^Ky-5Tg0%moDIDK>VUAw=(_156Px z_W)0F5UseEl=h;Sk9nA0YERGsy0takBhUw*Y@wJC#a%q2|!xh0__5Q!fR}@4%E)vJh|GyLir= z;#l9XgXQH~46o*^@Bn$-_IpAwn?Bzv+!;uryFP1tb$j5pt<|A)*RZm^xq{*{Ypo|E z1qiv-7u{@F9T!B0h2+@hk_agb8AWS{t`zStA%d(-9_g>U!_D(>J9UBCnwe#_kb_Ld zfgz%0j#txy>hO~I^4*HFDu+q*!UUmE;Yq?~%-<2)31_T;AB%{>w~v;5I_5>)%g=uP zW1l(%6^MvSu{#^UfjpojJ@DkY*~K2DeoIG1!;?vvc;QR^{mWBNQ38f*P9CYY-?9}? znN$9|?OOOSTr&mpVZH3L6?&JE&8xIV?6)Q!^L-5t0WJx|v0^GjE;`TRg}SO{@*+$9 z0S}6sh~Q(rNPTkUZP{dE?X<1FgE$^hds$r|2;*csFqGC`B(=Z*ctJ9?{Sx04_bblV zAPvgif$-CKWy9+a^A zpxeh-5z%$82LAl~PIHSdKkh$Wq5S)iaCeS@vGS=h9qS?uiQW0T0w4ukD{mQg=rL!l zF=z?mrmTs8qc5iyPxX%aTg3}l49SBB13Uc2SI3W>%1oOYrEK+bS3fCOna}n1Nym0& ziasa5yzJl*lxrhkhC$x26Zs>F9DXFPc`gcU00IP6!oTi0u&Os`nSo ziCq5=AX@kjAS$%jHr@P>k_9_i+zH#T-4zer5INTG?bYAN`gZ$F)|6Abusc=jyYFd8jr#g!Uo7AR#N&eeA~@7vkZ4NZ z*GFI29i0m8&W3l$Cm;HST&&5Et(jFt_pwD7XJ!?D$vLebeXXK`_7Ytc7U^9LUkwe2 zIfBz$%uO*Q$cpdXyJ*<&$Hy^gvZ~SDFDDQ1l-W4Z)vPj~IbE z7EgUtu3@!HuAx2;xgNar9C9lr@oYJv(5O3xK@%@@CqNPpl)72ht4YblWG`)VAx(Cg zgAOE?vbC}i{D&^2b-p8R=oX~KcDcuGTFI##B>zes+{3E1tqxL=7 zZx85g=1Jr2!k78%ED2vcy zad^HbTF0-0<>AI&@uB8kFAr)h+zy4GQ-#(@K%FFFR%G|yf{VxT~@vG!#Mo#P$m34;cxxu-v`XIhR>bQeA z@`8wpkq|qze?p26aRaGfe?ZzW)$lz%mk=~tE9Gs+HcJk~G!<#DpJ#nwk zPftsG#PW_)TysRu9!i*|yyrO0{XF@{V>W-UtN#~DcoTjP3jml+mO}MeR^2?qiB1vlHJ$#t`ciAORImTQ~c_*kwS^16OsX)9W@vD}dZUirBwTXPX# z+D2y=?*7W9M{lZgBA6uQe+Vd3dR<@^)To$l!(vseF~ca*9c$)j6tKR2J7`O)w&ii9 z8zV~@m}0O*#61dV?Yxh1z?K`Ms1$o6acLz*Mv}KFb|$O-u^^+=2k-5t_jl=$eJr~f zL@xY2KTZf6aEanP!PoPh>wYmU!I(^2C`pxE#Cqv1tAw}2_Qw7j>kLSSH3b=YGqez( zk2W`2)J*d3Yx`9X6I`PL-+|Z@-&?w}I1BRe76B2ZbigeO>}N}FL-v{U!cN}qA7yok zIed=?dL$`H!vmq{mTo~kCx@$)q)PzVB_58yvLcAl%?~9_a5Hth<~K`Mk4x{x(1=C3E6v z^=oif@sI>Np+Dxn!4F&3}M+*rq#q3QxL<8vssn%aig*XQU5(!IkWirOIK1^(4Yl~{Q^J>yG@1f%IYcEh8y)nZ>bV`=# zf~(jnI_HHg6Yl~oTK$a}xhW=U;Qk@F)`cUA+;aBHi`Pge`#O@hqTu|~ulA%!=dlVf zq}w#MTHfTyL`v&*6g=x&%YK|l^>Va_<3y5ZR&Q7Br^5BGi-~4i3a~v0 z^)ar3w-)?$(@UfTI^@jTm@-OtEdAAuFjCsAq8wriuVI?J;;ba!(tvd+tqSMLS8s@r zD4LZb61U{wC^M!s;gDb_tqRm`?%)f;?ma;>Gna3d&aTeh5i^HB$EJ958luZRiWR6u z4!@ZpK`Gvx5NFiB^2P@zra3FJ2jI7VXqKAtm;CM=I1} z3v+ytyhc3JfziX#x>3moDT}m$~#~{d2=&2dSk7s$V?WtuQ@ybtPUZU!{r*Dh}NdxIVVT|o>!5W|e%vO24rAuz> zc*07VTtBEwnbfxPdw++fPJ6#P_Q)Nrqd;62O?Rs#Mo{utz;@XBW9$$+W1-uxS6_xH z0P-ZU{eEs8q&~GPlIwPM3*?jzgPlX^^CR_|(6xD}3xe6iE-R}!n_F4Yj5DFk zlY@>s1zWa|6*7S%df2;dD0u|F;|a}cl0jfed9%>9%6-?y63qwE;M>mh3T6)P`x|#$?_!QBY`k_^Wis*$zdU5PP8NwkJ%|zEFd8glQOogbn zC6Rq5!zf?0McTjG8Z*F>7xQe13I-(tnwvyP+^20==H@`3Irc=Q0?N9ZBfdoS(t=c% z`OIm4UHB>FQS()(H8;kMJ<`M7i7z~W<{!fog6~NE)!qzkiHj3tgTdl?4q)E%_#05^ zvC0$A@8h->lyVAjQmsaf@vpVfp#?N9VRk-CaNrw_>m|yGq{x*`?#4^Q1@G;LY2@Q9 zAeZdMyz3g;4#X_=3EdWEO#S+jr zaNmsX6ixQAG&vr&fNME6mcd6)TQ)btwX<4T9X=gA+oO$-&FAOCwUBFWd!-n)?Dis! zj^l+`@DdNc+GZ197z1N_<#S3Sl1EKl6~CUn!4>KH*50SAX8k0kwwOIcRu3t1knp*j zxKbbaj?9^PgdRZm4g4j9;$YsV$J(jR*Md;#CV-H(MZSuYGA23-{D_F>p*0$Unp6F0)ETUxB)M* zyX7TbUcWJ>t>{g`h?yjXT8@GQK-@;1XFt?C$t0DFS1?@^jjkKphZO2y@2b&@BJ(Mo zjOoPtn{8%y3b!qX-EJ73G4PIuiel$o4?&{-cyX{7p4wzn(--)3j$WP})eS-F#?QK$ zs0}@LE)EO8S&GSQkxTRi{cz9DN~9h3Wp`V%9vg1(oEd8e`Bg zAUB~bP#^gMX}$5KmY`q4meKv&{DCVqN4Kv$jP6L74Rs$1ez_T}iRk+ARk}Xx|6eZv zV3-;7`b*ecGHd?IMeL`my>RPxR~8NCk$lI$RQ6mqr(DG9WFQAi>%dTltNt=>W0QR1 z*-dPk)f79eTbJct2#~mq$-I!>mN@d@MSd)2i;*wki5)iT7=m1Af>D3dm{MYp>QI26 z9{oVu@>Z2v3r+VZEi&U*toV$_#^=>pPlpM-Yd*k1K z#)C+cvD9D`mb!wR#xG`JgVR*=8dM@oir~}vW1o@f~3E#UG zHmU-J+8G=$;iVOyLB@N?oJD=&%z_=Ib!0m47!WZqEBG1SGAPBf6|~*Tzz~1uGE1O> zf!`$K4HJV23@reeFP-7zJx50`-tvQu!JUo9;#=>>BhO}0b5yylsOr>N1~Pa#co;~h z4+g*B8>)dW{+i|Mlm%^=AZY%8_}>10HZI@$Rl_Zi_dOSZlT+tZhCc>caLrL5M1A3N zj@X(%C@1Rz@pp zVi8hus7_Of7G?`rHDG}sOF9w-wJ{rB9;a}mRBIx+Q65AF&k>4$G5oLo=$MZo@Yb<; zQR}IHZf;L@{ccK_4^>?TIlBQjH&(fdWwYN+7>Oi!qL-m zfKppJbzTXs-`|xawhg=J^34>@%s&A#q<@(V$6YBo>3oXS5w=X6p$RYU{xP$@-n<@O2zVA(%hjTL^H60FKFM;akSvdKe1npjv z17sk*qqK^yR_>0zxK6F<1)WhS{tB+vZC#4cD8l!p+_CpBX?tpJ`4wgqCS(#`F+)R3 z(xhZE+jP_ue{~3w-O&t2Jo6__}aJm?%Y!p?-(DcXtDElUa+2~MM-hJ zv|h0EFip^RC)P=ex@mdlwS7!hAtdK;X22*DF)VVlbyIfLsU7kVm< zA~5m*&yL!w%OMp~Rt!(fTwRKN)RbE3#cWE+k*{+9&hjT7g+#=mYJUy&(OU~@fM%c8 z*)7`H)aJ`VX-X-I7>6@PE_d;&uYCCAZL#CO0N zaq0-o+KyEUZ{rqo*bUax_KBwyr8Z}rl#t19(c4osm`6*a{>#c7`q|4~Pber6TeU(| zeUED_1fzYP33ku|xSu~x0Ads0OVy$NtlmglDzmy9ZB$rvhL9{cX(EhpGmr zVxxblk90w#-q$vVvOm@hSN3cqXw*)En6KTOt4SaEVpAXYOcg*(QhBtD7DnjlByFdI zOa<{1>dNzwQ&2B6fU9}J{nj6?lQ+XS5#{_IeR#Re)Bo!x?bMKSbY(BdwO{=X$G9}Q zW9GPN2<(5b#WzR0{dqpL@8WXZQSb(&SSM@99u0{}+>w-{kpOr!0n|G+pm9aEz}L1| z9%k_k#F1`ajQ?(C+p=!F5+@?X;I6J6xdI)(`%UZ|Lc$O$s*uT)JURQQaj#H6H9?3j z4Ov9m3lH7INB@y;Su2h{AtL4{i&AYaLi94nk zTybuet{&RuG6@akRV$g~Y8~b`p`0Vz2@3_0!<1C{yKO3;P*&};KbJbOoMnhoi^f^s z5ur8DrR0Y9kop8myEl7?*gx(ECzLNKTO)ar;L8)=q?t_!cpp0|-aSGV1VnPns%-54 zx+Yg&0PmOpYCOU{2B^Pd=#9{>sK1~bA?G&l4JPKWNc!n$5j9*8E|OJKPk?`AMe>)+ zfa59k9`zjSBoj!>v9#qXLgtT?&7;Y*b;b zJXrJSl0zz^uKaLd_RJmZM4UN}EfXu~@$&V~>TvU!& zX7(78wM$<14%o*8--9`F0B?%(cA6*R#3cxt1GKDPD` zbCtmmV+zN?M-60kV5-+!F(I$++QmYcdKM&|%t%jqDsILqktooY?m{l+JfFLN(*@FQ z8lM@Bz52FO?R){=mR9a}J?wU{oLwL=WnG%e9+&Ku!CsH1c+$7dTeuF=1F-}3U+V>U z6VjfpmduBJBe}IOrwn@^7&-bs?)dr$CO2HdnC?0{- zEx;cTNfw3D&NOVyFO-Ua7kI~_4}_7`49jj;J+YI-#O5N*vM4SPW+vyy4?{gxz)VqO zPtFQmf4RBpPz`4QJF9fttoy4h-w$mw^ak?61Kcm=y?9^OuFT$LMU#=A`J$+m97U_o zp-J)uho6|ei&^g^s0~aD;^C+F$c6p-&NjIp8LM`;`eGF?AoadPn^q`|tZENmDw%*t z4MxJe5%T*DIF!esHC^!NiMwpYTddO#?RZfHlJq%`$LDyUR{Zt zXwfUoAnzB4W@w>ht$;D!pQ&cQS1f=7t_Ab1rWpZb>2gk0_b8X};XrrF<)YD&*tz9c z6@xi_Z<|!d!MO>Mi;?1O?c>XrOL!b#gwNV~Wn%Z{59^idok$#tkv{hah=yHHe8maH zVPYB*Q7vp=i zop-L!=QF}@>IZWk`NF~TS?cg;Or-1svdb1m+E|dP5G-W-q$W00>zix~UdqYf_HNHX zTIdGT3hDQ_yAGyq6}+bR6T|q!Fio^T8MCnNP5PJ-U$n>+m3r5jZNVQX zvSHO${hFEMuJv*e?|5SVEqWqwN@z48h0ZBDDb#6@4Q$JtZoe_Kf#0xeXd_|=adD|~ zkwha6u~Du&-o?A<|Ia1v__I8XKSPK5hF0vePe$Ex!-MDZz}raei_4FHm(%Y!=uQZq zo8buL*Cs(H*CoGUFbks=7+&~N&lFogUUn>d_5KXYE9^<D&<@Kb(Pie7b$kW{JGW=0Z*TG1c1>k6u11?&$LbA_M3zr?(B^)ST zE@QGbyE+wgKjTS`d?snbLd<8GEC+o>j?q*HYYidIHcCYX+1nwy&C+;L(rz$X&x(%k zsMmJ24nR)8=arvIpT9%29AbTBsU#bDqUeBujk`fJll#}!%~v}LB*_^dmltcUL#-!En)+h|^ zk*10&{+Pn~U^AQdmt==N-RdlA8@+**^QJ;di>{Of(`-mE{kJ|`?@`4w zx)P_6@DJcVVs%wmc2%7#*Yn@GDWiKn`62yTc^|7k{UyJfk!a^dJRdtYF28bMnJj7( z$u~^!f+~JR3FKz+)*^M|EUS*i%vl8A<;6+Lip0^o`~9)4|Q)JLiRH_^`y%wYtPBuHgl_R zeUM=u=j*}`ICY~!3bxN=L%LEj>vx5O(pT8eOC7y~^%+3Roc+EvH{1yIz=ICAL}zzb z^=op=D70ztiElL0YEl+=Znmv&H~eix0*FN+2YU5SDZCzmU2ch%{h8VM#ETytg>HXt zx&h=hilin2b@46q{!>U>A694J?mSCnV{-#=^`29`PWZ3?AxxhK4tT%NRs1^2;LZqp zgH-Jk3NQS~d4Su1_A#ZX@5s8GVqLVrdHY7Bo#K}U$Ej~S=ym|s8`$a=oyFBDS~5s6 zF;fegeEE5y=|p1T?j}Hfw?Evvu^Su772>OCku7}3DI#{wNomG&e|?>@d+qzL26o>$f z!=)ShZB;F1^6(!CWXhm2-hl$6P8>)ueX%n~g0e;1{0Dz7i1YnxksB;)4)@1*s-C{K z45E~N$EYhroX#rRai(j;)se0`&9o9jdx=rrffo9))J&Z(0$oWu7YVCXi6zjjm?kmE z`ZEJ&Dv7T=^U1^#7$XnKbQ8p&h5r01F`q)oLoaK_0<#!8A6t#HS<$wp3%jNd*qQ74 z2U9gtKOt^2r*D3-eR97OAud`}G0^vM!_6w3X$w$@WP9S_35!*Oht5@+&mt_ZGL7zz9P&2jB?KS-J};xzo6Om<%k`BWO8HXo+e7cLjYS?sde|%z2ujr~BHKgC`;!D| z=B&JxoBN8`jkc{=V(KFPva){inEHZyfbKOJRsT_mbdp9{d8wT42=fNr(-rKigVo1- z%7Dg&LGLzjml)k#xXE#f(mcc!+K7Y7d_KUu+85*=rbrTGTdtMx6I89Ct;7p-RzlTs zYc3V~LX79xS$iw8;r^wM@Tv;7LP5QDY4SnPiDwvVL`pYdak8A}TOjzPnpS}&c&R`$ z`J>Zc3-6FDJ%!-|9yG0Ml8HZI{@Z&W+i(4kBpb9yufY)aSGjg50j6ToT&uQ$(w6Rn z#Ff#SCMcMzG7JUgacJVmf4594lM{}c@hjWx9J7V&N1C)!LfHI7Cs=Q78tVG7Xw>!e zteyTUFG!2&fY|a$n8yXgst24K1m%;(Z|e3AU5!ZiTg{W?+qgO_guvT|IZ+oSLsZbYu1!hr27VnPfIaTyk*o*D1+FqeLU9}k%&Rk@#e)mrH zpOB6$unV1<7QCH8%(nNk{dbQv_4;^w^&q?DvS8+njl~hz8c>Wp{P1t2K`i3gTA3~; zN`SNISD`RvP7=vwK6^6BdM&@g)L+Zp{l4$Dp>QcW4SP?ok8o_nDwwr{9cQ zT0d8@e2BH-zmI*J7Z#L{o^Gipsa74hQ%#*3Ivo!l&hI0|3b^hcsLZ7KdqK z)=0EUtI9RIwWFJJR1`yvg281%B+!u7Yod{^W|z@V=*u9AxKYgO31m~pgTuV6NKxQ0 z)l=>Vh+q3*$CJr|`N!O($WUv8hy)JV*FbT~Y*c^&cu;PVO!bm+`&LgUJ67CPsiQ<` za`KcX&sgWJD(m;+#$>hY+gU^fb@h^xKr+|)o1tc9Fsb$C+m{BW9~q1t*E;GrgyqUe zuGB6FjYb;^W89*rz5?wGp&y*!Fwf zCOI%kypyp#$E{4DKGRKy=7WY!lWzjTN{7Y%;owAi1T60oLw;ZA(HG=`#a>%kt6@o} z_cP_2{Y&dP^T(gY*qCw1hqwUw68`He{LziQNO^SLRxW&uGvmFu;;I zJO#oS7kAqiRzE>06Wlj?zum;j`q6`7V3+ftI;8(RCh~g%9SFm+l9CTW{+EY~&k7ky3ho;115}M5WyNWW*dkJ%7&HMkcg%8-0}IMb|Y& z^l$4cD1iF4QR^@{CO!UBvfmd;#2sA@BU8BB$0UMl(s#FaNBP4Ij-VN@R7;8KzheQ} z{kUTCGhGnyj)=U@WrwTYA^zE1Ot2& z3|r7d&|@f=9S&P>%x;Y-j~&0<_k_R8ksWUL4*v2$39FWs zExy{owZ1%g`tUHtP^@yNOZ|ryrCJoAOAp>jRs75x;_+6)_o#4Gs6+06{CXK>wr;Cu zI-9ESm*vy9t=LDvh;Ih_$WJ^dIgO$1k;g*U^G3L%#$09q0u-j z5E%fx481TA)U&@H%&1KV5N&v1q1D?cUhFTAmW|HCn?9oP}3TG zbsE?(r8=!rUAPj?P!A^lX^@{`&1FHN)MW>P2K{4GysXl>-f-O5yzB(WJ=)QWGL*b> zt3?9XLqjDX+w7q<9W~n-bdTy%t%9uIFoL*$RdvQ@nlk78b`PAi^euBPr~O#duFM_n zfv|eaZY=8{FV;LwC@Y}eFn!xUc>8Vi#Jr*is#X1^L%}xgVgA$|b$C{tb2|Q^T`e!# zWQ=#e&(i*>e%~ig9t)>@?Qn`UqKXhIjRTo~D}EUXhA{sYN&SYY^FIC?!MdOX_38(}_<|1Ave zVDQ6T<1^|LO1opd+*@BWh_Xw%zcgT1U2?xo?{K|oGo=U^*?@=d55#sR`&ZBrSIjm& zuqf=_C6xhIj+mNU{+UZYS3NE(@JaZFVMOIIIPuBKLY3kCyb=3PY7Icy{We27sxs>o z_eX%x9C1v43@-FF)N~qAT6~+#UU<;wr(`>8_WtonjzNVw|B+NP zvy)y+)>HRlE1!IKa?C%q{Qg|4v&FXRU9-5ZIH9VNLhqUS%}=oUDWzy7?%l2Dxs`nA z=kFM+_V|^=?F3z7Q#bw$IG&UJkI}X6o5ZR=R48w_81!i>;$DbLdC?Q%WBMp_GEms; zIY=~q1ab%Z#{G?0>|U=8?Q>4HRU-bA_Uz?B6>!hCi_>m?2Z4Dxm$6e<9g~Z(ri6^( zVxMB#t}rv45k&D6sYBk({TX?n1dSZ71|)|@)3hb9JgI)+52|C#lWodu+upnrc~p=b zwag5fzcGuzYyE!zfMzMR1z4;hDL%Q6oEGx_N{$1o`$FiznoxQXfl{?)9X8`O(|`0P zX&Pc|Pa@WQcBl!RTd_(Q6@4<(U3o$RzoY!*33#Q`9Xt=0)4M)sZLLXGj?F5V8c@Wr z95;481$EBJE%F@|Jo<{M6gHwv_$;lVe{D#TodpRP8K5E7be>lm_M&g3px+tJZu~Sm zEktUg>}`~OTL&21{9NwAZ0o3BiAF{w*gjmWxceGxRIt83bRPC@d7<@ZfiUXC$acX= zLR^2Dj2XCmM&;fcje#CDn2@Nw0)HP1GgF9&4nP97q``Xw?LFUjkhja}F-PziS9Wdw zGTjNg-)AMJhh55#by0vBGG=2dp0HS5h~pN^1YDZiOZxl>LlfKv*1TH^FR-;J5=wtT zE*+K=y$YXZXn{EoUVXe*Pwr@j101hh)n~EGQVI*L5w)51$5Vocqr6`@?d^e6UmL$D z#JC@A#vEbJ-p;HF3}1Pmx^vEDc@Q4EW zNO@jbe>J(9c{R1lE848HVc%XwN!%7S6_1L+TWGUb!M@T04YojD9eOhKGXE|^cn0$Q&rLC-sk)aVZ2LE{nt*qPK@Y(U z{8PkNA=cFdeseCf9bPxMGu|D#k1pEDS-wPwN&>8|E3K{!bl~ z$k{EHmN5TOY9k4|Q1=a|71Y7D^zx_shTR3(4y87xhLiB&ol>v{kh_M(>;dgj;{{R^ zObY-M$78z!>6moeg=zd4_~?5ybxMpErBO{>siz%aZ_>610PXU5V04auB1U4*Pvnv` z9%c2&AyJk#q;PuvLn2*DmYr)X_4&BEB9S0H8?Xpk4Bgue+MI;%b`=Jg$Jb?Qe>BVy z!X}eMMGlDIpM@H0U72XW*Og3A4%&z@V7HY0g!)SZd)73 zcI$g+8p>A+aMFgmJAiEu3y2+9k+~UZ!8Ia^-+hgYbHB9n*Dc1Qi!P&zO+z=^I3jsO z8k0vK11?wYe|=kOJnL<#XstPHPdER*PS2a4sL0hKbaqrRzmVqt(%LPKZl0kf1||%L z>~H^#7#t}nw{a)2z!xGI^kbvLgZ8Y63w!ykISD^fjL{8Pix3IR;sCCcl5F`7m&~R( z7C+={&q(B4V46cT$lhUh%y!u1+KQ8KB+McE>4xzD+A{r@Lt=3tbN&RU0Yp0M?M+L5 zMyYI8e~DeIR% zi+XiR(~6=Q{O2T5Bo4pE(02N6C2hkdfTL+Spn(H_H$@sxFwuENC;+f%mJZ`#Vm z!ltd0AL|d-6v!(bF=r1PBik$LMB6ag&(e->g(`kIMgD*&TNPhJqWo>)?S=sZK(YX9 z_$#-{jNPN7{7Yi&s&L%Pp994w8yM|XHyNu4QqOl%%w@hQ=X@wW5BBxAlb51gwam`2 ztQ>5Tbbr`k%H%-u&$3#9)vNW#o@sM@OZQGLoYj`@YR@kg6-r8DUy0r-L-{3i{@Wt6 z^GXR+LDpGQt}~bS+c%-KYiZ*TpN6}V`_^_VpWnrXbt4kRsl(+e6?u~bcF(Ff{NA29 zKz}#YeJm|)phQt)QV$Qa(-%zEq+az8YybH}r_x;pb6_nM4NLe+C1b`v5J$sb5iqloXMJ+fT@Cc(^ED)p+7E181it@6`VGjYe#o zgh7$|i;EMBM>ChqNDv1gl)-!m~50+bFkcoS5b z#!!>C66OnV50CwDRkHG9#+u4G&zlr<>=zSa$*og0`3+0qIMtU`FN*3`E;SrZN7NIm zPep}ZuwYM4k#tj{#j~D_>BmKz7u3k6wiKvRe;INvc!mDjXed+YvJa3eP!0&xIu2qw zsts)kLwT_0xqg>Pv7gUTF17^-23`+W(0YxGeTZR%!(~7xuqhl5S9;P(*uuoUDEuZX4wDxMMpd)iZ@zL#QNq(2=y9-*lwyk46_>J$Z_JyE)jH;vc+erFWQDRm{tzu>eLsw=m#pXjX_9S* z-HgoNTG}cel^;-Y@u}%hjK=ZYzV3qzoDHe-cPp7h&{oObpA5cHg{J<@oz-ovzT+Iz z7B=vlREJ_lwp@umQtz&!b#zW5UMQ3TgBcql;f8_aEcz(toRD^wf|A&gjjndG)6ExQ zD22%c9>$(D$>dg;VKzj>P)2}bz#R?tAE+(Y5>iM_*zucy4fZmZA%#g4j3N?0D~UZ9 zQ%GzW0+WVSLYkx>9OTyA2w^I4$XU)$E0Phmm53BrkO_9b!z^Vd+T;=`h0`bU0c{NoR8ai+Z( zwbH+cB@|_;Ywe0^ePZ;&wpEU$BbfjpTv9Ti%(bU^9oGdpdKg9{d?8@)6N0*s=P^mE z(MB8T8a7H5?zlDcU1gHken-ZZWe;wlCd_jGnUGfxu!{70x57O{rA(j|=IdMRdvq`z zfas}RXd*eae|Bn-t|Thzc2~W)^@co!nhCS(_@6qWo#Q=-LDjRUd)JVkmG~*fM83D& z7nQ3XKWNF)h3Cj~P#qD~h`-=XO_Dl`<_FgxjpMiE%Dcf0p)*bXp>v9i%&Ioq2C&yZ zv;QnPA*sy|rHdX2Q2UyZcl0k>%37nby8+P4Hk+Vn#I2xK;1FhOkxuFm$PA&v2V zP1%!y#2g?vU%^nqH#_;5+&)13O?+BybA)(gftwGG^?{h}kUbRO!k4sVsfD!>DJl&w z@*=Kvb(J(;_BwRYO0wh&{^>wCEkmV;O`*8zVCsCTL6&t`@PbnwdjphRPZIJI)lb?$ z*bw*4+qD_|qB~ni1F?kz`1Z>f)xmqS$x%SreW$<+ai)o@eT7=-$S-gGOg#S_SGqox zO}FqXoo$af6`xWhi(ju;)b)LRY}?Qoz$3xs9^b914uXgH$HMnSU>>-*lQ!wm=f`@Y zCN6fl?xN?rAB26iPtcD~?+81TlW>DY3nvQg9{ z`ISmMA&ijGx9}x_h_`8)-CS2M&QfKt-qe9_zm0j7fS%^ip zcwT4zY^rI}MG8r~dhXj+l36{VvA{bS^M^#Xw>3yP%_hm`GkX*%s78@NA=rjXxYT(q z)P5OMj~f+}KHL6jYbw(Q3uau!Ig<0oVFba9LcwAh0w0^D`8Up38uRlxkUYRleSO#5 zWq_Wgds)$9)ZkWsna!3&kK;BWey@n9ITKx0Dw zgRWi&wT6zwt5`M?d{96=pvCjk4eJbQmJ8!WOkeM-%HRA3C^(ht++RXcHOFi(>WgB?kQQ0n5SU6g{YI zz1Jsm5^ZcK*({~7eu345D{viU>wyarYkmF_=(^Pq*3CzGD&$SPNWw9f%FxMahJ4mg z8Z>ieTl7_0Xtz;_!lx)#_pTK_5X~M*lk*Ncj=D}K1vd?`Vg#63pBU-p zCw~qxb&8J8VLr6{JA9FLfjG3fnNC4=EF8^V{%z}4W@b_D^zG;ZrdEL+djz zvbr8P04_?i?&BEifs;Fi!!5ynv*BxoWqEZJhHBe#-`-e?K3AQfS4!?}%Jr1sPf?5x z13f(3h#>Ul-8?h2A{m%9JW?()@B4)eb%4kkj{9x9pgTfcEU#0c_gc?{lQkg2HI%sB z9w)ls`}OACFPb%|iEha4q{FFgLb1uu(D*%@Ww^eRytL(Kzz|J&*N_%z77SyanH3-g zfH9zmsml-f`JgS!{A0u|)Zcaz<*dO&mE<)mfC7tg-nu}iHn56iktrDh;=fPvoxL(v zXWpV-!*3c$%!i5wgevkJLefNgUr!S6=7jQ>fBI)ChP+5Gl-H42yv6vldOw&iP%2G{>8){e^eVGQyWT`-DIn zfd@lW;Tgj(iMY;7yGSQJ>PXOL3s;fIu(YJvhokLTYqi9+2x)smf~* z+|yBi;+>K2kKEceKR6bx!C1zq!u9 zmh+8o(Sh5iE+3c+U`nLPk9`Oi_!ox_fyhM_cF+!M6OywZK8DxJ^F@_^?o$UILe6pf>K-gFXLjS= zo==$BQzsXVNT1w8HP!53ey>=i5{MplXGl z>V4fnhe4Ix;)TwO&JAH=4D=0Rf!d;GIoE%;N$dh(ORg@3@@A1kAK?CifX%VGyO0wR zL8acim1#udi0u>XwBM4+bM7Q>>^t+trl?HfPr*Efv*>l-$bY(iJZ&k8)!k4;hFfcv zE!H_udsF2d!rn(4R&;-dl?*b6V}`lk=w3R6#cTjZPkOrXi^vK?3Ea5s%Z?Vk)f~pc zfZQXTcQM~&z?7;=>+IMwwRP~YAR)VQE_g)gSk5Px0L##(YIYPp=#=BE-Z&3GbRd98UD}GF5r7{Q>re4JW%0-)-DksZ?SjFX(dn<; z#@XuDM!)-%dU|WOgnl44Bd?d<4>)=>2$T-fD0tLzyd1VOs+=qSF-c6J;`MG)U zy^Pf+7uChq3q^_a8src2!Y`|VmYb*-HE5!`TM3*GLvPfmPi&9HUlo`=7I%0S0csw8 z813%d9&EM}e>1^(m^HHlcu?%GAj|W{$%U#??ap9Q;Rn1 z77d$4nF6o>q=Z*L=PKw7;Xq0EDVSL~J->gCwD7^!z2g43_SGO%4O|i=2da5BqZl@h zI&{!d(_i$nOo-OizPliyuv3+YMr+fD`aUGF>Oy9$j!*4>v5Xr8SHEAZLlY(RN<)q-;E3%(C<%d z3xz4cH~oT3wE7CY`}5~I&?Y7qgyp${rYuKO>Wn`Xr_Or>CBB==n6<-?NjROXOgSe(cv3z_7-)rJ~im6HnPx3mWUKoY% z?pJe1+Py46^tdMoWo;-916yO~-g9oTfXwG1v+wdX+N|-8a z#rRRqdOQk1MD!I9X4C7}9>yB)nRqYlwX8I*Pn={v>EAuv)J zt4U3+MFssOMfzJvZ(F9;;{Kp<0DOP*r;{+ZaJb?i0)Ge^3(5}oHaPP2K=_WbnB4o< z2wP^p;ataq|YkG~ibI!~TAtVP14gKt6tC2(jN~mZThQljrnES&3=IW}Cw~HG9>RO*En27()qz#3Me*0{P z!2ps?)^Nr^Xrb!@Kyow|&)t3VE%J(rDji>%pEoJYZH=!|nGs``F0}7*Zbj(HyEnrc z84yTW2&hZ>?+@{>?T;4W-63IxWD zS}RE&bV;FX&2_f5d9ROx*rPQ2u&#+Wu71>}kx^}>t=md6GRo0>lQ#|j2j%@olM_Wi z3MwfCo&SiwzAE(MCS3gEs_Ei?ZWEJEo|a=yx4YN0SE>MOO_(#P-@X*zL$?Rq{LTa# zN2tsHn`uyD_uJP7>3SE>W@+!wTNh++hdKU#x*+}7m@^JWm&{9vuIoeLd|wV1s)lA7 zA?G}0A8^O(NnLz)BdMZs{IOOhO2Ju#l;1D5g`Y@~dxEwZ1rr)l@uLfmSq`9u=1gr# z#f|$T7=H05FI)C%Fk*HcJAzEloNA!bgQl&{T-IZQPHT}$Z*{^0YB=no_|=Q|C720* zfQA%)BPy|}48@&x?Dfxxkr5lqD{%b;YxZ<`J+uKzzWJ!D-DkgXW+x=?Q2O zQ8RgynV9Z(E+|%ONo*urf0^A1bm_ogy!WzMnIX0b34@BvWT(K*{D2Z9Lb+f$eU#oS zAwu70^mwGbi%VimXRu7*tW?Fy%$u=a8KnGOhRn|hNrJQ>HU&;(9a{^m-qSN{WTL)H zX@>XKkHM&tSce#Z8rK`%0T-&{1s&0fz_Y}@PH@nj+W(z-{Orp`4A6}dv-_% z9fb%g#Wg|n(^;f@;{g(Ob_#TerQBEWOgrP^&;+G#Fg4 zaCq>r=wP-Qtx17$*U1cZq&;0H zyXJg8DIK(N*CxkpVP4MJ4`uCJy8ONK4r5+{U~(Rk=4xlNV=@QBWGAn~>k~a%Pp>wK zVGh=scZRaMXz`huVTC^2E$ltyDX+@i{aEWHM&T25OcKzEbbU0cJQ=rI^OZ#22lx3Y z1++Lb-5^GnPQ|3rVNH|iO+6K|2Vc(`#8yv~$t*qTng2rR0uj1p?IJ57@J>IQP_ThR zehg3QyrEoaAsl7B&CM=^XRfxrOm6Ve8%tnuKsxKW`|Rl~UTK{8>%Tf1FQhaM_bo`y z=_D7AXeKQt{IQQc!RUn4LL~XW_mtTd_&c0#LA)v@2b0?LyT$u|#0jU6y$O&MH`RE{ z!b$B)Yu>K0zbJ8%|I*KHWkLSuZDrEpXd&f9*ZAoo49n1B{bwqBtjX+C9P?fMyLgScRhkrk9zS60yv93EobuWB8_%KOfmo z-sn=~zL{;Ii$>q&1bEzI)!;!K8m-qbq~4tYole5A=4@>O{Cqg9cRdA`-*C;Rq%&$G ztoX|+tBjlgK<%~@VHrV;6?vwF=-TtN!c+dD1$ z>MGVx$vorL+4F~JzKGEbz6dwQE8TB2NE&6$XnWId}kMkBc zXGAe}7UzMM&F+J;R+vjSX`z;mBl4 zd_f0Psg5o+5E%_F$xS|dao~k%YVe|@*!N#{F9EofcZk?WPV|q63uFtYFMIt;pVXp* zo;d^d81jY`dAmAColu+yPdwjXLl8jFXhWe(kmxp#Z_Q(f4FI97@%2e(VW(2Sq*Ek) zn@rE8ia2?3l9j#=MOhKL{8i(7nOM#8_tT4%${Zg7@Zo9MI>gO4RiK$Fi6TJm3+b_zV|;cttNZF&G1%NJP4xVcxV628;+9DFNeXGu^W9Zv z>SJsa0hGteAxpg_?a^CDcTEb)p5r~^! zCZ#*crWiTVD=+MM4c;{t{UU(f5%(o~n1}(%T1asc4ck)03vH5U(Im@SX?t z00pq}ENGwq@)9^_p$J%{>5dp6W>37~uyqH1w}X*eV~NQU+&^pA-8b@M%{70E+8cdg z@Tqr=7Fiaf}FTXvFl@#T|WaIl%bD zK7fr&e7Xg)yfGw(V$SnNH{z>G4KdVZ%w#fm{tdd+<7O|9qHekavJ+G<^pEG><@Bae z<^eCAp5&ecQsgl6>{+jP@kRjE2`EQC7h8EvVx&N-V&o}#s9#s>7ZQo80AB;zFcSu= z;&CW1EShy~GfY#dUhb6$2&A zM~djpgr`w51z<4JK|34C>A9atyLvkNERbs(YNwUdJdE&D^- zOEdH0oa`adYO%iXS!~r{jiT{;{PW-1lrOg49K0Dn0fj5vgQs&Y%7dHu+l>q<+;KR{ zah51Vget4q%GY0@jV24GE>Yy4gtad0KDLW)nZHRxF8dVl4(49(X|CFZC$ONg&#Rjcz>se6uoCDOdY)9I7HX7l9(Z5!C6_0eXHZv zdYCo-r;fYF4keNYqJ3mDDg(F*0Qkwkti4A9qM{zi4joPwCrH6>8vV72u=dWZqd^}L z{UuW+>tcr?dU|}?`!;F|hD`Jq3--!|s&gEH1x5SkEBnc1il=uGC#@M@0Q}COZc7?z z5l%Cic@PxA)Guw_l|ne6o0sf6;p&BB1bJ6?_#3#Dip;knQQz;M7xX!d@F0Y%%D!yk%;pgMk z{Pi39=Ig=MPEkhJ&c78>&zie^7=~q_xC?N_g!$M1&jQGBEP~QwVZ0z|@b|F?TAVp1 ziOkL%ex;!3VdOirgifpI1&KO6ghpO^@7!vTm29*;C)L9sqJFFn&gB8Q#90o*V!{c` z63|&Xe@$(;^PDD*Q}F(ooJ|fXA6K|+e+z*1_@(I;0-o=Ez*%d;Se`*WRCpp{&DZWs zR&3R|VHo(1hV^G}E-M7Va<@4nXJk=Sv2yuwAM{#T*dpQv{I)-6yPz#7Dp;Rs7UCOB zr}x6adU2^A@Vrn|^9UdP$*++Ozp2~Fp?EoowEpg?w!ks?bRDh5_9xtO!V4@N*CTw} z>P282nkJkjQ{F;MX5{O`PZv|p<`gBQk`TD}RW3vo=Sh++*BoCDi~k&9aIg{zg7l6# z*T<8}?-$_{sUAM?pjmRt>&+`&4et4CFMc`Miq_3E|J&c-iP%~&vY}GXA4{gbBqc<4 zl6TpNF+r3tKguV%O=MWs4uP3P*Wa4?pac{NF{2&f-J^Voq$gr#Uevy~yE{(m+~tS9 zz#pzUza1mT;S({zu{DZ`7mMfr^BoYp<1h)TOih zPQy0BPh7P$d#nO_0b?=p3v3VBKFMBrv-(Pj9zc_;VLRPkXUrsLfx*#M?vD=vw4y{@ zc}zjB_KJtqPf6AP^?rJFK?+J&EVw?0gC}g`{)5P*hYIqhZu&JcF}a(seQIEICoZCC zoHf?Hmtpw_?hkdANfzs0I>M@zv~^AUV`PrK;GSsvZXefB83+T)?=ZcnKWfWWZ@qYX zNLa$dKas#o$Vgk|0|bV_Oz`3cu`u302<)JV@bXEc>Cf!Nb89lMzknaRu?g1_!&Uf? zwx94Q<9a_J^f8LLA*n1n5P1+7R)MoywYerNyhNA1c6;~JGG1J*D4ODD?zZ$o{eVwg zfB{&SMRw{Gf4%lL`mjE5Z!uFqJ~}e?oYm6 zzvdhZx=rey`bK-+$-CkJ5)Vp&LY*M4w#p$BjX?m1)A0L~-snZSNbsT&H>`k{jJgw3u#b_G^Id069=r=kP&?>9_T44Tg#WJlfYki?$1G{ zF@r9$zB^l-L>q$uTT42frRSAKvd{}x1VH(bnbID({3lS%qft_!|ft1v>sRLZ!$p`B2(4@EB3VP!Vi zR9=hYQey|#!{=^?Q&+guKP88leYZbGN8~BS17DNs7dzWIYx?f(;+pVQVlU!F=Pq$zG+WPbE zz^gP7BE+A_^-k2ohvO19<``#^^K%+mosZPiYEs$Ic^_RA&WnUWHAB8*rQPJyB5wJA z-(RCDpz0E4Yu3XJgWiwxEn!)8BVSOwPttqL1N>D`wA_DF{1LraM`>=O7GQp$N&frk zzOzg$qnYq$*JInX{E9qw0r#&lu8Nj(wI3;8bpR_VGg-MJ|MUWDKY)l#Va$;RtIJg2 z2(h_vy;Dt&J)gGZd1^W;l;6w22DQ5k(^@vr%mIE8lhTtta15D+!(>vlkZFr+>oK;N z9$s>jd`3IdcwBpqnh1>Y{kHmMjXp$}NreZw#S2L`g@5xF}$7g!82F8f`H&s$k0 zE_0fi$y%$5BI`Re_2=o}Je_{swGlvoAq<7LuMyWCtH4p~9GZC zKc7m?323LGbO;lfkYHaNlP2kNtM{X0K3!2>4x#Ak@is5UT4Ol|ax8rukq3(|K1^ky z={MwpkFa#=`c@}TF-ydp=|8m6R$`#IT+n($qxCF^*hB?o=?uLS1nwe^OK7hG;XG-u zQSSFLz7jpR@daKPz{hO%@cPUX+*vp>mf`KS3>4Z*AdI|0Lxhidv5wqiW?RdGOm&h) z+*7PY9y(}rgbs4B4bT!%$MDy#J+!4@)My=R>WpmcK1Icao!aCvpJgm6Z?@A9|C-}l zT~K_B<6!c(4%yC?KS-|g`xzVTz_b*-?3=?z0@(6JB}r$#cfb*Tet1~gGZ~isRY~qf z-VC>glK%V)DJVCC=q(CjpWQZipvr`UN9zRs^hJ?9;&sq%#N+rZ7G zs&#bznO$P%ZR1Bic;r$er=h7=1J72;>?l`}k={mRadb^M z%MvH@{l$K@LR38%=hBHlxQjgPG(~G6snwf&)zq28U$Q%cp_%bNW46{F-}{eIj4Af+ zl{J|0iL^T<-cB}6;OhVM`s)_?<_oeO`~B|Ei(*l1pA|{NXv%ryJEK&(_-1RBSakM^*d8>vr0sO;L@a=mPx2>_mi3!^ex(@LX)5(LCQ|>or$v!WSRmIhO=kgOncWk}lIdU#> zD3mRAhi4$67nFALI-OzN|JpmN4HTiOL%@|6+@@Pj-qWq4kx`yX^-7rC;MaGlap)aa zrrWYsQueUxt?Sm#9gi_5t+%4l&zD*nD>uDRyCttU0NUN2V=U*|v&^HiG{Qj@A0zy7 zP~I%WB9=WwIXWSSyRJ*NLX1Ra=NIJ(-LCvn87<`EN{zZtSx!a8jky*Sv0ny#$uWX( z3x^UhLKqZw$9K65rMKh_ugMxKKY?%IG!5hoS^h2U{(ybiq*00LWesn~N-|Nw7)KK> zRdcFK)|R&afZ-ywdVbF(>=C@kj4H8E2k*S$Ht>T*i&voI@J5!`*80j6Ez~=Nn40sy3a`AGj8DUNFbm06=p+tf<428S9;)JbVA?bmWe->USmb zmM=Y#a)APXNUC&*4(fybk(PCCj-C>DbdJKkt7_StGSVsH#7p;-$E!Xcd|)N~6@Y%< zO5>s`95Zhv%qUT*WV00ujMkH#KyGVIvMt?zqXg$d3ZkYrF8FEhOXLe#;&^(1McW?#wc(+h5ud_yXCt^Cp)D7ktT?v-M$jlX%vZE}kK4Wif^O+BLZHQ^DDoNeD;xpHl4LFdC5)VY{4N+k8a(_wk0wIFF&&N7O++t zPU=1eaJR}A4$uU}5=~BjwX$nYNpESEjU^vF-c{sL_DX*^49nc4&dc@PNm~^>Am2Vy zsM@W|=krSbdV89iAICQ?p_fZRUUfBH{cWZLn6*2>U)$}?Lo-wvCpFrAj1np%`=NVN zP#V*m?votyZi?h{_yU=e$VBhxZ!N9+2q($*!*=W}_R@1Bg)~M{&RJ)7gH<2?7QKHv zKyi_t%w;H}POfFi&5_i-A9bsl>W58|u0;)6|FVW#c2dpxd3 z)6YZm!w)Qg(_yPowUmFvFx~e+!x-za!F2@{B?mKpvU~;-6YhBn<{5p#Ib;#fCfbZ( z09~f+UA*g>9*ohx0zqci@Whgs^|#U~DU;}%@}=i9EgPP%r_C-y0#EQz1Mqi$1JteX zq-%%$v-@g-D^G>uf!2nh0r4HCUSt!ZDn|Svh(Kot zRKqI0gIi9hsvcwAdwOJz67P+GiL5rrf}?7A!nUDqrL6QU8} znF+f9F;N+tA2pi$0S1cd^q%k*EALzUS2Y$@P*xS`?QVz$Ijh%Jt0_grX$Ct4S!cOR z;>F>J;i4fl1K2k!c*D`R+hz&+XL7HG74M6pa@(S7^hEB#!>xC=2dP5nYoE-V{nrwq zjn1ZQvl=h}I!uN(>QUKYfvzde?7klurLg&xaFY7&ElI_d`?GOGNzsy$)^Pgjl)7}< z?{cpz(=~gj{pz*GMMOvdmCQ>PE*7=;Nk^AIRlfu{_(tMZvb!P{+8T2Wpoe)e_ueB^ zDset+1c~r}*=%AU$+pz7J#p`m-8}tfR7z3&3r{@p5`EMxL^h9yXhQI1EYhEl;$H_^|%hsxe&qz_1~71sOx3< z+%v|Fo>V;OZ4Z}Ofy_S>wzjcQqmQwwoNY7!97=;=*#wnMzuTjElkq+wF%D#bEqIyD zpY0RurQJj3(C>QRyr5{3pg&Owp^%7?vWc`!Kj+)Dj2t(=dpFD7G>QsbKLpGWv_5U( z$oaylJMY`*UcEbqwx}a57pt)b^0^ei=gM<_5%*reoHkO8AoQDdOvTab%HnArO9?d# zX*Vm7+k!EU@Purvz~@chyjZiZ2T07|mC=`doZu=4FV{b^2|tsa!0pgMo9aBps;mJ; z^T(9QgM1RgJ=-VX+ek>-~pdp8O|crJP49>}gD2 z>g?1Db!1|bIx8M0FB|5K{g@l=UDk9)B}eHXZPGhLF&{MOB6);b$k(xh1^4PY8^yGE z&czSWwclb0exy}JyVZGQ+6CCUwmz|3m(yP|I@1A9hRphSROmR)|df;zW(&CpNQ znoazd;ou2CM#b}a<<-@tpW>Td7CgMJ)L|BwP>FIV**Hg6jj8gHS>c0LU-$4>Nr=kF z?BP=5?4dQz-sy`P4_CuBH|VyAyd604`JG9zB1P>OIA1U9kK$DrR0qb??#!kugrh2^ z$w@xb)aef@6(fs6C!J|7s;o4Ll)gva%vCpxl8-)M0o0VNt%YWy;``bv`_s(NeWIYqAo8VH90QIoUg_8G&`QEUhpq$X^rEjtBE&&jwY56yxskZT1{`jBL zuO%NFv#jF|4K*|t01xD@`myQc=$lGQrwsIibBB`*H63%QujwqdBZcisM$ZGtuQdUf z0a^e}vLg0GfIIBe};9ixg4r-UZLcPdY20A+iS>YYrdPg4cEx+;@*DpU<;{@ zVMP8+D*!jk%UHKf4++1(BKrZABLx|kS8Z8|B(c{;Rj+i~N0DO1&Ol({um9^KvW zOkvoOpRFCPC+D=s%(Om^Za3#Uc7VOvDW1!<^Dshiy>diEzQ}-xa^%!=?^Dp8;8Z`g zc*2Ix+TNs4Z-9@#bwo7@-GMGY*daG0SHMRy-PzDGk9?*YMia@#Fg1@1oc?GYrS5gZ zbxlwg4tSdBaF^g`a+Bko>tGs-(w6<8FJvApGq zn8WgrOQ|FNor}l%G;a*yINY31$7}w+S_=;-2edY`9u(<4odsZ4uvMy(3P(7j{~u)O zpHA*S%i9gXkc;s2g;i2zn{%h7TOi=~+?ugAHsBD{L}<+{N1M#6i{ zu6n$Qnh0s_**$3#RU|+w;sRPa5n!_ z^{=yIION<`xK3VlwnHc#MV^{vkV;FhrIRf1XF7r(sB2=UL}=pN#*4WxAJo)*%+=fR zb;ln16nkS8;O{hyJh#|;dz!}TmvRCM#TdI^gO)5yyT7G~01+P8YFrs0p^5PN>qI+~~F#acG}QkXz@tvn)bih4m%W}-z6 zU^O63%|Wh3&8v*T^3D@3*pAojwwFx!D8l-`&VYaW=2kU9R;pUbpDbG91L7lo)D?~^ z5W*X|cim$PKW%xZrl+Om##W+)(`zqx8|J1P;HRz@UwG;4Ikb=#gw0SWF)J@~hZBWI zIZuA-znCw6d8@;V?OxRG|2h3nD`Br-80YFn{?K=lu3^gOrH80sV-4lYAOBPthjBP$uZ%*efs)p)g z8@JpyxZ=e}1^B9wjJ*BCR{2TM7pm&K-SY9Z7{v`uNH6Gp4Xot;VGN{#Y6;bPlApk5 zJ6irbPdVolcRBg&Aq_7p!gg)u@TgA7*P!l$%X30Edg$;o!zfEiy3U$)z}t}wY=R`D zet=OGJe5jKQp|ScbmY)tFDitZ2QkVz#k%Xd{ z+|xH%%=~qObK6*+X&|^^rnZ(^zuw&Gh8b11Kx2`%x`J+dMK@vj=dL`TLe4hR^u`-1 zr{f$31@OMobD9RRJw^V=IaWebHHPEyHB!4@NocF#=Vo1C)5h^l^PVIX3`DRfv%gDt zQP^V2h0)0%;XiFO|Lo6>-)9OWxDNAOGP)GW;e{#sP2c;pLNX;YDtbF6vtwO?#bE@w zFAbn2q3KK!V~d$8hr>yB#pN1T9->HO(b>1lo$oYlrCy$tux|S`cZY~t^nL6gf8PZ4 zDtzW^hJWm#+}LAk)!h{Y=Imr=5CBQo{d+~_jL#nYaC2CM{eWoB0{`7mw`k39x-ViT zY+d;*fw^Mx=H|S|erK01r_!x*UT>k9X)JKAWdmJ`?a62b#CEB00IrmZcB~Q0K#^_V zS)&#LP-4#%h0i8DqZHW;pb5p>88VtHgE!dgb}AyL>qZWeGb`Mn#ZN>Lqw(SW$+q>g zeqj59#}3}pc_uQZQzt08!Z=ZLBLScrv0}H-a;qfJOJQlkh-Zr8!;6n1^}!(ickN#X z+1M)8cemALJh0#THl^UA1!g=p2 z!nrvRGaEN1w@(!HJ`VxiNv>#kFD7)_KbpxkDlC3GJi|k2Yit(|d~vIG#_K~{(vucPUCVWLl`T=z%31;VX>rEh>B;{u`*;6lz%W!@{3+vcgRv>xJF zGA3Tup!AB^8?#u47h4IXD0$dB(eBdIbMJK8KI?AInl=98cdrIg^dAUz&&Z^`oS18$ zo-BuneUe}$4g$(kKe$Tbe;r|jts{{b#hMSOg?IP=>~%M|eGmU7uXS@5;z@h0^Bp`8 zf_A0t>*j*MbbIW(kPM!{EZl?_vyY0vOeCNKw9z5Sg+{&Li1D+KIXF%jt5>zpV~s94 zCfnKO6Zu#z2#4>w4|TOMm}S@>cX#!sMxY^F0Qqdj)I@w6`7jFg+x11(-!Lq^`n`7u zr5@D*&u`5iq$&3LWv8@~jRBqi87=&WlJl?Cc1VMHD#5y3vN=^KF9q#+}3F4-n{ddU(UD%y6U*{2fAGP;@<1ey1O>ekGh4(Y$u-IGg=2~xv|79#r!id z5);fa{ZGttoes7GV7gWnC9|8I4I>=-`%Xz8SW;CMXAOEn1ZuFUWE!Hsk#yL(Ky8k# zg|_;fift+h&&5@@BT*C2Q6friB6mb2iPvi8Rd{Xt*qByrUm%cCr8B7o>f#cdoXb2a zfEv7cpri}xOd0LkFMsBCK0+8=2(S&Qzo>c&E@%OM%@*}*hy5NhmolR~v|Ne6LV-yY zx=!5D598w_#dWRWL#Y9XvHObm19m$Y?wyFFSL1D2+47fXp|FtxbLt{K4W4K^IeE@D zS#ehR5xEbx%OsTpT{{l?BHVQ-nWzraqL(`;@Ce#MXHB1QeB+=uSq09_QB7RpSd+o28B=VXsh7_X`L%A(4R7LtlkE1z{^b5b9bS%e8aV_PxFTr@kunP+`)N`}dH zs<^b&?1+S@9Doq+A&7^+v$B68Q!hj zrw!qY>dEc!vJ6Lw<(9d|EnMO8c5^`E6!ZzVH=u=KNmofkI={kvP)&Sdp13U=B7@1y zAooe4Enco#T5ON1Y?Vyo>Y2S}IQd+oBgN+P(px2!(&r|`&r_o{Aie_UiYFp{O0S!- z3FgnpC=Kb8-e@>5R8}?qS9aIGzXnXeYx-+e(L`d6nenOljxnfPA<;)vI&%}Sd#_~= zimBwR-Cl`B!tYwkI2_ze^c2atbiZRhuGZPQ~L7;C1~7Cq3K zw3*uSePaB2oFe>u@NmoJits@2j^^9@{GYm?RNm7KERw9VUCVdJJepH6*^-Xe` zhl>;O`ipUKe4vnmApNeY4wFh?)i;U!d}%-=!L(Y2;sM&%$#vb+{4aij5mEyk-5_o1 zi?InV1WVa^5lyiqO4Seda3aA@zrBeed&Iy@F1WFUh1Qgsd7IIep?FR&x zWT$?F{y-BNyfGuoS&u(wWLwfzrLe9Ds^v+k8`kMqAx51vI>j`yr#vDQsyep@|C-5d z;&02Cnb4xDD`eq3^|v#ixf?O3GM6a`^&oF?WN4LK6%Y_svOPe(LiG<7~cA$sKelInbzWm9?g<8n~$rtY6w2-qCBf zhj%PM;Z1e{imyat8_HA5er{f{ll$uUlc$c|_2VevzjC7VuP{Fb+)A1ZIfvY)C*xN{9y@K^18__#Opv--Vvbb?_v=`Bj#$Cq33Rz z2%C|d?cP!sx(YiuE)9 zA2X56*Bl-2tg)&Vfb6BxTmJEEI=nI-{gyu(IT@R6f=aCI-T$MN+jEEXdFJZ(&#br1 z_L+9KBJV-BX`%0@t~EQ{<)m=_yRE#w&CE=`Qln9L6V6%}%f(|DmItk(gz}f5=yf+AESlQmlP06FdmB!0@rZmV z1xCUaFALeWx3zY#zn;82Pc1ek<~@|4c?}}71x?@yGxS-um@~Lyz8`3J>X&Tp2;dp1 z$KT6JeOb{5%blakiK%3TYwnAZO6aNlG^S=FmplTken;tI1U%H( zhOwuTs!b5KDisE-Bzj*9>zR?fOZN%Q+6|xywDagpz>mf$BYqt*w^^HQy0lxkKO-pc zI4$PtT&Qgil0aG5tHJ`WLP$z7dR?axHg>96Cy`tlsZvj1U23zc;yhCBYASY3UNv?= z9SO$#1NvpoZ@$MiiGYL&{A7~*`pP%PHm%AiVrummLfCc1bU*U4W3l6F4i0Kh$*@L zQ^h~bqdeKR@`0#?uysz{!{(VU2|c~a6E5Bc_h&9^&Xn63j%8Hzvf6+w#GD~O5KkS| zobOrZ)mpw^EV|zvlefc39#W?LibG+5oS0NlxYe8tCSxM`*2>R2HR-KRw zEL2|!KbN*Xi9><5?x$6_oc6{Ky}^GG1^(TZJ)-8x8?pirGE$z12etJMA^dS}W|F}Bm;L5sf?eEx5$F^;w)3G~d$F^;BoOEp4 zJGRxaZQD-1y!YIDzjJP_s#WW+UAt^z>_@t2b9-rLmxDLD{36)%PIZw6{N1s2T$`Y@x~@Ak$sx1>R*_pPGE-IwBmk zAr(Sh<`}wWJI_5Wqazn*kS zLGGF6Dy@Evg_mLSs2!DAR3DiQnVKFSJ>mJe{@w`n!AY;YrU|XWO6o!_ar)`F2w zj%#IJpO2u-^V*a?k){p4F%1={c`T}tT@wq|?(zsW8K}z-v6n5zPtO(aLrU|NjUG;l z3(Px7Ef6wha8_hfJH{W^Sc4FLtYLQt0c~=ue%PmIS8)~rfjs(@V@;UKLPQe{IA<4l zMU}6Y1;(COQh|lM!*HSlgVHo$J*jJAR@#fl7FnV$x%zX=1!3*ozfiwpV-pBSooBW! zkM1Y0GWM&9o&pc~+?89~cxx>8suW=4YL%R@#(HlE-)z((;4~-GII>tjhCAu zl@DvLqi6TUsL&eKg~G(g)#KjzFap2o8X9!gk|>Q3)O!DFrQ6luJxOgD^A_`S4Cf8y zUZ{e5L0*LuQIYlr#lJ7JHpe7k>~SBXNVG=9=$)?S5|6WC37;7hw;7UemLX!^pR=A6 zdy}+<2*Y6@v6}u3`SU5$oCNo2`?0WRFL=KymQ@Bqey5JRT8J-c6fl|+kr{C z{f)_CaPm^-k?Q915@Zwd`C4ib-BL(b*pOcIgl9B{ZW(EB#44amcW{VGVBKE8#*LjXMvdoqad^EXg8iFR zNf|HfAsPDmjTQ*K@rQj)V%OJWT=J(mb-8QSq2!bZbc~^^o~2PSiu4``Hw=f{E`hhF zY!)p`J`3cSMpc|hEpv2^{-<6p&g}(O_KLX8v8B+1MBXph6V*zAq;6b7ZjdAm;tLR9 zkd54w*bsQQ0j(L|>G`BC<4ua*F1;6jYbCjVsdizBWSCzd7Ox^&mOEFb@bcczUko&p z>^H46ubb*p_uc~?`j>>X5|%`iRs2o}!s5GnbJstuF#-~8f=})%Q=1c<=WJ$R4RzC7 zDIZKbv(r0?4i)>xDmmZuNyK;aBJ3-kt4>XQ@vb9netqN9*&+#;d*yTG1+)j8nkK+> zT3o-vUzIvoT}}|hutHRJCqJ=j?F{NmcFyBvug;NM^+1@G+bB6R-t>XRT|<45@X<{5 z8eyli{I<`z+LVL&d`)xzDdRge#C5Ql%-A^&$k2sy0!;hE2tf8h&fjN=HLh zexI1$@ksF#<8_14(keG5Jo=v0zlXY3FpAk!;nn}qqWRBK+?fbI=QeMyIK+flqQaTT zrOm3Ze|Pq5?$@T@CUe&|qZIse=ETnH*5|kuaRwGY)$nL9HzqyWQZNYT?>$wE-97Sk z`c+H0V#2n=z`{M~&cyi(4dC+J;!Zp(}*3Sk<~HDun7R-cF>Hf;)Ery>g5Evr0|?fzf#Vs^6r+qlWNvTj)2(vNQ>I$k%DJg?_nMc)LRUZuTwXbpu{AuqUo zLW3pES%(wS87@BQ2|P_tDxF^BJB5gyM4DO+7op$^Ju`bxek`g3dRI)#XomH&*qRM) zRP2is%e2(-@esv(z*a0;c>zyQZ-lpiXwznGVumb^9=lNmCz~*go4pCp0gY~Vd_eV9 z*|B+u)WNS`e}nTz2uFisA0b>CI>YvDhT)kD7Eo)l#^KXtOrVE3`qDP*THMc<{{pJN zTko#%=6&YqYxy*vtJnPA+F^4BMEYBToozn#iKriO1U7*lCa9v*5nbX(#C1`8bfKYf z(N-ojfQB$=u1K%s)-)}2RyUtXNDy}q3$&mZTpJ0snPSZxSH-h^VkMmRgE1tMHSQzq8&B&<$y1kny%;*w7 zWFY^Us>~6yqCaw2bMUuR@G2k{WSHp&CaeJ@(S?9drj788X8rk!akeZbX4wM#taUB5 z9S+h$7|p+PsU0Dr&29uhwdc5UpaLlvc_NWrj+D%n&F^>z zI=Ug9nL>vZuYz}z8O6GzIe`OE$>T|!ulVXs@jzj!%7wFWMfBK-lHHLHNb!G%8CTaj zZ7dkLSyIYQH$WTE9lcFiQcg2;SDUbDMMGN^$0{5-A zvOC~m8E{jC!Vfks>k6tFYNDSIgv_3N^IPOQDom=JKup->6S>_P3;n8g6TH$~oug!z zj*u##KGb*pn@=~mE2Gb?t@-^BqcW~53|frbBu|w7tk0X7{iuwY45^dVLACy%)W+rpowak4s231n{W8;|pVI2> zXISBkRO{!=D(Jo2NRI}w!h&Ko1-~pJtED@wz{xFrR|uKZUd}v8ZVV~p5e2dw7IQY# z(gh~KSrELbnTqJAMys{f&IWKxSHI;bM54dN22Vdv|HVA!P8(HgCjN2N(!-MZesq-> zv36a#D%x|InOWSEK{+2zdRz6xU)v>WFWCyw#R-Rgi@-A9yB>}}36Y}fC$7!P2I6i% zT~jOXAn0f?NnDAthxs;6h$fV2O6`Ly3h7|oN%NC3E}JSQ`SFBpU;W=AP5*WJf`BT7 zDf%^?R!GMoV8hkP3kA2FKK1V;Ln|9!?05d<3G+hQA)|NcIZN-kBQDDGeddj^8|VIK zo7@$scSMhZ%ifcc27)RZwNtmAUTNd?yRk1{`ro*m`gULizlq0D{!GHx(1ZLvYGd7Q zOPb~sBCNz&)a(T@GjH*{+8#Q7kNFhmSvf-<3K93~vrKjdqks|N0i!WP%`t@V*Cr&Y z&iX$+Wh6OrhvZ`1Rsn( z_Z8d|BpyDUhoI>&Q=FP*Vl1p7I!74@87p)~!ygmq7@)94UuO6xagZ_5nmwmMGw z1u{q1O;gj_l7raH-fhuAdWDq8Ue{#J7Yh1b8)rA_XPF2>L|uhb<1z2jlG~n`bW+EO=02`BkcOyly#4U(#YY)IAs4iVT7*hMZ?txr zkP%Tj?$Axb7$>~9T&bZ`Q!q|>NiP( z$f?lM8R7k6rQvs8?iV_*@G%+^Fb2?JrXn$@*j!hJr=e&MG;qrKaqz*o{eh@6>k2BY zGh&25N0<+N*Ca#G!9KxX2CeJePKe8mh6%W2$FCYN@&$JqQ11z5aQoJ&T3fEg`BVXD z=WMo@p8rSr*i?bDaKX-v_!Y6Qp(V}H?b!tH zC%#3zg73D+<~a6XQtwMHrr&fkh84;l(%sg%qUm%*6Ky$|;c z^bwv)_hJ#EOs+lSi_YkjjLmrKRZ||*!b+X}25F_snVDHAAap3jl<+iQ0KydIRa!0N zv^v^*i$mn#_`p?}?USV0cRsi2jn!@|K^ePl)%9jl@+&nR`Ck|$o6j><{A;hGk8K8 z!GeI53pve5w=AvZ4!;owqG~ien~J5JtZ-AWqI6ggT{kVIWQ6m?w5J>ET9DNvIUe)7 znjo73{{(1tesOLoK_A>3+a#6|`T{(nfna%?^;MEOuW$byx%yY|YRw5I2Q4o|=R~YF zJL0!uC6&ETOYfMQlWd?VH_Rod%|$r`W9#;_TiVCdojXt47QT2Ogs?hm$zoo1>8OFpDcKXF^T&c+k$VWT_o5dYB!k=D=?>cfGDB>4@ME7hF&b!RKRc95l%O><<+~(lN z@X6eTiBsCq(QkfTJhF**A^0bpFSx3eN}2ykIHog#(39dKnsk#$C%G}&*=&Lf{mSLu z#RbDHa>Nx%#U9HHb={PF^m!JXVOVHOSYS|fq&tW7vTycgW;)}(=|VSPs>u7y4-tcM z7(;Dzs;9^`w)p7{#s_jEHz5a7@#0tU#qd}T1P;C={*Idj5u`=2(KP`ymNkEP;O~8U zR60m?y}KR0=ztIt5edsyzc{RZ38_D6dlFlE^GIcc|{yY?QW6!sC@ zAg?i*ZB_m9WK*rCo?+hbAUjCKNMMdSGFeR&Ke>A22p4sEG>O#N-n_jIlg`>eV~xND zBoCxPStF6cxH5j>7fH@MV01wwY3|T;a^_|E&>ZN?$R6_Q*V21y7iL^G1|))79Zq=5 z+mRYB{JG4SOzoI?f-|7vjFQ8!Up@>YWXhjlX@0XP9EU!vm19))7yf#Lr(bO3;Ao8P zeaF@OWkj&Z=?%h1KU;Z-x|_zY*cvwG#Fw7VwO9rN2!K!bL{k3jh*5$&U4LF+(D^&w z;fD(bOf2V*yA|N4S34eTt6$|A7HvbE-f+GyE z@&SH_E#wj1Kz{(p*PPke0Zci;#9F)_m2)@}n52@4grf-Ah-gwSix}wsDvAl6DeOP0ZhxZjc z_Z9!A*w7;PuRzJg&+Y3#7O@o}huy%ai{kiDC{jj;ECZ|0rFPu^m9 z=}79JSJg{ZeIHlQT0bbSNSr^+r7Wkt4R@er;yj(SD1X+K(>r!ZWGM!bMO)V^6sQQc z%&Y!+H|Hy9_srm&`ZSpN1$G|%pXpuJv3~ktLfU5xjD9Tm#mCPu30a!52gZNVDj*j- zD(673Iv#gpX0-%A#4Ik>q>CLP%_^=8M*jMy)_|S_Dt|hJ6>idCBHoxmNJDPtv%dL1 z{5amocb$dqY5)zjta#6OkIJATU}p6?r(#cxt5Epa-{msAf6$ID=?;RXTm(=rAp}kE zYD7YuwKL_6im`WxMgF!Dg@ah!P^XZb=$sE2z&FBph!J<{;&#AUUEHv?>eW6l&_8A=l+X{EsNHN}zNqCmFPi(T(Db;0isY zVd9{uCdRSt>iM8zU?B|4=YmlnT~Y~O$e1rB9+M65kZY-a1bm?nnaj;AH6j!KDROGnzc`UGpXFE(2={;s;bRs<+>)B%vz-nZr#; zwL~^2UEc}5-HY3yoF-vLkY#X>Q&yu{F~TV4hMnZDA z+Nx8#C6n;q7im(dy$om-_e9xC>U}k4@N}UYe~@_)H){V+Qun{N4GNeX?>x@Zm>*ZM zdiq?YJCRDlQJxv%y%mff7CrvX6 z*2noyrfD2i!d%OzDjhZRt2Y*zWc2k?uX@Vk0M9KE9e#Xz)58Tch&CY2mfmpP=~^9M zSg`*}3RjaMtGY2<4>>G~ok({l1%D`HJ{t+?vMfz#46d#FQu4nn>lKF*dS@ijg=f_x zc9lYqe( zsJsaD_&z`v(VKGs>T@2B-=r_NL!HZtj(75mLs%nn%hpOpwAxC5DC$>3;Td)V869cNr!r|z?Pv}=U0LV zz6nq-_@SjK@S!7B42WW*DQ^NmTQk!YGw0g?d>Cq@=W$#%<|yy;=X@W(rq+Exnfufr zg_SD%SL7(czTM{HH_SOxuR!`aY(SxJ^tRq(>o>jTEJNjE&=dn*)$eB_tbH%$JSdXE zyKcn^WC;0#z6T_i71QpdHOpXK@x5wi+ZrOEjFvC7{03W@>nbJGG|L3(Z+f^WyhZDF ztN3D9YnY9NQkel-Ohh)OL*}CM9}aO>bed5AgsHfMVKHS%b7+WK%O77CZ;Oc7cCAly z)YT&ORi8&Yze58&-0U+T)f;0bqGvJCWJoJKc>UTclk}bVR26la4`@)+80 z(Un_`@}xDwcWtRw#PZr1E$I|T4bZd*PSDNpheWq<`G!lg6;hDuYZpkQJgf%js$!It zx6Q~0vs%tChAkF1NgUDwY}b$e+Y`9rkM|SBdcx3$!$^KY(}|M5TIG(8iq}@{>aRBb zyzo4}i23AM|BUF8jp~3pHh{c>6X5~hnqp)mpf{v?t1fM1V(8=lTX3;*u{pJgS4m_6t{rmQ z#Y8G)*u;-psDf&sTp&h)ecv89g@Ur$77*Y^h*#rni`TOj3PJ0tf~3A@=lhIjtPiuQ z5DNio1FHuxSzJgpwjlU~wFGP*=g;|NtjpBK&=6y6awCltm#{k5Y5tmo72E}Q1~fZr zJ^!}e_hvI}+oM#pekPnyG^9y~QOQ9`j6>2E*`UAHtG_SvzWG!6BEFQ_F;K;7&;4#e zUl{gKq*c3MrdH-#o@6ERHKZz6dbhR^7CG<_p&_BlEsnGVKN1Wa^x#rL(rl+{3P%lY zV&Fb0?d81w0I4q-2YV$^ZFvY~XMl{e!|R{f0bRRR@5H3dH;nja!P%GjOD>u7Z=s#$ zRsGs?85{^Mty3aV9ugd)@YSL6%9ppFaW7qOL%^0NGFcC>v-5*#Wc@gYc1_NGv_>cM z*+}~-|0`{?kN_@v6#6PjT(E>RG90n>-I&I0Q@HwF3*P4?j9F=tRUd0H-iMXpLp%F1 zx3(XhW^zsAykH0LM((1F*s?1yUH9A9`D_Qsz3IoYJle7|zhbB3Z>E|+9UN@cRuIZn zDOMJBO9O!XKiT^$R)!;2&ciUpgVq@&`hHnDBFY5L=^B16VB(E7K*X(Tt>qYd;Xg#b z-rAepl5Cshox9K}2oLMq#67}0yoF%OD&OxbQiT${9DcYtGlGt!N<3cwmBL$&Gyif|%K5*9PCtmiZ|3%4o3 z#!nF?MJBV>>CT0lq*#091>k&8a;*G*PY^F%ChT9h&tO3Hjb$9yZcdakQL6w38^hCU zU`?~HtXmsh=DLiH!JPL$Sfq$==`#%E4^~@)PBpmoF!}jq==nlymu}p$+zaj^*Y6IQ zX-aiI`)?IR#xgI)qQ6(b@`7{@A^RbU-(l=}goo%LD@Vmy6@CS8Ri8^ZtID*o`@ z|2ey}ae_vuj4+1Hp-)WuzP`T^GkW-}aDEQAZY=PglirzJ~ae$uPK7Hvlfu`MA6}?!N>**OzpUPzu?bMT|1>S&wbG-C(95Cn&ytu4miXk9xK# zEuOAaTOc#3$n987T@xmm%xB#Bgk7o4>rEgiVn?h&LFmEnQeMgZW0*mWwlBHX^ohiT zAxY9WKURl0d86_lChipxS?sj}fN=%a44SdpfN~r^Ou@O9HOljoZ^|=zrl-98lr1ao z3WNe}lW}^#kK^V>W$#*^rk_AG%iKIPUxKE%Ej#}=6l zS>zGJK20=ye!v8RCH5Co(XQ0Puq)9<6Q(5{Kk+$FS*`1bx&|lN;3DW!4?=!#J3yNX z-~WxlXr7MjCA+aFuX_^@@;Z@Dy|-2@D1Vypg`5LOMp9J2bfytQ8>l}kX04=I%v-p! z#{_#y{ft++sh7mI7Qlzz##sFJP?T;~5yL!E^Yrp){!+YI3`qeRU{(;l!kg4mfUVst z0dA~67<7oe&si$}xSU-28R07#Q7=E6QM)f3^fP2LhQqQYSpVLxhTVD2N=#w0-OjE6 zNW{~G7vFT?+L)pL2`4hIDINJDzoMCOf~5kbK1BN1$obf6C>rJ5psMBKx5w#MB|(Beu~Ss3UGBTa6WC4Stledc~{Ymde*mLy8r$|wgGr9-Xq9j@yn0v z>@dDs>+Y(6zA=i&0J6x?^I3v@GIlxgnu*6ZtLlrGUo(O;pBAS;^IJH;)o(eKV5M!H z8l2_(%^)V+oqwZOF&)7L(PDACm4+iAZx?#I6TX$4>Cnb@`>%~p!pJHn^GM<6dW z+YlG`x@(e444=@LpQkXokyl>hjZThh?@#vGwAg8_))IR@gacrU!Fvgd!TRPdIS_1- z7%JaNdtC3IYQefit`_ihs{WP!6l8{xr~^)=tr`?NvUmCiiAGfMO04Ib9#1EKW`x9a zNhnKlg{}7}#G8z`SVRA61om&M$n_HrODY7vYaO~=WYz~(ImaV`MpS;Luwsc+xgbr7 zoH~%p8fBWhhFS{=|Mbp&0n@zE+M|Q+@oxx|hk*3r?Fg8wV;~r8@L%i0V*0+=aaG}K zBc|=*ZpBv$7a!Yk7u%1Vjwi4ng62M^>I$Qqu9+aa_Fgi9qXjZz^^KR@jeNQQq_XaO z13p>_O&N|htmWJ4bsL8UvRKeJ+fz?KE28F~G^-{3RaHmgG&FS`pF|U6r}PoBhOD}Q zPc#`GA%%(QjCCozP>$1I&y{h`thd=sV89r7p%=wW)5?`4w+ds zU#Z#Z4_5Y}Y9+WXj_)~|otEJeh~cwA{iu1$0!mv=KQ_{SsslsKukIq8?#g|o%ZIY3 z2bF;m%$&kvZ2VJ22n1;+I&YN~*bysa56c$i9TvEAKXgQvCZ9W;r-18e{zP2hS`A~& zz{8tZSmGH0@l-}Oi9YcFF5XqSt`vM9e2Ix|yw%1Oo#q0anVK{J46d2qk{sZKp3z<+ zbbSwlk$5Ga*(Gk;Z$L&&3wJ$!{!Pp?V5X3G_`5qZO}usf^!urwA@upK@0`NLLtU&mp*IEvw577os7U zdfT~=;qzpl1-1b?d>JBFbJ671>SL@vayL^tmLHj-h^D;ZUio@|jPItiYV_LJld6)g zE&ccZPmKT~xn<3V4sIa8o50=)@JLB<*P1?z6B^-0EheFXjj3njxQ}zOm|-SM7WsUELQeQE!WK5sndE z&~C-XSV{?Pj&c4mL7w*0d%kia#ZGWsO1p2l1G&+AVa<+EZB@bpj;$<3fBtuP#v-4nYV8n*1g%I@%p!&prIW1ks)pw^!bU^@gFj;M!L1^J0r zXKq4hE}DgTV5Ju!9GHd6F(XZhmAgIN`pSi$mOzY1SYcntA*Ve2z88kHz?^Nc^rse5 zTTwn(1e?QXOb6Rvx!Z@XN9SJ=iKAK*F`GR+2Xqk3t42{z7t85>9VnOT(Hj%^sRghO zg)0iH6Qqw5akaTJ5)I2MWA^HRI#(XhQ3I1tB?oAO7tM>Amm3k~l;EOVd)BvT_rzWC zss^vM^jyLsOseqBG<^lBP;Rvx@Djw$tfnsa%&}#|RZcJ&mEJN*h7jsBmH|dH1u<-9 z)2e96Z%HARJN{RQ?oGe`Oe@M6O5C3Y-Z~8khc|uAs)n)FAnGE2U)|adO&ha(#c|$5 zWP}dMKXnrFwOrMxv@Wd1xQ|@JXwQ(MoSXrMBka|TSay^nIalh?f$!udRm3w^{X3CY z7G`ZSmAhat*LIM0k}w(k#0L{>!(aJNT7cWXuEFUp`PxBpMTHj$_m0bv^>r) zeB@J*Tw-(W>^K3Yn&+o&>YJ(yOYPFl4&NkepDJj*1(G-d_#=;oiLYs_kdzsM%y@od z1LuFnTfd|7xOn{F?(I|mVngooYNFjQ-@YB$!1cUNJDZy;eD!*Di^g^1oVV}#aE^Dj z4pd#hqk@ZE+$G%IC4XkAE}dzM$grFX_XtryDDE8Cvnf4G@JTUraNobH*VSu}R7~w4 zC=fU6vn<#iPNEkkWp6`@Tpb0}l^z~lJu~RNVjErkf@l|Ix@P`irK|*pqLo{@EqP+l zsDB;MS4cMO#4X&p$sdpEJB}GtR8<*(enF`Boq!s#yfwL9--J*Gs(E?;si_@=PLW-f zRAK|7M@~m18&$)~?N^Pz5h33@+j!MyhRM=*e!mp3RsSX|>4Ms4i{{o!LBwA~eGDJJ z3;?UO(j_qve!wttT*6sugPeSR@qvQgJ2`ddLcFL_8fM9!@Nr zM3)(7Z(dXaWQ}749`a#qMNb+zBi-3T$-j}~=U11+1?ekyLxD60SrNv4S^-*Km#b&4 zt3SBe83kmqoFt@&^?k5Yi2Z&R$-2v|!hhIAYR4VsznAmJPbDgqnBr?1z6)afsrTu(9$ zTCy5$5~+qcjkQIxt5$VEUT1KEjUaW49N)8*IV5{W!<^@T1`ah?lXZ{laWj{wnw@)0 zZ5Us&tzUi4tnbRtB6tf1AZJr+oiX==cpS*IVtB9UY!q&k!?FL3#GeBGTN6ePbVKAnw(gn0jn^3~gr=yJq~~{QeUbc}I4^`#VCi#JxUa2qd=iE zvGl^<0O1tW1K^ABAl+omE}t|fqi@7K1Y7>~_|0k{vs+52d!I(g?3#bU#rCr@x_gW=*bZA` zbHZh)%MLz_EYBWhDgFUVr#SP@8-y9 z)3!kTE2^uNJa67x$7k6UL?q?iHoTltGt+yVsBqEUK#UYAn|E_D#acPmqeM8rYH z*`7NJSvT`~zY>H>HHR4^P+b>d#}G4 zNIb~#hp&)E((a|q`5wiy8Rr6WiH=cM{)uqaidYyP*-Cn0sb|Z6*Dw`xo{QX0 zs1=j+@Xx^j9~KNSb^GAfJ&iueywSWkLcU8T`=jqOF6lgQ>L78)uFl(Aa}4bSH%qYf zZ-v^_4<-|WI&y3*Mz>0sM}N2zPaLA@1VIvr(!$G2V6oJ3TO=8KVZ|NXNU0?CE=7*N z1fE09mvjqL`<(Bipoh{I_LFpyeADRTahBj~H-l1xx#tKv0DOhcwi9I%w&oX3(-}78 z#9v3qZ@gItk#4PM^KDdIK$%*Ett%nTr9FYQ^WSgXA`Yw{6BxM^&f>u^m?DIXhO#)~ z`ZfR#k(?(5$wZMJw4BiG9QfP-C-VdqgXSomrFjGs46?HT?Z4o*^6|-BTF~PNn&kuq zA+fpo+&Gb5txk!GWSD&z$(nV@`JLcbIn2lV95*+9Yz>C&9ZYqb6WIk|XNr%VZ^g}o z=7PyK^FJ6Xh?&p0Q5B;#OMZDSlqDqZ*$xl*OMc(qZ?@|<6Lb;L<3J)T3@+Hmnu&iX zS+0PrUa3tbYv}!Oq(iaErZJS>N9cyXgfW3JNg-nP@+*aCN^OYC_9aN-n1Y8e!9ld? z683CJ{t=swHY?hxnNJZ^0aaBR+yTr=nhjKmggX<~Ng|DN*}$--I!s#I z*XwRF#rp_pr-JZ2|qjL^{P|b=GsleAI0j zL2)UtMueM$CS4N&jc{kQ*D7RIN@RH3$zozM#qS!JXzJ^exeCExyyvJQWOrl#cHLM` zgKyl4|HAx?9`I;*GCq^^&p&}81%YX(xgG^~XZ2U&_Q}ZlIN6--Nysivm)%ezeLfdbRzmExQBAS@Xg9m`rl800B z->qlvWg1J$9khF~iQmqP<7mWBoFCxshjQ#)oiT@M2s7CqVR;!2&uL#+ib$;rb&!XW z*KTbnAt^(7BdPb%`Ef(FVU@PL3soi68tK68RCcHm{z)S~q<2n+R)KQ?^+XsS>S8S~-vnYa2(sK~!=a|E0MC za^dpo#YNTQWL5jS@7QFC%jC_4n2$F;Yj|$ftB(Q88R1+_sYK912RLRGOpZSk8AGl) zld$ccVs!Meqc@9=TZ3kOGeZ!5PjBRahi77Kjzk~LGaGcoX>7PTre~73aKgkQGiEC6 zo4D%PR%{vgTdMMH}o$+9T_ZcTpE>Mq6FZHWFn>~9&-3z$$r|4IwrFXZ*Z()u(!W2 zrHQ#c8Fww&4&$F6QFkS1v02+r2n-xt+&VdCjjWrS$%-*cBtT!>S!wd z{qM`UTa-TS&eJe?Y+S52fn~K>Wphcd_+Ck@b-jW) zs9$QAd>7~f3`_C%7^Yj0X5jU){A3PN+R1qN-Nrhd+d8Zt`~+p`p#h$2Jt`qx2M8Fk zT?AW&min(M7aV_GW2=&qA6&>i1HBqzhQ-O3AkwldVHN}HogTidmdav5>D4~gFpDrn zNsrlQam`oE7`KDy#ub|(08Y)GIiZ5r+$JVXBk2wb#W5H0hVUm=$PJY>@gKEQ`y!_6 zm=9KmJ)^8=Gy%Tm0c&vm&J4y`&U$w|jxX2j-j27_hCQtfx&3^NyfmitcYa&7((V?M zEYt0@ITF*UUt%ezfoBj} z#K!Vih%}TLhl5QT%B3C6VFIH@ftyFqG0HVeKN#BelP!&S-Sn-CRdme7>kfQe2QkO< zON?;y$uFiv^mIdBD4k(~todIuAt)JX&T_*(c>61OGqs#%BfdMnA%A zuNbvW(D+Bt>oh+bBE}%EdC+=oC>8#0K43kUv&q#w2wMp0hm9LSxQh)0klXk|{=)S+ zjvTsnboTAGWBYyx$gB4JiWgSlb3mgxCWU{HprdbTcZ0IhmgX8^8W>i+Q00F1<`56{ ztn;P4m(L5Q|Iyxp-Y|QT8fhn6clJ02lR#%Xe^sJA23xh;B=@FvAv58AV4dc)=#QI73fYwXz#?)+5&!lpk+z$v)|&`rSBg zNCJLKzt`OUr2jd9vlhz()`&LrLRwvJQDySAc2m$hWHFW~Q-C_sSESn&jWRlj8P+aJ z$7JylpA(Z|eaDO=!|9P%1m+Aiex~G*omfI(5k@A-81bl<%!EW=D=;^B^gU36Ut%re z3Hl_-b$)eEz2Sg?G@1E{KsOQBiuP$b{NzA4nBD-IO zyj14MQ1ym*^{NhoiW#u|q}IzzDR-FOsde#&u(wFnyyrTLayX}B=TSrTH3b)hfd6+>zx9!(7JnsXF9$+X0sS+OCj#ksqcG8w`q9XAYdPUrg9Byh)12ylkGAJ^1|*)1my85-UjA}|5O+^1I1 zKlwEq(Dv-WYCRoa_@WS}SqKC|!uE3n)Ni@gWXUZxvpye*@xf$K+XOR z&Ss(IU)B;`QU=6e(2Mm{tS7ueM8iWT+r6e_SA5;%#A^4-8cS>Rj2^9S?olRPh;tT) z`grW4!i0nbE;unU9NLb972(uDwo8slg~XqRgH$J(`u1vt**CJpZoZ=(YA3p1hhkSb z?ipDG)RyOtFiD1b@#W`hlTo!O{)?&D>#1`SK2iLoSAi znMuqN6_s8H@wy_-2;Y6M2|KqoW$Fg6MyF$$*Dp43i+r=2`dZ9=e%@p5ksW#F()IwH zhpQahbxw3#W|c_4Y%`>38MZ-a4A?{LD2}K4aPxpOgFbVC$okDpGtD2os=p|&zWT2% zEw>~#hx{!VC=(y44;VKPEB{pAT(Yu4ay{h9TG+)SEVG0D`Hb0MrH|c_`gu6hvkz~? zVwQn;3o~V6Ngpxi@ma8F`>;z&O<`CI5tsEHgMOa95l(XnX*J$;t}e-wO*cEkx0BSC zk3-Sd-^2z@F^}NK!a`*ck%<|cB~K2&4+JqSH#N4^cr26y@C24vjz0Q;cK6SZVW$9d zNJ$yv_Wt%h*zYSFp3*k zM|fyrBinjXMi@8tAm(%cdHcaIU!b<7yW_IOmyH~g%%!7HrWStX1m|JKEVwQl;OGANnC&%;qvxEv zpo5A`%NrMJ&8Evc{-f74BZ-<|#6C|)>yEyjT^TGqt?ofJ@N<8H9$*?V=|f;o$hG0+ zNGL8{=4Ma0zjR!*FO}jO$03gR$wznbjxcHd2C1kt83;DfZ8siQAAz5+AQ-cLf^+=P z<&YI8`LTlZR&w#>PAWQ^n#=slo%C~DK}9X;$(6=ub0e2l*^pl0-}iN4-v?G6J1qpM z+oKv?L{Q829`^BuwM>109Vk|-n)xV6;$r+sQcEGqKy%4TDyOF1*{cb=!tbnWw8<27 z1_U)44O3B{TJAu>G{mBRUu6ZlLZDeG;|M$(ui$+M;#D}0xOn)%YyIW5!p;6gK(s^a zxUx&EiU7Ucclh}yEv8e(5V1EQ@{iXdWQBFZ`D+!V_N$L?#Ou2OKaq5lPHif(2Q9m^ugVO1f_A$9B47yF0d>j@jwhwsm5wV|0v;t&Vd}Y@FD3 zI=1!Yx$k|y`-~c+{(!1oyVjm-uHVeV^Hp#?)Qi-*{%OyuG{}BPEw*5};m$i`BU7p6 zlBPb0YxVGQQ1<*dLH^+|wRuM=GGN}K3o+@{8)c<|-(yHz_9GxUDYNo`_^H-HAO!7^7>lNUIg&h(l{+bvt@ z-;@+Edf;@*`M0^6DD=_qJa2qIGcXXBpz3gGYx!dEpBCvqcmE=o^?@nRVo!fAOti3w z)}z;{Gx2hi?8CF{53!kAvP^6{u`cz}XY41;1268?)WQ#AKHde?79|IZ?^_-NTAu4D zsM41q>8HFqFx63BGSC^6R#r(Z*tWg~ zJJR1f{9q6lHSW@PdRVu4@wd;Z;fdgp;OfU!1Ri=9m`zGDj(=18ezqXNnCK(1Jqf6* zfR2oeDp+|eze0cc{8k-`Qlh)V6JcD7&%Lp*^|<6DvHk`^s9wWzF&F$yUb=FK53f&3 zY$O(>XYti`GKFiAyTP*prb!8R&TGehgF8s5r^dSR1+%G=qwIfvq?;zGA5l?Mhcvcl ze1ovFNbzPf*Br6JNu|H5a}KTF(ZA#%8UIjo%&)OYqTPE*7QAl0-9WGSV1ZW{&Jw+* zj0JaoFfmg3?b>>VF)2j0OiZO$=SBEIO4C<+@9>vl=};=jri*Z7$18SDkzE?fYbT_I zLfS<-5iE`VI^7-Tc{tmCnyG}R%`|{2PiZZd0fmeFhR}KOF;PSD7CRoE3Q88jPU-qo z%ioH$mZoC5neb%#c3S9CNevtul8cKMl3(cM*l7Iiu#a&$yGHlK1U8KrjRmlkqz>a# zM$)|ULRSK^Ks%0g3hz{$<2gldGtA$gXP8yJZWzE*TxszP`lgdK-6m()S4Agnxps!T zIZ+YLrQJC|^wM+CzIOoYYe$jrV0-VZXt0MP08-Q|$qQl%&8#gzTU>T!1#3PJED!Xl zsgv-dA4F*_>n0%>=&SeXHE(c3n~LgOU z%u_JLP8AbGGF?1>h4Wa^3i=J+IU_$64zmnXwy>>?s8^}T^eW%NZ2#Fc2X&`mZo}co zDkAq_d85GB@utcL>b_&*3IoQ^V$CJ?5+0SbrhmI6W9T7e!iZHV&~-JSqvoh(@5 z-fwNgYu_u)HM=dIS!e(2$o#M(YZy*@S4{kRNAf;`bmIJp7p92?x-R3vSa>7l0jVU{ zrD(Bipl&r#iJs_a{Oj9X8oj%HLM~tw(0v$5pVghdp{Eof)#tH)rucQ{fh}|44%DK5 z0f{?~V^a-(y`-{}_Edv$uI(;4yEB-SrXdVC_5cmbkX#^pwO!X;!dZD@xh4!!ob zNm!SFAHWELT=2%RQO~#B$Gzy?gB#ss^>fgDCm}pF=szC>Ee#}Xhu1V1`%0-2QdrCl z78~CHLEtJRmpr0YESJbyEx9NoA}9+kMBl+New;a{(7~@4$E}oR!(7U*PqmxX=3Exd zWrTj^UWq9uPgIK-4k8|rh59#Qttleu$SHL8^WA*o@M-lfC1wQ*!pSXs+50a3%EP-w z#!J&LN&g35ZBe8gks~+A%Vj^cB!QLiP~{)TSiCZPO@@U0ELkbVoa%^*d)6IJX;6@X z?5G-N@llXxWRY8UoAmWuhsl6~r25&=MM1x}sM*#B4#qGGE4X2v5;Suxvc%}tiYMCO zp}&uo)kS{XxKstNc57vuVXSpLo;dJns8eBrU49I5#0W}_hUBkS^(MVo8dQ>eX$-$_ zXH`!>G)`2DXk}Jpnxp*%;J@|T5Dei)s`rGpvz_PrCQcg+gVhM5m zZ=L+hD7Ua7WMa>ef?K3d@j0hAU(ui7n~R0Hs>n&vY>%s_Zw#~TCl~EhQkGA2IHDUp zh;}P0IllB7!tLnsgQL)*c$PctZypy10oI9uxWrQh(eOGaTOkNvaefnD9WyN-MhBBm z=)You*EWjAcf+psFM){8I!le-Rt(V^Tf{14PaT2~_wajDam&gC)uhTKyGpvG;pN=@Z4Y*^>d=-l1f$U|Mjt|T-d zb4%6OrB@gBRs~i4r#O52^kVKqlxx}dx0?5ySj7oI8LBJv+;=AQ~1?P}pL7%G)O zv-l$Vr=j4PWx^%g{cGyzY49b=@nBphW#m&0~2iv{p|}KXD}}o@Sp#K)&jIPq>68yo{5|V~T=UltFR# z)3B0VA{p)QsO_KmYP$l-hCveV_9B?q&rAnazH@zhEVXB3jEcF%h~c4N`Z$7#nq;aRGv0<(!mwD zh_5RR9~tBqq@;hop^CMLwyaubh9>V>Ym+~v5miDL@c6?62K}6F0wwAr#nAah8tcT5 z@xH4C5qPEVCeH0nKsrVZFg{KSop^`b#k*0d5LM$+m%`S>7^UQM{62@@egcF%Mgkpz zHU;t9rS&3AQ+%SK?VgQ0p#A`m4t*B0`e^^;2U9?V;Yi~B3`TBb~e>6x-KSB=ZnSILWvq#qv1#DJv1X#NV6 ze#As?(BvFUvP;GJ0QEG-IR|lE7wy=27w&=E<*~7lQa$2w_Q`iIH+IFDB{uLG%~ofh z?R*e!-}P-!>P%W$J`Umbb9$ZlL8S|cME)-w$DOkT)=f@Dl3A86=O1XTcxHB$POs-12|8of zJ~NZHo#62I2#C*fSiJ0XzCU|iKUTevL`abXNTsDx&HoAf_VK|grEN@;-bmZM)5#QF z>riU-PlXAg$8Q5*asa@6Svsj*y_oAgKe{g-qU|1OtvpvkBZA#+q2jxRp-3A^xh%ii zd(oy@JTNrYDe<8~z&g?xyun7SH{+U(3s;X;fz2evTi5RE4;zS;OKRXlv@SUvZaF)>D&K$AO8X&<7`9L^}!+Pr*|6@I4PheVs^gpa90*f30LhJ3V< zvLh>C99_Q_AINjt{z|hF;Ua31O>x2RqejK?rGEZPlS@K3j+nF0t=o|c%eQ9M(3Vf1 zROOS!iQ}WVoEK($FOzXCXH_4`;+hD`*RLH4K&?+sMRZE^h?T3_5NmD(MRO0wt{3GA zvE&xGi%WJ1_xW3acp!kLn|PB=#J*cpC=v9JdQ7I>{JZGka(CHqib^VtZB6|jOKmQl zh>i}n&sfuGSMyix3_Ht4v^+KzQX9+R#gTIqykZ>m;oa7W<1`wF+k3gw1*5`+GnqBh zQ`Ru#cKEXs!bc5~svaRRo5xWHhfgP8%*kTO{qSYt`|AXMEX9Wv|9i*Ykqvlc1U@~T zZGTf@RcPncNMHyD;n(I)WO{Z!`WOUfMQzPSNTh+rcJEeOl zRNS4(g2BAZ=H%8TCu0OLXWNup{P?0riZpdG{@qcUhU$xKF8<#Mb*k+2xzORVh(+9q zAx0ne`M|?FNBe4RfTxh4<>XN&${w5Vlj_NwKfgaXWt$ig6C)Ix)H1Ym5-Lm+!@RNm zXz*P+AG%Uas-+kNM8AzvvW3r4F8P>%zHtm>OuXrX(&7%C?q73#jcwJf+T&izhn_vr zSSBXVgKxVBZ(AZSvg{tKsgx1c**^WpUFw&Q<>(w0shp3bK?CfprnC`BRNX6yrVSyF zmxg3xBSZ8b8sgm5A*`A^>vrM`@$tIdZU(85h#SfPBTWiNAUNZbtQ>Q^EGFta_#!Nx zr5sH?d^Mf9n|UxaR<&Jp(#({@y-@2BgP6XO*kovOma0WbGD>XVVE8*OD@m;xX&fxk>Umvb}2Z!c~3aatjeNK&PqAhsjP;-MXPB6scK=-$%jA@EG&u+y(gJ$#{fK zf?Z#o^ABe=6!e!xd95`~lMro7R3nm?^;Zi&Cc>l^%@$oV8OmAo0*l8$tSFvzQln8x z!$b7;(6&h>o)W(`u3bB_4&wB@4FUL+ ziEYZWtsUgSrFxJ5v8w;$CV0T4#;D)&9<7im;ZuJF$ziyhot3o>1E_^(zidSB)VnZl z%@O_mL2nHnnydXPy((gRa19bNB&lIpAb?sR)*|F^&>&hA$W>g*5f0lW%p2yF^T24k z-h;wM!SG8nfPm-=tR;3=ZLAI7m^s1YsXa#4mDbT`9<---LSFF-aJlATHtNVKNv-LS z$ps4y&c9p5k5a%{TrHp0m{@l@zv{@5)sVvOUA69%72}`v+*OBfnSa#XmXev8lb8Jf zm(@MtV~wr3BWn=O_fy#lw6;DU=(eT;uJcguWl-bZ888dw4MMW~40qM>sg3oM?Jhk@V zJY#HA9xZTJG4a)5$lVQGaigfOHb$(q>_Kq*P`X9gPJFw;BMtXLerG|Fj~n%#krTb* z?o311W<+lniN7SUW*XAnS?7+|jN6X=boI|uU{LWm}`K zQGax0hBXm4%a zNvG+J`?XGgbjw3i)ev}9f{!wKKY(&WuE@}&x8=5X<=yrgOezyvA7;@?_!7^6<;TBl zdY~t9zAYEmd$ps2J-auXF?ZJpT;CKOZ1{5Uq))C>#7dTG60TjtKpk*p*DR3AFUdqF zUopOCr1M`zM<+AlZsh!<;KcX)38&P+2^%$czj3EdU;QN0(PxLFtoAcX&7Smv{`5o> ztX6ssj?^@9ZIOBFjd%BGE~ed6#yfQ>3~yw#A-!OYZDmIDCF;vey05OR!fviU1iSWz zBC=RYRfh3CD&V@_%jW(U91OBdpUq_&J9N8I&g=Knzi`ulM6X`Th+X_^E`m;x_HChL zn65+=F&SNzLiln$y@IkBtFT5M0^9PlK>mAUd1q1{&H-D2zWPQFhCw`!tieH*-@k5W zxcg zZwnNzh+PO3t~1&F14n)+rK%OqTdL*G6)qomiy=rN_YjFJ4_TISEKnAAB5$CB6|+Wv za?iv@{C@r*U^k`fhV0c;`ZWM@6U$=ltYoV|Y3AZ(hNGu1z$&N(db5ul8zQBXnfB#R z_bumwqN7^ylVujGH3nSW!eMI+eGxy}%HPTH?wy0fzq^f%{*mtev0|CW-;NvILYJ)i4g>L7l?8SA(v}kX>*GPhLajja*KIG&WV>D2tS7i1NYbjMvh={_|5WCO00)jfCZW_ON`1N zGR%o~N-^UPmjBFfU6Yb#PNloJSfXa z1>W!2<=Cxs zzyqP2$mxo;qL+b82LkHBY9uzdS#$11&Sp8(a8s;?!EyX^h322`EsMY}1r!d0*+$Rq zk>($^TaO?uSWXv*b9-KTqmZV34zM7-7?Etdc0dtVp?=B2PCt8EZ0ej822kHOy+W(F zl(YZA7>AifPUylN6}tuUfCKPYE?Gk}#?fDkbsp%Xj<9|7gmk*8!neQIne3SAtPc9k zeAX-7HAUfBfzL902dh2r@#`=K?qONQib(kWc*MF=cACu|50-b_UiYBsM?tpHuR)vy zN`16j!UpLKF9EgmRd^Q*%@_TToQbF(o7(yhHu-snOGIj|_qX1RQSk2{g$TSb%uk4a zY7xKkj|#h`?ae`G;cf594-vsI1RFnj7l7}z8(-O8@!^MS$lHdfkwfGLa}XH^<0N`` zy=HEHYBZTMT+z;w<`+L093O~G;htxplj*%Ud$hYcL_|h&qlsn6*Swla(|~KvCJ(I#1&8m~hpA=A!~ADCPSW_MUoJ!T%*_dB z*Acusca3g?(Mz(tST*9NG{-O%MSPClEeJ4f@=kY*V_%4v>n;kxzVd8YR1vzirzC#2 z$F4rt6xlHjGl8At27n7%4I6%L8?<|o=YwkhAg!>$z_ytyc4abUQO) zPUr_q@7(qLB{l--7vk>}=IJxc0hd=;szfJ$T*da!q@^IQu3jl;j9Q9mWWf- zNCSJyJJ@p4$z$})LS3wWd%Z(oOu^LV%3>$>Uta#) z;?7jEx9`NJ3{xutV$e^f3Ff_0Y5aJO zntJmBl0lU_$u`s|Y>Ky3XBRD9)*GXUf7-(Po^ytcs^OU;d=CeE3<&9X+nB+6Z+E`N!l+KUb-{%tl_# zr)~fK1-W0p|6T2#uKizlsE_97kOafEYJ5ie<}VFruA2<>+U-DI?apO0@BA;fX*(vd zp`dBzeFN-msx6M9OdPj&p4mXu_}S z`?3)BWG=W?k&+i-#G-=kELH^zY(YdY*iB?!&1n{s9p}kUBn^V30VsE&#syK&-PB}$ zNkrgRrbjemmuS`;A1xsr27LY*mMOA)_r*TVUF(MB^oey7zyckRMvb`Qu_IQFX3P5h zsP1aTpUv)VH_9wMwKKRXtz~)29ih9Tli(m>_f~#nCI<$o8%P`N{760MM6W{VBp=&$E`T&akc}!2*rAp#Gf&^}}79TOdPPGU{#aLNET=7r|&?kmXu!>59K; zC{7G~Tvs<0J`VTTEpX_F+k9YK^KjZvTFH?LJ^n0XK|d*R3|JCG(gD@Xdz7(z|9Yak zY?`#Um)0)mUoNg1%;NIp#x|{|OS<6Vg|UoFDn*C)EtQ|4t7xM#iv`7p6M!--hwi`u z`^h#hRV!R2mi)Ct$8qL|4~9ep0tHE#uHLRGG;7fEbLk-4&tPQLFqFK)EUz!Npm zULHf*#>O#?*+oTj5nZuud#wq}bC-O`B9{k;XE*f?C)rMa37S0kEuX(Dl7cS=GWtu4 zl;<Tzhg+mq3ix<(jg8#1?fj)0}IV;17E#M zC@z}Uh%L~_$?*$;Wmsy{Nl3ZDpSEM0Xsghg&Nn_GN(8+~eHZjoc^QHI8!qNqc=&cQ zckZ!Yj29&Yz-_n#{cH{JH<^pQ=`J+w>Ao&q_v(5lbuQs4MDxsk3d-%fOI1S`$=~pU;8Rn~SELNXXoq=KjneNoBfgA~{(1lQ%_$?A zK2R(oOk!+`r3GWdo>sdF2vRLVkOVB8b+i6%g8~H{?q!H~#*&oOEBTE#IWrdKKL(hK zZ&F_*{a&(dtRn~*J`su^ovebARa5<@1XcT@8ER(rqjB|{gixaW&tdgtroe)&;$TP9 z1dP_L<}eNp%l;t4@gTC%j8OQXrCLFQBQ6du`sqdcNfdF0FbXAv4LZL2PgCSi3^W3J zY6bJ3xzk5uzB}t(lm-~l$j8`uZVYO%_jhctgt36P+e%Km zNm-*g6KtqbLo@}owN8Wh_hxv{6^myxe_n;`FBv1v%rl!$$F9-fJ(ryDQC26TW-XDY zOsm=pm%OcfCrNn4+7fqP_XK;US~YN9h^o9SgSPJzj`u*}mW3F7!|kY;N+wvqp^ltk zn0{E-?fw36AhGFxJz$%ZNg@h`%atBRRj(K4(>L1eY}oZ=1T?fBM4q>><}{AoaH6F$ zSwC^v&gz8{OUHv*N!8zqwXPG=GV6gBLGvH>8_4jm6EG^XRgJ?m3ZtHZYZHsfXXf!< z5Voh4HROv(vFP+|7pC7HYm)#I z5t@EWxF3|V418UO+$W%NS~AwCu0~?Z`w*;@c8|SgqH*KyQQvlpca<4Ymi2{Nukj zDj5u`doX^bj=xM6Fi*eoC@hLZ7ORiFMYZNb~ZWXzX0F@n3ec9 z13%+8q}OMAq(_$Vr`d=DKtecbk!Ic9wKB*Ti{|VFcpRRduQq}{d#in`DH09gh< zc*-d8a2n9Rwv{9@AL$@Rd^<=b`#AZ^Yt(#OKxkPP5we8#t4Ff0y<<@N8IsCTv(P=D zdN7k~18yo9S(=X^?gBI(VG$w{3)qCoOU#kg$kfRoiGb$s8RWt047ozIGhjoR&bk1V zmOnE#50;#$HZw1*4{7c2{A}EP+OO$Y4!x_qMH#F|2Cgb{05p9#C)2V8o){XnN^k2# z`O{2jQ}3*T(;$<=Am$a1$%xrvsUm=ufgV$RR&^IPU(k_MI(!o9$M4kLB-5Ob@#2aI z0a{CPaD!s8i+WgYn(|zKqhOao*tQ=Xp@K!NeZCvOSG{ZjZcnBiFo zN$M}=H(L?zu}V3G71tK=K!d`|Eo{IhWbxPdyj@18tMjnrp>E7iZT+kCxSUDu&dLn` z`se<@0$`i8Kk8x|Y{(dn)yb>y?335XyJ9H`!6%FmZ6KO7ZsRxTG-gKOoSb~X34OJ;S&+%nQpF5oG3jOFF6KOI7(2o z^a|MPo};^3e$%s1}_c4A+G8>Tg~wgdoCH!QfX3vP#@DA5k%vn0Z- z1N#gxQY^ztKVw}6CRj&GYd+E1SP_jxBl}qwlz*W}_;TSQnuNYF@~Q3;rhvEO5hEO+ z&rV9fn^b}cUQyByaJ&}O{ad=rCk34PVOL-zyOhCi*&Jr&^YV!uksU{p+se1!h{~n$ z*Dpi~=F`8>hR^Y3B)a=sn4(8ewt766F#sR2j;1NtRD<{;%YMGQWsLF+mk4!y+#px+ zbKp`r(Ps=(q4b{<+XSjItiM(Wq6Ah}wl;(RwXi{QP&L>;#!H0z zD!Z9J836cX*pd53&F!-jIO@sryphv^At<+otc}j~t+3UL6WL;wR@Eb^ZEa+xQ(43$ zD1c#aqQ{@GvxdoO#4!SzsG0X;CEK_wETTIe1?e!37ILa`W1aLIzALL90u49{OQ?ta z>K#;T^5@f7?1&2ckLq!}IcpMFAXJENQO`I!)fr>$9l9G=P`Dx(%pScR!aCM)L;?JP zA?ssl&%ol*>l(Jdr60ZM#6^02Q;%n33=EtHiTcl?7qN}K-lGRJ#JO2hmW@93&qhy$ z<5jx9L>N_TZrk7F&_;nfK4JXs?s>alzz85+I&cOmRIak)S9sYyD=srEp77FKXBl@5 zP1#HN##*(I_r!jJzYK5l6Og8GVq$`q&JpjnqIcwWh5AEabVyY~{7;9K<9HEWV6HpnDXfEeS#V zD}=I}?~HtNR3>s z%(%mnB%(#^06N$EM_~yr#^7KiZ_QlDMv`jFL3jI!UR3*pY}^*5r;8gg47$)rm2O>* zokYkJc=q`w%y@W@DREaSEaGyXEIubBvw)jhwDR^XgB!juB$mbxdYZ4gFlrwYi&@K- z7E8ESif>AE9)&nh4POJ8PeR*u#6caV<{ z^a;vpH(GDzmJv(_y~3b=-`1hF8V2?a4Xf?Mb8)M{=z^cXmvVrBREp45**RE=h(6LM z+A|EzTu^MdccU(b-P!5<7lfeBzx@8ai2;)$5X6NABBBr>*hdHq*0>#z0oIm@z1v_; zvI5w@iw(Ry@|kMk6Vs2l?}=Q!NuQ*2AtmQHKZ$V8r3C0ESz>c=Pt{^bpMO@v)e5A_ zhmTnDd`GpnT_Zf*=56l0+hA_GOOmD{DJkP@|hmpf7X+3nGo3RbuKUH;fG%s%%HEl|j8UaQl zH(kt}sd`je_r--=dvpcV413vCcqGN^JGooj(#IeD=Fy6p8AMnQkI%S6UMGl7#B!@E zOe^JU%R{;H!KUAA=C4-zTvq?EPLoSoz9r#-`}ih`X|->V?{#oO6wn%73ZLP`z?R45 z)CM!Hs}+#mFF2)AKN9eG<8)(Te1g4TFemc6kmB`ryN_b%&52H+k2(yU_{7*B_BQcc zP$s4yh7YWM#vHB8W9~9>1(c;y_o8T^m8Z3p?o|f+H#PPRVK($uMp+O3U$Y)Shc(15 z{x;6u{bsu<@VBsAU^~>)v^T3T9qQDx$%swxT?B=8-igbpob}gX*82-jC*e9oN#vY- zXV9liv0ZCxqrND8rSz&0vT;F$M#nc&dGRvvu#chaFr#wNS$ zDdT&r{iJ1LFuPGN4mO;E^r|~LMal~wR_AQpTAdwtU+Q8HoZy~ESP9X0BpGY11~5QS zpFj!cW4x}I5qfAIi~)rw0XfySdBL7%IS3kLr!bwaIUFap5r6iYJ&wn%U4EatbGU}U z$Ef~+6=ItzuJvlUqJfVB9}j+*NdK*~nem}SGuHOzvdm2Gb~W~$74hz8d1aJuZ_Wxi zYmQ4DUd@f()Em68jR{#=e`$#EOz-S@Ns@3K&`crto4CB>mz_OKExq1?xDozfc6^?F zj3?1cHogeHM1sTipQ<@4#MWi}L~CLlq!owToTMxg(Ge5# zIU$F}QX{;)y-pt}cG021LH$pX-T$Q7?WBspF^Yu}2O!Q;WFgFc+FVh_P&Fhxr$%h7 zYZ76v3q74ys7Q?^s}j()gN!Uz&_`z@Q|U8n#6X5aZ;Zf#Mrqe+6J~O(V3`^vfTb)^mcUhdKUJ~oxE z`%0q02V_}4A4)uw0UKWo%c9Zs&>{#?_y=!!jG9Gjan%?-4mME&u$V+$EuvwpW;{<$ z5jGF2HO?8}!r;?F`^Kc-H-Z``zUTvYtAjc&fz7T_-4^*dF#SNkbXXUCFv*rveLi|$ zyC^zCt7N3tnFG^ke}6Y$tLn>qfD=np=ma^?fw0|`okz~&Ak74DBd})p$9P&$bTnJF z!&3&M`bm%H&IU^8tCC@(d~G?ebw~2~e|?1T41r$uBNV0kI|AO_W{tIOQDu->rWFJM zga}e#Jf2qB;(@H~)%whZEYqxD0;j)AQ28!C-brTg95Fd1jeEO>Kf4 zcHWlYJI}+7I3G^RLPQ!FGlPHuWZ9u{&gDw$w*h2_zjI;Cx)qK(B8T$7K@T_I>R^Zq zbqVv`LSrap4vU%RIom~u3!28$o8TQM;Q-QY);Z)14_F#5GW(>=lC6!-HVw8btOprV z<5F1h_<~o7V`%*Mv%bVYf2eU7w7S?Z2X3NbNu8#7cwoB%OYHIx;pvU+)tw?;%47Bu z=8*6%ddHM$Xn2*ISNJS!)%Pok?*mx#MHvUJzH#0TUEbUNmFu3B`}1?JnlYpT{U#k_ z${mDH1`0L?VxYdev*=zlf}3m;M(pa5*&ON#ADzb?LgK_h{Sckseri8R-7w96foKK1 zB3ae%)w7kTqIo{I#Blf}46y3`f@i>aD88=0X5r62#N=F>3***z+F<%v$$mf|S`c1Q`%CT}3>qX0$9=m0ko_IEFw`@vW1odRJE;xV$-e z=#wnF+HdAamp=&?uthY#R&wcJz@9o+vN5IRM!*mudRl!72RkvBRXjpeqSQW!s?y=e zK}^?vnUs;^&@`uwg>TAnODXFFB+NscRRyRCONQTFs55~e_UyVUk^68^80Q5MlETcu zw4F`|xfLI2sSs_F?PBcI zt;{d8Z|91>?N5RIcEGbnB!KAb;e08R(Z)DiRd5?LQ@Or%7Wl>w6{YdtClLHgBq#7_ z=@^w&f~@`%RVhsBbyZ*K0-5OL_1;HOd2`)W#%um*03*(0@ndSEscIi*fGDVVZH3ny z7ss;EKH?l1?6WUMfBU=$yZ33v93Cn~Ty_nUhPxHo{RHV}zS$pbmFi^Xe5p3;3qp`f7M*B=T+p&7okfr$Yu43r0?7(Hir7s8J>E{_$ zM23bHCzl4=p@7IR6#x~H#jI2w8mNZ*hgF3Pt)+D*u?+)R_(U@*I$$YGToW%?!B;Wve7F znKTs&bJ-9~ql~VAbPZMba~Nt6B;Le1Sp_-6pZ}?*6B^MLTJyk(3X>jTZZyu6`MAQT z3y)xJ`#6;0E0F!51S8+B=?9Zk+2c{g?CxYjxADk#+ukPm0W#!f>L|e+>EAf7cL3v8|O(tuVW}m4dlY-o8s9$UG}nLK_MWS!_`3tn27{$tsC?D zTRZW&H6o+tVoceysbeCIRBqvLf9m2|KSyu(mkeN5F>xcUeYStH`KxoQP)eNvVv+8D zn=0#x0W;z3lD<`xv-J^udD_5n>byoddBpWEFlT8K;M0iSah58_@OIrX20&+k;cb8W za)qch8*OWUd+2a5iD}ZKOh>sIp?PrDd)9)<*#eA4b-b!pwp2B4M)CtAYp-FlVq7aR z6x06UQD}9@p>46b4J|PVNkUPC$W^jNzcuW0r6-N_$Bu!e-3FsJ0uaY|A}#O|i#6UXHf+fQu%4S}oivCuDLkVZLgK zOEY;M6COo&apO(W16}xoYeqV+uD>5>8T4napEqwsY;<>bi#`xGRX2DL7ie93Gxs__ zXZ*7OGk8YC|NHfee}sdGEfUZb1%0}o6nm-&!@uQxo`vYc(}PI9o25B+=j-F>oqA+< z#mg)Umz07avMYxiTl;toky_qRoymMTm>f!#&%Z9_HwyXlY4~t)EjQl~6A07nF zqS>>%ABj(x8WHy!6{LdnB%Y@3s-nPc?&&zi`oF>p>pYL%pEMVQ2V*ftoGT@Ht?^Yd z!hx`KQZqwPnnJ3U`qB)R#|YQRHBVB91W72%tJ%3iN>Ok4Uc&7Sn!w4J&#cHAkw)Jn zJ*y+=aXno+&o#n-+5GR*_>edKX#>-Q(|}Z=0GpAlMwyyw{bJ#_Gmpc)(bPq-o^$ab z9Fr=en)42<89Y=y^p_Nf7B5rx#gxeKc4n5R>Y>( zxCuS!=<7wj+GJkdAgloO8b=Tvr84*Nf8Np^=mjk$EoT0nGFq-Zfzlc#=n zWVNPrwKqdzhOh0l@p3^74hk9Q601Lbn1+~byp0KA*Z~@`ZC(ia(Gw;UnK9Bt>N`g3 zJ*D&no5RB3}f8iU8y+!pwVBF9xC}i5K~bV0kTSwUn4 z4%6*yKyq;bl@)Nvx-EoGLe8Ti9e(=a8faC)#XR z@`nGAFl#F+DfJkrqUJSLv_`s9M(F28d3XM^gZeEc$N#sOkJE<2$AXo>`T-{~vS8^B zs}5C)@W5`0wFLvArS32|A^fOCkds>^thZh)?C0|9?EUKg2Ec&rJjH_{X{usPQEWZYgxidCe@?C^?fvo93FbM@#q9H`?HCg zd-uDG2L>%(F9#)8|5epLC?1Shi(q12#oNDq8q`0Rm~Gc(VHx*lTwQ$A&52U({!Z=8 z@(UQf_4Eb0%cj$FqW`vGEoscsF~Mbt{5+X z-T8Z6yY2kaCwvwHMQ-~m;q@EIY_}>WbNWM|Ry_IONyOlIzvdKPttm#W8H|<01LeS^ zAvny;!DSjrfW*2{M1n5Mv#Ve8*D^vAW8UCG#?P8uIBBdeNW}&y+DTj?dEENjR3lyH!o#zPE9(OTqA@>H}jvxY&ZSI=wJ0H)j$X)zNsn2$=hScFecV+_3o#_Pa>2hWA3vlga`~>_cfhu z@}2KH?}{F(it2YTMqMus{@0x|kBAU?9%Nke=SX z()7z7>9py`u(jrT;hVYq2rOx;dVvLHXupF(@=+L_uc>6|%oT70)v7!6%l4!DFY2AbD^>>& z&nB;#hwPo~vj@yi8LN@f8X_GT=a#2?XHA!~^ldH9aj$nd{q_H6Tiab5Fe*6uZ8Pv- zE6=x*%*=03w%%R)BpeSJh$4ZW+VaAc{?o)3a=|CNQbWQC9!G`};6?4fTcyBUH9)H^hlZPk(bqFzY% zXEJDkBZ+wLXCDs;ZG`i^uM9l)rM@(1Dal|11726pdiw3sU5qG6L2LP(DhX8jbfK~G zOzv-gbeX+N9y=lkc>U@W+aezaHq6&-ZEuBlLJGLDJawKU+dPUcttCWg{n5T#=(&e~ zf9sT-t$3V!?vu02lI%nFsH@@Yd+e3k#BDRZ_;Di@8Fm5D6cJ<3Zrq_QZ|w)31FWXQ zdFnp|9a9GSw|@z`Nok>tQP^sXq8EU#(FlqVDMYNkC@6pucHzqxbpM$WD3T(MfrO?_ zKVO&R&ZleQY2x>X;}7FG2h@$mL6M($+Q*!Sobl~(+1@GgIliBSCdjKmJ`pi&RRG4G zn>NYHIJFyM;ocKY!B(~SJ4Sbn?Cxp~jS}~>2xHT_&m&Z!=mg|tzGvY|3Dp!y0uV7tV(K=yj2E znIUz}Q;DM~qei^jb~DFgs~n^FVi`S=s4WW4Dwf9_OlLuqV!rx&Y%>auOlrF~K+bm0^LvK6X z4gQCFz=VH!Kk0}_A>>RcgkN7ZLOH|ym83G8%)dV>dk;0^H4`+0F@rIF$ObNArDIE8 zYPPF+>b$)NH-B}9#)&}J{E5pv+&em^&%6Mm^KiL6*l}(R`E2ye&(m?>2Xdo`;Nax^ zRyF_2Zy=6wXB!isyoJ4%5O)TncrCwY;mjn)@D!b7x7!wv#8u*zzJ9uhb z;1$O3$0++(8Q@GQgtss*!^tN!&^00lyo$~|NC2&a(NJ1LAP(FLp+93Tu`*CaDZ{s& zs*)FXy4d?GOQ!L|Hs+>=32o^}XbwGGj-F)`553*x$;zktN7!T8l8#8NJjng_ad}Y! zhNfgVk}X0{_e)|qYF~a2&3TIicUpWuDro>Hfy5HBW<2xHmm?x9FtQvB+fooqa4-RAbc zqykYdf6~T+YQc^E9O&wy_Wnk%)0WIspUfkbV4YTcZeXF$3Fr_Zt|!N{yv-MZlBdnv z(SO1Gpd2>6W03Nh?l(=jqX)1i)uqqr+w5u0h{vAi^#X4h0|MC5>lUwcC<_KY)vX?D zSqf+UFQ=`Jf{`y7gCw{KK+vx> zw%m+CK+F9Br>^0F)w&B5m?KtTdN`r)N@;nhnQ*Csk2WTIVGoD4iw-yQi$)`%Zj@-g zKpYXEI;}F6BBhl9eU4QUVr6$} z&;WAq`%}$Wr#0Kgt_tD+;nhKDPeA%GZjIwx;&MSHn%0U80wNC33HXCd1)k0SKB;Fm zIAD`eAj@iSV*22M<@D_9k$l{=IQ}nPuh=$NUUG5x7W5tcm2`Cf#XG zk&%0>6ZN09BWX6)dl)JN;r4Nh^Z4BK@y_?4q46dZZ*%*luHokLy7&PlEPn}C`{x-) zWaFA_fBD{v<2O|0nVt^_O$0#nno1vji98?>p!dFn{FbbigSfYdLpTR`S0UqV8B z$Z;)WRDzG2ED8m?5%QVR} zpcy6L@@fFjuyDet;3`81fLAIIXy@=m7oIl3f(G8mO_D|z4gSk3RWfiI;*wl1FCs!k z9OvQh;GuqdKjDo{mE)pGNx;*W)6J_Miigb6b5y*38NG+?=hj`7$A{s!UmaS@2(Rox zi}h9yjstIvkT!B5zaT{t-r_fWdOD|pJ>l$e>-yWWqm|{fEiycUWj`Xe&CMLLo%goG z7^ce4A}}roy{>PMbZ(=~6~4!vL+Up8)NpoXaN70Z4&9^k${g%Td`~qhp1m&R8+lVj z_%KvZ%}8SVH-WpL5L61xVQ|-e{lPj>yal0RX+S>&yC)~HZaJi;8>hz0kyt1w(GhNS zoem{Z#ka+2UOE5SR@8C!Dru4{m>&m10g~GQ8k1GJV);qOy?u%AIXCF3kt}?=sufnOl)QG zXSU*DM9uRdQ@WV8XN&f_oYrN|Z+6#eM?``$1g}&Ue4g1))SkT5-mbWa9Ohk{*QtD; zotJd?AE0kE=25d<4zuH;_XgGycowX`aQxI^10s01_xC}aeoMAZ^h%xPqyD@dxPz(s z*TRl2<}!lAApIEiy|p)MnL5_(f-2gsTbwBdZ$^$Hbx2oxBP*U2Vw8aZ<-YwH8znIc zyE?T(Blo{!W0k>vEx;W!vG}CSmjaH&lT>|1vYp4HtD_A{?KrelDa5J+fv6X@lYcJr zctx&N^9SN3%ko!;rKw&2Bb96+z2!iAEoRZupkEY6B7|etIv+Cy+IKNoD&$Poo-U!M zHe+A|$Hb?vystcTE=MtPQ$c7w$(x44AxsnV;NT;*piI1V;bi-=#6ukiOVoC1uuEMo z@q0IFK}i)LZ|qQ?qE>Z7eke>k(4U>y=fN}~J(d$r2Ts$=;v&$bxZ&njp%b?TsJYx% zB#<6L>m17)h5gVt?iJZ^tGRMw-{FToe88yD(o<098x1vo{$8lf5^=y;8SM%Aw?$C-S#)mfJxchvLBEt^u>y^TmduuBunSl`x8M6K6fXYJd{^e zphi*WEnT<72Q&!17cr@6vzAKz>*<*=B1b(QP#-_Kx#(x+2_t_+!@Ky zfekd6zu^iwRvEk%_0wyT@ak~4$~v5xXKdA;KeU2GXEu9hOd-DJ$J`zLQ;GJB2F~_NPwlk9FLU zP#)KzXd5JTG2NuZ1ZrE+CwY$n#4YEc(klFWCX$c4N#WnIKP`DOJa2-7QGC6)y^Nm( z!sk4xHI(XG4M+KIX2~67@!@rc{vHN{EK#d$!dKGBDPVId{Fb@Jiu-Eptnq%dOF+5F zT>{!8c1nq_lbEmhDXjC|?)gFHRteQRI6YLbeLH{Gw9tc4xHo_fkp_NkU)jgrJ0W zc`1#Z?s>$BLQXp?YMX6&uYQ(YA%|EUOXbuFD@#vsWamW4Q2ib;@5GcTqCC>g&yRS$ zO`h6#wf)?987}#Cadmg2i2g%glvAtNqWkarD5aGfg5C?l+-ZCE82{1=c+$Yo|t>08JYZRiK179CPQj1qblRzIw}Gl`0b zyI#FoU;8`i{hk>Ec%WGUm9?+B44{i-e6Ug>OJhP)Q%v#jtc~a$9VnbR)-N@J5IzT&mB^To`^bSl=Nx`o z(Y_7ID(6YZQMj2J9Lh=mr!<2Z>|5TeMeEjwd=zeek(bRrB8EO{LI8h&Y5APd$xN7(W5ZVzRnTDXR=nO>>ciF6sy&btTi3_=_ zEy-@2xBicWBl~ukPAJHjL>=ist?1k~f~@*$Ipt53xv{__@W)4HN2o{b2g}f8PycrL z?asW%@5Jp>B?}Rx-mD8tB{_bi;Kn@|%dW%Je3{8ZyXxL~SL3}C;z4qF!$v=Zh=I9p44qXL1{i-0r_2Vs)LR)H!{Rtxu5>Y?HUV z;i+(bzNyr;TcwqY+FrF(kV%70{a^8rrIGuCr1I{#A6uy1 zA~6%G9dyFMjJ*y{Df;NdNj__G5C4@036r#SV0Ye%tNEYsA-#1!OxPEN0bW43H zf$AolZ?IT9Kw-+K`2M0niNnG3E(Nc7JCkpS{^dM|9l@Qw%fl~)ZZ!LT1PCgkf8fMS z(bP`mx*7sakJZ|BW^06!3sb7>AsLuXL(9I1O~}-jk~=2ts{0&DXCX_nnF!6e{p}Z$ zd+%7K=ybooQ@Y4TcZPvM$)QX{l>=maxr~`N+?X}gU(Ag$$t~9d&-SM8Bp<+hotDKb z=U(jIuo=p=KDv@hF+x^)iRNrtv@3|nNg0t(|C1Z-v|t8rAc0|;9|h+J(-~wEl}k(O z(Lxz;@^{je;c!g!vBJSFe(_E5|F*(145(RDoXcH1oovVtjF8x8SO=-jdiq^;z0ye> zXH6*sV%_tMh^C#uNpkEN)zlsr3OASJzx9HJalz6JsX_c~3Dp030T?HDn}i^Adb;?b zCKkt6-kAzxO&8%Saub{aIzQbsUbAppE@t8R>un&)T;yhrOFD`(!r38>miMYEP?e7g`d#CRek6w_$9Y*H}8Xy5C>= zbLd30*43Jo^_XMQ#8ctfgn#~^&GyL1sB(9I$2DBwpgP12CUH|QeAa9exp<>zOBVaL zJtoe8p;dJBu;Ye-9!Ko5*tUdDQM5T^ZR!oe5$+afem5$1`$|Pi!x7%Pve;+0Jiq~g zGfTQNr{Yha0ONB&VDo8BbrPZ+Wg#gDTvCq9%(iMEr61Qln0T`>_>OY<_tUd0hgALd8iB5%o(5;f()D}(Uz|x+SFeYweu2jutGrJWhn5mgbrJ?;t zkSMIf(^bC-Q|D{*cn#uF;6zfuK6D>8Ez**;Qx8PNoKbv#qL;Tsz_cT3h+*N7|J3WZ zU1ahq;-KP%IZ+qeN5Y4n^_s=>KTjEPQ5gvfSpVwe;{I@oA%=ibTW&L&JSj@0JX?sh zLL|jTj9t7DUfFR|nr~sAh`-2EUQ7Sv0UXB2&Lfo$zY5_)AX?ip+)PGGU?=?-z?|;Njtjfo){C#3|cu)7szN}v+fy4W9%B@Lt z16d(ZABm#IU35h%M>pRu)i?`LUJaU2ELXO%KfW7l;$y6rfSp7fipl{yR3`qGd3vTy z9Ixpkf~lt661QSYj7m~=sfOI%t25x!W9@*ftY!@ESXhO$c&!}jlYP2xkQL}{rBu@ zmUdIVT*QY7|KnSxAG>&IHU`c}4(C55+3t&6%YTM#`$>T6ph{Ln>+d74#jbpqQj7f~ z4&K{&>#A)2CO&(XZWsSB$u#8*5qH$}2hwt^ndbY<4R>T_pPP-ao8J5N!qjF1+(Adm zZYlwZ?W_BERM zeH`*sK5?gjA+ki!agEWrY;3v*hr7geqJ5EbAsek&U$|={nZ+bzv9PQ z4Tp7wK6!Fb9#Z8~vkWRcnf8AVC_#6gWZeuw9b6E!vl7lRoeN(*OjzoHt08zJ*8PC3Mh3NQ0U zg2s7(F8=t^l-Cq~>;1*cDcTUW87WD3OM$EpZKJL=HcrVSaRATXRzD)Twr~9)r9AxB7#R zx7#YG?1%CdX7w=HX;4jwSS@)2M#q-g2+Nu@$)bjV^UZZoKa24+ow9R`>+q?;N*2z(vj4n0 z;po-wYX|ho`|0_5fsqbX zvEg4>6@st5KV#olVmfA)`u3?eioc4@<4H?G*+FP3DG3EA!6n0T<6`M+Qj`8o)xp?t z)U%NSA;WEQSVk=c{u!c&w~l>2+}$RgnwD5EB5-?0JtXwrNw1+4T&fo$vUI zGNeYudAj!b$iLb6)m&!$@n|z6i}A`Hud9u0r-UEn%#cHBU?`GGnciJTFxi9M!IRo) zPOUG)ENnX)K)bxUkh$lrn@zs}L;+9j|qjy!TVASKu>xN1zKW6#cHE6+E-YBz6 zd*$2zDd;bR2n!72R698<5|upEysaxtljrpsA?#E_ff}@!EjK^qwx~}|R%MwkdwKg9 z=J&?o)WyrSEH)zHkn6{X)5P6y)FtxkL8uxw&S|YS5$aSYNR*!#ja1caf};XiD$x-| zOi_;L>3wuNIwQ6{s?F{-H~R3-Fg@)XU9c(&v{`GGPON)AuE4?D68&h_w5$oSbcK9KgyWs~0dS%K6$jK!0Ml~tn7 zAhnogL~n;hOTgID2iO%U`xvN6;-9hcNxk{;WYQhg1Rm>)fSM*HG$rJaka3d(jEf_m zEZO+|vyYCMe@9Jjn$IxrEa-Q|VmF=aCnq+&m1keuZyI#DnCpTSf_Ozr;J{{?jPSAJ zGqZ)hny76gBhqHT@ncVrqBrc>Z>`bEM6|tLSK!mFRp(wdiieo5&V^P11$bfkhVW@9 z!;MFGlL({A*UngxBHTyS_tKCrxbBg#nPn|voyvtTD_S}1ax&(4{u@rM`mAU1lDf%| zMSqg%HdNW^)^%x}Ne;uu*g1tB3G+`dYUp=BU5XrvF{bTz_O)@B;_l^k zy;;HUDFc1YdgY9%L{qUi$QVBOa4ND-?e1_g4MB;GosKe#n|?j-BJ*D&tNv0=7(aD* z^TA*A?&Eg1!+>mSXUZdfLy4j3I)aB8tAkG>e?6XL&^ptEv28P&DDN^K5ceZ`m>DTw zk^x}BJc|e%BS_{`@ss7asnuW{a#Id)ll6 z#K|l-Y=_;NBX7ICUvgSl1@#)&cHQ=)8JT}Wm}3u%i98xCYP*B>qw@bk)+6-sZ5U@A zGkN9XUTVp?S&6U70e1Zna+Ir0u6I3p@rlrI(s2885_UFa2SAGU*K^6}M^ZIM`Kjz`j})f+6|PslqN5kYlaT|&RK zr&qu4R3=u&7ewrb`3tconwg!zn*_akPR}TDE!E7abhdgTVx1F?mRYK0X3BL#m)WL* zntLahXthI7(!(j`_=*OfQJ~nCeU5o(=(2}$jvK@|&mx>2HY>>d!{IH6mi5tFknWN% zvJ6Fyq`#{8Mi2h!zb4XPwVR)$IfHn_e_dM`B z$PE(0tXt$KJ4dQ7_wu?hnC?xHA3@`SD2_yJ`P7pd4jC@K(J7Brj0QwO0pl~ z1$ktZBYb5^97_on@i6f?O>4a6<2k38Q>gv%vcoFqu?) z-f4Ax`wDP)J;w@i*<$fOU%Y>QRtCa+?CE$N`{<#zqe`~5waFe~$U5798u~;8z1}~Z zbU@joS6(nIU`WAK1m_4wqSP8$n3-jg`!nW%FQng!DUevU)dXTj!>>m}kQK+MRCtWO z{Dt5^04d%R96yLYT8DNoIx63bQvGQ$+9PH)SMY_qY|z^`k&iq?RX-9#I}#RPAd*t+ zX&n*iKK_a274i5DqLE2*2037A?*T8ncFTIm36pFTAZt2i)6o$njTdqr-CaQ){2e7f z8yZ0dGtmztunB&EV_`Wn*Wq(8l49RZ2mn{a4S|=sSOfo{K}KI4(7>Q$7nk13aKVY& z9#>@mX3;mkg24#t>aVuJ?6v8Bju)~jf+j6&-6Bh|C2LI!3}UmqWXfUg@O#)nP|w5b zy8KLcr9P!&sJ=Z;>7+(MB$4smSdTNY3#!8H&Fce!6VIbNF;? z?RYk*)J*JZHis=iAUntDy6Pw1{oAYqZWXWi;(^wH{d z7g+?9UVGl2u6ggy*6)r^)O2gX`bMnW+6qemSr)I*f`#KjxRCg`HX5iue8M5SZ%<3Q z6d`_st}kB)4~M3U4tw%p4|g{q3m85@b&I9`G6hJc4y8*d>jzJXM%P2D9GR%FS3Ip+ zh*4o{?E5il;@`wUf;LoDT2vorY~YFtA?_Tyl6kbf;(MVBA-pM4hGQW6*i(0F2v2u* zxcFZ#!|FTgaAbDKql^Z4X5fFjIXX#a`>ZWo>uGGhOf221*4ENtYt(gf$LsNGB1ipK zasMaB1RM~WMRr-0cBbqm+6=8QM20q6(Tf=-qAoFEgQJ)*3*|S0*!yFg{>VP4>Ze)s z6$0@_j?`Ym#}yx?Ln8^;zA5LG8h!{d95H(!NW5CsSsetWwa(oP^{}cupm#q3op;lk zzhHJY`zwB4R`o#;raim$gNzr$_2v!O0Q*aPm=!S; zvuA@PXv+2UM(pf4Uf=2H!cA^>X1?u~=YUftClpnj$$tmbZ+fYs!Ej7T$RPHM7 zxLv+xe}aX^KI@4wd!~tmHmeE<-Xv4^Gk#4Z0~GR0G3oLtpg8o}i;yn{_>L>GTA!b8 zheD#-+DFW?w&U$~``~5Bzd{LwWrQ&5iz?<|VR*`8JSYPoZV?;$pns~tgp1V_R6*7> za(W%!xCcw$Q@h{_HACB!D$t7q6FvA{n&3eYX*oiug6;1pr)uP+*zo2 zDb=uFe>#Kf_{X)=&+TZ~nul`_e~x)4)?y);2YhPAvHExN$3)O!M+pBu_bl8c6WyTM z($LWGnX#jg+FfBhJ&l8` zUL4Gc0bFgL3f7X-g!oRL~Gc>DSXB-6b9ELJS836*qvMYJr%Vtp&orPGMqv#bs%N~3ylDl zaW)w+1${LDWEVr%DZ(uX00GGrK;QF{ThzN{r6O9Fl5UBPEe)kdKiPBbD=GC|_ogy& z6dzt8-eVXg^~l|&33@}y2sM%TBiVX?D8Zh}Z4=$Af*khams)53guf6%KA*L?S`Vq? zJR63B9I$>FU-32_qe&mJ2&9&XAz@Pf)EaMm;MW&!8jfW_B=aCrXm5?H|32g?E|2!$ z;}Uz^LRi?@torE55lhoHakEe}QK8+mFrD&9BvAKS!Qy}#0NFuxw1~6U+1~cxe|6gM zk3PX_?3+CH2MnWQg77!2ukomrF@5V)or!``Z`~A9X?RiXv$|IW3N#x0avcKbU^PEz zUn8p`V8S^N^dJC3NYw70lFjFvmd)=&=-V;cLt#N{vP?}7kKvCZTt|)l!+!(5TT`_s z&?!*MX+#LO0ZKX+dt{L3CZW~YUNJr=P5^L0qLGc7n~#)+Lknnyl2;s{TjX&}vfzv&+^B3*S0ysUd zwFUQ8aNh9K)|7~(3E37q_Xj%t(I$t@vrgh--?2GQ=H zBr3J8JNk!wEm7-8|A5?&TUkYSm_v6$3v@?GG(5}*Q3h{45i$aTQdb0j5n@>Xwa%+0 zw@V&pOKXL3cL(Gx42B|AHi@Q}f6i$BbwJ79-|B51@>_FDD=?K+lyClzHr75IC%RAd zlEY-0aA_8Qd^?Wh^kOHe+h>L)S(bNnJ4CXZ*bl|5 z7hYk&Z9E<}tY&w8^k{@uu9GRJ%vV`Al0~LIzxkHxy?otjh_Le@MR>h!Kt3V@XDP_0 zUiw&>;o2jjluhulnJ(u8MpEyD$AtPwDKLWZ)y3Ac-id5!tjTPNea(^i$%?FYqn=Sf zPGj!pj$0Lm#mhEL8}jc+-v3J$#&JMg8eW)su;%y6?Jc8Py_N0AYnZz`6LY$4{n z4p0=ysu2(B1x@B~Z*|ZLYv4tT-E0fgDrUn~;C|Ax(YnyM=9Et=0IyIaX#Ea4qGr0w~vE zTfm7Vp-8&vT|T`F+?YiYflW}|EzcmYpz9!2tkgi6qR}DjbD_F5piy6_;8g({!5JC}Q0>PK8|b z4+lIv>?RM@!jfaBaA$F>Domncsu}x9wMq#h;w)38YlSF2(|5oiS9q?=EiyUh#B>+a z3kwRfYsj#HN@p>f4{-=OyZ0;YaN4FeF2v_g#uL#>*#drdU%<;r4CCNmf>@V$1)MHtpTvDYysq}Dn?pl1x4jQNl&+0mLo$7MdH)uh?bw=Z zUcWwq_xIa5hlTi;1;&RHwP$Iq&fA-_it>?%#xV(^y=+(8zjL%kPZwKFsCG@iEO(?y zJl@&32Qs?WQ!iPp>dfMzksdvx@!400E?V%z0Z@)zPIzgo{RCwJdrkGF& z`&gLrQq%o9$PG?d>i91oB%I8J_Z(r!Sv-X$IOPhyR22jb*`~ip;6Dd9Qg=yn2!vRW zCC4bo1>mfAu2>mw5Pe#Y0jG={DkJu>8-{iuQQKW02MG&yxIeOb$I02QMPDN$LUX-@ zNsH9Ft#Ty8P-l+CRvoLa8@D;W9cgXI_1U^~KE1EcHYj>r|C@CRs{nLyTUt$iY%LpW z+Yq{nr%AMZdvI>6YJ2k!bGIp797JjE%=$QxNwK<7J4inGsPM=^Qh^6Bk_L95EUgw{q$zFAo8I1>q0nBs~gsq8ApX zvs4yVKdt+&C>e3wkn$DNT1Ne*H0f1$7A|)%0&})F?FNG}OS3z2CL9P@hB-|7#(W2tVViGak70CZp0D(3`LQ8$>&2@eCb6J#ZE-8Md3`-;e_Yw))h1&$ zy~$*0c~y!NwHa5%hA7g;5B6FyQ$jX@_VCy1gx}IHf~tl20m1i?uD4|@ul=jme~2FS zQNS!Z121*lt0X#48NXpm`}sD zguhP8kIl2Z0mn}JTT}?|baCnk3#k&(0{vI1ujIy8SH5vJ9Be6XEidQS6M|GRxjEA; z&CKDzvk#LzT#_ZyLnq!ZO5##2rxv{*jasHQs40Dlah%~>?7u^2Wdh6`6>I^)aX z8bBsHJ9~ri81AHM#2=V=FM9wxkjSOn2dRlbl!-nloC;=GL7^uR`z4G=4LzXzcytTw ztGFl7p{ncArXfD(q7KzQ(l9nmrOUeNu+Sv9~c8kA&GBxr{ zg)yY4mYL`7%)aCdyuzRw;N38_p4ngA(pD=PL!TaTjh9ii6E_O=?ssX8I^eKK-y+2A(bV?x=C$>#i zd2`beF-7S@)p9Zxk`P7T?Pw{EBabEcGclic(o+!0=^zapEF${m*){H#_h{*uWG{uf zgjyq*2ZBZLta3d4>UU$SEk5^7=A6U>g&!&GRLG}n)+5oS7iY8m;Gjg*41(1gh4%-P z8Qx0ChmM`{V!Qq?Da))GMz@RtrAwqNdftkQYvutzH+=FfhC}|T4(n|&ClIP)YIXO= z=NK|68Y#Q1XsLQJ;-V>5E*I}J5$2V^-r)l6ZtACDK8zz-&)J?x|C46N{l;uB?zczm z<`o(Bj;4o2ysdWY!44PJVCPw+-j8?GT67el)xZ^=z9!u=i@`g{Wh%29g%$~#UM>I@ zVh*m)B{c&wE$g$|_wU&G5SV*tNlesgk~6{a;A-oS>k7Dad{qIYO#@Rc_W7U_)Ej_l z8=qgWbd!9mX`ESE%!Y>xX6I)ec3H?ZCxJk9zPL#>b0&aQWm7yaoaeJx`|DZT`IO&# z*V}no3wFa7$X$$V8azTFhIm<^?oyuhzx?aJzt3$UCzFKjo0{ALsWC>5e^^1~`Qyq0 z*i{hRln!;O|40%LHKw^)P(V|JZ{ta-MYCTBVbUeNfSym@dw5p-#ySQ?8#LY z%oag&$sWes|DD0jDc0;*mt?p$&Aw`%B#We{uip1)LlNBpsh|GQ0d*UX#{BX~2mQzI zR?D%QQa*xa2lIQxJ%mm1N6U>JU}s=Pv!#8%Hpu=eFFx=BGp0q*L!SB3mW+bVHgRuA0(^PTOw^q+wk6rMGQRk}R zx@NZ&@TUrZ(aD-agt>E;y5=ME(R)X;n^vcsY!|;%f{Oc@DhZ^eSsvvMnRDXjEE}I9 z8wfre3*`n8H(oiAi&+d&-8{56gt=++&q46^;)IhYAlp ze1`I7%`ZP^_c`Ry@(F)eDix)+I|JAYb6i7kEedMIQTV>TNyWEkRe-}yARf}GBmBVs)3>X{hUdIw^b*;Fm@dX{OT zZdxs(^G4R?BUTe8?f;?n{-cBIo~ZFp^F?VehrMzX%WWtbS?&o1$#0SoM`*{BxGR_G}a%%cOa*H7@P%uzOpk6B7(6EG}zn)DbY|Fk$u8CpF#Yca+NopV6d^Wt6Y@IeT~ z`Pw$+bak8a{utDzICncbe98MyBAy#pCN%#8=iVDbnjxOjL$mmvSidZAFXlBsvPnpU z9cFaBQt*2|Fx%wqbvSH$J{^@+O=a=AK@i6~6eKTbH;)E))E&(xxLrL$Uo^V3f+x-AZ{fy?j#PbbC7FfJppjr}_BY z0s>MKisa8(MQk-1-W(iWYZ-hh`Rm)zdP?BggL=!*b+S`m*MWTo?Z9}=z#-936Z(iPhrxW8HWMVtdY z1HC=|r|?CncC}Cet;Am#A>Y;`MB?U3%5o>L;rzLr1Eno7B^;Pc;3USB` zs%H$1u5X|Np&#Mt8D{WGNIpnn$Oww>n6{ZCw@J#rp(G7Ilji%fbx@Wnk`teq$+Fnb z^r=CjdkmL977+{SXS9E`mm`AME~Pa`qb|P%T}iLaDVfry6d$6CkT$iT4a#I|TOq1H zsHK|xRdl*wHnuN|@l5sP;^G5jZ1Yrw=?B4bhdPb!dTA71pL=)wT;_&9ayP~+!>4ML zvoT)YUYQaf!M=;kj~Y~QK|R=qEdNZk%RpbTY6QLIW8lG987C^+<~d;L=j*2HaX1@p zCBplqs-i*;aCjOL*%WDjaW3-4!l)PHu%$Cz{_+~~&+x(YMW^K-A>qcoK|twrIP!#U zq+IRa@qt{JI3fW_SSGy-A7TA+GPn*h)8Vkg{_CQ{9kCPvp{is0 z$iC2jfL>{Ne?aBTB8b9VN7@Mk(HuJ!aH{dN{x+YEl2IS%liN>lASO5pY-7?LUU%f- zi|5el0f8}RGIVh2s06&v7M>S;Namaja9Xg?7_7EXt>80GE&;eE^okf8OiXYRJf7Gh zaM_zU{|z^nXi~2C_Ly^OZ*DGf1B=iquKiJWUt;$0x^8y1mg&D$eE-q%QDeJjz^Ifr z_JHT7dx`x(n+aIz&||ABQAU?}&EL@3w**mBN#Hcf8yt+Cln=kM0@zjODY0Wz%b-*bN*lAjcU|Hwtrf*XOD+ZD+Lm=zR2XJ4dkKi9^!|8w{r6gtc@JHoT>&Tf< zc3+h)C|6P$+`B-*Si{B9*@2TJ{S@T^eJO39%-xm*plEaZ5K6w?E1`xHeo zTBpC=j+^h5b?rxZ%TK!sb(E~J6AdA$4e2hggZX79$2?L@=zVOX?j2O%*6t1Z6D0nj zA0#XSq#LXxluO)1lM!0>WS_3h6sAR2*qWU!{p?U6*h4q?k=>A(vIV0ctlb3LQqOX6 zPes;d56S^IlLqkPmOB_(h5SZ~z5y_$YoDJxLU(2x3#-SW;R6GP*V<<0IRbEzErcSc+MlG#$hNbPS$}YAKhTFP?;6$O% zI@%a%`Zd9_6dAA$%~ndQ6RKwBvAQjxFg23OG>wh%X)+Vy9@2bbDdqfE1WZ%HBr=Hh zxqtqu=)cAM|Fd>MMGx}Dkva{aSUy$5zja`Tz{bSj!8<4K4EVdWp#UW&HxNzMY>No{ z73#?8RdT#h@$f_0Rb>=o^04>;C5c(dK!{EOd*~n$^GcKSA#*blyJ*#KU_fn5?AMg;`>J1NDdq3%qjtgdM?bLRyjUP|r{F zSCN+hP2b~oraUng32t)4U*ZTB~&87q}=O0)9~s#b9iU(XsE#vCNSW~zI5aSzZe zytrulHr`r{3}?8A{wnX>&DyqG9*e#+@md#dcietzsGl_IFL2Wuz199npRS|pHxME_ zlA2@l;pg;bt(+YEPjlGCiJ-dn>aW3r!6{^D>nJn6%bbud zaQ^9T*)Cm5K)&cfzr*QXcWG%cYVpv-AM2?|CTrK^ISFrQ1iR&>BM>&bs0ih+Y23L- zgltb(05Nov$2tV`k-D{$7v1Xf)wS~ju^*s(OD46Ij2mLURa`Rw?q`IE7vdq0!8%lR zTd*~WhL~z@S;*R+Eq*o;bhWM0`_meh^EgbNaiNwQl%YGMeNOyDG=-6kKLZ}*2F0@y zg`#{=h18k+Ma!{ctEn9mB_^M(FsXvPf~E+&bVe2)v^`bjEc9K{SH0gr3EW)57Qc7j zC5eXW5p+tk?bXu8Q1-2s$4o!AOsyt;0qwVcp!NS7?Tdh|5zK(O#&iwhEF##oq#JA3 zX5bF`7AG!-Bm|i!OqfXMm1bj)*+r6Ws=sOv9StR983AL^q30@#$kz?zEgosjJ_@-Z zw)6c~a?_|}9TFk`a*XxR4B$mx;sbE`)ESN(F&67RG6HE}kCvU)e`D5;k!~a~*(I4o zz%k-9_qgUVla+x&BTrEYjuUP`jf#3H*l2Ny!ia=Ft${vh08|Ad656;sUx9lz@dKK1 z4(4mtz7qLb%smttnL&5GrUuCaa>B$uE~>n7IRb(}rI)gnQrY1hB)XR`s;{@zn3Y4< zCnNH{c2NYra>1RGFm=_^x9>=v<>&gk9FqD($t?A-Wi_}sf`=9O2#*PKe&X*3B^Go8 zku_tU0&(0OzMcIZouSl2J}U~y(INcf>l5car8TPiuS64Z4vS0dr^L%gx@AT#13|Lr z`>ZrNEl$s_O9sRRwmO^+on&qN^|4ObvC|`W$N%g`=$Umny8Tle?JNUU@ZcCusOQ=U zy1ok0SE^(wCnA?XMsOLrK7TNWD3@(kVYR)8oku!8_BPHJK}%ea2OIT7hWA5>MTa-_ z!~(IM551|IRWb?Vi>7A%AI77+`6C)+ZjJcnvk_Uuo;P((*PPm`wQoNKc~j$9@|Y5A zt}PFtf!!hys=&iixA!mkktotNI!9^OPOjI0(a%) zQ6P6Pyc5vq10k$|jMI8mzN1V2gKtBSx!`rfof0P9VT^}CGbkCP#<{?m&)K!mpO~#t zV+x2_Qd(yrdfCPsmgv2Mgoys?-h|98E=WP;EPlOQUM2Mmo(vc)8LZ`g6-X2vZBHbf z<=s&rvQZ(3BNpuLy7&wvq_@aN?UZQPrNx1O93J;qb!j;HUk3O;ZKZDtj7rGWVZd{v z5{>}WWzVii(pIN_4b+-3E3smiaTmGd86se6R{e9eR#u#B@`BC^JOZA34W({!?yeUc zq#Cp>5{T6c^FMl>FI?I$(N?pBzL@0}zANf5x}pf9BvKgZ+se#(ds^ENvM0=35@WR<4w(6Q{tmB%#hF^4vSu%#DRV zxo(r#6_7S1HVf*>Mja}yqY{gSkIkeW`BEQ_9YxZIoR0e*={FS#Do~TORSh@e_!p`n ztwv|7Sy_tbuIYS#VR znUeajLxU75duTn_vd@VbxkC)^;12z_P9CgOKR3VnsF1sfqpyr?J4@CuwBx)!FFgN` zth0)WtJ}79;qDH>-QC^Yg1bX-cPlKogy0Y$5G1&}6z=Zs?(T5;_dffabMI~IVZGHu zwYlaTbM)T75!wA|^=^Q`^Z8im1k=}%TUZe*N8p)^4c;&?m;N=;PYu@6Ua=B(mE{8% z{3;LB=YVQbozzNV!c~W#wdQ^u>H_onjsYQL8(PyUnX!Jagj$D*0vdN8*BLN_UB@SB z6@O7tWyNYb`Kf@4eH_W!HLoHx*@4(+qGwi4U>sB6S8IZw2f!}gXz>rf0ynP(WqBNd zx5Jk;x7ouRvjMv^_PUAwmksy7GHVS$-0N#;?FuJMW0(%JIU=TpY(ZZ@+zj;@N75gp zh%qQH7ck_XeuSjxxZC|AsgO}HyAu*t@-rglqP0Q%s(-~C?5oJi8X%j4Hde7W#X^2I z`&30T>!yC<*hnLIsx}c%`5_iWgAzYWRh3(G5gsYdnhb!(Rvr^J_G9l{LAOhU91iFC zm-=(WDY-E(3?XC&`nWqYAiZI*3)TAHkkV#Dn_OrI$IX;HUqSm%xeUovl7U<2Z$tA> zOXCB{kdxC)Q|0v))wxgs>|KPfdv{*p$!{r(5~C%I2W|P?QBY|wyPJ|_HaF?Z<1e;Q1Iq6EuBqx|jFR-z)uY zpy|Dbz6+BrOdrS`xUmK<+4XYHMeq5~Y3WCSJ-9ZigOkKxd^mafoW+O}*K`c~p_?yy zELt%pJ#+ie`Nnytto+r{mUt2plxvm+HhfGYuyz}3@z87z-3oJf6dG880U)7ZW*-R; zhdDa8GWs)d?mxt?;(l!&Y0w2TOW>a>BEgrM?!l)(BkikneVZ{+tpK1_HrPAE5_`Do z*XC9e8s9B^Z{czda(b8_yFEN|^;?SjO1LS|GY>+{5cw(7_9$d#y_WXu$m*(ZHk9r; zQXcJy&+u{lW56r4MU$IQ5Ild%!7a!5jYEUA$xkT^dU#8_!|IaDT5Ce@;7>Uo+!6;c z3y*GH3T5-+CrR|3mSqcX7xTUpk0qJOQK%S=o0g~m;C7qW;JbkTHIM)O(*l^O?V?PM zS%ZtNx$*C+AnF=cL&rLohX1$d4TjQ(N?vmh!Xg!I?fvRhKaZM+`5mp{t0!zi1{rfT z36F|12%XIxEO*vks~rjtJ`N*?Qx(KTZNKV&hn9F)q!mUxtW_~VDuQDy9!3#MTa3C| zguZBO>jjVS`VBF{!JfU|GNA-f{1UaRT_DHJRc3;>JE<>^_|b(mOvTKYotxy#P6}`6 zA)?*TH;7qV@5f7}IFXhJBwc~V!UW*;NwDamV&qnh>cH0&Z-4aN>nu-w7e@&FGDj^# z;eNWr1|k}|OQoSkyo+K4C}(?=Zf!q?fY__}3reuqZLc_Zt=(h_48Z{V7ulCH$xRLF}7%-Jf(MoG4T`@LNTdT4izl09)5WVl6Oq{0Wn&p?na9d z!i)V}o9lrNtcjo$)-5!v>!)asvh!F--sJnvsvqPu&T9+OE3gKlUsuLi^h2+%4+YE_kWAQR|q*^}aroH0rG>hOR!| zi5c)it9w8$Ev`5Ge$#7OIs9#yaLKKRl4}H!wHVNi!t_nza?R~8E>JVLQBnv=pI(9m zSyp!i-rO-<#Lo=8;;6?v5dFjgF)p#q31J5Hm-$+}{$y4NVZyzcl<Ns)meO z;C*+eMsMC+@;H2I>=9R`Z~kINc%7@@8VsY{yPD8M7epC5 z);WG$XC0e{)n*p${L^OQyBXQ=HheuVF;=Ivw6rLhV|4w~d7)STwQfYc>JO`mUCY-v zxbC0LO!y@&eJP2Tsxyh(CV1uhs_T{X<_qx~LlNdy{?9K?uKE`3#m9HDD=}l|s~us% z4^q7iI$t-M+o8r3qDmCj4H_Q)xvF(IMyI^~Q`5bVFl=Ty)i1?PRaP%~1Hca#Ar(a! zK!XwKryid<{q*hki!DC}^)jyLfpN~%}KNpy}Z`ZBoJG1c8=R&Epno#h#8hC=&Psr11wWIMpd3Mh}t0}O1*DIqF|~& zeks(#yt#RE2QlF|k*Dh$jlWKI;q~%8rhC})?~su=ICuIk{-DD(D&o|czmu@ToU`3} zQ}dAejMELUy`&_m5#z_GuY9h77?jQkeHZ#w=g_(C;G!e}x7Xf2&$re-Pun^zzT7W9 z*=)24Z|Cq8_N83Ez@2KZhByAByZ`(BX~dn%38lb|XBBaDr9V48FOrVGpcjH15WNiE zuo=|u(~slqbq?AxG1N#o##VR$YcYaNLo1F0yO(u|Ei>X%jS8!{H1}Z)l27{ZX{m78e09~^~qm56W`Relt7VR`u5Haqm^up zk@LGy%F}fO>e%ukrAhM?bllQ)2)X?OIFPW&d3p8)k!aXd0_zhmW4=}Mj%xm>y=wLt zP|>8m=T{TuZ`$6}C&z_h{!_E3zR3gYW3ivAc!(UdJPc?qpKh=dNsIb09myaWx;h>$ zVbWSy^S;^y}|t;+(LIK#M?FsY>kGZQ@zwbotMcs7}oTbqmyc&RUPNQeB% zunPhFx-kIBrEx?sS6uon%}SY(%do5k&e0O{L5%-RnH$5+1Cvo>t>9?@>uS}H84}+s zn>Gri+TAM=3qfBX(eDX@@Tx7O!+U@W>2fBTDX!XUFYLh8o(UwG=J;;Mm74*!c$`pE z@{_PphJlMUrfbcnI6Cz+0W2R}Aj-#&{c{(KIeH8y5#*Nv`L~q*dv4nnRjj9OC_jRf z2~CQ>Fw&Wq5@(fn3}|>@K>Bg3o$#POa;L@^zTEEj1r`yGH9a*xW{W;YPoHCIc>LU_ zJ-CAS#oym|g>z;qYMXnThaX;qz+<(1rER5YtkoYvL%@FEzOq$4hi7&XQ#v~HSS7!9d z1n?s*(19@(Rzz+q`Tv#cm3xO%Kb5fp#{z00IL#~>BWLT#2I&_qh|cjVe7tOY2nzOl z9)H5q2HY-gd|5;6jk$BS7&<8o-C6~PU-QaLavL99)+sl)3&ue)o~^$Q(2Ocqb5z)1 zajVKnoB|!W1^bk*^@*DpAZp`~Ea%CZLUwKW{34&Rg)NyXA<8DowSX`@oce+?=W$Lq zxf?9G9NvI?FlA^^mEvK(7FM{uNoZizI@cXN=pXht%_oQcgn$lFn=84I7ds>E!)fY1yRA2?XCx`DZpJSrfgf9v6j2lf)3Bv~0O$ zh7FdXhWgN4XaBXz;F|C=ucu??N;M`m9$n@6^ zzjx2b8blWJaJ#AHCrjr40D_7#KOrRK`&N z9R?vbI`4nCC1164`FaL7{=)(w;bWMKNi+nEBGja;(sfEY*6N%WyGAKo!#j_+SjDYfZ)6?Y zyv{Lo)CWvJ`mrla_d^Y!HzL3^@u>Kl02-j+^$u46q08magV|8twm#s(hrtlRT30|^ zKJY)zm11E{#HeFqS8LQ#a}c9Af2!Y?4Ni=%IU#mR^y%=k7%quYPnW)z)l=EqU;`I6 zF^hxoC}duhykRE&>&U6m)RSVIp|)=-3|f(85g)N`!PC?k34WzOxYQXKwm%;fjQkId zOoibxQdh+Eu*W_IAEaX{JOBse!>s1ibZ(d6gzq9q7Mwua-<{r_$cQG!Y3oA!BV;OAN%Nv^}zXY+jCG_op8fWkuqP_#rMW@v~6-MRd?8B87WRu(P7~h_l8-t8D&p0B{QW+|tbc z0LQdSJxfRdCICEhp}Uq63a;!y{pdz53?(omTgyRi9ts|2TO`@Y2z1C?!4&R!+XCvQBv_MVbg z!Hn+4r%1k;z-fRjUZ1bE9<@5Y!yocWSyw~gLf_{hrm0TY53VA;mW`<_=uQ|^NSFQ| zo+$MTp?HvVFH6NnJIii?E&Q#c}@qkiidA`Qb;zA1lIr03eK{ zZ+t`X2OGZP96VD)&h`J0Z~jrqHXm$*qQ3de5R_pUI?CPb-*}JaepRpj{#cH%)B<+@ zb?CU}re#kM${sG$W*W$m z)zWD%N5~TF7iwb!I)!30Rb+`uD4N)ArH=-sgRuZhNnXh1!^j zdJJua+mIH+>-L(u*r_NZ*5*qZ7f|DuVL6Fn7OBE=q2#vfdK>@-Z1IJVPPT}?+DmXs z+3(@AOIGMfqu?~=JeQXj#nsJI4sR90yE5@*d#LC6LL2zRIEfeee%C=Z#b{)UGELBNE%2(PstYX0Z1hS13cCn+(5(i%VRck$;#Zsa43tlb^A6n?xKxFrsJ z#uy&5Xz{o~hWye|cnc-jf(?eLzsdo;N*XN9QxhLMf^_bZ}|h(h)emxe za-YOP{o8PXfw4}U)?Td%iSCUd;*C{Tu;YihMV`-XnEA+wvAaMTN{t2#_JO&b z$JHKHB`>A(gqv???uhYqzuBsxhOYttXge*jR|k~WSk(t+8VKLk$Nxs`yd?~ru=psr z&_AdDZwta>J+_z8ThWtxPRtcM814FyTwhe(FlEQ<>hb#BL!|5GJ*#}@ZjLUhYLpma z6oa)zf}XQ4`D*)b33o|s@C3Lt`(AC6QLBE6H$N}L6MjVDx<^_7*!DD%sa9FBZza)r zeaoi!8lPLk{a0I8;W^(3L6rlhWj*VqbtN_R${BnzNX^W@qrY6g$mvMX1iuy9QIV*l zH;@*($K?CM%z}1yQt^aC%)rurC}}vF@sR*mNFd=kWwv?qg1EGKUZy0i;Y5DrcPJuU zQsQEn!=Il*9nqZ|T(94?9PiUg7;Ipmv6HFxs{le$Pa^bU9Kk1%{LXIlibLILe_x6{ zAi1-Y1;Y<5Vt0SfaG0SOp=|U=8s=f2{KCB4_ofp;=_f3dn4&?_M6}?L504ejKks6P z-RqHidzbO%7GLUN-x`ln$!DSP@_2N^VcwQF6sRCg;H*JbP6d01OXP&YT^_TOY_qyo z+$TR*pVjNT-7!a)>iLB44JkU34LOTHu@ljzU)>_lknu%AS4{Z8(I+00lXo00@!e&A z@5Q%PMD?Gpko-ctih<7~Mq+}^%AgVe61q2P z4+1EBO3&acrx+vc(=i)~)#BP|RhIkw0aKmbXg>j`R(%nn`MhC83zrga^!n+p?YQv- zwLQpK*#ARNbkUIL&%}j)cE|JcNL}EW?y4~OBW%<1xQje=-eZ|-Tab@7ki#6hj&LN! z1;($rr(Ugs&!6qpz#%oLkJ&r2%q5p-yVGY`iq+RXkhxs|?+-p#g*&M~gtoRUY8hb6 zCxkB?=xD$Bf&k6~n1R=pYdS{I+AQtln1h^mr>PL7M)K!|2+;dQ1bNOe3x$+Y+59&# zVK=N$G6-O7DMIq2^|wn1z`le{pKZ>9cO4QcB485#dBQZWD|Up{dXv4CMi%+<<^}wL zES^}9Bw|&#_mAWno+}kijEq80AXJv56!B0F_nf2qd!s|ABYpTnK#AWJ)w=1)EM|6ys1&J-9p>jM?&4?xaGk!+YSNy1@L5#ebczR}J z8$*83xPDq1@;3Lsr!BB>idi8^;l)>j@%6BT$VKK7Uey#waE%4J6>-dMqgkb+tAosv zc+Ie#|1x2_L736A1aTlmQJv$BMfexrApPrU_wV$*Dc^i+K*$OpcjdSdFxxlL%I zyj+5DWRCyHCkU}AmCebHh%N!9te619uSs#ue2&e7?Wcx;bdd0t@JVOou{MD;kn@y0 z2;bZmSM%C`40oQ>h`q1H<6ZEJZb}IeL&zR4A1@r(Y(jNq1!oIvCPT^sLkKty-1-*m zRrH-v1B&IR5BtrykP#2(9}PnWL853ciD^x%K1ueY*?VZ34YsW_@aEw*wey`ZrR~C? z6D|RQ0h|QVfO9TuROBHZ#i^7fF87<>%40|HCWPKztWs%LO%ZMFD0(m$6Up3Zwcj=R zS8kY&VL}5Sy-2K${#=_!fZ4T>kWkPe#2=AkxI)C|xid>A+HXGxlmDc!Oq+D*5hPwA z{=?m$_KbTl1j}4q^4*7bSni4U$Y;ANkNqI2opEh@61Nf>e$qD&)nGx?0WmpA! zHA2`860f0=XRUO8aE^gQ-sHC6vqc(mhN=J$4SPgu&yEAe&*@>SWxBuDesB%fx0EjL zacyzRzg*eltlSQ$^&6QoUwE$^?9>L(s{VHq1N2f4Vm=ZMEP*`HHhEio0qT`@G%g#R zN7ExF!I^F)SRlS)<1*0Bj0hP;}R6igt-WoSLJ3HVq^{Zupg?Xkt~t!cXAOlM#(B z(N6GBz2Zg?{(c5U9m812G;I@8-4i#0Lg<@#@p+F?rn|OSJEEKe(J6uA3<1&9Cd-39>)>zjQjS30E#D;M^bhY#P}HyV7}3UdM{MM)CA{95>NanvP;X zJmI|~V|6E;iT?wMBA#xcy!fXNied@YlCs(ipjw6G^S~ucnUL=n@_R&GKnz4)fP>b= z_y&he;dvI3g-4u26zVeXDwy)MIZF=QOUcT@kcnLv!17Ej{X+?r!dt!(t9D^3XldvN z7hlEUo%W?fK%s5z?K+9xCw}23TR1S=km$=KFZiO*TAgIC;fQ^a46^9DMhTQgdvnOx zg>0}_+yvi+-%e&~#d?1!!nb^(Fi%R{p{)~3%D%#xKMR~`P*5G0-Own zc?}kI`YAibx7s`&uwdxjF%Xz>rvH;1#SN1{+3!j?U}b=x#!vl~6~vx(?exujIk;746oa2xaryKp)>L{s zp77US;;7uMnRq+FgzcCQ-@CaHP!YH3Sxt!AT? zVA}jfF?D$+oY}I_P9~{6xr|}IMGJHFS<}+`I9mk!-o#6T2qm7+#?!y0lh5vSF%-CP z`Je$-DwC~EwZrh9&_s@~e4u!{FCT7E>w^#qy8URPhiKe`Z2VXn?>R9s)YGzwY|2RB zKDt!}apX9B0u&IhRRMuy&h$tFN4g@>|7QUZ0~K5bO(i|M=g{p;Lc>CCHs}T%5nmw} zxrMd7-~yTsh-chCu8dlkDAFl+l6xP5fAf&md}nSS#RmBk zh~Qs52A0j=`f^m;>N#!naj%$h50?r9D5NSz0YD$!V$C1LToyn#5jk%4gBh2ja1g*` zvX2XbPI2e%FojJF=8%*Sofwy4?l#P2vqqkjP>dv6kljzO^Jxcdp>t6r!65@-$c)Ie zg(nDFxxW#)`*osa0Y$}%xPdnX1ck3t-zhVik=x}F3f@HakC{wEzwT_sZxrZpJ4o{S zfB%W-P9RtJP2Qe;mdd*nsD1ZlwiKvf@tQV#T|KKz`;VjbzoHe&I{$nXrnp0SHl-b{ z4>_XNlur!OWvf4pO-rldAEN$Jy8SvO7UjaLJDH{Ypm8IlZjzJZMy&WmvUcgwISvhA zY3L#8od)|=<2R|fSL7q8YC~`v-dOj?%Y5z1%w(Pa z2Gk>Xtn7nef!qhy2$%`5%Kv&sk^qNZ)&S;-fabo{L$;@D)D+v9IH)d&O~Pa735=0^ zOA7o;4}Hx7Oio${XC0}D?9|(UqO39_4@nD?!?UP}GQ_0wL&eUOF=XjaugR#6R9@$+ zpvZM$C8JvkD@8*qz8w8KF$D#&=X}GEz<5&^!l-o~ zN`gXnznJ)j^;g$oVN73J%1JW)wsE#G3!l9(ftpoJrb7No#GMCD*i-1oV}*wAebe(f z?@Aq4*W{JXM|r3$PkD}BrQy0uc4en#L3y^Ge`i|}hvv@@Ri*%#l=zLfisMy8mG>;? z^N67&w9d+vMu+c}79&USQaj7Lt>oTMH`$D!%KtQPJCzY&L%}!UBC__1N_jz6M?Eko z)3u)g?)!BinbKeVqhco;^Y1cMJEOO7yX#*zaa4sr8?%7e^xW_I_>U5E)N=_IRA#}5 zxLKcMk&1;bZhG%YVQ0aK6oNrUwtZhDV{~}^afwT2U`p+S`yhyDf;%ll!YD`JbI=wm zA;#iaDRZZSQQ#YjwJ%K3El@ZaicSz|c>iT-D4+zm&j$2bctFH~TDF?=EB_2-mIuTN zf1Dcn-0nOaVG@sE2;Hq47DLR+m6AC%FWZ68d5-g@ro-`oST8W&z#vOcf8}MTs`vgGFr){+DkVE zD`xH+6KkDE&B71wiT}Zpf3^)8>p($b`Bnd!!~FO*`wXMi3RDY?~Xe*4)TpuugI@wDQ7+Z zL{RRGxp-Nix6fV5KQJ|24>L@!I`*H)L|H1@^n8FMHB!*~~w!wNFZiZac} ze@aP0P{FG?WG;K$xPfLrq(*Ohnra|B$6zMKi~8CGex;3Mkt7#vrQs3pd;$WtYY5TbO`DML7=X|6ir|rG=q#6}uHl9nMvb+eUE~p&V zj`Mr|%DVA8m)g-4I3<5`#gl1UF#Wn=1z8CJWJz@|yRXl#FzU?iX!GQL`xFLL7VlN1 z0d}e;uxvd4Wt;^OsyB^W^21tB&!+%LAnZ99Ar8D*n)iI}DnnqY zVVB3FW-RSilsMYF?itQDnxtKzq3NPbO5686(7g6sJMS;Ti#y?C-m_}_BMv^lgOB8i zlHp6+oF~%bHafkfe{NO(e%gk>Pu>=uuQI1QPoA8@p^;0HB89~J^31JJgEu+eI`I>l zzV5d?wC<*69=&;0nwx}2-q{-%;2A4|K|fkIho+gAirR^F6)LKiVZbgtZAa7!HA_Bb~T8g}S zN5Y`}klkhNqbHb9EGr5ZTIaExf?gN8t-`p7O2`kSey)(LU%`P^s35xF@@S~>fLLW# zjFF0C+LIip`ZkCI%2cb}J?){EHTFsTi|xD9aXTm=udDY<`PJ0Rqhi_49-VL?ijvB% zGqwE?^ijBny8Vy)QI3Oy`jyNEy1)}QtHyww_$Dt$1<6YVHSbFMiH|(oKlRxev%mEM zSrp=l1PhTAXVz9cr`OLLJj;a&z1&-0+qBe@*d70wv#??L%jI7=sr-82WfwB2oqYqn ztf+|kXliHR=<*K=ng9odzcc+$$=ah;@NZgjYL&}2<=>#D*p9{mfa8%Yn zh#>;Gi_5-a50LUSgE6kdA{kXGOaJku_WBVYTqHK_cNVMbh9n#VD-9qqD|t4W4Ls%a zE-fBc^Y(-gw%b`I*qS9vB8b%76Pn=)19%ACpM$6rcXO74XRLN)5!{zBVT zI2-_(0|U=C=xXbu9f!FAnOOD9b$2HXbbSOlopd>!?~R-wt@BRvKgYbP(18!O7SXP$ zoknzJA&HIl$ff~99)_a`lzw{$+CN_A*vIw6-3$MhKYYCs>NG#txU^D-h zheS5h+@9NiS;uf}c+Kc9j)_MlB4%|;vF>5 zNdM!_BTk1pmB=c0<8393lP{y#dKIEd&}H{wCI?Z$PWRj%biVNl23(Q3H@JvECMQhE zZcEooXW(}<#35%F@{trYwx?!fzF14(^JiTWNLoqcB;nTv@C7{4*o#1VaHm4kg@&l#QZN+mAh3tE$c-nN+ItFS_eX)#)P3}F*EBSyx!PeX93yDw z2u&h-h`+=UkO_Pn$(gyKMww1E@<*C_!SY5Q1nV^R_~9{v)J2od{7VvN6Yd)$|Iyc54yZ2E{Z$PzyJ4#cp6c5W511;fA1%rmh0phfFT=in<5W;l)ir!v@RK6-L9I+YENK zyxvR%5q~t45D6s{0JsHbAwMdG@Ahb@9?C4;79m96(>NjlSsJTYHD?d7L$fe7X6Dr; zs2dhH0e}|(p4h=3NVJ$-GH3`98F!2WRJJA49 zxf!W()&G;iS@on-&!6|2-)V))2_f2wEQvT^rK<_1#ZzpIC4G_y|08 zxQJ<)OB{a5qn_D#h~*hns2ODY`XI;nOD$OdnF>{eO2`iuk}cbMnTodzVkVk0rcP(2 z^dUOl-LeJE?_J>Jhi=rXjqHgCsW@;TX6GS>VxpHbJN&741aa6sg){(#ET$95FBR5- zpPqQ{Zn-V$^d0)?s`(({$3r$VADN@!XzI`TJ;V8+t51ZU81r}6T&zxn`mAaWH$%-8 z89!ICg?79b+^;pBQG&Slu*az<&p^CLcXI51-r94o4X9YmkWfl>hX<}R-mx)f~G51PgU&@AIF=2PuYoaTG za<|}v*-BlLm>q6F~z4repMMST4IA0OVX)&w%qWgTm(2tvgNpBo$ ztndAu^A^pkD*hyjvrPO)4|*dW#FiCe4esf1ll6B>*EwRI=4x)f;Ch-!9@Le z(}zRGw6{M#Z>L4arM?eUU!cRqo$v)Ax73kWRG;*}PmtN+O={z$ehIo61o_$J6HzMG zrqtci*f+LChYKB;)q%$9^?y)BMw0jWD(QO>X3nSMoU!#x2J~jc#MaGY`5se!a%QoQ zAz-f{I#9NqRdaU2dqa)wp*Fq01aR+=8!CDyDJ&_d=^y>zi!SxX%ik2B+q>3xv&H|x zJjKpA;r?7-k)<9{U2h>RHQ-I1FMGGW_Hqn#dG)=}TZXTYIDR>hhH$98>()I+H|_sY_CldKyLv4FB8h^P={Q6pIc}FTV5B0TTmqDd?R+;00jg?S>lMow#<-%Zk{y+nU%EYAVko+EZHE`Y~$aVp6^Q9$vPq(;U zoweglcmQftr`C)wjHn=ZZ-)u>#>ZpeyOGC5J2=1v#^8O)qy#XcC`}{!EFX8ed`3|l zUGcKVH#BW9AudVGkAgv1d2#*b%`0Yz1{Hp%ft-((H?n5*OENAN;59Xn9CT6U$Y|XD zzGyPOkJ>CF4C1!iew@#6)rj9fqC4pnCpTqja73 zM~(bLyBQfvX9t1WdIEI3nL`TYheAk^2HT|!w3>rRVKZnA$Zv7|C_Ns&(=&N1&oS=N zRdUy)&>I>CeIjXyrpKHbvg>s8>=MmFjof zCx-b~rYBK0=!J(1q3(n_?o)c02WS`ebD#~Pu_Kdz17Y~ zDXp~58VOYPmHa92H^P}#wVj?C^@q!4zqIBL;=qn+8Xn&J5cLH6>7L3ZioL(;O~t90 zVT`s$Fe)Q%76alV0e?HP$tCqba8ar=)s8Uzx?jD^bR>fwvX$?f`fBb@g2;5y+p3F} z3C)%mN6@XvF-qd80a+l8${4Yf8S>B;Qw_;LhyIN!k*yVf@{xw|`oT_pR?)k9Q+^Hi;BCJ!%=ASO~=ITwr2{GKZzU;VgF`RFy2wGf^YOo*`ZCSqp#>x9y>+7 zcYnoCT!QIe&?+TRS7sfbg33872><>44t$!tw=ewcYGz=dM<#oJP{x_9DA55mp9?qc zy37v-kzk8A`pN!;m-fdVW7@=(@*&BvvUVbYDK0wka>4u&#P|Se3woMj;e^asOR zOcY~&<6sU)Qpq9Z+$Q1H_O70A1M|nTz=m(CbO*DikxLxK32cg*PP8G1TMZIlM+t82 z$L*u6`@?uSsC5|KK^E3*?R(#YG@BvQj&$(bZzE2~3*wgN%x-S{$1_{dc#&H!I_Wyj z_Q3ea_~uw?<6OM(D=_+dzRk%op$spB84S9VTaaIiTQId-LO8?OF?f__V+A<=qCPO) z*npHrjgGXn`}B>LqLlrQLCQhnLW3Ec#%Y^zxSaNo4x?v!VrAR|sh4bLXARbt&JD3K zM@rOH)^5q?Fc@QmUJPTHps2N5pt!Gs&k=yiVv>^j{=ex8bsr~8Sy zknjy-u&8)#^T}`q*)8s{)CT)=7?N7IGlwlJfpdCn&rf)xl@AmdJG}qx8J^zX4HSah*`!;vHjj?vw7$GUmH#ebd7Qz3^fGn-?vu5*F5D} zU5+wOXFZER0Z?*x#GJFQZ&4YDK+|!f9g=-1ko{`-1vGYR4^?1i*bGJlfRRy;^5$7V zdtQH65vx-C;DJz!5CC8Z)CG=qWDw!_Ic4}$<03sm?vwaSV28A@+4lNAuG#brnJ&r{ zG#Z^bIi{1biAa7`7j6>dqK&Sh!+|UR<{zb>qP&B~Xe>^>Epm+t5vsv#{wvf&c?Y#h z!)C~j2IEmKk7*ibh8Cf^FP3FuF7&cRizR>nTyK?3^TgPDwWlv6r3%7H83&P(3MB;2 zDfoiJG~qP+=s_zH53k5L99gp-xBz?7fvSrgAK$B}{Rkg7mGGyDPZg&n6PNA#bgV>< zn`s~USGn_GNHmNx2|TG!*?ieh_LNGK^-aIv} zAB>uc@1Bgn@`Z_W^;`S|Ca_|{DClt z{_i&X7<#`e+)h2M7lUv#%V2LbVtIX>i zH@cRYZQ+}=^-f-KJ;LdoX(1|v3qe^VSeCNmmPCe4m5n? z`L@svskXwR@89H`2!Ur@frv=VqM7rFo#;7D*qQ!z$@$z}YI6=^)^%9teL zCcS^3!G*wa&Vu4AR!8`%4PS|$W<_XLOe8q2sgZlq=dV?_b-5cb#S$8FT#{^^%b2iN zdCCOXblm!mX&gIJGySf4J9 zBlUES25b_rjM#aSsmutMHZ(GY;pd#2S+~Ndm_ZYh%me{uiRV#Iz~I`ky6GBSzMu{_(8__j?TCtx9M%qXXsk-Gbu@(7|#^VJwQ^T%OgQczPQgNRcYf| zTMA48M`ZU7ce_O(r^tOP?CFLyUV9vZgrNqW4-KUeKcN~}PM|He9?bLh5-+R)!2rfZ z;=T4q#0A}4w_LPDzK#g|-o2-)<@~!PLt||y#UFxjRtp}!{_Vs9yAwU2!LlL3iN=Pn zTkup-xwa+94Ye&v`u|Y%4t|-&-P-q+ZQFKDwkFq9Q(f6Mu535iwkF%QZM(^Cay@hJ z{p|PI@859#KI>d-9p7~vIA%v{4i1D9lbfvle5tivznYGt3AoEQM%@mEAFVQvUciar z#=(Mc9+q#Rr&&rw3?;{4U(E%tF1pYaFE9rqyN;p!fMuEQPDqIwt!nS zRYPnhl$tIljEMTLTyJ+xm_uRSccQi(p9e>ROuST3>WYvBA76YQ-eVR)#y~3Gdw#JG zoUN$?meYBjA@G(W)#>hgScHSl&S(2LL3lquuJ-IrML|-m?)AFRI~%vkT$evs8|_M#1AeOi zE#r}qGkmJtWz8W)@rAc*q!hxwQH&yN7yhU+pg6+u9+nzr2O3kR)&x^PH~^- z3~IvcK0#u6H*kH=Sg2{zvA}ow*T|a_ZHLVAo`;Uf6XTUmH%lF&eh!N;!^+W?Q~S}@ zou)2hm}bl$XSVh$%@WnWL$_XI984a%Tju=y*MW@l$dXG?-Hn?QD({Xp1c6Vn+D{5& z1W514oVzHUK8ZaCr%~H$psjC!loP;qkDtcJrF~p(7|jxA%Dxg9IJz4H!(=x^37-uH zs~KKOQ4+_Joz`;DAyKPwWgZORXws3yz|k8LE^4W=8kN!=#115=d*jhNRxj+&AJ;{)1{9UBn-JEqy4#eVkkxgRr9x zfXaBavV01Nw;eV2v#;S>_0jL@gWuyklQ1vfHeff&8sxP|Xa^3SZSb$=^);zCfq$FiO({(DXTA6UMQANq>0{e??lo z(;od6&c7E!#*JQ-E!7^V9ZG;qILZJ!2Y5R!ZVK|X1$!@&EAht8xM8N(io+k-*ZnZ? z#pejRq6}(#@u^3|Hia@cJ%&Yw)){v9*W2#$3BsCYs5IL-dXf=a4hRIn^VU#3@TFX= z*lqUDzn}A1s|6LrOWl}ttze^|w|eJX3Q_n_t3PjtfS8M_535PQa&|zmysQ#+ua64k zIDveXs|{I^u9*0+ZL*oF--#sz78o+-E(cAgCR<6gc2m;IKz@lru9I;4d_U-hL3m!aZnPrta$mZfM;AjgF@1#&zk5-6w`t6ZYy zquI$SZ*Q>ESAS$TuDapY<#w&&KIYTo+kV#`9))!G>nSZtWlp9j7!Yp6N`zGtSZxHh zVbpN6Y7dcq5lbcf5e`A6)Wm1@LnLD#&H>HD6ebW9OjUYl?pSAFD5?m0jWX<&!kE8S zXrb@}<&%ZKbil3sSi?5rC&W-0$>UBrm-=o3#XzJ~y<&zZYuC`-LYiuEW zrBUAzm2kdd{eBvBOUc+I;cEQtQ^G`wsXaUV*+B2$&zZmh1)M~!dT0BHs^Wng(Li1% zoPP_<@`YiSE|F?3r{PXt4LcaQPgNXK80BA~#4VcAFaw3nKLIQl8u*J`7KYusX~u`e zJZ7h1!qllUzwVtcRPN?1M4#Z-i2F|PX$-=5zx$)NwQKT-s5@3JFI5A+Rj;b)SY*#e zS-p%^VE3_0>tuF&M!&sgvs0nb=ag`jouhIVWy8?ZN&0H`rF+iJyxhN}Z8My+2u{+B z%WLUHS_+PH%=qqr)c(R7Ltm3@c4*kv-)4j=q^x}BQ7W}4Q%`ZsJaGC?FLcyyx&7^5 zcYMQOMe6%nXgsPZ(wEUY-H=^kviaoq#u6U;v;;pmf40mCt1?E<#WG)?fNTUG7dM+& zq`P4Rqs^rd#1+_z#kJ-mQV3=;9M>!ktH=HG{2Gc*3Bzg|3^_2K8l%Tvjbd3z0C?qj)$Sw9#%4cdU?k0oGC(!( zhxRXGhNN_(DpNv}i2PASVZYO^d07jW=m?E!kM4*=vUZysv&kw{_BIr5H0?1%zzn|} zQA(8uYww#E^vb1l5>k)JBY>i=AAEd>czNi7T~0~y(F`B@?p`UXF2fEV`2A#1(^r%y z6^FRwNO{^r7hJoXR`Dd!3PQdlxfZ+A&2FbWN5CWS@zM9$aM?&}ViVawSGYxMInB9b&$#Z!Ix*7npck}X zq9|E^9`zSFP!6GNm--^)Im6Uvo$8tuKEQH!wGOv7R+j#`a+cG?`u@7sZZw4vC2pMX z1!~6OkbXSGDJVZP%R-V|T&uNQ3;zCmu>TSj?6|NWl>d-<9-T%~n@=D+!<#LQWiv&( zIdeGaXq z>hTj!Y2@u~jP^Q=2sh^#OP$*JpXTV_Q$$(t7eprEXZTF@9VMt~LhY*W!m5y$P5JAV zU?kqh`L*?PCBmi32;y-T?pMIK${R-LB-%_7NPfJIauCU2+H${!(cMN)CuyZA;T4!sjsN~|^UXQLvtP@b;u-Bl{;SSU^kq=L-uP!)T=qCubi9R zKHp98(YGkzfOVCzlxTH5S!1 zC~2>CP9T5`MP?C(pY9L{2GzPa5ELxO4z3t+jAZ`vhBtvU)FvR!n&+aT*?N;i(0yb{ zd1SRm!Xy`5uU-`t&AH^-2umSNCwT%54{=63bLS|3L8a1*k0&yd%}Z(@t3~SM+PM5d zo@epM^1AQ4PuMZtn;Gf3*#0+|{TTpaZ$uvm%CgdUXgm`);#FV`B>pDr@e3ZKm?@7u zc_HG-b$2GgZ;c|dSX}sTNmX9~;%G$YhZ#-bQclA?TZN_6gw5NVn_cB!!Cs5v_0_f* zEG7bYku-FAk)M&pKa54D;7s%g9BPrlF6Qa-OKx2spNmgp zOo6k+Ux7s=skUh51@vVpB-U|T$SA!FA|_d0Sim z^tPRmM<&?w8WN%4i%vWf<5vw1K`XRuM(wv8rMH5&lN)PCfhmAYLTTU$1EXV)^B={> z{g(w&R;WGndo87QIcEZYx;zqa`KH6|)jfPXcTrpynD7?j4X~@Gvn6l{0C1&C?tR@B zKc+~4;3j+bO~FZHt4f^M4|MGdy1rU@UhC4WT5$E$vXNh_jHU2LHBjnjla{L9S`}l( z!-l6c+E^(_L648^-kC>nphWdkvDYhsU+mII+S`o36e-~0rWsi*(CR{HKt(muq`xO?&BfO8+R4gzTJX z)aczJGpM;xdXR)NqyW0K&A^=LIzXwHQ~|&1OS6gvFv%e#UzietXi>oK@04>8X5|oY zaJ|yPP9?fWv0fy;KXxRbzLb8B2MuX9Wkg-i9CyOr^JkRJ3k04{d z3py1hZwYe6h;ua0*>`)QLX>NH=iHSLJ7n5v?yFnROL-*0_DDP@sQ*8qUpNPPP=hdl zv5=*%G=e{;-e`JEhB{tO-*SgKU}-30!SqYZ8a$-}JC{`XGL?#O$h3%*+O<&qY34*G zp)bBFjd-P<&pF}=)<|`d#jz~8O3>Ga9y_pjgW^p>MpsdD+rxs14`3`4l`VG~MfnoZrhHTWFkcV`U!DidPoj zmewe(wjASB&N0uGlF}x=A5;>LfuLuSZG{zifiDkCZKj5MV>YC-Y=v>wPux6A8-<#P z+kc1c8zV~+_VfHpZlWddOB+F0*o>`>6}+(BvZfkK$Fc-eox8f3>KJXyw+=Y^bqkNB z?O=%77EfKwLt);y+U6@ha!7DX7@N0vlPceT@8;Y#2_r_h#nU{VF_EgdtpfXa{*)Lc zQ!0>6qpI)yQ|b?d-=0r=mxMO)Oc@7T+m~mf{l?_BP-b3_J6?CIy-vq4!8*MkPC37q zkKaa#Jvh6CBcZ?w;A;$7azMmwWn`A1XvxGK%yWbj_Ga-H5ZRjZLWLcy zI0gL8%RX>(z1P{L)K+@gtb7<#;K<*muutgii`IQLN0BGN2ZyK z)C~n#Q%?_x@6X3#`nGe90T1`(KbH{W$0~k4H}p!Q*pM_Sn1LoxyQ9wIs3<9)hx|uB zmbI#1GB;r2BF?yJ+{`j!~GsK!ij4eudhjbvac{+-#DY@qo}r& zgT#>_Hsz)OV{|$z4?=_2G9V2+j}hlOjf^G-zP8lWDQ^uy4Sc-mtF2UT_HqWLZ2l{9 z5kI(~Int7YH^G)iSvH}6a8;Dpz?NJwCATZ4;+B;b1p3>LM<`-3i7iuv7YHwCaDN^| ziUYac9G*B}AP=o|g?(NtUq5U7LRNkH+{EtEdB(>K#QNvFRAUME(+?^1QIV?{D4pJr zX`g)+ZhW5ZPAR%Iw4b}Sj~S9Dz?{qQ0ZrA$s`uesn3m3kS&t)b&Hm`jcHW~9Rl0wq zxDs2V*}um{9qqIc%R&;DSD-JCY_r7R*Rl|2wf)LFY)iUKf6DEyivqtvKwfAXJ2j6D zEcZMYgo#kI87!fS>|yi!{Hv`KQ!7JyCA?hckgzB?1TOdvxjet-YJ=f8Sf-PBlg_SB zDtG_;zmcQ=tdg=8{C!*>^8ac)tT--yL_D=;w>urlKE7^EkPaFJ)!XG^!HV3Xq(M!3 zyWcQ}PgKbFTSM^$9xmFZ%iU=>mU0rYih6qvZu0sZ!#@X3D@R>Gt0i<+peB}H#Il+? zd9;%gC*EKxl{$te?j?d%=el2;8MT}K5PBQLLZpI5ZK&SX+UZ4wkmmx&sAA6-%od|3 zm#UlxhiRirVn!@6c*i~jWwOB(`139Hvr_b4Ei#N4fp+V`5S@jUI?J|kRtFx>B~FbN2(sxn9k3zX5CL+5 ziiJhf4wmht!yzp-0V!{qf~7=v)q1?Y{3de-q6m6NPTr)Be3y=;=TIX?sGSuAt-}LE zTWlZ?&?P+CoRVNQQ1UZAScsX}Rlld~YNxB_QnC^1GeN(Z;k*eKoN4&y8ZAN}uz#9> z<(A00wS2a=yW?Jop9H)^!w33g&A;E*HnM9-0cuVV$aqVsSwtrv(iF4a1B)QRW zd}nC%*GW4piqgn?1fe*Vz8qqR5^SZtH!}5BNK7*PPPZ|uBz0$D$O}U9tu%(25AlmP zY=>om?!`1C7iZ-GsqE3S(PMsIOebN*F+8PnBWecGq>Gns7k6kXH2YhEi`&4T<5r#j zutaTk8QlMQJnvTcql*18!-`AMA<+KRhLMLuJ71rIDK^&w`qe3wu8kNa5Bvb8h-S21 zN=7%bd`NX&=|#LuW79C2tiaYm&p8KXDV)KolLa^&B#8MrK9RhGgmPw%Qw~NqDWJ*O zQw5CW#t7A*d_Vk;0;occV}`#?{;>-|y1mC}mi4!ogUg5p2MG3pa05!f9EaB_FEb-qK;K&%t4pmMW=M(ZVHp+BD+e(zFoo#*X$s3&5p>B&L(eX=#F zoHm=5Dby5dA)` zddj6*jb@*cDapQgRR)xIKxaZ~HRD-3G!r6PCp6C3wXYxb%(HK!GDz#~(D;fuX|=a6 zCj8UDZS(fyIH@-757?nxMq}!_R!spGM;5-+)^3FKHpd;kt0#Y$WYdXTL>Rg zwyY|#FT;&7s~7G)r4aidhW_FS7})GZ%>Cr35}nym;#kZh1LJ4v;4!f-6{}WwD`2f|2$$7U7A)t6_xf*UU(3C~0A(GN$W zIKJCFS0IFY=rZJcmQ+PVRE80HxnFnCN(eYln&E-!@(|(**XdW-qKuhG6qJR=4_13! ztvpNEl=PEVf6U75*71D=R=E>`^!FuiP(CNc{cgTnsv6C+UBm9_AN>wOfc8QElQi@6 zGWPt!9GLy$tXDnJpB?cKk(rwq%7-Klvl-xiNz8Y}d;2~VSw7P077dq;OY@`hU*-X{ zUa5Di@%-@d8e!@`hRdBrP2s-aKR+jZZHQu3>^~L}752YNm2yK#)Xa5OxLW${nVFkU z4xQEn1R*KuIqp#VGM_Ea>XhS|@xf)$6@$dLm?o(KP?b!Vh#TkpSk!G`2J0>-Z8A7S zF}+66Xk*mK;*}gt=z1Hi<7T!Sy^^EK{>g({D6H!Ni}>hQ!QU=V9uO|fi?E1^Qhz9- z-$3g33!#k>cRyK^Iu?)u`yHTGSQrcT5H~8e&DTOk$0j*vjOauD7R(3XPhfsKz5? z6%8)JD!yh5(Tn!JFsRY>C;OCtURuKnbx9-VLugqhgSr9?8WU`gt!Ju6>u|w%?5dAo z?NHYg>kkJ~!asNXzI+~!r!p-lK4=-H;#&jnXH8KT*qf)z3lH;j}(Cn{rl;2bek8C2#skHFO7a3*H21=e}OzH zy)3@nvq3VFn%)xKTFoajs{y}u%Iu!>Y>08Aqe+`P{x2c&UwHKwBN70wux2I)9@AJ@ zVdSdICob_x>n`W45YxMr9(r#pxB*ups>~WPn&iQdf53o3TC6`U#rON0ckL76zDhz1 zr}4e!C)ic*?7l{oWgic!b3)A}@hY1WScfI=_?z+&JO%ex0&Ym7+IJ-WbzL@1^cv$E zgORE3-WRQv;bDW?q{3yPkogb@ATlCP;LVaG0W9z9;p$1$H>w~i>e5}erxV!y1fKO2 z`mn=eNE~~u+37$+)Bel>7s_z{t2frXqDorp0Jc*3@JM`*2*xA`xlOX`#(CX%$YT%M zh=%LHEGj?U!P8h^B3gtMx9WLq-)1Z51mmF;iv`jiwQtn_7Hk|AU6Wy>43dWAlDVNd~N7thG^t-LmaTU{9 zF53?nA8YT~k!NF~KqX4NlaPlkioh??tE%V~yoL)lJ07Flu%NT!zg48+&YdEWq)1Ey zL)B0?9x1g=mzLQK5$7Xb5ral;);bI6ezX-{Qkd_!&q+_)G|ZGX(XnW5#EOFX;ji{N za`?9nr%HG&jDmd5nm46o5})xCjxCZ@>Y} zz>P3yTg%qvQxO?r@+GT&&|NvPFSG=+nhN zTdr!^Rs}2Xt96c$CKf5b&xLtNXOJaH*6a-y)WbW(MP(&=kJ7>Zg`E}G)SbWds^XIZ zRLskmv+~cg`OC64#cIO|WucI{QMo8la%NZIOk#+(p!rm0uFU27Zx=fkAEc5#u6vIJ zmr?_yv>K<&1-Xu$=yHNvFQ)o*4>u~}hnDU## zg`ThMajM-wu6 zmKemWmB*d-w0rYovY*R>;p!B2A1gymB4=EEjZIc>SgsLXbV9EU(_|m%Y3Y@<9+;J3`Yj+DQ#ZI(@YxFafniKIjJgyg}rkBhmlgB>)UQY^9oTQ|Z`SAj-*GUoru% z;fdA-s)~YBlCX=!F1e!Co$O6pe(lc;h7EN@2u5^mcj(DXCyCl&l;?o3PTe35uLx=OX19F<+as^4ySE5)JH%ctMzQ z`{7D@wp(sZtN$YR)F3dqNfyEf9p&Oi(exAWbwVXMGDNLuBUuv$bft}G7C*v8A05we z2mTOESyDL-o$qUH%F~LQH;2kch=X|Ns8D_gvs(?xrc-6l)$xdvYk;>-wbH#~t48!A z8m4`k5W0hxh`=-wo3zHIpK3dmca${#m2nQ|;Oe zhz5-0`-fDoO}8N(lb+AD04OZ3BS>|Wt^cv58UlKCDj9i{>U56+alTT)+*zl?3>C9d1poZr zZLq$uwg^H#TMRyCRAXX`(}Y4~6eN1zU@i3S`@`kWpwwN23JZkh+gsm;n)o6b7R@AUsap_OynQq@_ zg~z+2iL;~3mL(Icoepb%EoegVl$pn+XcKA=R;J!2394&SAr!I>D%Xz2Xy&{Jvf%Zp zOzt(nwQp0GPjWywfG8ERh>Ev*NW7If@8Wg8KSym0aE<6-lNcY%OXsDFsif=xv50b> z*mSNueN^q+<-#r*;G>nrLpqE8U2ePZqw8!=N%&{1@1WJwknv$ASV2+;*2Gd4QA>6{ zJf$ScC@usgj11uB211TNB{$F=27K==hD*qCcMlNrtuQ;j1cL$D;=S61mb-zyvy>?= z8oNJ*tQaZ&KnX0<9AJ#?iWbh0_mTbndg5vP~^C&#m z!$+w5Ns^m7AJmyB_@bNrli(aEP>W{_q*UhKD~xt%uB9!$73R362L7*UDh>MN?9`y1 zBx=mpli&wSS~8A7FxIBg<;BHM`?U=bmG6PgkxP~NSw)MW^i0MGg-rvwuPU(K^X?@w ze`ajN1KDr4q276e_CTA2uH~wB0fK#Fb#6q}VeszUp&Ww2R6r;XzIc|^-Z{0!eg-ZM zs=fe!Z@b$30^F&l9|da#ZvBET1i#GUz8g-zaugjKU&!tdTxLkA5;PpCcxElup#^$p zsm*+-HP1Nhsv#ft#bCMMJrs@PyZZi+bkL&KpnVex9EwNOTaBi5_GWl2dLwZ&AtY%x zGjVNRP-ICzqc%wnqV)qR$#0@nZ{6hXSC$9l>hA%JO>Chm;%jk#tr)bqy zId!q)Qj*9Lxc5vxDzvS=qsm$d&95it5{B2;7+Iq}>?v+SsxYQKLfan9fZZOWEg(Ok z)Tdzd+rsUcc0yrRx{+|4d@T|&v@U9`ekqy+9KQ#dYf%o?c0gcl_hMl5reJf>#~oH(Hvq)b&laHF93dSG_;^n=mLwAjRZ4>n3!J@762H zSowozvdozD{IJH2bwiAA<_0h67?kr*GONXJL4_xq+-r+{ zraxXaql=~dC78^q+*a06X@GoZ_m;AJT@F+JoU9_!{@?%hm)xXs4&$#z<7d_B^)ZR! z7_YGOC3^I}Me#8wGrTuaZHH(^$CNhmu_pKzl<9w$#Fd+Wbf+#>o&5 zAmfUO_W_hJ?xY`(V6GPv4&*hUx!q&AcK+I(B^3=)nza%HSSAWe;7*qpNzoNpCOqL@ z^WGt(CcquNXF3DHpSz|OE_)Xyj|t$yrSD&)&jdHyhe|q1c8bZ52r=oRv^VTla&Y0B zgsB@@$)82#-&C;ti<_|?>X*x1J_gq0A`#p>=)FDrkkdE?&Nh> zR%-G&kJXDi4!@H5w{2VpUyPM;=7@Is0J(nx_<6`L~D4T zZo@sfH_7K(i|yWZO&shLDxcoD&!o)Q12FBvAOQEzdwy1;8=~3QV6YV5b;gWSYdE4r z1n-vKulVl$??iO$E5sAK^KYj9WuGZ>IM)ZFR+De{Qg(=?InzBaD_t`?67YJdmM7&9 z-3-Xz|4|L-|M&*r^6_0i3JL|5Y1YbdSbiqWe^ZM8MaVjTi<3ag7D|)4pvL1dhFG^= zsZoo~6+#xE+&+H<9)&iQUqK8OCN#7U!V`kSp5IKWImt{$l%l`2vzzvN`P6|YK*5U0 zP#^Wt2(ogTVF%dq8xT3BsXqL5s&U zEyavzjRqnmCpvZbh4Uo>u&tY14)Sh?@ZHg)V&Ko8;%ZJLCp4ltmVvh4;l#pXoE!a@ z#8km~qzyJ{o^|j*{P~>Kt-5mNhFR>bC?W3J6o?>l(TeVQcx?UBBs|eM<9(~Kmfk0W z&H&@82zSTia%u4_2kQXjcJ$sujKt4ly4MzBypA>+D6C*ZSeju?d@T9eG$uiIF3-}H);3lhG$-fLBHBO$ORF2V1@X6hYv-8DCDyl?dRAC*zX<&ZSoxeqkp^t zLHxHOO@nDJZPh{)6~a1k8BEUu$sKeKg#kOk(4XLo zZIX*0x0yWAX%AlpryRPz}wF?z_fu|@OPAn=g9KbKdJ&oV7x~A zraR8HAZs)*{1<~e1u2tYfY;4qUe3-O?{n-pM1c7xSM>z@(r0m^eLXQby@}^P!af+M zAu}qnd%W$I6NaUV+b=aP*Cnoh9k8``jYeq0`Tc9RH#Ua0`t2S+w>GSBD&VWAe-S|R zWlHD)@eVp#!yY9kTM_u6EaM%u^kCaX#mN$1PYl)Lugh>A1ThHlh)J)gofleNBT}Hg z>xzea^=`1)p>NkRTy1%w)c$rI!#jiR7wpr76nc_6KrI(U9(em_O@5dSLkh+VnFGfc zN06>VPg6$k@p=66cy>CWaq^jWX5ZnBoUqJ3Bm&L=>;Di>z~?W}a!cj*wA})f-mbLM z+bCb2opAuK3nhif5;4EEAc5T%5xtokf#3Lsv*R20mx0-=qaWwM$Dn0^%HD8 z5RMZR%TUsD*V;7EY->Rd)G_D92rAcL$vNVsLpSOM?hr8m(Jy zn0$JV0ajgG#qVM9%ILll)q9#4zUw?|(8(`0rYNdY`8ZzeDoZDrtK$yA>UfYwi9;8Ny}~>W-t!-rZ$3x z(k9;is2||!P8w$aO=Wlv@?G?pI{KA1JoV$&oA~)c^3Z|0&iOiZ{I5$9 zZv1p1K5OqXk7qh@JQV5fM$WxqQ2WM7ri-0NNrpQs{3vHSs|MnC$W5|IP{vgYblfNX zq~%=WSA8bK2ydo?vlVTQ?~CFE_txsJU{h^P9fR z(!WTd3PrTNs;)WJh{AKt=ri@Msa9^c#}&bnnd@hVV%~ zoSZOak_rXaep}N!P~N&aYXNzU`M=O>yJ$)MxvO>P@Mi@7QRUd;Rvj9nFT#vcCv<5% zBp2VBvwIBDPwc-{py%4$QoGotzxDNceg;3-0Rc5RXldQ3M2$f|!Q0 zJO3R$3aB59VWE{u#%4=q?r#hPHf$oy;dSH%&2u1-@(YCPoh|vGyEfA=Bsapn{eRjh2r;oj90+Uu~DS^Aek#a62%GPwkq=myXw zUT+xaRD&l*PKb(ZMp`~2#9-Y|10|)PcZGDd$V#aS5fKGQvn0EmMEf$zb6L95Y51rWC_ru%xl4uX072H3I<51d#TnIAJ!Mu8iV_=*X(jBaFZ{KLEfcblOr8I#o@~9ghH{|_P;)9qE0}Q>OL~);ZVp0Z`d7&oo3|bz6`K*)tZ`K za9A>$8vhF6(N*li#d)#ujebuhQr?c#o91A~N&kL!TmYNv+dO+&I)LAQ?G}Y2HWL$h zchhF<_IPz2$RMZR>8Yu^wia`ncHsV02>0Yhr4roiltP>&$MAyU{%;l|sh!Ux|MJAA z6<&2L35pY$i|AZ-fnel$(~%}^D@*H$=j*W!GY%su!Vx}1|MrQQ5!!S9Nh(DH=|P<@ zfr3kv1eq!2N)=qSaJ&8BO<|fkOD_J(?FTOxW(e#cKX{|&pFlLFF^93M%yo_{=^YST zm3fPmqr#A%4OzHF(Nz2t{8S-P{zUV2s|gU~Do?EAs0IYwNDj%fLY}jIrm1tgmLn6C zDBLO(UzZUZ46b>ONmXga-jrIG_7sK?yw+a4qS+!ao?P_tPj*6hJ`;jfKOk%biJYSA z1E7D3f1_hDOQw5sCn2d0y9U54BB&2!M_bpCiKFWO_VWjw!7-yk()eu8cs~CH7XeG` zFK}y$u7Ircg3=1CC#x5DU&t;0dcOXm*d+K-mlWg)KLikn)AhlM^#6^{AOcz%>FkbU zGkcTqit;8vU01#ytq)OZ1av*aVPpOsr2*vILcb`|G>ZGHBaqsS*#;y?Q}mXqXWBBB zylIKgDy{(Mg&|$==tZ|%`MkgIt&gHf6<`i+r8?hUJwSi(Cn{(UT1W5-ItD_qbxl@7 zlKA@TJ${;}|njHtd!dx^ z;K66Hejjp=AATPp(RbS#=NAGM$o(qRIZJdnxHU zK=NT8Ru`$N2JCC*)k8}~vaN56R)>6CCxvhrm3PlGafeO)RQ*uQjwVQwzX5r?t`e?> z>CYX;#^S7WKbndD(ck>bJezLGx`Spy9x#dGXa}4@_3n}2T$X^}K>9nUl5K5I2*sD7n z&y&Th*5hjv|5B!goo9&J$qA}=n`Q_HWUaB1{A6qCLLWEN6%rt&PWb!98sI8@vR6;H zZeK_}wbc-}Rt06nw2xcpUJ+@MiBfr#dn2XJwJSE~f5B6u-_hmCI zok%K0reQc^?kwY@rC0c2299A4gKMzovXL|s7w~fMQpM4K@E#e)%{D4x36x{xZG6hG z-QVV}Vr7Js?tZb_kHPld=wK78$Q$&skvALl(AYgru0rCtZCuUuO5h=QAuH3oVj&G%zbkrDX;??0k< z;2z1G;PK(1@a@z5URgao@3!$Z!449}=dY``qONFZVk=TnPz{*MpMeMyUTlU!+EF;( z8Y;6!o{o7M!#ERCQ6Snkm>KInW?#FrvQ(90at+?huvFD9F zcupi7Vqp&zP>%=h(=q$-u1vzVxF%s{2B_|M`rV`VX<(;tNVz(a8r$AiNdu|x&8vK> zgz-xSKRg%P_wZeLetd!Gia##2<62Km`12tgxma89`B=#%aMF9>RIcc`fpYB+V{3KcAMMP$_nJ&H&FAjYiqNCS%b04!5#PZZckZE2=yaoZj#Bg! zRajjTtExsQqrMjBtJCn^GsOGV=g+Q@ic%gh}rpi!erF;#?7MqqSe0 z#`?KMv>Jh`oRFxZU&j8&bj*Y&0Y(drpTk)5GG9Nh`n=%Vyv9Q<6Gq32`NPWy8sn7` z2GL!$w(888{C`#iX2!9*U2U8H^@KnjtY-zNp5?rf=@DjOH>n9nT8;9t%P-Rv%yC7T z`Ppo=`hGwY9TD$FO_9>>{BVd0b`5@gEtrF9OP#TZ?L>%_8`a_0d9(@vBLKwFB%uk$ z>m$sb3=SgBvsxw9x8`THpM(Ei%(nFkPDIe#(-J(G7^#o~3a-_cy_-ElQKzChvcFyW4bTdVbF`Y`D79O)rvRFvxvT zC%iO4t_OHSifc((AI+Moj7Beo%41*7{U!GM@+)7Nd1!e{`NNBLIEwBlIi0$l+DTir2=WImRmmU;~2hsFSw$Hy{%>4&%0ue3Ep28l? zKz`mrGcn9kJA={f!{M}X)a!IFeFF8M{zQ%pVOGcUp`)!aqu%rfC36<6fT4J=+qK*6 zflp!e$c}3$F8&_R_pa$VnbzZv*Rj=%^xfTxviD8cG1i4aWJ z3_l7!jMWgqx%Mu%(||F$>`DSA-B%|fm!N^5bt8kIQYQXMu}@jDXS43F!B*{FPsQbS zw8YFlhGI_N9N{9sZ5IReoaN`RBR>4jghAZGC$Vs@+A}Poq@lz6yrQ<#ROi zrRd+hk(o=e#t}fW610G$O2-l&vlj=(T{PQq&)DHZAE9WMX({q5CvX3mgQ0yNIBwxw zCF_5QRCtM5eet99lXxj^N1d3Do2F(3n1+Og>7QUDlBP|>0x1!|0W3UK3}30_zE~yf zyQF6-0hSrUR6${k6ApWM>o!ET#mbSMm>{amCp?O7)1EYb8_J8;pKfH9mvXwK&9`#+ zM=u3Bxpbq~v_SEj&lvg!y78V2=!-PnB1Blnm7l4RvumFZ&(}+Cejmu}RsW8`{8YBO zzWir2mX@)x3tYNCZ`v43DmaO=OC-_>ke(@iLls2*8kBnppnxXgiM2*mY1L)A2mdyR zVtqDUOFTFVllng85IS{}3i)<&FquF2bdeaB(vuZ`epIpYykmOsEopA02`n$f!?2h5 zUm~^jAY+}x(Ripol)m0%LIt<)M}=C_p-Ug^L)_x!63?P353AS zbPKqZy)nCI#x20^!)?dLFb-Yf+R3jQc_MyQCZ0w6^N5Cz!=5@HByhJNJnL{qlQY0} zDDZDg%u_Ap>Mtdn`b2I~S3Z3fR+q8}?7}c9spn(e3SuE|+`|GB8{#r5tA_5c`UNK# z#^0Te2j3qLVuba#k@Jzq)419P18MIF0n=|de%j^xZ!*FKSZ5lcV=z0te@Dn-LY+(opfwDabyTOHfU6Wcu5 zW1n~IU$DNcF~_WXR$X-jAchi8X*rp*ooK_{k5cS$eP_gch9iUSok{uEd;%N)oo`W9 zPeX=FAze`N1!CH8UiL8c{BZxjwMq(su2yy{3S5A1&||$-VIJuU;HI&sh`>Z{K+rLm z8Y+FnkT^wY9n7)dsX7@x6e0l&xB?I{qxjJDjdB63w}&7CB%nU$doJMV6bhyM1|wS$ zmud`)!c$SBt8wuRTySqlD0nfj?V5PG*t1lZTLD?D*NmUKqJ9#XB#($p@MET2b^h4pDECcQ9;!-Ob&$#I? zAZt+oz&@(|j({d%oQQ(C*cI_6?$5f}0`9#!;AhvNm`)#lDFwHOX|&ALJ~H1sijget zx5qoN1;$%Jd$vKwB(Tr$K;(|X9YAF$8qFhmn%DEI|Yap zLVG3fWZf=EnKiMeLvHrxQ1-T+FAHL~4Zm2YgC;>jwf=qQ{F%{ohDmQ`-&YKaV$$*X za4_Y;K@)o*L!n!d`*Fosgp+W&dY>ll@h`YXnVqTJ3+9cvx!+C!iThXY-);1d<>lUJ z1wZJvLiU|toc#f^WD-7Kv5~1cEdTL|l$r9Uj;j@d50nNqw{kDHt6$4aMnflj@!%D| zq-2HU{b66{uYaQVIK{^U3SN+?&r`ooVelXbL;-(Tmv7LB1UJNqfPUy$1peyMz@*xq za~)*{;N&VVg|#}bdbKL2?bdHHw&V{Y{QMN^iRT*spU~1kvfyLD_!@&sekbbEP>6^# zU^+uIKlYyrlx~gir6mGFWAHKRB;X+2n1_KDH@iDb>^Bbj!A-h=rdKPGkRr%5xO%X& zns@l$8q7YM+shg|uu%<6ai2cak;?ZZ3X_ID;ilmN_TRk^E>^zA*lcFCArZ47y9ZzK z@||>7Q`#-%UQd_mc-EiA`dWmG2^31Cv+tvx{Q8P_%Xe@C^kEn#UPQgfd${gHJ#v)Z z2Qu%Z6}F;6#hrab^b>=_Y}u;srG4A~PDs5#taK##v{7~;%8F|~6;_o7+^n?V5))=N z;u)lGP206utQkAAZH~ed0J`?dZ%Q!oi)6He8M8%J?~Ioyy+Z?#2!qb5|cS61NsEX5#&y zQ3=a}n5j>k`TU9G_BcaFmArZpVp*Uf;=Y4>t{*c{4W1^fVx3kUO`c|0AU;Ryq`7#9 z=#2&?OoBGnrFWHebi4MJ!nu-$4CG1UxHe%D#)?yK9wV4G)QDg3%2+w`S?i`fUv9f0 zqEba+L@A-uK4p}nTn)tY<%hJ4^aQnGqzZN095p$M?2D8c*bVr|xP~!@(Z~S8i`t_DzSPwY>-zTKUpZCBSm9D+IqJnutRJq+ z-qBjnPc&pcrimrne#1EVKPxAsh(6Yeqevop@De)hw!5or>v2_)(3n?IO&=)x_0iT< zJ}AYVVx35c3UAjx}^a|E%jM+G&0e-g6 z`1Y|9i(2>hFqI~YSI6v?l=!I zAf3*9758vw;S%^j#)RmGyi5{!69kcp1DgQQ_5pzx`ss!XrbE-Zy9W8`tNwDlZv{(z zrqF4;fe8<&qo3OvhHVYguVp5{@N)c9f1)G_D2ExmgUP7L+Iy0918n=gmB|Z0m@3`F2 z&q;mt$44Ref#OT+pht`b67Xp31$RKglBNL*1B2_5+e#Vs&PciYAcDy-yR}LzhrFG= zkzRWr53WvYZ?xJGHQ zrbvMozzCy%T&Ka*+R5{jcZ>skNM)-@q5yEiJ+{hJb$CGq@xt7b+%ro>rebF|CJZI@Lr4)UJY|8^&{!|m z(*fz!&v=DaQ7GiM!2x2;aQ7jTb&WLLFxxmNei=MKQwBmGopwfBEU$BM`p za_vWvHEkPYOK53VK^_sKJFphMF2;kHvC%j;C3j5P89)B}OiGWaPJl0AiFs7aj{N}O6`RxnejbOUkbU*kLY|}C%)pk$oA3-7er@}?%lWOC z;dn8ewG>Ueq*da`ZO>~V$X<)n-FgM;_M`0|a#%U}?(|s7FB?;WJ~PkmHm$}OfMpkb%v=8%dZQI>Q}hQkf`Uzychzkn-Iv&vh8Tey-;nkT*9$pnqivO2(~H( zbQPoo(mV3un~N^VYCn5Ou!z}o%yN5Rc3kai6*YvY#L5KpuQuB7TsR8BoHTtCoHVTj zC0i(BUD6HMdAqIR$F8>8m@^M*UJ4n=ZFQ%6>H-u#k(bRrKaAhJA48KloyAAZ9d>Rs@=qE`AE4o@)_obvods z)hZz;NxacjUjW^VfF~Qrbr;eEI*th5x~C2*`p(prL*wLq|~dcDNAPa@yuN9l|C~ z7*wEeiEosCH^wd?6U7aoN4xN}5~aegxTi8TFiSva6$EmN^n5;$2=~EZFjh0v|6>8{;Z)p{r>awU^xfp6MC@JP z!7Vuk)%Nz#**mgq-g0H5F7q^_&hwDe^lVX|9EUX*nO0&$oztLPjQ7{!wObU)a*ZIH zb}l*|qC19~(qT8EJ)&?gA-B5BMu;`x6}3GD6{OCRn3VTBQ%Pbi!--1S`rssJ@?!29fnKze9A6IT8YcR& zXAj~tGeECZp9rtjw?kmF86^TX3sm;S9l;&%UG@h>AB8I>%@B z2C_v_4^A}*Vyr^>*Lw|7IZ@9SNWzoC!{UHlh1E0SB2kG+nq<7FaJ+Pp*bJ{AmT3}^ zdxu5bdxqfa&9eTIw?_UqqMU!aXQCwMfirux%^dL;r&aQSbhdu5oXaMYTZyt;4$JJQP(Hc-8>&Z}lyu`s8fT>s@#X zy!@<75a^qrj&>XdVjYH~VJj^K8T(TdH`o_WuHhKKB^G(8`c2iDT$ftT58$vH*qCnk zv#We*U5C~y1ls+#CACvX1-UG25$2L>;fr8&v*w;ZiWY3_g{zeF3<*T=AB5TU#OGRC zXry=;K5EzN?#DOtnW~2O-N*%*z;(Lc3V~R|`b3he5;WD{AmZy9oodR-4IHzy{a+^B zM&sUM`FHV`8&7d2jVPSK*iYeGv3^|Ck*)ks+Vgi?#g$}kjKM5_RKLy zF-q}-IWWrr$G6ukWz*zAz0&1J4B|Cd>xhhN|FGr$0RP$vvm*)htzsITCDskZ`7*_r$f>snwY(SGN;L8STjZs;|rf_U)G2?W8)t}@T*>7 zFfeYGs7I{vXbUW1Y_RwQ^&e<{QFPx9p3^7>KZ|$9@$($)6<0@1&H9g9evzkUlAe97 zn`c?lJ}bP-JD_^|N_h(C(CizR% zdvH~Lysd;*%w?5GTg>Ejw1aCqbHx6Ar0qqP2**Su7L*Bt1V3^jpp;-Y7?^o^#uh+>WWLXyLZ} zkq!F8jM?iGLrf*QBexy2?s?AYI8Gy``&~zXYPw(=Ld)NAYylzIHGk4wo_Bu#7*Ntz z3txHuwlBKEtkzqS(BA3hr5l{@N^Iv4wp%VSL0(q@*H+61$ti;wwe4a|0zy04Ko}D6 zom@8NgA~ARdzPCF-~q*w^l`e-tY2wHe%%{CYrMs9vf3!TCL)BG7sLHAx!d3%fNtQd;|yB5kJU$(MWT)|Y$w*2Uw? z1DM|c@57O$Y*c5Y6{4SByiFZTY9>9>kaPR){eIgSEco^L-nGjJi$@EN;|GKUHWI99 z#zI*JU~y89Fv9a4nGbN- zaJu^Qe%_cz*{pQAKk&&J(CT1ddsSXT4(J`mw1u>Xv7dB&-2Zs;&mA~Dxl>=9;Jms~ z?@-z7@at)R+VO2_Lr5dzK8COMfVLk+z$KO<$T9uAX*;QiwD`1B<_ zgJYB`Ina8d7)|AtZRdWgX1A^=ng8cYt82eraSbx_$(0Sx1=87ipCCTZ)(1Pl~`Kx7y2reFi3SEp(+W>&B?EcPfq7YST zn}tBGDfa?G(7<0{A}RzJ;lmj zUJlLuwi)sW@b1@x$Y$xV)sUUPOz81$Ag1kT4xtMy+y$P&e4xT(!^eg4a9!Zs5ub93 z6$rFix%ikz$E-rsNc4Xuj^q?M5!$ktTM$&NQ&_$7@2a7%5x@(J3Ab%B(*;j^R@Kz+Q+53Dj%0I}g1+F*z}jPr*+t zb!{l}_33LQ8x5gQrC}S+V;{F2vG!vKj&Q0C#`?}Vx2gTm8V|zl1pZCYgQN-Z9Ws4c z^ETxJCC0)9Y{`N3yM8~Hroeb@f$w<7RteBO%1XAcZeHtMQ_C^jP zyNIvfXFd$Kq_i){i)uWh{_wr2x_Vu+pZfQoREdG~{az$%CkuYZIbvq4B2jer7U3ip z`OwLtK?P#DH~^a98nE4kE0m-qRAzI9_~xtM$}}KGxFpUrM#PMMeVjKt_vPY&3@hB+ zbUmYI?n)Rd_&12NQYX-Gu~s?{aqryJ4w{;vJ0=zn7T2$Eh6aQ@*A9!d|AuBsVtOoI zT^8Yj7+%}}$xjT%cQGfP3w%#%%x;yDBaLB(4y25|bY|Kk;WYs)lLTEN zw~{ivg2}qz&+NXbExX{#+_y)|H+vMzLs&$iZMNFNV-m$5h2IQeqq+tzUQmPA)j!k? znywLvk_@L}!@KZQ)DZ>ki;l>lcKuS2`?R9m$DZSt|Ggo`pASYTf%8`qbQ%>X)?-NS zESixiFN2@|n@`!Si2qp!3*D&Cnh59gU4L6QT6HpI19R0UetPHzlbcRlm#_0+yfOK3 z@=du}yfERLw-kdmU1CN<@ku(AAXo$Cn8oXdFO@%!#MEi zwUWf$uZDd+>5MZE#BYZJ1CAP93?(Zc?2a(2Ue>MMIo0puW<(?V()tcJLm(@f_^DNa zMhrA0$H+I_*fn*!r)Sr;=v+CjY3t+$q+5r?Tfe7D&v5l=zaXbP45_D@Pzb-;@ZXtr zy;%0A+C$wzSF#sKF7e@kZKKIU3Nv(2yK%z89TbP}0YyUcTbN(G>&Gtp$GPofzg+#k z0sycIby6ISiXkjg-*C3s;dUeHUEq0tJaYPW^`*w|_kbJt-BtKHf!I5bWVanFYyftQ zz0`Ak(G3_Z64ffp_wwv+Y4;+&e4JKQ3zxoh9mp5r_5`F;e|j}dXBoIK^~%&MhSk>v z@Vm$L=)Y6$ySaU=U7TtdrNp^xnWbzXg4_2T{&u(`c2~?-_&&2} zY<9T`(izV4`E;$O7o9(4SeX*A`+Mn z!AZ|FsL&}wG`B5O0g^cmI*?+d zG&V95v9t6@d{&FNvNxq*aj4rYuhcW+ckb6|ez3XJ4x%j}@dVfhoI-*8Qm)xZ7Kx}^ zGub_*dflEFo-QXD+p_<7dLT87xiotZg3-|B=o)dLuP0C@Zc9%recm8TeF;FIi2xH)}Q1|8`M)t2p=H z&aOIKkkNEqygmz#YpBisJHxyivl0IY&*pvoh?+-_?a-|H)Rv64(7`zT{m)LX2VRcr z_xl`yvBQLu`W+W_B`>>r143Nw9z=?DOf4)+(>B@$kg#WzmgFtLY;*<)nRHuyW z(cY?c7C6+xgnMdWvO7GlD+FRS4;>U(i@v0rGAt;J%F6Id07?h-pp=Y;Tasjf;wn11 zg4RR)`4-X8>I7OT7PnxK-U38*4|?^VStZY&VffzaHU1x{VAeo|F;6y7svy z#wMGUVQp(QVhV3jxRFvz95*v}ghv?V)^Y8@JglVW>icTrxBal5bg91NFPM2KIWO$; z;&3;@;G2}DEAV^up<;Ok+aGBa09T>p>(ZZtnx&$_`xDvd!JVt zxAB2}CE2}D-sBXG-VU58RzvV+n1Mp)XxWaQQ2Dtsu|nU5`Mt6(jju00ekV@ja`?&~ zXZInOCMursva)l%gpzZakA)*toXtHTRDJyCv5ojP*lS;YxtTVkgD_AGCj}BCcOd^M z^@Pvm{SDSEKrCIM-M21urtcE|&>Qaj!`ixOTmrRy4ErbNd@L_0t1+T0!TypVSi+O@ zl`cEaR*7iVFC;>~((ad|bxS9wsAl9$f`;37a>+1RpVHf2N(T&{QCfZPtvv5PTzxiP zs}?gxlKZRY7&bDxfNO8bE?FZ>2!DT&=cJGmh&|zE(Al4aaR62C)Z%bg+zY&{^5ryN z7Zjd*NzF;U>kdc*PCscqq<{{wZ~Uc$MoaLrd_OZ@)vgf_beTD@Fgb6WyWoAV2Nnlr znI#F_hj8RQpYM6E;gvD*hh7Ek%xOQ+LzglNyPq!Q@M14Y!*8&?5?g44N2;E%3U7bq zchlIiT_ac?iT`%Yxiu4*uTVQf&wyi#X~xl$;pwel0yOlc_<>kxp$culUCD&iRtmx0 z%BbN>KEXBbKJf@h%6Io=d}vez=$fw6J1D{eY>Px^XX)?EB5UPzLxq>mjx~lNHyKLk|6_nE&qoitHJ? z?pqLH(Nqw&%2_XoRxJHl33(PUt^id7dc-!R)56_Yn~w!$9Wd%0ekZe7mHu#s;z$Z;`F6J?1fJ*e2lo$J>4av8q9r!EY>C7VQcyCF zY5K}%r>SQRP4do95^f(KRW<^53mW#4`}Hu@_TJajC#>h!HU@OkE<16SpGSJJbr)xAFp36pv zr#eelJMo*fmPt7@g1GXxv}*?SM+o6B_W7=?l}JEcmn2_*{Mvb^zs;5LtE)+flDZus zr~Y6ygt>WcIjW}uA~=ntH&{Ehi14{m_Q;#K1S%V_ zI{tHe1=p69?(0U+PsOj`TI+&#uO~D%altYM-R{UhT2p{G-=yqYouw)RX^8Xe6QIOL zy%U6IPS-p}cu)PPhrk6i_}z-&qV>+w5D{B1Uvdd7JA7UWiZ~w&O2F}(;wKpt*!di%8xI2W3|qf!Pgs1F-RaC)C^QxVDz z&8aG!ftwjxHi>_abBvoa4hX|;Wj(D)hLNbOS9`jS#t30NRLupTH5SCNPronu2(Gr} zki)ZO-cF}Y>*FTQ4{^7{f5|N`G?32$u1Q^nQZ=w%Po}7_Q=ZLk`rCK20Eu(waXBc;d8kt$lw@{vL44F|1 zvQEaG+8D3sK|2Hqpm-3S@sGJ?9d=^4lq527#TP^hT`@@!>*RMNm_TL=+6ON=kwVof z9*_}qAUgT|;|<$0y`n3?uA|3621s)$YLJsjqm?Jrg)2KA7y2*AG#(7}Zpz^{_f(rc zHx^CY)&}wn<$Pl|eITX+sy4*Kk>NJ5L`-kdX|?3)(I#QGiw5-f*e>%F&rddJ7#DI* zNBFl;;vCmnL9S9GhqO5>2dnEscaP$yh-E2*h{@-W(~C?y>89Rzs#}^GVlV39^eogIB+~5dwfK;j6kg+3FON3Hnf(u>3-HdXFWytCcYkgJGh;KLVs3#`k(^l=yW!h( z5Y!WQrd5m9YHR3h5Em@gi2+7CLLGlao^ObWArdA?=K3la8;A)aa(#ddlW=a8#$hV$ zB5v-!c_1cr;2@THmVgQEXTgZ#Kl_jBb|;|iikE6{OEmG^f$iPuwhIQYh4Whify*q; z4#nt){HMn6*4EkGVRL1k&GX@c`6I>s3Pso3>ftM6BFkWdH$}hCu+#CPhtmqiFT(XT zP9h(DdgB@m8@(4nkWrXxbaOB0)B-SjXknUS22aa%P%04BJ}3#E78#frJ-+SAN09u9 z6(ki}$8s2`-gL?dPtQxj-+11V#%gC+yC-#^rnfE~J#28qSRR~=*#a?d6kFS7_>pcG z!}O43q}Qm0jE&7@T7`EwTZ(^?a}K8g^Jd~!Z>yN1O3-nPbyeaZ-B1|_$h|OxK1-JwC^@(>CM<+*}CRjfz5{grp=S*Xv2F#elP}*7uDBLO2t!NsoFTt z`_6i6?$0Dia=maVJ1wR?JL~R|{%(((Vh{&?n%?mpW-l#PAGdGTDkXPZ7k9Vb({N2& z)W2q~wt#a)<|^ZEok7x(W-}ZE!+rnI3E5C>b5y;)X!69E;6k z;f~_Q&Y*jVpv)?54J5UkaOh0T8>SYL@jO${PvfA1uqNe$Yi2c z?EZ0^LPHr_cg$Qd$PT^|rr%mIvPd3W+CG_yaMrYba*GAK$v%2NBFb>{U?HcRXj1}q zT`{eRd~_=gUuOR|4088-Gwl5x_^wO$JscwN@U1-4%>a}gRtlqafiMkCO|pwm+kQk& z>BzHz@>!NtVyYQT=jVa?h{&Io`NB3UE7gn!m{GajxuAidTa5)3ECBZb&|Xeh_a+ry zQ!|xwI+gH{{1C1dXm{f`PFO@5b7UC!zi_*uBku;wck#?!{=H4=v91RFC&=FBg8X6q?xuFg8FtFLCc6O&M5y*zb{oyzuRTOvP_#C0M zV-Iy+O8E88Do8_)_6BFBKL%rot@|;qX@;4z8!$XlUq}DMecqDm9Gfh0RS$!P?u)cW z)yozl5p4ymFa`~nJ&w3l`Hi_^`n$z2Mym78kS?`JW=BZwyDVymdB*79Uh`Z<>Mz*{ z+?%{m2pUg~Fur6?=iOM8Fm_)!U%a7yR@YFT!3d_gbx(2wX)Ry{;8nakqnINF(?w=A zmr<`O-(@s*BW4aiE1wykthT&3>TXk-QD7z-c=UppPM*N&w<@gPbbi~~>^s|P9nk;# zv{4UEI{A(?dcVqj7`7_(z8Q9w#Ev7Sg2Bps{6!q`;#K3#my9D+-S&MVXja1F=Cg_E z%bAV>+4xJ{Q8&9He(&xtWabBipqw+NwG1S7(5z~uK>u;kHx{)eiy%0yDndHQO8E~F zAeDlAe{M+Rg0)^NKHG6K#kolNKTa~c4Y5&oy!hV8CW6*408d>qf(9%J%l(0pTz5|d zSdv&xmDD#WF47^R+j-cuQ2C6R3V|>J#9LX3AK%#1*CvvGBLpA%9J%>|1uEK71_< zBW!&`Cx{n=gK#m7=gNI7z1KqnH97lWl!Dj-IKCEGYO^}HP&foZ%GO?#$y~yk>Edh4 z#{K%*n*UaIzHdnybXUgD?P#)hQNL5ElfCn$a8I%b{)sRIhBX#s6I2XB6ZUCCEZyoN zAI_NBl-StvBg(%K)sl2Qyo)bzHsBC{VIU?AcUfyI@VFx3k4Is!jO*kmXCKBy1!7uvk zI{NzIX*TI@S2uB>;nG&vw0AGnRvr#go3L-$SCLa;*lr`Zv$%L{2V3$8 zonA<*Zj& zp_!X>gJSHaZrUSg9=BrHPXU5w0Cda&{hIq8{{5+F>{#gJ^=q*aG>8%_rQOf_g1^*J z48Goa-kl!M);Bqs*LO$^(qW+!5h^{cGR70Yy$#_ocNRn&>Lk+wo2a3L&T}bF0Qs2q zL|(;c$=kZSM4%i`vz;4~LCS!(&U&4glw}b(4FCo=*arGBA=!>kz=f`OKcVN->eZ)G zl})V=p|DdkQa}yVpPvk-FbpBau;NZ6{=p?WIMoUenYZRh?a2iyqve<_u6huq$rUgV z6L%$$HFN^XLI{4K&IuAAcGm>cgT%S zs%M&pH~DrtBxH3KSC+yR|JsKPt!S@Vtvyi&SQL5J2N<1Jw-kUR@)sM5$$BCRui4Y$ z$T?RFcACB~D(+P{uzr?x!AFptPg(9O;hA^5_wno(WtwhCBTB8j;`?jjVWQ{!V14K0 zM)k8~RcnW$!5wSss&M$BkY5V}$wnY9jc$RNrBuN)FhWaYmt7DCk_Z>Uxtzj&WlkPw zV>xMdgYt-};;EM5EO`l`zs|1-%SjY<{Ia}!5IbRd_PlBu9^V?`ZsL>eJ7=JQT5CsV zD*uMgzokO%zR>@S1sg>2dMf`hN+HpAtfvDd{rEua(vdc_GrFCI3FPRD>e{>&lxyrT z=|rufM5Z&gDf=mMK$JsTi-_6)66Ma77F^573l=kXE>)A;;@+aQYNoaj<1iZEFdV z0OuD;)O2E36*3c?tEefM5&yQqC}IzD7(P)2bYPCX3?Iht)!y2@H01sS1^6<1Tzky0 zEgC!*MB-52Ns<9(^#EVnN+E*=p%H@)l&~I;)NB72F>?m6Cz0GJCLX!5Aw)Wg8G{Q? z=oBc}*&(|ID*)mT}jI5hDkA&fpIyMZ}|>OMj*)@#Nf-UYkDBQ;&S=D_u3(aumJvaQCyY z)NW~(6G{rZZPODT<*SSE=ab%EZX^BLet%BAG5f;ME{g<-Y{VcOAxshxI;J)_p#kT8 zTVTCaIc{Qx;AkVJ+tS^rE98xDcqv!8w+_2F9?T{0@ftR{fav=&XJ~TDdL84MqR^F# z*=GF<3b#ME+(5VDZkycx`fB6XI?)PFI4j!#Ek<5<`ktK21xXIH_D9sRjluZ>!^wi< z0;sTEQK&3~{Tf$l)Q+v6P!cZ4Hk!!P0BtQTy7DKPNX%2Y9*|RDR2vv8RIOs^62AWN z+1iDni!8n7jjcg1kd2;Ch~JsqC%+0`_vc#A>rEf4Wjg~iS1>@Ip}cLIWUrem zRtCPc+kxHWd^?gLw>LCf{UH9cEae5UI7}`IW%nt&VJA)tgPnqPhcshfrW*V zO>f*6h_?Q=_Y2Wtir)YSBWM%w+B!PdE!tpX-hnJjI}=>(pwnKe480ba_7>jW93q!vJUSTN0+NJMlk<&2zi7(6bJnC zMHZzUIg>imMp>lPb;zk>JI>c)o51h$v;+k3e2{`HRN&B0rR&+f@F zFOYCsEJAZPg}ip{$j;ZxyIG!YRd-?}qz^q^F`*S7@Hq7B3d5S@QSd5V`9OS<(CbHGAcfFoQuq#92hi)pS) z8FPf*pW+`+WBKhR|LqCS;oSD9-#J~w>Y#SZSXNk(p^-3$(V8$gLBCIM9k3-j4dlM) zr~$&jqrBM;^QO{1Uh>X305*D3EBr>HtMizCWn_Fyi#c}$ZDS8D13zhY)Zs{~#u*xe z&z>ekuXP?6UfXO$ePC{cqsty9b4JI;ujd^SbCxD-ncdz!1Q*&R&6jcng zz1G}FZ>9b4!%1Lf`73;L-YNNGU!>G#^}(r4!r)A?j~W<~QcCgevY+Bk@$vqkx;xBh zn%r3PeGUF7T2^*#`|ZoV{DSHI1#FXZnlyrgN-~rYBPnx)0MfNrhMoA7cx2URQ@8kJ z#i`uVICy`uXQID2WuL!rdQd&gTf%QWWY9j;R#J6*cKdv4=uGnoCa<|ZoO4}UISPTu zI6U}k5DLRPWI%~8f|dO{;p>Bhws0$ldb%3Ie5qKr9dsp|+H~is5WyCX<8g(*!wnR1 z5AO|q!w8P3_P&x|*&1m63c^Yy-YE|~$jAM&(kwEJmbJc%BBB%!4aOdB(3@OL@)C#Q zt?;A{B4G&zD&zW8LFxBa{`$HOwOGaLR?gV{OmKu}`ztC+);SvSb%^_Yxu?A$S~d!S z;wVE$_S1u2@gd#_bc%X8|D46L z+7!ryTRiG}c~iypuM2?sV;5ufZnS^^#&8Zi_05E8Z)vEtztzP47RXG1u0sE>ip+kA z{=!4-fP3a%P7()LFo>ZMXdDz#R4iKJL4MFmuU64ia07PL+RCMRAwEb?ObqLwx5gs)RL&JoNweTY;D5>%aU%RzjOItd!T{$S;rG9Th`lDi#A|$EC6G8gzir2N? zuBgD?)DknN!PF`EU=ygq&+nnS3gb#LgcB_0XUwf~1oxMVD@+*=TAcMV2~4}J{1*oUJ)huPyXKwN8W?Fek#G0u%1;Z;{+s1^Piwx(^%V95xOdgC?%ugCk{>k9W49WIzYL9M{lUj_ugr5%1>wa!U)^p0*MTt zusZ5wft1(48`I-IanptH$oOO;u#Q=F6L zevC@xl2A@f@wGt;S_w`t+v;Z5;b)5A{gDZ^=TJ_->clz*i4qB?NX2DjP+$HBt;*|x zL~@EL!oi;RC-zPOIoQBW-7sZG_F{*cLk_8NHDqd&P_Rkc%YQ)J-81}SKC6l{FQC2C zp$peQM#!O4D`mJrzOuLB11qER?BaB2Y2MPqSuI^Dh$_bANXw?i@M>yX$o% z#z=cC;;|(}YKqGP7DIZ*A8*T$1p_*=rq2XL=-bnGQ4J|VSPV&P;kT3Bpi^!RyQ(1g zOOiGMmfI^4FQV*wWLrgai2>uCAN{8z8wD}7?h(zAOxUj?wAePmRayN0Z}E@NtwkFG zS0f|_4-&PZ`_Papd@fzvYW?7I zAYA(wK~1#SeGAsDJ-Wd?JYOk4>iL>vcETLIW1B_J_S@bU(h>aif%|;Mfv#iUm*J0( z2}atB^UKRRk;{%iPTvX3R4GxU?iIbPAFW*IVKYCQAJhhY8hfVlEaNP^X2MG_InXjf zel|HDx;FVg3TA;&?_zkQ%g!DQioTAmv+PIhtk$OQE`+Vy&mD+<(7I5~Jg^sxET@&p zsg=Yf6*kDyZRf0l*BFGN<@>A!+StkUG?j+duk*u+CQ8T`znkt)F+RuA;Q0%$SHX=aVgIscC{e2xx8Vn;aE*_ehf>g=wDdP@kLwk zEdQr~h|r+42IToeb5!3vgN*=|@#e1(!^9B<8W(8Bep#fK?25#p4|K2&{!j!~pF(K% zgtm{zyPW<%&(B$wHFlBrN98AtETRpkxi=_&pG579r1>Y+O$N>W!dF@qPlThX29E@l z)GB7O+P>c*cKFlmfQ16vph=H810i^sitEG?c9%|K5o+N5+d3&~N^e{#*E{^NhL@1C zgUV$PsR+SUiF?%ZNW!mE4IyO%WmL`0&*11!2TK#H+!lY5oRQgIC)nA{s9Q;Xpx4|` zt)aSP6|Gp4D~v@+g6>7r{tTyL@}w!cn5E$nH@U<{v2;)n^d=Vpb_*m zn*%-D@60`QBQJXH6uyZj1qHP#?BB>MBhCw)EOg8hi;v2eT{4I_K;PGye9htW5gR5F z)aLh?f*k4x1wNf)D^ONt(F}(f2EjXS9LzMyPZ!}P$z-r86MT{N-tG|Mm!IQV%oNJW z^~T-uN=GtpcQ|H|Nq!uXt49xl+E+3xIV(PORW}qtkBi;qe z;fllDK*LWYTTa1`EEP%K!t>CnTfo};wPpKz>>a}2*T(QFE0m^Wq+S>s7g zrZz$U*eqna_I$o_R}eX818uOE3tz+r{gJ| z*N6VAZmE_9p-F0e?Z;8Y9(m{)UWHaWF;fxOzhTHPpu-!BV~l zr(*w@qJXM$0+m*`+$iL_W7zsb0-uYR@E!w_Ajyuj#3XoQ?G+}hY4g*(gn*^8*k1}k zJNS?(b`RaQzC3F7DO?!c0fk!zj9b}G-ni7KdZ`Mx`;SC?Ut&5u6rJ*5p6j4Prkdyr zHlc_64l*HwffXI5a3LJwC5iX;pzrGGX+65+>d|7@Z&@`bjkUrPGv3jb>Z6?MBM;gE zP{RA$4s?^1wRgycNu~XE=%d3DP_~dxUS3|qSmE7Ej^8-0uBAOT>Ygt|SN>j{hZb-= znbBog7hKQcDg533hrh>Ze+# z0z~@+K#mNg*xU+tvOTkER{7^QCCT>J0c0ZsLDdC(+|d7jPHzB`+NdP_FDuk zFBHJHV#7l(%CZ`M<6FXKhOE{jQt_<7)~vJtdzcZ71A9otFphYNr8dRCtBYoimW`F< z8#x|uKOpJYv$&aHdG<(qnZO(;C#-Y@bPEUKjbT)#SFL!SDu{vC!Rijsfw}J?^X)Q} za5VrrkNdw!G~~2fjl@Fuvx)NTQ^W!$L{9*d*v}AJnY@*{ZPV_NEQqb+9y1_Z`k5t< zInGg6&P$?l?8I4(BYRXQVffY+&2`3=e8_zi+P(h<8Qt5V)z47Y=>{m0E$wqW*bpJP zzT9n6yzPLq-F9Y)hv|O*kEwHTk2`Lgeb`uyt;V*^CXH>|-q>j4#?JBk;G5*2wOT26JW4`K$U}le@S6 zbIqwkR+P@kL;b00ef{2?BWqXvljT8+atVulzehHyfRAB1o8r%L7t=%<-8QcxuZO#z z1aFl-J%q!>ERA<5IiuW@F7uJr1keqKMaip_wZE6waC3b620DI^Dr`Q#Cg6Vilry+h z_Z;K2z~DK=%h$C~jANk-wrWqeqBu=hDf)zdS%m{IO^=lcB&Ld7Dk`zI)ZzRchGdLhyfysmcIG7K(X&Ffv7LHP~CGEY=p z<7r*@?QYAU5>579-DY)W}e*9+@eo>%FTV7vCZ zp*PmOSmJPZz;uE~9%Y?E-uqxZsAItr^A_n87SNCfof>k9%-Lztpuo|y-S`F>a-8Gq zT=KF`{5ejlX+3hVm;z~e%`7lD)pRlncCHrZwSUrZLUgH#Z%(8g4@r41fl9Z0PQIsh z8#t5640PC@V7$j$t`?h3w9{{|469B@3fd10G6Y3Dhb}%cf~9-Z<-S1CBlVy^mx&k= zaO5mZ)@C6MTg3J;0n>b75=g^Ja{pdR>mw*q^9jeW_h)>#En8;5LFlYtG8c7MhChT( zw)W>agZ&VRt5{v!M*Xz2W%CAr3Z!DWnPU>HY=pN1p%0AwKK9b~=B$qq=CShZ_p%be zJEd0FFxcq5GZuO#vFyeNz^Kq|pH1SWT=o#Wf@B#A!`ED*sz_!Zh3UAzKy%kC988Sa~z3uby!;vQ{cGM zv=%7Znq>;&)s`NG4Knq}*9GjhB+OjP;@^h9_M1dR_Kg!PQKP8h0gg|SkZxq`)^K2Y zVh#kLGkCLG6UJR>=GCTkRA|k&xs)Nfpayr$M!^eSBHK$Nrzd$OI!qx)stmTOaZL8% zz}JS{2A$sLs4o3BHmMH}DSYY5KzALC8zEI-&iaL@}2OTz~Y$xZ}MLF0~j(E7S z&WNId)Ug9TfYviMX(jrVen`{u!uGl&iF&5Y3>>1*zuQRgoL49!nk(f9PBXsQrN_=* z{c*pBUUy&cs8#o~Qi$B?-!o<)HV9MHQqp0i+}03grCWqorfhOY-@s{@2`S1;u@HV0 z^*8}UIV3|3AhyO(-tX3cTz3a=Huj%QXb&+fL3Pq^L}m}`oKTK4oHd}%^h8Bu!|+Y9 zIX5)$bPDV?P--l;InA3AO0qf(!(xYaBkFuQKT8;Y5l^%poxtTQ~bWZxhY;lTqInnGQ z%!*Y37tn{0c|M>BEYun1%9l8=UB{4LdZ&KMU*l`S1KmF~2t9xShPbX3r*X(<$zdf) zWadQ|)NDJzOc&(|eXya7(7+ zPIN%T-{UH+3l3cM4qL`^-!>N2kLW9S2f)|u(_!2vJ;%(OCgC5{M+yUMUOg=p0m3Ok zD$r-0*2mcWfKS;ht*asl&NRZuXYMf&lQOnJ@g{}P@qJ0w+O(u3_Tx(Z1nQZf-y1jZ zqN+Y22>dN^$VxrGIOlD=#G=5}S=203hk8$qjt3}rgj)>jQQ|$d1GGFoL0OR>R_~8r z{nV^gGSJ3;Bk$r&ovnE%K-;{@@zGG7;l1|DA~^QRp*UkmxXZ@mT3WU~3F6wgm48O> zvJLerW{dH2Dtb3fkJ@izg3w$B>`t-3CGKiaAzKDid|>w1gZ@lDbR-_;{{Ji7shE;t*@r{l*D{j1DBf?YJ}z;rj9 zI3;>ua7BMWhgFSs?|6z62ND+dSP=C{%aT!Qh-hvFYRVm>A5re`c8^2ra-I}_s1Pkj z^VmOFry|k=FtRQZ!Q+3)v|kNmMb3yQR-sdeW=)o|D~DAx%NM}sb#pgqpoO8HFH&ct zCiACmkj&fjAz)$PmO+22pgvBqx2SFUqTvaD>UGHqoI(Is;-TI`c}f3iiD#i#?@$lk zbgo_WN5;Si`_IU8{mi3w|K6sZ_Xe9K-6Oo~O$P3I!qs%-kXkh;jOvP$;J z1inrck$0SJt?jr14+T~M z2*z`Kq3XoL{c0BHYnJLFq_(kD!ed~B93Bft>r%_7MsflHQ>a2H5Gu+)FyZlFmSfeJ z8{rLcFG*o%b-{WECQ4$_ARI#Dl%sWR`L1Mpv@A_qtq6FHC06IG@{F?V-nbk#kgoFRHJ+*HDY0h9SP9{e3`w789e1ZS(}_n{V%h!GLm# zN4NQl-hF1;xAB=%Ux=5^lu}?RC?1&J&ozimpSSrGYVrg6FcdZR4N)q@!*22tUmpoBsC% z`Q<-pASc!x+P)C@rz_DMaF>w%h5U@(e`0b(d@Cq1@sCoXP6)tW7dgnA(P4 zKn}~rW6s8nxLuRF-rXks^_ zZ^d+A@@--_`gzYKIew!emNpAXvNj7H-Ub>v8J0=qv?%{!0SI1pFJX=wkwB>>c!7O} z#wfx2{HdC5_h7j4V#XzxCCDw|i6%1B`{Hx2U;4!kUf_v3HD=P_n1k^e7R@*Qtz_#e z6a^keIR z46LwJi+pmlD!!AZ`-yXvcc%U5gIu0Ha4mjZw+S13IIS15Lzmoe1BhRI{BOMYe=-9+ z$iSf#%2M3eJG$NJpPTAuUX|NHDmK*|MBB$b@)emJH$I0ndDJP)FvrAgZDZH+x7LPI z?(N6@De$TMnRcTP&3s$ML*o^S?XVNNV=2O9j%+ar?FOr1Hcod0qQ96#KX=d}R%(A_ie6g}FGlGAI>aVPN z7(<~0HAclwL51(0{0z^W&p=k8-3PU6kZVf&L~)@_c*@z-jZL^Gu~R!)|9JcNF$r8? zLn@uPIEbaPG$T*Y>9StbpIvChrc9~>{owxgp= z$9(v%h|s*Gjed&bK@$Ul{%W}U3CW8vxf8j79tu}?jHY1<)|7!Xt zPUX{23QbVi*b%C9U4^8c3?6OGE2VrQQg4|LA2NNL5IiV-+6Fpb_3$B~kTB+!irmqiE)aOxN*au1 z(Zs^$U#nznJEaTYMPIDN>ZaPp^}F{cc<}W1^VJxu71H6NbyCZDA$Fy*BD^)okS@|f zELRfYboiLEjF%BH;5PwbMtLnHp|JrXYSEo_i%ik+#pVsobPUG&hUzZ#Uc*&yFf>rM z=x#hE*>uPv@?}E>SHz(xED(*zE|v_P;K%X@gD3YGA81+$)*bW2`mabmk>80QIy{q| z17p;YPjW^hmjyl2XZ>NsrT$hAQ~^-iO%E%EIXnnyC-|I-#S;$6Z@fHedhMKiD|#+v zyRYv2xAS-t_pNQ$<<4hyb!cOy4I|OOkJyi*>E~)oZ{pEt&wZW{Qys49MI&#A>KWq` zi$3_AF<+wDpZ*Ik2Zxu@tN#_6N8FC-kUSfS*N3j$yU5wUaSn~+RW)}~DL&w;^lIZD zW5fjMH1xE3e?hvW5&JzUML=D6DlyQ(1{uR?ZEAu z;#KLfwopFju18jN8&oXFmOAx7&F|dta=*d;L0;PrP4UyJckGoTn(3dX{ZLL9(^tPZ z=iWzMFG}NvTH`&vxk%~Q8w8y+J0>@b4VuAhT*S0Jv|}u0E4O1l`1vvcYDU2Jf%A#H zxN%1NaX4ZnI?>VvuS@%}*6s-@@g3Q`=8*kbPSL#4PWGzJaB_AOe`?9&J6@7c){i3f zeNf?V!LW~R8NL!XAWn26W)2A;cDsyB$`_;tWs%0Y!Lc^foc+gp|`^p%J7}OFNur zA}A`$3f%yUIg@@y9&sN4K0)3r@CsI2KX1?HHHWl>b-kZoF3WCIWINcYM_!pgDKv=j;m~q32`7Qa2ATw=L854=YdfflKz}7*!y0Tib|{v^#L+ZpQpx>_W7L#tPuDOn=WIQv=79D=HpyL}uOEBB!p-_!V6+O(8l>iOn5a#r zhoiXngKtEZp4^6~ldk8}djBQZEtDy45k*R&BzD8_s==+pda3Ox1PM0e1GCok({E5~ zZ13P4@|K7S{-Rn*v9#^$ZkDzN)pw)U#0pV4Dvq*-^m7%G?>b;`v5#VUS4N_J5aWV) z4+ND5<V3AJLp8M>@4ntlTMX|m+b+LNUZ*=2I9V%1Jm&s$ zS;7v6niIoOAA#jLLaKP>* zw373xE>VW{gQZr+<|WCdY~S`*GzhmQx~8f|m}@Nd7u(^%19?lv^-t6%yy|`?rKw(O zi|3@Ln%2p~&+?}(bwJ*VO{gZik^AI8ce2~%emhJEWWNVXL-*@ zoX(e+pwIAQ@wGr zpfh(vi7f{$j6-NQKghznV^5FXPtzpII)M_6IS547XJ^4kcRA_o`4%>AsTRNutwMY^ zSbFn_L|Lh!*=GcpYV$ezzny}i2GN7=yuGJZXdPgz51aM$HkM02u9^Jv5P7|!(uHw) zF-&Qqu%4ECIt>WTBKS{4fUY~p+Pr)o$0-NE=p-=ux9d~VO1f~WFGF4FeK+ZJ;iRZy zVadQ>Z~gPa?|$dm+!8Hns4cZo6EOjY$gwFh_cE2igy^UiW>aWrtg)11frY3+$`?xv`@9`>tQ`E;cM!chesr_FNNd`2+X^Eq6^f@b0qLDYA zllH%8EjueYR!jehb0OqG>%XTy{vf52{ehxu1BD0@oy zJro9_LV%@z&z?9NF#=2~bkD_wt3UcJEzz$bE*X4+s?E}v>28mp0#105cKm_!D?XY0 zMCz0s$3=;y2ZY$oGlgU>y844a{$JCUn-Lw38#$mAzB^g?wnOh&(MS56&8Uq>a+6b? zjrgT}TqO{h92w!IfI|ybC)#G?8CQKU5AG1INGs?H{*xmwpUuF((Jkw;U@ctgvE)Az zR8R&v@p@=9#ffV0%c=WIF^KkfO5ifegv|0i5LE+et09U@pKuB}t%e)0pV>nYWg<9K zr`h3j{_PLurm8}AzIYw$p8=Qa{M7-e)CvSUvFvceL5h$T#;7)zUu$K51IWosBYawd z27HQZsijDne@HxU*RU@+?l8=!cLAi8r->dzUKKRN_%1M(!%+N(X|&J~&f{}BmExRS zlS%as68!sK$zSK}b!t@ZpP%fqlWS)O^{KktUzUDzujKMLh z{$l+d4@C}Q$tjbW7E3NqxMbCw;fj4UO-Qff9zv z>;Lm~@gst9-ikp+OKKG>tOAiE$qAxF=hv&!xq4W1y==c;qJa^GbZ9gI!{u;m)`Eau-6crT<6w0(PJHH>meh8 z1-+Q%56nFmnZC3LGMz3>Zf@<6T3A9q-`@`iqSrp!s{4I^E7o%(X7V2EXVda#AV#>b6x zebddKIg(0_TeG|I$+;-3f(2H!*#&V;aP$<4I&6Hrir?@R75UKJikDVpU9Mz66%NL` zeAqVKsB3g0brFWP-&Xse+Ke z(!6Pr$9cfFHZ{9o72;=O2VoDTujlBWvgi(+hu?wpnZk*gqRUdFTV^y- z*Gh}cE={W(SsUz&iCKsl@X5FM^GwkXc{S?orjR1!MeQ<9kKu!M%%o_Q$P56uz6N~H z(CwFBU(Tx{cQr3>f@!?O@Fi-X8_O^<6E6!<2)_M@e~9Bz&-%M07xNDWlJQM6yw+9NSoc2pB$$6z1xnFB)&HR;N9X#=e0V1o zbt}lJHgsc94LoguiNUPL%7b3WGy~S2?H}x%Hn-)8sL1P8rEP_Z$2r0D@w?H6%uU!4Yq zl#A*6UGZ+TA;4Ly4q`B|#!MQgK^A4H+;Nzb= zgTb2rPF9GzbahRO^$cbnXcebk!lr9pY3X(-6S|=8puLO8Th8~g7x^TaSGzf-oqAts z%);X~rY&|LK-!m`EwmA0s7|$|G_5=@6F<19Ea9fet5JJX^-aa7K()^p^caY=>KI_& zxL5z@v&V}(?jpR5S|Af0OCaR>!4N0PR3{rUZ}KIP`XRBA(S~_9LMRQ+i38tQqDAwE zk)p^6{vo1>@>Nc>+qnn>!*3q2xXSm(3?+96gTVE~W1)=(>%;I;!XwEaIVTkjPerhs zgVYirSUM7agfRedunGLWaqS*~Z^0RWdriZ*)$^8LZZ~)$mMj z#H{CnoJWQIGL1ZnW}OcbJ&?}&0T7S zicX%o^wC&4e}k=$8!owm*p#N3SknyI?=bXxKDth@&Vrm*(~cCRI7wlDdc2p-#C-2r zbA{MIIZ$&8>GUVajqJ-5xnqIV@q#s-w~P*Mn;wiL6o#!Q5^N@Rw@vOHhro-4tzT=d z7Psl1vQMn03W=nZ1|`v{Hi+Rdn#iKb&6tgIofYu3KJM^<@>Ai3yO%x2K5w*PJ+Z@J zy?K1jw}$)5m0`#98i0QmFTX?l`w0qPr+klO2pNQRhGqzsK=v*e4-85n0<{rznjbe! zYu;Zm@cEpU1T5(b@%i#8o@NA$#(C^JFBfD8LIzOCxh=zyI=COtw5agp{5{kq&nB2g z*`_p{*JiA#RL}AKfNpeKDi0^zM~VIQjb+=Uz)R}&+SFM99wt=P%F?@VG$P(BzWXDd+o`e*!ayDX>N!{vhB6}#mx#vh+^z|eGo^kSURJ9PmFV24Hn zpshcV6OVzv+d2ltj@C3qXm_-RZ0r7{p8g)gv}^OPLFB-BW$WvI;{eh;sGz3#jxe>r zU{eW0gpXzte8@i}nxE}^&Aqu~ShEuR*c$`EJNlU>Q-Ydeju zx~ERFnzWu@D1+xiN?;4!K3>xrSDvTFv;kk&Gxz%K7`G!45&Z}BW;=bX2d?^&4<=IJ ze$)>Df=0C$=36Fdk(-paLp~Z)mqZs%XUG#4I=VU0LDntHf%}$&-0gi<&J9DR?JfTd zsd!6>)prGnjErHZwSgyci?}n=Gq)1+a3j^Z%VDI*=| z*1U1GPN(V@p(iT`^(Q?Zo3nWjJQGey&9KF&=`G7ypaNGh*!F2Bal_EXLL*oC>iL#X z+^n9XkkiiFcl3TC=_H}e0~NKj|D7aB=<2~D%H08V*jORY~j%0t-4jbImjJG8aj@pdy${>lX@tSA{Co}AyjI_ z;ZXs3C%NTJ1lxLl7E5-$$fJKJC`h9rUJA0=h@@R{tITjd6dXLj9BYTUk?1-MzTtVL z6;?$|tV*}R5e0dcb2c%!-|{IBx(aDy;F`8w2W8^Ap<&;8_XZwjonc70y|EQ7V6%_K zHXQz2$uiaNg!tQmtT9fQ+nr2PAdE*~T(~oJ|E9@o-nUzYRMY8=YP`0=1^a&v8^5Cr z3K%KbbQiRLI{r1Jg?LV&c&WA%@MEJWY{4owEepd|oEy^TY;0mkxwIQ^;@9rbl|w6^ zGlOz?WkG{G`bGg!udF^&HS)Q>`4cE)8Ny%2m{0*6k!=gS#MOVoiM>9gpI!>lFKjzl zPioW-@bYXs2Z5mWtZnOe@gDL|-H%d9H}`6`I$Zug7>X@2yGg9Ga#$>Zj`1>9Qz2OY z_3AA|?{PXrM-&71_&5kgTHba4(^kbYqJ<$uZ-NKteJ`=}YpEQm`1~-sfdTfQi3Cc!h^z3z8`vf^7Tx-NOH&Y${Jajm{)q`cNBSd&nFjBJJOgsEY1P?Zm`BP( zC#>Uik45t%oHim1V@8teEkc9Ii)LA`)kFeUZiB^Mcv{Wi4~A+4GLhrtX9@<9!XVs6 zPbz^k1PyJF9oJ3qA==eotbN;pu%=lPfJj{Lyq9o$2dPP6Qo9y*&!EE`<@f!{GmA)d zCK&Hoh)7yP^8MSycc`$aJ2)cfDiw8b6GOMSS#uoiIS;{C zU$_0iiIa_vt^xOt23d`Ae9H`?>+A=BQ#v&_L__%iq0BcHW?3Q(0 zhOwK1q6Qy?{cyvnL|e6-(24@KBi06X(5nNH!2PjhdVSG|_AnXkm+=kCu?A0# zCMg04`0Jj-3f|Z$cIM6yCTbtIYwF93XM4JQ!tA?9U!*ogmg!S!&YLeG-!B8g=D-@; z&wfy9sy2!Eg6M6U9ByYSV<_?D51)}~7cp1~D%;Ne6-?*gPB@ghGUzBvLCLGKEmICtP=gkR{QB>oUfkLq-|MaIQ_a3=b)K zXhubNgrlqgxtZzhxoOVif=jTsT6m}P7OWZExEu5GNSnh{-`Ve{?rx`ECSTJuMwnFG z{QbR=+v#lC462t;4_k-F)MC&t_FVQZ^QEjV(VF_}&and>b}cY=`8441+kC{*4e8I> z577xW5G8-Tu=&p=y@+@I;(i;18K!flI(1s!?eM%cr=M@u+-WJS3(p94?I1(6T*WlJWNnYo71A3DBX$@}7vGz4S}e)k+?& z<1>=|5W9++jqgR~n<+0o-2({o#&g(Te2&>Gc zfkcM7449iKApMHE{@p?`Ap6uil`s}QD9Lc@EH=r%RVvIcl)U&lbEM=2uU$x>lUQ_xrB~yWw~&yrmRUF|!a~Q*vC)qDi74OA4=hzk(&Z7=?q(!J z0)m~D^2$awTt6 z-?eK(2?gsD`{bVagP`F3wU{wv@dvArMxLJT^G7&wg&b7-6x!WMO|)J^LRA5Jnix=F zeyfpiS^ljPDPbIpwtYN3v{PMIkfU>(=XEZ|L}i}49}R)ywau2CHQo>*UwpB^YlItt&ssYd#s5!abq78GRKjp;V&;qqByGsA5s~LI zvEWH0;wsE9BC)^5THm?@(0?(T`bEh{{oK|qvS3-N+H(5pj(MWOM|$_@Xi396tA)S@ z((NuQjmr*)wZy>kNbAIFm$^?WHc;yU-@QJX~cz+$fGAd}wSkYFd*7g_O^ z$MTBzj_8))Dc-X0Gbwk+s~`CA5O%Q_ox5NJmi`_!#?rq}8-TYv7Wj93azoK_^?vp{ zn%TFFl#0*@NnozHH6uE5-w*M44}~d+uM3^OLJ&mF59`6VfV1m=84w}fdCRY~t4*lDhyGtYL-4qF3A zEUm6#^QIX&z0kgsQr~!SuSkx0l;PEP2=Ge(V$b!HaRy5fCFAAbJ4Snu_l5;vPOd2F zw>USnmZyOS;9@uz>AUar*Zc6v^NBOn2|Sr@zPLX-z)W?4S=al4@Ut+IU$3}#r`EQH zBeuGrY>U+3od3G z288PeS+B!x--AHBcIZgweZJk?-FS+ZZN#Ld3y6Ja!XHnXsIglKoV(yw=#@WhHUb)U zr1^xm+BzGRt8@)2str2ivnzo9@_Kqi(A?ceVwN^{Fe3)%my-D8Frg*?z9Q7!3vY3o z>Bcy@Zi4qeM2hm8EdxFAr%FEN?`0gfyrl!Hf;%2Ifprzv?^TENrEwXT%c1C(0()X5 zo0f$umu+^`T zw5wnna6J*ltS*Y8&lNM7DXj~j1K+!6**`yv{SpH|u9X9PZKSv^>rb3uUYgtz|KB48 zcMXw(Ot-PqLaQq3{1-Yt=~YTIi@L&5?hvtdUPRT!dglegMbao@1ZI1HTq_8ea-8s|F@&dA zI@tvauduO_yvE2Dk=uYSEv+-Y=J8BI|M~gz)8HlX?x)c%=<((IVWp*9(8UEN0d=!r zsB2BcTQ)QdW5uSw)wiFWIoVU zJ3%>dXzbs)+(D#Ns9lGXL;4MMokX|BNygdy>*cb0-a9(-7Gb8!1 z@I*(wvlgz!(=~*kpc5Uk7WDllFHGh7ODmHQjHIsjA&W zQboIAA>0co)rgt@af1~CG{1+Z`9ALpKpDZBr*M{&+ge}HGE-cDO{@^n%}ZI<%B`mt z#yQ@952t0&D0pv}9$qhE1ATe))=7|UUU?Idl8n7ZW`;9P-V(6kex$yI>B+9k_^AM4 zX^&y`OTx3;PC#e$m0i#k_9`2JA+zbJ2XW7gAefv^g-M8p7<+W=S3qRd>kr|)(|x$m z8##pRO+=tbU|?_BtO}c^qSR?F0@xwEuVC2b>L(l36TI>}xl-r_mRhuF;r_8*kU)>A zdN`2MBGka|6;*f+V2ypXmwTA!PLq4LzO%Fwi%SEg5JSO`)|AiCfc-08@P{8vOrs^? z^u}W1(1guWd6EP+Ube=&8qnHG0|vIP1U)1ch;4^7#MY~CEwes7E)2QU_rzH%((YuH zH7A31Wc;bZh6v)5u^^NcC^$$=nSy_19u(#lYEb@-od7+~s%lwnQK=gRJE6zcuL2e) z)I{8}Pw5XX&Rnof=K?OKxYL3D_i%M}Ay()EN64-(bW7jJB=ORN0vCSV@=@zom}c_+ z&g?fgMTCyTtZb3U_+LZ8{uYy+#=<3!3gItL7QszL=0CHPei|NmYfOV)4LtOY6;u#BJ9`DhOpd}g~In}9TN%I1#R0$0#i#pq>HOW<^H z`|aA9-*vzTPj&xe?zcY@IF391Oa~8W2}ljCOS^7^wK`vMxn>%2gl1-$?dNa`eRv;$ z+xgDn^!P|+RIl7)zdU0W^Zgb{Ic%CU3}Kd6-kWLTp3>1FI`6LW2V6fi=kHhPxa@m_ z?I47w-yPl1*-d=hNcVF=3ms_dX9!mE-aV<;cd#0bmhS-|MB0jxsSp0 z=b#!8aIj)=iW}{Kz!-}Up4w}qw6&$&uS)Tu!e1hAenFl#dZ zYM|Nv7SVc1VzrY z)5}gyyA#278QK};r-P@<8X#bjS<`a7j-WG0AdJ{VWqb)ZO7xNO%5rHobamt|`@i$M zE^C=8%Q-FRDVJUI3#JWpZ}j}MAH<-B@opjZRz5F2=WnkWEvj{y4DAuF^|NJ~v^J0I8?YJ+uu1VB; zFlX1QeSFsrhfQh_;MmWlgK8&QrW9`Teq>xdl%v@CTRzJ&W}P!Ob@({)Q{&vc$>I(~ zG5PzHUgYUOg{}%x_*}d5xUV$$s2XaB+ldSrg`z8=sC#AWlKz;ljmLB>D|jXKp=|5? zI|S&9qi3YQSAug!*z7hqb2t1#TTH;oSw5D+q(KM7#3tc~){5@Y-43O4TmQp(+meJ} z4!t+QD%0=P{lFp&_MB#6=`!qcd)PIVk2IE*Bqt2pUYK&(-}6QjUTkIJk)ZaK$I}}@ z0%ab}GYv-eJ|)P5th-j)#&O*KA##oS%&JR*^8>JK6S1}z)?&el&|i?9Mq&AeAHav? zjj4sViolY~p|XPF1%0DJ2MQy(M@&2+eqr!CA&raXa~q|14ttc4Jfwb5LG^=oCo0@- zc$QQ<+NhgI8cb+ZMt)%G2iZ+Q%oZ?w!pMek3yW3(a@a9HFct|y*3_<|Gt-SIs3RHy2;EAAXop^gudt7 z9{iI0I(*<-Ir-nq_=X8GK^yhSGF5tUC zw0<9JDXqg6^#@!EOCF}LUeP(hBwYz%$==M1)0lZNT85`iK4`pGON&(KJiL@=AM!`KRb`x%%XG-{|ous9YoU&#( z{-Ij6ghj%I=}W3ue5{N>dJ3+QJrkxsUgtPA`FV}c(CzPyzC%ggYohN<@$*hwzJ~!2 z)aSDVHj<=`qzs0a`!tOnU7@bLVj%=|#u#*30ZhEo&~-07(-r%rwS#I*i7RB$oC>e@ zR$t(Uh=(6R8*mR!R0$K-?M-?NGj)tHX~X1*8yU5Fw7e}CXZ<3U_7*}ieMhn>4w5B} zpAdm8I%}A$v9A#n;Nl3=d=lMFV-FP)Awvc}A8pf}^rG0%zo>XyyiEVd9&4TtZ$75n zAsq23eHz3~d1uTkWn-687TKGbVP*g`Sh!;?EtaYch8%F`2sKd8^#42`O;NHlyQ;L~9o}N@>Kb%RC8e?b3voJkKq6 zZj$3(Z^Fd}H>WpjV=mncIi6xOYN-aDR2bpvAEig4#@cDi0)9IX0(DBdTVipexDDga z?@y#oE5jSD3#!eWDW-mE>{d13q#gV~A+=_Ds+ndIuX%#J%miNhojc?!uvkFVeCX$v z6%bzVyOO;AfbI~iSkTM#Q8Cf!d_tgMWp8ub|0+t;AgUkP0AfQaf8s88MqIRwEO>kB ztBJiP4>;XP?dv7~Yd`Tw_UD@nZ7#{~Jg>B|a$4+|pUhYhyUx_JlYLks3fcC^^$auC zsRGt(?fpM3$A}2yoQI){V(-i~AGFJ)5!zve&Nan?ig2EnRbl9X4Sp$j8wSZ7xEmAM z6hk;EW^5bI#|D_1-d#S|oQShB=8T{?D^kr!Cd?k#s5gvd<#4^1QQ%aPw8UPkA?CyGS0b9(sm#Y#(VOw4Ii|O8FW~YR))O(&|EP_}@T_*dXq}lM# z4-Q|Az&@bXj@W3t$28oz)`z#J9fH#pD`n}J3>yB6{iBf^?g&p>x0DfoY|YkBC9d z|7ni6LdU~CoHCb0*aabGfG3V}I;9X$937_1{p~bNaW#7T!`P_+j@MUX@N$lH+r;a3 ztP!An)D*h{JEqiKG+2#5VLfT{XPYJLo^Vhs%pPVr| zmXGC(el`M*HMB&UlJ*4CF88r>#zrb6O7irUnx+h9bFsS(Y$fL6BD;699`|f>gOazh z1W841at*d8Z3o!>f&poj`#F1`Q%Ga2?+{BQugXP7%+tnmYywqv_p7}MbHxbmGb4`_ z%vEImJ9JlW>|_xr9Ql=@$%!UPU9n2?F<_vC$USR8THmnlryW)#i$6!qi~XT;LBuFl zc2Wg}Po@0E>z{qKwak%-RwPu)DO-H~cXa}Xx2%Pa$?@{r|C0YuVjxMyji|4f*Ou@5 zd_)3kM0HuF8)2C10|*YVn~4nVw-pI`n(=!LuXU)inX%X=+YtI$R_es^PJu zaB`T$rjibxK|$k!ckN(cMbem0=4zR? zQ<;!-&oZZ23$L%|sPZZcwbEmIzWlq`Z3YjwH#zRDWr9ZJV{Rxd6DYh4g)iDJxvn#& zO}zYkUq#H(9+Y~uI*q2>gk~!NyJgP%9W!#Cws~8d4iKi_;t*pCJ`g@AO%ICBdXT~R zz$hwuL+mW?qHf|1dbKt7QD0To8y#88L^(E~G#m_JE;H4>7BZ9L{!>t~)_Mhkh?A|022NY!)vs6twoRo#7klY$AQWP?+|!nW`?q^A-;dRle(PF;oz6}5q+ z1fc$qi0I-}SLQAb_D_K*rjYLCc>&&TeO5e3gk{PlcYrQh`)WF%$(s=BJVnf~V9Z;!bjtd?jH)fK@CsWP`K|sGZYQ-Y@7Jn zE3Pf=>dCc$DO%+>P3`pN3gp=Sx*>H++<>q6QyHrLPfQCTqS{ax5FGx;6{K> zE~tr7ekw3b(pID_=TL@HOnq*l#$;9tCq zinoZUIuU*lyQNNAzqV zjbHu+`q<&7dBL^Aap*r9LfYdMXCPX}Lv#fOrdjGl3SeY-tPs1nvhvahxG^+I3A$Y# zthpnhKt+2zqFx4c_*2Z?Gu`e5JD^q*DJ=ZG8VuRk^XRJq+fE7mR61=eQ&|B&Kmuor zEZTZvCEj=}3M~gw(b-|(81AfEPxX#S+>XypI01iGIkTS3Y_0-8TkB6%u&EqVA^#Hn ze6e}HTI`s$JNliaMX)LN-#4}{2m+HaQ;ijZzmv3$|Q#G>3z?=A*J`)vbAVJW{9#Wt2X7f|j-ZumHSxfr^o ziBKJm07`pM7gnD`#nZf%WTZOpZ~oREN>X+=tEV_UbX8M2vTWNW27hZ(dWj@=Gd?YNG9&vgXOJ;)UYaG9;*mea%%B(5fFU`p-7ag zBwg)oe&6y@Px75O-E0VDkGWxrmT$`oWN!0i_@uwp!2boohMEN9R-wToRnU+*4M!0~ z$d8J|hc1mQ;aaTbC%hT+T&!5cIYlpLuk~gaYLe7~-(?W(@Nt4ggC4PdFyYau?WYu4 z`PkqSGloed_`3PQf=>80Pm%eB@7Q_-*TpsIszu1NcMHjLneO>|iqyv9G zXmRg`wU-_utfP(=&f%yKwyxi%Jj$0+n&K-OyZ$3-w?D9`1txCid10pZme0dHOBquH zLOjC+yH1fsUt6RhmQNd^(CQzWB3f7xah4kClRdYP?1aPxiy1}%A#tv`>yCMA!}LX+Bvv=yY~BTka}D{8_oTm#r*D?Ha6Etq2-u=-i%-& zxet2-H(7Z^*gP=tt{m$o3($DbC^C=@i6aMzFkdHGdeA<*5Cjf)#q3veq-p6iwnbXj zO1e|(9H-aTV-Hd_ejL-%VL*JHUEiAQ9g0~X>f!&V9^r-?4;t%=6V^;I?+v(0fn%kU z-;~hezL}8PHg!uTj&_Uc6wdF2G735S7``d=)7`{~D}>#ljK&fy2!e)$ZP%1UY2?g< zTLdZkyXNX(yq;z+6ltZCWq@QL?6GvQFnaMY|-@|I(G6aD1p`F>XD+aJ}pyx4G4((Rcoo%9`qKew^We z5{E;2*We3;R|lBS@;KYj7fB`f+)QK6FplC5s0~HvMi@Ii!P&yy4Ec z8!JK`=6Op1_LEel&*G0J-=(m{qgvrLq^-bW3=O7j|HrGVt0*fwH_Dds%I>zdra*DV zjK1V@J=s=SykP(zK0$W&BNwAyhxTTV4`r~?cZEFsfH$;jMA=Zwo4I7vo`JHN&P>wY1Is9*F|M z)10PHppPDuRr6sp@nvwZ@JlW%S_$)K^0>HFQAKeyrE|wKU~c8WU_#2P{`DU9hdXsZ zFF?%~hEv?T@Pk=czE$(*W12TMMcYEvz!n0m0FTZRCczvuGTr(Qp`4}-63 z0S$w#P6IyQ$AUE@bI{k#A(vy&25VR3==y{|TPjUah^|~437n(guOpKyC(ZtADXuDO zYPY?0|2obtsf7mNtv7wGwkahJlA@@rXv)y_F0Svm3-L{>uI&DQbkHGiLfLQRsL!?< ze1C4>kHTmFV2VjLYhBbw?JEjpFagt?W%Ved;qhMlT^WYX9M*^ed z^-gGOyJ0(Wf#q{1sc!}Yn7y-Nytf6I-h{oiE-v8sTkk5c)ci{^`vz)(cdi?Vts{is zhu^tFA3xQ7un~{e-HLcf`@4ECOFrq&S15C5#z?vnmr+`EUp63~Icqa4nDjHuE%ro% z+XZHlvIfz`0#W{W`Z0iT#W}bgKx>VqOyVN{zAQ5%X;QKtLn)ahW38Qr9O8z zjCPlb97A5V+f>VGvCO`e=_OJ=0#5sT3wv&e|MzF_$(2*qI8eUdD<`Hp%ky9$@SxIm z_PW)1A=X{stnZ7qi+OEe~*||{4 zmOlq_mgVOVdYmv*!CUr?#q*o&)*BgeaSfSfe=KkloliXNbe~G=AFkT3XMeWP)@Bf; zfkOS57JcNRK$jJLrL%Ba z^QrMbGwU8vBmKn@$&gqIreMLQ5$kKISDLmVECtvCAM10iu6||DcRb}8qu-~`gTP1J z*N;q1j*65+P#%zYY|2yU@Nu`QSokQh4V@Oj2{<=2!PR4qv zdA+?=f#@_@`xi{Yw9BMh@rXq7bb773=@u|~*GNw`clWU_pOrSVHZrO8ZWMM$66xRR z&7yzb-PB9^e)hCt8-$z+(!2XjD37j?Y>PL+kCx21{9g^%ck|BhfxpS&<9#+#iMwHg zyFv9PDMkQWfGXmFl81yR8FMr}0@?c^itlZ7s-^&`!(r$RK~y*M$c^R*W#c?~3-!OL z@}Y>zeN8xR?7!t_y)Cl4M)PfDM7aAfe|ih zWm?d0qf>8bVeK+kW1A^1G^alQ9uh+1#?gIKT{UZtZ}Wy2cfTDrnG!AFhSwLkl78zl zQlw@&AR4%S%dvYs{XP+K*?7NW$!)wlpHJ}*Z}rZB3gno%QZ~Nso-HHspN7aU{qFOd z>C`t_(;*}ervk=On_YN)yxAIPUA9@gwWj$UfnELh`C%6bJ{3%CuXu9jX@$yZ^FQU{-(4w7hEwdOKZt;y^Q%d&L+Y3P1L3@&IzPFPmMc~} zW8&QjFLgDx-(%1Rklj+Hx;{*uzwO$5hJ&vMe8QEp)jDfaO{5y(7cG}T-8P>4*=Gyu z-wk}-7-57`y_Cn?tXg3wzy@QpoYiB!4~}!Mfl9BoJUq^8z2m(125BDqwHAEI57)Kr z_*v!?)FXC6D8C<(Yq2b{_aIi7*O!-J^qL`^aRhwEyT5rLdI;7I14VtkxNKk|&s=c> z^?FD@{wxenU&WNV@vTzrzIJz*HLln>s|bpK{ColR8$g`a<3agCf71!%VRPNj9A*VK zpo-#oRx-EJhX=J$={fuY#`%?f{`<=9=74Xw7`u9F*sAnweu@=$E39W_>N8}YiWgBP zlOPj|j1ol<8YmIoqw*jUFG?7G|i`Amc#3DcQ8)) zk`MIRzRx~gECd|V#w%8jJKP3?#?hFl4J!e0cy$@PfZ9hHICuxD>_0_t1@U5F6q<|f ze%ME`qcKyeu~z@}QD`AUC;I3PL*Pxw;kp-ny(RqE1wLpP$T0d|l6UtKOKqzycnuf- zi8-Q5KR5UY4BX<7Or>pTy;$NRla@ejD}UrC`D?8*r8+v2Hr9g z|046s_1?R6e!U%)y}QBJ8*qKOGnG1KC@I0JGXWIxkUYQ;>Dj|{cHuU_MdkmZx7=Wp zqDQDbH6}fs_$6MOrc>FV5S~9UEL&K(P!8WHIuvyJtoC_wpbWM~Odu1(%=|A{w;iH9 zUnVYtgw@Qvwp3kP!CYQ|hPwB5F(H@K3yZNPGpYf?iUn<)6p!dNMLH)pFAWp zwS6e#f>H>$ohle~PC%d7ba-gaV?JS|x zm_yJ}%tZntWW($F@xLp*v3l1YkQX#QFPEGxy3&2G76fP@ub-?;B+f9(astB@7{*A($lDD-r(cBFOQ{^@BiGG#5 zhc2S3XWTb;pf%k(jJlw5}&cun-?D1)Kz1P_W7A(6nYDY#`2I zZE&lOE_T%7(S17`f>5vXT3H&1jca97E0e^ZxUit2?4LSD*2&4{e`Su z7G6!mc?6sIcf&x|nX}ErH@7`D7wV}(tyBWdNfYzfQamdlDa9`LMzBO_3<$*49~fv7 zXgx$X;c~D!k()7}+9>1qfRyfY*lV7!M9@E`B@JFkM`Mpv5V*W&nC`~4;DD88Hwe!6 zOCf%}#EJy(M3_DMlu`68M)LKIu>yb=8@ano;a_ohd==aEtQ;Jrq*LY#Ax|@$x75r&LvTmRY|dvy z$5267n}zu0_7>yaoAL6pmpF(KJV9tT82}I2sm-J~e&ZcdLb%&<*xy8`P@#5z0wkyB z33T*+_O7urAweUks6{rHf^A{GJ_P0%`tTbY$1)p#NcmKDKG(&-hofRCpB0`3;XMeA zUa_f++E2UsCy*5T;W!xYHidyYaXc-MSYM|q8E;H8m?uTH`u`x-A6g$jvQ&QjEXi75 zMuG(A(wJPs*NJ8(P3~yQAx9|}h8Ei@0%c&PHs1{&genCzn#-5Mz>L(?Le~KLJL_wr zFot>YQwa3Z{3Is}8rRnlIadgCUll2QtW!2!00x)!Rrfj398ma4=tG}}QVLGQ_J=dtGUcKk2r-#=*^gdTlpG@8Fuj|GbQJT2; z>TM6Kkz@gT5Pu5%;*WYb+5_GO4B%0jZuRTgRG$|{rdTA+li#FPp7`+2e=h&ub-hCz z+!tyQV47_&d@C#hMqXxa=zDzHlE#;JmVRymFuMAOH`uzx-1+=&&El9Na{%R|oZtAz zmYKuYbE0d~D0^$-1$m+h*|(SNuL!%LJiS8zhR*zt6>Ahg|BvT9@xlNr{vaLD+z-eE zp)!SLgYCFq8u#ILufohYU4(Py1rnldR_S!IZoDWRvb3Hj;gg;b-kP%}xyuoHaGwOB z-<1OSy*g{sp+K!thg)8g+-ns|d8{PN6zKB;6`O1c_;JEhKRp1-LNftgxoV}`Abs`nD&={a_h+Et@Ied@W+L@Ys+|6!^m zBCz?YBA~8+$RGWi&Njr$4xfZ>f9e7b0}4{C$=&mrC#~oxci~iSX77&&)$V1Wmg_`% z)MnO6WSxEiWCgZpeATHjS1;Bura`n5&@z|bf$ZZT?kl`p5-Z79Z(-iLbD0=_kIngA zHF>JYJDJgnQ1lMV7X;O!SEs`>;bvav6L&4ZPAc$uVAT!a_q6@VaavsKs|9Ee1F$IY z8Bv0VreL0dj)^s8W2X%$Q`%y-MZ{S@qEg0|V)B3DpRN>A0)}b-UAXPskXn|p6_2=N z&nj`RRlwfcZ%|$n;dm@i%J$&w9NLL`(eSOj>DPS4kI>y>@nDT0nw-t=k1oI$HPpNss&Sb*@*z_XU{4Tv|!bXtG z{|4fa6U;21tsd&2&|xa?X?h!1PO=B1P0p^lfI21K+&LP<)GQs)gp@BVJ zllH7w8%8w!kCNZ5XfOjkecC4L}o&lG%?+S==>u zfgf?zmT8c&gkNX$^MqHcr+O#|f-I8u^N85@>>of^L=^>h#c!Er%W)2vaI*UYchj)i z<05Vyo_9c*Z6!i(mgPF!l)~dTt1%?7;5=v;!WCufh%W&gil;>7dW)R?QEfs#VxFEF zMquefIT%k&U{sj^Z1p1~T-wPfW%&Bv(f)|OHy#d|Dg0CD05wBe4u>(7mw>u@lY$Gi zPLJid{$PK$iq_g@rtRBvONR1(NqkDq5) zWGTk`qM10dt5j#Dv};&nJ}GVTs?M-BA1l%_$4}VX6A0kVtqAd8tK$`Bakk!F(6ep! zL7Q239E@DSZsW~XE`WkF9HnOHF%MB0&M9xW!9OAWQ8ZC4SRD*6RkGNbfd01&l~Ta$ zI}lOk&VYti{fCUrUY*cTD9R`pJiqo$g3cmG1)9q~Zl_OXDVJtD(Fl8pitpExALGZp z!N(FX1+zCp-|JEh{~<%(d?pLo78@g>1lTQ!Cc~*;< z+u^m{St|;F>!d8eQljH_>DXS@ojPn-!1~mf@7W}+B-anZG)6ok-K5mlzlVlAm0s`s z3N&$jpIM(zym^ccKWrU-5~Yz!5m|b~0b_%(`iAZ+K}bxV(x}7mdUdWJM_JXdhR-#H zv@mM$G%T4%!@PSbhQ3s0c+)TJmlMUT$j@0O1jQMnZe8gnXfUs27Lb$8XvM!D9MRIz z4rw-|`>!+E?qcA&E^b}C?4+-Xp}xBtHv7!);2k%88rpM~ozIjzcO3^so~rD>BA4x5 zdvU0f{rxx&Z#T}5vjy|k7+Yja{#_<@vM~aVBy^qr@Z0ZbCS?&EKm5b4Z$w6!p%)z|ALj$rH;T~qF={NB^!GRx?~md4(0&=Zp80;SoxbGI zqCA`*RAR#&*RDvyKBK|Ow zGZlKToSE$En1HrLzO*$c=0uJmEUyMQuBr1jIGh}i5gNTJQTm1dlJfx2@nF9+tBA0L+RIGN5 z8eMcJ4bSpo6UM+Lb^Jt9~;nceN|Hqq_I69<%1v(c3~@178nyXp-$=nxd^roen2tT8`xM%%-p zKC%Jn$GTppIRJZS;%jIdy{{A2r@dcLUy5zNNj^4aKda_5bPpuON%zhgx>V0!0>y23 znThx0EvL$}Dx_a$6z~)bJa1(?c;8YjV+K-WvE_{zJ+5J`fuLSb>R&DA$NQ!$X`Rt5 zBR>OZT>N1ogT~$!cSau?D zCnQ<9=&r!fWC`VyEW*0ZvLzTjY}&YTASFB* z8XuQJZTe0su3^AAQHj;zf$4;9b;o3wn1uGnVDnUMgBD8q%kZ1u=e4Q&a*OXNhs+~& zc-`>h=sc=mrbh|o!J%syE1y4)Ub&YKoL}^kkSR~LsNYMy;@3Zp*eL8vnj0#SzH|Az z_HN~FfqZMo>o@RY?o=O0P$Yl3Lu@5nVWb9J6qU#qT;9d_2?$qLA$dvMKsci^V>jnA zR%aNL(F*0ll-OK%IzGqudDcRcv*WpWuU+8|W~V{mNkInak=z21qh5dx5_^i^Z~+C? z-CG&6L27my5E%cr=$YMl!$%dRC&nm6Vhlb)H&%y`*O@8X`y%-+=^%UPQ@6D|o<>q3 zgoJN>RfSwJG*%mWOth|&5V7Q7aSR3(OYe>i(`)l~P>M()8jUa4-PFLx)Ash~7thRN zer%f2Dk5Y_Y~GnrX7U#N`-{Nivgw{MiX@H ztn`)1I5^vY!aVt5-!8E?qi&V01s;~Usl$hSqVSjJHT7#`oI2vpkSIr;)~mt^Pv2-? z{F{ZHGM~Y>i(}mg)-Dl50gYlO3f5%~OT}MKPalK@{mLS2KNY74H_?*-nLi!S234|m zDGgX2wbQvVty;S!Ux-{!iU^7G93#17JbB-B0!~%pVE$P&N;l!aS)_GkT2;m}1X)vkR)n{kSu0aw^tn(=olxnu zvln`vLV$jsOtl4_gNkc{7lxE>JC8TDDqWzzZ`bWPX4p_?n!>#dGUQDEL2h{H&Y z-Aannsrj|ehA*gf>;I2~MkGN+h}WD-*1QB=dkCM@;VdOI-={Rfj55ONMHaD_#YMRu zyiy(+p}Y-5Qk*60Lbliw{Ld*NVHT9?`trq9F{aiZh_FE{tklkh#v+~KAr-8(FAuct z*r7@scj18NKQVC&DHBSV746z|<(42da}vq9FkS3#h+y;dj?-8Y@^Me<%_ohHrLr zJJwCG$bTXS!T1fq!t4cIz>@em4JAk81DAE|qy}!KJ6tcd6TvoFnYm08qevy$B6kPWY){C{)G+F!qE~;h7IB|&CMZ_R{XAckF{pD2 zLwA)7{z<-#1(^3hrh=C`S!H&dCeg#A`|?Lb{rN!CBSrl-xk(8o2a>pUAlajbk{@ip zjbvh{*=joylRpHWQBu1o4WY}X#6@*mGi@W1mnLg7a|SMB$74t9ub1;2j}u}vIkd{8 z1_CsB?Z&{dnk53!^q-SwGPT=ivs6AiSueg8dS)j=QgsD{V&xSR3$MWSa}uMV)}#hR zthY+jh4Y2SDTTkQSG3FTj^Y}8J=$ZquS>}1o%KeQC6uN#Cc>FQ7#M2m#N!QVCTITu z!DL{U4G|i3wyXUK)pwDDg`CC8FWwx%I)Jqm|EU+yM&J7Pd${Cnm4zeQlY{cn!JNYH zB9yx;abgWI*)6FCa%}ghzB+~lbdpRAx^?27vh=>yF08h07Z}mYv4_?5Qn|nzJO?or zeZ333k=u~K2q+?3AG>OwTl~{E@l-?UE8JhOv~=KO8x65b{`Ue~dHSC6vS=%Rl2*{# zX^Macybp#uVqr92UblqH5M0>zyd1M6Rp7grTMK%B*17ARrRj%1lEm`ILFm4o^eDOrxn7C$oApJFBNE+g|YP z!I0)_--3cPRer*j$8ps}Av4W`4O-Fy^iUXP9}Y@Bp=u{6n?XG`$mM$aA&xm;=~7mN zd}aayq?rkvO(HAydXNCWc&the#LBhCf}YNCG#-tmG)k@L=MNGadM0y@uTM z&SoXON~-m&NZ+Un!O14zXr3Tw3kg14Tl_JNX``PsK$N#FCj(B9b%?IPtt4%w!C{OL6HA>HS`Pq`>UYL(!2fduFA;qL)Jq^JQ=ue~ zgDQ3lg^f3CW9EuS49=g+U|Ap9Ko8R_i)jk(3i-o_?z7JTS!*1{84yH7^79n*FbJj# z6Z&r};pWUI4QY6%H5%w%a>N8yK!$x_KdcERCq$ONVuDOx6z}+wPsi!<-*tbGoAp&- z_Ca{TDrzYGXH!auilazI6EOpKMjf+c^2!gZf3>Ain2Z&OGM*}%An0J{%7iHN)&bp^ z?ae^C2|*o9R7L}!0-Vv6jY3;%`9r04@+OTSewT2IB+@|@KYomPS{D-kAQCT$CRWs9 z7rfH%8%2u%(2@>jh{Lz#)@^CK?ho77gx*gRM;S|RT}<367uf+q|D zv1qpsmqiLDIGFo~)ZQH5w^m=3DI*4d)wSP~V9Kz?FE7JDyRYvZM)+whkoYZjB+EmW zk%tI`N|5{T(Je6-k-DIy{k5&s18pvQuI+iGU&S>BqvacEM(DVTL57l6xU$ysFlHDg+6H^nfm2sr^@NI=qWt&bm6O?;S@zI_cX z$N#S+vJ)U|NU1vm$)Eyz&z8&v7iToRAbTtirAiI=qhdzP+hp(3AjMojp>)I3`+3X> zww9oG!fnbfCEE7fDSSBSgnv>MZmX=i8a5idge{z*USGe5I77NLiVS4o5B}mf33DO@ zrDj7nh4hAb;KglZT=*s~fwXjTOm%s5KSQRH)6{MN%rzG%eO-ldRx7+)=RHm$s|GaeSYTrFqjV_!1?FH-)D(D zc)>=8ixG$aKF1MuFLzgANSlzE>}Zv=GaOMAU71nPS+AfuZh1JQ_UNka@fs~QySd74 zDU-QF63mNKo!lnkFj2xLfmr2Sz-Wdab&+{ZQs7US$>vF&$@OELo|!7iO!UXg&XOlp zo@b&Fw^NDM4(H{`spd#*o*psFFv!7lybOma%x1Zys68EH<(A`;ho9MR1C%)D41|Ld z*X=`}4l);{z%!o(QxBuI;5%4Ks0|1&N^S`iL3^ytQ`V7cDqPo95NQnuZGgA$&6dKs zh`~d^!R<4S+i2n$On?r;M9jsKA;VK(6#8zcK+hprtuqKA!K+LJ^RL7S5<|;s+x`yW zikoSTk<%yyNlIWB^Mp9vN>9gLXq-G6YFG@P6R`MjaTab|pJP)(p)g>CgAl?Zqy<7E zLVd_{zi&Sr^1}n+zd+Pz7&W($Hi63MBPp{sb!YmTX6zj+f?0XBux6FuH4@j37DSd}#l1oG%(_ za~+PT=v)GD==-UZA_NNzHI;k}sIF6OK)r0@^H`Btopp2n)7~EppXNtr)zmcXUwfr- zUoyF$j{D&)V-s%6)^pqX7zWDNCh^Qa{!jit6hs+u-6%1VJKxsfUf{M7K?V`zl<@95 zd@P=|{*8wqpfcUt_^i%Sv{A9wBLFxEyhrT4Tc12&Q0j3{9Zb1wy^E{sq!*bg#h8U2 zC?J??=`*wOVWXEEBZs#satOgD%vpT>@!-l#n!3j%lVrh}AdXgX=lX>5fIY6|?2Vqv z#Xq~==FDN;D%YGS_2Hp`1id0b(s}8J+_T-8Vb;sE+hU^04Y5i8D&Z@!;d>3eK3kiM z`%p|MFM|cg*XG^GZa57o=hu1qFlj=`aifTJcNC_2wL2K*qA(YnebY&;KT_b1!bGU~ z)_4^5Vx4$h>;M=xigvi;zqfVnzjcPu z1ue0bgmW`FialiKBk;R%k=qn%>B9CC%3~O6a2Mi*69I)g@9}h3tiyN!-133EP*s;n z+|9vcP>7Cv9hP!h-<`v<%Ko66*VS7XIc{H8Jff!NsM0&w`B)h{MI#8>Vr&aNC2OZv zBxpn1B>5&xJL^Ve&YtS&MT+-zgz9ie{*$Eda_o}Ge&FRqPsyg{x@evgb@X|`jH*0` zp54+`SHbkH)0ewTp^eF@oO!08*Hrp1jm!|cZ?g`vh@FiVM20F2(GSPNH92OP!%~F- zEFMiaevO`1@i~%t@d;X+NB8M6V=^Y5B zDuEgd4`Q$&Dy7RrD^g`mj$cj?91_<}Gp78yq)G5XmwXsQgD9ph#<4ff0WO4Pa{EBv zTc9?p4Fbkj&GJY%?hq`(I@(?xh02i;0j2>#I@|0Sjhf#DA<}YTu*Y6H|*1A3v%njsbaX=3iBsUv5B+{ zCnZ%gzxp-GW7XiU?6VUspSlsWdK!-X(FCv=Ka@`F@i_vYEh(Mht%i-?l1gPXkV-8o zbyKgv`>PFDpe?x^dM?B2AU$16$?O2Jq~as(=0L*R_Pw7Tie0UXmA8w0;c06BGnE%> zn>a)w*FQ59q6V>`7OiW<7lNvM^~?Rxc2^?#F>Qs@mL%rSslQkTbKoEJjCU9jZ( zFvli__*M8?G(6D{9$+ViVA$V3?bjg!8O#1^wA7mJNlYKA$`O<$J z*?pEk=aJ)%j?CdFt^FwaR7)!vNPv?4Xx;Xptd8WgZt~f18po+FbV+eUsxP`lbb30| zmG*mWwkvr-FaL{FVl-H4RmOOFg-e=+ji2SIl~SGyYGF-Z>2i!~k-Teci!H9Aq7uq7 zSp7=S^x1<>(k%0zH;)xG1cWie&h)TYVRd^`0}Z-#0eoJio?7OS;WYCURC-aviFaqj zIObQK1VZam?A-;s`hiBWX)CkWpc3kv)~y)F4MM@dk)G2@jTF0RVV-YAb*E&gHbAX5 zs=E2%!t!}acY??e<=S5d;?~Yf8|g52!5-J(T@->kK8#^N5F1{I$TU~7*|%2!DZJ-+ ze{h}i)ijxCKy`EQ%XK?p%XWYBs_iV5!NYOlm%N8q+B&_=P-l|c0lNJ`CgFR4NCyyK zh%mUlMz@TA1-bj5n|+-+5O~_icTEO_;>e6&*u93loh8uKS4XLk(li7 z<+}bI_&9%`WUdXUOTBNKN%ipA9Re8y*ti<(wwQ{r;0}?qG|VOpVm}!&sj4g<*^Z!p z5$HWyca&>{vbF-@*UBg$X4JL>HkF}7CY2G_#K!lkq{y{dgd*gKHgS>X<)rX*oRT0_ z`PS5=uUXr~_&u7MMU_=Dzx{3@0KSlIF25ag*Qj&L80!|Y`wTvb!}-QFxs|gQ(8_HG zM|fr`xqc=jc92KN<4QCxI1@a`xd-83jj1PFP;wT`WpBvsa}zXMI-2Vai0A$}%Tm(< z>~L*Q6tlTP0ONPDl^fil16e?4nr}JexWa49H!{4KiA?tru@X@n@0&TP*bpCjZidm7 z6=E3rcAvDA8qAf3$!4S`7bx6dh|Fat+qEcSz^XpRlLk@XUaQ<5Ui;d16F;t{YP9Lt z`rz<77a^r9u#08{o{nS`ou~nSIJj-|xhZj1%hMRn>-RkYPZv(7R1`{_u6r{1-_mE( zCPI4O+`i;r({o>R%3Utv(>gjVlrrf^Ny-$Pg*$z2qYPxf_6*)VU-tz*6W@y+MR3`4 zF(Pi0AXd6QKzwvyOAgVc%+Hhi7yH58r86XngSDG_i`W;Q)iW6@2^f2QiMt&ht+X{& zY8RM6Zz4Gi=0kzCOnO+sgMD35-0r3Hn7pX1N4uO=y2p-^#5(7|T|{1Cut0bgc3A{G zP9iMsZOVk~P8m=5m`l58|WXPqo|(J&+vX4@!Mm> zf&XbDf|rEQ5N312ZLU5#i&XiaU^`PPSyjtlayKnnF#drB-cN=&HQoqv6@r%4>WhPb zcdZegDj}^(0>D}bkPmUR{*W`ssusH|XwA{39SRIAfXP)y(;gMzX-F4O%x(2CK$;p4 zL0m0)2?`0(Mpr^Vb~=|Ya(X*TAcM(h01#6@UTCgNJjrgiq(P9+;Wbj$udLj_T9<`F z#AkxMj!!F%C%`u;GaZV9o#Hf-&mmE%qI-nT2b%{A#9$85IV+b^@7fn0R4Sg#$b#l1x5AH*G=y>x}&4i+=-NmXXQkRRQK2zt`lH^TA_`Vp*sD0 zi03l&v?UiOfd3aQpZGtQfVCLh4iJ0Wt+a00f{`o@ye;pA+SA^luoGLU3$${ezDjbW z*5=yk-MEuGBC>*JNPgXVM)rG43~-0Hs;wd=Ameqs=GDQ2X6n19?Xm^BCEKY0q@-b**W$>{eo30Ug1z-2g@zAW=;ds$^5oI3?wkDiACTeJJ4 zn|eU~HL8${MCzBk5F1LrT-@qqp@J(YLdqW6uWpy6BjX25u`9-1bJtD<3V3FOaH?wF zO!EJ#?>pBaClqKR3oVId9(G%;Va&n;!|^kE>Vb0tYXAKNT;E*Zv z{g1)$Tf`R>%5#&yDS*vUR&W)R> zZ*^h}TdnRk$Zn0YerS?bE_AFW(oPr4XY*lcqR$B8AzriY(6scS&c%bP7h;9-imJoh3?{Y4e?ThG~5JMapqs*1G6gK|frlXkPLaJkU1lg|?8TrN$v z=}r44pbfMeYDRNH1c{ohK&SP_Ad0S_Az|nfps~mA1Ca-&+iXtzAa47diK~XunL%r; ztw($4DQE$S3IaY9+4H7W8Vm-qm@~bU_?eZiT(~C*r=Ui>vF^CmE-IEX24)g=;b^h4 zeYqg@C1mvF6#d>P5qEoVj#ngFDe034@joGp zx4IlQodXMYvPg08rG6;?oS2UD?hK6(skz#6sitp*4*(0?bfqm8(wXOMGQzS}5YoSI zJPqv0pIk6IHjD9y8sfqfK;EFVr!$5FxIN(h^(BY%JqZs1i9m5Dn24)#r%p)w(|!0b zBy2vsLc6|cT9>PbC6WDWY6+5J7*<5}=3AKe42>O`0h|fH9<}xq4{s{;DWrVT^#7fw z*Bk_S56S&{0fuaU1p)79YjOVA>UP$|{jfy>CcT7#X7NS$ z%f4W-`C1H0qAcceg#bg*r|s~?-maT^#L_{ik|qmfq#xN>#qZj(r&L8~?qqs)iTbb0 zA;4z4oP{S*t5`Xjc5-q?@!|>WrC5G5A9;rkcj3o=ruObC@Tb2kWEE4?1HjiO-$T&8 zF_5qc)D;L_Xqh(vq=|B7zvkX=iRXQ&eC^Etmt<;@{1ehHinc7QSAGaYgATk;Y7c}v zS9-gALgSp<5}P>5%kH>krtLw&*HspknYnR4aKCZ5M$e{~`8Ov0KIbkk@<>pL#Me_@ z*GFwsYYML=A;C=QQA@SWLInssj@ihRpS z28gd~!CmD%m>o`t(B3f;u>{SN)6jmW6H84LIbkUnYnYjlf9wVw410JuK%qv+?WtRX zs++Hf{R2#f{ zgYF~2A(rb%CV%&D(j;O9GGYk@Y$bxj*OPM=4^uKn@Pz#+6T6Ub>pJOiN{x5kf&F0uu(<1|ZCsR6>wgB@=(Cl*Es*Qh+-gj@;VCN-DXEEVYf#rhWfe zOi|Y2#v&Tzbn0kMH`ed$A3P`K!oHI?%LFo-(o@!bBCLlGrh6!x zDagygFtRkKCBe9O9c*42)v7&o@cYU!0DR# zXJC-MN=SIr($LyRuXQHDlo}Q^2CL@a(c}G1zG8eIU@Rj1m?xCG?tapL)#$xFCz+5h z{>HWntK@chU?Sx9VVP^m%2{&Ez~1*I+EZA+JF5(v!GL9Q2jz37g3o1Df-TJMfJz(8 zk44b>f4O}Y*4X7L>FqK+3oQ`EzG7&)FYUy!FW{=!Me)XeT84%V^mODX75L4cGb}<& z@B66M`I=v~MDqUg7=A+l%b?UQsE(6PJ&ZiMSF>4c0G&GJSm(urS1d_2jt!|U8DTvk8^gE|sf zP@rpri&zdA@1)2cMy+-*AFvY1dO#8jBWUI!sX|bqFr4p2(l@B~Y63;@`B~_ra_TnJ zgk#ktM$5QPK_^Q#5FHuXz=Nhrv1k%<+wPkwOQQJEV*@QJ5E*{>*@QYps>=muYw89V z>dle}j$`2mI*K@8#F zkH~Wi?bIu`*bXOfCrS^_O7AWm&uaN(S)SznI;EoC<2KVno2JBHn$J@uf;M{Pm_Qq7 z!xUaw7cGY>p44ByF8*W6ev}YP5t0Ec3^{fVqN78Lhb`v1KoIR>t!ViF8v!7R;> zH8OKuPF@&2bRQz`W}0_R@O$={JXGZJZpwf7lI+_$gJt6EF4Ynk;sOj2oEj5qE`TRn z(XSAVcN>7C<99WUBUzzl&|f+-mdO0GEt>uM!~{U)yePi~JQbJe{;^H)(L6sB)2vtpghpKPCtoJ5= z&VM~ml3*bgxo!I}PH%MmCE)R(^O5!JJLR>m%w}B%>lJLGzI=>#zN#tSe%nu7;7K(H zj2$Q~Y}mAFMzybF^gsF{rRn#-JsL{SQ;;;8%Irp#5r^?3!#&lTNm6O|~Xu z!pXL6+qP}n#$=wXx840byYK(-!+l@)Uf5_B{pUInXk!6J1L4idtS`V0LEjb5S@7Md zz=Z#n0RQ`S2u6mO>5dVf$UWX8Fxr==dhifdoIp2v;=yi7FmK?d2EW^|nG2azPUl=r zU<+s7(+4u1usNl!%@oo5+nfrSFY)F%t)u_q=(-9G)*60dAv1>bhz|C2sD&N-8w8l~)t#T_# z*ZLv+u~~yEZkwO|IuL0e2(oeFx$)#Sp)+xnuT%{BS-o2qdgHh^yHDx#cG0~3KvK!Y zWee8PLn>+%wQB>Q?N#La&TjB84{Al<>#jd0t55^wlAEe-*z+r+LTH=Q=7P))>A@~l z0<%}>xBJWj0bU&ugKrMIi}T=ba29|T+)B*EHqd~cNz~ROam5nOVAQ2xSI$}pd_jhD!BTyHQv`inSntC%g3KZmLA6gEkDEAhN z1jee2IVS#{n&05bV3-Rwd9%O6{(MI=35m zk%ryQ?ijmPLC!~EUD+a`uf_he*|#x~=Z>4wMl+OSswOcr1Uv99>p1(+>yjkwp^+~( z|8VB@TBVBE2qItCcIqW*ig!rO!I%~?T2_M8WKifWnE%t_C70;!_sfEFhUB=Vrg6={ z%oA>QM%|P5)z$lQ8;b3(|B4av&j*HM6*Rxvr6pHwDxU06cmiu>WxtiyI#d#Q>Z^yx z&5kN+&ofW+#1ncR_@wlYf{Z^w@}6A0ccA#8lEj^`g0R?*WKb0*qqO1Wmb%qrgGaz$F$oVUt zg&S&NTa)z&-$(50tIL|w;jvuwA3c*$3gc~ zyG;xHxtZ?j{~Vmq=Abp>^q4~pWNy~jO2f-%qg2oN9x)hLCD4gcjK}U|+f%b3WxkIy z%6~L7RdPoCl#R-bX9v1MEUJS~ec1-xH(&(HLpC3dn zNoYsG`!BQ4+a}sybT5-A6fW8{cg&i)@0CtJyEx6wxaAOTO}h)N1>ZY7lZA%ua*qwV zUGDVy5B)@RelyH8{Y$sx@2b%JGkj5b+gH5Bir^*bubXJGsHqdGrm_%S#-&c;shCB$ zPnhBHznh6TBB*r&vwa`vUe4Z-0NzLJ*zW!k+p~mvY#8@DW&W=is4KCQCRSZgkC(rX zodmLj^!+!g!D{`>ONAR4E5Q(2zoLK@0cFZq>L5fc#*W9WKo;6jz9?D^4p{_zDorg- z6lTnO7%s6&C7gNHk$8C6mM1F_1Ocl21ipC4_BpPxnxCNpDL~*vAJaGUaLxh%0D_Lr z(_f)|M4Kb^IsyI%vWT)_9HsVLd!=-`T(K~hs*pCeY`|Zrn%0rTIFA06abxNjDQln) znDxw^vNGnd&Oilw5H~Cb&wZ(uEJN`f7DG{ZGJPQ@b-ws18nrF!A0+XWyfE!F+p{>k?~8}6OD6kM!ip9lYe z9g>C9EPSi27)@~F5ROfbu}Ek0U1r=8h)mPo?YYpmMKfTvZ)S4-2C zKD^|Y`cx}k=kI_jEp;Hhe88zEGnS!?Wnk=Gxc2=N4iZki+63PE$dRF0rc~a9Aui{B z$&7*R;m_q@V~OE8IL%4EiP02GF=S;F9bAf&6tQ&H#SAm1-^|C38T3g6IN5S^??D`a zg(-_Ks@GxDZCnsIuK>sYHFfV+0Ad(cZ@Z=%DsKgE043h@^)#Hs}J-#0s z@HXv!s%V7?2tUz$ow z5l#;aP5>aRCf)ahl6vOvGD$kt$8WUPSAOgb40nY+1nSAf+T(n1lvB7}w zL@~i%V^DF;bM@;u5kmw$cPQ?I0hsZc9f;(vw?d-dF7#!bd)-C3(~g$|TVF3*9oht} zx9CN}MZa}W_svUdh@>nv6Q$vh8)i4?S$5;CxH z2@<8C=p~gkr@fzqPhR=&-%nQmWy!Len##z+U5rLf0X&cid5i-{p8Pt99gB*n<_``; z+8j@W($dl-h~8Jk=L(_%gnVlAZR);_ISZZ@$>s(-+ZKVivtR2$S6y$D4J$a(Wa!ZI zb74bGnEcA|`-WVW4kJryzX}xVzyra}o0J&Mo2y2N1Z&c`3DiG#Dqy4&&0Q_u?IuEh zzcOtJCWyCbr~K7S*H@lX!=$2WGby3_Ul;g_WM{#DJH3Yh4uGWAklIe(C_Mxt_%mNx z06a=2nh{-4UgaoD*XKC{AyY9kzHQfjO_XV1b~;}Z@CNs(>&~7T7uaDljd9q(rD2m* z4&RjXFCNc`;s#ogTnrmao-6}`cf4@kilw=s^n#0>x2h0VbT&XIfo2YhDX$s?8zHP9 zN{#F9Z01Q_Nqf9!U>zl_#VR&5zj7c5yDSs3dM3kBZE7qOj{$rv&vu6Jwa-R=-Rxo8 zyNv?vb?Q9#@oTco9V2E#OA(5r1_MwT`qaAHFE^Q7HGvT9(s!ht?xzQm=u;ur$DJ2? zNia8F-QSA3RBP)FZ-#IKSWjB87yEJZ$M=wl&By;>Mp&`Qog4ox9U0ix>_#vRqMryuTMNoYrMdTt5BQ-PwtyFHC@ z?&H-(!EO}e6V6mtd(cOJKn*bj`FU`O4l@9Ev$|IEyYD|N0AWmsM5>uc%#D#%aRh@Zu>h zTDcg1>|_@z;2F!q+ASuq^@)W6YcRW7{4g1R9C&2$Ig%8r=9a#Pu{Y*CyJO(?S?o^Co6afA^CxYpGJ1}Et2I_t%<;h7OvKGO5Scuezw9<--iph!^}t&86n}t-aAQ`QY?d&^Ozg9c z%E&KE?=nBCicE>xZm>=HGiymvyMWn3`9C*cWClo&JNbn~vl~=c4H;S4qT1HM24YHv zGVrj_lO>0#%AApm--UO;Fe3-`A}nV(wfnOv&)XGiFT&u}q|g?ZeR>MarVjxW6A`LJ zF%fqwi%q}X1!d**X|lX89igg>_F}mHa2l!rit{ddK`mTzj)_h{WLqY4!n4Q<|Wo>2Jn`vw^KCC=a(u5>;ZugmEHY~(sB z>{pqkN>XKKEsdT9Kd~kxGFP4Ghxx{s7%+%>;8P%yoCg+rsHa@dee+jm=cyjE%cI5k z!r|H@3Yc$esPk_e3~1?d%n^2G=W!7jMn(XzR#;-k7Di`%u?k*IhL=+~!4BN#nCN>_ zdWuI;y_!V4af?}`ZF_|vg0_?h$BmH*S>-+C>mQcSYf3BO&@+7(+>?rer9a9abF06m zFko0J>2pAotm|}v%D)W3sM+IGKwB>mKb+5;k{zrsQ6TtM;j1P}AZXBOXB7iYNQ*_+t*XbiV%B-K>9XjnrG{ zzdea$^wAR__0kF_a&l_HQSdysuxe&)(?l1ak7F}XGNRLI@nC+xH095ZBH~Txx-*)V zo@+99dnVS@qyu&iUMKcxryYhCXGzFsxstv|4ra$WetM+E27FH9F&6>93kBm@$8KaM zEzon-BFRWwsNKYb;NacCcj;f!OWyhY-Y8`7I<$J(z|xbf?(pQDv_1{8kbJjoP*axP zr4sw0JNJ4<(>AGQUSHm@dT`scPBqmeblltO1MeQ$oZqYgvK#IWfPahN9U^|Hq})5Q zgA>3*gMM${csRRh#?ZG^`ahHRoB;;=^ii438iwtivhim4t)`8U>}W(4iqv7~U0;7i zJ0Vv~F57TZ-v2r*)rPM^`JlvmiMCCtfh;D1=M6T7_56~C%@ z_875UgzxXF`=xqs62Z-b4BY2Sa*qYk{X52t)m}ebZ;l{z$z3$EU2$NqKx8b(m1CXj zh8s>Ci{M_qo5M!mB!0j@jYXsT;o*vtDSdOk9e^!IcHPQIHE~JHrH?2qA<rhmRrJ z6*J>j{FNnQRhRPt-irzPfSPZ`cUHLgN;oKJ*)$(UDb6tPNaSU|TDLLkTR7N~?2L?{ z-aJsxyCHdwKq0&?@4cc>My3PPchKiol+ryZ%jkeXNNtePE*!UKX(Lgl_EM^k z9>?G2Us2WSp@>}m?E|jR_-=l?C7}I>#K$*FFrih2)pbTx{yom(4Sg*+N^%4%`UGf{ z1Mj1kNk^ljFORue!q9nZeL5;evQNM;RlBPw*v;SZS9!HW#yX|WZ})~{hL`+JMn>PE z_OZ9Ukqr4E!mOt7n%%jp&UC>0-sT#ek8^np_=ZKx=1}#}ovr-hurI4vwtkFF1bd&* z3@7bK^53%X$s(izM9G{8U{rxgWUGqgh}Y}eB#5T_LF**>WB!xleeud&&;l=rg0Z@2 zoSVADP$TX%5mu*dXm_youjHv5z8sZ2p=z0Y8S)6@8q2?OPp~s(ZM&Hn7coB<$@lz9 za4)$RVE4o6*~y(Z=-}Lg0e*=~n_ri2aSL6?>I+5W z5o8SG0?&zvo37l-7kcY~?cSG*4-7Egw*$-9TFqc(5uAGhgHI~+J=MzqVDDbgs7dzB zpbNf+gZ36)(?{7?uIs-=op)sLbU_i1zj1H|I@}cbtzK>(ER&Xfw&AM%3Fao*)+v$` z!guIN))R7GoNzahNej(|78Ac=U{dkIy?dneJGMQHAhMRC``*upZCDOr&aKa z3=}!dRvYe~+OK^{#7?Rj*%CSnYxbJK)RdHH#j8OBF_9wpz=Rca))$)Pa6n0c@NupI zBJnO}t=)2AmVuKstez33xi~kgj4VMP3Vv*ILCr@FB5ihN2!3G6q`nZbbN_}z9+G3$ z)9g#YDX;{;1eCe#;F6&2@EFjv)X9nRFDXjN=#3f)K{tT;INfVc_1UcE5@(41hf?eg ze2;>O_Kky=kGHbX5?@Qb2E_DU3Fx3Mi}UNa?D)|qda+Dwh86>aapelktiX38j4FPO z>vAEGBH~Cp=<3p_2cw};W>~maDKHqlyb=G(UhgA1stwk6sn<-DnY*f0wqb4`RY!GI zD*6z3G)Jnsb3h7U_I6eD4W#~Q4yw9E}zjteMIf5oF42@OcmT|qHrA6xh}kRIU2OSjL) z0k&#LBx@rH6qO-Jc7EuTEX>?o2mNYnZAuwR>?V=ANb8sN)7V%jfUL(JVmQTP8|Xa! z$@^nY;g=I0#Hv>1vGc-}DsKziBJV?HI8milHcub8WtQ1bPIS5GSyN{h+}LB(ccD;H z@|%=;A8O!&Sx&U;(UBFG_hsCgc3fh5+*)D*E0(i{yHyw})yZko0x*P?p(t}rcybnh zF1Zgme@@t%nA7@9JXR}VcCF|)@>{;G=E_DDA1Bs**wZGc&pvw#$8f!%%K$M%+_!-NK2RRQ;e??M4;J2A=0%0d~d%(~2q zU>9){r*Z+izJE;I+;YReaHY~VGD1URm zi5iQ4j9|N=5pPEx?^g%s0nF|uB1L$I57Gpv359I{5VsKA>f*=OPcEoeBKw~l5|1&; z%mi#CWgAjvEU-;X2m{*D!qipD@$uFV*2)UIl6XvWUKB4)2k-9f+>ebi&#Oq<&a4X# zf-0D~P25I-s)FFUIr~j=vV?L{IsmW-!5+wX6n`Yq`o~|(_T&AQ)NZj;qIa27lvQF= zN?$O?l#yVzB4BqQrxX(}-UotZ^wz0YaJb&7&Wy8KtA*L8onlGDUqW4!X)dgcKQYl2 z{{-uiBq8C-u%PuI2*9_?|zklpHGg5 z*fXJp2NphaA_dhtq}KSvD4?jj)nQrMu{zfKR1apSLJH1PsSKsHBttqmc8h=rPuUo< z3WFxO_wKe!tKiAU%1;@fjHq^C2$uSj;l4>ZA1?eF+u08v4ROQu{5S4AbyIyC%T_=# z#`2;tsYqU8u)YsDZw(a^0OkiKAR)a14+K^5wYyg`-j;J)vlok;&Wjg!YI2c}(rUaV zM1P#L*+&z+V)>;Rv@dHOcv2&ib!D&acQ)$9LT^mQtP(8y!h#p<-+}89lNovWk==ji zJfuZ&yz41*FpBrDi0Tp<8HobXpSY%l(H+IV6Wc|=2ar>_9xA}?x%PW~*RUr^3n2y+ z$*Ly|zQcr8Z3n?90INyfex~}JNw%i!*tgk33dU2>r|4gz4GE2Av&(-xmK*rl3kkA* zuQDN<3BdhM{sSzaKXQ~d<=t@QFS)J(_g>xP^ci+nRP#p5U$V(b`Vv|4a#=!0NX8pt zHWD*s=sZ>aXPgL%6Jk`WD>68QgJ2jLmv_LyCS9&ZU9kHjA6d>GLRl_vOAZpTg0sv$ z!9_3;aIFxq;dYkKya7Qwy9A!4kAd4GN%OhHQbdAeUTLs7!;{NcpC_AGc=+sixu*2x z>fNn^j+(b6z2Bj`s60WfRP&=oTv;V~XwhVn080a6VK7dTpSBd2CMusw+rFHZctUm| zi;48%wXbXJ+j0zDUi6+fc**f~s5Y@k+^DKMKZcocH%WO^OnOE3)k9xl{-tllBZ7xj z+aYZGdMS%n6UYaf&)WC&c278@LtpG96GKb~Ef~wRX90FB2L7>q6|Vl*?;b|6ON)74 zJi?vzQ9$2UVg{5VZZKNE(VO35x)S3?Y7o9m>|2Goj&95e*Iz&=Ve$==aWHGWNo<<7 zrEDg49eJ`j@)9zpyz(X_2KPC2-z+E3LfTMmUCI_nj~SFOa$ZxV>j%RW zyot6SkzmzFN^nKTHV07ks6&)z0>`dqBIMe$gSiT47(e)@I!&r> zjfV~6vl0WgKUr<%cQSBLlSvZvj=|m*P)v3JI~(9ly;}32$^SH`HZQH`P3QSWHeE#Y z_HiXe4w8Gkuj?}N`X|1EJZwCu(7f=jD-Vh=vT~~E^oRUO>4-Dg5{O&XC=K8gs4r5g3;S zk-K_K{Mo0hg%$pvyc@5+d=Y=~0Fn2QEZ2gJF2PRbq;J8}U;e_O$z{~vT%5lAydZXa z3#4ZrphNh;3K`Olv8>FC#M>4y{fjNQ_0Nvg|Irib=`~9SSxzyzC|XShRiugUBXOrQ zTl7Hp@#QOX1QuZ8X6FD6GayOwEj18t8wiq;fxJ`B?x{AjaK4KCM=(66AYcSa;7Si} z^t2NmnZlsw!uvSv$fI?K3wbOAeE&`N3_<=u?bZQ}X;PKc$5czUJA6q8Fzqun{1<|Q zmcSlS${k;&+evw{>3Ra?&}jv1F` zqY31uJ$Ft(Z_M%q$h^;HTpWyPl*L7j`;~(czv|kSTnUH6mGo~hN!^28s-8cfeFRpomji~wQIHUsw7;R&=Yyb%)9N^<#aC6_ybFwT*})=R0z zLY%&&n%3q2xej?EfeU}m7`&Kk9?y|WRR3LFJMRlK<6`u_HyW!2tw|Q4~P#b41#@THe=YP8zT)z!uQrdd^9v_l_VFVq86WOqqiiJZ4726`1 z+4y6&EzjJM#L-9yt%Xv6WD%)N5h&5!1c!*ea!HKp*}=nK&f@6Wa4F#98D;ln`y_8i z$*oqC;YzMwiD|74b+V>a2YR?~;$MoYoUvSjLmpE#TShd|pdV?WU9*gvYh_qt({GuM zANJ^;QmG$`Bz4UahbOu-%bq1*B?qcR7Hc>WWZ0S+kXvb-DJ2Ij;g*=Yyxq)~U8!?9 zUuM7pYF+*H(RcCxR4`+I;x@GWr04GgW41+CI{~w?8#RUJx{hAg(?Rk`B-(<*b{ml( z&gp?@ixBe=2)LTEm5vs-h2R!1^W1iZ@xk7m{qE0>lF`_>Mh`=1L@9EzzVcP$24Jgs`8LiU#w@1goJA0b&f&r}4@HeqMXVVapWLi<`Z=L2&EKrQ<~S zwyXu&>Wi%BX8B_17xijup`$w=4MkwL!JmA=DA!iC89hZ<24Ir4UBf8oUmDrxy!yRHr9rgQ=3x{(*b6 zbM@ZN{d`buRYI1!M6gD-w$Vg^)))79;6Nzmp0w14sEe|AfY z*=jinMI|^%V}fG1fX;Ujo!B&?UdzYchQu{)>aw7lM))vunLoWi!%>M%>K~$g!`3{@`M(*DnAb!1B{L zI3zTkVJdhaAX~!7DF0L%*BP@4uRPts`oCIT{}br|gAn?R2|PCaN6Oe9smpx&!lhIY z$wHTzfo|wwWmP35U-6fmSz!g`PuE}EIkb~+^u?x3nM!%GFkyN#KRxp<*Qm{kECSjk z+lg3FE%A=yn~vmf51ASfPi7W(8(ElQRVGd@eI}#Gp9{Lt@6pQf!o`%?#l;Gj1Puze zz(ujO)yK_Sofv)B=X%$DPsp*Yf4!4CAyg*md+(H(F>T6{{#skeQUpw{YnvfnoEzje zTRJch+p&8dP2C|&O)hh_Urc}P0LOc;5+>AklObr*!ko>V7PwDt#8#J?q-0<3OKt;gdn4Ro6r}%gEa|o~e z)oMX}Y5&3xy1{Sdy&?G3QF}kWBnT&7tdoU&92em?H(gP{^z0yh>w|3e{hS>Rgk|q{ zm3_7>=eo`&Q;#7xFsQf&5ian`RrL(PV1g?XD+c=F^mfCP>#N4-x>kjaPNt4-{gdeb z9ZX&AX%2>1b7E9h1y1A_l*ukaDWgM96?>GCnkl_pr6ZqQtvxSlaVIu19|YLuV3Thf zLQ&NU@uop;4SD5Ha3YJRtdw@SWBP;U`5i)C#6K#{8mV{TK;B%PbW3;Z0b{1yq@Hik zogYWv_+2eAj2%G#(y>egaBO&jIC2E`i3C4<$bTDA9Dv@gT1H%XWv_KhDd0$mP+B+< zKn13TFq`W>T`*bShc^{itNhg2<0)eu7O^-UK~q{qq?2HKIx&oCjig}oWTme*-<{8D zCXwXFA)FQcuKC7Ngsg$*a9%Tuo7@KV9&@_{hZ=fW`*%~Kau5ZI+A!WqQB>Sf8BgR7 ziY#UhsD=+gfN59dcC8op{nr+x)A1$BNte3`Xel1q+P}7IkIj9ke^bM79EGKfocn!< zpCGypMa1nfhF%Rm?}y=5Y6mK#Qq}f<%)D!W0P&@SKBmu~b(DN)E&(Fgp$&!{MGoQ)oTMB zvZA|o%7aK2R7om*k4W|=O`mwxH*CH2c!IU1x6!D_Ph#yM+FkzHJCKo*0vPptv6rZD zd+YUp>eLD{aF#77`W|1KWm5U~ZG}-;o}JDhkw&e$NTbsGTN1*%y4tRo+uJcgEU?53 z=Ce0I-L}*c%9erWVG%2HJF>f3*s1dpH8^GI{Xz$L&vN#USfD2+1zP~1I*zbqznY34 zaEO32Hx>2Jp*Ersv}r>XMM@YC9RY15<^%Y#fnxGU9cr#&<>~HUs75u&18xqg0JmFU z029Ep5p3&!&Gt=tXJqja7;-9%g=u%d0gKjddD2EN+fHA)dB$#26ezk0J;BM;xLWhY zkLPJ~m9-F{{sNYA4xAR*z$JpdDr!ZgVj>o5U1M_3WhmB+4kW}&tinx$pzRq_A?3o9 zZc?p5VshGxpqnz3X+E0hI5JT(xzSQImn)C5jD_(tRX@+maSJf~cK#tbkkM+yG4xX8 zM1UzX`3w7%>Jo`4K78^!namFqa7$+_GL^V?iJQ6-%kYy^EN;LS$xDNvAvnb%8RdBp zxw{qlo@tvmyKG&0QOzV4CacuAMMXmoe90|3IT9mgo2PN`C`mSE|Q@tZ9@cM|YR6N3tk%)F-^ z$@d!^Ypng*Z2?8G+1^|gVf?-5(rkQA$CV)_>%o?0coHkDBKZLeq5H4X?*H6e&+%XY z%mT~x-IjL&=V`bZP%|C96An*14fNVNlH<~bzxSq%8H^m^wwqxiQ`%_}2ctP7uYL-% zj?(=t1HXL)-ZaD7Otq&zkMNJ-*wVxw8yz!}JK^QIJHZG3jtfF9Xn^h;ErnU_4Z8vwUap`jVHW+lAZJ?vh%~-mBV|aa<#8z65mhpws)7g>XV@ofO ztZ`k9)LbbIYuu(M*1ynz`|5PMUYK>xyDWUMVtpKO3DQ`xX$-4^NGF-E$^#U5eNaZ_ zA;HrhY>W*)qSdh3F7RR#@^EGs#7Do}oLV^$LpN7jzcXTdcRFLQ|Pg1z9vfNlr}ODdtu-UEPdp@`by2Id5Z|+H#ZRNXB^$B)Nli#YN;z0 z2B#SL9C{O83EH!uhnU8j?ECT2ZkuOlo*@!l-#=caaKj7wl{`y?yv3cO2Jm!A>yhgJ z=GgsLqvrZr&}XuX;~9Md_86HG<~Mszk%5P!Slg}WxYd)@K%oKL&K)QIE`iL%d`EM> z;Mgpk%*4g*&tZn(@-;H;#dn+T{E49r#m-SGuZgJ{0U&klaZ(c7?y!@gxi-uC?N?N! ztpwdJZl_U0JLj8Q+G1u9V^O7kMIZtT!QEZJk*SRz3hLKflWUu0h|)Go(%LMv3Di$cXfD@<2hU$IV!@%P0}w;VDq+@cybs+N}Eth2Mk9n zVGs}^&KDWQhm8M|UU=0H`QX2vQRDg_fkpM=(2-Hm)vYI!LfL<#dg-7f1`O;CZ})>? zy``l)x1-*fyab5CrWyJe6((enOq}5r_z7Vk&DhgMwzpIpWE*HMWYVk05rY1RzftxYEO$VrG#XG4SwF(&nFrbPE>%gC4|0u_Kl5ASa5R!}-+{5?9N1q+s*9_#+ zw#?@vbiz?1=-3VBlOI;p`_j-!S`0f3_?bi*T*QxQMnbhNAU~ z8cnSAx79uV+qg~op~SW{@}Pq9wOH%sk`eb!HBLCK;NYBGI(9l{s5nicXyga`5FP9R zJyrW}riim9(_X*W6VHKH+;rxSzrLTF1CKJ+5)G3?wTfV@BDBy5xZDtW|{(|9ovMHzQ+F+a$KH>QSJ(7 zm&&@TN0~AwUu5u_hmnZp{(QK#m7(jNizA1whT9Q2IF*>Ln|DRDw&OxQrj(DxL^C~S z968{B1h96`6__{}qZXvg9H5n(n0mXZL`%k z)=XZIn(P}Ji?a^NUv^P;oK`5}kJ+#e>B5;6wJ2%8MMeCngV*iu6)`;?BjmT)g(cGT2PMg3){Er`vcfG(xl_ z%rYH_be7u`c8Rf?-eu*;B@1_);P&1Z7hMw+xc`v=&c-PB z4cO6dbB56WwWQ0Y#Zq-RRD>1RG0po}p~K>}+c)U={(=~PV0~1Jj5yiSd|$g0D3zX= znCPhfg!U9^cJ8MK;BJ20`fm4S-?dxUm&b{kR+DBP$DC0r9wK0K)gz)Pu^~V>Aj9&< z1UfsO2QdDL<7#H!@A!#HkBp>ks4j}b^ZR{68s*w+hwjHnnRb```t!|YU3EOANvQM{ zzm)s{3Q&G~Uqm$*D1D{P1D~FgGERtDPi?qwL z8LioeMn-Qf@-N(e@}nP+oI$rOp-O5Rr9DwXA6MbWw6&Wsc}yhXgsX5r?imfd;b|Cb zFw&+h<1t&%TnVUx@A)Yd)N3kN@I@d}VI`b`1wFMaXjZOZfs;9@?PBuHEP8Q>u^dd$lu%({JP9^{19w?6ZM^Z9yxr|JK>D zsloWS?E=jFQScOBEJ;hQ$@DhpytNak(8>rLg|%F^Y5i7lE)LD(Y!bHiM|%-=NjvS@ ziEL?*dlIRo&^TMU4LUZq@IdA!M!9sznPxHH-C>c0aRX3t1*r&NgbRmr6C ztQyODyg7VkioIuVr-R-dbL#0zZ$X@FXLG`v5wQ#>-FM8j?to7tn{RUva2x^PE#{fB zQS9_^!5*QB+=^*6)L|c@tP-@Bs5`>LqJfE3n~|e6@S{xu*NOq_%iS=_>z7oJFZYS| z-fQ$%q*=`d9`&5IpbSz>&)SWtm6LBbQ@bH*_VeO{A}-$XL^_D~R`c`oLmP(}n>9l` zXm7rFJ@BvdE|VEqK|`v%?|O@(DHX9%gq(TflvD#?{4w;}9mal&JClr(r`7gcu{Ra0 zP&E;a@DFC=f$LTR|@DKTf4d|7Af^;JpVXd=$+ zN2#&*A-EBWMyU4ohe)%p*3La)X1v5^W*MZQ9=)JUQ;_8Zxb{t?B~TfL-c;gL_~n;h zDNpXK4Mw_@g6y{=KSW(_tBTgEEBsG~78aIT0?b2@7>Gsiz#q+$8xb83!cd!;Djg5Ow(q@xDpqo~a@T-PaYOoJZky-2o@+1W}et`c8ddzKv4e7hmp5dzR^kc${Z)#WFt0Sk`9dvM(Gm1h%*8`B~#*WLR6{X={RZ=25e^f%F<+_&XUX+4N{Sh z+b5WZ4t^M+Jq78~kY(t9^Z}X!mv-O-##;8ZXEtT-fMc?^BvrgK2;Ua@afHDmta=PLZ3UyFLu!VSSTz zt2-F)GNLM1;YvbHdd;s>kb z+pIaxMoWK>J|twEUBHg`r3T<7Z?=d;TtCTi2t($;V;u1F{8|zS6Y#I=-l1C1hYu{C z0wuY*n@nU(YWv!2pCTIAwa@v=y=mdK{n%y_*b8@kJhLFm*>!i z>u;t~V!1%Y0vDGB6Khreh9OH+5Zl~v7JsZ95uW_^eJt}yJO6XR$(-l@WFY9-`!f>s z(CT0=hSoM-PNPa#fHx!_Jm)Z-A(#DeLnOn0t(J|o-<;`nw*6+Hi8AjZ+zdx{DCrPX zTel)U%E(jsdowz&@YtGS*xitBY=88|`d$6{ThJ7(f9ZHoqW+LEvap(r^UL1AK|+Y1 zs@ivd<_H}pUuMTddKDFIvK%JB2y`B;o$c=-i?#2vHr&yKf;O*+I-#Qs4AI<)IV7zls=SJ15cPN`fBdVl>!6f(%CecgXYbl=+T1UOG_B=0 z_EjgeAPGS^-tmNSX9x3t-_calm1;4De6ekZIWa5FhSgR#J+D4A3SdFE@^-zyX#ZX3 z3jN4mQeE}N=|$C!C8 zV@jy1-|LLf?%JIq&ccy*{h3rIb-yvb<3>78j40|dwHUKMmS#VqLag71kJuM?sa+Hg z++5EVaW@)04RYH@I4^E?JO7HdFNWM&W=)FS;{8cUc~~%An`AY1xjO>wK008^dZrZ9 zTaz@b@LP(aSQpn3;Id4i?q@Ek{;yV(IG#6^l| zngm;0rZ?A|M}%$}BimDHO8^N+ZdaPWynGh5eturz`$4jRY-sy-H~6a;J2Gifs$|-;lQ@{@KzN zluL)t5gc*k)aQox&ZVSCp`W~LD7C%KMY6PC7lN9-Z;I!sx*y3-ruDqpJufa=8*-%A zhEynrX)*fOn{0LZXU8NsBKZ1FksjY9vxgO$%)(vfr&|)Dw&VqSOpj+XW7fWtQ^u~a z614fz;o$@bQ*mAoUgHOGQVFMd>|^l@Cq0b@e?-+P5N>u|9VtQ)NCLav`P!;BD@fh- zCQ3w5MFzxc@GM4XT%T5YyXV?Q*7zk1P#}8hZiMdj#q>72Fl2_6zf0$?pGzFkDKA zduWaBLKoMT-5Kw82=M|5PExI<7Uvo+^;0n8olQJ-lfBKE6J5nAk2qde4#|$PT^_^# zIM`){m%FAA#WvjxTNXFm3>z~QaBueqT$oNQQkmX8xTZTnJJkNf{ceXlNpdQf8FgJJ z)IWM`@TeU^>1%h(T8k|)gNK>ed@L%j0D*yIBs~pNnGuCg%S$8s?h^AwoteBCo4csr z1WTQ2kdq)fwVtiqT|7zzY!(=wTwE2X$T6HR#gEO>%7TXMIf*S@3tZI(TJQ<+Dhp!s zHPAQ-#t0=J3)&v}Jvx-0ASf@B#_6krqJE~~3P1h!n+(x+IRE(zZ|FidoPFDkimtk% z$YiM-?wfbSedxAg-J^kBIocA!mX@H|^y~1kBNUVb1mzd(9CK9SV`7q_VD;IRAUQG5 zg(O9QiNw=F!ksVxSrFVj zUH>|%{LHiWHAWUdA#Zef+I~tX7y^G+cpB}#`|p^20|qZ0Ifl!Fxpya;n%RXcThL3q zv&;$LT+X$>NC7lBn3|q4GrbY}f=aj9d}J&`N%ts4{2t2R89YQh);nP7a*^f-`sY3;s8KjG$c1NefvZ>g#ayzi<%yIJa8X(w&v3hrY|8>lHY zX_#lZ&MH}&OL(+~ol-TaI-f6FL5bB}NnQ{0M3U3I?=EhKn`(n#)}g`|kW3~knbef~ z8_Yng3nXEUPbKZMd_R+3f&BGn>tTRXZ~T55C|1DwL`m?PxD2PoU=`bTN&KW3gM44J z7tZ@?UYEggc_SHi>}h3H-H#i3wYRywM=?czA&ykMc`yAY@J0>iyC%|Y8y@;e(tOPeE)N2jPsMNw|C8*H+|V_p zM-V4)$(t6pA(E+Whj|ed{_xoKLEw&E7u7j0J%}TBrfyM) z9g3t3wDReX4qls9qxEc$_z=ABh4QC|A1a99dW+W5Xo5brH+InSdUSH1tGzCKS$eH9 z+#NS*RyM6^qf^i`<=Bt=qjIr&rK$_@&@^TE>~i~!tOB0 ziF5BEo!xSDuY9hFlWSNTZdke5vyc82w22k#%#Op$JYNLYYB0OFa}Do!s*4*JjZ&hZ zwWH7&9&cr2$|pPF%qNyF%Mckl0;9b9$!|j^MdvhV`&R_)t+m_vKl$CSo{d*y37$+` z^>h}ycAm$S~exI^I0&UHm=-0x2t>jo$+ zn0)^pWY!*GJCG`;lsKH0`Z?{Uq|?iWcp4zQCXRYxDZ^#E?ylYvy>BrjE8i7*?4NDZ zO?&Ru-jtHp)W&#WQQ6&p+hvXi}f*`lx5> zxEsB#HHtSecB++$&>tbfZ07yZ^vY_nu#+E%1*LRsWwce^3m2 z;IXT@?-69)OAp7bc|hZ;^C(D7th;I56bbpI`T-H~iXL%IVdU@5ammvRQs*HzEFBHo zt|ucI!Qqgl^I~0hbjY6H0OT>?&g>W>w2pzf)Ai>;6}`S$8JN`2Mq$KtG=yjK6Novp z?`~i^pnLXL1p;!@GN(z*@O2+qm7R5%+w$!4USI znR8E^IDxP?ZEZst8K>j}T(VuYl)Kfcem;E&^dZoPKpz4h9tb!GbmxJX@|kF2u8BrC z$MX&E?`fKundvgSzFpR~utB+%LMP+u>Regpv-Ev;e>?MFix;?6PVc4MT6fEErmcB7 z&(`5S&glGeM8{{t>figCE)!2nwjCbdJVQ(sb zagk~~`3k{cWN6lX_dY?O;zk>PtV;F2QMEEW`?VdXrmN5B_rQ;KtQKB@BR6xkUfuk< zu?-Wy<}l5mi3Y#LCHX^nNS_~NCoJmPLpT5)e$s<98|Rw(>`x$QYJNa|L$i$oI7_eY?n-PWLf4wLZYUd8b%5*M$kTVvg!^Mt!Q z`}Pg&AKGO0rT%{LBds`~OXkKmV&g9X^qJw69U@fbNC5#*`OFu7u`F{J+CTp9{+rL_V_cy;>o_Xe(^4fPVGVV#i0$_yr zap|J)$8M3l#{j}5kEG2WIm#t(*UFVk%jJ>N$I6-GN6Qw+;1};c!PbZ$ z*h?P`3l?W!*lHV)}pj5a>hT{zBje{J{;pTXjpCS^0r(K>ByT>swNi`jyWn zZp>?kgdgHn)7MgN5~W7%KR@sgX!Rnm_N{ZKPUV0B6m*y(nJjj(#XE}j+Bl~=IUUC4 zqLwG+b=t1Zc{!)GL%Q#l(JHkY5G8l#)O^dBk*{-f)G+I4NEN!YGSRpBym3hprMD6{ ziGHBM%%!!hk<2+f=J8s?`rSa2ah6-le#=kpBwrrD6&~c*R4Ud!@*thCY>q><>uTlG zvzFQouTZG*YRJA!@azq*@%qo3L7va=H!TGS~XP_@Olz16jmZ+e;&OUv_JGt zziJ~6rn^-+ht7X3INvtWUxtdF}cVP3ySM_dEu8l)=w>|k%#@j1-eVq;^ui~z%_ zSuRW58;^B{WqSHuK0OwB8RW zGSE8)g@gf|^jka#3?kRa@zfKvI6hBc9?3V#aQwrAAcH`_hO~h z^~G}G^7U9`s@m?Z(bVJwM+3M3#v{!P1_zD{>S4+<50BW6poO%nYP|k18WJEE>tW-U zL8kC1CN?I*XaXs_1hCerd3FX%CuWpWr@@}s5Bz5cQzdW^aACLuJSBPJL*qjyZXtvp zj7zbE`+$9qU_rRcu8eT;)(*mh!KrzeJ$L=ED~j;GY+;)j+g%F&+zb#G6!i=s3{%$V z@qaHHP{12~D$$Z?mM!oKn^g4q@Cd>`1d)*^II&G$!QNRq;PP)F&BI+nBCCo6p;Qi0T0;pWQqf@9-05A(R1cZKq=^CtoLjz^l0g z8_4ecFh^soDb1mV*mGq}Y;A2s`Y@|t`{)aWW|uX?aOp}}xNwc{owA0FTrc<9UEhh# z6J$7y7k;}d2)Sg#*UBRgohmPU@-yYa!fN^E_g_NjL$Nz*3{Wb!{MrQ=6abd)>;fa| zv$i`}{^YN|i*WW*xqf-MOb;C?-}$?@%CG!NDW7=ulV$J+SB+VQ(B9osJCLLED@cxq z_ck$CfQf?LjWVg0@!D`%S>54QVJ=>qodShM5Qc&u*f`z})>wrICl!L7LKo|YHQ4MUGK3otu-B%Z?A9HZZOF+Xuy z*JZMdk*vG^_Pad~DD;l9^wHm-%H~I|cpA^BhWH+EikNs=IbGx#f8w)?W2Uh+bSGoT zv?1)o&vB9()C~-x71rCjiKn>%ll8J3PHIF!RwC!yMyVTPGAHO=DuD$Z?DSAn1%Xc=>Bbd*h1NB8c|CiTRF@utSn5W;V7 zLXSeNMg=0Tebs#g% zA5B>JbSl!MuyVNk%Ge*3zZD0f&l@=0sO>el1HL9=%_B}y_4wHfx=h>dzkIK0g?>im z+3M%$nVO7eld36Y|6{+Bg<&~PvcBd7zEBYr8{{A5XXPp5oi(a zUYe8_paCh?sM|ZM#Pt-M>ppp76eQq}>zy5wljE`GGe7V7@U-m42BzPjQv(BR(5y33 zVWqc`cLdE*10T4Js5nJmc*;FYD3V^@UbqUfsILe@zo!xju^S|ddx!8h*!YP7e%lAY z%SSG5nlK*s$n^!h_Xx1}E884Ki8Gcd5{YO|ykUZ&sYs0D7Gl+@s=>CN>KZYfdBiRj zUfK%WV32H~-Mh*_QOoG9x85$tAuz{}rL8~*n&m4bbTO-zm1T(A4pPHBE);`NL5%p{ zckdbk5+NO=owpR?%PxfQ7g(nd7-B}8fPK92rH5&Q&`EF58s(U@0+j)F#3b9p^kot< z@}{p8WCV?BI?eYaTH*#Dlo$Dhz*fAmkmi@wv}RF;rCax)bEdN{&9}8xkP&fhL%uaJ z(!aLbeD0-FYpyFW%SH&ts4LI3afT3v_t0dIN!7~?x68)bMwmHCA?RRPU)c<8-OE?5 zaB10c*;?PicO`sy#1qX@SC zpMU)Z#s4^jmvIZCwE?VIyM%YZ75^)kepqGPt*mb%K%On@Oo|s5*30=T%jNk`eY_m| z`VY%nm)Bw=W>Z0#eal3t;Erh!VeSz?42!Wvdg){tk zEZjGObNu+FXW(h1u@ZVUOknsKCq`X9WBg{FGQ_`k+jaA=Iq&yrMtU|cqeQ)|KKME2 z&N~}b)PI~`(75JlWVL;DGFtU#oM602$L?dmGsm>x++TWSEZh0k_vle+T~oKXwO9cx zI5o^hi6>^p*$nmDjfT{YZ|E2JXbWiAsHS$lF*CM3-L0Q*{@S47 zv+w#4=tJPXLEr|XuQN=Y1rEA>Hqtx6HD-Nw0&ehPyc*YMr_hMsrwum%+k@!c%v%*3 zY@#!H3Lmn;&RYr}oO(3RH8(v`))v-?nCk<>j3fUcPvv{tWf;+W{P)G7Oy|RHoCYrs zq9^gFh;wic-gfglBvCi8`)0Iv;Y{Wno~}Oq$_&Hj(7d~GlUr&8!dxhAvkk!`14U04Y@*lz0YjKQ%B5(UdfP!byT+yATpCF_wR7j^FeN%Rz?yC% zeq-bC+M#qLG~8qnPUf5RYX zE{YZEtfd@G1t7U`*A$eoPkT6fKX3y0cEbd=zr=xjW?b{Rm##11y_e9v4|zM_!?}aR z|NPDcY+anzYB-?U>}ICq?=5i6JnOG6lGoQ64CLp)JNwpK54rCb$L+0iG5xg}DSr zBHD@6K*7mJ!K^COGx}D- zYTi*n`>%>BGQNN7q*QUtsQQ60-AK(_(^^xteg~r6o`+e`)`O)qSzB-FVO6RN9Bw9y z0UNu)vA1C+A0`#G@HV#4C+j!ktgmAazVHF*pfrqgXlS1C6$xW^~-jX44d|R6JYDQ1;CqYVwV(i!Q zq{B_&%|ncebR;*2S~cI(=~I2H-@AX>t{D4G7B}mYoXafRxh3n@Te6qt=_-wBzY7gd zm015;W_=n@S8?k`>50(HZw*A8=a};p&T8UA{Id&NhKz!C9o6Ey8~x0$39t&_GQYA0m>i}m?XJI8;taeqVQP5gC_`SVUgg-f>h zL*DND*lE2u())e0s?=V&VVY*GEEz2Bg}aVlPpo-Q z(lHe4)aI>u1b#GQqMg27-raq#a)pEVc+jU?a?}@K#7Sm(~&ba_KowWfmdSb?iYOw-JoQy&0Sa-9iZM z$ZXJn5@OV5LupTlJ92=h-+lhu7x3O^fZxmFoSz-kG04GaO(yg@2Uf)C4YRlvaq;_hT^p#Jf}{bET>PNEQ1KT%tN+8%{mzf^Uw~agGS-Qow#0x z_zsibNl_n)xY_?>tnG7Z(`y8;Xeo_!SfBZJ3Je;GU(J=28n0m5k< z`%vd`VvjQ@(BLcl!~^wz{p}GJrI5%Jng~%-7lAGOPKe^&QhFkfDhHNUI|;{N$82ee~)r#^Lh(S^&O&k8KJ`7wT;!Xe08N9IiFMjU%^5mma z_{rG1GYk3QGC=J;JY(ww+*0) ztKHm}Uw@0TzsQAakCuP?-5-@z^3W_s*;|Wa{2u*R@IL?zai6tJHQIx zJStylWcKgP%j*plDv1-dzB%gJqwHXsCT?^F@Qv}3w6qhq8K=ffZQV{tGZw`_!iX2< zP3n8}de+DohSweOh-)H&;v?{xr*UePNE7*H!;BSi<5`;+i5u^R*3_@N^|Wr*_qH5y zYg-Z?nXabqw4jMs6^}cYF^KbVT9vpkvTqi_9Opbvrf4+79r#%HeZ za(r5s?i)dT<($y?N)lQwX@ef^RILaHC{Kn3t?Do^y=hysP)~XLO0w>K_rO9R)?QV* zK`ZP0<{C^PulK5KUgtC!C(ab8#0I1jSi_gsdGba8s^MahdB^t+=5E7k`8Ue%Bk3RX z!AVxkFu!ZM_Os?$)86%G%s+>;t(jL0u|Dk>?K)Lb0jF!k{F#OT z*EVX;qNc-IZLdsWJA7_#oRg&7pTe4SkcG<_7k#I^0@IMhucsT$YH)}Xey+#q7h$H$ zn$!_xIAKwip_GGJ!ddL0O-;|hn-7%h*VoG8;#yhar(kzzXf*m_mv!XM7Uj9dZfK=~ z=@_liSnF?j6&td2eeS1AY2E!Sv0v7GfLBIX*E|_860ZGKy&-%KtFeB!nf!+N zK9~Usl@K5yXz(boB(4$HB7A@_2|4;eVW1`fh9TCHEOmC7G7$Lj-ux8VnwMz|NAwwB zQ@}_shVWL8U4)P5tnuTC&~PL)fSsJ0cnBDG{VAM;AevvruhjB3?m-vx2%X(|k}i7w zJ#_wI_*6@-cqP8)?j7)`6GctPBqqcp@CsLv7M3-RdMshW;PT~5<;vA-XwP!XZpoZ~d_R zn#0&oi%COGUi&B-V7(;m^cn&qL8Q+%yN&koFoMo^E-sdf z7fX5SW2ei}>EUu6O^&_M3C1Iuz|>d4wqtpRvngzDmVxb+^6=@oGDb5moWDw5_=WH* z8W*MBl|RwJH_M5Z1pP7&m@6JToAZ;ua)LKl^Dx>yoo9#Jqw=;T7zpa@?y%0wCZlfy zLg96Xe;Vf70x4fOTPJ<<86NQ^t*d<_^CIp>kAXK4pTOEKo5QGx#O^@*+Bx|^+T5jf ze9}+0r4ia@X<54Of>P!s-WgU=Lw6ahN#x0^K(oN~#T#6XB*WSPFnD~VW?9)uu|9d+S=*2s~d-1$CPR;i)f73=U*iHQNy~fMDO>N)Z+|@KSR;HDw z%r%bwDzoU+-gSd!etw=4iQ^F`l(7h}ZK*=vNN}(Ibk=IU?E?ydx3|Dg=ABrJ(Fc+W zn#xZYY8ThLe7OH*l8ct7M#~&F!)InjIn~A};JzAEs-jh!+;L-@T_-6@$~>emu1iru z+FWf~Z(Z6yy%q2(AXbnJU4)n4+2PV=)>MPYD25RBo<1{!>}sN{EN_LdcWDVz4lCyA zeJ)gnVzTbd*fd)z(eaBHJ$1K$M@G706%1p;xY8I>`H zs1-)#9RcA{)7`wbZNgKDhko^E&Oz2BE)pQJS2bSEsEtij-5Cs5XBNuQqesISxHmp} z{8T1mXVaZ2%g?&h{IjzA>s5zFeRfmrkJta&4;djVjR|`(yfnSlJP}Vy*g{Zgywu!n zHl(6oBb>gH$;iGUL%z)~?MFJnkuQC2|M}jPIcF-o989GfdT=U|ziS~WOwVrp%1Y==m<9d1i@e}1YzVK}M?JqsU*e&I+e(-Af z+F$*k{P65Wv}-XGKY5&s&(I8BzlvZF_@jlpjah~)!P+WuRfy<2;}Bu6P#)yiiW66u zFNlc~4OaT@^7V~!_MOY+7oIs@9y@ciy!JC~mC}DqZ1$f$X+2UvxK)l!mGZ=6r^+(X z-gx^e8oX=@V8_i1px&Faz6s;(XLHl39_@1sXI-*5?Z38NhUFL)9QH93AgkF7@OJu6{jF0wqj;~m z9SFED9+qAOu(iO>9MX8SH6Lmm@jIQ&GcD|VH{Px9&TIFjW)n~Gj-k-xk(*wfKC(}0 zQN-?+lkhio?D`WaX)c>*kiKy?LdT#H_N!fDZ~L!iW!?NlPagt(2)sWKkO(^> zTLZoG-t{|pTexA&0SMJHZ8z@W?Vt>c$v;h${b?fj@WhAs*0gt)>X3~3ULRlxIOjM= zIuF*lQ9s}Ho1H>%GChgiNiO4dvSK1io*?-Xal1Qj-MpdZd84?!VSbBw7TI?Cx1D_2 z1M4bJ*fcQVk%|C768PBm{MGOLQi&mA@1q6}ES&Cf!|HhGEhhWpaQq7_?FnkfH_uS& zXyNnWV~Z5$byS^61fNz2~7M= zO-`XXJcg-7POx56k;@C-y!?EW{9R*_kUWJ(P`2ocrq$`$eALIGo;C2UJ@>Ev?pn6} zjP4Hva-moeyb>6nE)?+VRJM66H4q-+rxYO+O0HocbHGLW3n7 z+1K$R4EdLWI{YC#`V30xgz?B2>W=&n1j$+`3{x{u`?-4_M;L{0(U)r6D%6eKT$B(t zL^|Y$=!#-%IkLlc7iJt37^x{bM&Ph!9V`f8g<%nw_-2dyu7OoN{6lU{Rz9k?&-{Vc3eTwJz}seZo&9NAW77Ms;tt+~x9%pE{1<_H_BHmtVt%u);=qDC$o%wSwu#!GZ1a6awf+*v)+T zwUzSb#TANR_cF9W14@+nE?vO;#(9Vj;>QhLglGRK?3_SrcXGXRzthwHoiE{bZxrQoy)SHfL=TKzW9gXUnhT(Ii~!! zoa%3yT3*60v#S4uMac?>bztl)p{F+7oDG*EnA#4yS})@Jf^>MTF&%=Tft)`{=}Tc_syJT)OdBS zyIK5x7-P5%?--xSrP&MF6YvT0dCeESlwi9>U-V(yg~09LVvTb%43DseoZdJ-Jw?QJ zcyFF50JeUWHfLRHn)o6pF7j^H3i66--XBATGBZ8ZU<3F=Vg3{Vo4!5HGuM0lx79k= zn9bbNtw*bk%uP{8V(p>%6xz3(VjUgjbSeDw)bt1^zo*cgMLT)W%hyzLF&+tA!g8OC zC+9SoFoH6ViYme~!RQ(tSP)M-<~>iAyoXRjHab{o>*fpani!vrv^%WDgNKi`A!(tD zmWeu4$>oY5U`-oKsr~|V8%p(@bAo4Z>6gBA7YE*C% zf-5H?Mx6pdOHXaZf?d*$@-_mjtJfCFNo@3XivoJC-U52?ZYY4lr0}wDok}NuSNSsJGsvwuJU9?3*W0#Zz z2#-d_r^?tA+N<=t1WkcM(lZ529C7d#c?HL9XWtSRQXRgoK`hFeWv^%dcawBOGgfVb z&-!khd*y7Dc{jBKKgH=y?B*)ey@p-gcP?E;tCpQd7~~O!Gr|KdIWD!MiV7APEcr7Z z^H2y3EXEMx3<1JVJo!|4Nr93QY>kCwY6YTc?no5lde&F(I@C?2Ji%n9$gzv(}Lvz5M!FVmw<;9zRkh*d5(* zchq>~GBg;5H^OghWVbwt5O`*?lvmDPD%Uunq7ZSL%iFvp?%liEhwm;2Q>&q>sRd!8 z{Uimuv+QiE#T&GV`nhRgA4*%KRSH3aPQeVlSC=giKN9Xfdt23DPlPDcwa#6xyN2wTzs9lg=931ESpXEm9D zMcTb)YrqRF!G#!uz+zW~Ku94a5I*9Ou<>2o>9`2?4?pT!TPPDFuDqWv=NM{Cd%CXs zo{QC1TZlvx!Ueno?%kBW#T?W`YQw>?+jf>xH7fKsU9CsNwU77JE6c9)sL!xpPg?7u zIhb=%~dRf+N4^|lIq*M~qK0{0aHDTwJ7dDwvL@vHQQL@}1z zv^Fwo(;44;(ziZCj@vD~n^Vw@8bBVcH0gUtzBPLP`M^M+&VO}o@>%CGQNkHqE#8%h zaV``>zza|0rm5V?HoR_o`l{)Crhm?N)&GG3+I?+E_JT$Fmi$KYSg}Tf_tQ6dF8|6s zvIdZM!yUH49RdA6cLagN=_Hc*S01ZNhr_S?nRy2j=2)mHYLPiUTFGm`zC4>uI$;N1 z$iO01)YB{jogTkY);UL1V8LF2YlA=>;#uEX=Q`dG{zxm;rR{F*`d^PMkQ(`VGagVFa!_Yozjotm`{)-b-%GhO*R}9YxTskT;ZC zs7R+D$l6s+&@vU(gp0-TPsPVv<0QOxw#-mD8LCnUnbZ6o$}}YK^rZB26om`dT-)2) z;l<3M0`?P=Wqe|^yz%qiMh4xbAq)?|b$4y{yjfRh|0z z-T?$8@L`h$MAjCdLJfr*9vxS;+=ZjUm=HJxa_8W4Fu1$naq-)Ay+p%-la~aM1Ml(U zm0=WFiqa8>vI518&%Y4#Vx#xMh4W|yo@#cZrWue3#`ujwxZ)O9h?)c2K^EG;=IUUz ztiFR}R1%VeFNu@B5;ULmMKk#%J5YuG8RmSk4$+)EavWQ*+z3geJ?-O?KIq=aWC$EK zh_eIkc$8eoW2uHG1a^8p2%&j|El>i7=$pYYcHd5dd&KubusDJa4vtK5^muZnY}21u zzd?H#;T#&QV-U>MMyNFbqZxKBhe)3-XnH#F)=42;A{4KUe-o?s;rLJpBZ2P4-yrmi z4>eW;YZ*V{F3_W0{%y*_-zaNq>)6%3TCQBVQkJo^yTMr7VY1QgtGlZHtj;!?$~)q` zlM5cga|AoE3U)#AGOl(W_Jy!xf)ISP{P|!1q@267%=c0m9b71%{f$y)*(Dr&Wtq6s zp(wkxv5Bx9_<9c-6QYXM+<=C_k~&~FNKMYsk#U4VIT;$3wn3?ZFk{yfed-uH!gqXX zro6-WTji3_k3IHCnV{^l|vy{7)@+f2_<`T(YcOP*IKu<5&=Pz`p^sozxf}e{(hXs6lV8AF+~g-_g+4A}d{QPE1E)ce#QA{dAe$_s z6H{g8$gwgzf2@p8P7}qs0=kbt7%W6nKh0JEk$|1^h4jO5lM4vT1D?bUoQkq7jJDkX ze3kCpTUt%8il^3t+8pMxe%Ab;Gp(tSrS`ZRJ%4ipmb*2pSvtO+} z_~GShlM^tv;EX3*obwdki@U~29=cYd=H1S@|K5i{9|HFq0+rS!J(PAhMx{;6O|byY zdBMe{P8uQIkfz3IDWbG_&UhCX;8gEQ}aL=Glygh{soWRb0uO zvYt&|9lIG5w~L$CPM>mIn=Q^c2u z9hP!mHn;K7%0uQe1SmBbs2joEI8I7=@smQgQeJ!GY*|>iUe263gP`|l2)x!2W|?9X zZL|?CmD*-vb8@q~)$D{NRN`Dq`zSv5^}gWlaO_Do6w-7S1^_Veg}o-biV4jl4w6v) zH8vi^r+K%7@DFtEr01c~GLCMU|L4-Hc^(>(9%WN{ez#K!+)vFO|6xS*Y?WOPkpTX&5wSJrZ7U^@uMhS zqLGUBrf{3UM8nAL2zJxl`D9$|QZAakY8LOIX+4A{_R!d9Sw&E2ee9@uyxR$q5s2A_ zZOlvTmN(vfyPP_Hyv$)==*r4kSwSmzm%bbyA1fOx*UKcA!2QA}KUt0*n=U{3yNl(* z)iq2*C@fZBE_Nh-SjxR{_M1+4S8YwrWat#^Zi7>k+$MVjP1OnPBnAG_mpPx>RskUP z1t3IUJ`*<^AG5k`C!SQgX)b(*i^aO{4Sp+}i=#pTCr21K2h4ZbRNIk};C%p%>D6nO z%Jr*gMYCzJBVK?q3jQ4{j%9^?=4}hYOao~h5;7ZVf6A0Nx*X#?Xg4uqoY6y@yl;aC zE7!{6#dpd(;Pn{7-q|DbFjObY6awFo(MdLSz+;M46M8%71p;;OdIatL$|%~-VAyzC zmu$D=HJX3mPa94L0zXh59n5%_wQ3OH(9|{W!{Ri4b|%0Sj3WTkQvg+HZ~tcw#_!_Z0%tH^*Y7gZm06NLneO9%HV~xhs_yf-W+`<;&ej+l5v;l6RQD zrSrO=nH1*0B2QhD0c3)p6su<+-j@xLgIjYV965f)WcZ*G7lu6%p>k zpHQS}c+fg;MLTJW>l{rksC2l!%{rC2%k{ztTDzJn97cfq(3#_5Uw3Rwc@^thOgCbi zjHm5JvXFxTKN5y8R(`kkgblR)Ef_RwJ3~6o=n=&~?X>3QTC)22tUu=GWDivf*hwJ2#pZDW$U%-1mpnMO@=n|WX z+uN(44k@5eb-YJA4uJ#r3^R^}o#1zR7>PYng-APRW#V-Q`ui~wS3wH!Zo zEd;&Z>}nqC2+T0cLY)zCAWTzel9QXlr4$6VO1ekw`S4^Lf|sbSP)X51XyXO3brG>! z*4I|!=FONKWE9W_HTFl5V=@1K!}6Tnj3=8$W@}}kF+6n8XCu6;+qQ!E%7b! zCiBhcW~1QH`h=+w#*2On*B3D*as)0yFG5o8ZDRB-J6L z+w*7%TFnY$x54pYj?52^V~pJ*{e!<6o@=N{Zw+JjU}OSe99p=*acgU^T)(nh&am0B zyS9V|FBf2_5xnd5p~ORgyQ)czg7B6JatKY`F@!>szjM!{KaeKg-<@r*gI0*xUg7ef!7lD8@LY+`$QZ?nHVfz`P`??s{F-w z{YMZPz_=!doZo1O5WAft4jpdtALz7SIG=UtQvYz17g{ zR*YPR_1O1z>zs`t1Mi;2D4Rc{j88Xz z#Dm1ugl_(|t-6GFv_2TxTbC2b`hWTm=tJN=L0}(EW6>El^&P1)4LF}c6LJ!Qe!B^q zE_erdB^=XP{PC0t%tFj<`qvW@zMEI_9Hx=h>SsvOc<1C1Xol%CuAAr30_eT@jCi6S+ z?-qI7?cm;WYaM(>9pA^gwcA?jll2wal_!A<6Q*>}2Br<&Xdg#&w+f8p?E>V@xNhg! zf4?~dDlQl+z}L{!b}Hkz77ZBJcs$!_Gkzvc|87RLThcD8F*7XY2EHoW)=iPQ_5L+q zal@a&-dWa#URbYl9UCSZdK2BZ@2r~2IJ!cCZjN?Dj0a(=80s!+u%0O%T|O`$pwYl7}Gl6KQ)fSato<^0+y zD5B}tiXR=vchpHf+^sPTJ8-&ngpWWv;Rkt!V3LZT@r7mGIji3iEZ^-1pJ_4! z4HN`w9`}x3k93huR6xIxjzB8w6if@RQ662njevPjp$73hZlW+M>O=kFsJRnG$JsJN z{p)+;SSR?9m#Tp%V^ncOoN?i!(}quMgb==tU{p;??dx7gz^m5n3b$;Ac@yFWb0wT` zF>!;NGYG~u5Sp*E%RYt;pK(kYIOz;C_SBXf#U#bKOV`kPRd6=M(~B+8O5b*ZU~*81 zx3yNLITBZ}xw*sSaP8VkdE(6J^3ds%W$^;GSJmzT4nt^Q?hTBj%~>>ek-wH<+OfI1 z$h8n+HS_Q#2`oT2FlsDFA2Rx!b#9bM}ZI1lqPi0ut;kyWEt!QQAxlfZ+G z)#W&{p8^2JFgOsV9cV(u;Sn#~^P7M6wGV%k%mbk@o$YfE;c{rrN4Ofh=*_cJ{`%j3 zw@lAt5B=0bW&Y^NFrl(HfaWgs-inI_&_p*s;2$Ff06TVtw;J5LY(Dfl>sH5FZ`j@c zwn6XC38VYtZd{W1Z0HE^)KtwVbcoR>l6O!y`Y&Q-Z8Nub-|qX<=6)%C2t4=@Q1dqE zZP3{qlX;vswU2_XOD`F;{+t`6({3ue$*W&dYDRf1HlgIwaeaAuip}uk*GyvwG?=*{ z(!+BYW|B;nbERn_L*r*5Cd5Ss`6|O6lX!mi|2}vSxY<11ok!#m(#)6_H@ODeTH+$z zyX2w{Ag9lY+jlAJn`YB)dvDq8u$yLbj{_Z=uBUWCN`fXhMj6+^@1fj*;K+5+ILZvt z1JyMc<;2N;Gi~499s~~HUyB^}=1|Qt2)0{nBCP8Sb`4vz=KFoYY1ZxXu)2^xiML{?g4Ynfx^D5J^mX8mC6J$9{dW^Qi2eDYH-gndts`)KEL55{4KWBncpw-4%1IB&av&<}iZGSfbh z-*uu3ypb5I8A!3+UZ}{B{T#Q!H#ldXSr_q66j0lA2fMMWXsvE}VHa)ia-oVJ+P;zZ zF*&|bioy<^bl+q|8Y90NyEsg`rwElh@?qsPchJqd0Wo+v%EiLB7X_#YBTUU+W zDik)Z(^kDWP5&562x~W1)%X(-E|o8T;WUQakC%-%-k}~a zc82e+l^wNqu>Z5YHxdHrQO3m!Pk+38_Vdq_=RWy3c2-OICx19o{`6ZfA^n|1NayY- zTGR-4fdGp@@cbv28o1HtgX*L?C`nYRqmJ9hrmY~0&Tvc4Tzv~jN2fG z4(zZ^pTb+F2j(j`=G?q>AuC->zSwaOjZgwupClQE4rj+n?{DRdsmYX+ zD84D+4MijIgP-ex_s!85=Qi7AHN;=%9an|}%z+AS6@ZSTi8M1aRp#fXIc+)4I@7iI zCPM2q;xQ+(<{1F5113&ZA~tvTm}7PO;1ob~j=VMOYWjW8PAAA`TYk5kZan=O|Cm5q z-w}zjZGW7ARta&OQ>5M-grXP==FKHc9RiC^9+B5!<#bED7jJz5@4bNPea z5eywq$B0bhG{MK+@t2gcF}Jubt#NZ3p8dZGu)noBoDjp1aKu0zP8PFbde zDe@+Yj45ke1YZh`AXo|vnb>_c&c7>zi0Gu2294bxf(`SjMk zDgJ?f)L!h+tX7LVVZeAAVc1hoag+c`tmdxTh6+@Lr#o0KKCa8g0+3chzeB&6R#OlPmd#fa3>i*-PD)fNCqnPXL@+mu<|^?D$JJ*h z$7Axcj!s;f60i*l_i9^g-abEZpcQD|ZKnpi&bH`6SW6t+v5bbUra>-aU-!zD%OU&~ zFT-R5acxTovP_773Z|(I?@uZfIVv?kWs@f$>tJcuy&{N+oORnXq_W>0dDV|qDo42nTvo+{0G)} zNGBM52mmqLf&BNxiFp{v0d59G_>5VA*~!)N8^83`^7vyT<==hpO8MbWUPZ8rZC`B) z)3-Y$mxc_R&wh{#t-I!gc`SIDWEJe{>_Y{dN9N{$6ZFIKZ4>WO9`Vnoj8MfjD=8KQ zCUxoyesxy5k@X$@5%sja#PA5A+@RwKo6ReW;M4iHFtu?pgs8jCCW@OEYWvplz#t5P zo=k>gag-ImrW}T0cqS0yPct5lA3ar$&d+k9;b@uWwrejToad4SPdLo88$Lp>C@2t4 zI$@+>cO%B>Zdqaj;yPv-E?l}=&hxu;^?JF=Cfc_!?+XMfpOIu2TF9Wx#jfv~nsRd- zz6f5)BdR0Jts|V&kp7Rj87vO~k28tg_}pw}f$LQ2970~w&-&X$kzs>LdUF&03Ie>z zrk&=?r1PT)5jYyEpM%4<#qy)3KlI zsI&wg8y?ORgi{lfK_}$#9OKC1iJSahG6nahb`M&vZTtXcK$*X*?_mDn&5T9G{-Bzs z?VEnLV#qSQmK0C>+l;DbJ5%1xx5g6}oFg>N;MkOmr~TzymD`i)J@|}zT2U(Hi4sjY z#(IYLAx^U%Jvz-LYSU$Yj?=7~X<$vNf|=_brofo16z&QLNl}Hd+-{{E_!4fTZ9oIJ z4&ZJ8K%*XT4ZIZCQhugv@{YLr+$g^$ZPcY^%$l7xnqqrb1vM3K6!cDEx^WX3!v_5} zMwM%x^+^J=vm@`Z>kD}AF@W!N_I1Ll1R)0n_#=T}#+D#R9O^N1>yvSkkqi`bW`CFN zV9J9?TL-O0bZ|Nd96~%8P%rvY`_6%HJ+(zBu~Il_GZc~#8K^ms6rMLWhFJNe>(yB(jlHb{>`TvyW)HOSw}T=FI~D+uAr^Eh>%Oc zvrY{Lg_evA2shev%s{4hb42D!fuX`~>+d`Fl9ic(MKow1E1&<&3+36Tp1_tZvTDrK z{@`z}lpnnGYWbVLd#${KP2H^lZrEg@7e?fFSFxE3zN1AwJTys}W0+y!cs{$CW5l_> zd@WA5Jp0sR*pr+@L6 z<@^;U(1GbPI(8%$c$;Vk+ut#X+NlVcgE=4%rrWZ%&SuKx)iQq?CUR=5EN(z6c2>*N zj~p$({^b|TJ6Le|^S}Ncn!N~%hv(=^phJGaWCB-FLX5drPTUQ~)^d3l?rvI1*EFqx z8RP6*SK6^crY1aVoy1Ww$7lSatMk47y`2_V_CdGD!g~#kTz9bd(AecNJ_Nf9moR0) z1$AY64Z*)V(+FV^&b#Q}!Gwc2B^?`6pt}byAj~~}Y`%Q#(KF=}Xi`7+$mw$O*c<}h zF>Y!_(95`(n2=F$!v&3O{)wB8$w3(XXd__^?ryu$9M^5{i~$aia_9;042^S)FE1{y z#0J_`E(Lh$)wAUt>@dG}_MLL^>N571Nwd09F1)$S?XYi@(;s^pMew;YJ~IcYm`2cx zIhGipmX13NEE)0<`kUA$KHb)<**oc)6a5}j+m=!j1A1`$s4G-If1#i z6%;$xHyPiwRqi1tf1!Q9>S)a#d{-eVj)Wo^P42~){Jwp-cjO+eydrhaU@_lbTy@Q= zQpX$$Eh9`GuHjSYtNf#`$={!TiFuF4#Xr^{1FlmsS2xM!W8UHN@WaP}A?uw%6vbHk zDD)jhxk(|gbJzg)%BZc|fhT!op0=z0x@{x0`Ka?&eRkvQf9vg|<{LQsmRxy_Q}gy& z-+eW__lFnt^Tb_*IoF~jGZgD17sbj`tQ-EuIUuJXf0ITrzT6wfYOReRO`|%MX*IGb zzw48gx_4E(Hw}K!autb0QU{309|VbaJff)+UbF_Ixy7i-3F{yP4kIcDW8J_f%BfgE znepl%^@W->^)R)5ZGvf#$LHf>q+pKKYG9WV0;c51BlHRc&tJH}ss~hSHfRmQ1o$Nh>MBrCN-h=wCf79 zfc{6~j9o}SDGZ8y=p+T7k_3-x>ynt)aCe=-EjUCi9w5#_&ogUf47G7X3K;41;pe1; zAj5@-mwjn(baDv627Ut^2@7)t3ROGhnI91&TZLFOAa<~+Nf20qBe0egrDSx=r~Ya* zUgct|%a<=>6ZLx8+SrWpt+yk{YJ_2UYN&RNtyBxv%?FRi3@{-LgKI;WNtnP!>Y3B0 z%Euo&UH;xzUMx>OGE}^w;HITMRTPZ;}Q3^1|hE3Bm5QOXteQ@&Z#T7YEAd zu&CDz3OSQ2`2oA(o%J%#@ufL-d5;~LEH6I)LV4yBkCmsN`Z&AXGnib^4lBX|^4?(w zSnaPt1phnWjJB*s!I=>@>;?e7ivTLYILW$Xy{(&LEUFuM?P8*Xq65dhEqm_RXn7QS zyPG?w%a_0OIc&7EnYM5p8|atHORv3Ee)O|9$}4YPDwh{8mv>&eSSIIAmAO-omYHLx z%P6=!h}Qis_^XMP)Fu&LS)L<_DuzoK+j7T~^-8!I*ZK?1J>ax|4C~uuV4~K0_?kBS z^N(qpqFcWA=e5=&%Wr)}o%F3WGfWtOTjAxmP|;TNMwx)Djw9^XZu1_RR5d5V002M$ zNklInv|rPaNhhDg|0baGs3mtie5uLzc{U$4K~`{o48po)*PzVo zwxNGmzGfA8Q1k3R`w+N82pquaipaOfCnql=)%avoU-9kYd-e2Le{u^twUjoYzdi>; zF=3ojHB)Sqs>w6P+%Puo{RHqfjCD8qazHmiT(a{-j0y|RS1#IX8Pae4JfY&8rVG9Y zs$p0Pg@?)`56?3vI~Sx`p4F8NY^bi4RfIuXX#7T&L3^YV&I?IbqJ8EQVHJpYgsV?$ z6OkH!9*2$B8;xyK9f)7cia`JL-TMduaVu?PS_yg^1qRJB%uG*~qeo`SJL{JMM-n6C zdTRgq6rbeBBPlrP3%M9MhDgQ!uCf`ylyJ6KdAF1FQ_wa zeOABlX#Kg7e=AD7?w|j%y~0Jezc!ZH{t-?D$6t&~J`DBm9(bEI zMa`SsQL~29fSiN;Xr|A$Sl;cs{WWVk;`Wn&=wenF<+JvGg+hI1vufPz3;k;R+U)(` z-S{=UK6{0)HC=s*Al-SUrqZwWh<%)2Zn#Wwg3mnTbSsKfVLI&w#qV!ZH}A~7{kFU2gG%lpXyNOd%cMV9|+i5)g$V5(BmVJj%O%0Zm1SfRTZa({?hoGcEn7|z-GlhU^CGZC{%)rXjs=?$!_c}-EH(o!B zHsg9ZbLtd3L})(3jMzRgHp(Nes9Xh_3g|MQm_o^$z{KKCr2?lrUmvm;K_$EbWKB!7 z(bT{}c!CH)bh2d`$79yC?ct`B11N&5$ZcE20WDVv|l9 zVOjJ@CnPHiQ$yKKRHLkQhPfzea8O&Z?DCPF;xyMZw!vPEcy$ zXcKq{b0J&gp`dOEVfgUYVtHhKw0z;k=gOD9__^}Lle1-$bU%M(xhzi%meyn=4QF{;yUf$T0y&dvpna$s*1nWYyA8t9xA`~l~0$?y!bR1n_)I(7zm;TytaBB zK_B&C*8}WfLjiw&+HO?4dytKVpk!#i5ALE3Mqh4v11*fzAZ?aEQh@IQK;di9JBEmY zU@xAt-kKfR+T_?D!iR0}WP^9*4^JK)E00Xhm(M?crY!x|=gK863V7}8h4Srh|G2#J z#)b0gYkyUi-kdE*&wRYho_wN=PM*ucaE;wnw z4D!>Qgdz`&0YjH4cvOuP1s?Rd9pRV;32cM!rc)S9NZ?8EfWC*5QV>@}f4>|>TQ|pm zLYELY(;hD&tXQm&WfXhZ_UjP+qNy8?!WPE#+~fwD_>W+cV-z7gH<+&va}nQi2=P5$ zy~a^&=Xl4OKY&fXmSw5AITig)4fa6+xcOb@QNP;ZruS#w<|NqV7jhiZntkB`{U|qE z%WL#iZ9Cr`*Dj^;?DS7>82K7zUVYbxz@0)M(59j5V0V23p~xw5EyoF8j0YEAVyyFq zcqi^xGd{6!4m*GfTwJJm+5(yiU6$u?xJhjkhQ)>&9@uuePLkoDCPu6FM`Czath87WI7MtuG z^S1~3cN_=OU zgZ?#Mj)`3NR=-TW|8JfD^tHa#-7Jl9ZWSJJXz-rn+UCX_<|OL;Osn`#p1?rIl4ZM* z!;hytqJr;1?$Qum@_4bPV!g2r%st(w*6x{y9>>fY+9TXm;$^t2yH_~=&3z7xs}YX; z49H_atAtmjWwo8&Y2*5Nzq3BL>fL;%=Lhev{ZM(4!~3K*`|YUI~MjeHyU z)V%A{-lJf8#zz-Ok-qaOZO*)VpS3ozE+GoDLE?!4O@7%f=Njf2#+|=dBQ|X|Px*D{ zl@r{@GL0!ed1l9+yu9!2y45l})eDdPUqQR^@6^{|+Zj*WW0>pj9GBKD%OHYr0?&Qn z6`UPq?V%D9dLwB4V`mqW3^OyBT4YVLyM2v%I=_kc;=eG^q#jSkh#6{NhnGWKO?xn?o2vVkv1k$9MHI7(eUn_};{(@Zb<; z^H5qG;biod!U59=Uz#h7ZLakX{A%7Jn|t)fH6+eTXXT@#qp+-8R{mh=c6z5n4hHvq z?iU22-=YUQB}SLV7Yk|@+L|^vhk#4%SqGZOtYzvX67S7*OS+?cM78Q73;)!g0lw!D z2)mjfsgu?!cA?H+xP-uBhZ_q|!^|FmAbNzTnFJt^3iUS8&J>Sp`?>_73#Tl>vOeU_ zhT!s%fNi`QzYISZC*#V0x4WYgJ2I&`b$q)ot?&@WL`ZM^LvwCoO04N)I!b%L)ZN^X zv@Buxe3;`-YUhee>&w@%Z+aAA=m;9Lt7wGIk`MR;p@AOL%~ymp@aCT7bzQsdZ_ zj27D_e*ULDs6gVYO+YQCIXc(qLKt(2!Z!vA0Y z=l_tM(Nezljh~i3{x{z$SC5sR8zM(%=MaK3P6%@> zY^*Ou9TaF|5wN_D2JiK2pTg9{<7Ms2ljV2*-j@pN!}5Rq@i)uTCPF}jluk?v8=3dX zLH0Bk$-e6jV>BY*R)2a?rYF9O-C#24gvqICG@>TMOn{~;3_Can9n5gQPu4ezA-#-O zoda#34INNOO8zc>a^oy*Hp_%7m>WWnd;Q9#a`m0F<=PvsmTAl{jI)s6Wm8~kT(cf5 zs5h1{!@+I0bj8;CLK#P}`_(VKSbpy}zF3}mbRI2m7ZZS1~*3#@J)vXyc+@t zZNbB=sSt+wr!Fpza=bcT#1%)L3{J8P`Wicbwi=TRjD^Xm3ADOa=rJ$#qYdK|WfcMI z+4EP+AO5Rwhb_) z3UWsg+KZo?`guf)f7UkuR$mDVmd-{uem<)6{e2bgMnxL@w=SJ;Y8_+UFqd(B(>cSjcst+<=TpjKXJ*jk1|Hy$qVGLS)og8Y!?5SPiS98r%@{f7d2!wbuwG}wYMnVw z!Mz*0AsDBOx*2MjwJzIX!-U0yM9fLiFaq-@?7?xog|lNgqC}jWb8kJa%`;2m`(N$Uo)8n~KUn80+-42$i_i6I2M^4JQBb7OdKkBKuJ^?+{0!dChfVBoIc0jA8!%=tX7{nq<4?3LVHNqUbcQkyB+)iMwez)4jSKr+~2*@k6 z;U7Xq{Gk5)9Vo}J|F4NP6>N6kOW5I$-je@{lYN1IwZ8Ua_Gw~F)7Roq<9~Sn*Yv&5 zX8hpon5|>F{jBf3DevER)5d_K73JsT+B7-p*Np#+=^UGzNWxdeg((ENo6O}q9A)_#tv;Ct0wgy{+kmeN;~KXP6WN7#?z z2mS6`X61}q1^N-~CVy&Aw?Pr@ZPL^_xaQIMH#JkOPa`9Wx)DG^Pg2^jK@}OWsXIG8 zieT3ZuP0es$ZMi-h4KtX7D?bQTM~)0b(xXx&Dg->Ca%+hh?8G!IJe(#lFc0j-6+pi zU4pI&AKO>k*|asnT;r!pdT5?a?c42+xHab8eX^opA)#vuq2K(V9(H28W5SmXH{3r) zwA!r(8`O6n7zjutWcKEf2#q5^*a!_iCQ7$s@ec;K>BCA~x|I(^;PXE9Z-?4;Yf#^! z9YNTzbBUm0gQF`hZnxOwlmT(q*|tb@#7DK&x=e4)r9N#}64C1Opgx7$t=#Rzxm6wq zairqTVJW+H3gNDOfv_j&3CYA)O*0Jadi)!qFPDG~q4uXxGz3I-qG1AY2T{4mC}CUd zA}%g2mTQ<{xQZEuWy~*Y0sq`&sNrF{DNXUf^PzlFA^_INl_L;G~`x7+lN-=wyXSwM0-7jeAYZm=wG50{tU zS}f0ht{?;)DAU8MAwj2;4R#?PqcHqh$X zM2m8ZJh!%3q!PZdjFu{61rk8Gn$k?nm~z-fkh!rvTCS}i5MSCZAAjmeChL(nTJz8T z^-JY@Klo``A7a-y#K4xJs0x!RJlE+b`vY+v?XUAhH0!Sak#Qa6qKRsEH#PBP{%?k7 zx2^^(5{jedeokF0yvC0Kz*qi$0FFaR%2LbA*o_@4UjqRYNyILmHTxDTBf)?)X z7Sw80aVYRbcsxRd21f|DpPG4CvsLjbon$j$dzeiuYMENTYU7d*Ik=OYXhvFkZjidH zacSNts;?txqm7PEA+#SV?_A$4|Ls5im*qP@`e}KD3*0{U?5D~zkDts9GbDcQ{f%Ra zV`b@lnP*4-SHJXB`TXaeD(4XP{`hBalJ1rA)3bkBww9hM6LSx7vA_}PwS~4kP(__= zFoXxdkBV!1T0YTJ8fw~aGH!PUHmIk#uYpOQ;t=t8rob`3WuBz!HY%`;r>u(O%71|C zeRNcW|H(UvF?>?F0ovmN&H9B#k9B0s4AO3qOM0el?1|~2a{Q$BvK1hKV~i=aa>9-$ zLZe{l5%2;{+B;lk;MJ57EA&<1t48lKn^PNX5UgP@QNeF$)l=56ntISQh3E3^nx9dd z+&++&%DCtJpLGftM}2J&)y(Et@qmAKo@fFxnmyBU`@dQN{ntJO?hypqIOk?ZopGCm zX<(@D;yzd&^ujd!{Er5l3uOhHdk_;h@!Uk-;P!7#FKlf=tJTn*onQew8@2_tqpO`k zSyHz1$T`QVf>Ot<8ONLgA&YV2M^G=H?fP0Lyl&#UmjM9zsAp z#5h+Id5Q(Nn|#NQ?{c37muD@mV5VvXn!zpR%p1}PFAFuHbGn+n!bNBK&bK~m+bERp z2=q_$<8hdiSnqS~2K(Or-WRd|anB(@-vE9_0R36}!FhqLMmpF{+xgjP#sHW4p-8a? ze@rNG*`O59MLLBzj;rWL@(4V1qlC(fH|;jynZ;PHA>!Qaxf}6%hxs2iW_sft7U%YA z(v1c8K|B0){TePMJ#40J4j?$Th#2wRJZZ))Jk$Ed3ZUGJjs3-?1qSa>dFY`>$~+tI z+t}H5{??whrZc9eXG0-ohj`oY^wC*#SY#cg%5$0j?QYPv>;A!g@9n>YYXJ5=RXXw^ zhnjzV)=Up8Cvj(Ar`PB=e43^=ZzD@n+hOu#?N*JCkC!uN&g6+@;=1wZMx-v&#cS(N zhm&jk>NoXmWt<~c+MaEf-eJaOYlk;;S;GI1J zAIrSB%Q{vwehNH|lZDoCUMt|UzFW;ZgQY3@?)D%syoVqq36Kc{w1nFyKUb9b*6IB0 z3bBG;H(|u<|M}oSK%yd%@CL?r(Bk!oXb=X7Mf7Ei*!Ez%-)(3xDhObgaMfB=;^*R5 z;h#>MsFx7pts?B**?tHC_7N^3nu72pvmtXUlj4O$-Ig_k&T^vV`w3|+??HH0nAw&j z+V`$i`|}st_GcIBwdBJlH&`Dwrol(GMxZm*g#kr7Z3s=+OXn|_bC=)29K&MZ#yXnbk(S->AtyudVFQ7P3$juEyzuPD%P)Q5 zsq(-4!5@@2uB>wt^)#CXTP)-z5%R8=JudsxK>WY|+y9{a&R3sAh*rv*=a4p**~@`*Y>7MfMX-a=4Q*YPd-zwT)tRde*NV#M#flWr9KMs zu)~YSz}2gl%5#sMDYH*~tbF5JuavKU^E>SQ%`#ytbW}J+T*{z__~r5b7-TZ~xoWOm zeHWgIN5ae9V#{|2+n=_M+Dy@Y{JXQFLvxe`uH5ke8qR9Tsx2#Ac32#{uwC;eRQhF% zejZ@4zi{r&a{l$7msPaGwX?eee5Wvfu>)hH2F5T<%@!Kc6PWDy)F)1t|KPWOrF`)- z&!8oXmc|;Iyc9PEeyn05V+WiZVXhs=4l@vr?>MqV9@_}~b`TzW0>kN80d#1E(!?DE z5xe|cl#OhQSp2B30$x0cmq!5YDV@R#(`xT}Wqqf-v#?SA`~UTi%lBWoR5mzLbpHB! zdG*}2^6^i6jI1aVlN7tq&Mn$D596ji=T$ZhW*A3DAD=~&{KfJs3VW~Zlt2CJ*UIbf zoGS}&zFx*=j&of3G{O{K}8G!fp#!#rt`G%$ob3U!#*71FxM zjy5>96+-95HkA`n4y~2NC2YIHBiW8P3E<{btPzq{SgAVi2)k^7e_L&l zAm5g&X>KcWKhphxK+t$`$g$DtRmO_^gS^iy_IOuTF=K|E{#|j&d4#TX1(~PL{H%TJ z8~%ZhjybWW2R{N|oEPiZsA+HB;L7Vcj&(UdQI>{2qj`l=V zY**GXPF*1gx5}Xv8SuyrR%ycs^k)+@S@MEQD@zD@cgkarKT#fi>?$0~v$BdhO@Lt;6F2Cl}&HKIO zZ$AE%ZG;m^=r8@m4d)fLcfDL~7~Xq_(|!(-1ow9Dw; zEUH_@nDrZH-$HX~BQCv~i0g*Ea6+OaGtO=oL@LP}DQQY2bmDfnZu1(C{^QOdaC-ne zh*y>(3km&+UiE@81VJ2G8f1~7sRcFr+`-oDfVN*lh{X}e6^vb zd2<1grNSv}&vH!MmD;AlBk(|@=R+Jx6l(^UpvHGs%4eS*Emwd2v*i!|`FF}X8v_tR z7$|M5s@0O>&kZKjZ~n!r<<*y8Eie6?_4QA z1Lc4GpZ}1J4R-sdPN1Q@gdJ3D1P@R)LZ6LIG~xgFz+Ma-uCK3xpMaBDOvJrW+i05@MWZa+Hi~&V+ZtL%@yR=W@ypfCVVTaqVn|83x9lvLZG7 zZMoSB6NSOfbsi_5nBb@!v}fZuw!u01u*Jgg0yjUpF3@bzmZm>UPyf{oQ}Nb!DU>xe zPhI#(i{g_%HZel{n{ScAPRP#)?f>aR;Qm6OBA;WzcM(!#b)2Nr-yn~aSKEU68FQP< zD>d6R%s31)3{cPscHxen;MVf_X{J`t-+M$5Cmh0@G)|J8_PoWHGA06IBTfL(vCWBTiarAzX-@>)! zu-WSsxo$*Byo8xT-wy9)BZXzVhSI*w0U2O+@FR>~rRakQoqZA6kn$qz7N*8=IUuc$tx#1RWvo;Xvr%UMu)8zo=0& z2;1RxEVPo}#aCxd+Tj=o0Ft$^Yrz6mjv(XcEsf$YyiE$ygpRZYvkVA#9m|h=?D29M z?OiU&2%af;Ab4;$U=#vtB5V?q4w|0XfoI%g?cq30C%mO&ekJ^y03NMMbv-{6Z@qmO zcqJVQ9NXW7-njci4}O_fg-qsGznZvR;D$#xe}Ucs{DF+yI9LO#UpJ2o34hyTjyzRV z({BvkTBldGIS!;I%jzll?cD1a8v(^a_g+&5>``gAJT zf4PegaLsY3lPK@o5$Z&&9fC(7kR5ht7JbhT00bOtN@hG>Hiee!632!SP+^w{azUD+n*%MuSXSlMg@iP}m!` zRbhLLiPUs9En6qbX2$h9nUBc!f%>x#mLH&&weib77@|K0;cP;%LD#rIQOlge%Jdo9 zsi++)$n(;()s1Crfi1+P57!sbP~*7azy^X51R@g%!#qH?iBQ9Z+%U()y(9%xAJdSvthJO=dmOBJHPRz^8E8pmL=qD-}tvbC@;NsvFr?;K@$`4BN|KY$jW?%Koy4E z>W;9`b#VRv?7iocWyf{kdCGg&)m`lyrqS>K0RbQg5FiN>Bq7mTQPOB8G!e7A5&L0g zW54W2{Rtbpv9We+%!m?6iJ}(`=s^b(B)kV2KpV6#@6G;xC*OVbs=Co=01bc;E359i z_h#lzbMoZLlP6D}R1ox1?$yu>K~wcf?+SGl?y6m_a|;LF;&Fo?21Q z+~N%Uia%>;^(Q-RR*;2Gf@MDLm zt=*xt7No_uoncbQZixIIVXs?1mx<@$OA46f$HkfC{Y18Ol-;VDcioA3 zdYu+fkFoZlR`4~RYZ6=&vhlJ3fmaRz@yR||!`FP{2jtBVe&~tW$5Q(V8rGFI(^*Lc zkB2z*d-LX@G{@k{--|57*#9(}Q}_rctm3;gsyO?PeI@%$_Jt~hJ5iJWu6L0$;k$va z-Z{ZH@1o6RI@Gn6jdk@50ePxUw2(8DG2g@Agi$N>cX+rvO*r)Tb%i|D#Q0pAKuZl^ zc`!Bqp(#51x_@Qbmk>>VL(c9R>X;ul#4dwvgU80>8wG)CBsD*GY%mylrjm$5_yIU?__kjthz2#1jv7IXA1}O5HC5YLQDUKCE!4e3#zqelo3E zx{X2SgZFDp@6|om`a|M$LmiS2sPzfUE{otF&w@F3>cOxtvA8;i7RTt=3FZ=Qv2)j+ z7#`V*d87fv)!Wi;x%dZ;bh4i=3IDuvej=T|A3X$|CKl;D37k z8p?Zm;2)&VnQ-k)egdb!Ra(1>_Z83@anpE>?^T@YZkT+RbF1XPcvcyrgSmjau7`$( z3T?-~6+9?H(~{?E+n%W{!9TqVu`Xy)Jn$56SDl!eJS(0qUM5|DrxbBjkW&#zow}i+ zZWIOCE#2p?FcuBxJ>b)MAWA4KLip!5qI}jXC${EO>kHo3(EG+x7;nR!ZwR#9`ssiB z*F`l;;x00lEDBQkBGvFJjb>vd0{Gt8a2aFc=goqE?N!>Wp#(M`{t^NiLG31;Vr#KZ z0dL)9quZ*bMe{QP)4Lw6Je-zCJ(2VLP|Me{SBGd7qyAv2goqz6SF&aihD;;qO<^$a zZBQduNs~B1WJ*$`Q!k=~MO?2ixL(P6jE#ra3j)HL3)s85-Od2gmSzm(f)HRap;$zy zHH!ds8sXRcA`H;z(KvMQ`FP=l=i}hvV{yX6LKYBGA~5Pk0O{6u&YMRV)r^)JLkwEK zEo@D8padOgY6l|(y9n8O(a5>w`h9W3RokPd72B>1Oiw)i1j14n);7$1P=O?fV>I6}SD-Wtd4=h_&KY#oisUgF~49_V2%nfOZ-I9kzk{ z1`!0ax(hd_og_DW%K)~Mev8^jGvl#ypd~(d`<3z8Pu{|!PIKJLVQ_!@M$Y* zG@B5HQ{N&;Tv=d%h3zLkxuwc+&_iHB-BW9nI@l7HPhVl{)9gw|92i@P z|NTFHDSmSALutqD#w+*6CqMkbc>1~hF^x8OC-u4g?SB-TdRwvcOp5eBwdfZYO-Vt& zD!oiJFxkOYiVUN&KY!ae=(g^XrcGbcJTY*H; z%v~mJV>`y@;wPawK0;Tui{{qyKD6Km2f7emb)Xqy1nCY3y+IE|DGw)AAjDISojl}X zhd7qb#uoVH$KvIa`M$hs{MPu@#iI#rxD5!r8VFRVBW@-hfsN3tviqZssq`P7rHyFf zs->%)Ko@G;AwVtA?=4$;;=&8Irpc7{4rx0J!Pp3IZ--7H7-hI5O*HKgqPWmiA2;Zi z3Q;nB2$px><*jq!mJe&gAhpXvlzSuopHu&NDd3boZ)lF2WKoc&pCcy`+DPc{vcq>O2frn+u1R=x|apNqFm!S87>0414ooB zu03mMXWUxT+lLzSD(N)*){?0BNJEmBE(NWXw;}$U@kklfU`{P&$MGzK^^#!NFX;bt zn=+mkxTalF<|B(JXUxt{0!vJ!5VU>A?%26|4}2E$3g}8p8wwwqX;R3W<3DNnXM)__ z{nVD`nwUF4mlnAMN(yyrut+|+UZ$F7?L7-ygK=ZX@9T4g2aWTIMtrc`Rh+eTs3F{1 z&wR6`($$Fc8NXj8;Oo*qOS&~2t+H$^vwn^5$@3Dws!N8EvB%HYJJOkCMDvO?_E{$V@Ww1{)l+UrC;k7EkTk9_Ttb}!Oyc7@}$SYz>H1h$3(Sb;{|8&@G**_t#K|lPlL%+VHc}~&#Kl(3yHWE=G%4Zfwej<& zK%i=)Gi6?>`>UC@b!1CC|NQf5Q_;8?rZy~1YugtghtE23A)DOWo8u^g+Qt$Luhib7 zBt9o2P1zUGd{fIzf_M1HQ8YdmV$ZH!Xh;np3(`)Z10waX5{as-WG*YXfxii#^Zs)N zvOu$?Q;=64m}KOLpfI5buh1{yFb58@LW6Y*;n3)b<1xnpLJMwHM+oA{&rVntnXELk zHNFK6xZbw;xbV_FvGc-<|OnNW=~wXIp>s4g@osxKBjy;Bbtih1^Pf1!gTRUD1Q^W_o%&I+?Kcwa+71>x>V* z_ttpF+xGy+h;M%9*YVwZeitX_J2}*83#J|r#!((MMmv$9?Y;DpK)DaQyAQ>8e)RJ= zhQ)`LuFVMe$b&6;6i>46&{cX$b|h-UVo^@|3|QyvpRd%FFN90E?4{yK2ki3c<=`*OIz8 zF%i4A47pN?=VCiu22>~xjfoI|l_zq%BPOii~ z_ue00|EGV78?L`5KKY^d$6zN~8VF9QZC0_O&q7Fc-=N9|HN zEk=3BQ5%a;7)+p|^f?aM>+NodEt|U2qz9@x2#y?k%S776o)*kuSYf}d7<=1P{3$}% zk~3dn)0st>s?DWZG4Kyc#ODvH2l{ChK02Sb4OExUBkeDCdUV*zz5{lwik#?zEj?U^2He0c@wp$i>N?nX#Fre~A9BrnGT30BQj zW1s!lIP$6WfqykxiETfv5s~Vm-!>g?|pzF|N<6 zshl2n!{>E{0H7B)T)?m$#24|W>Ph02Z*$t=M8RR8uOFq01#p60Cu|R|vvxamXCa@d-ZJIZ>9MM4FhdG{Y>Zt-HYG zVXW<#Yw+MNSVd~<7^r|(zLWV0iXOXma==@UW_{#O?eolwTyr2!G0Pxs zW#XjAyv7g3cD!&m(oY_?!!1x>Pje|h853Q&$tX1LwLGZ9O50e;0i?`5|GEmyK zMWff@+|KKW??5C0a*$~(x9#uy8qdZEuiJCt5ZP9^BrdwOfm;$5iJXMoN9{kupD|o(CabBtq=K$pdromNhB(y=FWH=Jq1>D&P zVp%pD49@~vj66hZW^N@;o*0kAhmXYm{m-DO`&>*;jiNQnHYPP4(W1=*Az@zHIeE4{ z#-e@kM2vJT#)m#|YkcIxcd$i#1ZHO_o_b<`9x!CHHmgC&V3flcXwXJpdoSD**IhFb z_x<|8*u4X@9z$E=p5Htc%WPXm{K*zH`U=dG_`=7m!=c0IBoOhGxP+Jy`DZs*7YSl( z)JYaJ)T7Jxj`YW6`*y`6Pos5w(k$3u_52&=3HMG?@dp{$TsjiPQQuN`ccx$2^!_^UsEU%caw zw#9=_9*Hmf4`G<(Fy4F-S}EPo6v;4?l4zesTZf*xg0TxgGnR z2%OXgg!)rwCb&!v%l0yb+I&qtmg#Ftq{WM=t-&F2pt>^fEI;Lut(LrG#FHx z)}#lTl&w6^bC{NPmpj|RGa7IL4e>{?UHc#Y=4%Mpe-rx;oQxL^9%sAoQ0#=cYDXyN zc3EvHrhu2pK__V~axjMiyUMhK!ax~Al+G~kpzUYOo2+!j{uA@@fBdH}#cv*Xj0sv# zeE5!=qiC(BFI;LvPbdHK%RGE9F*>mQx`v}s&AB?$^^KrIBy zIBYI@3uB;?Gm()R7cXzunC zm+=&hd$*i2Z7%VlZS=z0Wv>$F33C3EcgH<1`+T7HKtqTX<2jEnVq1b2L{>^yr@G5yqa3N?u64$zV=Kg(l}|9GYW-q@UJd9k-zcME-z9w z+c5hyF)NpF)xQBQ>uGBh_xJH$!M`fo`uECz?Ohta*7;rC2~wOsYXEIPlE2fdaI)~! zYre@ZDx9n(Q1d&}&2Lw6dTor%v%yQ@t#X>a-oDtocP|25lw07@GmY$jB`wW(m4!RC zXDL1Ow<=?z9cdPsPNCJt&G`~(*sW?kJo~ZpIu|^p^D2`Be7grkZ{60<0i(m1D})BH zGf)2}#z@a75&ul6&e)`P~)HYuH_60lXxQXyLPzHxtZ zAmG5Mv$>q$xt+sRpW)%*cu`GPCf7D-5(L}V=lsIv6=5ADY90psKJ~+fvQ(2uiRcoS zOvMa`uAM}PZJoAn8-WnX#7e~YP+@PnQpeiM#%&!0szIq@{;T(@fBWuprB&_c83u?Y z_yuKbC~=H-(F0ezWjomv)3nvGBM0Ny(J=%+3VUH%u=mrB0BA0SzlcD<-8r;O`e2Bb z5e_X)ACC)m^wQ={a9|K3a5PY${90AwV;SEUanOm@kIb z9Olx_FSdA*^kSoIBA$8vP~3FmWoYqkjRzjv&p~f6WD0q~OJP-Pm@1qs1A<%boqm=D zHU?1Pg_iKbN?VLhF|Y!UEn7!`0ouq2yW7QKa$dk3Ll-b=hG85;&V1t^T@!!u{!6SoX=Pq%ueF|TN&S`n)^Umti%^R@dA75cT)~<7(}~Gj z#;c@W;omFGYt45s9NJiPk->?}BKAGH6!uP@if10YkNXL18Uu5LtD41_ML65f!2;8h z_D?|2_Ns@%Z;&`d0kr{>L~Rp)WrAfp^EpNN*2<4G&LKe1G+2 z7sW7Pr;d%qs3)p3v6yE;rIq}$?*Mm&2nq*N0M4u<*D1gQP5v~&(3JL5OPN@hEa^e> zSo0R*Xs6qp(HiYT7_b@JU3+$19#0+`izl8Rji(RKpjpmAZrJpr3J60nS%8MK6GlxM z%+uBiNt1r7)hZ+FA_$SyWD)IJ>01Q6QZzVk@w=$28a3MGUZUIrr%4HkrYu0#1%x48 zv=yv2xI7FIeENZCOFF3fmPBlJ#FINBReJf=S4a@9|58)-JAkS^>k7aSI$g9>CpkYnsTnqNT16+Pm-=t&H6Y z5f^BC`OnStqb2ymqbE)>+-bH+K@#H|yh9rb57PZ=XXPTiRSgl!y~2Uwnb~GezvtsY zBi*SNnmSk=c^CVQW1x#5P8j4*Of(lmHc6@iVJ=gcry>Eh5ef$JP&dYV3(Z_q;CjmH;!Tl!fF zjCuBbV+;m7HCMH7buaLt-Ck#Be)3f*+yzE*+QFkC0&)?W`owsQChLqmGDc2 zlZN(8ULBh5cecFBeG+Epsn)5;K~%~hJn68uof$*HGZ#OH=-d4qqSnQ8YpbSMR48h| zBaq8xA_*Cq`Dz=jt-P&$aKXC>!_l27%V@E*o|rSGC93Qheh01P5|V zfdDjcb7yW#azf?g*QRJ@qNU_sZ4ZffPQDw8Q+1FAuZ_ny7y=UX%B5{R2Hw&sHI$9* zzs!}#bwsf z6;&tIr$)!vcFL*2tcndH!07AID7`p~Sc3t!;Bc}tf6(-$!iz@OSAE!f<5k6}e?t>F zIEgc2d0gqf#_-P2-XnnbRqzn!z_S; z-lQ`gJcb~)ue%3Ei36+VPsEn~mALNhSH-(;z9O!O@YIq{JVlW~P6E-Qo-g%DIRv3z3xq2TPdxO6Y}lYVw@jFQI+bQG~v z3Pze?h;<2LV1y_w@o$lVRC}Ea^`wN*4nf(eQxoz0fr;p0%Vd{_Twp$Xk%gIla9P_( z%?qR0+wF;4Znz@e|Hs#)%=L?3`)&N>7Z1hp$u`V9P=4yVq;Quu%E2@TYqCTDrSJwR zaf~8lTUyqf2_T-HEkW1SRR91$07*naRGPjDxzQkYQD_C>m0LX3c1?T$1`BNcSJ2a8 z+fuhz>r7AlDCHv+(oXp?4b)A$+kdky$;I+z{ze0K+26BXuR8bC29*iYCRztf&LUdl z2cLX6W=|f>L&VblFxu5~)YU^O7tui7Jk%K<`{4WH&Ud~owz1WId0~pS2b4^Nw8tio z-^R}}W<~lCQmZ+wZRvS!HqW&oJa3MN9(f_Y|Kp#)576!3Zdtm zEI}j0zc%neQz=d=D*+qbFJB^u=_$0k5$3A}j=d`coN;Wnjmm{=@90+HX+z`A;Sa4mN`Jx z1vn?Ni|lsDK_H7~U#VT$536@GqMugyoSlw$UDaR9+e`eKPSq#ZM=|WRxR?6A^l>No zt4?~*_-^re=RZrBeOBSFRV}p1F?MjUld-rn#s+8L+s0!I(^e2@79$Z(L5DR5qn59W zaxU)6H%Xr44-~!^SCx}{^+c-O>1OcE=8`N=|mo%YP!*$y~g+Y!}%(FC^ zH;BN0alQ*V0j8yxV>Ppz%#np)+8cfioRBXlCOu5NT=vWL_-7>>`8c0-_3?0BxM7X) zeSafeMT0DZi#@3k&$A<}hn{J!O@7$*rZyJ0oqx~5vrkQNo(PH)od{z$bI|U{$hPR| z8)9*r`m%tk-QDDGg%Hnz!TE~wR2NzjcJxUX^37}sen3 zra(9$pJlDVl}suj?;8oX*E_GOU0zE*rr{;*b%~2Lzv5GV&qrRSlH2t8{q*jRpuY@}Q6vy4!AI><{;9I?WZ}jv1^>miX{OZNy zy?WN)ONP>IybgBD)5{3R4uGR>byjz?XccM8mB>s06h4|>Ro_zjH?mHzC%n!_+LiFF z5l0%+opU=lIAT2Mfv_tAUj#Z#y4=n;iLEIQ_j9L!LU#r5(v8#rDFc5rIZL{K$R|1$#Umczk~xIx&j2EL+4| zhTt!YNs{(X1zuYEWH5tXv7wzdNBYXfa1>(ER_%^Q_dgcDy#ELqyj$b?D=*-nvBwZ{ zp<&6qPXU?}#a!u36cK}DU}d~m*~~l48FisH^skOMIzAiE9YS!nvoA&lyJHN-&Iwa8 zg8~ltIM6xx!fK@uNN>cy`A&5equ`GnUNndmkdN#bgn{dh)=6yo%0x3kZC#l`8?rw> z{=WCb^>5n}hens;i(mhC{N~{oU>dt(sih}Y5c*j%i=GU#S?3$@0KST;k))@2f-W>z z6@tqkHX~u3l~Hu^ODv0AeP1;85Mt5h6cLv{KD;U?UfE~Wz6Us&hEHt>Rb9nS`jq~J zmEiK0aC}u+*896jC=`$(cYD$TCypO}>XA75!c#GzQZ`Jqna!ZF+m6k~`RTFPv9&us z`6us+J8!!dd%I|yGO=w&yHQ$Vd*)@^3KoQ*3$wrzVdWyi_Jx)9ICyL-zWx25$M=5x z%Q((L$MDD?Hp55a!ykNaTz$pm2r=7Y>rhwx&ENfF96vr9U;f(nu$kHsH(s+F?OcTW zFn$W>+p*s}IZ56<9HPafVGeD}1r9%H?HJ_XwBzyB@7@zX_~|d=$}9H8pJ8wJrptFk zE5hA2@OD`NE`rx~4iQ|S-d9|{8xszXP`1M{&ep-rJ@nyJEd_gWq9DH5H%n_f{uk2# z#G{XP(vPMQW~aU1Q*-hC@81(oJoZHV@dq%Qa>J$IKd`~Bb|*~U+~m>JJm1sb9Geg( zZhhaC@!0d@EY7?@A7*iRkwqTNpUgAKnO~Zvtm1HOQUYQulecsQ&cj~9;suyl!;3Rv z!|O}Snb=A5fJ-g}(de3}XrXfMiVGLRKW3GT~%}_K$02-xb}5uIPmVqHfdL9 zKY}r}j;5K&&v4TB6pLO6(rS}RC!r>v3wPYBvRC6ojtKx}^}Q-bl{eqMhCaNS%Er?l z0t6cIYqh>kFUus=Q@mM;M5~m=Vd#yE6axbTXzlhuE7g!P+=WUtdi~CK7OE00>3r$z zFSRSjqcZl@{W5Mtoa|54x3wf*^5%DMw6nlj=z7MMV%2B$snpRv=_U0kf2>aB7|_NT zH@vAAjpwd7adLwB!#F!gI7pNOLDh!NZTh6__l^y|r+Jq;Z{1k`@|U(rU@8)n5_o=q?dv?L4RdGm4Gy?NeaH(g-X4!X^Fr?SQuyRIYS6=k)AoGF z9Lxon9H33F%I762=Xg-{^Tx5E^7FIGzcFr=ToqQmpU-<^8BEvrtg`URdO0UhSwS%9 zq4_y@Xy!YUlT*xtR#;@(5<7NW09_g;Qfr!}gE+y-SZ{b6uAC>3u;5DA5tapyEIlJ z@u5zC8biu+8tjsaJ0(Ld9&ti=24zdsJodR*1f&Gj8~Oxtz=bw zx4ur|OU@;!r+33$Zm?PHdhVjL@2Y?xua{;#(3%oATo@Q0V&_(G7s6e}NzBeE)Ln#U zg;OUEJa!Im!h^&TmfpoH1I(NE)12`O3=?Pbx%OUj4`N=Me%ZV{qV(C%Gf| zXk)M*;E@W2o$sZqwv1hxe+oR{0pefu)n^zEUC->S5X+@*srJTrCA@WPb+3mU;U^?it>Q+UEaW1s|HP0RlNzT5^dd*C3Q8N!ePD#s2xZf!NPRxDGmlC>=j zZ*-0AyFRQj-fMlX%3wN;`BY`n&&zj-rr^-2ZQ%BDOYOmHoeZc}q1cpCVE2dT8rw`* zHM$C()m`DG&yC+0Ki`3)g18EX3T)@tGN~QpshR0yJVw!^o<~rozrsV~R_$k-EFo0u zMR+*}Jy9FL2yJKpG$Y9AVt^Us)Xt0dY>xNdeqCI9Izuo++#8NR*xMXkWD03UtU+#Ht1zX)y?|Xn%|FQdR`p(A<;9PQ)eq2H9fY z8~drZ0>uu>bNSw_@u`n|ATHeA84o^kG`{-7U&n*b9*#w9=q_MS(?gTGu=y42#IS`C zwUe84!2V6X)<B(WO=af+)Xf=HMB%6BRx$Ae35S3;zlys5U`M znw0vz23O&N%q{;}cYwhvvfIKbznwK9T{5ZSm$%pWYa5dB0;d^wP@h9DJQGI`J&TDB zw$=gr4#q|`CHv5>okRQdqHP25=b!pu-0{w9q7#kGHW(py1h~~c%@@!vxmDOU2Fh&+ zP#4kASj5im>|9ga``{DtWwdG^c>K9&Vb{#|-5153@3}VK|DGFS$7W17AkbW49KPcn zmotI-i};WKn*;8SSfFWXT1UrnCv$-rXE0*g|+} zaxAt$C!MItAm+qPAusqM6%}hl7sab;DZ@RWsSGpN-WLx(btL}wD?g40Sa?y`{OrkZ z$CeBB#NHj4OX0A?pu=ivO$t7KEahrf`X71)gJxORRA6Nq0P}tLWCN#hdE;Gi3r*1V>%)0XFs{?ycZUv)jTs ze6Ja1xvPCChIe+2Hd1S)3NcZF7etg zc+bi0`hI2D*_`P#x+crg<8DDReVCpqrlUUb0~K$g^k54FujaA=F{s)9Ms&`_v5jVUeXK0UqI z{NB7RHgR=#52AnqZ_VNoOf|cp%G^BrL(awQd&0(fS8`jl3XMU3OfqDcqc;7m1%bPB zDh27nveO+n2zgb)i*d}?DA%FTX?DgWs-~`0#Q9Onde8Nh{Ac#Qehg`RFK{o2U;Ni% zte|L&e=eYTx%l!}(n#BJ+t#hIl}j8_ZsS}_;p|I0I4_yE8UvSk<(On0yx3vM;-=@e zs4UgY+>UO^j?lIkU>?xd*A2eFS2NFc{#WR>n%^!~sIXP~sQKG}`7Ql9X?E>B^D#!{ z3j7MPR^_PqRZ;SLU(QyydgP6V*8qW*&-{=7_OC@IZ78Xkra|zuNeE&Lu&1yO#@^L$ zjqDfVO|#JWDY>W7was%b?#(2`=Tg46WE}fjt&=o%mFn5MT9pfE=O~!B{VIW;r_+yf z7@6BIq4T6eN)UT5OFWL;X$y z=@w?Ut@LzD(6m=X7=vel#cJvqz|Z-sLzUw1&;8{F98205r-Er6FTf3-y^{4~GOsPr z(Xp{Odh8gdvL8ts&pw|#c`6y4dAIm7h$WthJNa#aiGz!)+zu|?UEK&JnQ);cFu)F# zi?$EM2j6`|eB`dT#})hfWAr52fj|5inu+(s6>qyfPNAXw_;aT?ObTHaW)S8USq+8x zX=5eSI=C{bh8;!Z8K#p7pj)G_ylhWgb@_G+osFlS zJ`l}lLL#O?6P9wzTv6K==$$9oDj-ENSmt-|XKe^MnbssuEh60OL38*WZ`%`dQ%mvS z69>?2WU!VygU-rv$rz?h+hpKO+d&m(PPi-+ha6lvZ9xz=*tJY~FOCGVJZ{8hG9h~5Nv~4j3Q@ubrW%OkH6v`=1ajvYb^{Q0M}QGvkL zK0w3T#t6Ne(Q>_T+hF{wKmBlg;P&egOio8( zZ=tC>e*4HX@wZ?8R(#_-Ka2w}9*zFN{)tkKQq>&0^h$ikDU0TQG!j6|D%WZz0(6lau>|NZ| z29aJlHh5M;CBqR$6@OvIIr+$ZOt&h79*xhn2phKz2-G037FUXABTrHR%8958wz-v* zae8pDheebvOp-T2-xT7qRhb19?TM?!D{Wqeo~IT%^v8LRs7ROMPM`29yH6z#5hf+g_;vX7O&cjH#?yl%KR90J)2r2~+6!`NfH zfHU?P4+dLe>}p}*dl2(N+u?;qHuu3#U|OoL4<1F^vYbocm<--1uqt?9b;@|+Q#w(P zd^F>bPd?@t=sg3|-zbf)q_@_y;LcjV#&6Eo^O|xsCMpeKjBFE5(4r+|B-4`v*$?b-2@rBw<=Jyw#%ERTq6r6W z<72W5o9@- zC);JM|EqmFQyw%*wo4~-);)XnfG?Y~AK0d8Ua(fm#SjXtKl7W#uE>e+*ZCod?{Ij$vbU@XY~Y95XLyyjTq zT}NFKmkaKeutxYd)}l(Q@+&F4wSH^;HS0}37GA$+hpe^y#lQPs{@P-ygO)bcAXH7M zrsk>;lRQp=?A9(Db|BTNl5lAwQ{(F0-MzUou%-!LqC=b+x!+pN`FmH|>>H(nGz_RYkqlufF7uI>dotN!N(Ex%ry zLiJtoZN#nBnAI1C%7m0utdDie0ZcERwHc+RdD;@qFt-{p9k121VlEoX-S}LU=AY|b zc%8{r{=!mtcnM!&nHsv7UC^%7frE$Q*s*E+ ze5I3_L^z7TK;d2&f}(b`c4O*fT)d?V!R}RY*L$yv>#yI6-O`Bfe*Zxy87dHj~rwxHzo<(ZkfVdwno8d$slP~#zUW)uo0FAAdz1SCTT9e{GzyW z-$*?4)Qj=(v!fg^#uk~m(YWl=E7LyKQ%^t70cUPyr~E}V51|d(KMHdZa$27`SKkR| z5gp+dG?NLYHJwKQ%y};Hwu^VimcfCz4_m9FGo%kA*W?nvtEj+I!I}cERy2&%m=lj> z+B^m>MSS3`6W0qz`s1c+FN!(rqMthOczh7MukU^LO)*8jU-;%P(Ux8U25yIS*GFOM3x3$Duh;<#QBats$se9Q@N95sIP*-VmN1=h z2+pTfT96(u`%~d_V?^~o6&}taELC{EFf$HwtjP+5-7GXHJZ+G| z0qSQyac6w&t{dax?d{Ri#Gx4E+e*8%2v_<*D@;-+0?+N+hGOTQopI#Eskr}Pw2QHi zfAzK3qNxESR*n;I8o?ry1+-kBJTxBviG$gG^z(b;w%cxrfBk14i>vmIASBgxFKiqW z0R_9Q+D&Ba*33dDg8C-=975>*FV3;B@m%bt-LKep5t9~mu$Zh-H5tAZnLshTg%y7^ zycg)#V>2u9;$&-l@ms%$zyHQh(J(*3g79E$9T|?@J2%JV_|e$^>{IXwU1*_Sf*qh9yLBb@*0ectYCz=~-Zvf`(18KL7#!|4`LtFM>o4bSE0ovnTh9)diHU-v= zF2{__c-6PS-m-1D4G6q61kR<8CVn}lHqEg!t2YI^YVGFXFpR|tAzgHBXNQ1`$d0wS z2q#^Wr{OO(?{a*%PxuYaK9^mncDG+;KTJ;}aIN}DC5zMlY|g%QCiimRo#~s(udz&L zPDfg6pH4@=*S2oy|MvS5no&vwerstup=V4|n`|CaO>Wayc;sQPOVD9B9p;9NU%f;4 zbpl%!uGlH)IGYQxz*yd|;txu?r5N=*fNO%b^4_?=p%AbSB=f~RpMBTMA6Q8$grKX-sB*mR-32>N|6n;H%hW_TIP^t0dj zO)cDfb+sbo<2ocM^r4F15HUYIzdxsytCoD?x#Ksxu3Y?H!j$FA)CAW|)@@*L7(2VW zV%M&Vv9*gy26*xX<_4a{u)^**&+^cG9Bg&g)hZ@UGkwza-Nj&)DCBxe3t879++AVZ zbz#MD&ns~rTj*Ic{StG8$=}OkIW7ZV<}cn0-6XXdOkZE%^|Dm*xIM#814>-reh zy@E&8&gH&}kB#3}an`4EuJ4U$`Ay;wceUNs-ra#hM{g)Iq$z&f}FU495VLB#$py3BJH5<0U@5$*a`9tuwAbQ8!wZb zs5;3?)iIcSG*hzStFnP))g$*hQr8Gd24w^*wi?s7;#Qw3AMf>4GkEp81W@B^<41o0 z&u4~~6}PLFEgWj=P9c!%Vt>0^(gtLFj@2Q>2Y4thmT+Fr&XFV0hR$)1KLsQVoMeJQQFelm6M_w><}MHWY8hy zEA9xLBu#}GGgV`+I^icBP&lNfu6Q)b;b>knGX5!G0OpJ|(vEgbB5+s#%av*Q4BNys z@G49Q&kiPLG=ui8lYkWNp;5S#70ge4FyUvpU;{L$~QLrZr+h>`Fkat?9UfqGdt|J)`%2XmX- zY7}6>w2iZE@!+8&apT)Aj7{u9_Fz? zUI#h78fyy(UpwQnOD>Lgz2}|r)PWQ6`ET75j~!5Z8L=3qB;4+;jct_(b2}}R>+3^MpkYQVBB`)u0f#n04j+ls*|*%dsk zu(f>Y*NskJzs?l6`&KSFm==Z9m|ocb*aNYIwrHoCiP8t!WP!u}IuL61b12wfe)c1A zI|uu9HlxLYP}>t{n_98SOP?^V!mV6f0FP&Y#}v5u&{O;4TX)|RzkTQ_77!NDzP%7r z4DXCv|LF4AwWTMz&;VYVK1q?-!iS*MLu(e<_MVKn+92f9jxhDgeLLf?{>5kF|NYPZ z5D!26Nc`OwzZ{?W_133TVAN?SX96CxlfCCx@X@4IqNevMWKFftN zaBUeOSEufBE9KLwbJpE2~$kSi^<)43O_3>^}V>VEv|a2`FX2Vt=v}QuZ`LG)>xm~$F<*mplYXX|6#P@(gP&Tx+Oyw;CP-gjPaJ1g#Tcf%CfK681nz4eT1u(88RX4kkILe`Z`lbHdvY@%Q$zR-Z!bfXSJhaT-GCgLN>_=Q|J>S^pv=cgK?2(TLC& zS#;ym;o)8uezq`|IL;y6W6)$Z$1t%Z@1&$4VYQlmmdIB=PCnbR)%(5WD`UP-Yh8X> z^D57O=>2~css${K5LyGfTKhNpDQHzlD7>YlG(zo8o7vy&PwY_XM{9QzJBQTz>%(;8 z0*8h!DuDb5Vga!(t)(E@^A$J8>W;8`1663sGC^VPX1VBapT z^fR7oxKVh*Qo34{HMcWVE5p~IQ|*hFgiS5?stgGVzDX1X(Jg}z5q^RtdieXAU`s)B^4pW6z7u5%uy>jM*Zt5+uGfnoHE*nXjpJXKH7zN=DeNQ z$VNGH)9_XVx*TBMX+(AwE@4s!S%|w%+dOm>-qrb6F=1qhTtE=dOucqh`8HIo&~*Y5 zm5k7Et?!i8_r%(8Z!82_{`BAdPk&vu2oxfkNG?HAQ;mj6BuoM)5$5D>3^DhxO}L|- zL7a)`oW?Uj3M1R-sr>=gi66@nZU|WtDPpBL2auX%58`4;YT5P}1>}z4X zi(eI?Zcf1l%zg^aP!MI6S%F$72YGcNZ1Auf>!WM@E(dj!wiA>L>i1Gl^5>xfkABrv z;+Jo$xTe3}8P=Ho+2S_FGkxPa)VD#{OiKu(TrbVB0`z5Tv;c1-;fHghng&>dW`Ub(fByvG_tf`1B!6C?Nb@ z>T`E~+;qjRxM1h@_~maOM8M0TEtI#j6DFGFY|TD;Vkw>jelv{0tgRr}>LwvtOtUGJk0BYvvCPs!%1gt#gF+p}Htxu2 zBnifuc4<9Cl9j$c1@DDCY&b9fR>0C!bT?s@T@vQc+M*G;X^X4H)r5E824w~R2X z8Thr)-Yaa0--OWe+KacuKGOX3NAHMty?tNYeASK^fMGw1@b<-HlbD29iKm~RKv<1H zd}bjoyP!92zIHe+-MuXqrjEzK!^g=V&1uPh4RO~pSoq_re(3X=!lf<>8=ZhFRN_Cj zZQGs#)6y%&>GG}Fl&r*UL;0;uP>MDZY_wyJVHvT&Rv1`LyE2N`T*P6Kz{BbeJo&qr zK6Qle&`<)eh{;ZR?8U+mVHrC9{G)fqhwiu;^9jImaT1z=K>^CEX@WVlUp=sF1-wR= zITnG((eZ`&%0K-$KL4d}Vw>(@PL4l#$L;Z#pZRdy`nF4BgssEf;8h0;3+>>6hyU3h za~zbYlD{^eMT_Fl3T5}q6_@XgV@D3eZ+`P@>{~C!_C1$Jd(ZYba(p`e;VYO%xc67_ z$&cO@pZmmJnAc$PCH{asP0~WrS94p@Ta|1sguq;~g-x>Gc|1_FCODuRCKzsQzws<0#CB0?TZyk#k5z^#Z6J=0inpR4odD?-cjXaQS zkVC(=Z|X)fwkNLGvnjUqqUGB;7oCd}XkgQ~!5wX4(}`s|_?}%F(m7~MPE-*b)4D8} z)V4+@6l8=Is>}Fd!<$7w%~J{g4u!8gx2Ro=FmoDv;^Ivg+G|bN?{32c!w_23{VkKR zck@bIv$G>^zhYC|iY?)*w=Tu*-nr;);ea^I0?lEb<;3K2jI#)(R`&`*Yqw@r2iGJH z+bFe$DR^D*+voKcF-zRqH&uM$R<4YZKP5^1byX&{jPl(Pr18rtj$@(%F!{QYL#B}U zX@`gY(Jsvh(T0XP5$*_YCy&_tgXWuPDhg<(1fr}>ba#Bo2U>3eX?sd!Kg_Et1$pt9 z2e_F(IA{K=Wv@MQ%L#_BS)Hm*cx<>g7y^y$)A(F#wbDRmER(UD;UN@GM@DlS*=XZz+{!b&M#D*q~UZN8=}lvjEC z)tvak|Jo&oU-6!0{4Vg!?}^h4?QdFP!43`2UWDwLa8dBI01ucZvfxXFuj9G`-#nC& z#4Bhe|6GcbWg^8=u51&_*HFg9rK&wji75iE{1%@-oZmCmdc9u?ix^j(+tk|>9w~c6 z5@ELY&_=$yc;}ee!kF9w57CUh-L0Gru#MIJEeP@3*{-&TKvNBPwGPX?(s{)kCWy9z z2d#1V&~g0H24qg5E!bto3N^kp=_Rvl*6twkY>0w?^jY{F7h~+N^-Bz?%E`0Xn$2IU zptzW31f>x~)!WNj_)A6dN|}Q>^Pc#dV-GlHM*OD@eG`@*}s9E04X_ToX=Hg`;OFxqru4>~r%}0b;MC<2MIlCi0@*Df9^EvO*QRORc{dZyB#pGgY z#dcHJOId^kpO^foB7VB0!Q_>3h*AECciLY@H{iUwLT}b5S!&+sYrIu>m5@@D8kB%V z6`pa4A}?IIDsEN$j7y;CP{G7!-RWg2>Da2-7T`>yVAK{$mx)!6w4-h0;s^5<+sAKr z@7~FHHo`p9Su~uLb8Dhx-_7!pmN+6mBz?5snuK!}Ob)vH()nTs=RNfGHgmpGPi)`X zkEx?9JuvN|B+-qpc`YDk-G z?FblF5D>EclNGEc?S}BpoGND^V+R5Qx9v0{zB$=>k_lj7P$29#i9-!7UX{YI62XV^ zXteyMc>Q7jCV)-{L7l)$`)2WcL0Rcn+) z%3Db!SHRYVHxk2&P?j%W>uXZ6Pc<*~Ij`!YnJ=^Pl${zB;7@On}F0=((SZSR{8?&A5$%~ZDsfZAf?r9=I z)M<6=8fm_Gd>nhH5tm%ND_VbY55i?uRI$k_!>QdYVXJV@jifnf*94WB2sMG-%8&`n zN4#)!9*xO14wO3{he>ow;dPsbDKy9AG+LS*xRruuU?WpX!(y7y`XY2Bt5!5B78hs< zgjW4*A-{C*_W1Ar<*f)bBaWPkc=*w$Jw{|v|`2Cx?btS zPd#n>N%5`ymNaFQWu_K6I8Ek8CdWy~@xz$nKxm4@I=7o@tK7xTfj+j=u{-6%cfBj_ zy5lB<^^3VEu>?-f(;sAfXXrB!6mV11Af0jS)Og(g(C^STzb}6CyNA*a^vyS1A9sD= zj+$NBezbP!mk9k3Wm8Us8sLB;WfvyYV6{etoK>|bCJb!E3(-{ji_d)`{_E#g;>SPv zS+ro!?e=%x9^d=c*W-}~ABw;Hvp#oRy;#L+o%xwyxZ0|58B6i1TKk=dXFQ5PWICS_(eC?axi@*Hb9|KQJfnd9D z0vo;UU1cID&MH)v-|!3oHPZVq7vf^k?CeR*Nw7dc#rjx0-hMe{Yuc7JxDSm+96mW4 zFP@mhmNwd?Y>}K~r@=hmb&MR@RG=6FSm&##%YGRPia&k2U z`#6QoLFvzK%xMg7>W|}Sb&sAxqlrZ!7g9YSPrIF|&;|WhTcrt}PfbfFGP%%T@->{y z$%}6};5ojPNt$^#WS!w>f?X!H@$(jefCoG?Z=i3qv+!YmP~$AmijYo&Cz@ASM6jZ* z-OjF71iF1`Yqy&fB!!B_hM@e;*<2&$)Z*2>ppU10+Sn%>pHGX3$IFGE>6`QE_wxCl zUcb|QR!g)#z4h;_F>`dm{L``~8{oe@qC;4Vd-JXP)v%I6AZ z@`v(52#Of%-KMS3b{Wm=Zp=~*4{^9JcCEV^qg&}~?tHl^;K!0gqn{Y{8R3nH<7_2IO$lELTl#-rh~up4DEHxr)!$1 zg*lINBJp`Im&0gsYI7aE97-ttBq$h z9?fhkSCzQDXNjty+MNWgJkI(#RF-*S=~EscZbcQKyR)pne<15U!Mx7-k)~CW&qA}e zQJc5UNAtDM$%mJ0%<8S-s`A$0v!>9suvLiSVO!TQ#JIu|uXK$(Nbz~;U*XBu^{dRw zOL{Jp7h!7A&XxahmxG$sn>Pcg|e zt^xRLQ8vQP3j{DDxV}NwzT3%-BIBLJA6(H-TOrzG>SpqD0+S6#kIcpdCr1VosZO?E zYMX6gj)vr(*g_f#cT!^`XEzd1kEa3q6Y_9q9iH>r6lyp~`VW>O+oaMwfE zjvP6{VOSk;5!#xL#txKDEDBCm3{fSxN@V2g>Yhm@&I+H(_e@nS18<2@wLx_kxK4a4 zT&~JoQZMbK&FjkFd-ZG_Q(deL@U9Blhtwv`0gJ)GMVWROtakeDB0|rp=>-l_8YPVu zG<10$n?QhDPJ7L5JuuzEz)4npQ3mbORwiF7q%VW0X@wlj$lSw%Ow0T@-wZpjzzv?J z75q`VQRbp45UjX*tmK#awz6$Rdq98sscYlG2lvE(_`)}07C}f8`MV za$0$xWAY#jbNIA^us^I7p2gD6Sv$|U5VyLn8n2Yu}~n8NI$iXEo=#6VFCg7Jc8gQc2jgaQKoiF*eq?q ze1-Vnq)Mg&2^9SG3>t+8&@5bxBhc;t?caYpj*falHrlB@12K#C;u7^*nsXZuOnO&G zOv3P=I6M~5ocv9kf|38&pWGNXzwOF+>Y3-`1dIwLvA8ek8gX`gq}6TnLJw0Ey}j9A z{YGe<)e#{XAtPmEzsXj>qkONo@i-%soh8h~6;H=utPH;dq z7CcVHyKcQUKKzk)W4Ee1W{w|9+|h3NA`=>Iu7cJv3qH=T491gB9*rM-|DL$#r$1-m zVJt4$dttoqeYeIfw_F#SILJUvZ@2Q#Az*g#Wd%G~V3Jd`351;mv*eVv#!y*q+usR@ zW-wNo=VRZ#eetKC{Y)%={)_R=uYWaud+#q(@cgNde;DEJyJ;`JKuNO*{JHrnkSHe)8V9X!j0~o)e>;7}B3w6l80fSZHe&2i=Niv|CU7yOr)Hcplw=XbYc#ZQfT@@3sE^wjT=Fr zo#$z2!^9Fc!?BUw#KM-=sCFQ{?HXcY+I%v$T!<-+E`*ZwudQ49*j=y*a~hbm0KVYYt8X{dOKU+waDF= z?sAcHf!!e;jHf%9}|jLS~J8XUzTefW*h$|N_Kp|ox4jmaI62i{8B3R9ZJ4n4Iq1=M>rs>34T}MYx3=a(Dfwz5_u5f--Ou50YJDdq*zRNlj zzmy1mtCnwR15?tY=IK)v!Ju<=+2?40vNN}|cYRC+2=Z7x2;i-&@|)>t%xehi8Z6AF zF<;Zm^4I)@r9*IW^@qyiyx*(5UoPQujrVftoGH8!9tq1cMXLFgwgfKOb_G7AY^7c8 zAMTW10#6rncaw9061@ldxNFBQ7E(4xw~9>6El^(~RC$CuATR-^G8OOQVeagtG4xaZ zCU3tD&0qVUizzKCGdX{tzrv8`cdO`CaBa0MtpI+j=%>eq`)3A$v(L<_tjJyosj9n# zLVrXG5H?Qy-pV0teOuYyI}T$%&GtqnvP^1n+cCf8JCGFIQ*}jxClOuY*)+s52~d4- zN1W!RzTYxwCYECYj1m)VE_6s! z@F+)j?8q?!nqorRxtOPzL{r;xsEO}tu7c17a6p%bXW`%OK};|Pxs`{wZf|#W(Zv9n zMZZ(b=;Taz$@t7OxHO~Ly2M0HsdXzt(ItdUt!!m?sF9JHM+jiQpJdXnQ0>Y~IFO00 zU(dWahQJbSR7?$YJ99%A&_uhaS*R&TClCd82@&en!ogFMXkyRCj_nFw+Bxh=Ed;)G z%RJkKZRg7FR0@|#2R4=R*|zFU!faA@wOTh1j6}!m6!ujy1kt-IPK}Snr56swhu;6L zc>F(nJ9^rBlX06z_}v1$W*Lavum_yviS%5!(!Ool%mQzOi-M*7&mD+;dw0dY3%AE} zN1r7=6B}SHK2iz5L|G}POjKFnub4pVsXqrXpfzyx1k5tDvIPMnpk*NEa4ceIr%8d> z0>a*=Wfs<01#SnvDYS&)?%}Yi#nyK6J{iqDLww(X_Q5E2eGkVA2cL^e_wB{#{*Ksx z^aa9(VjO|kESkn`q|cYML34~_qgEktCuTI}XC~s_2RP{M&Ku*ZE4IeqciIr%Nz`B3 zyC=3_L?7toaG4{AN8`u8 z`UyhOhvSh49){^3h|hlf<8jBk-j1+zh=~(|^M!HvE!&(ja;dC>0(Q2iizCh8vUW=g z7j3BxEG753f(6SpF*SBF_Fc3aE!a=7MQ}Pz>-_m=KOMK;d?Wn>0V931oif*{#zBoEGEz-~DNP z?JM7B5qCOnxbB*`{m$#-?KfT<9pFqSTfe3;U62BFg#ELaa8XOTyAMG#2c&%*LHP;B zm2ZFNr}34q{Se%_Cid<^IE!Xb3ll&E=GvoPLi4r>O`=XTOz0W(U;HR%JEz3iZ(P`E zVp4c=90Bfu!*S8YdjjQAc2Cld2!ZC&XqcLwj~#oq#C6z{K6GrH@IlNE&1T@6d>oI_|m1>u~gu@{9Dc}4&LKmbWZK~#vW8JlcX z>Lcxu-^s~?i18M8a)ORMjuS2LgKAoiY~z4N?DU>MxIT`J-pR=^>Z=(Ug}uTQ6jV6i z_~kgppLk!!HSb^mm-ugpbR>I5GKoI%j^BoRlOeEn#<*IT!pzs`dhyP-t;MLG9WxmT z!HqH@RbxpWfsvWEUrAx%CWKAHT%DLb@^CM;c5|C6<8IQj)m%58-cSh8{}|AkU7)8g zstr1i!ax&dv9vGR)y)DKCW($5If-T`CZ!ye?Xu7bMz-1;!}kJRmLc3uCPnxjU2HU&luwr?#i1o?B;=m+fcyh z>8b6$W2c%zC)+}vx-6)dbnU0^s+mCm+S&>~Oj_I6>2=jr7r^5`0w0Z;B6i-ju)rss zU(jR{<6jD)*fOqy$O^clfVZLtS;AVe#i_t4ctLA%iKc~6YesZXMQ8E){B;I|G=ggK)BnBNrn!1 zRRybZz|NJ7=NKrT=QxttCY~J3+^`77hk-y@qBz$&hNeCb*-hs7VF|AP3>g& z=CEhI5w0e$@KErmAknf^-pBem*j@06#}hheI+Ux=0V4{;CAQndW_eSM=fhBrjrcznx4 zpyhM_?tlL4Qj0S+{OR?})j)`ve-g_j>`gjAw4*K7*Vl`XOf4sE^LlD6C=P?}w&c8L z79f)Wl0_b?RW7l+pdI%ro>V2D%}bXr{Bkdm(kFv9e$EPkMgqP*qHWWG@JIpK6xyw` zPPA!bVeWUUt_)hfSH8w6ZBt^cjlUZ6bpI0nwf%|*q|kV+OV9x=C*a~N@m!qnFe?4k zqZBGSm3jb?7 zA%hTuk3TqntLKC-{aL|P8#G{HmhDTV(~3C)HRiOznD!VIyprcKld{E`vDh^*7<;j& zIX1ZxPjC=ZAPCkztxTwgK_Q|=@B#zEH!e0<5KoRr?~B}l6vAT7A6#}xe?0N{fjICY z8Ubt}ukhB1V`|hfNffVzZ_$pNk83X76E|Kq5|2Lm3^sUQAPk$P*ap4x-M7R?KK^b7 zQw5xX=IvlS`uO2EdK}e0>}SqXE@Tt9BEU}V1qNhsO6_48#W^%#JHW3d1UuU7yy?0< zz@RyPec$8c!j^uSC4`F2GFITo674HKB}OH^t9q1vGKLC0djJm_ityp{z*8oY+(Z@x zQ@{+qxdp)&GWl4XJ;C<(<#^96m&V6FbUOm;ws`)O?@ig0wv!H6_Ve|K3nxI@yK9svJKqp zKx5_Pi!a2B2lwY;UxhKM;RutN9hvik|aFT%VTOb^i39cXN5 z5BeAPACABI;@xrg4}Kaaj=mT-Tz^IUo4@*O{PCUdK&zDe*v{XLHd6<9-wv~;>5dln z?o&F;mkXfUM5e%{E?H`xYr;bM6i`8^s21;R9)za$@dAwCuI(dn@t&Qu!_{%~jn^Th zWpRQIf^w7YfQJUPH)C?4ZDE2tnx;+I z&P5}63$}a}9{ud+zlg7XnDB3>n-bC7?HlVL#w6BZl`y#p|#CPWgFX9p&w|*CpY0Z!MK(R0{E!)lmmxU zu1-7bA7!i%Z`|qN?6Lw;iRN3mO0R#*g72+eaL223)xD|?ZIca_Kb7ZccS9Xxq;k0`MO}TCsQcP2umF|9#8Q_99SjC&ulHc%ny&=HZCEufPOJSKB zWU^|GLCXm9G~LjJ{q&wbc1N+8C$A~box&yPg*%@lfeJwiz9;||msYRr?;=WdVaM1K zeX#}pMV>?fsPhHe!!&d30{Ze+?rL&sq(IbNYP}r3sbF+$%(;My4`_5F$W6PY=Nb&7kyI*W+q+%AnWyQ*ia%6ES|he6`O?8F{Ha zG=^7U)%|Qaol98+QLS}(5H1BaSuR7QkI=Y96bk@!?p{zK(z6Qs`r2dLR{Go45$K@U zNgrZtbN8FJt~)!M5aPD7gK$%9!QTAH$N=UXdKnYpui1YmwxFR1a-ogTRg*|?tp0*wUEU?*p` zUnlmGM^N{lU~;bpmi85$uogN18drpzhN?gFed0wGc82^auOxcs5U+}VZuf$hjpbSY zona1Ut~4vyb#f{5VZFsa1*HmiPmG>Q=Epc{5vtLvJeBP1CBlnw@tM z7*~~}x+h}epZy0RigyRxeD@jLO@^T6Z`rD=ig)tl$&9amHCS68pCu_XuJ$4LY+uwI z0&EZi_%eeCr?1g;97zK6)r0wgiUCsi+Q!PCM*cnc%tBNLUuc@618J6w5mF3bB-5s_ zh1F|TfL)=UgQ3x`R+>M6F=`@Qo?ez_f%h&4Cble1&UmVOg2z9idyK4C8Ajr4kz3a-Uuvtw;b|iod_QKk>Fi?>Av{z?YG6=3%cXU=N958 zKe-!wq+8X0T1#3QnoPxk!21>|elb)zKFC>m`lUna()c*NfN=U50_|V!PEW z?;iBlMc6#1ReI1oUty5B^KfQqrB~E?>*WAjYh*Z3_$<{Xe3e^%Fd27v(k>)J$q&!_GO>;&)AnayE_lk%o)vS zBymLx6sInLpPFo5I3XrrQOt4u7$2hlL!M7^M8*kDG!nf+G# za4iUIyU5!ug}DO(cqWViiv1y9c*w~Rc}NemE!T|sj+F>MH*H>zJ=?2s=5$|Nx_lwN z`HjDfQO1NXeBpuk>aTqXQw1xC3*Dd(Ynq^)iH^aGAMZmcZ zO@%-D7rzt#;s5?G@#?Fu#y9?^HU90t`mI`qqUzUFUDMCOZT<64jU3D*?5V}Cy zq!FGhui&R0L9QA~t5#}LP%R||A!?biy2%KoW>aDTxKc|I|M_{9w3mMW@gV^3gJe&o z1p9u)7v~|gj0N^#`Buk<)vU6)wYa@~DEt37yr<(%ljjoD`a0N=f3|Pc?dQhvT5W9V z#HFgutC0Wrwf(1=L#_S^jtVAoCG|iv`fx^@m7%=+h z+&D`o{*$<{k#|)Y0%k9F*GLgh{s;g?M$>=LM1zAT*8_!utvWdK+-bxRqt zU2+D+I7~fFf1LSzOD?*0BBN^(thl2-F1j)U;zc!z@#w;KaB_^*dO3=wKzU z5kc=&ws0sglnAo*nw7lVca83gsILtjU6#VmCQ+`r`6aXS@FDvR4^{uE0x#V^76fch zNx7$6yJceo_IMS5Uc7iI1sg?+4sZ+pMTl(@$hw>}y}ED<-|K?@!XC|Ip{vSjy(~^8 z994i-tzdeH92L)~rl4k|g1Zr}D_0%-%79l9OXGU^UR6;e^;KR~`1-QwXZgG;A#Dn0 zA;kJ=`&PuR{Oa$fqrh2L)v>zk2fvY9UW;a{m9$&Pps}e+n|26~x)GMTVy{8=p5-0b zr@R6a!T}}pQ4cPw?5B--*Z_kNycfcxK@JU?ik)Z)_Vy3OduPtW)WEbLSe;M{6amT% z!d?$TQhUQRQc#UBdEf4>96Yo!e)7yw(t&|jD;EX=;|?yAr(m;zg1?9G^Wv325VJy`vV*ADw@ue?3828@231&Ou(Vx5)kNx!7xX=%ChrQrtA~(bAb;v28fqDTG63@MM zHokn%#<=~)4RQ9zFVIFX8mW<^WS=en2!y-ax)J1R)`M;7ts`;Mp6zHhM!fXOX-s7F z0qa#3_h)tmkJUz2LxY;a@OF6QD|abU>Cr;KOXt1#=4>h}(-+w4t`p=>5s|IW%rUwvQalqd2 zSbIE;7WQ`$D!%;co3VV=iujj*@N4nq2M%JBwSmO~?du}2XlDdN&^|VzPj@1Rn7XP4i37FLTh~%Iw15%nkFnEW0^wpS{aHb76T;6{=$B0UI70ie z5wuIunDn&d;UVlP)4#Q=uExe9tU42p0@q18WebA)hGy^#0PaL^{PHWW$DjPi|AGci zZ``nRQ+)Mbej#q&za4zTu5;r6{nJGgXbQqzwRa}4^{WP}c-oD9OzG038eAZ>Hgu=Q zr(zA7oHHAy>2F_+|L0HsQ#|whtMrNO@f)AJ838biEPZO+#VQtun%b8E@0qxKbu8X| z`z^GjpNQAqe1}5|i+P0&YuBXNhKty_e(}ir*g*b^_|4yZAin;a4@CoXYYe8j8@LKD ze(C>o95ioxhsWYOKYk*<_1F)P8?TPv`s%O6*B`!(L(;$#gh*2mnQ2TteC^@;^C@|FEnL zLVqWP*~Y@0Z;&%^Qzo2cp=<_TKBcajP^g7TSEi5AhB-b;$Hi^OImQ8irS?gC`x>?; zjxoMsx}lGS0&v7hzhFox@Kf*=AK>Mm{zcQhHYv`~3Ah^6KE3e!ls0=Qw#e(CmF-bi zlSJzJ_Nn_;TDj(-fLHsw;tY#$*d$!F3X@CAo#aB>5cZC;5U0kjlU%p5rhp1sQ5M(5 zuO;_MLO^~swL59<8O9R%BKy4Ur2>UJ;xyaP$ZnODte~ne(bYK+moN2UwngnT_$Eyh z=|m@P1*7cuzE%8@0g9`(>KDp@->)hX2p%e5s$U!B7xcXnq_hdF6*L+?o;Fh9r4#My z)hxcPW?{FJom%pm69^?W+t$kXNy9+T8N^HkS}c9nId0Lod?s)FnrQ4M7hxPfop*3v z!0J`qaT7elAc_O;p=dCHeSU4#dT6SLuw&4Gu;7k`qWzsGRejnDIX>nXS>L!;H0ezi zBOlwrt7JG54vaO>1~vOtKyfi>id|XO*F}e{A9d8WsdR)QPL_js=n;P9{9=R z0WHnwB~H*~NNRBID8*6SoOxn`Q$h;(nCcEQR^3K|nR44|EEplK9q`b`h-V6s`_Rxh4_b zx|OaC!H>e6Np03KK&<3w=@vBKE?pXks~mg+z9s>gLVFifX0iy@E8v)=BGp6bF#Z;w zssnM?qk8?ok}rMyC=jrH6$U8ul+deb)6lRr-^V>A%J#0BrD}~NGR3nDQe{A>@~iNp zyw66iKL0}Rh2UMAM^%OtTq7h^Xl)(U%C*eC>l6sh!zbTsPBf#cFa!wSAlR<->P)-3 zim8I@BV<*MjCjotdCB0+a}2R5kS$Danu}QYoibK^a-6cs7|mq=#DsuJ5TxD4*N3 zind1^hjk62VR}0D?b{sdR(8d)bHinjLpn4}Jhyy#XiuPdS6ak;fHUBlR>P0&bwwOKc`2TG@zwa!JN9DS77q=mpn6B%iD4)Uk{VYPy%5$1WiaFe!b z!7VjlM^P_$8xs(B-?cq%xM5d3{pM)~d2oobXcu^rbgBiE(#d2wapD($!jtUKyu~Ki z7;wZkt~OKIxkEeKutTu|8=-gKe_K3w-|cKyk9g=6WH$t;k7}ga` zlwoWsS2Nl)qu6Gh!vD3SC*q5TH)0cYd;H{uSJ4J$LJbWNWNk31W-*Da*A+~(#q-T; zm&e1Ozc&%=vB#f9;N4AI6g-`Wq95{7-zV%}03p+CQQH9+yLgyk@>^+rFg(9yW6n!o z?87&M8LEUdzFuOc_&n*hdISmYpLiRsOC~X3W)tvj#BW*KOx(O{Tm0VFz8o7@^&rQ* zg21vBfjVPf+ln}aZFvs~`_WIHC7%}h(Sz~GBllukc{PGW#yU(DxH{i}X0BsmGRx%I zf+mO>@A~;o+{;A(O65UebT>*@Xo~eJC9l?gUylFyU;aA&?%O|%JNE5hfoB=J3Oblx8k(t1FoT41|& zVp`>{+v4`y5VEpZbrhlR-~IKE;vDvL|NCEkE8ahICVuy~z7l)3uY+D8h(uB6`aJ~Q z{c-%*Tk*#0uQ2f)i+k_60~o8BgBgZV=o$+@lc>30#3t|in8d*xcr-CdY($eu4I}%q zZJTr&D5mW{U@q(vkT%4p)z#`}@x?VYl?qQF4W@sIU;HJmLQpz57_W^9bqDbE(5$m( zuR^1pln|aP34AVkK@*ZUborXb_lR&HNm1)3Yu7~lHNF(&1B?z3gMs2aOvrn2muuo zT)eS8Y62qKM3Y|%wrn>SBFoM>7b4Y0YeV^GC5JP%u-MwiA|Bg}86h00v%lB+el>bS zK*~2899M+91&{nK_%$EPGT^VokCe5*#p=pEN-Kp*x$~8FDMChg2YG!2>MjbeSlPjD ztZp>r<awdeeNpKq+c65q{hVs!e~cy z1XFEWHm^iBu!qIxQ53y6%K`pnkn=4@!Gi|ExU;Vr#S=}qsU)Jg59ck__#qD`Ru#AK zu5aOisA7&a9^RMA7w|+1#T4{b=YCjrVUcx2aO*CCRt)%eVN9{z;W@`1EDnmVV*ADTL%}sEt5=rnTJpt!WNQg z;Gf?mpIeQKz$tiz(? zbG9IPd0%p$We7O3exOs^NGIY{$Wuj7{hRf#@(Qx$p+6w8ha(g>fvpj@yszX$&MpS@ zqP5Y0kSK+_5J`!<#`#6YJXIS4FOg1S3^g{-g3nd{6>>^s__D;{Rn76S?g|0io+6WG zo46v>jbLKymMuy2uU_qi5HY-g2g2LdsPMqaTM^jR+G5cX%n`qAOWO>WZO6SzD?LBP zPnFKKQ40TbBIe2I0nvJ)_I5^~FTi0=YIS;aB_ zVrl8G6PErhhQhP)%4l06)P60Cm+g}MlLRbH{WAnc z*BC<0_O|8m*b~ph{kPu`x7@rn4ju2%J@4gv7dFr*ea0Si9rVYRV3=<{H zgYq^ZBpXKJ)Xetw2HN?ZbyLD_v??uhBdA6?H{}nZ=ULl;Rb}Ea?C%Y6SwUnUiL%#qztEr9NJGc1=7rO+F}Nd zvs&zo3&O_!ra*Ph*_x#srl~f$&TwEHFaW24-`huzqj^4>ws@fg;DR>h2C-S(6~Fz@ zejWRBoAQvtDKt}uVa)qS8{+xrj>X@6=ST6zTPNc7J8q4y|Hi{;F>j3y4)SY8tGUTZ z4fRnYdkWl=RH~Eg#MEaOUc>|Oz7=L$En-*N-NK#%zbty8tyyB3L2x$9Pn!t~+f6}X zgUmWeZJJim{$U!9mrg#&m^^80{1mh$PI0ey1@;C14M%4o54J|PbJ8-;ySHtL|MUO& z_c>wPxQSCaVwAL43?khu6^lkh!Vk#8v{D+gMNqE5l8HUqJGn)dv=wNJf321QLHZ1f z2g}eNx&NM9z|pbz?|=E%@t^ZFAz9v8V04K%tOZRi&p= zE$N<4{wC?t}J~8PV!ESUU-)NW-RHYLZE4OQD`UML+{qC?O`!xIb%K}6MinVq!U(LWxOKs z8tl@W03I|ZtO0x8o8bMYU`)JE!b3>cT>zeDoNtvEfYxv4oQ=`ZUGc;dFGJ^17FgaD zp5txbO_L31_D&&ORK|!xjMIRWmm_Wene8RfrVQ(%+J4bLq9!Ml^L3=Dl@|Dss!sfh< zua-95 z4Yj#D&Ad%p)|w{SyLUTEO*`l>%pEwF!(9)KiLjtJ_#=L`Wv)|;SN?t$K?=|b<9A=2 z2iKl6Px026I=&m^8i!|wS@h#Ip_e>9-4I}OtT5u^Hh2}^yJ?7i5@0Wxa+x&*MJre_ zV-kP4V<@g(8HSi3P;o#<`=yyBe2HhSG|}Nw_(ptJmE8VQIgz*OzydeKs_x8PU!}g8w z%F*`9t3g~kAOyavD-7)u3$lT_Z;k=as%af;PiZI&xA>_%hr;7$AEmR;-Ozy0N3 z#f82r(YbOXp@HgHKii#G#TUPDf84q&;*}$>$6tK=nRxdi2V0DF(Vp0i#uR{p?Pdg3 zYIhb*QH3UG)=>9$gfU~7ZFu>}8}VzuemhLZo_P7hrRX04J_tWuRaUs%h9Gj+&UNuy z2+j82*p2}Cy?FG;FUFN27-AS34=yY8o`U_1&UP&VN|;L0s_05ZQ%tVvzqXm05#p!J zc50*4@=J!tzGZmE4`D2d=%Fy!S1+EAkwF%#a^V2sI>Smc0;krd(RlcwhvLwo zeFzWR**bnP;dcDw+4$z)eK#I|_LbPQWk>w$fAg;}e{n0qU~EJ-W7nEY#@X_3FY|v! zNu~lPd{PSq_&VXS%uYUdWGjC;w8U+zF2*>?DgBqYS@=SaX5m0JoRAn_M$*NX)X*R? zH8Y$*PjPUf_-2PNcfgP^FmKbeD^*U|Wj1?dz+d`lguFn!60nIy2w6f#XPz>NJyzF86iS+}GM;830j%zb$1DjN42I0W#n7)0as z(I0##)^FK~R_&}Dmz3)FBFTDI}{OO)8+qbKz8ApAVmjpBgfWRI^vD zV&Z|1z*Q)x%V&MvQPYe~K(@$oO0*^$di#c1V8iYX3w5oU>H+V>Vf(+dATJ33{Y)r2 zIa_j{3a(sp$8i_EC&}D z%Pw$;rnb3h{#JGdX`_A|hEOfZGM<84F z>)Th7M`BD@Bet2o=lHHLshLA{S8+a$wvfBJJtM;H-g3}oES<}u)|c`&*K%d28SnBM zIo2Da#&eNM2G1YU(`l)e5b$4nc5g(0*cUIp^cHhT7HwB9CyDmt`BtJytj%AwfQLEn z!CjKJt289%mzkC{#o9sdW&F)8Gl5sde2YSCaYU18t?;Lgw6;H0KWL*`(@~0y|56GLQ&q#-JS14n!;f0SSx1N?^44x(1pjJm|xNy(f z0q6R%8oq*0=JP51soJ0_`oj0h|9W?Ks=JG!2+qr5X2Ku9%%p|~3oK~Nt9Z5RhRy66 z-3~m_sHT79!iqd?0yY4~)bm?+0lRfQhqM?Pxm_*%4 zuM=5U!X)tiDXGcQiM(8e4(j72b8)>6z^5hmp%BOc2iWT*ZVp6hhI#_~>QyUgkL_`q zt*@6ZT~7MpD!dwZ4iau3u3EzQ3kRtW8UX4C3giAP?t_W2CAyv~-{vNTB2*dZ7mKm5 zjC1cvNlTR3$?Ad>a`0QEEDQYW>#`7j3sPM4wUo(E<|T7QpKvmq3=E7C49pCIB}7eV z9FE0CZ2Elu@WFWV*m<;Q>2HKpQ!2G3sEdMBx3u@rM+eZr)voR5@7s^Lf>+|m32c`( zVsnaZ%x(15!n`2*NdYfR3Pl(~6P7VAmN8*(P&QfIQDJWF~ zNI{ro%z>2pYJW^dtQWhcy+fELQ6dckJWf0hQfNhs1c_{nV6W@xm*0>3?ir4oF=McM z+wyq-^(&Y@APly*G)W^a2{U_;n$kH|TW0e{3t$Lszd!rNw^G=vCgHL!R?OLou7+R> zi&u>Z;B)0yEkbZn!5tkCMi%?Y2#jvo-yKhHUL9Ab1}M)6b)C$7&z?UM-+$~!v1ipo zF)`8_=gvY;$JsW{#2M)l!YIl@8?ncX_GQ~SWmVuiqhB7D`ZyqL)bRGwk|WZzgYZxfOh}NXhe>D}WBdA^_?@plk_UbK?caPio_+e6 zSc&b;|K(qQ9RcjhSdaGl@@1U};+g0<-i*4%Q^7bW&5x8yq3rnN5Q`&iXxCyhd)L?E zndf$5uHo$-S|2r| zwQ;RI@p- zaqy12DHHn^AcBsSww;3gpA`={AerT3l~k@u=bSx+kJsm?+HEFqYD zn^;T#gm_4g+Yz95V!pxML%qEtF@&891?18x$1ri!`0|HkLQnq}4+P)`IN`nIetrln z2Io20*4kbgM0==}WIM}?cwn#FzTHtU$(B^@Uv{%SdL4ay&6*y@W=$|jJGq$jiW}J{ z7)v2_b*|)*y@h@$_GAa*X~}(35U@v9@UQwAjg|v(t?_F8Gh0gr(f)7i<+J?O2+BVQ z`MWknFWZnVobSy;H61_Ou>Y^COa@5r)pjcj>f~(N)s-Qy{h7njYrlOOd=~3>bLAEm z@;4ru#+U_-bVr@=)g+F5h9()hP_|gH0&@(jQKaa0yf6KYj>`8U7_QQEw5oUJpJP_G z>HKdQPG%if;wfmJqwlmXY=tIR+Tx}IoO1y^f9d6SlIL%Q-mA4c>OvmojJkT@mEhH3 ziE2tj@*pMeOusf@mJ*0Z<&qK<{;BwAKB9~jgd~n*vvq8gZ(^~)`GC8e+(nb7Lqtc@ zPTpObMY=vqzr<1TD;;4f7*uy*W$+p<8_du}7!DmHZRbeNr;BL>xB&UAOxt)RMwNqa zKby-0YEgVH@G4KWo@p6sZDeuflbz!$d~Bi~!p6gmdlGK6AH2PXuFo*eW;(Nlv%i^z z04r(!Q}0^^Z)YozTHZwodjjnsu#|hrS~KpgU%x!(5nH#e z1Lo{f$;A~ROaN~M+M?b9SM#{$gZ|Q56{+ll=4aIU@IKex{e(-b$ozQb)588XYc@r2bK-sW< zT_z$i=<6R~HP}`4vLcv7a6v=V56Xo|)~LxMMfoU1bRm(hk5ix5BFQiCDhMg=%y;@P zUd9UV=7(SScKtq6AHTlb*Ym$#n1wkmd^cXM#M?;e=!p#63RYb$R`8=HV>eo|miDeg zJJ7`3g7(=t1cnMe-A>0q#Kg?4&&8f-16!L1(O`Tze*1s;YJ7=8ozB2Pu{Q4D*H=gTA3Lwg-)(q1Thb zD>Vf@=t=bMVcBd9Hua?&=We=n5(fcIMSkNZ4$4Hvscb?SlP?*KmWnK2tx0P z*UtYqPWK@^Lue`^nXBPIH9=1i-J({}Qc8f$;x^J4bZWx%RdX3=Q&7QH3Xmo)D8m?i z%59A@if-dq=sP@uHrv(9Y;WHZJsjdSg$A}JG!&kx)j5VB{mrAtunoFDHf^|pEv_4x z9Q7ke23pj!g-LbVH`LY{ZEBe`3!#wC_HI=(2Kssu!SH*hMq>Bgj@YxIGx{%Ij8!XE z$IaUg#ux9qE%xu~0={GMXaC;|@x8~7a8MQHYhyb-!f_2eHz2%Aq_UL&Le)MMF8f|R z*MArMl~Z7+CUnA+G-XH?aMnB1DViNt&@li;HM8cu=2FNDAd{9!zZi35REPVo#=zA} zz>vuX!G(u5q}yrl`|rC4++iCZIHC6FH~!*pmITW#F& z)X;6C4=8BYmR=Kf_@)%>LVQ|VyD>i!@fIdl-hBIHJpJ6O@!DG_5%MxArOhW1c+YSG zd=PHaX3Wg&+!(jsvM-jgC3J?v=$v$tHIBjncR+~0=7Ts;AZC4vt9+{WPwU-!RaaGq zQrA*{{il6!6ejM5OFvJlg((Si1gE zTt$~YO4y|^^C2M3SZCfZr z8Let#5t}3_Is&EYO6v#OJ6P-7o4lhoY3{| z)86l|*Y`>t3oK?~02s=GxBiYl9IVXF7fmvFz+EHS57UlK3WK$kpZ&VP*7T~@DruLu zIr!Co72dql7KJo8%2wZbO2)!4C<-x-4{~Vp+SO}wm((!kjNW3`+z>YT8#y@mDs##X zc#Cd#=(t;nxL%VaES6N9R2(y6@gI8xAtHPnTF$)<#gVWWrRO9 zXvN=I2A$vLU|sw^+HWa`rJc*$#{#b`u4N%uj-Bv3@^8+G6gtaix1r3Xkhhz%%7bgN zVRU#HLA*Q8N?glQa`Ly-MZe0oJb&`PvoNf{QdgwxCw1@jkJY!?_D{`wW7S;eYCUH@LnQob+#T#t{}OQ#x;=7)8XD3Ptl_l4!HqmWf0GW@mS zu9tW5uMb~ek7QaGiCTrJkGC*bwi3m+k7@e}St>6uG4u<~1E^8g$o3~KFsZibVPL1u z^mC9&Pds$r9dYc$x6qP8SAw=BG(rzgsaN9=T^fW_E#0f)O@v)9y>=n)xNTz`e0oRx z^!4*7;A$%k69q)p-mHRK1vwoE6$cS$4RJX7`ZWl~=;xC#63)ZrFs57#lJT^x(1h`^ z5f*r^#I}taDFdbs(BhHt(tfVmJZZ-&`@d|IbjHe-7K6gz*A!O=rsCYCp*Xa=E7q^= zh?8j9K}a%O+CSBv5t_jO1FcO4Q|hMa7pIg{2*So-cE`{vQZr1uuTCn};`OAqDYlVK zPWQwMub+-L-WiTP`!>hE8@9%!7msp)8udU66JraMTRO*`Xu^?#@$cFh8oX$ac6G50 zk;N-ldIzy{B||0QomA5ao4pDQC*caFEDO?cwK`oynE*cB%x`vY-xNt!rWit(u|1 z!8|l?d3SdVvh7V)rE(SCUhlo~ukO+xH87T@%zlz4 zIPjOTYNAu9i9QVsFJE9G!$a1kX;<>?2^K*juinXt@==3J0OP+YReVXI$wg>kOV9~vWqYbLf(C=Oq!u9q z*@g|P5Hu~LU+{&67Pn?A05%QNt2E83#l0$z#2GWKT+*CUj>>E4{z*WfuJ2XEjJC98 z)YymMbFY=F)@HueP$;Q^!VbeuB6yr)jO_02MA)|;6I26n_S~g3gQeN5X80#*sBsyR zab;Zp6l($i06+jqL_t(5I8tR&%j+|Ao9hFMRSNh6kXHC{l>^j{cTv9y=4~1Mt*57( z{?^SL8*^RF@I7b}I(B;&hRy}*`t%d5*+4mZ6Jim#W;+_Y@CC_w*y6TzeGI(xk)Lp< zn+g%#-L0HsaDdPaX!5>A-*>@vBu0lYCqbDyQMQnmQ{z>|iRAzBugX|Bff}_ZGoQxf z!_CQp$lt?E`CMV9Y2>*ChQ?o>*mGkXm)-iOePRWlnVJGU1_OhwttZN_sk*M@IOVKefEGR8=L&9eAWtjU<_Gg&#Dm zLf$z+um0}v>+0rkSmsBZisTKX$g=hR3r2iLY5O$6#{5v z8Um4%AGc%4thX`%abQ#1$~;y1>eV6a@C@=zdyGujAT&t;L2d{3LRe~fC6O@|b6s*D z7XnG-Y6M%2GGXi`aW4drL%86`*RENegQ5e$<*Qd28=1h;egr0K+sC%J*5&5~-c_Cp zyg%^udg))!e|}HTqtbFRj*QZl`_g){S-hbh#bvP+u_?ea1CK40$T;D&8+S>5w;m- z+B8QIW;Ar7DT=+>A9HxoEjNBGzHtBD@$&J%Wy>;JH<(^f>(LWs8y0Gwo;70~lSor7RYA&iu zfYfNF1Zdz+UUa{wg~v5Rz*X zxC=`a%X(JE4Lf(mnGwuku-l?b zmqO%gv_vS*x%z&R!cSl%Go=ma%tNLL_{)GMgGEnhq^<*fSL4dXb7=350(;5{e5b(o z6)SoWjNcTmzW#3f=+SQ@Y#fPu?)zdq{Du2iDChwPIryoc?f?9>G7%X>z$6@7&@k!; z$FE=$xd|9u=~FvRoN|KY_CK|;F-L%4-}gRjin@(zWSGemFdLy9t!V#h5HWuC7zTSZu6Ey=EM!_)NG%QB-ykG-2rUt?73F@|tN;NZ~XTnE+>1Gis7fvXeI4hlzX?6lA zZBPf_y0Ebm_@Mbihc32_>EfiflEa&N_H0I=Ji^WbXbzKKwW(pd5%QveixKYTCUzNM zWPAWKEd$abOqM+L;;Zqa$DfJ!&R%Bn=ptD=8b9=N+Mt;>(RTMFG-(a=ZTqf0z^W51 zsm|E8b6XxvH_gF&o{p^G!Udb$NkNIE&c)F-01e3UO1Z#WpFX{=h5)vIx`p?JH4_#% zf*G?G8`J?`{R3w5eQ8pL)?L4`JC+T%VzvR3GT7)H#*X|XcF+xz+EDT#h4Oc^Dp7UM5R9BowZx)ne>Gh*RK%!p`1Cn5u zK`jNmB%n!+a`;^n<{H-L0N?<2wHJGq+#NXPTDs)87_nSfmWsfBSlBAu!uVCZ>wT}n zm+yrTSAO;PGG5Kq!0^?I?i@iiM!~`QxIP=R#993N!te{7{qsX0kJGJ+L?a;kh?p+~~{T#uQ9YmH`HR9O*|t+q+Ml zy%e|KxH;CK0elrR5B7Jbd_v1}R$RfJMtI~_F(-S-uwvE9)xiBy3gr}FDjBk`S6f&t zQ({^&T?lFTlU9wfUHZg(XV@CE1ta#GqWy^zXr(&YG=1vBB%lr97jn0ZuNJd{!E`(~ zzyUX*)t8!=2<93aSYbumfs@v-W*`eY5u?zrBgfCgk+-H|ZC7io?^zz_`=`;yl<9+M z;xDxqVc--lnU*^$O9jhYaJ~ zy{v=sjK^BGrEl1@E>67rJ^~UL0!&b-%{a=p^H+Q0g&F}mmI(pW` zp_^}xJ8#+?U;oOzarfPK$Kx-&63@KycAPkkz28wLS_o#xZTv-CJswxjRiB*;F7m3m z0rQjX1r9qtRDDo5a8=IuUU^U+aFa&SV6-dMNdb|shN0cigjPfR{Mpkn!GZ+nNt-AP zB|eun#xGtTh!>xKIo7UR7kAx%GXlq^`0kI7WIPY1>qD@w26}3IvX~_!eBt~h+7ZDi zI5mhs5Q@oV34kemEzy!!iw4?|AHrO4L~TQ{$?fKztg9_S8ULIBG0s_Uo%OSfYL>Vl zS_Hez*lzAjo3yKzFJrqS_A9x1y4o>suo7FqOpFj3Yxcu>l59>gq~$4i$@0y$lclvk zB|LNC#|UNDOfu{&B4|cpj715xjk8|V&v}h_>j7A5%PRPtZba*ndaLoBho33n0VeRe zWt=x3I{nlz+C#KacPHApLj&N?VDzwEduSB%G0=%&`i2WlUD)Hx_C;&D-5mgFcemEY zLK?V1I&upqL@t`JKb;4$YGMNXZ)hr}pj@nx*I139`0|y@(Y?GU>oSf%21+OoW+1v( z#z_`7j=py`o_p!_ctlboAH}8n9RqGHm zLqDJwYt}C3d;t%`<0N=!hZ^~kF!9C(B5@>FaDatoLu?6mT-XXZZKBOTovyTtWiL;q zPNgnBSI+unt*LT(1}m(7#>)vLuWIs1nuW?F+xk5qNL%ME^wkayzU*Sf=?Vw*4zj>9 z0qxBs>a(n}tGi1-#PcQh^FcruR?$$df)sP!xRw78JS zV7tKivtw{9 z&YVLS2D9M7nu7!VWR2h%+M)i23JsnOVp6t$lJR`;r%;4R_~Ybb@?$Bv`InuM@>slq zRPsTob!t?c=lrD5nVncB?1FKjB^jI4E4t!)EmGb|r-ti(@i9Xfgoi4mFT%!mubfvq z<|9OPXO#k8Wg^Z$N($V5AudZpl`MZLP10*#eIsW;OnsSi@RRK&-L1@Gx@@mfo;{z3};i6>G&wpE2$%&+=Zf0y_4nqXHM00lO+#SCD(iZhJv zxMOc@+^`y+-`zmG@c;^5NR=h0az4vHI@a%b1lPkLeb^ zS7AynRj8%=X9oiAE&atg@MJbQA9x?fwp|;VFD(!pwXN>A>K@YYHRYKXsbH`CKw$!d__RKr#<{H6*Co zX5P1t_EOrrgf;y-zA>A8VXMxiTE3K$;aeMxt|?<}w5rc18G%}vuL(bw!MrEqf7Gx> zoDI8Rl&t*g%QG*d1ussNjFZBaYy<}ow3}*7w+xora$N`}Qwwd4kOIX;{MtE;Ybu_^2Ib8Mcg7d)J`}INaWpO<$el*e zqd;gJElSNFG-`$b0r90?%s_N)#!N$Z9K$ZGoX%u228H2Lc|CkM(i=PqL(dL%ZiTZSYt9Eub#Kq%R=!av`*@bBY4{C!sy)e`l z$KE>?Uw&vuYz5u}y)eoMf~T;*whXP$$UG=|obqBHG9171)bP9@lXh?_O{4g1hM8q5=@91VHn-IKH0}XXJppg z*z1gkx4I{`Y}ydpwrq&a8`shgR$*thJ8fbsBqpc4>@oRFx@5{T zcVJaC!_}ff7>%#>wq05{5YD<8uY~7@OU+tin+)w`jd`eDzVXMau@r2}0C!>9006`& z<~`IT>Y|^HppDtY0@64}@usM+2f~eTl6Kni21b_FOmYVRb=G84ZnqTpTuqd>%|6UR zMq?XoBBM>;<(7-Z<~_s$Q+Lm@q-!3s(uj8c%ye7yBYZugw(iTX$4hS=j|=o^lz0&) zF2`I$2e<&N(eRaMj!2AHG+DiFV{F*AE4o&!11e5DM}c!gY-hsSiJfdgrS|reJ0TFz zYb!hX{)A73@dftO;4|#3BQEibd%lVvm9t&v-sLCkM+yjSW1m4k>@YiaL5l&byS>y( zTTWX_>n~&0tG8EeKL#mj#B6$|TU};dJyVF;ENkVnIJWIPSH5N6&_CnU!q4V0`=L~A zUi=SvsbEqCo0n$g`O)vQ))mrlwXob3a=2^71zNX*8^bmipC;j3n-TD>M*FP?b5K`NM7WGO zr2%#kxhtfVIiq$&=hCaorh1g$t9J`ua}X=_$YOm^$1(1L?+cQv&#Cr2+oKlwR+q0| z7YkY|-(2MSKxI7dV24U4i@hs>(~6bs_-T`tV$udJLgDDau8yO{qz(KQiWw>-c$iir zhZ1CpwPdqCRi$S0uFunQ@;)18e!&ww1_$nL=ZAoc{tRoAok3M)}T@PnKG$Gt~o{$>3S{?~8$|el(D&eYFb$7m1^tH?nog+CX zVVpyFEuX6}RSrs?%G4>=bzPPF`~VqizSn}cj7P$jAeE)Lws<2!>s(#+9FUuemhmp8UjHwi%Dqd)_xb z7w34xcS%SlOE_@CXX6wde@@4WpW z{jMM0)}5IuL3xldN(qc{&Idl&nRn&tpYc3(~crzNOj1w*fE5N%P2a+=w=DD z@70yTd8;pZhW?fLN$p)=BneP}F=zj*OnmZGdnaK06`RP79E#NyjR+Ie#yWwZS1q@M zsDr5ON}J21Dyy+M3hDhRTz>;Z3DS4Fmid;$< z!q=sr0ZF4c?gXC|M%Cr*_t{YO;cGF=tyb1rJoEFaFNZ>$*|N@yYX(&gwR9GIuV8WA z_=Hc!fPuxnGeKV3ZM9Fx$jCP6n&>NIOsJNx=!#{l5Nfhu(uc6|`y7~c;PAe9_};y7 z`RwsHe@U%hY%rmTHaU7OCPpr&nF4ew82mfp^%MPZ#?vR6fiFjb z1H*{6Yii`fxQtD=#PRn|0KfgQYj;mPe)N5Wrm|3+NRI%uNkJ>Zd5+KngCJ!k6BnpquEBjQ^2ahI8&YR+MCDYEBEfe4)JCVgzBfgnh|t!;N8&0IJ9qFJoLcfxb^mR z@!Iimv?O|CL_1IjHj`<#?*j8z-oF%YogIyXTRXAGyCY7%aX!wBwZw(D&c%`U&c(r( z*2iJ$w(rL6@zn=zh`Tuy>&>@L#!p{*D_%Kv3V}I7bA&A(`qhG+UhSl6A_6uB+sw2n z8URg5Cf#;7MxIT;)XABXJGEh(Fv%m{3iBq~LsJJ0FvFH@9KnARV@Nx7?m+N6GS`WEx##B<0tqAWN1rkLD{(3uiG3u_%;oWTQ3)PX_SP$w#a5^ zTNk4k(GhGj;c)^)SOwxjLCqu65?6J_KAe<~H1V3&mI^t!^$`T*Nv)Gf9!WRVnT0W~ zwF`RC#G#Diag-eiPd<4hUOI9-ZFp;|T$3{`t-u*vnLu-Qn(#9UdWqAGw(h2FJJ14N z!9;pljJTjhls5YNzMX4gc?a*)n3f_g1*YlIK%#I{2$+SZVsgtXWTbJz!vhlwoYL1X zpF(Gy>dWu5mu)h4D=)Qh)L&k(1`Y6lcB=(1;fgRqKTo7Cnpn2KJRW9dzzdYu5vaGZ z>!UeNV^dywm$*Q9@m73PJI%?o<#BP)VwFWgz06P^0qljJOd)Uj6@OyzU6)u^9{tU# z*=|)Gt-V;im|Mg*^Du1njdb)A!9Rv8Ih$6MUM&%mz1H`d98!x5`XP8S4a#EO6|nnW z=$s}qs3rYSoX)U(PJWITC$27PxYMMKodl~_b;qjJm}7vCZ)z%n-8}G#bfuY=s{!F$ zRlekre9^ylSJ6P1n)$W5S=Um`S|C!Wo-**#&nEx@+q1&|Y#q?1(6#!)%(YYXWLRR- z;HFR=RLh8ysTGpoGCAMf6bcJ3sB3me5m~Dg7IjX zrAwB}oP=lPe3C~IPDQI-ny6r~^vPy+tF*MRgM@|s)%3YGOgJINg-kN;0FOp^&ZKin zRrylp-oTqVg0vL&5nuAH6|J78Hi?hFKIo+ zqWoid*zLX>Hl{+ubI)_81qZLHj55%RNdOkbSFK%7TyaTSOc~X*B?lMR<+Tc~_{q8y zdcgy(l)_@!)Xot~3XCfau>MS@>k&SrsS;jpCB1?&$wO3f zpjxt7XG0psJZAH@!{rA*7F;jy`kNOQ9VWSO@^5PF0w(gSngC?pHpLFGma*8#xiW|E z+zUU;%m_Zjd8_=4yT=^f#^H5AfK2-OKjK^sCkx=}f|f5JHD79FE|sqfQ$5zFQ~A|E zH5+%%f9dJ71Az|^@P4#PRvqS}g*H@$j3tJht1xs0VePmId{?gQfMIM#(+A-Vws{B9 z{Aq6C&>M)12d%h;7W&Abe!+lz8a{@pkaKHlAT5oTXfg)!jJPmY|fV43s6+D$K&c^8#Z%@=Aq$f&wn!qcNex~s0U_K(DD=|hxa;<{@xn8!*m`~uh7WDV zq2cI3a6iexNUobGa6vsTF7{8vPuaqJ%Z~fwzPk>^v+oVW@pFT;AHseXTNL8D@ZuuO zRWvLvT)Gfjw{Ai(c?^LZ0;Ry9t6IVcU=+ByV%(~R7I>nTTjC7;b%qI}IOWzWCy$Me zhPbR7zjLi(`w^DDK7=;j>9ZGO*N%0ub<_HI`RLhX!dj`%Brs?~Xgh__#se8z5eB~e z`tdk<@l>4V@GYhe$seRy1yWS=at54C2$G%nIf&VVR%j6fC`P0yz@!-_wSi|&@rs^~ z>DaMhSv>NEd*jx_TjS`-h^Jq8o4O%blt{r4Iss90w4ZJNFFyBd9NKno{PwSXE_#Qa zh!@^Gms+_aXq+m5)P7SVj6nx|No`!)ZPU6n92E5)!cmw5xDxRT&{3Wy1j%f9r+p6W z-WgrZug4S`98)6~;=y|l#@D`bn7$hE(;ps>zy98j;ykiUwRA^D6gKCah} zz881w*vkQ9XjYsUigROpN5k?0T9r?|d_3Mjki2{McG~~8xOMNAc<6IG;+9)?#1qe- zjOSl@E8aPEF|Mi!z@b;#TWdvwaROVv!cv%uBRVyd36#8&nvM#6vn|El4B=1dSuP&Q zb9FK%G$NRu7#`qIv6I>wPF{ln9E#RV_A z4frt`edmYb-7{}c&q?e)w}PL|v1Q|`*uQIg+_Yy$Y{OK?isju1D9N6!@G_@%0^!^W z92Kl6@OAf%IGcH8od^bS6utvg1fni{FnJ?P17(p0I!Q@E5dGG$xjRI#QI8a``IwC? zjD&TeUnNBOCN5NXVEb3vEeg#oq=LCjgz}DXpkNz|1Pb@_Ksfw_Gwd|NSzs!?nQXI64Gg+p;z#l5u z(7c0!M;DKB@(z9!K?<}7oD+rekVgBj4!_b?_GkUdd%@3IeJZ@GD`N>~0*koWI`S>! zR$*%C`8v(a|K`B~t#Sc=w-4pjnYS$&^#ewMD4#R~d7F6kC{UEspOtkB~Q z#>V9=D)sbqaJ6H17n+f~SrG6-e}z#NCzF@v$p_$*?Vx9UzV*+1s&gNqN_C-^9)CFy zSU}q{(~r_pwzJ`?i*yv6z}w8lF7JAXF^w$dHFG$pXCy$1V`Q{}1G>jKD3}F3g;MZt z?n=rN?CDpD-i}+kq|4+mhIahbL|)N)cfpWx7bZu(NsahTn^wbPYcJK%ZlNzb`phni zm*aMoe^rJW%_Bz1&$yMV!c_0qzt`7xVW^6%(SoyJp+z#7yWR@z8IN5%)~6=%^wit5 zCG&}fWtamPieAhr^`JeP?WUrKG5x8HukvFR%reo1KeG`ET zt}T4xVj|wi%KkV)x_3{WiwEyJ5Ic8lB;GS<-dbP6C}_eg45fpKgE{W#;2^TmIQ91V zXlIeaFDWcd4Kb4>9vVilTbYGsDqKuzV2id}*EJ!)8Bcg#hUvk!F)Q7V+<#}>e$%Gd zvZW_pd389x{SVK_iL+O!<{E@#0F+{=jftF%>NLdLM~}s5|A9ELb!Ghim+y)G-bdq& z^OsRFTuEN+Vju(aA0MBJ)90^XuQXyS0^Sw`#zSbUOpu1V?o6`@8at_-LdJ(qtSbsMVsbwh?7_MTy$Y3mVGMaI?CwT)BzQ{x&y9t3Mg>qH!fT7$mO z2|#N={gUxk)0BG3_`1z^h^>5=Irw4yw(Tqc+J0yvBb-*aISqW2!_SNjMgRFzF*DqY z9MV&3*)k8FIM=bSOu~?=6)b)7Ftg%^Fc5*BY>>j}My2Xbu7Gtp2#Yom4@o2i{4l+0 z7`LKvtx!o#`u>xjcQai4@Km>LJ=UY-?1VPXIq z%bFMQUhZm*mHS2|nJf=9?Xj<%>UYX&h~&}d-$suPGy9GKUK?ZWd{&cv%M zB(yX>6>BlGb2CExn{V6|H|^tqL+mrRBkk2*-xR`R)`GGxdvKdh4Xe@?^v%>X0WL82 z9uzo(wk^43y>eni_*~48&eO4-aF!9n53~_CDS7z=rgr{>gpl`HHrS^kxTaOh(1L-u3Wb@de&@?p4D5Tt!sG-@-2fJD;!(M4x{$izGF3Z z4~dI?H77F*X@27MB4dMPUvdQk!svrs1=ETiR1-rled>p*g!x#Nrlh_mmh zIAPe_N>6$UaaW*-u^gf9iWSSEt5Z!hV&D(en1x~0ud}HWmZmR+y%&nW!;)Kqz%>wX zo{^}_kHRMTSkG!v=+w;++0s6SQUZKypXWJ1hv5Nc;Nd*jl)(Trbfgh)U0`&s$Q!6# zX~dSq>$5eVg?)wiHLtvhwm6@&OVr-eGjX~+`CHOjnBKzgCg6OjB&3F@BEIs*eAl6r zaWc&lG4^O1b=B%lb}+Cj58AvJKtT9UkQbTzLt?^=c>4)tBcWo@pHQj5g+ za4*Nxs*K`N9z@Of=vffH+Yg=RYi`5C*M?B&8W|qMj=H;X zi$h)0Pj9{{aL~govJ|iY-N%$lCTg1-y31 zV#Cc<&eEMy$gA|i?!~A+s|jRhOJ>`;&yIqhEFk`g=3Wu~La>W4(Mgt0frYjp*JJy% zizW55*yO!%;UX*Q2oVXRW}3o9Ls#UjBCN(QHrUGGSJBb>?}pLkHxrPc*537>@BD(x zNy}V*#k2aYg~?Z+#e=%A<+TLP&ow41N1dt$Razf@&w-zuKNXagxJ@o;x3hZ(kqJ?%EVjVOzDeZB-tAGR8q%%4nRx z(vk>`+R=!ci0?o3Vr<{LG48(Y#(4SVm*R9kcD@jBO-!iu=L#+>yd1W6?8N1`|8o(0 zcWjMg$4?{9RfNZuD1=sO9##ySvKrYKwFPBNbHJsbX=3HGnq@8 zgJ5z{1WVH#0yUK3CuP2&H?rO%gI8j8*J$k7xhWob=!?`-jrN8-UTtSF8jS!P! zlP3q$v~*xP1C3S87;jp)8jVXBF9hvUtajR3a|Q}Gn-QMB`R0ju`0ict<%bTVhS?Nb z_H9dz#qWLpnK*OS9S~@@badwgTtW3TWl(^w#&FpR-4tgzvHJC6r?DHgIreVb5U0-d z<)L}Dz0x#I1&}}r$RB_Cop|HzV{wSX-R`~xq3})n^(2Q>Pce2(&y8~6ymLzMgz+Pwfv!XJXS_z(U#|GoV&|qIO zoXc0N;WOITxv&6JPCi;UQ+v1f%DEWs#r7^*yB;vtz*r&FO4@`aO}B9Ki(r&={X+;X zwz*y3e&WF&_K_9@xXoyScc8)0&I!++^4!J&6zwv*FuKN55L{d-H#u27>csrAR-c>+ z5~xN|YT5|?Z)_FPc5kgNNyqg!EG}V^Pxu)(pKTRhaP>6H z?*>S%7x6+s8b&(iC%}>867U*iqS1_?ZyMlX4w?^Wy`y=qHu_7izJqZ04a~P-hGQ5_ z@CFY~EIWWq(uw0Vg&$Km%kBbg?sl{PeFmPlc{_He(OB=p zWKTbKdPiBv8yOjfWU=VN0*u>x6@q};#DTsNZ(94XVBwrA_*nX>&(&3pL*;w%7caf) zIh-n`DxU9#sl`j=uF|N!dH;BBK0T>Vw@R2j);8Gv*OF~*-a ze&Ecx6pFj^19Len%yq!?ZQ9ra4foJWrxNbmD&OSOhMCva46Ov)IPrmt2GJTLS~*2%hAjTySIj(tMNSI=HI> zf;i6)csj>}_@3$3GEE$<3XpgEZ*leCa%TY^nPz@2<*LGZpNm=VJNIn8O8;`~FY_zQ zUGh=LD6M0KpB*C|olWdmSjmB&ozOeZ)S%0`sO>0P;G+OsUf(hmKi`WhDb795mEj-r zX%04}ZR_)b6T{ThFmuPQxar27@E6nZ{EKf#FLRU`6b=Sy%eD^cISoI}!g&$KQLm&$ zv~P{?DpaLDu$FV!mTAOv*6J00zwu;;z(_ys5AF?ctxs%tj7s?PD3d6yREKyNBATmdCNyOWvjprF^{JuaQizid@pJ;?9F@l>|Y> zkt$5(J$E;a`pYl8OJMS`%F7p@tBa`&iX$^_b!ErpvaYtc<>vjdf8TDx(3Z?aQVXFJ z(a7^%eX{evEWIs3;1>b`xw22#$*?>8(ib2aY6Cerb#kZet|_*VYG=@uzO7r=z`(Oz z{K8c<5j_y69YTx%#R+}If5(A(FK=9ys#@3dUuN^bGsp28g4*#xq!GTCgg@-+8r zd|kFs?WJn1e9f1dPrY!r3Pc&oW92cMTBcj!LB0?qi{wi!t;*jLI0>px#c$UiG|IO{ z2b@gw7xCk;Rh6lNRDo3ripawJQ}dL`tc$DtoG3M=022*Eg+5O_`9j=z=-1;O4m^0} z&9`De1_!N8)NB!u(kI!zJqg1(MdxYYz_r&-T!z9?ycHfRrkz#f zsAOpP$vAPk5BrD_x5Bu+@ceUeoRxX@bkp|QxKzuV?MeBLRx#c6YF}T%R;_!>t7fGK zWu={N>PW&|I$OYovRz&GCNgC^NBS49OkfyaXa`Q9B{)Wr+dF##OAZK9o2WYCGK7#5*eIUHR;|L$Q8W*)4o%1B@7WS( z`wqo_``gD5D6T-LOnDGIPr<-4Pl>*P>DacRF;?|-V)_CBHJT|>O1LhBdsESk0QTJz zXW}B~a2+_bGtRRe{hL2{Hh%c@tJtcWVmtmu>OYC5%K%!!X#au}BM6F}{7gVw6;fir zA_frPJ@>}jamyW>)Fj^`cq&_>qeU^9N%4 zbI0R>dvAlm*%n`UaDUu+cz-ou_MZ@>}NlaAq zq9Lx9aOt;5^I*BqmH?O3!BjI>frk0Z$STxL0W^nu^mH%B-s-AoMVQ;#$<{OkL`}54 zHjh07P(d(-PCKeXMf{s};G536NcU1US$!r>Vi)(yS@)zN)RU&B9UKq69K(Q{F{DLo z&1~Rm#*S_`Xx7blO;2puz8f& zEP9BKY2KnXxfCR7R%(W&n7y#47H40po`DinhQKbK;Onn#o_4l*@%jH}?@hZjJC4K5 ztbMQQ>gv544Kx}+VQJP|kFdaHWDMi3-XS#{rgZ{A!ZBO@atBO_xc2n!@? z0$1mR)-*uLvOEB8@(gAoi0vqEqM851k6%KY{PlA5#0A=JkhWISlLQ&RV%woOVH{}C ztV9vp$U{RDWqbl{=AHY?AjZm9p^wvHPa46$LM_@UaFkZs#e(yJ{oBADV2N1(%?9Y4 zn0YB^*R|R<-nM=|E(GcrD?FWCX8#b6#7D*eG}%QDw`Xq~?+adW7(Q`|#m7(xaPcDq zJ}fZNmtB~)*%#4*?+py2W^T4W9p2TG2)O`#yoAALuA2u4|M7)<7n)Tpf%l# zZTs$S7lWZM^m!+|sZ|G5d5<(nr5Va40ZBKV_xjv;IUbRaW4mLk+(MQ>KFIX+cih9aHT4@F!5q-| zAZKZ~+r|a)MR=byp=22$Q@9jP#(X;JcC~VCDu>ZNWp_0gW|r)rg1K8{2ht#O$Gh&l z30`cqyztUH9I`$IZ2H3{Z~xFJ&+O_YjCc70h2TNCXxnJN24}8Sm1~tj9LRaCW*=1q zV6lpYd+)Je-L%Vk{HwwATDj7$O}PSxHwU9B^zT6<+q@K_I@gYa*PLtHRAv_lmwaMP zZ*x+g^xblpwwFAN3N8w1!%P=tQA^h_OY)O^9UOG$Za-yp9y3e7n++b?G1&Ox;1clk z*-BWIEc<5ot-lMZtHSAu%2mLasN-`T!8Qi0`2`4@DDk{8SiEJve2u=BV7CsjJ3Pvj zkxVA!00f02jPWjZC9()}*By73FCgIUMS-aoo?A0(>DF`gY0GUv;1>mf&s@M;34oLO zBr^0ddQo&v2wMzRPU!gV)|6d4N5baU`SVO>u_NkM)fkEy`z1)y#oAd-qjsoB8`9K} z8sKYJ-EtoU0bv+$1pZaf8*O7mfSVd;5JHGyFG9XOX!8!BZGHa2MQkT?5Q5t!k#Y$4 zAdWCtRU<3ZCQXL4TWM}8&^l?{^dYk+9w8!-KTWIVW8@cFU=g74j8OH*QdPz(lQC#8 zkOrr~8H-;SvYZGu**O{!;Cf}RxqNE(C|s~NSVnMKi?ba5b+mlvn>Uo(Zr;rSUT;T!{evFFML`(+ zn5#1(pD0sk-YVdAi&EeiDVe|8h;(Ywqu*L5F6+iq{Wl;?M<)kmt)YQ>xg0{H^oISr z%S&&+&p_K3HdcEvW3Y%;M<@8%3mle|x{^kJ2$;nIgk@G%nDMNJQYUz|icrig>Cp!) zG7O92y}R$YqdfHGThJ6)E&u2L_1*IJo3E6A`deQrU%c-j4*wY}od|86j3{L5K)595 zqab0GvaYQ3lvxDV7tm4|g+coJCw^QWdi1x;x4v;lIez^8@;GJ=271RrD5U@bnH38r zXUma;yUX64qvf@;XDAQa$Vwz>$8Lmc3mg)5dU2*4KR;bYu&w%E|NOs|zkdF`GTXVW zbPet(C)xEdg1~BYe3VH66CP^ck2Y@{)CHs56Wh|3%L4U%<^2-{Mc#7vZKLJjj)5|H z5^WeK_I*RSU5oa$Pp=?M9YL#g9)f#;Ep->)M9_Qmugc9&?kHdX`a|W=t^1ga?1TYA z07yAGtQjF2@Kq8ciqe?f2u!uvC9Z~}sbO(>B(V4=Wk(XzLtAuHwgm;5moKty9)UH& zX$&_I7R>_Uts<<`2HoXJ?14|714dxCZ5W87R<4@BTEv3!LbwiRNyL8k@#7F_S8u5&Ilz(_&cNyBTQg$MEot@@z(u?Q0Un(<~ zFM+oRW6_k+?r|Sl7riWMbWvz==rSe=`sg1XVsh-vG@9^FmcRbNkK$0an-1(M_rtK> zd~jdb?Hy8!hBUf>Z4dY~Foc;8c5AFf9Zb)*RqKcbu|C1vTim4mJjJu+uTCxDfK~Nq zz5#-83z%0iEopMJ7w}dSOWWOxz+xIr>(k)(OFw(P{NyJuqse{({FG9wt&7PMT4@ag zQ8=y!dhi(}ZV9wK-9NemeA>e3?y5iMlI0k%aMHkJSe1;$rA!MGKj!oDx zY)_92amiDlF zWMELZVrQ3Y5OWMDwKItari>4EeO>Irp|46O<@>IHPY}xt8-%lY+`4T+U^4{P@m4%? z45-+dV`v=S$0BDe&a=Saj-=jg+6z_CyM*>Ww)ig~lwt^RSE2W14h2?tRmYMI{W1Da z;=g^`r1Fl*upp8TSxa(vMbIhz~pC2%5CFJ2s~I zlR++a4zalFp>qn|n_#l zp`J?!$VTBO?qvsgw2#yqoeA7ewThoGnV;3+GTQ zaQuyf+9;&)46ad6ix2Q^9fQ{dXbKIg(80EC8RX`_u~6|E=XG~ZgB2qHbkMGgiG zqTP5l{(i5{1q4G|r>0a5)5M$6>dlXhi^oWtI5KZh2JSxAK-_D&+Pr@5kCtUUPoMHq z#NnfTfabwQ;i&Q<7%BRd{Q@S}0GHY7{rFQ)m;3Me7KY)!Se}3X@5?l{mAcDz`jQNB znof{OU1i(UBEs1>-ag4zsyEBS58lG|{JYD=AHG~JYC0e^OBDcd@EJ_#3$MIdzV@XX z%9kFztGw{esq#K5rrjOmA#CYFxHQ(+TMpiEV>x#b?a>*eykT;M6>Npi2=-*eQ^Wxs%SDq5o5+6Xq>0s><+>(Ct4PE;pw z=mU3G-J%L$gh*nV0ww%hWx`FfGCkPu;f~nlwM;PK=g(g#fA!s$%8M^PQ_j0B5ZjM0 zzwv%~=%Gi-Er)L^XQ$sOh}6P{SRdvSI-LNc?WzE~18u=6U~>#9>b|{)%B%06EmQyf zhvoNv_czKP{_Z!SXP3)s?_-7lA#NW+)!BtfG!ajdF9P0OXfnKVjPhyn!3hAGv>Ys= z34yuJx$+Dq6K=otK4>Fbm4|i#Q|iaWTS1(f$F8zRwGezSph>(;J9VuoAVGkFEmwLl z!rkTa>F6tq_)X1Vf&u~Q6hg3-)&9^3 zJ@w{PdEw;aW#_Kl&}{UASH@{e+SJ33=>Hx@6@8Ajvz%cg6TGx7qi{ac&N95w>hw=H zSR&>DPtGIcMKBI7=Yf8m%4x|PGa+nYynwCeQ>Wf%A%b!u$Xt=;BiId-Bx-SD@~0cY z_UN|pGKy`t0kl{95sr3)Z)#1b*(WB105{4Ms6lzb4jF&`97`;-LQE%UZqM?b!r4HX z_(>Xx76`M-N?YP?y_~3WcUOb$s4j|55cnuf^NJV!0R*|xk7Z8%?xpaTbT9#eo@^7* zg@oZUhArn&%nYn9&S6gEGIV*m%ub#!Gm{rE*Kis5xQ&`NVKO<`h0qdssc~z0y81@T zJV^8AnT7K1`D5kr7mt-~!~F<+x0NF|?=SaYd;7-y6ZrL&0oqmauifLA5b(Z=wxssk zEU%@Cazi_E=Ztkse?E~P{izdkCDec~RNY?K+<|%MFRO70?yT~@fYenx$qQ^1m||7v z92)rFee#*|D%$JszI}p&E)eu#OLq-Am0b>L@!L9-HzE_1am;G#sek*RQaCk;*d|SJA=;AX&EsRX zp*7udKMx4heo^6SzfjQOyS$=8MfneHH7h8whYVw~VQ6q0+HWJ+=bb4R5cJN?O@p_+ zm_HeSzPi{4ozO`y8m!H`exxr}ip<=_s8&Y}A3j7pzgHK5>q~QQ{GyZRbNrg*$96`} z@|lEqcr90PG{evX|VH~vw9#Pv$6+UwLFPFkgAe3)f`@9aez-i4Dv7E}7rZr!tY zf-%ODpvVNztm1)Y$E>@2m01dtfKz4}S%n~uvB|??vp587FJ5}`t7lup@c;S!)b_hN z9GH(Fcz1k_U33V`wy`L8_gyzpqgBq8c(0th0B^E9!@_+-Oj9vl z6Aqh-Z%b~jXS5p;LZh1(c`FyWO)3;QfbnK>Y8`5QHf3?m*K5_gMu@q!FJu(T;q}rlTIje$`g+Te_$LkM(Y062>0{wqBv8_s$8>u_tfb#A?WpcYY-t@2VYXWb^-iy-Ose6<8o7`Y}y=v zK71S3@L3Gg(go4yC*Fg5NWc2sw+fHAlX)Gm>wuCee!9O2!zc}f%{KAPYREvcM1sK2 zE%M1Ed1zD>@~UC_#(T%h8}D8$M{eI!ZnQXc)v7t1p*zJ;AjB#Eq8_JSW>T$+D)>)3G)c6zHk^3dUO|6Pa6r6*n} zmk}^|kl8TW2fIhdFdxuUUVG~tHZqwo##U-H!J!9>Fn(%eL|<+Y!1hRNNsRH=?e#rf z{g{VXp&rRiedW~IS%l{Wd>=;8bP1s| zTj?}Ez$Cbba5AItL-==dNi0T&n873}2d;QI__U-%P(7eBT>QB)G z#-1{DmNARN;XHJRwo!xH6JPt>N>mVBF^TW$wR~(@pIa)=z4&tZ4)%N>U`6^rJ@yg@ zeIc~d9{LclK+|Flf#FiuFxrl4(L!0_XtaU4M4z{fPGht5-1}^g2Ug;qj9@n!wgF@4 zg*=nO)E+cK4X;xG7g`JzMP`^%AA4xqI# z!lLVV8A2ny8#}kQnQiZ)t#G2$ywh8$bX2VZifXRnNi!Luxe&-x0I-2O7vuTjVh48l z=E{jv=gM)k*^eGSRo;60J=f@UY(k(P(DOmQ74E{@ zcJZ=ZynGgh(vB_n@gWe~W`U(}jIovH%0Ebdwfim!_gm}~vfn|^+*%o0-yoceLBkw| zH;ABjyMo@y>2mSHB%0pmp+ndg7vaTBku!v~Vx;)kcySj)vwic~_xOsocZSmcYR+)& zZqs|@+5Y|GJe!DaQ`-2r@MO8K_Dx@H&c{7|6%;iWBOA+49Og8{m^Q>XJpe6ZbPSv3 zEP^7Ga#0PEfjz}9^W0@s5;_CZ64O48Y7 zOlQUX1XR-uRqP-GcMagdWa9H6wrjPSKY@LDbWpJ4k9i^%=I7v37Up4c1208YG1qZd zs$H{NZ23a4Fc?Sem&ml+&nrxjYenq$z+%mN3- zstM?L>UgpS4-jLPW4we9{~SS^9HXz>5AB}<#UeCitVOBChe^l zcd@q*p445q3KCVsn46n~){J86>*grHPcgML!_JEZl(?k(o(G^%u^ZmaxlXp1b!h4s zu{Qo>yJoBAmwYysxD&jZ&y4jx=V5isE679M**tU~2U4}Zwf>P%+fVFTq)l}$HaKQ! zdLza-vduA1n#@bI<9b~!)yFAQWY)yBd}6uq^Lb-=?F(>XAg27Kn&Zv`7nuurHj?Fa z%yquh!yIIoaJJ*j3>Si4%{RvQ6X{o&XN!ebz;(R_*0JWF-#^}OKq#B+iu58kI}
  • SVxd3Z>>-IBsQ$$Uy|}HW8#p>B=$5hz$O3EF)0L2u~?ypVHM6q-dE<|MEZoc zCU28xz_D~Pd@{CV9Sj42U@^q)@=bYoaLbK{5q2ZMJU4s3{OymPF8|9dzg_;pLwA>> zulxi7C}|LX1wpOx`v(x-V^(3HXNXnz%jKoFPL*e0K3=|l-~RIO1Bc67kH1$YIecvU zF!pEB#_fVRnkA1PJn>?={f@)sTfg~8dGFn0<&}3YGo9`%qx9kXZacyN$>C(ry^Mfy zkew|FZv{;`VW$ku`zk^%wMYjMye_#w#Oce!1FPlm0qh8)k$V<_*F5!Hz=TB?nzP*;z=nJ)gl00; zUBZ+4xOKamE$vt$Q7P6BAD< z*JOmd6}n-n77;uZw(U)E=%m}E&Y!zfPH?#0fgKa&#$99OHMZO%;SM2&CN^Zu2I!N+ ztT6X=VP*l%h#PkfA*jE%OzhoVe)yxO%4=^ND@Tu>D(}62Dg^$wabUnZPrgosp)#{H zUxtw0sr|N0x@%}tY6mtB3Zp$k8&v|pLJw>*{t9N%iG&wlS;bN+LKh$*0MUPB(Fjdb zr#HG*d)rsRPw9;`!TwGaNo%dl&P-#gtv~v>RNcO%;9NUkr%zqL?8QuIt_~s0*Zjr+ zWgg$QoAd@?ND)XQ;FCJI?H;QhaP%g+9HpO|f%7RxF{0)(;W zIPT540H78*aI>U?!xN={`~ETk4Ad+?ee~V3ggyI3%sDJFx#|Fy)Rtx)A%!-;Kj<0# z%r72 z2(uZaEgce`+D1f=o`TB*uvkJ_6}Wq-+3B-qF}XsYWM{x>H2>dx=U937=*h6nw`eDf zah(Yf@wEY*^#&&dFt3hQ3(yhmGkpjH! zpsxn}X;Z0v2xv*K2U^(Oy@aWX{beUMUOQJf1crqM>)^tPik||Ibc^ zsTyf2B!{$Vd+?FgG^ZFRr9+u#AZ?DTHhy4<0$y>zF*n2csqzr|hil5>bM)^7Z3W1F+XsaQ6Pkt_+M3*`g26v{KjGc}{XSt|2Z02q1Ozs!p7@d005r4#vPzJ!Z1 z8T%LSD!saT&XftBSOpC=uw7{G*LEr6>)=3ldGLYTgD?Ea(=Uf`v6n+oFP=M#0>u)V z&HLf~23Jddb5#DeLZyj$en~VP{=Q-~Xz5KBrL)c3m;_Qm4{>vP8dMS3?IR`Ku zcRT3>x$mZ_?4Zum9T%;mF7hRR;eU0PX<5(;ALHn}N0F``ag#6UG;JEYiz8x98<3E{ zhqd-_R}oRoT)W^PtNf}?J^avpUwW}cXB)cns~=O9RUSbp$#*^7O@-Kc z-GacU0)gvum!C?On-bl?2-3Th#%yreY4virPDhyNl-P}2xEMrcHz!&TFeqHOFvDQ& zK~8QJg=kA4ARKnEAdtxcKm;USoAYXt-@1K52qZc4SCS?X?;RP2C=Rk^YCGE2mk`FE z=kO@CIT4yMvr>p_3&&)m8DuKKc3cQnEe47t`k}qUMBhPOBB~Ir4px2>J@5*@>i^Lz z)sW@DwH#EfQ8OMyc`Hgr9x)-1H#tX!fq+9p%~~xU}wG5nCcuX7v>hq6VJU` z9=dBk<{j=RfBE7mrhcns9<9Iuwmwh60H_W37Mh%Y@!g-6Kl;N5${+ntzhC~tpZ;xm zsO^9(|;I>ybMVK$Y_U zefPQY_dj_W_;r?PY)K8kq^Jp~phw120i)%z{k6pF^wzEWu$6Hj+B}nlvj}AO?H)z* zqN|+0q_jX23J919*M)#g0RyZf4AN3LhtQU8PE_l!ynyGG8UqZW~A5Be}tT_%Cc?~Vz zyN*nhJ8!+QynE(FWM`OpKug7m$dJ;&nM;^roh}D&-c|0t`@Zs}FWgz~I6P3!B7c4L z)t%+7ZnUYX|1&SVQ4WC%U;4^Jq51*>LbZ6cp}WB3Z3Q8Pc{?#$M4G6Ebe1-H56@8;ZniXj^_9FW zfBI%HOR9LbmbeMZN5UES3TIt2m5RsGwW|hg;%@%7@!d9P&$XsXWc&>)4Rms7=l7KE zC|FZ}HCy-J{za^J%%RzffEV0YV3B5i>Oz^r*6|{T0BXnD38vb^3cTfRwZRs58u_w^ zwV^40^5WU@;_IiNHEQ6qJr)y6gIv3Ja_aZ!00Q9cWn%kSOk_O}$HUVU>Q17W+eIGQ zM?HD!bUAk7B#VF-(b$~{ZSs|{hs&Y{bSE^InB>`EwXLkhm2L#Mo%AoK!1k>$HK9f! zrbD{X4w~4pheecKES~H{qZwP=5Waa9CP0u_gjyqAha1gPh#PJ(x35^gPM&+gwI#On z-*nSBreC(PP{f$U;CzIKs#=H#F~p{5uFF__Ji7AL_v8rKgc(_ND*^O%>u=| z5WJ;t@7^;6{=*S24aLH_3;d2nbMUu|@>dGl`0nD5ixDo!$V*ELR%5&{-|TzYzbuG? zDu)m#5UYo&m}Ea?*rCt4ARQWzEZFYZwSzR1&v97oz)XX5%CRxVA^DZ)Pv+mMFfa5? zU+Xs?uj+(B03+`k!uaj8bW(w&-_mMZN?Ic=^NavL-Ergw=Jf;RCr`h^q0MLEl_%hN zXUnN$N6U`gdsw4KQ9$@RQ2;*fxUoINgIJ)oA=+Gk%$$Or@(quqj|rz#I7_%lLv6zr zj2mz@x3*M2!J|llTgO}JeBzl4;!NOWUgxI;zqT;#^=k9p@F>Pb(d}3zKA4JJ6ED1|OX`VIxD?w3->6Kr$e3C>vEbFcgLkYj9Nv^>tx%xab*w5_XAS}h?QqW+#*2-bE@U= zZhHjVl;41vgQ^oc78PUAi58=qDdbhIK8S$v%;e?rgU6pLcm2yp%U2(~r#%16&&u2s zvJ?jCu!qYQ{zzM)Co7XP*j#<~m80d^mpGv9i#y6UzIcE6uYdCd!p}kM*1~9orX}`P z>3ctV>SZ)Ux0T=c`r-0NfACx7;+cEPuI<|jW-rU*fAw5Bei|(bwLuk{RCq^Q%CtFw z>Lwxw#M|JozaPw)+~&AFIu}@49cU}3>+F#po6yW z6v9vhKeKb^(f%JR(-#)Y(etOvcfNIBl<~iP?+Ng1xy)j(trKCA%nKgmCZjC`WJ)!Y zAVUCrEFVImISv|o9|rXHBcr4{THd(`@Sr&gG3C+MFiYX~_t5-<>7OF~WsHIzI)FwY z@Vv0pS)P02Z22#L{Y3d!zxPP_ok#D%?%4VA*voGrz@Fovw5hWDrX6JrjmZ9jK#s$- zdb^h%JeoT>{1u2xKvtU*eipOkjA5 zIQj?uW@Vg7*AxfxjgLa}on#^8TSkcMqCtbZpwfmYCdJ())dFM0)K?M zT?lm*_S*L;5_JF%pot2Fr619nl;5<{ULiQnd(JPxV-^)X{N?bCd&+igPowSZc3S6? zmQ|eC2!9K?<$f^`u;Cio5&hWK5KC;FrUW5up`Gb7A&{ZFi*N1{Q0oh0LS+JR(03SUgrkP0cCIiRd4K zUm`5i@1%)+Xbh?tF}BUc7kM+rDd;kWe86!g-w<;9$oh6x`dHK3v#hm#R;>NXueI*+ z$#g7*)uDX$zAg88hCm=f1Axt)pyI}6|8{uM$LQZ}otegPd^;+{E1w{Azw10(@#O<{T6Ox)}p%@R9NoDy7IjE@S=)-lTUwI|*sG@+PLx z;H%+MI}jG0KYb$3Qt(h{7vwxZGc-PFa~Inb5?;>*KNR$u?8Og2lp3Qc9IgUl$N8YQ zd=Hx5mT0BJZC)Sk(KLw>mxPgj(@X&;*opFr<4?4n{_;&t4mFN<-6t+fO~Z0D4v4N?I9UYDf;NY@zcD|+HmhZxoKkwrBC}#N7WbGfE<@|>^groDZXu{{1lbU|w zzhjeqIb9X-CS2dheZFCwvc8kYm;v;h74x7dT(C0Zd(xeIYQu?q&*)bvGvW431f;KwhO37Dck`sa6--~HC3 z<>ciH<+ZoZbHEt(QV~w<-?6>CfAl;iDWG?>StkcWts*GaTtWwex)T>KmE-5u%8|o6 z%PwrCE~AOE#)M>iTTi+7t~<&%9=QkM?@+l!wO)PmO!>RN{YiQ2o%7f(Mqt}HfEF}| z5{(XVAl}9D$N%x!GBmNL%%It(9bvU3Q1s$ZE$yYz*I@1dBp3CfSrqD8KQ)%~@|)Vu z`ZD?9&#jW;)Bt^1Lk_lQz?Lwk5f{GUPxKJK!psjLfKh9@hc=nyu(gQ;3V4AnWeGv9 zIEpYv#$G(Noty+|tF4>G3Hxv^{*YoY%$6sngS?Zs^}xd>OJ|$wtV4Yk?OFliQ}z#n zW#EWWf7(K(7h%$GJ#a2);JfZsqi?*oCuVT!6RzEVy~F`WzlWAJK~wNUJ@urLVxlQ5 zf*aliS2y_A$t1L|e}u)CodAEi>^yJ_n!QtH=E7MHYC9KNzRUBMX?twmlSU8bMnZEj z=!9tlYiRr;jiOE4uHI47SKyvq))sdcfCwbWr4eqAWOaaIDL8fE0KqADw+3oo*fD?* z3>{(-k!&PzPA%*{?2Wj9+Y5fEsXMlFf9W3?XXmHd^CSx|pca+~3=)fpBPJubNQlJ& z@*_{patKe$WZrynigq%Di!8DXG5qD0`Vohk}o*rx9rkMH7lILdlG*Xrj4l1A0{ zyrZ=aZYL?o`YP0o{K4taAjIrKj8C!1<)W6`m$4hqZYsBvj*X)f(XU1`2a>W_w}h#q zMQkU+ZiN8KzMLhu&|J|w9G?T42?l9;^e(@*yDXD%ib6J@qrdsC%X;VY^?r@}%jd$R5&%tdkadwa2^s+$mlrtjnRdGSj+=sJ{fKis zPGfqk8~Dtz^FoGnj9sC9DEb7vod5CU?m>CKcA??bYcGs*v}kgr-ID*%H`)kd7zdt_ zr^Hp-Tj_B7eD3P$U)$FfsWjc^`mSFrVlzgBMzK6CS9P&C&Wm^>b*|1beUkFjbZQ-a z53F%Osn0$%@4_SwpoLGgKg3x|4jhz2p|oY|f~Oqd>V*#*7+ApeH3$A8FkQl2T$l+Y z2S*a|xWd9Wl4$E&Q3}03o)ezLtZlX-5holts}xW1ll9eSfW?DZcBLxZ^)Tu#c7xt| z`>ojB{Q^7F;C&JJt}xGZAygr^?c|@kW4+`tD_*tojXXbLomz=)J#0bX+7S395b%oV z>m8~!GtKVS_HDfqNyLl;A%?i9E+5)|b}j5)b}|T$AF8*%`uJg}gIvi9i^s(02i8pj&TEQ7vDElvRM6hTffkVN=rC4K9SgWLyWl_O@-v zIH7VdZ0LK$^CuaNTC>EDjFahEq0Q;GgeQJ84M!(yXXSm2H(}AF(Y%L$g!L)E=hH{| z6^ceCtEj#|@sNqYpoZopePxD|=Y?f3u9gp&dXU*7!gNg|T%KD++xDe$ZNzeZ+`hu`K?E8F8}Y}yi$5m`&_0UMuD_z ziRpz)vrFaAzxRB3<+(S?&TZQ;%W#=%5?i&D15MO!1jaV86G{(!lD%#~N3WJ?%eSnV zzd6C|=vL5&0Fgt+6jpaL`Ig5h%V@4*`}5o1_-gsa*Kg+J`%)gmZs^>c6Ltj0-J|9F z*+n$B&|pSG?@#{Yf94Rb|E+xIn>Uq9=Vr_I(4<{fh{~eTvRbIxWo$9lZruXP;<4po z;8&CJ)cH%;Ybxcyp1ozL=QuctwnqrAWcFncXp5LslyYfi3GMas<^H?(l^Ze8|JKV`M?7hiTC0PEKlH?y(sM0f$Lo|tq5YaF_9W%ax_o)Wjdh(0~z~HkRZgtO*(4s z#sO|<&~;)zSpd7DzKq6pADY_CvB=-XFn-?gAq|>^pG6M!>&cah5J=lMJ$XB{L}|Zj zdLw(0vDWb}URpm{!%R8D7#9{U(r5+aAyY}8_UG`aNX>_U3uPBxSA=U%(C0Qf;cGw~ z7_Ei|b){4IClSaHK9iqeL-SDIXe;Ux>8*iNYPPya=I#~`sR0s{$9U2SwHA9=DA<8k zY}eXhG!`*|#9?=rFv&27hWYe`lk@{xTUdY?F0@#h5TYRvQ|Kk#OMw^oK>lhKMt=5c zgltuF*KnFtA~fYA4K8t9O=~`oE*Qet-h*vzHKID1I1G-Bl+p2tvTZxtHT#C?18ZR( z#;x-`XmrnEQ`mm1EVfJ9;OdOKday|?R94uA4(i0bSz$PGF?b4X8l&-!$(Mb5hReYl zwvqEJ`~$YT5dcb`+%-b+5=??>%Y8NwplzceHsnsrir?T<$Wd)`aVzjptvGOr@7Zg( zga7WVP}u8Y=m2=*#BL4qA3HeMat7_aOBbh^oU(I5UW6=T0gLn$)R>OKBBFAU7p^r{ zH2vN0_{KNyNpEQIB3ni_+aIlhx>OfV7ZhS@5o*nC%$P)%JA!R@DB zLyUJL!|ZqnZQZoHyM`%-Rd}c_1SVm=L6Dg~m@jzWyTbwA&gcDO_}uFA1|0E}r2mm87%- z7z;1?%ELG9BHS0sPk;I{rku{B2r^WrQGn=jcLIE)3$Aha8dZ!obXyy3Cv30fY`aQZ zZKr5U+dcC3z%$yLXL+I!MmKF`dNGEGB)IG45dl8nr&Wd~oO2e@o^=XGst#9>nPSb2i*gm5Ff-K1(6;^<2a?iWkYmqixlsS>pznHu=}Z1wMKTc^{!TZ>wWVVqbfLXz%9;wwhg}z?o((?*|0E#^;)c^(P3I!oOYwTH4aQe0eg2<7;cIb~6Au=(tVUlWdm}?g0Jr z{HsUHYwt{!uYX~zp!^=?QP84L)Du%(kzEevSIHVSiqKsB!4prHhre)B`R3OiEI)YR z-SWn92EJ9y0w9o6lP|W{Qcmo+?woBy?5A45mN^ zfib>uO@-o3z#?Gb&jZ=q0;k5Ey0Rnvi#$$+4cb5WAHH1+jk7Mh% zkHL5we&80S1{4sk!c48pfAl}zS*Fkueew09ZXx6@*VTN2Ilc2Jz_& zQ)L91)|?yFWma_P5JJ_wMHqtZ$UZe*7G^#SJ^5EEf|A z+5%=G0$!~uz+w`=w15zQwWs{}xmU{XBH;Ze-~P?AK>m9V(q`oQ*fZ~!zy0A)%bV|? zDKpf4tphv5)(s)?BHF|X%*H3S!?3aCh zCk;{SAj%p2IBP%xEf+;2g!gur#m1kkHh*gm7thvdvx|B*Y~S_Lh;aURZF0u*%0kA+ zC`&7-H6teQ4ozN#On9VUrWG21;E(at2r)4yGmfRU2~nfpF4^~q--+;R5F6VAJNMFe zu~&-C-kD41u?u~U$rd(zq0hFRnzC+FRqI<}uJ(JKzzIn;8{(VeHmd~MVUxC-XKaJF zoJ@Z0I6Z7>)t0W4gI>%n^wWOB9Fk^Rb|ajIuz}+)Zjd&@VAR^d2@h{$tUzng$sg1! z=opET2VuAZW={U-!}|N@Cnt(-!|Ux@KtrRe+Gs1+KGok>wa+30}}(@ zMB8$o0R(~pgn&n5wr&)}hNNY{H+e(xKd%fU-L~Dlq#NF|fA9dV7~frA$xmRuU=)Rc z(TRAUhi+)A_tK?FG?C^B>0jbdrf9z83HcJA#AnNqj(npJ8YcY|TwKq!^8>XWhW9yp zQ}!)ct;F)1zl?8^8gMT-#FeCEcu)oy3l$1t>XxN9X6FYjNd&F%pGwinf*BP zq+c+YIqs?9=(mV&IFX+G{qA3kxh7zEctjU$f}bLvD6@sxEMzY1S{Fenyj-M{&$VXroC)F_=JwkTgx}LYeW@Hfc?q7c3x1IE0@!Ic#2E}D zW8=V_#a|*VLBj&R!kaWUgR(*_+mgpoi<_zk` z>)fkwv!)pMLw-7M&WmkZzdIKW!8OnFD_OT}`NTWph{rWG0)9fbIX&Ok9rG_>oa2TI zqPzny%PG7J>3Cve3OCE;)sN8Homqn%b~?{|Y#H+gVY-3&kF_yQUXGol(yC8;-s`1k zJz4E0i1}%P!rb)#J~V{P6==OrCm74Z4*w7N4G?2KQ7xUNwH}e zeij>%(`foiv`tq6+9Kd2YTh+}3zg5LM8MXZq*d4`eU#m&Iwz~~jnk?l51R+(ESX`r zny?u+;~CfYnvU;3AJ?Q`VQ${$!@Cy{3~jdogdQ@pZa1w}cHmh>u-eODyQaVpY3Ie+ z)$;U5HU1MLP?-$bUj(z&g?_QquS>9g;auYL7UdGt&7 zmXl{5D>KX+ml?<0UECbj?T`J>hNGX6pI7cr=_$d=C(^6qCtjshk z7S*Z%qj6&5O!-$3QZ7-R?P%6@FJCHq_jZ93ozb#L_`9|p; z9uH0bc@_ga=qW{{FoFn0*H%Z$dvBj9fAg0=D1Z1bzfu12x4%-}Irc`mtPpq&?PB04 z*QmCa6}QY5Zxwrm=u3q_a|WC~b>ejS;_Ww-U85uA^f@$5LoiA;6d0&Es4x<93?3+V z78~IzR1b3))c_hHPWIIh>*P?dx6l~-i^qRj_U`;j`Pzebmc?m=^GMvs$F`$!ysccG zL4%}sxy*OY26N%ggdWUMlrHLV`cir6wb^pt5f8&F<%iE7Ess6*Y2`m-;?&$+Sb_X_a>!CG*gZwn;(4wezilk ze{6*z-^jW>{~D0|nc%ED!&oNnO?I}G&&uItK&5My1_i7=a10z(`yek~o5`x_#N-ED z&`(Y4NI!1Gqks2}Z)0M0ung`+NDHIBz;?E24rrU@TE=d#HcHd(v_e+Xc2Yop;nG&` z3cCjS*rq;SQprB%4sNMDvbb7#F1VW6n5_HVUo9-tXw>r1t+xII~xbGIEG3O z%$Wg=@r`(xBMFUk_|)i|meKTruvlhGb$w^QNq&N41CQl*)a=5X0z9wzxM-5LJ~hFB z=^w@w1-r4pAz#c$r7d+~7D6ZTcR^iqDfT-gI-#%!H878x#9Pms=Qp<9cvBxpgxr||J zKd!cR6?8>E@Rzbnp$JY`$KLh)_#7_lOMaxEx#(S=ykE;*@7uNFe9HdRZw-YBo%~-g zbit?q0Qo+kp$R7!+v1Su;4v3iboBt`&hpIjZ;kMBU&-876X(OM!Y%2xy&NZcvLQo6}0p7-B;w@;W`0`O5Q7Rcs`b+*zI=;u; zmNZQ{4#adZ06HwjL-?C7A2rht7rx@Gp{>7jK+EK_mwiS!*M(GzEx+Y>s(@4YxdT*X z9T!XLcp~2S;XlNjP#)18yPDDRT%DBV&<-RPyl4du`K>#1$6W{9?Pbrvn}2I9(m&_) zCRlr!i=NrfZa#bv&E0#;zP+Q=1En-<_fsXxXBpuUscV>GaRQ4|8A|Q{80RTurrKWI zru^5dK%}(wvju^V4*_RHpRucm{!xozJiAR2g6t>wK@{}0pSi-djJB?mxh}R^kB{fp zG*9lnaQ-qUcq1Hff~=NBq$5L5LSEBDETOqBJ2yLzg%z>NQbS-By@FL;tW);jym(RgF;qPE@`t)f8_7_4} zY&_G`dRr_+0E=#Twt7yfm)3`SGzq-W&kap z1%#{^I4OVs zbErIg|B>?ii?5gG-n`5TI+ITX%f=Z(^KX`w(6xc_GQ=wT^u-Gte&&g!^JP$NJj$!! zM+FA4!2YYCt^+|$Y>#Rf^KSgQygcBGcIZKSc8zW0`*!at58wCI^7Y?1L_hC})%~ZQ zey#lN_g^gYYuL{$qa18TnpA#dWVkGFSdyor>YR+vFQ8q{-}A4$Q}+IFZ~4wYJW~F} z?|rNM>p%V;0$>Dz>Hgyi8sT%iVFf9A2EHj41`u($vf%0(XTDYE(b<(%WVK$XfY>fAkyW8;^cH+8Fc3 zq(4;7qSd}YJE*B;IhHv=PXTf_!m{&|3*}G#^1qk2-n+Rx^|R-($$O!kyUf-hgz;V7 zz((O@>&;% zZJa9ay?>kqiA4^znZq_?rMIIEmf?Ouk_1V|WMJz2Hx`i$N^1uCRMU{FGUDg6#Cf za@n?N%QI=U+bcWange6_9_BfO4hRkSi7fGu^ zv?UJS5e7uyr-2bqTkaPL0pVWpv&mO{Xmd^|#RKt8jMcSx0fH_ekc~+@I3`Zni^R_` z!x6lRV-frcG*5i7pJZQgE9PR^wha?gYwR%CITE;`*{^vP0cP0EF^Bzg)6dh!;eSk7 zd=ufk805mFjb1HxB`$?9mhZtgQ4Yrvc^h{_c{p4js}COF)XSJG4`o%g38=DzW%PiU zM09DNRKhyiqcnNN80`QeFF+ruWfMl0J$M&Fr+!;J@bun0U{9(&@Y(s^pKT*L(9GNuA1&o47J!|h|X zDGpVp$)tAv%D*_TNaw@)Wqam3oP%_kHgI9uc3Py3;9_? z0r@Dfn5*JogKPFj3RRjV(Wyi!=IePqJ3aXHh zb$HMblR<4~)=8lPgBX`dkoF)21RfB6pIy0v+GhSVo=up}dolw)MUmnIPthRyc=0s? z`1331q6(7KHm6^kbI_>+gl02r1D$Q6cA3nTK6MaoL90n8PMT$a*PMn-k_6S2+7l;E zm1D<`M;Z!is%vM$^lJ@z%|MZ>gXT>J{Kq7JV-1LvCCX5CQdja2*P&ghKr{w6wYd-= zSw7#hxZ;q^9&I1_nSRrWtuUd)CCik!gjfCUBQAoqJ=F5+70;28@x5{|ij;$MVIs=* zbH*4nOBG-+Kp`lcKobsL2r~%SJ5pPBxi4&GE^!Kx76f}R3$TO$W@uoTxbx)#LbGSy zpDqWmq;MJyr9OnempN#u4^7D)%nZO)Aly?NLRz$_W*go+cd7j7>9@-7eB*HW`u%s6 zSKjxFL^3r~pkmMMMOa9oSw_&?fVz@YuP0N7qn!=B<5&` zSold3;tMcQfFRzx9ooZ3G{sVBLf8)`ju9v+e>z{R6E_&c5U|k4#kCa}!u_}1U;1~P z$E?N$>|%1L+`C7EN$yrFfUW#Pn0VQH-~eWMhBz6XL%zTvTAaj4kqLw4QUgM{hCSDI zywX)qYm%<|#9Mghw~Zlu+Ys_UnW#4cpIH{_{GJQb3Sh-)@DsYL_R|2i z&$B*~ZSuk2NwH?GLXhi3B1%thU~FSR$nxnYZbpXQ^(NtXv<_aTDgTwv5hMcglojMH zeVYV~!BzcC;d;*Y!DaG1_{K}61ucIAZMn}U1g?ez4W4`mJTrD;W5wc{UfxCHmb0%r z>27eleiFwkN=8^eG#?#vs*5o7g#a0@#^?mbwy&jvtd{*zVz^rCLkgyiig2Y%Gq2gSx(|LhmRO|?z z4Zanq*vMsqMu@8Kx zSSqaBTf(?8&+$XMBT&E~c;{?e&nGZX1-#BFV#kH5C-{dQVsoZ!)=@wC`gY-Qd-5OU zx$;m^Zqhf8c&4t=F7QGf%n2>Arnm?|-thVCAaSRzPK6cI>0~_YV%MWW;()2aXz?t8WMe90a{f%(th}%vMX-`J?bOUy^B@@*g>S{AK3-8hu>Y*DzVG^ z!#5CuaP}SXEagPmFT|f#A8QH{G9+ReK5?0nGXF?CH{I%jc=AF-YD-X))o|e?3$@2_3H3TElh_35z?%k;%|OyULLx2RSKus+{Gts&eY@BXGtVfb|#a{!1y zi9^L9+I^vE>@UeRuB!rX{cw zeBxsH-uE9b`*(k*Jo4Zj<#mL%FC3kQUTnwyW-j=2SudG8+QM`LmfUAhX`E!!z{Kut z*gotmmuCs%B%i#bLETKkqy4~TwRO**pDf#`kB8qZUvfJdLSCLb=h3VN=jS;1?D1#c z#4hzf`K@mp!jwZP`)}A+R$n{EbM$pr%7*`47EZM&wnG+G2q3Suz`|7dH{^ln-5o%|yo0(^km z7$VDd?I;^VUpriW`M}U*cl|Ke|GGJU+cjOShaN4@`f<~JQfUHpms4u^S;hvxd2%;I2b$*Q zrl7dVwbj>5VcoR~(|FZ7ZN9I^$fwQm+P~Mh?S3EjnRGu%^becOR=8hr2wV^UHdgJ! zp;MDy1pe@8Z_MeFytU=|;R<|>%%nNLJ}!6g)cOFUbp{3MR$Y6It-nHgzo9k(ZGHI5 zcfvytmuEP@`2uFlT(F;+!Y;1|WQ}R+X$0OKQvfJVDDWI$ZXzvSU}sp&=Oe9}htyO) z)H#nOklsqC_1(*SO4CMjD2*TjD!1Ksuzcyk+c{8egw*E{sB4;mvN;Ed zU2M+3OzV1ZzTUS0+1AgmECl4?Di5Z%wu|oUHU~dIjOc@+9M~B6;*DMB%0I<~<4I$B<8oSWS zo;};qxELuHFJ4CAGL;8^v9hS($~K8Zf&!=r8cRdCjDmxz?+A;UmBScN&7IDf_yJtMF_IP1r8s zNO2f;%Q6ElMqv?jE|oWrv*1Be9oVP!ptcT80I*_evI@3CT@+>~wDbn|lvj@}mVfi7 zKg8bUO1ZG0fdYwLKS?WOwPlveVi%{7D-LB)?ZU2WH!E9$NIl&(v|(kG7CBJi(7|!G zo_3WJrzc^=Fd?wUVKMz{^ZQn3~*9; z2f}WkhESc_J26KyRR%`C}lo5w7Ash(0E+npZ-pCb9Xw`hV2>)zYz#q@yvSJ$&;4 z2b`Lxd~fhoZ3I8WH_GbPus-NF2n*bSD|jCCINk_HKznFHhq?uAhK@ulWzzYZxX|vi z_5A5VpyEWuy^o(;Wv;~vTbj#;&raS-HeTx+pY5?aTRs*lT&%^M%+O$0x#7UBvUm45 z$is<-Vhea9osZDa+UzFg(co};@O{huDng**;-^)1HIKxd%qQ_Kv(j1ZdwyHbTM*cSz!n64kr3!ZfT(Gj zd+xcT3=EC3d+%p)_JxaJbC}6-=h?D?UIc|M`p33;re+FKa*8F-;8+g*l!t8St+YAm zCyHJ0*-~qFB<4;FVyh7&zrkF=)I$4HVQxc)tH3v45%hhXKAZOXTZH&fKb4+a#tfHI@8O>HjyZC;22_=`Nn^I@3x>qNauV|-uqFp;1; z&R_Fe&Nu8Y;;ki2T2yf@Xjdi_I87{*YIE!O_$x2qZL8H)AMNx4)Jx*gB7B4v3?b-Z zn|R+C0;E3dgAVnV%c$T@UYaR0boMRZ_@POAYok_A)aGKnFNgt z{n$7Ia@A3wdVh}Zn^7~7wZe>cW3bXrt6O5UnR)d1vCt}2(3%6Az^kbk&*vK7Z|$yz zYY#)%#=8zK?QIqVbrT?rrt>T=Il$W?^S~DTVk=j}D40JukXt+*d}R-GW|UX>Mez2r zM4;>Ztk)~b8hF$yJn_tT9nWK2GYSlf!`<`@8nEDQ*qCa{--~VB754S3iMq;Yx`62c zOYF8}53EA@7ubX2^rKa6VM&D8rm~`KKZLSo?zamt>dZr^7?xx%K!ey|DFRRhRP{4l$X|;bQ~P0 z$H#R!*nHgBSH`nyLH@4%1iWkqst#gW=Ag-Kfo+d=XXxBM#gGU55}&~tXmF%~2OuXu zLb@7H+nPe8&NrXK{Dkcvc}K4JuDeeHyY*DIo<0Zy(bhI#o2&TH=Jk;t#SapbW+fJSAWk{kDrmnvT^u7Fu?e{rj*{&B2gr@UF$8o*2fZnn_@-)RB5L zV|;vz6#2a6KKBri%(Sq)!S}Gu#|Lpw{?U8lQcl#XS*c|3rE^YFGZn)(WHavC_-kd* zp#J9`=vx5Tg1{C8J{J&Z=OY}))eMy|c4MCG@Zo*T5BkfqFT94Sw3F=0LCIu(s!S6` zd#tPNmI|pB}JF=n|6JxU$1?yd{P|~d=EeJQJ|YL3Fl90r!o&|Tn-@)5=|NEKvDyI zO7~heVH%22WUrt#gwn#VDW`Wea;vs;t(SA|3biHL&hgRs&iOmmJS5tkw9b=I7(&qN zcqtxewqglkzRzJZxiy9Y1HjF!igXZw^XHsFLD?+$(XAi+;|jY074F`7s$;ijU*393zTg?5Lvzq+68K+MPm|MyI(n3I)i5k0st;`Q{Hk$L)=;hK7aMj)Z z${+L-S0xE{Md?P)YZKd(Ka}^&xs3N%plF*TS720HV453TD{Ru2UwZ+s1W&>d#6=ME z90Z7GL4fie07dTJxjerrg6Dn?%dDvXPz+=;NFcha-cq9y)dXWO3 z(RS?D>}|Qkp@IS3rVlU-mJV!G&2fsUl3WG39%5!*9SVK5QOhA}!eB|pf%+I`jYEeJ zvtiDGI>0S;Gx*Lk;JVU1JTe-qtRC3bk3rl;{MSfZk*=Do4*K~79Q`A1mK`A}tE6Ox z-wO70N6US;cb4z5D&Ms_i6MRu_?j=zJo9Ebg9(MxXHRf??lcV70A>t2u-&wcyrwwt zt+0KcYka(%xOj%_ke&kPSm6%1xRRDoH{VXG)eRnX5qG4AckRsbJ~+%4f9lvz+&$Fe z+YjGYj=guXypIO?Ft&&_zP|+V?t&(0cS@nPjLJOqK5^zOc71n;Cg96&oTiOZIE3Vz z9Fxcs692_=?$T74i5O!Cfp$Q9T@#8&z+;%2I=T$?3 z@IlYT`&>k*`Pj!uje*m$M6bxiBQZ-DrEChCV_{o>%yR4ZBS4^zr5`3r4O`pZIMwgN z#NQkyo3RnN1{T?twLNWX95^EV3i{iIgn=K9&-A%o?3M4B80Jv59c5&Y3E<*vgzrGZ zUwWl*w^>SvB6u)X&@2o`V9_CC>5i`Or-h zn1{O^1&prp*1M<6Wt1bB(x4>4Za;P~4zcxb5F4+axv^oc4zZSZOrB7wt#npC5?>}! zL3e>{XqG~N748OKibks30Uv^H2j?k`w-u!Q@(;c{3~Xqbjc*%1UFF3(x7WLtM*)!I zf$x^5-cz8OT7%Zh-2J9&PbWM+g&${m!q5XoQ~4=*_Sh1t!VhIu1Jbh%oCijInmWp> zWxaClUF)SVSm)v33by%SZd*;!rR+szCFM12$s)}Z1Y2!|^PU9~n%3fj2cUWY3cFH! zu$e#4q1!`4o#l)7-yYh#<0$-<4){Q{cjfimO&RlGZ0~BGL4`BZ511y>d3}>KxGQdfG|?aB`PRV2F61TBhuZfd?Z6x3@fLH7CR5&{pR)*( zeN-)RHQh7)=u?qE=A%3+vdjuN?QNV1r~9=R@P-7uscZ#u1(*#YgRSsaA`~a0B5hZo zH!*>x;Mj0Ef8lbOx;z&Hg~UjKPNzZ`p&4+LSXHdxPGd_@vwD>+VZS0 zk%)#9lns1)8H_JXPR5~X3hes_23dJiAg^@3HUn_yS?GVTGY`WVr9uB4QFVe{lR~ZA-uQ{1~*35jl46ld1T&T;%t4t z`kj2U@_dfcm;+AIg79->8(OLgcoF2*5;4={Trm7u0mV+B<{H$$s|!x$9n|G)=zPX zhi5gVAv~-A7aDa6H__Ieojk|>g^4oY0Snm0?ck*F-tHkz%bhQilgHVbG++9MMpDQ* zG|o7Uc?tZ^PEKPYf`e|rnO?L$7i7+?wM0|Gib&AhMKiTzdkDK1J6%0XXzL^B86D{_ zw;j2)+=G4J`|g}5V}!eOc?k{P1LgiBhsyCMUqgc#`@#UU6GKhWKF|U+c-7R>zVSKi z5u^N9Za%oX{IKH$TE(m`2Qe1k*uD|W2BjkH_fMXSb~tqS=FQ!{Y%YCX=u8*lbje9 zwzpefS_yAGeC{BSly4pDDz;QWG;~OusWgdCjzms69d;}G81#y7@y<_#Z)yD2^xE&q zU$pydJ#Rr^3j$jZ_`E>C?fK5V`ue(KF0T^EzTKl`;7fNgPa7_;zILpfzc^nmPkWGa z3jW-Q*pI4aAKJdDm?h1Xjx*N7l1g_gkCL+o{rE~4dC+)vK7{bawB$KE;m0)*=68N$ zeo;pP!xJRpnM?X_9yhMuV(Vik z8&k+CBcNrzT<6%9sXkY^Oq30O%U#RvxM)cOmdxQSYvdAu%&}8o%IAmP2TyS>jPoks zuMj@XAaNE9!dsnf=loO6-?_y(c6QDq)SbcX1A<GX^l^N!E zm@jnarRBDK#J9Yb-7>8xyw2n!kFB3yK?nq5eYkR8EvRw}Wry11PE#SC6~&Hb&PWK8 zlwopFoas)yaXJc-(L`h554ak{Auzs{LwpCZLKbGOM#{ySd^Rt`R^;KFYN0gS*AI&Mvuz&Ii7M7?j{p7Am@JWvMM7CnPD@BF+C<3J%H>4{FC zK(A1>VR8`A=So7lu~BNQ&*Qxz+fCJNpPaCW*CMb;uK0CfVWFHpeWuK!z39P7`WaS2 z9$Of*X#>{AO9(ff5%y|7h9UGa#*C(g1uQ zfaTCx1M$Zvcn@wlSXmbbw-|`5fm%J0B|j88@g&P+$IjgSWY`S45to_}q;J^+mZXz{ z2fqa+;ns!S)`>X8afSoO)FM?t+vCW@|1$SZS3?!tBDB=bky6_@oXs>i#2{!(ENV0i zgmDl+u3$<)n^v|@#3A@)hrvyk3z+*HpTPDn3rm(vcy{Lk-7ezqL-F-W_U>C-bbCt%)8NBq@aOf`ILffkvo z1Gao=uIich>?a%jKI^wlRsPV$X{+&vj`Qmna2?#2eO|}J|DV10 z{HfkE`D7^rZa(<*NtUZa`+(!JZZ#>Rs?PPiFjStFO?_P?Fx_360$^wGB$?3UrX#a2-#RQtC z2vcasngqxNjb^>)(k1x_h;V45u!@i#*EJ11fYe#Kt<7}LBD%gvlRVI7GBUk%I`T9> z(kCy`{tZt9uIj4X!U*-aHWyU1MG9g>8G7Bb>&r--)9~$`>EMuRQ$lX-;mFhE4vl(G;K?Y1e0c&5OH6%8BDAU?xV(i?6(d!X+A-v6Jj10M1y4_{)jcTEsjT zm8&-O^wkM~074VTiqtUkp~ZZLNs5Np`m=T5mD2YP^1w;|gPxJL2&i#>*CP;+nT8BiJC~>>yOxMF_o*Eu_VT^W1Do z)6rg~#>q5MpKXrRXp4CY6Dkg^xa5w;d4YmL<~QDY8#q2y9yoJn`ETF*K0;)S^E-$e zklOw|Izs`k?U#H$c=z4qpZ{56P zuYL3G^7x|Kiaofo)6cdafimo>DzPaK^u$7Zm7jJEj>TDe;V zxJfVgleX-Z@v^)%QrTg5KM_~0WM~Y1Gz!euFvvdQs8eM-}M>6c|m=W?-ZUJ4U*HD1g?;WPLdKwtoY0R%qV5SW{T4_{je`ZqP{ zg-0BzXKwZc-!69bpM2tePUB*hVfu~o>g(@u8jm|dxcJ$%#l;I7<>-myWkewi>yeIP z4l{e@G4mL73VY=QG^?lJmX|oysKSoytnot0r_y<%1pS6jl^2mpn=D@J62n`cdL882 zb3mK6OYi;5yt96$_i{OfnN09El;cOH%QwFEg|Oc|HpU$@X#8+4kn*^Xg}zhi$a{A7<@a1i;=Huaa>uyj z**Xr~XBz_Iv!f=^tJPG;QrusJpLn)`T*6bm6I|9jK8a!)e~x(txH)#o1*K6(p#g@u z#*e&}dGYN=(GJRN+uP)gyk-emW3yZ)+;QWYRJr!iYJ^{cExL~m$(oqoW4R6!Omaby6ZAYrNYdb1WuH1hrP_Z$5opq#9Dx{EQ+uB$t369@=5 z*4IOOcO9YbD8j>-Z~@t_6RPQO_Mm;~R~WSqZ+saHX#+RoL|g|&7UyTj+1t9vC-OC3 znrM))Ys_7l=omYA8|&CY9XSHyFk7CSd9b|v>MP&_$2kzbsdi5+208+0gq6dAOynMY zZ~bHh+!$b>f>T4yj$;%aKUt4J9%jUxQ>=@)$+L-LeVuf)N93e#>&dwZO<05wlOz`r zHop1p$+ED_jj}}1+=3JD2<@A~V+Wz>K6qQO`-&w1%4A|2Ly*cw$0&J^j}67-sJ8Cx z>>==e1>!YJd)ZYT-NanRD(#ynBjbn4+74zQ*tr_z(y|p`Hh~F?A%wJ(X!icfx4&9e zE}t(ydH$8MJ$iz%gBb;m&@3%o#@vFtT=px%XZ+STmJt3H%0c+KOa2hfUCbNoQRevc z1RAs(OukO#39lXcdW%VXVthWBx6`*BMPQB5{SfB3`-_%u(>C#D7=ir?8sQSsBZo)I zx%ZdKkAL`n`SC07mDk^Vw+xfl&NfWq$Q;_jd*u&)@N9YTD|eS~fAg#5FVPIXd=@y3 zVE<_k8@g!dj!({^bCgT>8ih>xKY^<_9$XPe}BU8ok~M7mN~pGlGp!clnZP zC1!luzZE0<%T<#>r_fbFtY2|q0>bhU8nC>$Q0CCQu=cxjjErdX5sX|F-qy?1B5}kd z6Y{NNT}D>eq^i7vk_^Wq#|z(eBoK0dGeN{YAncR#YR^IKQfybhYsYPe*Y|dKO88}UX{O+d-rZLPMYd(qhSw{D_O$WNZgSP<$K0X90ZhhA0myZvrK@OiB1km(^ zPgmgv4j|aTVfbU$ZQc#oy>;WZ!TUXH2qS1-I(&R<-EpY{|SeE->P?%Ozw z64w#dcJT8dJYklHA9XF6%3H3iP&}a_lHK&rFYUT|zw#amEDCsIJjip9UV&u_0HM#M zbj(QGV@)RkHw)G+*K&278K?d3cja}O$v~fo6Iz1gFYoQTHTh}k>AYdWs0|N28XtXi zbv)N+f0-HUMt++TZEG~RNlV#vW3%Q~*Ynm(*!gE0wBwsk0FCR`34ttYS=(SgDU6L1 zxqwumnpmK4c5`DLGn<&g+vbE8E5iMKl#ej!aTk~Be&?6IQjQ+x&ZQ|Uh+rIrC6<_& z_e0j;T3*3!!|&O5%5e;r@7q-ouu&A!XW(u<2vl6ku>`(2Cd3^chQ$Vj12()9mu+Rl zhqi2>39iu9<$~z4$NJTK6CCe*-m?=KMRHRGfcy}BbfEHtIm#(yBPxN- z9h!traZ+JzyR2YlW@8;wGn6xej74*?+bEf-fM{La1hHO@8#Rj^GoN`4-hkaTf4ZHP z&=%zWrO-@U8A{pf(RzV5JB!WI(Zks2o#x`N3uqNW8j!m0V(5L#4?1TAfz;^eL}(kT z38{u*?*1VJ3ZiZq11Dli*zE-;q7Z-r|FLoGixQ^x?ixr9PJ_G>ZsC@brSbLjU+u*R z<)e2;?_gM)CI+hMO~XH34thNB%-uURyy-&-yV|5%T*9;Kg;)qdk8nxZum6p2mzQ69 zz5L|I&q3~)WFQEe*rJ`7m^HV^)%9O405Qss*@M)~wLIF~lxtfoyVDwGDU)T*d~4dl zBjYLL1~UFB2!zuxh9(c3@XToqP1-;D-k+3bo}Vsnyz>Eq*AoaB-GJCd_=@zDqX1J7 z3*?;m!xY&_{wK2{;o8AY?=DA~52IDfC1%U32q!UNz;4wzHx#-XIy;9=D(_$i_uu{QAD3s|SSpux5F{gxp7UZl;IYjmZkzkt=P=U-eZPds#} zeChtX%A4ojDQjvcLy&g>-Z~o*hq3E5v@VR6%4@H@ULLyVPBaJ}Ef0O=ba@4n!hiDp zXUiIu9zkloff)wP!C1eY%WL5NRxo3z6CiwM*I2yJt_3b}fZt$T^V{iT*oj5vL*)I1 zxUAo`iq5f=@sgnvr@?<=3k;?vW~jd7A>*XR0ZnCca>A?roibWYHHmpu*9vO9y5px6 ztws+())-ySPyQ`olI67D_33YK(6}3@QqZ#omi>9(KsL8bRL6>p%r+Y_AkOFn-(e(ktG*?otPTF7`I$wP+q)UYC^B;T;An?gTpnsnFWJ??5 zK7hbgARzsdMh2Z^POkJ49>}?wRSCT0emQz%vV8f=4n@81dGEJFfLu+sd1z&0W`J%LvC7S&uKr8fy>X z?$qR7dFa7Y<*BbdQI5_{a6vbUQYZt}%h{si$s>gO!RIN_4Z!lSt^%&%`vTt#8@O8$ z0&?}@S>StgW3DLOAON{S(JHZ%KwgwTIKFpSzbYHa6Mn8=m17BkOfRhnTp^Eiz0X`z z7*hSspTEGXX7Pa}LP71s6iRKVo6mx)8z_;jt!uW9) z6*jr(1PKuMP9Ufh2{iB?w{P2lQKUrH{K)rn?CM04f?Ib!y*W@pqZ*cL<=puTWj$=X zHa%pw-~?ORO7<9sJ0>D|x`^TjFZ!l`ldy@?eRNYbNg`p5T_=>`W^#AeP66*ElfoPt z-M8N{4-=prpC{P~oGX9!XFofiTQ?_)T8G3s zf4i-zHN~$JjhCP%9!8JcBOh_eZ~q+JqVWtiY!_En%JTYRm}p>cCo=?Q?qX{bS0-iD zZD{PsSf4!vmohaYXe*DiNwKuB25ygHb9M$TSOuiJWeVx(>dFFRfzr5;Nb?I55SK~f zFRr02hu{TU17#SK1H<6HM;I_=T{sP0{^4(atBn8Y^X2V@d8w2as1d(1na<$iCfbOHhYu}7p2fLZo||iCV2$Y6pwb^GP|`~<@llTa%66* zd~m^WH%Xjqw~)1ML6E7lLgjU|0N%u|?!r1+%oFq{b>AAoUK7lKLRPh;&!V;b7e9Qq zeEX4amv4RHzVa78eY3m|k=4k<)a2o^&RAbxUn+N|1tQnY@xmnCyVEGea`4FaIWD_w=lOH-|ymoui3O=a6 zy_}a5CYI=PvpUDOb+690IFiM&4K^PpFdw3pTQYGn)E;?r5>@lpe(rUVm6=@CT{&_D znPv97ZeG{Sus_)ieOLO{PSl1+eXq}UJl_xUZ~IjkRlkGE>(BGE^PPBOkH={Ux-l%CLXaskE!Ld1O(b}pWKx2#~o z;n<1WSl7dwhw=!#0gPhsSFwahx~p*3BIF@mhr0F(E)z{&HEBQV0r81E_^^!k~`oL3H*R7BBr)@Q$^}I6QR^Z2ag?kEEQB7gd=Pb7gCL}c| zLs*Smz_nP^*E&bqRH~C7i*&33$IxoDUp6s|w}wduP5n)BB6M_Q8zJxIa{TyAdGg6G zmPa1Bmy?@Q@P3>aWP@LMjRHGMkIj2|z*xI9JYhh|`nLc2DnIzV^&r3)N!gQCPtHD8 zkkReX6Y$LNT%V#y!n!pCysRk{_A0MRT&zgl;7#OKX;J2#xMMtVh-aXG{N%UM!r`Yp z21HiCD;;BD!wGh@d%@+giG1Hcscr*V%N{4M!!#(SAKhS5uHzt6v-fi@;1!xp$M_nq z0eI0>=m>jHj721 zPjD*zc?smGeH>->{(N$Twzr&L)K?6yAf&(uBI`n3A)Z6+;-$;jJzfJwOroCGZ~Cgj zMA%9EbEKFehGsNHkal~vdF#Nr^AfQll>Suk7kNd8XB=PCxihPF_BNWk3LX!YqiBN7 z&1&udZPwX|^5mBuW=CbT{N-Q%jH5qX_C=mUnm%ZRszc(Af6le7e8Yq9oKR}rj6ix} zlND(F>XR85?mzj3z)!wYtJg`8i4Ni6B$~AQ2%5b$cEepx-p6RfKANXvNItgEHZDV$ zQQ!`*QEXA}(?+pegY}oro`vB#jUW`gTLji>qTAkmc80y7bc#uJk4p<4yYC+CSso7! zxL43#J$G>t0Wl^AHXu@?5FIAZ*I$3X+<*Lza{Bmm`Hf$B5~gdt{OHH8#^rg#qg*nk zi3^TRO^(c<2|t8ZaKV~#C(6Sd`&xYQgR;7b&>JEw@jZgcfq(Q5f1`Zip5Zc2acfJZ{O%vU zR(}7#{h+*lj$`0sm~jAwMqxTfuotHGz}P6JF2Lbo>f?_4F2d_=2(R0~Rtee$|pH7Z}r_m3NS=tF8)OwzR5gS7zT!z{4FCx49ZcFVWli1Gc;yXOV zdR;rT#_D^TAJH=Yb*Aad;^TfM6Og&ock3fuboCh@t)CjVdPTe@jecr63xS%xK5P8` z^ws~f@(fza013?$AhD~)3Z6pM?JxCHSihCEl}l_4vHQKahW5r?<^H>lGv?Mwr-loH zU~R3jc_qfRHw6YQDvjW$y4iYXH}8IPz2HA~;g`b<0tB8+P9e_8SIX zfof>*!W;OEyHgYd5#}^u-CXmADS_bZuSVpf)EoM#vq7whT_cg&(~t7nYVy{4Sx5h@ zQ^v}A-B4j4F>%IMy`T{KhAW*o4=8van^vY1>p8r8tq^L zPvPz=g8J2!MSQn0d$)p|W~ki%$lc}Phwd)--FFJ*EbcPFv>prDSOeNGsT`1U2A3jP zhgvEnH#nsaAFaRe82sFl5a^CS$7SH2sHR+rKW#CqpeY{47((t)WmZGT1#6j;R?;&0*qkcN_W4g-!6C)7NZZ?Lco3 zl0>3VETlc3djW3;q#c<165T9#!=->CiF$Szhyd_hNbb?`+9o}W#^5x<-r1RnvVg|p zA`3|;mkoqpBWN{_VzR--qJ5zK*wi=@lbVif%IbeaIgMv8vh>HiHNS;zo&5GZ&L0Dd zJMQF)4X_C6S_mar_oU*VzR*W+d?WkxTRlj-P;8^i}Owz3aQ_c+c#}!8{rl zQF3Cbd4&BP1cc)V^Nw;k&tWd*+TLCadp?^RFc19u@{UuM5`ucspE#$Gm;I(P zG0SmyZBH@b$K=S4=+^EEg4nHc$H|%U@B^pH!}s4&Zolmq!rblh_PZC#b1%GIo_pzS z1fAO0#pDRKEJrcJ;PHUDNiG3fTPWXr^3n2-{=s*!X-PNH+~=Nsr2LzI^B>CVXD=cU z<~TGaAa-cyYwx^Q#-F;Q{EzSddAaY&FPFdfKYgogFYc9}zHknBOaY(ivWcyk$&pD+ zEo@?*0}bSJa7>{b-rCl9_ zr2silhd$(sZ;$4%>ji49Ar#)?7G5zxrT~%&6T}Ykj_EiifxX@3#Y^QU2=D)wzw=ai z@{v>J`IlZPyQ63yBO@9DkLCAP&=&adb7-Ew`FeTd^|!Hod>IoD2r$QwFi~imIgRtL z@2&7nKhPIo2K}KH0lj3u%CJz;U~H(7b*1LCkbi_LO<67qRMl zPRKAHGjxLCcj=;Oh9NeV*0A@yjn?kc>cw*R>0{;bhwmzL6WHfwZXSxA^6UX=LulqS znBtgo^aYMI$S5t4%(_{p>*7>=4t_pY5U4byjRoy@fswd%b+Gh>_bei>k}8t)mvfc4 z1MdL@1`rrP;4=*Y=INlDU7<)c*9jel*|pFZm#3=b<_+~bTg&C}>}2`Eqj!~K#}Ak1 zfA(s5>801o^2$02CJ5mgOR)d|KmbWZK~zE!l4x#GWu9s792rKb#Y?@t7bEy^B{&q7 zCvxS>@oo67DmYabBwtcBd99DUh5SkI!qRZkB%dR%A4EN>{qy;;AeR#6D-VP4v#C?% ztz1$ohtU1}%a3e(eqzSDj%K#&B0T$Dt-ot%3@1h#_1l72|XJ9NxvquM}(+-^JMMC`bz*; zUp@xzmVxKVma*V#9&RP4YkwQ5#aj&(+p^ zeaIh?TR;mMW(gIm@;y%x=NJ_qm4R4KH#Sa!&r1s%adLTc1DOSAIm#uH(mYL;eC`Fj zuGT6zyWo#r0?o;`eB=5kO9X|+jw7E=BPcU z1sp(5j6%pk7IFBkV<9B;B!%Y)CY9`@)iA3b5Ac^m${BFM1i-B%Tf`=6p zB7ob+CSw?4M=+o&Jf_#VrNE*{@c^YSsGapMP0bKCW;96Kbgm2@+;yi5`M*2KhMn=B0mXx$ZhC5hjta zj6IGejhD4@-`&T{cb|T${L`|5pcD6SWn%sMAru^-{@pM6^UH;^IFO*X!?kG<@cDS5-_wjQ15C1rXr|SwX5yV_{ zEYJc?n*9EM`or>f{=wfXfB!fCdRbZj&*ew2BF#mccoO099)`mgmsUeCee~E^Il_fV z@0_7# z3K0Z0n(vHD5wKx1#vtE@u+zJYS^9r?4$~G0nzhTt_<+gyy<;xr8-~RR=lwCBUH&>Ps_;OqC@C@}rTh|Ns$a_-TzHDA>A>5th5I@Aa;hmWCLW0uyAWt~mb=1xq5=aG*b;ZG#gLoXIri$9s_(hcK`$WOUc>g;1ghhj z67i^;N97&w{)yYRPq1`d(t@sUH^#ML(axotrkn4*05#2dAPnz_~iZ`s3HITj6=Vb&nQ{BWlV3g)vSOgw{LbcWZNvKj;l=^otii zK+wBd?!=tV)8BluaBl(j8kV4O9?K)Wumfh|pJS`yR_w&b{E+?$;Rfz8LKB*OU6`JO z-_HpIKCJh<52rkroHiFN(?W{7oOdCu4_Brt`!LLnED2aHJh6&n0@2Y>#Y@9?tL!1 zXlYNCFFbNzdE}vc$~-nqHOJtk*~6^$G`HwF!}eRhJx_3j&<)7p2gvYuC6;Thtfijv zgZ}9V>u2IKVDNhjK)|s}*T?wqMccY+>u#&Di$K?JaYKA?{6=JPC6mRtx0wzdsesR3 z*Tvnge-lZ(=@;^LBX!;!yID}Kr5(SzePjruoQ|G5j21g5ftQys6S-#HH>e?Wip`PF zxqvsiqyc0S>2Ckzn*=61&5pv4o)y5+;RGn@$5d%Z&bhNPRHZf2e&pzQIgGG(VPPF% z)ds?!bu@aDP{h#$v{HjmMdk+~K~t^I@FO4!fmH?GOY9VE?Eu>i1mYJ^-*mTCC#)kb zPbbmpoJ7MMLF1Lgx#_1I5jE<;Pof(8YR+t1}uO`~d&ucM{v+~h@SUMe&OfjBw2QU3XF{R%?qL*;+` z@PqQ-|MV}=+&xD&6XnEhca|?a{$=b|JzidZ_3d)@{6)+d%%Q~#EXdDG!k&2KOnKTTY!mRrY@PR={sh2{7sHzZCL{N#GB} zQyp5hl6QcQX1CN7*0zpDfOoiLP3bXWS+sS>%B$>_J@d|L`NBgp<@m`HFiA`W3H6!Ij~lConRETOY;C(XTSB z#1$8kR@emoi4OF$W*xei!s|`w5)YmDa&nR(6GKM=E@<&`oNAflR349V(?Et-rdZ7a z(`M_lVL1+b7b4XqZKz+@^9*=)A_~K+yMX)EgQH#72=0W}d@4LlV?ESVuB~Z@8D7)) zt_yn9JOiG*$7ByIb?xx*xCMXu+kEXNB(5-WqV3|=HuO%DGak=VxVyf5IRv@0TvYI@ zPk*zVzT+5LI*a_Rl(Fdv#%H9CK9JT13>jdF6~NVvAwz?S*H;>AJfDt7v3cMI5I6_| zb!69PU!0(C`c)dl6Td55BtO8PbOZdm0$Kx)8-T!v(c3zw+(4Ftr~?RmiV$%Al_w6) zINoEvju{>0E3`L;G5sbUd)ii^-WcnlFz?13zO{~NI!+lr{J@>uqjIFY@bcT`XD_~i zk_hV!ggaXteU@k6;i+PV$_V2V2zojB=YkMUfHIT5%a_;jq)4&cQsKJGLCLI)$XM8{hF>eB0+Fq)Zp6<5kP&8 z>Ks^B*4s4$>)$#jQcu_5)>ppQ3$|6VTE)D^%IZR_8~69Pu$r~n%?{y+|SowW0J|74F7Sc)c189bO0S z=7T^7cdk}7$07KoKv$gd#C855QxNY&P+YD(o3%K2Q1K-%La(%^!IEaJ5M#XJuGAp# zKl97#@ZRK~-{P2m)ftzvKtHp|te_#}6XTh*+dJ#XbH=$m5_{5|G*}qMOe``-!8&Q=qYS3d!ZOp5vCd@%P)WT8|9}zeSvoEAhcekO)?qOL=ZM`v)oP}$GhLW5T20M zGvO7Zoy4Jq>oWuprf%wO0_x+XU8bKvaA}#Exfq5i8Jj>86((noBP!!V>*eqN&8N!) zcONQ0dgfyJzyIIgDVG*EF>P?Ttit##ti4xWcM&mZUFJIoj`$%XzbuzUF4 zyAh_8@`E2eR~9!%%EB8Tlt2H;v*ow`7Pe~dzpMP!+h{jWV8#HA)(aPw5OQl5n4>jQ z$IE~DlmD-rx#w8m1Ew2M#uWa*y(XQ!fUHbFs*01|knS??s{BrXqOWTXmLzo;^nXZ>eJ=)oyWOoZ3*~ovjD&zxtCy$=5Z#OxmY~N zO#wY|q~b}G&v=b8eNb@4(~Ce{+!yWKCSnw)vor{hu7n3 zF|U?$=2%0omioiXy?J7M7TR$0K=ZRzlZxk8Yt_faoe#_Z!@{ptuYvyn0-pv18vJw^ z$Pk2!k9f=VrD9m`>rkJ~xjTi1^7!5%vdenS`Ty9_$@0}NKUD6x{doDS7hWr`zxf`f z+c?R$vx*&8%q_xSOidkvcbMn&-CXcqacQ;!Ko$wsBraZp|B`pmM&~H}zUvDLA&h#( zI#HgEnnX1-T~wBz>ltm?%4^3A9+Lc2BJw?iRo00{yKZ$2s^Bt}DXc!ghze12D@O}- z!Y$w8Gkoe>RKKZlZ=Bw*8o%aQzq1AMw5|o@yVB)*h9;bn--?<5L#w%suwAoUE6549 zS%2*!=qlW)Fv8{7^Jp|a_UM`N=)-5q@uS?WGS1qN`%W}3IOT;5WUUOr?r?o!+f}%V z0DlR$4&p^9Y&G?A&6a;1kNPrr{z4&8@hx$tzbYAeWmx#b^zWi5w#_C^Z00adW9)(i z!>p|wH~!OAS)cfmYcf0=n$ukmh&zspD^m zeD5+E#uoMT%v8vzEL&~fZIt9#9p-@PW>pKn(x--WpEXW>c0;b~O+ZBB`Wtp->R4Z0 z>HV>Nta&Z{pjITY%g(Bun5x=zxM?9y;77+vtn2~v8r23MM?of-L?-4(%OSKMZ#y=H z>4p_FdY8(|3T7LI&=5phQu{zU=zq%a$R~~?NQKDKP9ww^fmD76!Q-hA;Yt??uJpdb z$9V0y=G7o*2QnsV$`D`t#B~kD=l8+C?Yz4&08u!Jw8yiTxJ+$_31<|+-nsK{bHNsi zZw0C}bXx%>vCS!(8Y^)IX4CG@yl#%fH}8N~ttj46YcfcDJt@gPh*q-m zir|lG&{l=d*xw!XSbYi^ty2to`#U@xo>O;~x87VXZ+w7O^TbJOS$_1~8|82Q zwa3d7k3L-f;7{KwOB=&wcJgq!@WHvVxme1B_ns-k9G$wbv{HWicfNs!NRjVyO4bCZmQ6%yfZ8D3BqLTJ*%M>U8h*16+Pe~2rZx}ct- zv3=yPw8X(L9*qYh$~Sc(HaI9&<)8fAi^^3BbK;LV<-3apto|h-83GHQwBfPu2t2T7hlahilsPHE-)s8%CzLqD>x#8ur z`un81)}Z5O7sSPQO-NI%PPp;g_0K-bToMLE2*hV-2uA^7gDjtVP!j&oI5t}10#3>? zTF_VNV8DF8EMB<8Cesp|Lu{U|xw)eaZpO_n3o&!bt z(Aip!V>9X-m7ogY?9-eH{LFqz_yE*QfN#(I6X`N$w4<9aLgFVtK%AIM6CT~b-nS0? z8}Bwe^>TUG@27wD%YN7AU{~WE9Qt9twd^iVWC~yu{dldmWmpBpK_vy6Hc;;kukh8^ z_iL5YoAT5BvR>DyA3=K%t>_vI9L52Wy?>#wJCp!lAAr)wtH>^XL}I4wE?A25O@tCvTs zXmHQnv*pmC`^x?IA1^rDMemz9Gk%MYk5aY_En4*QmQ2`kU(;Wu>`9 zZEsIoyUGW+ta)rF?pSyNvx4{BbsK_R@<)kjk9Cv^G^4B=|^7i z{S7XO&#@jM;eJCaA`jOW;$>n%jEl_MI`G##^i%NK;{vJLJ`E1Fz2d#?@4K1m+Wz=b z7oF=eox{<#dm=eaXL8Db_0A}3zN5z{p+7q)lP)zT8ru0r@@xI{7JRLkw@TQ@YLN(Z zfJj&_w(bC6gybt>qmxK9g#Q@wE7(M%v_?3c2g{<{oN#u@>}nwJ}6#93Bq`ljG8s0bwI}WA(Bag zkQ2w($j3qKTZXrVIuUGUO}}K_m?ZGp=JwXR?>d2?@H^$`k>}CqeK9mzCnu(`_k>0) zIOHV&3SzwIOM&EQm_V@aEjr=E)R{+w9~-Sw=9O_LF7wfE97vnG@d_dI9$lB)y~j zjdp9|7Z{j4A2`s^vad0WaQs^3K0^-?6A%G>GV@4aTk(S9e zH6p+(cKM~#TL^N!G)}>8{WGmhyi(M5`PMDya#YRMP?qEB0CyGdj7gJSK-=;iHf^?v zyusfpV^)~)gRp!$guUa8>v1j$u|Cq;psmE+Yw$5oMI;QZi>DQ2h7`(1-6=!xMZAXb z-=STOn~IffI9fq-i+1{#DuO|M@!h@ zDecIA*>1dBuKFb&v;yKad~HjO)*qqueMOXLhY>n2t=PSydxJtfWAPfOkmDa-hd6F32GNz$1x-kLE=4gvgUU6EqYNmh zb9D%$nn*z|A|L1$Pd6Nc(IUJ*e~DVw>7Wt@eggW_;w3$lsonOw#`AI^%%v z{PS3|!y+zK;uH`Z2fW5O>$C|3xJSzTk*}85UVp#5^y+&k9<7GiIPYL_Ju!@u%?|67 z?Je$*z(%iY_fdEiFF^Llx5D1Qe-RyjP2=T>E=>!h0)QLwb^KYsIz}8*%@nS8pX+a9 zyKP1_oYwVcKr~~>#S&tiE94Btl^oOypx-<%&vtihaVrMoztv+_V!Wq5l?%w?EUJkQVpxmT3CJd#{SSR zv*{3z-q?|2Ev7fv9LBUmjL&ZC8dU~_ku z4nnv$kyl!5+ZBYNgD0rwqG~2<4eBjqEj+ts7lg7E7O%NWwt-L=b+Z^`3*3Ua5|^t%im6j?Tl&)rpKiGy7T46# z0+L9_BW;wC`I^4w)(LABnf0l{nw*$2Kl&tI__3Xli5@w@d!gRO#xmN8Gv&MAeX1Nk zajg8{2R|wAy?=?xi`&WQYbV__LE%MQXsA-Jt*s3vCKu3Tm~yNbE(%-s!!!e)QLc5O zK27CqMR-#w-xbnWzpw+vab*fBlar(6i(mL6IEZ3)n42 zFnpAoZui)wb+>(wdO3F1IhLUC*9lw(KxRN;lUjX?2z{1UR=M!-FvoQcQ^p!Qa{z~C zD9{o*ZnOlz1TQwY_Ss3^LX#8`5K7YQilOZc)BwA;vy!)hI+CbW{`UK4%h|J-W8hFQM!ajX$@7WPfVsW&J1!mjDxNSTn z4dR63I{rEl#beDD{In?iHBN?k95}H$t-K}j*5`eoQuqAHQ z@*N*%^2cAnuS`J*b6d#i-%a=?^h(;06%*Y(t=q{cF+@Bef$iFe-%&^1x3Wk3OXlvF&Fh-cwlQjMR)M z@(Y0u!Oj)Nujzx{w?JO~tCw->pMLSqGv<$)zXUcoClpthKcY@X)-~z#)pCv7cGoxR zuP;_R-@*Im5(3Qt6Z<<;O9O}ua%?HkN#&~;X5gfJ)$GhT8oJ|X^ByaAo<4)gh7UM_ z`3`q{T!If_O|dI~I#xDTx5_e?ElK?{lt(*V6Q$ieCzV z;oulM@@FnYh*y89h-2%D`MDx~jBS79nYym?Zctx~b2V7Yuuk%Fw%zxn0j?3Po34)S zND)kv>#GRLA3qSJs%(};)zXDF^`{MSFOKk)j}BMqhvmu}vX&%oSqPN}tWU&NnFD_X zbDqvx!^EEg-d#5L_u=&vMtceMvH1zKb?+(KwRipEbXUs*eFEzyw>opR1 zZ%-BQitlY#$3)xj=6laNXWR3Al#L{1jG?sF+oWq%zlqtyXz14g<+T#uc-ZwE!PjX??@mcH#u9Wi#dY2ZLiN+C*F*G89!>~v3gW$8+ z4WbES2BHSzR0UN%ZL0l}K&)TgDE3*pE2lmEGhGv<^=OE8$>`VhTL-AAuOQ?#>%N=a=R{Bcf+AZ8NFAK~kN5&A z25<;_6<8^Ba)MM4OO&8~yb!6Yq3YyqBkf@$A=HGyu+Ov+JcDNIu_NQShjf!(oYJ2-?fi_2_STw+4T zi%o6h*S3F}3*WZNt8cwtzVM~nG0Skg488n*8Df`w31RK;{QmdK1E>FS`Hf$Dw7mc3 zo8^bkzgD&u&X$$SYvsi8BM4Y&1#r@iu%{Iwo~Wmc7)KHL__ZqxEvd>6XN;^@7}Zu14i34=s)C+ zH_XH8<{pCP8Tzy`E@U!r2ST8Z!-E11tKrf~$Nt_b8v?wqb9`q02z{?MY4ot&t)>AJ zGntvrz8AN3e%JT#;HO`JTm7?41i;Ww-!pB7D$G?F=%$4NU719MiE7vHAh5NLj_F{8 zb7o~sq)@o#)g>>b0XRVLVN`Kn#HM(^Rrw}&U?^m}ymbOP-we?#U z3oa(qED0?QG`KVgqrkUn_*U&*H$nE@Wi&^bB%F1TruhU+!GL$m!vk7W<3@ZV*+2U8 z)~%!d(6b@PH-PzI6B~Ft(2X?=eQ)r$wTUSoH&!@hppzabsNO{AJ24?c z&jNrAs3)F$tbF;)Uxdzb86$$3+UGngo)}u+TS;4q+OHoLqc^0*m zqur@*f9o;_gWDyv-}|y1d=4P+xr2biJBAR%AV{eYaLhF0zGJ4WO$Urp2a#PGFgruJ6GjcbZw%mBJ> zlQ*g3%4i`sh??_*i}7gkmJ1T4q1tJB+-jibQL=O?JNJBxKJnQ1ZC7vnR z_3oIR9W-`XiyoPuW&Ju|zVgI_T%5}#YJ7V+_iiZuxGqTL4dF>~E!TyPH6FN|8v@Qn z;?2R1z66hS_Hp*Je)%4XZHzf_P?L+U*>(_W?6R(ldCq*r`2+H=^I(jbDB8`c1 z-6>-P|1o_yj*KJK(mu5A4S@RwZ#!9x^R~xzzF#BD>&)TijwZlGxI`rDDnV^f5#*el zREV?|^zq2iakLIkm9@1kGErk}6f0a4>e0}1I#5UIL(_J{FJatEK2h++zbC<`3H zaH11t3M6U?O=f+M-cSdl13m_2ZFl$uB$|3>J!);bIr!H7vY^PXuf&9@6S6rpX?V^2 zfJ}IGVd_rrq4{})LOa+MUSo%GCg6R?9kb;(e&d(1%lmA3nVVbBvMW43J_R!|#SW8~ z&MCm81Sfy~nXhG7Ec%PQ0V6bnlXW+4w->W6!Y`|6KJLs;AkLkdWrV-tgEopr5FU>x{ICvHfX1YX2tFzhHh>lUhJYl?QBy4HNj`hnD896yk#9^v zpdq+#TB{5#KD%(ArupF|6D6swpBWVyKR-E%AD_x|8d%0K)2zgm9te}1|wEL}uP z_TA9pJ$c7n2x_OX5vqz5ixrPP4fB*+i#`Kb7Z+BdoWqBXFzLTZ-4PMW zZ4pnba_4S?<4C{vUtd7$Z>n5aT!TqtAp(r{VJ_Td-v(x~B{B(45W-WKxI;FIO=6Gw z2!rl;;CtY%3V|4xeWBIQr#S9{RpxRHA@2|xy&D^7YNN3|H9Zr!6!y{@VPnKc0Bbks zD&FVV6jhV9WZpGa`qwxLa-}oL)FuR0PozkT+^5eO~UiBH)v{DGBP5h)1Ih{n&6EGN<$BdS^JN~zY5XhCNj#|U9} znCo_SHbQ{A!(3qBtf7gosf&I3!#{o)lPrpyoXB(=VeTGuVFH`Gd=Yn}JpRRp%6Go= z&F~xcf4g&rKcag7bqHOXWPF&?*H(9v9D2WWi{U z1(Q}SyBl%6YZ9`kncheygSej&2#CBQfX}PBYlVUOD%CV&0(6YARPz+|6)tWfIMj@y z{L!7K4s#jX6bdS{<%16vxPN2;UR7J3T%f%J55>v9-QZ!c6U$|)lYbmrbxa~1L)6u~eZk{>W2P zu65+gtdCVnfmy=adYH@Z9_z%0AFp}(48b$cY>M;?o(mTn!U8(#oWgDMip_SyRi020 zNdDiovu5(->9n;ge>XL`5A2Vkv3q}c;NCmS@xxQB1LXm+H_AG59Fu|adfF9s^GTp4 z<*~k5_oxVj#QJN#p-oddpo~ZZ`qF^m7xu`$Y5L0k>~kG6B!p!sYy0R}am~L}8rotV z=ca){3?gvZb$h=1xHVnV;uwE9r!vzsRy3RBT&&da02e@Lz|{>Vv&^sK)%V%)AG~xS zP#Gfu9t>CjH#Xr_g#do>)0P1PqPhMXsQK!Y?e+$O@E8jXIM}@ zCSwTQ7`S$52HTtvfTb0V8X;)izzji|#O%Vvco?NOdR#_k8PVECh)yzLIg%Ja0p5l-1K{@c%6*tz~s|K)#RF5+-`_X1j@!yH$ikm-;( zQhAsc7bpsv+-cNxAh z@JHceKDk5;1XJ78eEh46%5Hw(sC^gtC4Tsw!rRnPP=FkZU;KArY!&KOhTl2?m~b%geO>W?Orj9HE(a^LovP`L|vFcRP$+gTb-fb}F;5 zCe|~||JY92EnIdOkLzg4MjMH!z}L+iH{pEu&-Y~dS+ImTA?ZWY?kFhxgUoY$nm>(} zZV4|<(Fm6m;4-H{S9Umd=VHpI0@>J!j<}3FYR_m)*hgDz4>S!wwP(_{odV%a%)i`Q zzWuGQhepTlE*qy%B^MVXbey=A3k)H{hLohU4H!Oe#6@p5u&n8#d$OCuD=Bd&lotcD z(9X15gZrMXY=Yj_bUo3c{Osq1al+a-ez$S8CtdSle_YEs#;U8h=8T|=w))dl)bOYS z9zHXUv5nttcLc-_eofkl+r(EzjR9fhD# zUI>0-i*>2tqb!zoIr{HEO>VMB=sU@!)&7n1F8?&@<=GTFf(&4%j@jUQ6b2(GX5P*Dl;YdN&_U4S(Gz%G zAZTv{xz4FHCUdgeA-t4Vr0b5;%JcY?4#@WDxH$WEfQWx0l@NjOxqjM( zDCy-cmKO_|Mt(`+bpL&~bL?ZgEG@0^w+`{+xTyq@Gztj4y)&U(A#9)Jdsq16cQ>4m zaM5cVxrc%_KE#QNHho=zTaz}iu6%rG1d?1CC%}NerMZK7;o>FUZM#Sc^A{`dD@(h! zPc5fu1Cf18U(2$D8i%l~MEFEsb(3|9i8$RPktPU4`CyL>R z3C*ISzENCiQABqcT>oqVA6^LHr0wMAWEhI9yt7$rCNWVDBh1uffycDBIOZbvk@*;I zA>^Znf>QQ{#F{PojJXuS?HqP%&k}}^g^LGv*-=%!m1eRNOnfgWGHjwzEMuzbx-*wW*mO)m!B?k6WH9P_|vCuD}VmNI|zcw zkDc&6?StB2@I-=c)#8X1{=2~bT{Pe~@jHs9uv(v%Z(Ie{;+AF?Vn=U(vRqyUCX=(Y z2*OXd4O34ih`LCz?G%f1yux@vNj=&)%0`RYn%Vz`58TxtQ0buIzSnW*cl*8Kbby<% zSvDeMG!;B9rl{-?O~aaEz`FzU3s zmThDj;arF<34?YY! z*3g(b-u-smOH(x~6z_gRcVnX(NJu**s-a0MamC5k5rvod?D=tA8e|#aYMefQg;7TA z&>G^$1(uOa6A&mVkk)xpS~JGn?Ofx#v@JHtdrD4NWO2>|zVU3T(HC{_`MHNcKVnow zy$-+-H8v*TUv%;%c>xob=AudJd)&R@=z-@D6+Z_}l;8!Ow5j9mdIGs6;`38l&KI24@8oTm4>XR^LW9-UuVIIzL zVxj)ibz557=+nB_Z)55FPX04Kuk{mcC+Fa)GNR)$xHyE*5S4}osH`Brh9CaHH^6+* zO44R|-5NUg8y6@2h(BP7M-@JWiAmbKv%$J}o%NiB#t=(}~ME z!rOdk`@J*&Wz3uI*ZRd=9rUTf#&%`fTpf2R-SG}De(=a>-8h}dkHQh&iM(Z5hytG@D*;OBLwY#A1 zFRBjw-a&8LZu(4Dm1b#Z1ZZY{=iBor+#@@@TWrB%+ zmkJIcJQi2U7Q^^xBy;)N$kG)bYk>9hEY>j{1oupud$}~t;w$$K=?S0+>}s&nB^^B9(QQ1Bix#={uyACRL5#3U}dX`A#o610bBfd`ki&leof72k_r>T9i?i?^TE>vmFaW5TAnjm zz*HEAZ4@h_28{G;r<^=-s674cZ&u~Sqi{KUn}=^Qd(cfy0>#BA z>3ze$*2ii_y_(eR_p4^uO2aD-ylW*)Kk~*;IMlyjUK;_9elo79p^_za`z61x=hubS zwVdXHYQE7A0lTcM-yyi6{#9t>97h7`+-i^=sW%VX)(z>tUA+z!8vQY@=HDN0@I8RQ zO$>nphCmy$gIYFmdieq}h=%gnvQW)%f+RTyW2jR3_1! z!uHNW%z?*GOq9b%?kQ)^++N;4d#Swj*4c9I{9;`CrPi;f(Y!xkjrH6ZYb~{TJ&86o z&1u~6JRK!lvqO2IhyYKcX~q#wOi?6tk^{<-;j`_!?aGkucRSYA-bq7yZF6Vr6P3^4 zeU(FmY(fDle3WrK4Vm-3@hsDYq@`xb32A8re~q_KW6Jk=GIbq+?w0UIxVz1|)D3>u zSfgnFkBskNieZGy?Z&vM`w7;>GbljKu%M^IY#N!zNJKy26E>e}SjYSM;1XOnhY;fuDVq?~DWDwdcJ6en5f0zGyeeXVRn`zq!`T`ir5g znQgB?u;BuQ=rlZ5y8%4IYl8)h8KnSHfV-0;?2!p-uUX!;4!PI&d#uX(SJgcGr?EBV+aCtW8s1wS5B4q*;(NfQaSOTlN`Q4et) zPs3soY#<-tBuMQF1sl6C0BU5eEFIgw47xk8b-lp!64#9x-lw1hdrllp06Cs;9b^B2^WO?CYvf0Ub77Sii zgm68Iw00hW)`Y`anMT`qc-u?Pz%wpRTVZkW+MDllZ04?V2m$HZ0%jRVcxXy3jg2ya zVAfktN9fb-E$Y4Jv3l^9igKc+AkQun=h1RTh&MDnSvDwhY<#}Fhk1v8`S1T*8Tq^4 zDPKBsEVPB!!S8wO>7GT4eG>+O>j!BgTEPt*Lkp1iaq76m1#9P*H_LDT!Q17)@ zaTp4OxE!rwe-BuK8)`HI$89x|VYocP;V95vaDyn8KoP)_e7&e@g0UyQY9DkQ%|$>@ z_xARBBpUp5AaD@}}IQ(xc5Sj_plyl3;he9GyQ@{u;vF2OqqLd2ksxqg~G?%os-{tzFKc zyf&rQIZAq7=RHGj)Y)e7#ddTYv^V=CfoItXn}kn7+(h{&sg9U-2F|#)GoHX~QzG5? zOZ)R*cu}tNlWqLyt{>m~bIMwEeWN?6N4nICuW_u80$<@8e=^V%Aa4_`w5_C#IgBiF zEY{Q+R!hn-%Q3u`S3?KS0R(Ox2#E7KpW=1>OTP%}{5Uq!-*LhM4W7S}Q0am^UzpN? zA5mB;50uoD{3Gv15X7)?{+Syky*`sLF( zp@!$vgx$9|j!rvj8cln7AyS;kftJO%C*#W7j(LK>a-tRSLYypX@H>D&;8BAR{o|~L z1)hpQpij@(Bf>f+^TbJ&jAD}{##4@u%#ZQa#y8$w`-#vPJH=_WG>Ih-K^<7LZDO)7 zOeQd=sw`yvtyi`winjP3SK%Nn>GD23Q92*yQ`6_zyS2+NiIfnC>5Hhb+YVyLgZBC1Apd_=w-5Oq4Jml#|*1qZ(jEuU`yi;ao z#>yRcoMcUTd%5klBixUo+`>B)RP=C@C^w|7_YS8uUB`Kb(qs5rm~cv1B?7lbD#t70!Zh8uxK3W7{MyK1E4kDsi;4$QN&qH0(hLQ&ZCgFpDP< z7va<%i{AV0y$zzd8@G3QgXacT^oyDn68Wo3mjMc5Q#4pVk6 zz_Sib${TuEE$iQQQPrl6ZU2nfPLU~vMcdWyZhNd>{v{yVCHgL`>)_+NlO2%aU7|FJ zT~Wu~=GGFLwo}-VJYA-zC(7~T^W~>MeL4C|69cY;Sn1y#C(Ba`6wphwa}PY&&z6oAz~?^wsur z!6e@8Fdl}QBjAp?=*OnNg>!aQ!qc!Wj`*IT-6viH_j7_kg{|4O-+QySXL2g<^}p7a zW25WDa^1mYTq~@b$1VJ3vs(a>hIHuL!60chmI#a$>7Z$1><}9KKxAtMy?-%=n(<{u z7OnPf^rFnZ@%bN5L&@7?doF(DOIZeH|k$c2yk*B|XhzB}c#@-}_?JBoRaGCMJA zU>vR9k+-EGBO_?{LK^~33VX>xp|+swJn!D{L{=KRaFIWFs1>wwQV4Q4YCO(|;fL|P&b!@ArPw}(+= zaSeCk1S$katXYQjl9p z7zd7xDp+-FgkliwQ;S%oJUpngwMbXj*3P%`5!D6n(0tT(NkgiuIn=zuRF(_|!#1cA zS+QiI-n2Fd4~DT6kZX>Dd^+?^xCl?;c*4MS*(QQrdAT_8MuDRUW+%ouxw*-yNX#)D zhM&6~WurS!pWsfK!)QKJBEsJg?jqFf$V39#E`I%wFYT^WCF)4t)=im-7eH>au9g4L zRGQ1gY+J?@26?)x@uzKu2W*5V;hoGYka$K=d`ppP>8%KZ*XxEr2M+;i7w>?516iT# zDC=?dQRA_$%+d`9##8jWAvLcqYWMKbJ$c>o9~BY@Hw3(wNoW`dh@A{YXeBbR9m9d} zq_raw?1J8jHg|^Iv6aC$EY?%ng$*LafWlWHoq6aNg2_mo`I?i2QD^=^n0U87=4aI- zU!K(+w4kbCpZ>F5L*Lu3*1X@p9f$Wgeh)08VZx#}&s@MsP@AKYXgVc4ft?H8~ces#fBZOKT2zuAhW(*Bovi7*Y!a;?^A?&4W1z&qGSh=9I?{lCziSXLg z$FyYA>6dJi!Qn@s&-!N`k>S!1-G&B{H75AZj{V<$ty3NnVuU3VWY zM~^+m-yuvkyv~uI^Nb}Ye9d;Ct<6nkUSJX9hs2RjBc#lu>@EnzCj|%K41!bp!X|IA z^SO>WhWEGy_Dhe=m%DC1hHcyx1ShLyJ8%Lf1!1hVp+^yln%?gbp2PIVB<3Er5sYp# zaX<63m&$ja{z7@|v3twA@4d+}BsF(O%5ipIFLLR?;!@ z*+L>Tyu!ai1scV7?S>d{S<_6>itB}V9%M(dTe#d3;ENWb~D$I4@mJ{WW0>Y64Q zpouW|UbHcTZ5NO89qelP2Zvs-Z*G=KWwZSWM_Mb*g-5FJ-Dh5_^P|t02WjUf^i)2} zZ|SVEBt5`MlKVc&a+#X zV+diR8>%3z=#|>E^ zy7N%E?e;?`F|8x)UBGtic}(zKEURevZf>}a;v}NuoVeR4VktCT8(NLJOsf3CLS+bn zs9LmY@p^(OPPtOh2nsEE7lCWL}p|FF^ZwZA*9fsTzA~Vx_RKhPi$?T0|NBca; z#h|=O*g^3>89!_KQ625f<~JDtk7$pCOv0MZC=%FQ=vZDe`AF1+w~}?<-LadV9A@`x zy3Ehdfb_#?^eW^{f$tg@dr5SSn~P6`h1e2B$0h`19%rz8VV+09(kuZ9!qpmOi?d&1 zKv{?ABJiZCXH?5nO@8)qy6kJe0;|9WO-rn=I}wmr1dR6CG-H`@P0QWhvihya!aa(LcB$Q@z!sylOlV`kUo#5J zE0>taC(4nd^X17eKZHHod4#;Ll~-PQyIj7!$Rx?}W3<`qqan1_)PA>4G6;@6C70rh z6KaSdquvlj%61GYC|yH1`|>NVmv21r+Y%(rJ7~q z?6#UWrIyDYc&M!GZj@JEy;$DAuu$GUw_m>X?Z?WCFFsdZd-R%rDiL^o`hIBBwi zKC(|622T{r#Yxk-`uiGyZTzAieYbywbMqShgP%_y00-{^LEK2k$RbMq z8OOhjlQguZ&p7#&#Zf?@nreRmmY%dtux0h1>^1l zOIqV)k+p4^S!CGM#PYJVEGNtF|4mw7)Afc{Sg2iN9-X>NFK~W`pEL&8=A7DS=t5J2 zNyXm_iDZFlev#NdYW}3XnK#8Wc}JX#7{4{V>;LJz*-~fCdip9`&Npp}HdFJg8+P}c zt0bAUAx?QQ@5`^)uS8E?uz^E`h0jn5aL$ZLGhu1#%%{fld*B8TxY;4l##i5C5esfh z?-VeFAM_;b2g0kkc^&kHh6O!0@kk%wYt@E~35)P-mGK5{0D&$990&d- zVt^g|4-Hc=CN5-lOfl!m|5sBCj=jJn#-H&6r<`Y+Y$KdFA<)Dx!kgc2$-F6a%q*D0 z6f`M(a#IGR#d;9Yk4MzeQqJp|8b zzg|J+a9QDU^&vEUM>IKrMy~>1FBw(=Oa5&F({{Ge`$tlk%MvT(E6Q11^W+^7uB&sM zm@TpOw$(Lag%ao1H1}W~yBGaf=bT`+m>gDD zS3^i=F5;tFs#YZ41AH;{)Xe*yMCgD`;PeG|K5IZHauZ^DS_l5sI@f1SDmwdTK|Z7H z&BSQUBB*(0tBBgf&u^huU6z#*NK1xe2r{*??2YycY-g~s>@Muaxl@|Q|HiMC7wv`epOxp-bDrmEbA8`?>fU}%nXIg;tjw&ctU7g`l~Gsm+SxwfRUOrV z6T4iu06$~s-qW=tIv4Ht5i{E?K=JfY(-_>a&PnD* zFU&%6tK*_h?L-GzF+bOuP_xi~^65W%+qIo&jG+*Z3M&r^huO5CU5XLc_Q_B79^R;p zS7K=w^}y@Wgg2f9EtAp-=g#ShmutT(mmfM;zVa{spuGIjbAr<*)B#^z=B_qfC9V@A z%i1X8Lx?Oo+6km_8?9>-1<&ZEq5iLcGag!!m_E`0Dx8gRFuO?#vq)rth3;jXL#+PysyGVM-1-PYQclrxW`YE12M&qJcE;tgP> zv>DqLMF-lo%;uix##lyQK?mZ&V{L3=LLc;c@Ruo^jKknIx{(6+5CwYKgl{Da;`i1O z=RZXv;pmWky_JA&u%3{N*bwFPilgQMkG!Er>~FOKsg#9GfO%3jA~abSa@>pyjW-`d z)FjKyXTTFe)@{F0z#@%~fDWQb>H*rzJ-viIXQPcq<)8V5k16*(1&|q>d7C){`~>IA z>v301#fM1wSSVN1#al8pht>lecu8Zfd8!*vge8y~fBsC$l*;nB6sbP2CL?bz?}vJ` zDBdXIZAX7#P!?0JZa8=Dp|bbLLV51l=QXF(sktt6l|o#MHno|;h7T|Ry7 z&VwRu0QPLpH?@l_0PIxa2kTX>n|1I_H#bP9uqF(>k~$fZSSN{Z`hFxfoUlzeN*mpc zQ-J=0&h9xgpSw#4;aO2z9Sr~Z?sn#m%%k;(aTi%;O)o&hX5R!pp{V$>cC0_{FPAN* zRruQmhM)8Oj)uU75wVb;AQC`i47HXpUZ^P+mv^A_6Bb1(TMEY_?wqI?(A^7c7+ua2 z9zCP&QdElGtBY7(YqC~TI*M_RugptHa(^MOiQos#^0@^KE*N~zsXrFV<~5yo)a&}! zb%K_!h%ylFqYYIlsZT3-p7i|zgG(J?7BwrwP){F4?UV(mT33gDao|Nj-3A%{ zIHAA?*1!|xn9C|3P>aADzMz<+X8r(u9L!`!*VhBaWIQ4Bod^6>LaK#|$oqz(PFjY- zuZoY>WesQ#@ll@&BCK?T7@i2Fa|)LMZGoN1J@ug{w#Wgpg=JF{0}ZT?JaVpl{`0Tt zH18$d%lmCz+3>FW><~jICtf8)4C2TOGv(L>h%y)eRjOr>iqda;`-|nLGPHi@yT2%3 z{Pa`hv!8jTyz{^R7k%vPocbKzlI#iR*7l}edtQ^VS(n@&Tq_@Y{qgep3%XnPitfr~ z$60;&)o;IDUi#Y?$`{^vti1XAe^#{VT>kUl{iM9}v-kBeHl5JbfO>eKNr*NRG#@B$ z|Mb`8m+$?JaBCM%hFv}YC>AwMxO8GwS5GWyN0+;IuZus;ce=wj?r>Ze9<@hpWx{r# zkGCcDee2BQD0)_gg?5E`GQW2tVvObrY!2bsHx>CvZFLO z`;Y^t`mw&K7D9__jy2@!oXVpt;26?jWBwwa<^W$m?b-mrytJ~!lzj)8D%3Ks$Ak z)jC6W;BrPbXb_bE2H9fV#pN8s>m1iHTEU#DbFNd=opF{w)>ejLyav`rTmXSPkS#%n zlQf2tcBqrOYg)Hmx-9#`BbU`KeGFdTX4%lj`~?|x*YyVGvaTQGr0(J2w)1Rn9Vm}Z z@viHm)uJP(fw5n(j$PEZRKihLWL{;W6_`UPOdQK|Xlae0`cOZh3@iGYR_IFkfuqix z?%vgh={a1uq_@GCZ}289I>z=UVZhO^UQb8RCE^XrQHmTt89{h-r=kEhK^$U-Y@|Ln zZ53x@uExk6-`^Z>zM16ecF;0Z%by4sU@MqPb2XLlXcpLw6zTVAM z2}xX_tOS*(BY=prKo&whIEGH%Sw>W zL>XF9Q3o{TJ@2BOs%=x#^yjlln((5Kr0hB>0}qYsl0!isJJLD1wqP;S15QD zVoy7S?i(>aJ9&JF3gh~=40JdYwdrY^Mn4|PQ0B$4j9uDm1g!*VzijG6L{kvpaf0EWd3AKWaq?2E|t%P@Q3P46mJNqi}MdP-q$M^Fbl?MzYgKLM}IHreG|?!QT|!HWQwYsS!vE!Nlx*ulb*CA?+CNOy;g6*#}M3A^q~GZ z7dhh(TnsYEgWA-ywkGycUc7?CsWW6?`?^lxYNfxXFS72+h^a%Wk~7_ht7{To`oz;R z&R;6u`qmH1H{SZ5?zH9OXmLW!^-(z#g+YaD3n++FzA-S$h%7nh<6?Ye^r}t>|J7gq zP5Hf-{+sgoFT7U1_V(N5+dpB~bY0~^81a{QgaLU?Li!P%BK{Yjdcl43gYSH!>}XS9 zPwDUK!vX*PfBX;Sm+$E8g<;3AA8e{42h~*o)z0Uv?W_v)bMj&oE%G?E2b>UGb~0 z77_o&CH~S_$`{9hYhOWnwb`%fXyXG4dFPLQ5^whXh0n=)(pOL|j19;DJQ=SK(Uqbp zdG#j`xkh&b6!7Lqlg~T!O?aNy{iMX(P5CHiekqk>`f5tvvTl8(Sj2((cv{$7=|8?) z)fdLLi>DXZH3sR&S)iE$5gI2R27DfrX__@jv59o+RBqr{y>{){?Hta z2CTxQpXacC(Ay~W6T?r?3fMdAm}Jwx)Ml~{t~0uw3c0d8)N{I3%^M#002gE&}lQ86@ZIP;w zWxFC(yb`PvIB+09{nva{Iv%<(ER60!r$EdVk^{{$8XP$(%bUX(e>kuNf5T%uPHL4-4AqX#;1Ef(8t*H(dg?sT(cu1 z<+9dEe0&>y!aRg|M*JaLtk;E`7ptJVM zqw!gW2TtFXh3#_TVO=Nq@JDn)_j0*-@w~r%fZ=yl#@-dJ4>>98brOeZbXW<$*Q0ta z$lhavs|?{HhG5r>pSnezg8tA)tyFpB)jx$|o=UA`Wz^$-t zPL&qu+kGEsQ*N%35dHEBQ56&Ihj26#8tIRCo_0j?H@aIw0grd0x95ZOrudo-4CL4+ zcHvQ#1aI1?OaE2_F%^Jc;)#7Fdn`EK2~$5vH8{^|C#v2ELUJd}S@l&mRpO@x8c47b zFo;C6O+-Br2m~FM1jL_{4GT=APY^XbAaKxGE|*MnjFdwKCqkV^2dWHp6dlZ$RAV;< z1;VS{l;q4!KEe^}q!a!0rM5X~|J`!bh|;4Def_9U&{8St8~modfZIL*j=o_hLweFK z`b9gI+EtVGGEGVF4jcVTKt+L*L54d?*?F^^C~i%sqSmyV_VB|S0@5i;4I=w8jxmUA zX?Ky2xG`v=47mzo`+A)C-PcJ;PE>}Y&Y^Z`6^312q2+aY9ChH1#I=pf<-OnNE1TNU zR0jV6ZzU}tpAg16XbJ^i5(?**$V-lN8JFStPv@EdSB&L=NXn{$@9_ot$H2kh#9czM zGuk7tudRx(5KM?ZNinq5$|#JmOh|YY24gCQUS3P#E1(B5RFKbi8%fbARj;<3E9akm z)W(h{o_wtQ#b5rTPSbALD9<1)%DZG1%M5_tU;&S!8O&*wcVfjbT!HWp-}+(s^f%rq zfAohRFaP#m{ZaYdzxyxcS07$0o5-U+>c%T9MIT?gsKNRLmG}CqFO*-td#!x^Ti+=M zy1GG2avAy8%9U#e<^TSxe=L9T*V-JA!FqS?QrW_&D*g(YUsfGu$kq<-qCV_L+@?O7 z$F9 zg#(V=Vn_~M;6;_8a^Pt`#Iz{GaioN51T3Z$KnFGP(T`P45|mS#BO^5aKA04+(ay3Q z?S~~!?oJ0ijW;=Wm=btrW1oy2jwjZ060R+b%|)MX+lJtMsUBySmzYg_koGmlu+ zX4$T;Bf=koT5B;`1?8RRqScW~-lRb2P=^)0skdHy8ddd-*FR%|YJDSR!p17~BFr;& zh$pe4WxRP1G&9bImk6gz8WHZbQl{R$XJ4=Rgaw9X!CUyD1%J#7L?9CU=Z}Jlj#>wL ztU{l!Yiwct%-EIr+*(C);wNY^zig;=v|~h^?T*ViJJ%R{)+jLS|I_w+u5VJdqy5Nx z^;!1C;zBId=EW)}l05HYvLQZ)x0!GIS@Ut~unl`IXB>gqvXq6?Jnh3tpq1wcur|vL z`RC!Dq{rz{qbsR38~(JDkIk{j=K#>E))79jwL& zt~22g*1ntwom7>*V^M})>T}3Ir&h$tQtTgrZ(VbnhaWj# zoy%UuZTP< zoB9bzewr3`7&cNgMq|j8oFQ-AhkZ_0E1W;CHK_j9)|XVTb6Wpt{-yOiFk#4*++x&K zTX>V$<*NNM=BQ-W&svvKusQ{rV32nE^}{po9k+g?LUy&{XfhqHiP(Ur;*?A8Qgp;8$&Co9^YA-s*hZiAORiKm!E4ge%QwC+$B8>XZ|F||c zQEX6ZK7#r9Bjvc(&(H5N)nCzn&=Fac{OBKj0Z(qr7T~$E`pk9&_nkNkUZHQqNB*aH z`k225&&_Hxbl3U!6rXK2WgdIiN)gC4Q z1US1$8@4S|Pxc(PkX(VcEomMujBrwiO)~7NoU{WxZg(w%NA-qSdQVF<2evIO=tW$# zA0ITTxCuH715_wID|#a*j54NRuF&ALr~ER^o!;?HpwftZP@&5&pRrcm4{iq7D2X&qh+%9bAJ<-N>DAze z%$EoIy0$>Dz^mw*hiBGL?XTrhr*KhnPJT&dSD6#@^u>YhTCxM55~=ADmnl0ea_{Oy zwq9>Je}197`pPr<0_j8LpT7F7@=Y0BujwnTK_yA0aB_W$tgwnxSa;zfHyHEjFKE1= zkC6RVJHY?bfBft6*h3rT&p-V_InZ5D|LcGH>+;iU3*|$}B7^&Kxn5p<^5OE|{hL25 znrD>%~DNTcxBkvS70H~71ei9r+*LEbZ?Y$am9mDR33ja%7}+lAxBU? z9|xe_>Uy2zg=ct`N^O=-fc{qX&{l?T&wYrMaR+Ce0CrHyaXOehvIHv*Q!tUrt3^}N z&QVJ7i4Y9anm~!@L@TdkAqsJrAI-gtlZgtP5Pil|y>g&FQC!r%%QAXSNrBj9KV>F? z*KR+3##82qa)L+ZWj#q7PJ(A1{-fg2bKTfyZk>j%8cyOsJNmYyPV95Q&p}&s1g=W3 zeByiMM^-bR+ti^WZ{WAA)ck=*X)YU#;IEk^M>~4+WNn=fEu#DMwu1Bxlm7#4c&+J; z1y1H((ASl}^rg>~Prdny#)zxBBYejvUAFYm(3RzL!Wd%-b>t%?pl2*${O2tOijF!( z=~5}3^XXZIPy>u3p1`x|u!u4lo; zAB#i7QY3Re7S76=^yzq0ec2bL9E6pJ*o0B(D&H}RopvswizYP7k$-e&l>)PRb+X^5 zTNeBiIpIyS7D4?*Y+Zng+m?6(N&14fk9-;l!;8Yq_29ilT`vPyM!w7+Wy0qfAIPHs za!k5O9wbj66FO}Yelpa{>16y#LMgwqVNS9NqqTSjYHE-HyNE zb^0k?(w(&z* z>*4e>s{o)6u?IoX?Qbk#vb0t1gO^BLsyimbsFQKQWLjO8rH3& zqB3Z*nT?lk?(lc%f<7>L7+3-=f{3E=@Tb9x}8HdrExlzc1icw+I4;tIJ zDSfr3Ypytq#oBv)LnmrQN7m)}$NbE1hpIh%Of44Z9PZLVEj!_K8<0^VD1)cgdzGNH zk#d<&h2dAp!W%SkW~IlIoSn}$g@B?{SwBX4eOe%)C*cZbh_D&i+x-Ym?e+$M=tu9x zbsjp%#{5y)*jhr?$C$l_%!uiKdBNtxoRA_T}^BIe~;q zN6mkF`pw2qet19oG)wPkk@+e_4Q9I6F0xZljyF6sCiadLG!KB#h? z^h=!3JnF65892($nq(dG8GMqVv-VU2k-yF*b!aVqy{YWiEDg{$HG3jR^L!{BUG8V~T z9VabkRLL~(&y2)d5tS`G4p%C*AzYLH7y`FFH^ee4oc$PSeK|uxCEZ=qAPE7A2pe$K zFVKETuWINVrZPZ#21bNmMqcrsHxQQCk=c@>#0U&t3~~#4?c_IJB)gxK*QZNKSAOo> znrwR8Us3OH}R~f3Ez=AAhzy`NSjTt6zPqy!-C&G?=3t zWzf}AR21Hr%udE&1RS_1i!DP5GbyxBpzuE&qA>S6}{gdFttB%76UZw-o=L zCkMa(;;ZGq`jgL==bqXqfAKdzD*x}-eo!_K_4>2ATl<|<3Oj#oN(^jmyQ2Q=-eyZ` z)99NT*BXFK8QQ9U{Nf^~{JxjiQG=g~+cZq9ku&i{hO9#iqZH+fk|v=#nW%k}Fd?;x zEAouLcZvep3%9$xTUE}j!ZY38(0|kM5i{WNMxG{gV$E)Dc2&{c=@fybO?e|dp3ZOB zkc5y^(vYKUZ-hg(GcIM>D9eWKi0A9kEW|f-`aZ52Vxv#X1-&`&)Kia^FMi?8^75eQK81igG_R#!HOt!|B0fBLmN59HCjYsWLtRJR2@S z+BQbqFs7erWuE>SEhIcW!+;KaWIEmPIbfdeYJHmyorKT!M@zx=A8mP(-HGp7VXD6ch5O91G9QD1t)Y-Hv2LVa@juDH(1E%dfpK0y&XX@g z-0mOMO|LIY1j_5Lzfzug=IQeHfB&`e&2N5RcPC43wCl=Q)*Zgkta@@97g^cb-0{vQ zcT{fb6x{mih4S}r|GIqe@BdTzZ~x6#$`?NKc=_*N{+H$I74FGZKD31X{_^V|lz;bs z{(br0KYv)3&OfTt#F8;~rqgQSffqRxJaLw}=u4B2fxs{gT{3SIHF`%1j1)Kx1wuzj z;G8LSoi&z)k!XZ6oON3I>(eRkn zFqUHE-QC&JSE8@$bPA_Z&`+g2@#N+5r9b+t-c)!&S28U4uJ(0(m72x*&h|mMc;SNb zG0sQb5@%l$zN8K6NDv0nkF#JrV9p@0j2Dcj9!`;AQCAW%USXWEahF6~SQbGV;qmu| zDbP}II2?HFhW7efuyH+J-NT@Bpg!Ouy^){!M~w4uB>%iGF}GI97qJintgXka@LW`5 z!kMK2eO@KHYeUNi))`$&>j@|pt+>!F!GED5H0R=4GZ_d7`_CmsKH%r$Zp(SF{W+%)Kz@wbiodKx1+gmc&utWI|~_~cZdSWPIdtPX-6!58S@Hx z@bjbpjLTfd!0X(*GDN0PE!T~aXBy{Oj7h$y?i~-y&w(h~+0jRY;owmiWH}kh$=^7T z#D-|Q{vuC{3!<|9#HnT*%|sQyOdp(xWb_^5F&^a zKpFNJdqzdV_9dT z3U-!t>!0vI)Y!jX5$1xg*3%Hwmw1fVhx&4;J{U&Z?DAQIxA`$i8%=O@?Zw*qIVs59 za{2N``O`o9gYxXN&y;`ohi{ah|Kis&^j_DM5*K7pU-3ut_yEz0thNkNoR(V^tue&! zE}k!Mz4Pnx-v98wl)w9@m&zAjf2lnEk%v9N|5$kb{yRS||MZ<7m7o9idRbh*#JOO- zCa1{*yTw(C5L;_t(a3QF8pULw(i~VpCH)DFZlu6Sfzwc6zV5Mj%|M0T>O@cJmRaDc ztXhQa2QKwqNNIpkW|rHh_i>;K9m+H7kvYIYnW-8u&w0V1aeGx)GOXys9oMd1El)l9 zMEUZU|Db&0rRQ}Db6fYzZE13?1&bzuEbLa6*5xNRWwqETp?Ce56^7eL0X}O+3=>Mi zz{IIv?!RQhxubi0O$q8;;c}8WtJJC>Cgkt_XpwVZ=M5Ztf$0&3z* zdsn(Ap7D8iDG*)LNyf~|SdS|u4T+4wNE92xjL&=*#xnrv`?i1K8~)J$_p{^ho0{o4 zQOJtg%|Fk*P&RGr2?HNA2QC3prqEQZae>jWs!*PYhVqdw#@RqzQMHAfNx$2V#Sz`o z(nn#U`A(2N6=NO4TmwCW0n*$RWC@y)UoLqOy%cX0%_B?n!o1XDYxN{}cu8zJXWW8!p(*%-~ZQFqBeY3_a-VJt-|dz_h4^-HQC|rmQfrM-vGs;4s4} zV`ZomR?@nnQo9=Qa{%ylWi^8hm41F2~VRT&vfagkrcui`yms86g;++T~jDE?a6 z;tCF*ETxY*6-z$BDUf;Ql|3t-JhL42%(TQC{Gu9>XI3@=V0_5Dz;Pce7tE6(4H>h_ zyPa`KbJ}rEA0OJ<(ii19F|GHPS7pe3{f(D(H}50mYhV9%`QG>5Der%vkEU(vUgNd% zG6w78Lppi8C&LA&yWnY@!h(j^i`$lss`=|mJ9mQ!wh>6)D$L34u3vS{o!hC4ULbH0wV=Z zLxE0y&`njxWgPODI?8bpx=icJupmYP`YmMG8dxC6a=MUMOLol@BdC{G2Fknygi4Ow zc=AbH#Q0Z9`;6z(`5Wsi8r!dzZGAlP6QB5~KB)Go^3qFBYchCE3w1uK7I*XR=))p> zh?2W@ceMNOk3f2f7r6ba;tUP^kid3 zPy0ouMQlGooj?QK`GeNVAN*GftB;AknoJr)0}9-A18*{YKIzh(RU*hfUYfV={@>Ou?Q+5 z0@cx%2}`)R{r(B{&M-~N1rZl zz4cuidb!h*JB0mOv+llG<`kUhzp=JnHl=tsb#=q?`bC|9SS%mxTra=j)EuwEs;!4B z7yQwqeaRh{@2=@IorW&qi*jk6Ct-Rr2?)P?pQP&UF1@lA<8!3I{YZh-clpdVTCa7Y z*Lj?rI?ofT%pmy<&FwjwVj~YDa_YkbjkMIE$Ud-OjWM8`5H^*_`f*ZZQP=V;>4~vc zFKpSk`=@{M#q#{~Pw2{qE7BvJ?B#s{O%C$$e) z1_G6fd_0vVz3J;0gpU(JgsC6%2Lb2`D2$4cj|pd%lqZ97!4nYU?`bJeyJ;$0(%Iv9 zO*K!FfqvniI)u}bEHdcBB^d&k3;KkO78Wed_&PT5I2(lML4sL;15P$h^QPfDfJhvF z9}o&ma-`=~m4D#HLiQO8)EiZyyFcAS!%~k9XH6zK<>)+P>d7e3 z%LKCxImT^m>>+0uhq#NK>lk9J#;_TOP@*r@-RfKZ%r{yfIXt82`^88UcMiu|dC1Sq zP54k+Ptznsz!U1zlB+uvC%NIeEIyt_TyVSTS>=bvECZY~oRuF<4zq0&RaV>KK4pQSRQMLeO|6Ts!435O>9}Fx}seU4j%a4$dQpEbKh6 z3pT_GoI{qF$2xbHE@!iJXes)-Z)z{f?_DtUM+^?gulh@0<@(@*t2#}(R~ONGN~xkC zQ3Aly=gM}ZgMX5D@|hWew}$;4slYnjBYo7_+jxo(r?$xJb6Z`M+M@cMJGUXeQXM_* z$iyu5&OX;L?utl!;gmLQZR^Sl(RY1)RVSo>TVB>_xW_;8sP5-|vV8q(-zvZU)d%Ig z>d)ooo7b;tBD^j-%YY&S`+=@`*xMG4>zWjc_UFz&;>q&1J`_^+chvTfBJS?h_go7f zX*;ZwYg&!W`N|ZNAf*`k1YdMCcY4a*kbW6&pz&vqNS7|@uJ7OJYt2jL zQ=fXHeD*W1mq#DHAcOBUEly$qL49_0oebj!uf{P!wv3Q(|d4l-es z-gZs(!^e4`6(=)xa{{WxBX~_is?NB=!w8tL25RU`8h>~p^XP7j0?==sGi{aF!q7K4 zU*ySHqfYZE%$$MmHL&@=q`m}pai4_(V>qt%XY`u#M2Cjq#{d;d8QiH+gCQGF)~L@n z`pzZ=QocL=QMn*n6SElcngu^%;Vmyz#X~#dx41(v?hy?A5r-JagRTh|oSdP=KR%DA zfN44dER6`(#TMJ#u+!$>ZmbKCe;)wS#$d|2jW)s;J;LwFd!>cMA2?=IZj3q+1wt#+ z11%*Z)^X}UbUG(?y@?{-PB>Jw@@UOSKeRkz)R1J!TeY0X?h5NIOfErjlvi(mln0T$6H_eNIsD%IUI^9$u3F?|DFD&?5tCkJ?zbyd{Tk@ko+YQ^s4_l8P)iRjX?1}lv#Pj zJSDpU`k43*0lvy_*)OCI>zH-rc{l0T*5h9F-}Mu`$w2wcjw zvlGLhV3=SX=sr+{hy`HW?K_VfI=i6f4l|(KXBzhD1a=)DkTFq{Y;*NPr~JsP$+SH z!IP@BcyCE3S66lKAE(dMz$29pd2hQ@H4u{>8DXg>_v`Y+Si7;YBE!hGu4}kZE?s<0 zhTccYTi^Ij`N7*iF4s48@^|fAC}8@49Y_?k6zYaPct;;?UcYW!7?JBZ=e}f6+t)7o zsy;RsG!z{m4o*1iMHuN%{R=6K$LC0akpj1Z0=+I1He^qKZCsU368%5RjQD`X zp9=!g!;dB)(EV7R4J%*dArYTsz1nYcF-@+nK;!7cn%?QY-S@Q_wNO6)`8RYe!)J6= z1G;rrZwstwv+A1l5xQl4eO(zBbdUIsbljT9`K_%@ouB|;<5CYPisE=pnmH)6V15Z{ zc*T>GFX%c9yeKSSJ^pltVBj?dx$#=qXhI5%|G=fZ;Pi(}6hFEfr$8Fn5<_cLh2EX3 z{Y2Qj3i8Jj002M$NklE9(_wD7(pRr>A0na8T^C_C1XA{Bm*_w{rdozJWtROrWQkwaX4F@^&)x58N8({o7F$JJ^ zI_R47%#?Rt-)EdkLjb3yZ8%We?v}3ekq%(~+P&s4WbW6*u05*aog3+7<-sE&S#$65?vJS`Yfi9wFDmK%yr(5WbuFKlu@1&m!;szBVdZu=(aFMQG z{kLIPbb#MDsf)c1e_X*JM9?dSN7Fm(I#pg(Ff_@&0GHn=)U%b}qvnZJe{|Cnxa$Vq ztWwYP8N*YYq+T_X$qPfZ&J00B6(R-!cKHx2UeV#QeGH69mBkE(sf+|R3%0_eyHN^= zhL*aZB|Q}mp@-(|Fvg;aK4M_zY6hOHoZtJ^ZSR zoKHtK@o{=M7UY?hyatAtuZ^!|i*h}=SADr#jY*{MiriQ$7ca&Y4Qhh&)b=HE zJrjQub(_3FGnt(=kqzy6D4NBYCecQVkY%0h-QDF?=jHO!3(u6No_MT$?D=QPH@@-B z@}r-;E93e@GV(HL3x@`#Lm5!^_jKo_4DmWEX9ewha~2d5jvX0;%hH-?p?(uxph?P> z3FrxPYH}Gts=NhfP+yF}42{VvP`q^+pK-(Vj31vP1NY+;g_uTf{6simFDK})$%{elmd>29Y9oH0%w ze{PZjXxhB}PFfp*j_wRmKt1nHrjM(`3wwwMtV8H}=_D4K<|*+DAKYPM$OlWv4?n?0Gk6I8 z9Nmpmprt8TQZ@r)umAI8p<)E1RP_b-KLWp{Ya7_q!_dohX1r2OJlDG{)344z7Ha~! z((3}^TLS}S(wjz4p!1FT!Q`0nW4RF>lg2|3iTx5_7nYH)K{>-Br4I-`Ge41_~{ELYv=n;8ZD7YCsZCv_Ei*%liYD<9n zoSAt5bMFR^qHnaH_CW_d8zK;!yavZI25@B*eCa!)rElQZHGQWBK4g84-XSjdJ!E20 z;|arud7Dz2&d4}L&veoM*+(-$X5s}haob#9QAF9a3=!fPb@h6kwrBh0#cl!wA0fui zn<~tyvu%b&&w@M(`h>1zU&*Xz+b7bVPWlIWzo48WXbW)YoL zU`&8UHX7l%DEt|eb(ZfH}C4?%LJ zl8q&rrCqqVAziUm{`}AXL>o>|$hfPwHTHB5FS{I*-6YXmc_Lsu8l zP&PB1=Pk}TJ3X^x-6$pUP)8wloAjX0JY0_C5Lwh8Yy5D`uesKYgBNis7x}b-S9omB z(G$Je;TKZl6CQB85d9`y9CgYc*AX0Dy-tbX0R_M34ZP7W^lEl-+f#~Xg662)aYtz6 z*QrDnbhu?L8ac_yfDN;XJsm$W4{*%*b9xFu{pf+nt3GL@5TWPvmJJY6Y@D8viBJpv z?XtDW;+;YJ2&p|HDaxy*(zhxr9SVkU{t<8GrDwuw6T3_Lv)D+0WOgab2i(i6$?+n001L5@ z2i;;GX1Y_GC^Tw=@CnMwUp{pN0QjoI4^7*+OdC9t^d|rvD_{AFJ_7mNrE>nf-UiSK-8~y~xnf3RI^(pi@sWb5 zV+NaPl&Azf{f}VPJy{oO?K^h8Fzi3_;Afme&H_&AEjIAO^;q^x9#=T#qU4^z!2^VHlDTyX$Jo(Ej{aE` z$T1DCnC_}3=|1(gt)JDz zEq;{>4$18HzxsHPZ>5RAbN4(#7V; zbi{$pqVKF2=`%IQ|K}ySi8Kv&((QxA#^+-17!rD{=Sguxq3F zFq{oh3Qn<-h*7Un$@C z?vKjf{^MKaz2AIT*4ES~-jNGsUwo$_7#H+PoBnj~5W~_QAIQ^5JC8NcEj-Rkm&WNB z)x~uqoOO+UomTn`Rt$Tj2W&S`QoLM;qoxOJq>aBL15pu?X^teOS9WI6eCn{uCd0zGq(G z1Sb5zfVmL(C!ZigV#TkjW8mzBX2n-jW&{_xN-7DbSt9Ro8lMfkIFh`^1u- zTU%S^mkj5^)kfV$dGzy=yWgeD#fJPw~DI2X`g&d6V+|lVP;AC|7hty=$&2gK)v>s+Yk+N2e zyX5EWHRR8(Anw6+cajQ}b^kCvQ|NScsXE0|ypd*|pMZLLj_cn*z+55tweqBN2ph`8 zF$cAARO@djXSvXGU%bur4c)2UDlb0an`J3)$N$8oEL6XHqm5I1)I%lJ_@;?YBVGS3 zLpIXZ`cX&!i2@1J)t?M+2Z2F{O(W@Ft#ZJ8lBa1C#ZhH}KLELji1i zM`9yJ?1j%vW~L@Z0wjToU55DTcAnhO%-xGsFY>B5_YB&WF#1nS0c%IAuWr<(D;UVF za6+{Soj#VMSO52X_bULQ5S%H!CoZ%Hr2nFvKCTV7{p)xuEL28SW@5A~o^;n;Pv#U6 zUMLSg{IC_A4H^mD7k8I^R4507@UyUGus~_===1`29-lkE;qZ06HhuoW`LcU;v%L2D zOXb<;o-Y6R)o+&Xeg7Suy4x|K?xcOyX@L~GSYjPTGTNJrG$LCm!th6 zoCicpVAO-NQqdQ{#iTDzWgBwx>JNb0R=n2;RH z<{)E=O~_NP*D}5XufoS@*`--8RtWj|hhFh?u%`LWTg5Eseo8V*qEV98nN|`NerZwZ zx-)lWS@`uK)K7or_40>b`hqr|I6bvhH_Kv@h`yy9+Q}=MOS%fjhPjHHcvlyr9Xdw; zFw-%H$HbHmuJRfghTSmqf+s4NM!aaHjlQ)llzMvSnw&n{m}80p-SA&i+WFoT@GznU zh6R;Ql%MboKKMl&2X=bEFWfsHwgT~mJo)-$@E}Oc(H`^2S3~xJGm9P89oW&G9ST&g zPborbke%dmL8J5|Aj^0WE=*akt zOPV4}_-))(U+nmvWbVZm-9=N0v6gU$G-nOqSfK7xMTZ{$UB&!6oMhvfF!o>dCtp=F`Ei_m2 z3x`V62-9IB-%wDx#L+W{0-*}J#O#DFqW3^s7FT>|ZCl1e2KN}f6J{v<8Gmb@<_lLh zDjEGP+-S6_(s(BSINiws&)r=QKm3sO9H-1e-;s8E>#YLjyBv|a`e$9DUYy=#@ybUi z@^!-)G?Xsm%(hO}oxixQ-SdU=(BirBCx7($^1{cTFK>P0JLShe{+T{fv#rIf-mBJ0 z-NhyDEYrP~^qb1#i=h;&UUmJLKI2gDlnpVK*h=%f2I@g|@W>x`7JV7>9v& zN0Z+;0TJrJrj*bd6eZ&=A5~>h$VZR7nG2>`PfiDU%&D4&u_xNXGbYsu8!@wfYny6P zXr&%*l6rmo=sOt&hLd)35qC3__skzXS9?s1m8W!ba{_+Y*0ms$_0c~sw3KBr z4SJQAz%@C`JX!ljsC$$V zn9t{xKc_Q}F(;rv>Iuud;In@^ddqr(j?a^3zTcg}1i4mUa}~h8KDbE#GoR(e9fJ_# z#;|8HoKKg&XkuS4${&kOokH&;h{gn=sf4^>KC^RN- z_|?`0aQ&S}%fvqcJR{KQ^CrzY|D*_-d=HZM%o%uLo|aisW+wW%4(cBK6F>~<`?JJ= zFy+d@vOXTQq@CLbsk?7=TW1S%TZ$Dx(zx~ouhw92-}4=|nb_vKaX$(x6&P5C;l$j* zSRrNXoTp&8!+C9OwLJU~240yoW#C<|JIr%(-H~V;S;Xi)6;l!-W<_7|q`pjC@nZ<# zBrg-K_4QR5+OO+0^DLl0flpEi#E_zSw4;Te7C@v83JT`A`_R&{++7U8@r# zDiiaWkokmnNE>-5DRQGv4`m`_QZ(^ET~nVlc}#8ml5N>{J&)(kSMz{21d)5+)2(zI zed?!w14s4325t9e^!RKjko3za^sC2i$sFrHHd4^b$Xhr`8}gMQ{B_(;98kU6tcxD) zljNJ$*%Qh4SwNH;HrT`qzCC?o$(+=0b5l+m28@Vd_RMTnggskRuJ|zyoo7C{m$vOo$Mod%S3>tVR80HfHww}ZmgJgH zz%vmc-Vt7D5@N(PO*H}*J-o6ae$n*?__r=~&%U9^c8aS)L>rMnaG;t#lJApv|f5o>u0-2<1n?3Isw z?1l2BFMX~&{nTU9_nT#7LmR6ysBP(PeDo16?;xYy`_fa$J`>;N721Y24t-$1!tq*X zT*1KNyqf?jW9pEo7xnF1muZT!YiSWNPI#vXWw{?1b?$U+h=)IT1HcPh>8a@Fh&P^un?&h+v-AqJ7?$7HY=C48-ZTX| zy`X-A&dfdQ5Ey;zc=d?l89!Mk9_W5}X@at%XkJ=dl96{weBd>X;->p6a0}I}#Hls_ zb{aQb-f4256n0v^PF$`VR9n?$>OAImXv2nyWkR%+s5!i|qk|@l-C7l5;5A%Ih){I$ zMp|u3%9YQG)JUQ1(ofpr2OAE;^?fu+i=^~q?EN0PnfXUc8~C%EV=4iE@@zg6o-*Na zPOf_{0wc>=mylBD#uHZ{)XY6DNsq>;c@og}GI{dP@zhoSG@I66582fpcv5Hs$(1#X zL&0=@;~^^DwKdaj_cQhR?Jnmm<3EE2-q}j1V@&l%-|=E$7?d9Jk2qDM1KvF`C5y>} z>pIQ5tdqQ)=H>MqF*{5gi(dvK7Ok4>S>TjMi&N6mSjONq&!q^p0yGIr=0Z+*?&;p|KO@#+dZeN0l?AkLP1+%+WtHZ zA*_Jtzp5~kz6(?V@Cee=1Xg$;RiYJpkPfv#gv>-mtHPvC08d-3v8`O+V~ zQC@uc`SP`|eYiD55RS@rCxaiMZaD?wb?uZ9b;z+D8Xe#9SLK7O7}-MBYmz>Um45rKK^mrq!D+66ufwNAD2bj>w%0spY^gORPmnEggA~tdItfeTQ1Q9sN zFp`Mj^gsfSQFcjJ9hHM68OG3$oVHbPe@l3F%Htn-NLRhQSpHZicUSb9%t6_d!Im<> zA(YzLbG;c~h4--Tn8i3Nt*cAFfLqkqOdck}yV{WQtDN$)QS0`x+g4rBLBMiJiwISK z`lw`>jGP%V)s@m?4qp%4Q@@WJeW#h(=w3H*o5Q>yO6(2MR{^qQdU zp@5!Mqv^f|iVEqe$E-Z_Vh2qfgL5b_lnbbxZbC2Ae(loS8QO-_IJ2M+4y)_MBU;~i zoY~Pee#@E%>#aR~m>4`3XFaVo;0-!d|E*I95hd5_mk4M5oNpEbBtU>q{DN{;mIoCGy8h7tE0ZPEqY9Fhc?C2O~hxUo~~ir=s{W& zoavpDbtdc>IZ1&tXyBb}z;PkJilafIXTv6kIFjA_!`(R9fdnk;RIgwEPzH>EDS!+} z2uKJ@u(BtCV)qvJJSJ~Sy}!I_u-mU6549R>7;jiO#m;va_ZA%qtz;nJbvWOhn51Ya zm~pr6nF_)^#Z1hT2Fldr!NFMMk<_cNnl6Av87(nVJo4}*PXyWRXYvm(M4nq$*E^3X z3?!zF`o>0W6AVt4Jm@Rq+dJ3GQ$`+2uEwF57s@Z#dC z7f?I8PfG{2%Zk2CjN`)z%PXANW0J-IBb@xn5$Ai1C2#3C{cC5U3XYW-Sy*`KACBA= z%Kiw^4;f1leYk};0`gZ_(&jnWbtwXq6EgIOMlM zLO*S>AF(>3yFRyQt#&`rQ+;^Zu0vLZBPg-Rcp9Dn)GvdxR?7l6n?=k4l zCQz>n-3MLE>4x6qfctTwdEz$>7JD#PM2wfJ^=-8 zzHh`sl4XRJvCsJGoRiH&+=9j*iiYH3YX6sJm!JkiGl<0PI61s zwBdPGVWRvKG$q!@K|9kVX`?6qmRI9`a~pOoclzjg4B(wz@&v`qpyEVLXQV#}QMZEz zw*%+B+ZQ*+d-qa%Zmz%XRQvB#Irmb}+zWNN?+v^VxgC&)L}yUqtGO7PSj4W%ptYi1 zdmDM{AO#Hn5G4;=br2(7-p(~%$HmY|>{0A}R9c7n%zC`QQ4@K_u5B0#au*kipkbO8 z4#Q2->Af+VP(Jk_{WZX#+DybmpY?r09`dfPu9PR9c-#iweVs%e_WcBsGZdJhHAWSh z>mNFemhbDe>NT}jCzy0n_oYufSDtz1DV^l~etGMg-z)F_;&-~kciSyqUDt=$G~wOd z+txyg*IQR~qK~AYIJ}B02L5P!T}cL&na5ILhp! zD7+Rxq-NIc+X2{Az79e47)76{!8n9GKHQ@@9(IJdJrr;soTL|L!(|N6s5UD%V5A)Igz|9@j93U zduMwGWPXcb??4}^(jLv;?v}!buxjz!J{j(YiWkq8;$29Ky zC)@71LPKjC%*dlSav!2Am}sc4&>vjsva1j4@#JlQL(NyZ8VDxl9*KQ?-uDzx=OgQ_ zL)Oi1;+H)cc$aw-jSZfW3P#G1D=Kdg)({X>|5*bdhphFs^xY4C14jwo40a(yY7CH%!I1(Z z1x5;t6u4muJP-z6sKcN$bJ9(`{$b?Z*C52;evn4qIysE74Y+VaJaw#cV(YKaHP`q^ z3gnl@{<#~xJ;Nvrvo z#oRYeZ7~ses!?6jcx{cznP{=E9eEjX&YfQ_uf6tS`Pj#wDc}0m+vS~iep>$dXYUF| z#+-$?%eEaJL)8afQb;0vcG z?dZb9Dy+EdHCE+)au-|k&w3d_hC2PI8lMz4;mk3iU^?z0 zEjaHe{!>~__LVX%>vi$raXYNXyyO(S^Teqf6d_^~6>%CVVFV662y~A=eBk67BVL2% z`XY~%I@v@jMiUM%@wdD4VYzhaLV5F3pDdsL%hz;$7!(ezS^SY1 zag0;D1T4WUhVe^T?D-83KAwhQ7#&RYX(urHtzJTSM>kU7#wlQC?6N19<$$n?ms1Xm>MpU>&?X}!m9 zftZGpKeD1L*_h>SYmeueH!zNK-JurF>zn}V#wp6~fF*azmtJ8U$v|iH(2@iD_@s6%+;BL$( zp1e>lKm1zx_=``L?|tuw<@?|Nae41o@5|83BKVx=aq99o>ws~`MjXkOW_rj_e4!c| zhEvzb1#L}N!bx7_&R{(IdIrCMkI5o(Tr<(vjl8?hD*ix209=7J%FV(IG5OQxolF@+ z_caBAKT58ohJ&&Q5yURm{RTKTENIr0tZ_zL|c!8+JGj9aMxEf=0 zjJV1m@dg(n-&HxQK0ZeZoQML9H2|hWM5YY!WXwWN{PqzR3UOP0jA==)9G~NkPWaG> zz*lp3az$9_bC~pWbH=FO{rNj2Q1$|?C9S7pra(JyeAP5yOm_MJApM~uI61hrvuy(} zUFdwCi)4QRJn2G*PR5O)`;Y<>%#>L_%?cs&@Q<$t)6;Kx@(mI3662w^cl=CNOUf)* zpkcD$P1cT+E_f~VL4*S0&g%lTUH@`c($=M~GqM*lLz^aH;#9n`KnTf{-?Gu9pR1L) z3WbdoV^F%^imm!Iu=b^lzL5eW1x5;t6u7k%c%Tftkd8q-CvOZgOxziS7k$)7Lmi7t z8HWz_T8Uvbl=HDD26YA~4~7h8`r}{BD5Fytv|})f@c0`PfZh|6C`G4%_jU~QISFxZ z(U%ze^oN0kI2{kMOj z6TQDEzy9@=vbA+pvPE8A%hGGD3oD3?T=dC-K5$`2v2r1A@^p)1`Rk&(tD~~mkXx%7 z7%Bq#SQek0u!5(SP;qAO_xwn?=~6EwuV(!CyniW>ecrZkGOqGg2O#b;e`Z9-VZm!P zEn^clIgebeKhqOi|BQ0Gbb_@i@S zySp;dBD1Udh~mCpZ@#kmq5R9`^5u>4d%yR5dGphsEYCgntgdRgUanpHU0LU<7HtM? zZ*NNOYt4kxi@#b1a=IX$;FFP@+SOu^F@gHIj;dFDA(+}keXJj9d)ju?62`|!fg7Me z&+Eg?7+ms{*@EOCcM!zZMG z=%@b^y#+}{V2rq#VjUr%)DN4Ro6;)>Wm|d+ICM_mN8}sbgH8c>1)j+DoBcY_fDA7& z`DaYhJd`Uvn6mm~Y>Hb}n3Me75Qngv_sGH=mtc-w4X-ucmiAfxB$Kxgx5LkT;e-yr zrtV>oR_hh-u^swIA2OC>;ElKQln8D0?+{sqmih}CpSa``R&WFxDKJuCq`*jlq`(7b z;HBXVE;#}8D|i}bx^au0eFb>EWI=!1x&sgcFZT&{AK4(k@Gw~M;%bxIp&pr1V%1Es z52Q1#2Q7#8dwTVE=zzUh=TmaR&!i$86Bvb=RJdcppZ%YG=SfG*Sd@+Y`qL8w#kxKk z_RP~y_;ut3P27kN9*Ppq^lxov*9K^3SNU2r;lwR6uqdMr_t#zbtJgB{TsmL2wzqux zZe@90_w#;C_wzneKKjvrF5mpt4|Q$Bd-@QQPS0#>H(wJzNtI}*39}r1Arp>$gzQXz zO$B`tH=^=a(?UTB&fP*E$l<4-Yjz^C_W1;?oTs8^l#bFl}WlawwS%(D7 zFmi$;oN*BbZ`PEUaLAh$vlc1ZqZ&%y!-f9i#O=a@7Q2j%8V4_|tV+h8DKEeLvGSQW zUnwgq8YgA+<&^LGnv7gBrR?asqy7C|=}*o&(PkERYOiFQ4IhWK5Zuy6su#{mWO0Z? z=KN33P90INtX73F@I)IUX8au~a5EHu%~DQM2bd?#kHLh*!_Ry?=s;uI5@F@z5CC!# z@M-!H|0^B_PQ1Nr_A#fabLxXm^_(X2nSc#C$BD>!6%K=uCut%hG^bxUvCC!=f7|qr z;(|`v{Ds{5b051;=HVXW9|Q^{&mhdfaqxymL622AR>L>k=j_cLjZ-}LbohgG%RKXA zHhR3H36sSepD-Jk!D!4`$QI%+b=$jV^N-@=mq zH1=?BmzK63XjzP`~3L+gS@+5VRicFhI=*q=Y zQ_b(aQE14OLmX+q&HD39R?al?n0qaIx$q30uTixkR|LoAjW&Un!L0i(wF$)FxpD5iPw`+dc3pIOj?y{xhymEIaS9&e zSEOrETq_I-*jOSQ?NLN^9-lk7Bvz)5&yfN*Pl4nrUeQK~2*ZaRFT#HoBpH3gr~4Wo zF)VW8ohwYZrx!zS;z2&l+ZM7~Kk~~Vg{_+mwJEdweF?Kt@9Q`dDyU^WAv$umE^im1 zU--C_-vX!xcgSpGulm4!q4|J1bS8-P|D&3$<*Ornla zQgP-p^ngO}#&vyQctzvdvSfZmr+Ezq*$0WY`G!pS@9znly!UTRdUd3ZDU(&#CLnSAVfb}24R}B7405ArJyL|(3 zE#RJfK%b>W82~l#o5rFu#zBmNdgOwO3dG4-GiNmoW0B2+(pLHn7fA1@a#Zm9mj2P-mU@b50$$f3! ztpCY#KUk2_r?vl&Y5GZM88F$O@Iv}0krNNM1eZlxo7bFFVfvipnZ!B7KCy>E*-gZ- zE?Gw6Pg=mkc9JQh5Mb7`Egwlk?=4A|t(yhJsap)Yp$B($J&UeUkWA}yDLS41k@A_( zzENI%^%Ld7#dDJLYto%6Nh>|-hFrR2Wu~QDe)~o8t4M}O48N4;52tC-r~fDb5U9Ku zCu_}J{dQ69i26gDXqaKMVJ*PuA1QDPDUfpKef&DE7`+$}UUa;;k+G3+X>T6`@1Fh^ zB|mExVQ(%XkC~At0c0g2o#G$G!PbleS$3Z&Uk7glZNvl^fz02IDN{iANW^4at6(!e zR|4fT+d}L8hc3X#F52%%$M{eN3WvG74ReBnmV(c`G#PwBX+o1O%bJWGL-!j6vY%VN z=-U|c(Flvja;yZ;kM2vZ_jlt%e#EalZko-X1n0hV9I73x^+B!MP4KfV4zp$PU%L&KrF4umS9E zYY2oqUN1-a6Ho5C7Y8OJ=RX;`WQ zD1#XbQZCy+l(CWlivfI9lSrTPPz+fZoC=9~fI+0bY0S z@nv25x-KA$^344tz4Do~Bpe2p;Ai6Nq|L_JN_81!4rIOY2_`RW`JjR%V+ooIhfY6l zoLeq0e&U((tj$TnYb%V!PNN8-t+qYWDHEx)Ru4qIZ0e1e77iIlh7UnFSWjdYT^Dq*PtZ0jVFBwVL; zC6mg(x4%5YLFiU=lLi9}t+;Qsky7d=|((9!GoI_NQM|sWnGOAn!pd zB1tiv=!O1ePQJH`o~gQq4Co^0=?wMR;UrQx&Nk_y5##S|ra;J8NF$?F6~!mJdQIjP>>V2E|2v9@}zp9)4Y+THte!tD=KvL&iWZqtv`sWYuDSO z{3TV!=SYE(0wV=(Jp~?k11}_P2c0Cb?L_*CAw32t?0F1i9>nVayr==1lN#Mlr6%{l zcwl9~^mxrr4swpjVjhSm^zcH(v(*6)H&5 z^i&2GTwyef6RBaap}y2puNiNwmgn^WA+BoRssc{$#+{K}i4=eTxK0?L6Gq+IG_BFW;qc||g0Uul7!)&YN{Dt-M`=5NNeEj3j`y}sozw>ta z=}+F(1X3rSc9E%~$?&R9{$ljyB%yH1n2RBoKl6*Gk_W1T4OPOut5Xx)f?a!Fe)*V~ zf}lF*W8$sq2MaJk4&yaFIO%8634n3R|4)CtfrFjC-_Q2-epI>w^pMR~;NaWdVf;04S_ z1ldGh)m(&cI56Mnt{4$~%r|n(2>k(`GzPi6rd*__D^LEaH4Jt(f7~KheWG1fDxtg3 z8Kgm8^ca884IP1g;YtP!Q5c>~JB;qk6DmRCNjbfn)t7zh=o=}}Qy?}V;i5?%GG8IX zbzEgl!Q9xJGw`c&a5pV7&&giqvG}>BKuW;hcwvm}^Z_Nn$NAZS zI`Rg7@(s9LM}dN2nzavCpYc(`j6>%7yLP#fCS)*b6qN}%jhTisc0YY(N7?I$GI~Y| zj1(9taN8*Gz#DiOb{L=-beJ%D=Rh2jrhb6r+my#l5yAaL+f8hkmq zz?aM|mz}}Z9pjpI6J;t%Ui~4rZiSvP5mkuD+Vn0DV7SN-{^qxbs~MX#yt88mKnl8Q zRWT$VCRCO&jL-CZCR~Q^x973#SA&Nz!|*Jc07E~S{FN`}<+GGGtC9|`XPrS2Mo7&Z zpZsv7wgA)>B8vhY3dxnRAa5Dzh=@hcDLTuDfvloZq~powylOKGOGScsb>+gAPWj5nOXV=&vVpcF83lDLZ1bcp zhTSl@P~#9IwceFcom3$DK{e?cGQ$_+?~DXRfp>Hx1@06D=5Z?HUZ%m<9*BHkpd$HMhe_G z1s-SvZw@^?8IyA22RU;wTIcDJ&f+)|08&Oy5BLry1(!9lF>z;?)($(PJ-L{5DUQjq zT6B@={`+kw9_eS2la4rCOyV>4bWh_|7UL2=*(wxh7Dp~ak^HaaQ38fSrX`#(-uK6X zSQB8t;KM=t<%JhMrvBtg08ME0Ix`8!t z6Wg|J+nU(6ZQE~b+qP}nwmorj^6h``bJ?afnmkfdeL;MwwnW?$?bV32wovLOOk&x^Wlm?SwkL zr@0Qes(sirp-{2d_H!dsh^`+_`vmB)tXl*YogDh_GM^)ivU@Mi;A(!v!1+R%3NP`` zbc2%gGyUNy+uTDKB?Pfg3OKE5sJY!4zVP|$>t;S;3{zXz2`J8{_aQo;X6~8`bQM*j z)vaTqaJ+M;E>^Q;)=o1K(KgZG;9T9cMBF3cm>rwHX@hk@hp_J&1Uwc*WdYwqYb9kN zS>%N4u7tA)W`(_4kdNFPaD(s-t1=LyO4ED0<{8EaPM>1u3UGRV093!2WhGTonP{(R zlAoHCr9{rd$wS;lxm?pK)%#_Kvxj13$;+Qg^XXCNz!Wtb6XYJKppOghOyA5up3Sv+ zysw}h*!mdI47a0s8EJ11xv{kbR$+ZZycOi@{v#A(K*p#V=J%R5nXiz6{l<-OlhM9R zvPwmQbFA)v^_&B2sz?y4NAM;ihl8FZ7#ffb-163+8N8|(T|3; zO*?L&WF#iM(2L!e(FylHnq=oDYvo73s!P#^;@KWdIn;CRIQ~bb#euknfWS5SqanHm zy5b;R+%C!I_>Y6SrOeVQvZR{F8Y;9^!Hv_a(OMczhwDJ6LhmY2Cxqy0ggEZch7O25bNI^C>W8GEe43^ofRm%jGFYFJ5fZ;OM(wI= z;hf*(h0-R+_+Gjntr$orFd9cQYK>qqQ7@fu5y8pRsFp02LJFZbi6iz=`VJiYtQ|Q? z7RJiSCs1&j7^8GBh^OM!vDA$9SE=!Vim1^r#3u7&`20KkxW$vTy!7jNC?$J&D_ic= zW?T0Rul9?VSfOk3x{(8B|Znhi-t2&wE$Tn`&7PnILoIsasTK@xR$Y~AKFJp?2 zpABWwLzZMQ>|i`6h3+6`f^Ur}?ZQaT&d^T+d%-x4^h?4of^{#TA?(sS2r<+2E!J>=2rSXgy(rlkhSjJ z@Dr{a$@p@QFlhP3e%xMNwpYz>^s?TxRoL9BDWmkkv_=UdB}p% zMxt`Il?S=4SFF>@gTSybG_QR=TMc0Zh{8WI(@X-k1kT;#bq_Yj5)aD_P#788=xF`b zrC|pa`aDwwUtsXhfnHYYO_3I2tL8bkjIT+X@yDNP+a-rg^`-Q4FA;TvPRL=XnC2}) zYP8|Me&TzLiq4WL87lsNSpYmZuzd`}Hy0X=;l6C4A*Kx5gbxg?|FC#K8XnMfev^%t zLong?7F#*L2|M@8(R>V>i%4gVIM`0t3t(MnWCPRjA3bsRBpYW+mZZHjRC>WyBwCNU zozwrUW&6L{?Gv)wE=;F{0^DSjZp3Y_qG=j#Df%w*O(SIQ0N^)eU=f%IZ})JJgRZW; z&e1p+n5B#Y8F)u^(4d_zpSkC?gQ-yXz$lkQigZ_-sWkg(Ei=}v<0G8@$KLJ6X*KUY zuEg8a6Jci!k~I|-XWu`qHm}$G^Kn`Z`uA=zxK*3G-pk8M&bUA(=Dk{-3tu(mk3*EP z-=7R;8%t+L>|K%m;*m3O1&)@N}v>>VXCIrZi>rHtx5 zYn5GKjRsNpxSu8q-aPX^uG#RCZ+xG{j>K+0Dz#qi6l+2*mgq53l2cZKh@hqP)Dq`h zfC}1nbI-E}K6eUJbT&{HJ$xvy*G_&P!ay(tl6BI|7s|WD-*2J>AU;ylXED073sD;+`biEx6^bd7yxI11>%Z7WkzB|4Sf5U)aw* z*B>FRZ2Y`Zi;{_vaC2bg0_uC``;zX| z5eUJ)0dNv^DdFW#4cxlCkt;OcE{PhqGZ)5a* zZO41f>+V&RGv=B7QTk8kDwjW4l+x~koP8q3Gl5i4LN*XZZ#h(rtBN{O@TUg|)@x{N zqL7yOiW7&rjifG|cZOV)y(3L_n z<4kOJ`ojS8Ax|NXV+mcjOGi1-=L$Pw{*%YPILFn_9jTKQUvcvU;@K6T^kCj2Aax{? zVW+>{Z4l@kXt-tfB_Mr-gp~aC8wK3kF{_ser*o#CB;8!n;&KjZnIT9MbJLeznW|H- znxOkO!mS^@XBYi}CAx7Sa7imWa==i86!)3w1PL|lhYJLq2?ISPwapAZJ{bC_zDDw@ z4BNf;r-B!YcTZEQ%Gu53Q=h|lzE(w^0E3uGIjR5}akP>snS*?zO%zfRMqYpCor~rp0vCmi!gd>Dzttu~o8#l7EADy( z+s@=B4eU5Jpyahv{&heKj|-hdQC!2|4i4Ud^C_$ZrSB4W|NF=oObRA8s;0LgA+8RO z4}3}-%>*Nq$%a4JhDs3ox->h)+lQezA2|!jrq#f;7zY*7@F!Md%Pi$2Xl%4UeLv-6 z>7R(p5G3Gj7WT;qnA-W1Vj=;GWVb{!K50a5A}!M|N9sgD0Q}A#4EJ^|yN~NZr>=x? z{eBNrCu8u|tG4GN%MvStYHEh}jo%!d?kQ0lPeM&|0U)2n(^jfoSb~mboIAUXc(6PJ zWj_{Psw^W|NGxZW4V-lQweE^($H*WDOtJ1_bsedoLG?gZ($aWq#+rewPGkgv^tba;vjz^W(0DcQ)-ONAV>DoU`P) zW$K3SU7;o%ZI=nVjIPLA?P+{Ruw|Xh?|L34|91lIfp<*Sfqx>y+^e{o zuB~l${8mfB%irQLOh&@p~`&hTuX+no6TDyPoF8O<`H$E&T33?i=^!RU__-OJG z)#LtP4c80PjukVe26@cNr)Cd&tNGcBiOce~`)8tX7f*>Z(wY%R+=XQEOP!Cz-XZZM zf~;V4Y(Du}tA}WA%l6j3-;La`{TL4DGF-R4Wm*|NhU3U1CyW^+-Oo=})!j<9JGa19 z7EKjWhZ*r~30j$w(qLhv&#O#|lhzORQ{dDFM+8}R!a0k9ndE(7f;lD z@%^N})4;xH=8VEgm7;Y| z$Y{o!FmqUe6zG3FnOl+#B*h7ZAHNtvzL+~24Rj2Mp>jFKN$*)bC+dLI8nm>xc zY6XCf;@DQgY$+iJY;&I6Ygb8)QaGNg2_f&opQ&u8sbE*oiHrHr&X^t@BsVtiZ^JQ4 zwxdJ~?}_CQhJ7)R!FD;QJ?Axn3D`R))pq`2%!g9O!f{*Qp!&rr>y*aXslADg$wBX+ zci8)!1A5-I$T2**f4n)Rh8)aVW!hH019`IhS; zqsMUn_QWNlfw78FAm;>20o;$!su2zsSrT`lAmLuDYZ)WHgfTl z6p#bjQ;=7_HlY-^JsM!C$vBIpZO7~5fzN_Ctbbru5%)bHrAsa9kxb60a z;+XobrOvOnuH(MIk?pDXjh(OR*YgQmVlg%&s}cU8>kzl!|IG3myqhkMlT=%(Tm(fh zIZ=jvNe89k1yJMv8l)JtHj|)Y>{D`%%Zg^YW6lKt*vS_8^5B)B?X1lq33`ZU#^9K7 zgsupM!owSb#Bs(v{oY;+GNU3p+7?%ecvEW6kP%qAkQ1L;mGV$GdA~Kh0N3+jHTD_b z$+x^PwcL9eTEVG4opxyMx7SW%_N=OyR!F>(Ky{K;>-59WX4EOh(fxvoom4b7Su@VF zU1tiuq58knb>`H4Dk`XWnVxTV`GHKY4P#ikt*q=8K@KJ*9v*UfRz6;JKg=JNHEqR% zIldLSJkW|PgYDkTr`JtFY1{qvLn!yD#_ie)Lb(ZeglGkBXSKmhQbXTMrr4lX(AgYz z9kBVa=uWZ~c;|3X;@cCC7?ATLO5O-MeMjvnJYLkV&W%&(yxF~lHaru^Ai(HGkD$fy zZ6L--rlR<0Lc|G|T0uizg=SDX4?#gRO8>Y=L3y3ipE7~u?*^L8c;+QIX?rN1^BXq3 zqrG8j@8aV)?7{dp9dzTW?8(>3dDRtfp75&?J zx3Sd=fmBa96Zb7?7ZR8Mc%Y|M_86sJjZDvyJVuJsAx`$xClAD{41yxsGGRm?`Dw*y zDHL3!$kedjoTn!iET}+5|B;03fauyRlUr)^`oh$lLG4{5;C_z)Pn^<_cD}az$>gR30P^--HwG zxd_r9*-n!a+NV8fewQ4)b7y(z&d5s}6|YAAM!c8km~%9*pzPr~@hgt?S=uwxy^^dj z1wd8CMZ3-D?7QT{wWlrX&iLwk&3DfZ>wk4#v4^`DZt_(nuIhUR|W3t5yc7UX!C00YNRY_cL|72`pV?eG!edJb{gN_^@ z7dt)Wu5E4D-}y9Y7I3DSsi6rr^@M=QqjOvRe>pmsl@WC*ld0&Br)xgwg!QP-7^{`ueq zR=6U2aE))k3Yiyh!7M(ptMn}7Z05gQtq*C6Vzx*9@sPn4vgruhm!mnQdEY=D^M+C0 zFgSQP^_I2JJPrrRISP8~&^tY>dh)FCB5F)ynwE(a zRi4j3%Q=0QZ)-a5!8WM3~Wlv$n$jk&|Gv%}`djnXI ze}$@Mx5fdiOIaAA*?M(?57dUU9FM8Sk9V=nwaE&zwtsD2UEgePD!}~>7exwSl-*e~ zEAt!4g)&dr>1;0LX+uw?x_WVRf(H$yx0lQ67p|Nzvx5X~H2@95cbR)_OXa(%5Zr{b zde9rcW36ujBY9+sYd%i*>mG@(c6~EZ;Q4X%j?-Jf5MhK48G-$uZ2KB*PS1+|9J`UiY`sIkYk(@ViAL|(L$YQ3TRF=-8O za6|PW&!RK@2N_2F<3JlYZa=Su#XxT^RXUukCX?QyGhJVxt1o$tl4Vk3luw5@~X*AZu!bYU7Yj}ojrQr(7OI|3Hg*7_7$Kz#UsCU!(h0;!T$T0 z%WG;8!~^m?yzOW`}`Okj4 z(G}F^ydpY`BQwi8oQuXr=eVt8p9SpUnid8MMh(xA)Lt|>OOj2W-2?CNanFAs98?`M zM2v!`oYJA;nfJ#HSBCNR?}ZiI?9m=bDtORXi3Z_)ss)`fwcgVJVHGUpyy%QF(d-#) zLTH@1T7YlE0ywAhDyEr3e(G|RBi2KJMUiY48aKT*MA$Th_Nf$5vzL#D@lIL+k_mJnjU-A z!iRH4fNm}L=b$h>n$E%z`mx9-aa)mBLm@MW)*yk9-%!yCpEEV+ur_IAuN^gL?kH{a zgf1s)!H|lv&x$#OBMaW9mV`VGDhv1FtgNuh;d(f(3k;3h2@%pJXjk|6Yrf3Gv}cWl z*v-Zi5{4_^=VQZhOV4Yi`^!}`z?R*LJ>^k&SU;+hIzZhE_u@2>Jp+wMQyo8FFJ=?$#!3l^|C;2^4jEz|KgET9ShHv0q+8rhZa^j z6S&N=n@zWPxMRZ+S~m1VKw~<1;qxfUO~NM)tfq8+_CTl5$CEcq#vZEa?^JVPfo9`; zl5u1-v!+^LWN|jI6ki$^%VUSUTgE;fwe9tc<1OyE-eqF5O_LFWNZE>BT>suurFVul?snyFytY@7NHk?QiUzhj{bzIU ze3@7?Y)9LQ)+;3{D)1U4QHnc1;C-xsW{t6o>R|M7%XOof+ zn$?|$k(YxJid!e-daB?WE{5h=Jx}vY)iro$^1o(D1nxtPjSkZ}lSjfMLF0DOmu#m) z{GP;>1ClG!a;?ftFpNJit+Sg-+^}m3auZ`uo{yDi*bBZN+$M zS}40H!Zl;$r8ajF93ACKtrS8_#z5Q_V%`YMG7LjVp{5^2@b!`e0gSdHBJ2K3rF35K zDA)bq>3#j~pMFCJhfQ>364;q?R61)mM?%NQ4@rs|2w`=-TNqmzML$kx~)yoL2?xN6~(M+@%Z?H==uiWqLBw4gyP z&D&@z-J=TqV2sUwAO00PjDgvs_4V(A;${uS4=3N3wt{%zJeKVpwII1Ed~z!G-4{4V z{}`XxhUzSh`UyfiA)doNtgaQ^(V@yG_D$7U*%}u=tK-peM>!>b$;g`K>mG4|dzZG2?kw6yJA&t8I?r59jdsHsY zM@4fALHD%)?{4=#|4jy^d=}P?Ka}QkdE2z5U5j4oudR^ra|4x`@BNggtNJT>8vj%M zVQOV(eD>Y_;q^q`nOP$ufky~v%__A>fVOIt& zB&wIl5b7kr^7(E5K43Uv=$P!LXT$4pPA&uPkv@?3$*g|o67O^_+G+pgaQ5WNU^IAo zRi*^d8Nf2KZU)-%XuRf>zN|ujI^lmYeG_RIl8d2H<|qMUlv*$(qB394H`b1{a*QU8bF)AE^9H`Zu=o>YaH>`P!LO9sa#?Ar zqQxa}o53$91Xu_EO&aA(@`B_%KP|pd448?s(8|-5?wm&&Y*a{ z5WO-vJoV54mmFkYbq<9yvCrB8TU5;Dzstm^SipitjtSmiCUDbqPI)jg1e*fdn{6J& zh@d#j5E#TpMZM^ud+9Ob=A1j7Z$Fvj3v|3lf6?c5m6sz|P6p@^61;1J7)0oOe#84v zQV)pil}kZeAV1>hrY(&O7;(?k$US&44$EApVP(}qDTVZVKHIS7jQ(+ZIBt*Xf-`1B*L98@@ z+>xi7PenIgNmz}I9A|<*c>Ei28~_>Q7WtM;J0BNZ>e?tjI8s8|ZavKNT)w43a4L+r+YjyDgrlY=6J$m1cRWG*1&UiGbzX~GLmykHO z%hUL)DmK&UnD%TC!WxXJ!JNb|&J_VG3HrWbXYi<$gZ{4EJINgWau2=Go=Y09*<4b< z1gF^aW8tl#oQ1k!cnb-%j{dMK-3}V>!$yZzTNRIMxCG6qS*_f%F)RX*WGX zvaa35%|!y2T)cN+ytCeUGI_nrbRs|ux&GkX#;-@mbFviF8K>(CDun~xp*)*#0lxqWC(!R2MIQu}3SmnU~R84pGg3K3Dz|!6rW$n$(PlSf# ztemg-OIJd#>Znl+{;RAggSD9e?`Pkc^Ur*JJ8;Uk_s#q_&zb9G1(x?H}tZ63N1qOfe>VjA(oc0a9aoZq67wVl;VlnuP3bfc~-uk z$xs!eYw<^WwA(ldFBpxbL3hq_$kk>iaZb>A&W7=ZndL8h@5KnJ14i&3$hQuBBbYWM z>UF#*?RW)_@xwUpA`pz%t~R9FUi_yP9`?HR*H+K7>C^=yJ08xJrzr#Tw4=79>Wq8s z3>Pnq*qZ!pE09oi)}JG)&B{Ii%87QzeyF#ILQE&2&@Fs57+ol~OsVM^nnpCDMg8QX z1iseRNyOaAEhXIBd~sl)=0D1@*di)~dq*t*Y&8 z)e5TIAC|g1{7umaroh0kGUk5G9+ukSw4so!v#&R>q{zfr+w??o+HDj(r@uCmI*|A< z_Uq5U_1mz8<9E{gl;=%PQA6>L&Gk-C1=D2FhL_#!#%l0F}1u_ zZX40tle--u6{BiP_Mdqp3i}1v4*$tD8*+i`<+R4}oRQAf#GWse4V3Q|j<8~*uqGlM zD=OQH^Of+e*fHuySojZZzUVvdcDg^ob(j!6{Qy5R>{-eP=T5CR?N&ZV{qDgdXLKsI z4GTtq)*hkG-;k-*iuVHl=W}kX!`2Vvh9;g>;=e~!5CDmRjHv9AbYQ%O3uV#Gr3MsO znMVKkmGlAlD0^i2GCP>kj%`h(K<~U0`1x9n;=bq=09uBsPMf9B&6xb zde~pRNg1u7R1ky2QOW=X4xHZ?C~Jz$Q4~P6o@hD(aO|>AL$AMaMsANYTr>Dy6Zqz* zTV<}SworQpfCglzyFJP?5e4i&8+~3^oJ~E1#b3%(eiNR9BYkQVr_S8rp<~4`kiN<$UM4f1HNDkfd?&CRX;Uy6{VWI}zl#KaPh( zTP2ENv-iQkjK0UY9F$a2%Q(*pD7C0!e9KG!kO&aVqS#=qSEX)@J%!?pYa~#5bg?0T?!FEz+(sUBP3?+9T=Wdu;a%q=#EXS%{p|jMi(_Hpu7S{1)+{KHc8Z zociGlvoPFC>AEhG^e;O^fM+px1tB1Lf9awfLqw6w+ZHJ+Qx7#We9@->0h+K9ww&4y zFo-73)(X`%H7&mG>AoA=JY6R`_QXfvC+lEJ?iv1t6tGB^($vBvCSE+(S9L+f?lbVt z8|rPMn8L!wbQYimB6g(3vF-0gdZM~XHtW+JtX{lGR4btFP24*DQ9Y6HdRgzIA^MD; z#%RJ0BU>gL+YhH5*HG7#-z-!|rQIjn!d;R>2lE;6L25^W@q6EX?BqU=1WSDYE0xff z&I!nII_tgTKRcxdXy(H0%vNuHe)8ZAG?W8E;PP0x+UIQnE?v{r z#smDO?p_Y?Ol%kh%v}io9mnw)LV2`0hbZjl1B9jzUV&#&;*JhPlMd+v4fr`G?YyyH zXhpX(1GB`e{{=nh(MtA|`ns$vUWkXFdxk%Z+I`gWzG~fUN*nI~N8J6tp@80DH_b73 zRg5^Jm!{#3W&+@cJm%h}jcRO@R&Yj#r4A^$b-a5*IlMEY|A(wnn+{8zU zNC%9)2t4V!``Gma(iJgx+@0R5)tVTq5hyQ|eyYqCi9udl6)~H892$`@v7ym}BD70a z**qI7Tlxl@EvqiyYD(-wI^%GiurTisMGVAv++)TccH zzti}=P$KeN_&~ZEFFdo9-01d*MhR@6eqvgVepurs?04@Me|+);zDWMVLhU=0)@JKb zB$Rza%U$?TkfietVh+7fqR#b=on;1Ss&$UG%TS=p<*vG>@|b#W{I-`_E_Xa`x5baI z20H88t!SWt^`<}W%@fDEK>MVWwteb#@9S^T^@W0` zH6@1_SHHhl9xjkPjKF^&PAcPnoy8s7EVS*xFI#cF;WUTqt>J{6_aFul zZJlGsv3xM>|MaOJFhm4<`0jlE_CjQsS@Ot?NEE$Y!_XH$=%7eL(@*WFh zK7!Gy@{u-~S%Q85lO%&j`#`EK zPk{wt98gzf7UxbRgx7JnJlLYD+qLz^sWPp5`b$gwOG^p>SwI$E)h6 zbv@Y*0bH+|ZM#1^U+weUb9Cu?KZPDY%=B2{`n;>vtX&ZKaK0J1y6UQ}s<%;Q-(&LD z>>Bzl%uxzaWG!K&hUC8I%WCG%4F1Lo`3OWC;}f>v%<8vHH5Hu1CPqtPDvWste65*X zaQ7}hH#l-@R~ku_F1@RFukuU>f^XyEXUCX1bYK5W7ZtB(Gd}a3Ps$aGhiS8bMOOAa|46gX<~4n5_*Zf!3pr0`7{)0$6WDQTDl;Bt`#(l(2Mbn15r$M#C}k_fyy67){guChDzuC|QIgttv6FkWLP>^c1}6pO7Hb6F)4k?tx5Hpg?x zFdJGa@sB|-lKm0+Y+&rFQlwVj%m_lH34A=zGINs}B9zCeh#u$8x) zq67rxgSX))|A?u*h+>hJCpR-+772ri__1m|4iL*Sr2K1bwh%g{vvfV;Ykj~1b{YHi z7vo>{@6aHOfeguAN#K}zDXlW548Q1t+4u+{huQoB!o)je@7hzjufvlmEZc6vgL{B` zN(b+dPT%c0kFh9)e2+p{7j+k)2x{YhtT5_>l4TQpaUPN7r+0PKb<3<+L0 zRd#$&6LN2dyI0w3I{lg4g1}bj$EgrW_v3pjyGck^$Kw=s(*S6p435;pafU6kZTC|- zK+jFA!y~CXe_NK()qxU&^O#%bEYIcU9=?BM?Dme2=W)Lk0auuS2;K9H!2Xo4o;gS5 zux-`^Ll}9i0OXQNjbpGzH-Xar|D0~On;fw`;|=70v>qPaL*8`DN9UuV^$N(&#Z1P| z#4MI$R+}%bO|ftOtG@p+T@M*jx&RTn_Kyj94#6LaOyADWS(IZxhZ5)1+@z}j}S)=O?Qs7*La zbyzBgHItu-A;flYLC>9L{V&=u4jZ)$D7GqV(E3;ht%Ty{b)WxC(o#l8^kgw75^@4D zlsD@2A+>nEvooI^i#>z|{QbWzdeX@n3@H=s{t;bBu#;bS6T7EMbAy0+cw^}Bk*ThZ zjH&eq=%r9blV6FtsyfICqk$M1y8YVTguk=ZXdCGDpvCdA*{8Vj`ffwI9Gwl@+~v3! zzxQW+Db{hj4VsMA%PeU*^uVnw}!TMRC8TdDtP^&GFZ`N>{N;_Dty zd2yoj;(%q13WMSCUIyEv4eL!Zd(l%g{8E{apgaG)<@A(c!L69clB^pTpDe*M4h3Id z!+B5dzp_&WDcEbX{b!<)M4vtBCx^Xr5V=Z_`l=(mu^Fk8-SU@oM*>+BB zKP1bOf9VyNuvrxT?}JYjl=6Nh<2id&Jj>YUM_&WvmQpPopSaDK4JfFeSwYz-YyRm! zD=8r;7CxYdeQ0FiA_n`=s>5 zT}dZ}X*hJGoimo^$P3{8xO70As9YTN#T~5FGTa>Xzu51kUb{I~6nce|z&!@eu1NmJ z$*rBzEowxeZ8bc&NqbheL*hOyksW+5e{$wvGGZpGPGVMF=6)n7ttaJ`JZjzR;+!oj zl?r)=uZFPY@`y7$dXo-)AKgL(K7GPZqYjL5uOa0YO|UCP8>uzEN8L7^Nss~Ie^WcV z8sF4d9L-hNM$5WdcWg=|*U8e^(}Q=xYTax&72+LEL;yjh+A!XtWJIKC@&MSMZma`O zNvtD4|BQO4)}}9OSbaStM9Wj)3vht?K4ja;tgGclDYk9FV}oK0yHz0X5b6q>%u49z zU-pnsL8^vrvj_0qp2cgOa&Ar>{}}|v0Rv*|#`K>~-!h=G5b_NQHH0Pp^Cz677c6M> zCnv-1pol%(X76-RMW}aP947(bsQ;#M1e1ilhku9E%?DWkVPzXoM)gvPX@X1`oG#v z)P8@EbWz6CT=g&(2;hNjNIZ;@@tJ=O^nBm2wAj{AS?jtl;1j{Ot@FGF5?IeEEVX7~j)%O<^9G1LZ=VvBT<@l*fWLe?jJ(0ri)}!C z#qgfhO^4~C^4;auW3w;07-<&PXr#J3b0}94C|8Dkhb5chz)S(hW{WwMX9wO`85L8O zHCwhi-dEYK7u((5if~}PP&jkCE>FnS$!O|$eNT|p?umOrqwhK)=cId#5uS70yPjF; zdvo924*b?()asIwQvcF9j0|+J6sdYkM#}jEd@yrWy@!fQIf&RW=0LG+vw^|0QA`U& za)1R=gc)R>tsotA91zycz2Xd6mm_OG+2?tDG{nHQ=o>1#it@+09>YncyF0_AQtZx5 zy>@EQvI~Xz5S4xtzjAScDJAO|qGNH4{AX~^02M#ZKMpzt%HTeY+>dB7`6olrw>bp* z(y3~*CdnLQ3ZSJfgOfe6R?PIw^swNi5xmeolKriFx%GCJI;%cFDd8bxCr9zR7VmPA7Kdh{LPbe(reWL z#Y03;9AMHHFQq$39(5?)=wtXyZJQu<+q5Uuj9)cXh*&2e%YTZOvk4Jc{U`&cJnN3L zzjlesGL^mjs5SMcBZ`t@mTXSfo2q&Y0@grMy ze}hV@Iq+w7SFwUJA4!@Iwd$8_(mP<4`nX%LY>^INhOd~-wjmNn=5OLLA`B;MXtq{FlfTy&E;SJ(ui zb_s>#7~vPMF=EY1#*+opYiUMwhZJYKpmPp(I2>c8-SqWOP1<~&*L(>MYhU#)UUTRK zS8G!mp{>Y~b(<*TT;FRE2=koahxetyiZ)SYiJ)f^f;#VPZP=2Q(>a@zGJg`Txzh;@ zJ6+Mnouvg#mU+cYs8ZPBc313{>dy>}%#qu{4|qr$Bs*6>UUgVbO=;G!kll1Hf1Krf z=DUBWiLrY<@pF0gEZM`xIQ1-Cj_!Kq0_V+*ARbV3HY#Q{!VEcWTiAYb!K9IGo~Q1j zC#ELioDq5Ob_XGh(So7y5h!V4eoEyZfvk;2l11~V&Z+?t;X_7ogKXOC^S8xu8%;WG zrL@p+L-Jd~ItLm%;oN6B9u+N?0>!TzXbTl?4z)2|&vrIdk#Rt_KM-LfOL zl4Wx7zu%S#+^2Lir}(}8bI~e9_8{*yxSLBye&!YZ$RXws8zV1naEr8->D(>Py~Ngg#8y`xWRN`gIy!s zGv_uhySU+vBy=bB4ve1TD%RWa7#3=*BurZu&dk#cN{t0P3mmS!cP{LK&>9EQN$X(K z><8=w2j{)iXNNkUUFLR}8{9?Ba7OB?@zTa(wkZ|k4`Z0_{6-<~8WRaH8Xd|94fO=` zs@muq=?iN;JM`d%KGY;92zQ*>-kHPXU(ih9&Q9WwKflx~0EYV-$ZnfStA5T4>Z0{Vst7icUy3_k~=ulB{1X^-#X$IAEA_bfIxttGr>ynvC= z2+ZgU$v|2N5H(Rd|8Nm~M{tuA?7>1AZWVO{5n^QcJWn$sBKZh+X12p{IP!~Ijr&0~ z*A(AJ=(ohf@WnH>Yq@I4Pfqcub8x}6sy!%ble!|`dKhKwrd{;73~cY_F|5}4K}@GW z!WWF>h(CksN?rBVfKXj=!7KOMj8w%aR$$68KeNs~3$CQF$xUaH4K^;W)HAdC&o`Z< zxzHa7hw0q$d7m}?_x06Klm7WBbalJ+Pm!P0menCM) zMItT6$KQ+l(cgB^k%TVQ$>4=|&SnFPjg{N)KChG6goyzr2zvIB>XE3^r2sCcOrZCG zjo8WNI*W@f!}Iy(MS4qB*Lw(0;@}`o`itST`WzV58->eLZV^o$%vSv`7&8GA%Xj|n zo$Fz*F*`m+N@+HoKs-}L)CaI+zLY}YX))ZvVi4wGwe5S`c_IV%f85W*4|Q`w{c(Ee z)kSPtT+9arWq*>y$kjBE>i#Zu?M@PX_cMpbfC{AzvJV8C1kI@kK-ht&!0!o_?VzFv zvltV%J4^5Id>eU3FsRi|o-t73Sju$NmcN!9yu3UQ+8SKrV6%F@gSW3_D%NUMJ{i!A zZYn%zPvN8;7z~!-7*9E5!$I*bqzyzM-oOu*2Gu2T>JjPLMC`e!e|>toHu?134)NIH zwVNG9KRt~Ji$$G<7<3V--RYzl-Wpd^aZhr4eGof3+#zY?!&(jh0d1k5B-FHj*hk{_ zOzp(`ObG_fOKIdoa}boau++6#UsTbmOdAh?rkt-&3lB)<&!L3bI-og2s$y_8UiB`$ zx#V8HixlHFnmfjh>eybZaF{F8G8`Vxfz+KRS=6q4Z261LSWLOC!eoXLXP> z!B3rhKyVMAi54QdUvg+-v;l6p(rZ{M>1{I$G2?LPJ`k4E$}e@saeh!m;fg0 zeQP$y^6C}#n{|CuHHox7a+@guy$E|WXPtuPc`5g_m5=ftzD5r%O$XVjb^r7F%w-OSz zUuGXaGtXJT=V>BoS>VqEOgN}}$ zq>gUnz-2k$=bi#SSAtN5^C8YDuGY76z{aGJ10x5nodcfoR=Pd6ADE-YbKwUynVnsu z{{Vq+Ti^%;2;q9Pj{>G+1_h6|BL}XD1Ff`5V3Es^<&aR)a;}>`P+q@9M$iAaCx>%s zj*ripjaR(WK+Ee}Y)CrQT>g>X@!r+(dQYA_(FTuw8Fk}rz(wsWTwIFd_f(1skBfCf zghdc@TCH>030S-S{5eu`ew;qB)Q@GQ=cH^j5FX~fn5;1J+JGcOEr#7S?e1OY*s+cE zW>eS3#zwQIg>)L6&a`QQO%OgdQE$a!oKiM#il7W;(JfsrhYb)!sy?Pf-c09Kn3)oh z{koq6I41q*IH0yKZ*rrp){{Ik)DjmJ4hcf8krl333r4CWQ-c^P#O0N+bZtSp$H!4P zeqmP+TpmB!Yqqr>KhQ%LbeXca7MD4LH}axeDdQfO6`%Jh#e< z%eDSols;M)|6sXHctl81wNL=z{dc%h|+6-arG7_%{%YhZ~no5`tLV)?`+5z zqbH@>4!CAlR18Y*Ud2$V${W` zXkYEQr~|uI0UL^XgE#Wvw!4^u5#s4Nu)4Zl+AnsEq73jI!yW$K{*J>oD!NyuEC!Ug zmb43WOFj6_+xPWa|705PbN~QA07*naRI6%do#Cq;y?nF{A7k&fj(B+R;Gxd+-O&?% zJ-9eyCny4=r+nHOOfU?XL`kRoFo1GIjbtX}3wokl#arf>$QjD8-H)}}^ru{QXS=6u{e_nU z?g_&`{kkj+wCfvsbR^x{+S=3y(YADs?kh6v-feE)-12!zd^8Q-@dm(>`WlXtK`-47 z?94E)H8`__*YrmnTyCjf(42Me>NJK%4qToCmy@4a8swaH0);BFA2knu#-lT%8#yp? z;JP`0p2k9RUdf#%4~FSBLkH1DT{^(rH^y%If(n!7AUXf_9KjfYtY91$qklL4U%KcK zaOA)<;ehqWLs`gX$|y!oWH?8;x-d(!4WXn9h`F=}PCe4+R={Ukhn{I3h%rcuG;f^K ziquCf>^#|Tc6RrgC;LY>@M1_}lgPs2db6P8yqKdNvd+_o$N46WH*J7lN}RiW{qbfg z;JV%pEM}>eM2f`4{IZ0@Gpz(;{;QqAq8&Kw$2j*BssXy~%|n{s9;&WKle1<=uY@nk zAicEsMDu1H<)C@*8+WzALGxwa6y|##EODUHYjoz``s1V3yozo^uMNk{k5#Uh_l0*+ z{ET10WrcdFvs$JHFy8#wIUvC})rELi8Wdnek-|x4@KZ*B&^ix+V~uBlDncbM4YWLT zS&|H+v+UO0*W1zGXwA(L3Os~~<4|N@;@DFwjC%>oI8?;iPMIa+rUPZNLM0s?MIt1e z9`cwfe(cC2v#k09Y-3U}9mk@6Vvh$wGB)o|n%i2B-qJes#+qyo>L+;9oi($JV9tlZ zm|JM#{Z!Mn|W z^dJ9KbNBAL;t#}vMHy)}Y%sgCcGrVUN73^PWlPm%be)1#uMB=n7JN@#)K(aCCwj8W zxl3_ok#Nbn)`{$V@3M};u*@j5^9xvs<0k;!PEnDFQph0}i+ zfid3uV{Lvwv8?lZSDRb6H6Joe&4@q>my#}U-lbMLZQ?n5XO*Xi^8K2*1SQY(ael!f$hau0 z_@%fyZYUF0Aj6R&Q8jSMNDOi%ta|7m<=N2LyUWdg_s{<4=5PPs-)Yd2!s$S1&MT#S z4>Aa$E}6UZt1Y{FvS{P;iRjal(ijvq=;)Pej5hc0Z|ODaTg`v)_y4lFcW*;Djud~a z0cW{6(w6(1Telj{LEYHA(Gm5mLn1k6QuckF@> zl||pU)VAt`dC(y-C~1_VXL3qIm(d+|`5tH|z>_DtGWhQJ+R*{RP2t$=!K!2x{*r27PhvcNnA#vwYu5 zcuS0+Bg~``&>=hqSilXq0q}VR<~_90gGSf?I-p1 zdRBgyqQNzB5W>~3jAtD2q;_~BlzB-X-N=FK}*V0B9v=GO!jA?LV@ zx?g5zu6$AK-Mf5qVrz3vI}C3$8~VWTvgXdbV!q@zi&Y|v7Quqoo434{=z4`L%Q0NgDyug zJk}2Tea^oYo@JepjsCKCiXFcGXqt47jfEVQ$~J45GSn>?$muN zv~)1-bfl=8ti-DJp zhzhB*L3yo&u7(MN*o^8k(#hk`HF3c5qJ~JhNg=XdI_4C%K1l&#*^y+g6v185E6E(& zU}1Hqoq`)(Xts5h2hNP^P*Cx&Kqw*J9bab)|&tOZ-3kTkAL&eo9!o@ zKe8(2(D|j(tQho=NK{h>D^yPfGal(#r;cdQy+jqEUeE`P?(3Z0U;o)Jnm_%sPjpt$ zf_4IL>j{YX#K(@bvy#`VkG11*byZJAK-+SV@UwM8-Knv|8R%v(uXiRB#vq4rmoKM6 z9xcE{+rZ0qV5Sk}lApdQKg87?Pn|Y~pA84#FNRZ`+eV!$XXp^_&SH)9C{Z$u(6_D& z=j2W(@bi@&SE>Oc=Pc6OfF2#n$PKm*w!ubi+e zT#qApm5iOFF|ZU&2&SFNYL&MtS82WzJ@`)}XH+FGiV9<{L;T1gzw)x65@#=S>a`ml zRxywQ>$ehgR@kOKp2qHJbp3{Q7TnRU+*`M9`3y0>7R-eK*pp4;&pLS8>v+l!9n!5| z?@4{?sOG6{?!pZkVt|H55ANb!?C_4kK8?KKB|T*a_|c6VxC#e~*j8DP%ZuC)W*W;7 z1LID(^b=x;E8|Ch99AXG8W=vQthYRy%X88DY$|frz=WcK@Bq zKa$aBPjl-X?bLmu^K|#L8<3+KWCHbWUQIY{Br?3#49vIr9*zQKO%Ut5C^NK$*(h`C zm|u%3F91RtO~2XIY3FbrP8q|v3J$6m+ZIZ zo!^?%d5NsUG3xTIo7+0#41@2M-i~8)6);+aJFky(fIjy(ln`|$Wd8d$;iJg^8|N&QKE#rK*TDpG(=QT}M%YW<7+#PaYc z^9PjHpf*yex1p}40Uc|a71^_HES)s3-qCkq?%vYd_*w&NxBQ}XkT0p3AOG~zug@kj zdhsM_XK%MT6A(Li7p0w8sr`h?C3O_SJ9iH9VeIH$3w z;p)0})IK_B{@H*3zcj!3?H^=#l87ElV0~yd^nn-Ul1y6v*bS$9ZChW}XmWO{;~bXH znvZ_|LGzb?`D>lK`=;a0IG|UG5NeI(i~&y++F%1xA!}<^2)u#^FY5Y`HRHe=t&^PV zBNi7#4H=xti5P?Unkth8jJ$q=tCW1T0N|Rx@MUx_iUYlt7!XmX)k(v6-Pdi{Q_?zN zPPphthXgoXjxS+pI7Z{#$s2~BgD6X z);nz%b%erA-?Q_Uow$7bft|UWuT9bH*hS|>0c6O*Z^Cf}d6{N_UV6mT>2;XYVeJc! z)*HgN302;UaMXFm@XN%3)R(MtPq&a^=^`*i%`A>QAROk){ImSjP15Roj&C!BjAnZJ zLC+|^Et|%`$boC(fM$w}uT z*Y$vKrP}}{T2!)D&pK-LQ0H); zHTU$v?>An#r{hwj4@Y}4Z*jDP*2{D)e6bO2Vhb{_7+~<#@h={Xqwkne;*VBnew-DX z78=@AT_YWI*##xwvV%BL4Ef z!$HOMQg%;h%~$Fvp29E3OQAjC6&>a$+yC{{NQN#9XnY6{SgOoH+YDjt0A>vFlay1N z(Y;6xWJ@Fs*&^u^UxyP8pS-$;C=6249Oh?m-=b^-g2}LaWJ^jf(Q`bq!~+}7lU>z0 zS!a5%LE0N{-q!@GJ2oI?6+_9fu7Z#uzm{F(S6AYK zg4&@Yo`lI~2kfF~>#JzwAq z+`>CLf|l7CS5tPCaK-DE@0lOmwHw}N8u5uI<3@kvK*xc4+~{H@HRuo#l4%cVB@vyq z{7e6E=wL|SY&nZ#e#oPA{aYdl%Ta<=#&`UX8rVYDfD2esM>ld{fx^Y65YqV6quOD(|2IVvQwBGet1;UiRXbU zWxGG1uK`ZDSTiVKc*^#CfWATtX6RZHUf_78v`-yaM>lfddN_cJAhQx_xmb&ZK5!0h z7?8qXD*(++Ij@slzkGCQUq+#?9_uJHO*4=5eT?{+d699!;ugC>0?gRUrdA# zw%K-35l_C+y<8kv_7R4xH**}3fmhpiH6lq~uxY`M@^A%Mt$X)$hV8fdc-ps*cbj8< zr0_^@uujh6V`mHcmXmkbD_4wl$TE5>?PYB99Z0zxYhOPD=Yj`ugIj^r`Uh@fZL=!1 zh%`QW<-SV&0+gJp-#8V$oYVVoXJ7r*gy7Z`Rqx`D~0 zU(N8ukq%t~rgWszf@cg8M0K=nXNxeRX~osyoCMODA8IEq_<#E0+s)5({q5iWPI4$^ zl@K56?A#*_4ivSnS3Q=5k0+#j80p^K8_g%5{8ZP6&5f-U8B6t%w&tkWkP(Z6vrqJN zCI%c7RW39|BtugutmB`-kLyg`^%wOFpD<~4iNx`T?qSr$V8(^97vmh0ZFmh#C_Y%j zl`52*XF&Lf;yZ9atr`s^92vmR)=Ga?5eYv`LsBx0Ft^3`O@`(7(C3YOl%>@};<@J^ zy(I}5(`#ju$E|*1?1>{148K(EW@(sV)yZx1~c+|k?C0IWr$bb#X?u1_A(zk zdfIqFfG=F-2a#185OsR#R~(&qNzX6|xWT=dMttHTJi3tsm*W6>lCsNDKIjb2dTp6f zx}x~VU?*dJSz~Om0h#yNlt1)Vx>fWQXzL<~di@V2$r-MXGZMz%kpm+Ko<9c||MW_x z3PMj8F`gEEkI^O!RMA&ho4sfiv`O>KQXg<(hKw%fxJzOhY!CH7m-#t{Ub+}^f}6Pl z_xl>3{oqyOtRJ=-74!2L{~5c>(xP-1U?_BH-dp!hN*LY9fotS|WRz*K1UVmcBAc2~ zT2{}r_GAa(qKrUX?C{&yhK6l@E?q>hYM>m4i&=-uXZ!9mabU;gcluSoSk+N zhwf4Sd^am^LI-wAczQQK@2nv|v_DGY`xz#kdgcRVh52Kh&D7aPEE=4fGi?Ytm7({b zS=rV1aAbYj)_0$7XsymMYTntaO&v7KMD~DF^*yV)=j>wE$<%X626lf~8Lo7ysshoyVBn@xQf?nE8dGOr$Rh6NoNMlX&!v@ zL}?4|{MU7^=0v-EmlqG4O?@Qk%{Sj}KKS6h=7aa&RJvZ_Mo~}prRXQkng$FHCK^bV zm)5e#)<-S5(siMXxw`MgG1<&J*Sf85K54{<1>UjCLls?z;%`od-BDnWQb!}Ep^9?- zE}(0}J25DKMiKGSX4)#MEN)YZSr_=k?|41_y(ZeoV z!s&uW51dkfHSNX^gKp5skqww`aZJva*`e>c)_oAEp=-bkvXnu-$O}XluH$;d1XxR8 zotE_jgs^aAI~U$}_$wHKI2T#ti|FxppoJY zpS5@AvB{!bWLUC{aVOu}0Z*&zRnC;$T63!8F*tHyfb#)U7nwI|$>w#N*K_J0 z;_b|M&D8yZpmV;-{F3z_eFU2e&~=7w`WyxAmiP{a?)|4o3^vi%FxEFZT5U`B%CB+u zO!HY4UJSzV(b*G^zn~I^GACf}?T5iiV+}F7kpnN110G8y@5rSTMx-GBY%J2P-XJ^B zCW5`)1ATl6X?DvO0hQF9zA z;G7LXbl{quJ_l(Po%zzQl6t|K;yOXpm-;eah(1HUK)PeJ+N|ohHFYZ9waX4onF!?cAj$m*{Iz+!#Y<|sdGn@B zAN?N&2hM9pWXv)k84TNsY(UaWjI=UTX|w8z@A<$X=VCw9Zu=*@`u2>5I(FhOudnNf z73nJZby*9F99y@FoRJX2ROm^_c1U?@V2_(#2S$2mLoc9i{Fwh2`rVXRxa2^|uE zvd~{?|Dvi&AGF||ybpBbA`fF<(UA=sYg^4S+uiAumUVW+lD5Bx@kxrqx?P#N3d|=0 z$kDwh4qU!nW{nfhO*1QiGFhQ4O)MW{=%Q2R=nf`t3zC&nx|*HesS2m^X_ZSAN|o!nt%Df|Ep$69sRw#8#=pZ zwYhtDt9k$ZcbnHinPx+DqabZ&(gs13Ytb zj?phC2U2fpovJwz@$5FjG44v9tOm$q7-3joVgRxz1Llb*fs{QS;2wqEIVvGzAVM2` zER)7ol-9fYl)D?=7;pU#($S3^7&&lF9Pk+IvdV)@Yq>O*@mO>71sha2&J06{=GZb) zO*GHu+YW5n@R|Bb<27^QIU+0`=Bjs4UqE+&zB9h^HYaChGM~oh*fw7Zvv^)+v8+WV z$3HE~Aj3md^7-vK8IWUDkbO(`A3>{@=-0%tv6ztqLk>t@HJI^$g9jpK>_XRWKhEpa z=05ElZJNh=jeA$$rP$_U#WF^sON&bzHlkn{Vs|NX=x&_m9$B{rDIWdA5UChNhi-)~ zbgN<%uG5c>%D@r0GPZ(KGV}HBL*5BjbTM$`if({ zvA~C}=u`MW9jlL=m(&%Yf9%?%P8q{LBo5>}cs9-Ym>)ZIWmCbfB30BBSMy!zF&|1h zJy~iV?d&$&Iu_)y^;ct@j$&BQ21RuD*w)eInB!7_WCmQ!dyySB4q1*WeKs9s9*zE1 zBHxl2TEZ`>=|^&;wV)2n!VwUeKd@wB#v%Hkjj{U-JaH23|ojp&g=YyNl!fKCrsQ+^D@8a06txY znU@fsq5xlmo+l0X_G8nav8)buJdJ40#hRUNJuHX|n@iJ|c5aE-wnDzG(f@ zijHWoTJwYP6b#2bLq1|>j^bsY#H zT*h9EGO>OXKIR)yjK^ni^P%L?jU0H99FU}1Z`jSwaSOW#$IZ50;ojA83=bY|+u*Br zy`^4Ss|kj2k2Rg`CLC{+4jr_#OEIiBsWZ}43x2FmJ-#{*n$eE1ieWx(6i%J})0GEy z*8aKvpACObEbC__r!A+3tZ_2W4wrsHGQU^;qSR4EQx)|Pm_J6RxdZ(PusJV}qa9T` z^9&_mLx5$NeBG-l9y8sYn>VzZcSUx9^=4Cj4R89wwKxw|FtQoAe@T)?|E1x8`P=q|rw*=x*pN6n~LiTjf!{RT-eHKxl6%i*6weP0;<%9M|xNP8+0(obzclUO$QpDiaQIi-rUw2u? zTqb&lC%aNW4FcLNaCmgq+}wJl`Q{Ig)uHQr9!(q<7j=mJvCiS;%YlO7Oe7p1TAS#Q zX}xT&ciTxj<1+@90TW7T=(=aTOlUS zu#HY647z&K!mizFvF#_jjCh(fpiA%_3~BIc7xGrHq;JrjIGS2;jqb&8AloL}ApN8! z)A4n+J8m<*YCnTk_ioq3CqFygw!Ohu@ETpha${tkJY`9ptV+&28w(>)D{Bc@`J`o^ z5Psw(%*8(@2}Jlo5lmWFLJ&OG???W1#Y4RB@Rn%dCxF zNyD^X^K3e`iwS;q_k@!7nU=WHPw1dK?uKa{e-e81UtSI%+vmADozcL1S+pa@%N}KA zykR$zG^y1W>x^RX!==xHGZtScBD%+eebg+*BF&VA&ks$B%ZqW!bfR-S%pBdwfsq5x zg9Ej`C;p7{Ty}ZgI}N=%SG#mEJ-^;)&)Bm`#|IV#M+XSJ_w~-96Ic zmp8~T;Kuk#-@&*X4_y7RBWXC(49e~15Yb1FPG3O@%L3Y1U2Ja27;|S!XKHHK-I?CV zi*F;V4CT+Un!3=R@PX8^|Hzgd{p;ocZ;+xN9LI1dW!aT==#h?Nz`(nw-RatS#8VIn ztIqM%E>zZVNdA)aXN6tzl5b?+GAx0%Cd5sVYsKYQNlugtKc&8%(>u~>ojznJeJ96{ z@#sfuXs|t=Od?kD_~jXFP?CQPBPA=j#6f-CwiTFmSNPR(};*APwhg_iy{s6NtwyzXs_diZwON(n+gko z^vn-W5)(S4hbe1%%DS<()-3#&pKhP=6>|{rk{Th=!_K^QXQ`E~P(PD6{8i5RZ)+BPANAg(c%xMX=fo1PB1pbnP<^1KI>S#2|jCL zL3S+Uro*0o!kO3B_@Kaa_J|37XZe}$W%7q@*JID67?E;0FXz1YK#q3w`Jec*aPlV( z`2zzlGBY!Ojx0_GR|VIm4YC4OmqoI4veVh1qZ`1aZ`SLOqYlo9+P)y;LuN&B4`)|m zta7WA(buCF8X>h9q)s=!?8OEM@0R7=J~R(#W?Uy;PFmE|OtW02PH62mO<(6EPiJ zp|k@G=yG4`0vSvsC#xIaHbjIR` zjHA~WVCfHHe2g#{Ph{MAtPjWR9UV7&d;8XX-V){`O7kI=+8;=rl=^e4Qo zn$CTOQvi)QD(C7FADcU3JSI1B0WTa1QyRt@j4mr0lh@Q=;J=~|zVN~0P3`hs<>8U~ z3XX5U5#|At^OhLs;v%(k8IF{GY8ThR&kA*=%t{^OuAc+hs>`7hbrhT`1EodZ2}= z>Rdy*>a+|~2OiqsyUt4Bu6yXK6p=`kqxKkLW3Ir?$we*Bc>xdjC{KL>^9uR}aMM@F zfEVG2XQwY8W4m?hrXM8T(6@K=uDMBqj@&67Y^2{xYG?Z$A7`ge$M$pd@1~)D+%dFv z-(8g-fdMRp5?|-1T-CbNrWT#!E$Cx?XnR{9Py6QKt_`~fCyafe!{{#O$aAD01fOV} z04gWl}|VNwab)pTfCOiesp^mxr`G;)}=P_5&_;M zkX}$XU67Xcvs%O0YFMjjw*@|AX-#s|c)88X+cmDdD2U;W?=|fg;YEsYc5J=GF zN|ymylY6u>zS2xmz(faDm;=Fu11NS(5|k~uV$5X%GGG;W=p4XnaQmfZS zN-s|)TbWU3Psi`3rw|-6;y>RIL7;LjK=yU*2Sf{ku~xggJc}tFhLth@Et?A{nw2;q&rY!%exGn>qxLbl1$hgbouk(%JX%2L~ zK&AzEYu-k92x&Mcl^j;ggu<^dDVT4fL^-5Nb1{wvnCCY=y%!+k0%I6w+17I-;CP+- zltm5`P{Dd90{W=S=VmIB1rX!Qfs8nO!TV4?U$zG?J9UqAyir}#psf%TH(;ItQy>SR z+`3LeN|>E8)Q{at?0DeqE_TqYt?DdJ8E`hVg9bxRyvj}9lVg`byo}O}^>VC# z8GSjIK8|-1ka)>%1pSy-#G9XGmFSO<(&w5ofg7)S(4269I3gn-kRsk-q}gSw=Do6X z!7=pGaiA|9UG;0J$Z+}rg=8%mSiaNik3NtOR3?7Srk~wDWGgxqWl9+2R-nZOWi)SR(E8 zP-ZqUL-#%hmHtn9j|rIjWu40gy_9*Tx>Ezz5xnVks-0K@m7Au!qn8>em%QLZ@IXkN z&1;Gdcnn=52WS}$9j(h?>B5n;k`_Mj*^2nYo=5;Zrbs?C!g{Q=Od=n;ETagC;WV_k zQ1WQU?&(tV)#Hf`Lc4o=hDSz1ij|XHe=b^bjtnZTcHD*h7|2OO7$CxRFeSoXre@qU z)O1Y3cDRRFI*7}JW|eR`jMKHv@}^VzrR1Iasd7^^Q@S2{4ldph;Ha4R)&^LaYsBWU zW%UxT-&LQ&5e_=DcLj@``h*60@U*14teu>`dj&^6vP`XTN#y?W1N}4`?(!7K|i=u~Qw1&)ZdA>#s?I*1UvO!J5)K zOpUT;gu?|y#t-2Ws`C@Fi|L0F!$olYT-{xvN4!f%3_65c_^&=cIOFx6?I$}vu$NBl z(c^7RBKDfCn>RJUE_(vbpbEp2@heO^)NdXf^3}F5;-L(%#INC4DNnsXNCm@((I_o> zP^MEg1dSDwhESHQYIgJ{6jq~fW_hPl5sFFzH@fTP00t@?ijpo{gShA<%fO2w(>bf% z{lr0CD`$AQO$D3zz|#vC+{7`lvoBd7dVwuOl|#PL)!~q@NU6hFQXL0g?k#`92OeLN zStb*tVZ=R_f23ZA^W(Yas_{@-O+%DE{yr-XL|-tCt%%EX!pxXXUexLV;V4Ui@B8J{ z*d-5oa;RQ$3iGUXAIb*hRpMHeUC_CxBJWcr5CNf37j=l=n!XIDUyzjgNqm(P+9PL4 z9lenQKNt?A><)lLqd-_Jrjg($l>v#j137*AHb`eIbOtr zKczYo8JC)4&9}}pA*C!9lgHXUw5wgXeD(K0Uzy(5jFmYOMqoA;Vem=VcpGF`^Q+yr z)i2rFaa?tY@jDh`}pv%EUFEQ7H7QO)(@d`<0?DDype ziX%QQ;OK)q7cd_qtAf!ZDNQ4T_M2FVHoukMA0R2z5+`JP3p$6P(!;S>jAk{oko zqssEoGfqZi(XK_hHgK%#AwyEisgn_D`<;ie2T>&=ngrNhWg-==;6HfS>l$4Gdt ztvDN9)Hzz8#l)quet@CwW7FD=G*lxbC))~| zA||O*ii7xEj7+B(>*Rxr-R1}q;t&rF^|3TP42@$+7-vJjcv$*)XQz3%J82#rEH?Yc z!Xr7$%||KUwf;N{y~%ove#e2D#~GXa=e|zQc;dL0*!_RBt8>2_ozc6|+`WCXxvPgr z>#OQN^l|2s$zgMRbZ8sHDj(yL@pq!Pn-CB-HSz)4I5v@aghj`F3bR3$^6L>Bde}qrmw_%rKIe3hTW-C?6sqwkt!RP4O zD6eleX$Jb)gD1_C!&AS(g03^-_?%ro&`Ekij!cKg3b%H-y@<}))PEmiQ$L_B!wdiU z|N5J=!$Tb?zQ1pVFX|jq&f-1LIZn2etHX>}^msm|C^ZBV_7x4l?C!X8d&|DRXy_*^ zm}{A|)5J1*VSyJ@F$NPy8c$>}_Cf>;pxD(BjE*rmLD(;m?cT~H?RmY9t=gEOS|1VpTbG3_rS-C<2`prvR zI0h(o;blz9RNek{m|O{ikAB3n$%2sdHdxn5vAXquNP5z21tUk7tIeJP!OTmI`U6;( zl^I8WPl@oRnKL!Rh(zS5jHrQSB!^2#*x zD2@$cuH&!V3j+%a#*RIG(B(iA(_I;F4me(c-MJdlczDQ63K;zMVq8RDJw|nOL)9#o z{mra2;<78r^yC|u2~#iTYK(F*XA2*y;2y8IK@oF1=7T)2-O}0joWse-QC2yCQ^zIo zswKxJEog^sJ0H}J8)^xS@XN2jGC}8|KlLWg*b6ZMEt*LnXV3^#x~xyuBjbmD<^ad& zUS<@el89SAPt?tpFp*f&q^fhz9lI!M?URZ2Gc2b@lr}Qx2;_JruL8!AL0}=`z8lq0tD*<_p z#uHN+br)pQIMeIe2l}?lj?Sju-r3WJwtb(sJ6TxO3;vQd*)zCstnH9*k9|>;@CI$= zcJ!Vj2fDrmeU~)M;XVBeZvn7lm$}J`+Mjd3Z*Ohr+SIWy%YLAQ@sPR4ndWNC>QiXf zc*u+d1%Attnwb8@GS(V+i-jYb-+;*C=z>v&A!dg()JhxNna!gb9(|=P6z4gn?193Q z?Tz}vefyddF32G7kEpRBRl9W`>!Ig^9eqTU4G@|%Ge?e(sOb$4$qfBS_9clEn%$4c z4>z02lK6x2YQ0Iq7yh&V_WzK*HJC^b2{U07ixQ+5#>5|t5fe2?^QvMPban3A!M-N( zI%`!2`mX6I$%Yhcb7MWesH*!VCNh#{kCW6%r*W)SXxLg5&Qt-FWKCVmOSv`gQ)0!6J*20pfAQ zpR$0S!_1taj#-xqEHOFD(gh@>$C#TWE^>{%c{e5od-pZx6gnB?yD+1 zDSK6vf?dn@($&DeC%KnE?u_X2b|KQ~kMyGnLrTs?Z9S9=>xYomx?`Ni4)UNO%kBET zjioLwE_Mu!9Qa{ypwkJ_Yqd~Jrv$x9#KexM1R%z$ zp1YuahGpK_1&UrWU9u4FL{<6AkcA`0H?2%sSS>-9mwaay#Ywx#1oj^ZsgCl(yLcEl zVuO+4d`WBumPOdj>AvY#+ooQ;KwMVmdw{91&ohQI@bcxd6{%4_8Xsh+R(z5Kc;fV@G6&w;-_hT?|s*0`f^F(w@Y?j>pmpQ zx5_v4323Wt<#R0d$h9=?aK7k*(2J)}m^1ERIK}s-pEs8NjUN_TQ*HmnX1iQ!hHQw5U9SW{uq13UgOQOOS$18u|uNetD&J8 z3x{z*wT0tDD2;quJ9`T@!mulb!_z*TE#AF{rf_TG7H;Y3Rs*vEf25B#-tm4pceOsMIqvZ*MpV4kv5;K!HGBX=Aif4H!G zi%TmldF{@~Gw>(xEqB_-)?w8hC+fBSiP&%v|E{|2`rdjB7y-Kq!_63x=;iB97RVJL z`%bI-+QBuz)Xo^jH+QY+0y8^XvNX6ES7q;xP8P4>Z_7t`1*?|D`c$Fus;-IeC=&QAelBy587a3P>N-9TMdzX*3BNRT_!4Dt zo%a9qewx#JOU7;>ZAi1aO5RLbyu6>rnLE>)H3hHbj%{5QSaIW{$xOJcsUqgTGXx$N z1eUly3^dd6=Dsg!$`bj_TQ&og(kE%E(r_PwE2=AMCD%abD>+EwaFVuY1;oVBtzs%^ z-9~-JAGcR~y8S7$O|5h<`Kj2|{enuGvhY>yF{ptYgD6xt47Q-_%}C{VWGsX4wn`sb z{7`7V^w9g&cDK1v;a{-=Cd$y+^xX1mAig>ceG7>wg7x#FV%x+yQDj$M1fpsDaVPu{ruaQ(&*ikoS?fP*%U@h|lk1f~S_Cky8 zNm}9QPr0mu^G0LB-7-fkt6UFlymbBsEg!J*^TYFl#ZNDE-N1Pr9A2f8H{N(N$AbrH zOrcVavLg2hi@?&-4Yr~0r!nTJ`KxcMrScW;N-0pO=f7VT0wQo>P5rg@>Y=e6JUbrv zhO1%uR{~In;35F=8sCUdDup(kH=@Hh!eUp&?k{hkE0nx9H@a$I%)l|eFaj;abi%20#~bEbwet4RrJ1m_Jl** z_iz*AjH_fkxrYnVS#YMD(kWC;*4;jPsUUnMxwsbt#kbs9e`WbD|4NefLtrox@e&pV zspTU#CaPaJZxp=rTy!aP8wF}Kr);TZ{U!@ESIEf9&?$Ke)|I`2SUlOmvN&sCVP)FDX$Zkj1S4q26 z5R`7o6UUPY2zZ#b!h7w`JC9JWgZ*c0%W(@|TmP0rWd?E5r&}m5o$r-$ zvT~~hsBfvX32aDRNR`3AK56X4=_k(je-s2Hdhui!!@-*%PMTx<4gI`{m3J%vc$V&i zS3^D%T1NM)cxIaEb1Qn2miNBvU&l?$^uB*7i$p#BOyn{B%O_6J zETP)%IF%-pbiJJTcB<*M$E|7H!}lZKXuj14rS%tAykn>eDur+lf8s52qZWF~a$4ys z`)wlwUZ0=RKD69g?ZK;*|DLeJ>lqe%TJNdY(ICJx9%Q!Jku%7F;i-OWezv+HKmCHJ zx`!T_#`k@(RS zB9mF4T^xCLwy}73a)Dx(b5Bt4dLByqpydX>AhpADRBmz&Jrf_EqnyF~$I_c#Qz3so zj_y0x-K*t3RF*uzd3E?vL7>{2`9~s>RiHDi0dtZ{+FA`=QnHaDQ|7 zBOn0g*grk7blLr zj4@ct2Y19FYXQH+RX?_)exTc zAOG`zjf)1mNS{Xj95+Xm0q{$NF$E4m5~i3uT3E^~$)sRThe;^VeH6B{939>xy&N5XKKru5$7#x0Y>uoIqA9L`+fKEu`2 zKG)B;KKtbMAo-pB+`qh?;ET@&--{#uB1m%0q=k25+lIytaYHfY9@9*}M?Tq~ITTWl z)n+nM-*nP5*5o_Oox==)?+*gv{YcN=AxsQ0Md?Nr|K=?;6cuJ@NqRB|JCd+4a2JP) z8FxSFc0ob(2>)PO>yiK~6X=|LURRaG@&dPJ7fD|F0k4$Jgu`1VSv1tmZWL6oyjuFnEqu4&H$}yyRshRCh*wd`rom`Ygf4tKb$)# zd$%^-vgc&07S0;dRfi2gD$wdVme0V234Zxq9NKvAr5Zlrprop}hUdN6=ExZW4?;kM z7dr?12k(o2D6fVXc!ut|ja5=C-96pA{Ojsh_w@31@t0rTbG^>FCtDn7y~F%SnX-7v z1<&}Vm0-emLS66zur@yw8Y(jep73B(|A7}Rv)osNJjtd-ev)^Ers}$c3-Pgn1Uy-| zlI+NL%gUIr@sK#PZ8~4Xnt$W^6h-gN;)iGZ`8~mpW_)?0xVg&qYWRaZ$NJziVLxdc z&uPQRF;eifRmw_vmXq6RpDO)*-#5p7eh7d9>C4old|WsAD`tt^73H1x!*i}85W8W( z3+ZYT#n58wAij0~iemTmyOSt-Z#l?xgK=2JuFHWrw*|!2f_y_HyeEkF)3ML7c@AF} z1jLT)a)4ikM~V~lTk#usL-6MYRiXBvb@l#$Mdnv1dS77GyM_GVLUfD_mA#nDDe1+f zOp24Q8;ZZI>z~RHpi+E~e_MCcbI^vtNG;M=|LSeI^a19QFW^;*b<|9cap;;mT2$f?Z90$wIQ{Z^FVIE{T|k3EHK4Oc)x5)46<`Ef6c-i)fw;2aKrXSA!ndvp z1a8mULy*yJ!$1G|Wf318;2L#^Z6LB*9qA4!;MX8t!?ZC|ChYUfh=sz}5rQX^rmQo8 zpp8P=knm1l7G_RL7;n4m?(fdqS5r>!JKg$qnx;!PuB%p<%(EP12q{BEHas98)XVwr z=Y>GC=do|(KEECi6FWIKa60l@bP3~n+Q9h@cK#KJK_*1Ed<_Eftt9+krGL4>gH#y+<2`(F+qR@HH@5z&Gi~@v` zO5RJZi1ntYA5`q-hol%KFVMU}An!5Fq=H<4UP~4S<4RLkt*!4W~^9+IChJZMv zst~*68Snxu2d{6pvF2Ya-VIyE-yNMTu2fE-*i|l2@gzS`=1|!i z|K64)-EfVhGSE(0@EYm7%KGjGY3$?Z|85ygt9Rd2jNdF2>RXNToB4(Qix(7+lb`v| zFENEli!WYjJ;%?v-?qj+x9sXUmOCCiT0ME`=xNC`z^0b5dppWEd8te?m{56!oCqK zc5m3meYtpppWP3*V>rJCPqz2im0U{QO%=MJhU0~Putm{L#}si!8k6vbkTHz=j_c=s zKVQEr1g7xsK1p}U2ZnwUdwOSs>4PcuE4zns&?9{=rs&3Dhb=}fEdTkZm+UHH5y_q9 z3N!E>f7yW~%0(V4yvSb=sIm0RLf~tyZ9+4XCJv%1WZLg*3=0VZ!3x3~`eO`r^weVa z8oBwD;lRb2U)cS25{um$Csgd(*D?B|f48yTzIMk8_lESj{Uc&fQIT`iWs*weGryr- z_T{%6HvVHPc=MG2WdPPgAKhCQeP32Bl8giD0LWY?Bp@Rl;!G28CTWX4SBsZe^#1tj z1-?@DAut%ji?uS!P+ft0^;k5l``aK;tU%w0l>eo+Z)pk@@O686`7iH7qjrr3Gc%q3!ZxgU%NqG)CZ$| zW=*jimJd>wKl{4BrP||Hbld7~^}FV$83H2&GNul=WUSBf6!Fcm^a{CPOC>Eh>T+=u z0^p-~e$7t>lZsuHPj8~wJ;ui_eyWih+){o8PETb`an&)qaCW4#eaLWK%HY2L-1o69p?y6i4~;;^JwFP_J7UwJm+Rw3SXWp;kcCoF+-xdcGUM_xqt<~;X7Ex|kP^m=~ii(ba@~BEW z1yiVUkel5JvWAgF%;8Z$K*|+Y3Ufm9_NC)~_bE8yll)}KSHgqp`4(mFGY)xt1%Gi7 zX3JIEQ7FRyVdC|PlpquCzuw%_~wEry0Y;7G`Y?wCTu@jzI_ zYM%R8TH8Os&hsZWvAEZ0LM`Dba`oGzQx<5n+P#3jNzeEhJ)`LdAV#($y}Q7s@}#eq zb@!lZ1bLV7!I#1rBZs@8*T$aLS3)t3+`HIW_pCkUd0?W_V*rky^AuNwlN zvWFBbM`7~QeRuPP-&>;Xn8P0f0fjZ@SuzlLc$mG{Ud2_StAWMIm@D-t8ekdnBzZ>^ zH*5*fzg^xD@7Bm;wpgF=bGx-=^npkl+0n3IOW0MExhj1&b~q%3fyy%bCp4NL75`g> zPqjs!MV^~8_}R$UoP6l^VOIq&!o|VvP87d~_^aIKJ{G-vZ$3of7iOqxL-vUui=|b7!3Poak&0=YwHNktgiy?%b!W%A4s{$DM37s=|gr*c=Lz6NmL&ev1+D>Rt zYrhO;m9qaj<+ZR}y`O~XnA6+cCa*v8cD3wON(q5#%T)Icinfdijuuo&UFG=Q`Q>rA zheH`BlX6a80lr1Q=%zvWPHSB_E4=U;3*H5aoXuR_O8M-7!`a|{bP&6^FJSlX^y07- zc7kD~MVat_c%eK|+0ef93+xklVpmyL5)5s$9phV{=J5SNps_=|xEt2_M~~;?RgLkL zPsODCL*B88LQ1QBx11hx$di`3zq~!p)^QxwfuJaTc^6i*R&A47l|8nnTG?$SeqaJq zUNENqGIyaQ8r+}It;>~$^>ej`Clf-G(xzdWzxf7KybQ{B8u{Gdx?u-C`J8#-k0^Ox zJUz(4-8(EU-JT!C=eO{Zw-o#+*#$PMA>Nv*MsJ5ZF20$=9|-|)N58m)>LIZ}1#e>k z&#-dkZQpF;4oL$v<#C@kb`BP29GWI={ru)#XpP8H>_T6T-KK9^5*5TL@vp9RH)Dc5 z@c4o_<06oR?wz#mvXJ+oa-N;<8BCiW5p_=-_j_3HUY?(k?lKEWf5Oo46|Nih5KMF% zBk$SU#+?*D{q$b4$lw^T!$Ok_4Hp;4Ba~>EjtxD>Q@Q!A2H_}xrK<#)ZnE zJptsr34}A}<0{9^Wu8@+fr>kM9zy};quhyurNML9B62wh zk(O>~KGav^df@M?aUE)KEJdu=XIadmnI06Ng0~JCQRxdGgh}q9=y<|ml~13r+RVKI zjtb)XLawx}TOPO!0*w>Ul+Rb$wrv&O{9-{wjycQ_czh5L@2BA|9*gUdKcoxpLzfT+ z(l;R>3=!uJZDC|LIct+VHGv{_-6OD{U~Q;^m~p zd%BFIzVoMevPmsL@KE)y*e@Vy;&OsEcU zE4%zrZl5v+p0{i|@rM4Mv}O1ndF33wR|u^4{RA)9K+cgBqorJ8?Y4RHquE)^&Zo#lN-?A2ySPE9Idq+Q-?d8K>n!}p3tnMu_W}$5 zeSEOG$mEIl1{Zx)uK29NJqvZIx!@Gq=hkc59{!cA^Peva0r6*ng137{#cqu!)tA8+ z__|hlSKx``u4A)u_c=6ma&f!(*Vl~A#}|u}GZb$bzlUwy;*~OP27z=qax%{YzIC1A z>=IwU@b}Nv{bLYt?AD6kYx9g;hdE$qohszb)!%&$5`_O;US6y40t*lb4>M4DumTj#UO`r!~ZRL5HuVklqGwN@Y>_XKlY_xXKvvxy@rnt zFc89#w*zrt%3`OxUoYXsQg-sEPC?@yMr_{=BrC)N z>f+mZN(;JIg;Mu(AU5fD8(FStx=J8DasfwJzm(?>o!QfqE*3l8#E@ zIoTqT+mFM89t3S`>NC5-L0VmwXijx*t}cq-4Sd#xEr0qkR{?y;76|=E9pK((e}6A4 z&EdiaI%qjj~ zVG$Y`1-jBA*99MyGg=e8SE-9dfo>VxD&~8IRQV0bVsGTalA)~%6pvc4H?C?jMYmOs zRL@%QmgreAL-R=L9lT*kS;_lt$C8t%7G0C(qyAJKt66O0*v>S=1VekqwAGd|WfCo0 zJHD+H-A~5r9ww=IP+gvdGhi4+5xiAb3{n0llwY2s=;dG(*!WBQalU$Sn8SHDfm=?# zcG54DC@ZR=@H?@fcxdt2R99a`Lf@tbXhyfIQp|t9F9?W-g^Nv*qD+c+D{$a1cPxDDmQ3OPn1r|o8sJO9B zX~T64G{ zyv@W&mv{1y`0Isl?6ZY@55A+KSA)Z+EHp<6JV_&;Aydkm^6AJNEBri3zPUfb&xLh& zPu2J(Kx7s|#U!o^L;Ko?`)ynV;`c(yn?!;pf7&$vT_Mja=W2jl)wIdK>V z;@ZI;Zn#oY>KN*4;HFE4hYUZtukp6~%Bbr9x=WI8^bZQ&|En-``GHdqEh8s4V{(CA z-4`i^G;0)7j_ua>_2HEB zo6iIR`3H1fhatfW7$g+;-B#_@0p>Usct`ln#F_?68hKF!e9~NAo2Ryr$SeHGH&p66 z=y))LQGWEr|x(3*@Utb`iufI9oIFf^J)`Ofc_+Wm3Om{FX{r&m9Zr zyOaI*N8DGw<@Ik`(t28-cQi7ShunB$gw^{+7wNe7uxKUc)EnG4Jbkjac!71zvnL0O111euY?Hh~7L?cRDnC-D_fFpAoeiP74z2T&w$ye0 z`#nNn9nS}(0DC$}>$*2GcrX7jNbmZ4#lK5@fL@|~QnCA*?c!c9va?5PLl0NOcRz|^ zl}=7n)isIrbzrq+kM;Sc0%@t^ZkV>&_xGi_o9pw${965EJDV4bZSY;UyzYyaD7%&1 z)?7qcNLp6;BDd8(Q=hxWX}$LYyF6nA^!#adJ-MYCh7j4u9Z$6gR5hm#fImt=@)!AU zwV_hYf4?LI}0_e(`Xk?n=)fEyZVoK4?OM+AU$#bDd z&O5of#L$O1l{gXo6Fgd%4Y%+SjC*qyz$^I6bL5VFBIFsHnWxE*z#r~g&g{iNpF8eT zfAiN+UcL=T`n}#eHin~1W6+xOYklmx7z06Oj67v`?7O35cEjPW$Q`p7PHb!+kXF7A z82QumTF>-U4VGN{o#}i#TD&H2X{lK*dIeoI^lwC(K=DzK|!Hqhg&af!xok@I|tA4 ziFvws&GyJ+PO5%>=;0fOi)U<6-oqcyjy^hA)xEFHjReak%{N~q1cFb0Xv_Y-78Hg% zy{@}I^b@|*%7y(E6DtRZP56Zai%Qco29i_!D!DcCZwP~KnN(18``?1q{u+FkV$t>6 zyG+1T<~jje@+gLSls_9NNEy1xqku?1Q;)r!)kM-};$ez)6zJy(Y6Vj=uuLK;s}53Q z;yA^mJL(l=@qsd^x|uq5w<& z#ttajZ_9shmsl$Px#@J^W<{z1G~Epm~`#!A4IWx!*@x6tm%)n>MszGGqN2#ej*3$~+1)^O1nK0`Wv4#sOJ zS7O0U3#42LA;sUt(P_P1|9BnSG{*fgcZgOip}uYStO14v)wP7=GG6*z@`Jh|SMv}Q z08zG-8w^X>bVn8|I9Dj|R1jRe<*-X&ehMFdi6PJv4y)b4Vj95+|Cr1zk$s9URWs>= zfmhe_{P&N9fPG(BP}o3Q>>ztg`hw@{&SZ;4*mIn%>-+v^EaTsNI6)rf-S)ofH8Z6g zM`9H=P-w-uz?a1tFekV*;2?E6ir&RY%bLUEfq*lxlAk~qf_!7dr?Gzvr_$p|DAyry zAN><^y-ob-%HMUzcfnk6TiFj6co*=I*GK0p+IiR`t{XTLpblf(%>q+f{+5DM^i9bt z>aYfpsj(OUQF{FDXU^H}dbg~+tzeaVW7 z{@HeJ&tsppR55bO#b}^ijDq0E=3eU&j6D0RS)9mTgbc{OQbntv79fFl1aNuPvv` z$B(?RZG-%_989fu{1wOPZ|JMlc<*nREEz@U^sBA+4e6%Y%}b){LsRqIJTLdWfxm@+ z+Q+{&4pszfYye`dU@htc;ZKI8#6fXq(bq?Pv1RBrR zzrS&!ctsY2#2M!#AfmrZtiF!%0s8X^`~!>KW8@97(ru_NIJ=!(Ki(pm`Be%#*U|mR zElPx7AhB|8~jCVu%Tl}aVvwF!OXlBJ#Dv37@! z@K!!@@-Ik*3xCMtVl_%Ut_R39FR-xtr&muGFS%}WXyY{tLA%8Fjsf$i5Sq4oJilQ2 z74!WUfdGB)0hz6&5eJIHixA=9(3CrC7Pw?MU;Op;2jqI>TP%6EIAHCT@!*s`-eQ-p z3OQ*dJ9MPe;E8g6Ay@NzqOF9gayMA;eUY!7EBV9_aQ;_2H3zJL4-C{zP4Za#xcXU| zx8p0KVo&cv}O|2rL09J9+%tcm9BBS%XzYp;%<=BBDk`^7k z-A5AW-ve)aE| z=U0<`_b+>p{ZxQxqW=5K>z?cD?<=V=!?cYvW6bX>;oC{&&}tYV=pD4X29oZpPM=I` z`PQ-|i7Z39ZT?Uz`@WJ_ApG5Il?#UVSm2$UWCwse=@x-ce_dL>*8OPV>*{@#Cx20a zBflUn{3*9J5b*5a(;+LA{wgI5FHFboM zQP-dZG1jtKH}%G+C~g&tb4U@<^2}EBx@+wj%HEeRo-LlD?A3ZVn<3eX68W|{6)M}3VQ?F&7AHP}%jCj&bTai!`J~L0R}O7H8}ldI!JoaEG_23ZAtscoW60C-=s;E}6_{ zeueia0u@NH98TjjIWD!;D2NksniH&j}qI%Z7M z-!zSx@4plTntobgv+RurJLq~3^P-P^qHAtu9P^?Yh;{3c@S4z7BKMi^3RKW#-fhfspSLD_O};5y?BD# z2CRAUqq%`nCfljy0YhUNq8Sp>{uDaA{q>8zwH~J5zy9u9er|ZKf8$*Ut*02CkxyA_ z<-r`5R`gYBy7FoL9#=^}qu71@?u3-c^d4fUx=qt@#)|DdRB-Tl3W7|P)!o(SUOkk) z&|i-oZ7H0#ft*cqo6EtQtaEr&5RhZ6D0t;WnNLZPN^k2lFZGHy%7cY*wWFeVk*r?a zllS&7i^VcCd)wZ|?CjR$7JzG3sr{v+`A^29Zimst}yre}Qi+R7|}l ze;zv(-=7!#{hjCAxvp67`dQtj4}Ib)z$?c?X)FF?fj73mZio=XwPLN^&a5)=pttzx z+1}zO9AUqB_LO)A3w$u?kbj#Vmmtg9V`!m*0#-StB%&nB*@AGZyzcbWkPItA$xwus zMkenaA3pXA%{Pay1p9m?WppZA7#QVm$M$u#%=_`I(|E12R6f<04`svS zQcslF@H=>*2eLhT_AHa3R|mLiU}9uGEqgt*Kx<%EtyO$a`DYF2^tS`_P+hiBdr!w! zJ+|M7F?1^%;$fQU3(}BpHT9TpzWcf%Q21*by9c|c`?}ixN;SSKJe9(IQ%~j?=~uaL z$VIkTzzx|QyTw^Kgi$^xEx75SEDGvc_UB*+L~(s$9wBhPes`3uVji}53vb9)GV)aY z{N;XHzwPl|Roh=sSKr*l-l2iM{MGPV>Bc%%iPx5;6+i;^sm&l%(0UEu{<qV1Jb{A?Si&eyZYt*0YBX@v9iOIH+({WnmegWUVx=PrFsBfE&fqA zT5C(k*7^nCPZ0j4AgON_I?_S+RntTi^U`6{BI#;gKo2ly z_uyasb!IIDw+rr~ImYVmJub)o^4HfWiL{7EQN*vN4$#&xW)GshB~~NycX~gG&TX~M zzrU7hJ=gsFH9}yW_L>rx7`W`?j=8Vb#e>f2SC036XKwGgB6H@RTlGuZw--5(?a32d zhhjK$h>Ms#{q!;qR@N|0=2Y?~#uXQy(`qVJ*0{da5DDWWLc0kJZSY<`G|C@Il0UvT zc+Fz>aBp1r;c)eS8$+I!XMEpzb5C2gZ{Ur7o4T<;tHwmNXVO@dvC^F&fIl|f`K)|> zPWw->&OJKDRSv&1&qL6aS?4EjEqwabl<9oDAW4CJS2f!v<9;A zDE?M`zf#mAcy&j?`?a;X5%#`zNj$q8zOe`1y~LvTPd_}5(qe&MUVZaQSo^H5T;V`l zKbsqFuS6hIQ6Ykg?3)r?1|GY+yS(n}iRi|GA)-Ns^ydaVj9)nk&6tnGSmOpc0nqbLi0# z{xbFD<0-oD@yEEa`y|^Td!^p`dJvO$^!>Nl6T)!GrRoz00i?gTVc-PF#WJ528nkZM zr|VuF;JfZ{ckz@1i<}raL0T}$-9Xvvg4qrNLNh=`8&|%a&^pjNVIFI@H))NRCByW- zuw%TlA!9BxBugcj|2`rJjG|KaVE1cX3m58x#xCzP#)~hRvIR*Rm+M-kmr{n51MYeq z>ouEJ_^p@=Yl#r)qL7n9mMn6by^5I+XZWhdZ=-^#f@=xZ-S$<$f7^Ux^;;j)(^MW5 zljJ}#0tjBXu)nAY*S-f$ZZ7`m$Ct#p5CA_z!Rz#5i)UrWSP7dy15i(Jz$tK}CNkn( zW2LwTu1ubVn|OUc20bRIKF+q5{6SwOl>7k)7>1YiaV4oq$u-PK?6F7T1;`*Ob?eYn z;$d7)iV;B;JNr)-$MB7J_GPyl)0-|*YticgvxiI!RrLPIxh+qz?7g`-fd}a7ZAX3?=ei~7ob8gEyid_B8 z|BYQNm(r;7b$-`=m-I+}%Zz~)*OLD$K8+au1Qz*%Y3zLesUYyE6}%#chYamlOXN!?1())XgU-Lcu;%wl<&h1HcSP?=>x`}v%4}$}J%0^{U?5}#e``NlG zq~d`?dSB1Oh|fiVU=EKJ0-@)X#t;2F#AQA<+&4ztpS<3#kEOvF=-E)XE4~c42H()? zO2IM~m&3Eds0Z+zVx{|riDC{ zsNf+J6(>+mq_oy^7grt1yN`d)gD8I8VyObCCtBfapoRThmS#ig;u62R_3=JUD4b*^ zY{}`S?V9hu3K;=KEQS81JNZ-nT;r*SzT7g-xh&u=A%AZ@=ox3A%xNQY zxYab1*RjZzN@u>Y0*+7mFw$g?3q`;BakK}oQM$M|E&cDJfs_aQ^pYJ*p4qYqk5I1B zx-N7-$cQ{xZtoaz9GdoFck@8?pY(ekYhi&!ThPk|D}uWLTFwE0scgqwGCWCQRJ~RV* zd#|!rfkV=gUrob6Wfes^OS-dV1D(aFaiBkWn^wYJo43Vs*YS@$y|Aqbh1T*eaJmCd zec2gv?)=WqW2LJr2HhX(HpMx*V<82kjB1zdL8hWEpR0 zgD^b;d{l&Zc%@fZ=;DA=ObfyJumb>-PrYT)h-`O77SHgSe&FBns? zjSoqZKW65qbUz5|W7;v*eE0YvU{4#;&2_u-H&_y6>S%GO@n(n{gwZ8k^Im^n;*d&O z6)ql%rlMEjQP&GcoY?z@!yP6)Wgt|qG-0T=FI{gx&(}X5 z0yPP;9mPxRBm2`Ul-WXAFXM}7;T3`60^ z5SN&$tKQaq@hxL2Hp%8cUl;rdK@pvg(~S7;oHU-#wp`pIyR%+)oA1A*YDy&$wSq& z=Dj6e*K97f1m@9jRXy1uNGCl+f8Swe%%A*)Ah6^U)aN--@`zqsDi?#=oM%}A-op-a zj1Lc4T+*`lfSpDAyDT&@k5VtS0e{lEw`3S;sqi}-hFcY~af3&ED|qi4Tbj}`zQL$u zWyX0hrA)EPcTB8%Zqh;zKFi{XiJ?c|$4VEMhnI|jo>k#hJ_|GV!He3pohYiL;$+F?Z&};2ZDKp zFz+F3FL1W+Ag(2^%HEx|i}zfcNA4ihs7ckePn zIUWshVwa2K;XB-af8jn}*zhPW*>bp|rZL$SL63O7!b11#b|=Ogzr22%MOj@dZSC#@ zd;I3J3y01~K0Bsm*U&Msbh;(+Zw@mA{s;&le}wmgf#RY#%B>5=${sE@XE%ZO{M<#p z4O3Fdd$6~URWH86pE|$dJsIU$MI{bbP)o`)vN+E23zcyaDvdm4dzwqIU~aQN_%=-wQOr25OcVtd{` zii!giz#uEzcbp7LgkGE{Waf`W?aSN-#~v_%xtj2=_E_5nWGQKOsr7uYJKMd43jSGM;A99#DF4L>pg2! zx#-~xSuwo_z~8=Nw?BI1NF6i1M!9R>D0%n;dh#;IVt>q7(>GCGD0E}3dwI&1oJ%LT zr}(gYlC6y|STNhwssfAOxNfi#2mBP`!)gdltVT_qhBn)V;KAh8eEX;%5V{^(?EQLo z2E}+kz8m`9Ji*5y^Ki+iD!v9!O#+RRC6)uE-@vM8JP-n&0Z(`buXz3DT@<{f*k#(s zp-8RNRk*#;+zLdUWAq|fLQ)w?Y3F=oI6Sm^od+hceDir!Z* zqFi~p!#IKZ-btf7mEKv4O0=g>|ETNqz6aZ06|HQDd^D6zILylXr8N zA@D~)0EI2%!!5$?4Mqd<9%a?+FeA=?yL(R(@0>|%+A|IhJU-)msLk_O@cs+4TX#zC zP|p5f-Mh>E-tG>{;Bc;dnDiwd%7O;GEcgByLh6NwsdSY>2C)SqfxE%p&e_SPA!K~z zvK!?R<*mC?-s1}8()K5Ve9f{Ee4xe6J?49qR{V~*$l}P-r0w4hR+TnG`YcOh($j`& zN4IWzovC&Tjn94ms1>{d2eiUW9045x{tCy>n+yuuY@-65LEiJl`Cs2GPOwDNZNt-p z9S93#N68C~;6DY*3cd|U7on|CdO&NjHAt^eXl?$h)JVAq%&s2&w;u zrJW~k%Rl51J5QcuQm;UJ!EXn@XHN9Rdl!8ogi^<-+_f!JBpp6vzC02LOmWG69wsQk zCl&zQwdHn5Ct}EmCzmLBFHtD4E94k{cKIBhrjI-@J?{qKHB6kpbNBzFfT&UKNIkDHV*hUjJ8IrTbFf{I%7y zq=U%W!lI}u?UYA4;TBTN%k^8Wqc3;px!dN5ar-Zf-)G4GTF~$8?m?d@cTt2n*86;^ zcB+HLPv+=F!QC^RXui%6_;L`qK<89DK;S>%dW{2I8DR`ZQRbouhW|LX@(@^gmOpoe z=wtfAvE%~OMy3V(;aTODL3y>5yhT%%?SaCPV^LtK!!k&ErEtY!7+z=Dj&n4IANv=G zbFOTfK7bBN4bg=jxnORCgBt z^wY~6!WMtL4F1{@g2EuD#3;gzze3AG!a`qTYDn=~KmT@KqUJC|;5&ps(@JD7XsD?p z)Wjcs)*0(WNvbO)Z&BYF+8dR+ZqZV)t3NIsySu^GReT3Ug+m9aD^?t(?;7+R)JnN1 z?fWzIz~Z&zzQZnAesaTL3Kw4%%*r~_zNu&W2{;Q^<#PFF4yqhZidDhuVI|M8=54>{ zZf~|%i+5Ub@yzP+NguRA#3aFx+#ob`j(VQ|J}wA|JCp9D@k9UDB_C6iX|j&&>ll+e zqE}-aUG;Y<@4(U=-k`Gg`1Asv@ty^tQzq&NlgI#>K*}@Z6QqeS&B9Pk5K9=g9a{V= zK-YFTCY;>g7uM@u2uFTcB)V*mS&C%E+~z zjW?DlFXN0?W&_F~+$SEn;tXp}6}!qGrzo6a`HxlSHCEl{$Qxx*D1I@G*B}57`^%r<5yQ3_Uo;(m) zuM6+6*wx>zJH$5jp5pq1gPJHq1(WIPz$W^2sc^D18L+>i!`z3~wep?A41qra0*omL z1mdeaUw%`HRP;*lC3%NeL#%t9Tgi*WTVDF!-wm>cD&ZP8z;WI?wzxypxmd;?#~z+$S#Gb5)P#(>1W`Vz@`XW_0NB22z>hx zfCgg0TM88Rwm~5dNHr*BuyCNm5?3J)W0)vv-2QRSD!vNc|MxHdMvfXNOOd0%&R~O} zS3VDGfE1P)wj3Oxx88sgZ?g85KMXz7ILyIr8=o{E@cR-tlN4X>T-TO<=c}a^X(&mz(e%c{oNMi zeNwO(*4y6u^Ncf{KL%c`18VW-O5|Yjrvmp1{_&o}7GHCC+IuF37bss;*!V72@rk@y zvPHNIPVp>GH-`CEoGv9$joCGxcT48$V}n5TZp&XjjlEqDzN=sLe?QBU#08YO;KUwQ zzAvNbeYSXp>jrt+EefDr7}z|WRX|)_u%&|&+}+)s;2ubD4eo^C?$Ed;XmEnNL*woQ z2<|S8yIa#VGW>IA?)!PHv-hgKR(-{;kbA}Bv-X{)QFIFz(7_o~zw7UG*cwO%tJctX z5tiP)9`l@!R)C+R5iX_*D*L`OLfbUGeB+5~$szJVF#q};aTXAFGa^gPc-n)~&7d)#W*IEY zEw9jjHL_Px=jxrAem!-iJb!3(-FAK6<;8v%DbC0o!NU>}nZh;SfFmFQU_lnOMQ~E{ z>P^d7|5Xvo6`qO{kxKNWr=bS=J}v&ea#B^ITmSiPXJqI2;(TZ4Oa}guJS*Sc!YgON zxH+N~R-Kg#4-3V0r;O_oINGy6jW`qd-j#GqAPaWpnVMO0FE(-%IXlPZsJ=`8D5Wf# zzh)_Zr=G{;3_1eQxq&_%kC1cdAiIH8Q^hYzTApMNpu1s+yEYk|E_0?l*=*rbhJ6AC zNp^GbMcV&o0hC`}4tMUSlL?|ILNf9nGf@m$J~`z9=Ey^nC>h0|SJN^WA0Ka{UzC1h zJYfEV;q*v|xznGt#LuW)^LAAG2QdyHv82pqi12ov(6w3+ee?f}MRWwPud}c;i+9=m z3oL7_tDHO4mVdKYW2<24H*QNAAITSm>vj&`pGsIOt$R}M^NaZS8&#_1CdM>b_ucQt za6xHOAxO*Ts)9ra*^bwATG*u#A7p-k4X)#?{8Guu_)^hK{c?_kKNOQ&B3(d`uZ7j_ zy>I@e=*iUS8}L(+1OpnJ>mzBv72P-*!4kF3LR^^|?6mkfibMnCeg0TC3Avb)>J8vH zWnO5p-cz5gCmQ*7%GfgQyBQJvnPSzwAy`(T+f!BTqT4?bxB<4ZkKZ@tuSPwdGmS!v z67O;`MN=i_8Xf)|EMvIOVTjm$d)#f!acn^~eP^$V$4KOBr}0(T9kPC>=l^k{@D_aK z!0wqVA*B0!H*lM^Lc=+o0YadXqfyX#E#FW^?$8Un`#?>IVC$}@eZ8>`&yX*&P2*zP z6q!jkyv@3`1ABhaHy5+kQ>%D6;pe$-y1d=t+M;!(2om}(;wUhK5S4nY%;a!n2JN@9 z=sIolE;x{Q?_xh7Md)^IzbizH!IU!61bFU^#CD z?3-!wppK0N)Fgk?oV%>wtP7&6)b@-!)*OswuRI*ps!K`-Jf{0qCq8AQ?A;EOhJF}W z+r^-<2_Yi;4wN@ez(t;<0)(s8&^4F$sN(cU3=SW1US4;2G(UO)9|%>QLA8Z4HVkQp z*Slkj6bxAg$!T+kBeWq=8UFj9%wF1d4^Q6#3NWzPXJm5eO511=(#Z$i_F;Lhm zP{{4+nVu%;F^tpdw2kR_n@r9&(QTqEirHJ4G8^CoJH{L?brh95&PTaOa^sqLCZkmSdqmxwsGqfLrp zmUy=U*yd5H<0pF=V2u_XqO%A#fOmMET)P))S7m}$Ke;|SbP zdZJ=i4*v=51exF&64jkF1ne0;c456+S)G;LD4(i|x)g))HBsUb>MJman_Y(c%w%-a zPf~Z&5h$u5xztN%Ard-dY#qUDwDHq}(IQHXbm1^TXq!m1+9xl@6v@y+uaF;F&AuEr z)h^>rdToPW#3LC31uYLJxJQkeugscG`yyC|QrPw07?u3w`*+@WMl%C`Q}|cGx8-); zFZ}m9FOST2ugaPd1&qxOuj%%DwpOaKx(cMBb&vbDE3Pt< zSjTYpXUh){zwukb9Sa&a`g%%HqLNU)^|K7GALi$Ae9Wt38RsEX34 ze6VFb28&)*K>}{S-VbV5(RvQc8}c4XjHm$DII zc1gbJQfPBrsWMLMTmNH3Z_#b-l#q3n5Yz7z7d8ms0vNOkL1H;=2#rwOx4R+&YtIQ_8cm zYxg7l^G*zIq>y_^bxu}e>+*yCSKcIt0Nix&6WxH4Tf(T}O473>Q`MKx&t zA|^d%$UoDJT|C|d6?26o^sB#pbgNtTS)w#qtswa#q& zDtWH;2d5I>5(Bro{F_FF02IhYgvXVsGw1q7I6qioq`}&uo17aSNsn zS1^`&%5yw?XRUR!!IMZpSDT_Uhw$U%p2@D-hAO!InZ1Xt6p6Uj)`Eux0}~CtwKItL{_IdXkoWWOxq-)}zm541X3gBDFY~oUddz@xQV3zx16vzSYk;u7tc&M)dA_ z&0yi3niXL4X?D^(^R$IY)~v8p;m5B<$||>P+0)cs*0R0fD8@>>-9^ELJ>)ZlJy!BI z)4Qo?BT%wiU7OID^e!wT)`BV&zR@bnAT>mm(gIibQ3YBYd4J1(|CjQYmh5u8m%q zk?*MVels7%fN4#IYqqtW`I{A)UOyeE1!@1(eNx_ULqPM_Ik_1+pHNA9Io~-rI8J&Q z#AK4qaoZRhnZMFh0SaWl`gk=4Ny+b|(ykoof{QjG50#OUW;0x`9uhxx`1^Pr{oeO} zEtm<)kSXx^UkNeK7aS(bF16@Bb-p;qEL_N9d|z4LjK`-Kr?%O_Knz=PRsU6QM5SL0 zD@*%g=_-=@5U$?W*Ahp6&U9s$ z@qNtbz;c)0-L~W0vZUaEpuO!vSC;&nTFvdi6t6vdequ8?V3N10mff!0fzt3G|EN`_ zD^DpspB-3Y6U#XQln!OfXNz%8|?tbn>ccE1*p*SZ3S1k+jV+nkqF;)!M{ zN;t0!$?THR_VgLe$=t*7aOw{b9;S7-aaWRSYqfEEkCvCdM{zgSbcH^=KSr98=r4XF9v8-wUD9Zye_Ni805sb3=<1u5a(eVTGHXdKv9M zZ;1MCfF8?E?R6b7j`fs#kL_ZzNGuaW$nQ4rwu9}oq0=k#ZT z#oXs{klbX3Kx~_<0CUX{Eo7d~l^t^FqolYPO*LD_-M(tz{;Avhh&54wvy^#gcIYy< zJGZ%c?!n{9vHJ}V%X=PWv*QC1cDWkjjoF8lgAeE+!@7d9F@zU4%S?1Qp%W$mmr1Ocp(b_J6xC}OsWPXAkh8T*~tP(=j#lrI7j;J zM$Wo@W40($+&=47CTgD$pyNXK87}>v`6fz(yqwwB)wseKDki*+B!D9{#DE?6Ra@{Q zg9r7Fc0jl1FB}BK0B?cX3(dCE{)I}ysjG!bF-jz`V{32mE)XR=+JiGkC0Aqu@WO{x z8!2Wo;KGE&W4j+eShE=NbRsU)WBeQ|lO1>6=GU+C!50M*#+M*t`z*~Vi-j73wypR_ zD^%dY=z?*=0gbdy#V~V#5+S&lryr3I-OFOO_%z|AzUHCxv5+8eWl7ZPn&i)qNM3pj zmw%)^>;HIEAC?g+iY105^q-}7!c2e`O+!wH^2_C|?EB|(N9W`;nytFK6t<3;sEqC zPYM2vYQ)$@J*ly{juuHw@N$#j50`BjQY`DtG^O;7HcibN^LPFj5KG*oK>q$5w=&7~HK|M`)m+f{Hr-Nm zDUwKC5F|mfLTp_l-iyUY@t3(6ilB}BiNRY#mV0$idhVMuvK9z^*W5ap0ljf0I&bGI zqOmgrDjb~)_fg`Y_8n(*pr2Q}pm0ar)SMk2Z;QPj5H3Nh+UA~@N&jCd=OG)z)zHUg z*|Z)B76et)jZAF)w@tc=q@X7z}+r^7{R^ z^nm+5LhG53lxIkg;~G_fW)rRjaOzh#Eko}`mZo-O+8pibWp~Z!>G#q>X~Oo2W0TXf z?qO|IP_}L>SyZ!||F-7CYr{*zo8acU^Y2xD$NWz%m|K*(=Q$P2V*1ZJ`6^t*gsJ5o{BQBDmfmB;$eNHI77u{|3}sHU*wj=Qk?$%FXA>l0?Bn}~e#fELL2zUar8 z5pj>eZ}Aw}GWNnYAC1S#8?yr-w%vcIuMnuX;xH{NH4U{Q9-BVMb^Ju8SjuXhCCKqJ zX{-FKv7x!#*vuX2CBrN~O~0wU;WW-2u@I%5TTo$m z2m+;l#?QjCqNm^z=P~VG%8o+yg$upfEnaUEupa%Kj~#RRyPy2P=gUR+`Mr%~6^mkrD;yVP$%tNj@G=bZabhA=|?;Z|)rbNr3Vx$2JCi4hLfy;)A&G9)L_rX+-TsCih5Dg{D+fEd?(yjE`}M=QA3@M0L1~t4 zVEL3|3JZ%@ALSRT$YuLX`pnS=-N(Z883n^lsgad%+LP*t*VHI-lW41EyRTy1x)b6O zVl2o-q`Z04XIq;^kj}Gv94*4s7oSBCc>+2*L@#rq}$AAuL&DDHh3CncAbtVx|E zz_soC)t&R?!c)}6A>?1)A4B7^eiS90V1bnGPfJ2E6`Yn?#q~a0Ie2^!IBqdAjk=izvmVH9UYqv zrd%WCmtb23xnpZ=hu~9}Yq4+ortIQ>F4}_;bzRx6HRrY2{pw2$?jc{>hH`WPhxjdhn@XNW)(zJs+E#mu zXNg_kM4k;T=w#Os9aHWy126Jzd$qh2SiE-=#|Bf(o*#OJH+I+2cfr~(;J|#LQs&E4 z-r@K31`gIEQZ1G+PP|Te-nCH%@#bA~WBg+lvp?Iu@$GGa{`&d*Xmz;i*q;(_rhtr+ z?z8+Gb~B7zT-f-{5FM>9%9#LCpU)lo?;~00M(MehvnPC-gEa;>0lxQWR!}4*th%qA zg7ooG%nek?RD8b65mMnP@NMOa$jB`^Obu64P`TTHPw`>kHFo~}_olQ;n(9$RD(A-z zd5YC5+x6sG=h>mJS}T89(0#?|&~Q}jhw)Tj+TGmg^>q-J#VlxXVH203vn3k*_Y&s=9m^wucEaz|-*H5fyRtRv!smCSX7mtdt z^QKrTnT+C$x?l&%ODhy+Y%%k4Gon-N?6J0cyzu*iveQbU2qlP z5?I+OQVC<20$lq z+<4bF{Iq(MCt31!wqhg4Yh!$-4p8%WEv1 zp2Cx_Qa6K^ZnGhumvZOzM}Y`mkqxR7v3dC~y3dT%XD-W!E291LD$CrALU_n74;7iCE zw`%m%&{3|AyE~R^uV!(c(*em|e90PV*?Wgn3xCjmu) zJ)1O-Hzq%oHHUgOygx8Tys&jTcVJkWs#SO^Q7{>jvoz9`5Np?lamKOT_!r zTj57)NM6N4Nz{hDRB@FZe4CxW-M$u-F*;D>{h7TVGebXii^2#km)wPWLBM{MRh|}4i3zv>jf(rLJF&p<0xDEmtkrkjrC&-!WyqRO2cy?^>40Lo9aL!qmtpQ7R{T<=c$zHBO`D!H9WsF% zJ3nN@t4B%vP0cmZ_Gc9FIqhde`?KC&xD5oZLw)+}u?Lt|ZC8c82U8#5r#aI%p`ww* zu}@GkUt4`y@{wqV_+mn?=-pQ?5BC0ul9rmeP6D$LtRPJ%^Z@YZ-7FH&|a(@enT_RpEt$Lm{t-@>05No&+76tv<% zb;DBN>4xD;w{_?DSGMFYDw+he2p&$-nfly^zxnX{V$SssC>nwa25UIfY>_Y&yGB2T zMI?b=lsBg=+SStEEl*>Ev}#@0vKOkI5(L;?{8|C8@q%8{B2_V%J{f9@ul`c5YWV(}u3K)z1yS{V!iaga zZ*0y2k4EWt?a_vX%huBqEb5gaVBNu7%(b?)H#XFuWWRK=7(XkC0)M#u>Z(mzpQjw! zlEWxZdF(LPyi_2_M9``vBXKHB?exf7auj*e)_j$6QE9(hcb0#d)jEjs-uqV4Zen}I zN$(>PqH>%(x`Drkasu|5N>Txn0sA=HnZ4Y zecjuYj`*s{3YhN^f0R> zm=x92b*x3%%mOmlk;*?IzzhEac^vCKu@z2zm2Gf^0Y?{FDPxMdpx3vj7tLcosGDN> zuYM+;1U{CBb*M7Ev>m6!YZFY?1{gLiPQEMn%9sga^=Sj4wzY<&@ybd73 zGFueL>jE}5N+%=6?$vwvw`d~+)jD;TBw6>dLx_E9)-c@hxqRCvFTXMT9@P2|I8d@C z2B&}^&ex}>jh*q8Gy>jdp7Pnzp+qbqfoy9b#mumZ>g(>&oX#94N+I~!1~I*DgY}ZK zkfo7Wf67i2lW>!pPDw~zWcb>4UqG{9PY{qIkH`i5mpzHXn$3$19-qL}`P-&gLc-jn6-VoqqQlJ!%8?l1@!(w%4-Fl_; z=NRTkpu?|ZxVhTbg~3pQ4*hu}(~ZEGseMe94=X(W7*2vxb$%8kY=L{YuQf-F*s|?8 z`C^O7PeX?g$B5pg55XM@sL4N>@V%B3wp2n4FihRN(%#1sH$cXsBI`!~rW(&gJ|Bmo zAQW@F0$hBGE`9vfP69>s@x^Pe#Vt7Ccg##@7i6S-jaa;q9z4@BhSIMcnYcR(TL1Zy zvrAMB10|NIEl%rh3P2d;#IHaPw@7+$zC#oN2eK?mi_|Et;Xe1%RRDCGZtZV$&j&>a zYG=uu9s9=BDT%Kl;Dq)D+}N=8$)raD`D@aw|6IVFwUqQAL!7SG9u2u&Q{}fyY7uc0 z(T#zEz<9s-3pX3ws=rK3f~r0)yOPG}lSX0A7e^goX3mY16~LY0Yrn5@Yj-|t(XIGv zfuy@o$VC%@d$~nfJYo^T>{d0wjm((Gl=JvSripW332L%imcEnuQGQ3nzc-t}36Ij+ zjKx-zmg7uFKt%8VoTB1L@9rIEs9y6=Ze5<)#ZTN9yjZ;JmeE|&K7bpV7*PHB?+kV#Xtgi`7w|1ek;Play{{`^J>vXOIh#n|{b$-Kni-Dg$il|GeJMAVgwy8vq1} zpVyVcrR@}aLU$(4L{(*W{aQvojc;E|=lQ9Uu~cOk+nLkZ8SR*{ImUXCTzp1apB?6n z+UnYHs4~SMEyC?pC59W+z!aj{3xO4f4!y}0A7qm zF>XbFmhwVjvHZr?N2TCH|K_ZY{FeJZ=cJ37vvo)*(V>fV;H*lJc7~Mly?-p1Ah!67 zUM1ipTQt03}LT+ew^>k;1%p|QQ$KweN{2-2;J=(YTZ7%1J-P)^HlmvVsZ*u7QOsSo4 zvz)miQYO`z>s`EGNTQxq{!|pbw80%B>-%~A4K6$T_tD{rqJC6RJWJpfD=Wh!0_f3o z>+!$kDe_*PPLk_$-{t-m_nw%ZZ0W$Yz~#fWBEgi$EH90S_d_LmeESv7RdU?=1unly zmbKQ-i?a<#HAh$}XjrQ;QBBJC{bxwBAhXS+!P;TWNt>DY!0<%*4XrCVtJ4EBvZ{`f zR)$IO8<}QAzn%k~R0#riz1-tGunp$cQJC4&hkxmX3E~N0IEs!}NN#pCTHlAz2b>3ZPr@)D zy+Z>(&vb<1a}jX0v^w=Fao{GgGZ5{e56LpY zbyF2DOwETczgCCO6*z(1xtjQ#%I5bbEe7vVa}%|Nvg`DC>G9hx%R&Y z96e8J^UT}rhTKy&`FMMht@IKuV=4zLj@?TC0RQ(khrHkBtlkJ$OhqhZ&~<8*N+ro( zbG~Wv=bsc1RF%4hBKP)>BL`Kd9tdh?Ph?yv-`DQ^Am742^U|yHP&CG@BLKlUvC=Di zT;iWxB8Gj>H6V3_Doy)#{CVsuqJ|%OJf|yAKzBiR;I7GmI<%N~zb7(_oGMwRSp1q? z%DM{~W$qiF7VW#eT0(JynZEwJC`fyteX5z001`Mm`mBG!t?m0;{#YsQ+w$kE@T!YZ z>ADAUX*)Kq#a&t5URn#}tFZpc#35qplg4m(`f2v94Q%W>8Nnpt|UvYH+tg4E3JEZ3|jEgH6KIxHBsLeINc5;NwNW`5vX*?#P8> z*jPQ+WhU2cMxpr19Bte+Cxv4poFE)sMqHXHj;j+GmBI3@l+WvBh%Z&g@n1mfD*((D z33!~)4P5XBJ9S4od0^`b(bb1W3c+alljioD#4VG&!tB=&ggGMV`g$5}(b3`8*T8zE+%q*><@OoB z`_Ef`YpkWjO$^WY+&kdzaH{s`Fi)>*ag5M#FZEzVNxxiyf@W~BE7`G=+C8a*+2Kf`5T1@gB~SuxiE@4xi_lbQQeR~xL}!&25n3hzr>+N!sLi71fwu8LfB=z&ux#g1)l z!v2J(F;@2MuXFL7gq(G=%YFJXmFVmfo@#g6BN+L+l4~*^G@8B}6aQr}(cn{sSDKVG z5tf*+v7>^M$8Zfz~vl-ornDM{$yqua4O7uW$msfY4`_AFCAL|;o zKSaE|gw|_M-+XAVBV)Hs*6J!fLawG?{l-3!IUQEbEH&RDBr1o@$MJ2=XXni~H;Oc( z{5Qy@FXhS*KWK~UYvC9oBOi-*Q^?9-qhVmGgtK&)b{F)@2%m9Df5;_JHC8D?!*Wv@ zr0Oy=^l(?MDN%EJLmPQXX3+DLJw&QmCy%g;%x*5FYZex6khKrzILtO?Fp0?6mFngg z8xY@gfo)J6zs%#`;FmtvRC$^8p|Xtli8R(eU6(Td<>w1Pk&R=e)$FU)QQ z?{B>L_{3Jq1H9nHV$8FGx^HULL;M@yZ*jVogTp@9hqf?drC1#IDl&r}<0naVCB{>A zPli6*NTbO5Qn&hGb^$g5BP@uv4w^kC*jG6Vq<7)HCA*g}D3~+v*mi=1|96P=MrDxu z#y97-B~PQhM4=U>lrH0K97|VPQutCfgr4J<*H$WQ&1~fI(uM3NL0!LSBUTPB?^<(m zEL6-O?~U#9f+YldFE$6KO*Z4&<=sDUk&%(nFJgGzF~9UL38(U$XXEZTo1kamt0@+Tts)xa2nk0wpBn$S- zN*<5S;J`aJ!Q}Z52$$@fb^J89B}|Q%xAlvl>4%am;o6AVbfUWt%b^8RuTPNM{9eNw ziwH?orllS!zdV#;wd-={3g=eFJpC){d)Gm<=!r!8cu~n;9q&fQ$qVOYJV792ZA$%4 zZhP$W=_lM#spq1be_p34x9eIO)l9+j-|2lH4CW@bxn-zcI%a?Uy$XzBK|69XjMw?4 z?qbniuTP8gJZnM@4o0#*&|;Cfn}MDTYN}Lj8W`s0<{|$mzzxt7bUd%~3?A0jTjVO4 z(PDdEa%Uoxvp>`J6xt(UVBO6Go^rUKwaEO;uik&u0@*{uW3vlF{vAd%GQ0jxT9k3= z+HzN?uezIfM6lmO{lZ8nWH|V7ODMHn|G8}XhKeBD^5~#g2G8iFcR`p{D`UU#^2VHm zmoEFgS}9=Qi&_eVNXN4I5{NGS=NgB;v5I>eB{#>k-SDSWuCdjg(Xxv7Np7v+Ry|>G zWAzqsc6<0-K7BJ3bao;xzWSw1o_h26L6*315HJ?s{F#Kag2eLQfkmOAjr6{bCV>Q> zQ>2YgzGfnSS43pkL3xKwZd$P^xh*0=r;-bwm9?gr7X@J=PyoD5$w9R}ObXh#6#9D% zr?6pxr%Z8CR3Oi%zW7w!xOF@*z9hHSsRGVQoAz#Z-}kPB1-Tzf zt>wF`sjh3Oqzb?MDz(6xD}w5GayPksAy4=lmGdmZ6bbfp1`nH0!7O&QJ1x_4)KI!U zd?-#Z`7@N~>JyA~dJmg`C}v>y0x!g_ z*w3{Iwg`35aQGqUsoUPhsv%ziz}i zeTI95y4ATn`4{KW?(B7zN|!aYEdzb;*$AxkbD80{M0spp-ySBzMqEhOW~Va@9Gann z(dpjYZ*L~bN=iyz@#p%knzl<>Zk*H_qk{_UE4!;dyRih&cM?b+Ps9*GVFy- z<++w>Ltwb$JX&;QPHXzjlk1Dv>!1fY@R9{d;`3l`jfN3WvrFErl2En(!Q>61DE|GJ z!~=!;-CeEam|3lHKWPT~OQ0=K(i?UsBh|ARJ$Rs9#Eot2g2p^i8diqE=AM8r<>b#B zbk~fj%M;!V`1dz(nG{qy_2W$l8lA6fpfm#GGdHJv#%_@K#^2B_!%L;oE%SuIqL&Y+ zO{u+v21p>i;=?mHS4+){he=2!_;-%1@(E$9MDxH7R#qG?$wdHq@i&)^(hBQlpXtkyU*e~ z?m^D+l`w&4qPOqdZsbk}hlk6FIB0t@cxRYl*jbzFIlj`C8c%yxIbMH{O z`77YKZY|RJWveO7G@keqOVr)^;rf^47-;^6tnOa+6yX#068Q1yby3&6(j2w3S?(de z#Q=)s$*dLZ%ZVqU#s51RV;ZAe{}1T zA<%5F9&|m7qXvCP7>h&v_i8R)3>?K*x? zqKOOe{$0GOmdbZKA=&NeWI@wJs%&3BtDM8A{nZbq6kn%P1I>qVb`q&*;EtSk_dq+~ z$2iGmYCdV?Ic0PZ5S|@+I_5_q*5J`KsXcYI+df!!!aaGNp~&=bvR{NmE>ZNz&1m%D zNa{0CsAi95&#ZWf^4{8&)eDAl^IrkD6tg~{BgSO`_~LX|+qeMIwEzwqL{p3W`g<(i zy9A7`a4kPmZ}%sUQ-t_mcAOFDgcLtjR$`03OqUH}y8RHi11B-c&Z`@oKjlvWjpgjn zr}{~zosu6tCNiOZ6WTy|?Y$gJ>gz$wAm8K#+?+`rVG^$7QrBNd8cp%5W%A6U+kjJz z%=!l?iSd%75dre^Px$pI>Dt&+6MnTGXH}QLJ5MxQ5(~1iT;j!fEq{%|#0!|xD8_49 zi+S_9#V~WQtK!vfN7CVUG0U9 z>R8CN%DSxF9~$pLxel|y@)V@?PC}J;=vCI(19qJ1nd^JFuvkGK;JZm-86EmaO>A6B z4>^yXX&eoPzKAF?VY$cw1fV}d*{+^S7EIh;_ZJ9$Y6GzYz5VhfAo@vD zO^pW&v<*A4mML{JaNb5I6D>>U=pJIDB(SPj(;j$fwKcu1VVO)m_Xn{VlvO7hPU~zz z5Q;g>Y?+rRr=Ip6|L!EKbiSK))DLq*d@hyTMN-R(p$@`pEPb6#++zLjhdlD~IQfmL zxYc2qh^Xx(q-TV@CZE4aEO~Fc*LyV52lQ!g<@7J%Oz_4*O7_0zF1IG? zCSD32Fsm1+3xIstRG+gRH>*W8PZYmtN+smbiWm)1E zSH4s4#LhM*N8OEfM-s|29-089*++9kio)mAAjTh!vfD3b`J$pns!kt8lX+veJd-TC zn5P=@3}h=x{~qFbr=+Mvt=%x9?)O&R-r6l4{t*_-WI&?2!h-=Db57_lb-{I}QMWyS zEu%WcMVZ$5R)CzH!Zt)>Z&yAgT=tw_UEUBmA7 zCW%!t3xr_GP)Pt`Md<$h@o>j@)Hzt)zGKrRY!C#>#-< z8bRR;V({nzx2@oNrGqn zPc>jYiX&&W_MSS`KNpN1T&2}hSb*r+k~1=R#oC}Rj4pBtFQ zRvAD4>HTYi$cuzfXR-7!>vFpmjM(m+Q@C+mi#_c{vt~fj5Vc7Pj<6xtOVE$HC7>V_ zsfqPn66dA{*!9N?>yaqC;x(7!aA*8IZBNZV&;<9CdhpDZa@(csIEu&U72Vs-xP4@? z39gKkzxP6AYpKucmvt-dy!Kkw-whp(X?zv90!X4cns0J!d~%e* zToaF45-U3w1^OwI$(j^YAX)pRr^`BY}={7M3G#emNrn zB$^*y9bzf$$j{utoj46nN3LnjI7pJwPLjr&Er1AB|q zNP@03x8K>EGkTL(&(J%BD!LO+xy(#zTO*aQ2jHy};KOLQY0heFVESF?nf|=zN!GBZ zkyllmdYXQVl@lm#lIe20KX5&Lz$$=X94%nRy<4{Wu>FVap~kB6CQw}QNN-Krii*l}8cnGMzSSldUv#c-a^4ljF_>aE{Enq- z6b$$&xMSZp)L`GCeB)sQ?X_q7xn43k-Jdk;89qL~0)}Ap+&bXyiF~1}*@A$rFw=vX_R`J|nP%A@b!)~E<)in6Mj6Vclh6Py} z30)7Ge1}*rhX`(h6H5EZDx3rBP87ZOGIa(G?O>@S_)H89_nN!+URc&8y_QKgeuHdy zVi$%pUH$zvUk?KVm`K~41vLQ%#>+Spm^0VkDvEfQp6flBSF81N+Ak=o>rUEBl3aE* zEpNKMfUDMbZw+w%kyd;f?o6mSUx;WiaL8;n^H3ZnacPOrt*uM>ZPK;*2&1qwX(j*~>+lynR{+p(th7VpTdveZ zr&|4X=A&9HyWGOC^#E25@c%GUS!fW|DxDE@;fXj1**H>lgi=eVHPti&I(6tw4xkBK zvJ(Kr+2+r1$CxhJPs1@I;p}^S#F-4}o&K%g^gEolx9T9$udHvojLPFB$?Vp?&z{CL zNyDa!$P|%X^8xxx#QGAHOVt!UK1P0iYnZlQbCyc{h;qJ=H#e{%+(Q84v)xa-p+5>* z5H>dKIY6r!%bKYju65-7HH^w+|3W~Rb_7Px15=aIwUmp0?R-74&;LlMDFEtNwDfd1 zSR9d+CgNosjvEXC(p!AUjV}%4)b#>;y7yW@{y#^OCtb|{o{VP{b!*!thSD<#s%SeD zZR%ZGp*C##^7XNPa;oWj*HgO-(!+<~${SgU18+39GDeBp_$G_{{YUh#W*oT)J7AoU zm+Z@5)BWb3F0f~PK`l7o4Cfg;t4wfo{Y6V_N8+X9uQs?1kv*5hxiAJ9fv~ z)F2}nEGMq@CDIAMFP;QP!-M`9wv?67*V35z%afVTi`(bbi4N^EaSiC#p^99e_&uq- zF2XU30D^lQ(9)OT>{Lbaeiz3!Ff(R6=?doBU43#>s`25<{}y#z?}))wyX;9?YRej@ z{iRR&m(wNZi00h;RvEHG7nJ+T|I^-g#>2UG>n9>XL`?|MJ7GxCTY?};h=|^zcS6+B zq7%`35271o7@~_BCWv0f=%bA`7=uyH?7h!9Z_fU|@8|!QJ)fT6e7f&-uXU|!t#v=o zRpajsbc`aMQBH}k00xZWI|L*S|M1kg|JdABBaO>$Y{j$X&GrLIZNB?x!-G!!4e4Qd+$mm@U=Dc9LWxfA(622$IpF-PxjR>$Rt;f4 zB`xeOHPIvDV>}D?uJYm4sj})jeF{bCL3RT;0Ylz?cst3X#g@4 z=v3=TNmv>qogr9vFR=>c+qS$FaAX|o+~#SM2zU0*Lbb{>z+#|VE`{>~f~5-QbJBc9 ziJ7Dm`*R0Uc1aMT1?x+jXDZ*S)b656T^nqxZwBs#KKFr7NiV9MxDET1{tR#=6XhRX zF`k+%01&nA7gDd#{DFs4%8?au=DK5U8YR;)AYdIE_vUqnv6DSb^>*g&eO<98LL_J z+Xqfnx=V_|hW8eFLed}PnA6vH*z>+?*LFa4CH@qHXVhcWcjR^(F25J*9Dw zB&t=PfN`y?sXU91{NwX0!tt6P$Y)#Y0zIf2bK*{ZQ1Q@3!FkhqEyGB!SyPNgN*gFGv5U&4C$EZUKQtSgnomq(H!G^lsmpPHq?r# zGrH&Nx7*7}X@&#QwA9`S6<_a!%2$RMx8pTVqS2dBqf_+Zt5ervy$a9`N?zFyqk$2)ZFNLwYYaxLda75r@? zZI8GiO$oM??95%oVC4)DMUyL~fW5E=%mk2~0@HGouGP~~wI6T$GhFD>v2hY>Vq@w0@3*6AF|sY zqE;juBt3sF2^5|h0z>3*Rns3-^xAd8b2L7=*A=jrK+MfKMs9Ipr2oVan8|dMiWuAB zJLj5zmIcknwD@{?a;QA9bp?+zC~-`0F3kry`xxx*yuNkx(OF|EDn@x)1+J#pnn_T% z1G>nm2+zDxVI2DWQ;Va06M2do!<$Ubdh}8e)Ee@jz4x`nGq+7XgS}J58`wE`zw|i< z2|E~GkPcUG8=0|8|H1mJ$_>^z)#ecepvgou5;Os`gz(SgpI@>!P%HFh5WIAv%urir zdZm4~)O;l@0oIPri)h$uh2nl0e7TbDX0k&c2dpjvAk7_;kl#ghSH@n#Q zOe+*2gwOno4iE05s#E4)brsKz6++o%IW6Fv<)e=_#7`=Hdz@9OnDRB;a%WGO0oN6Mseuv_XurdKWgj?=NnXHn}O z9AFiwk$T?Jy)OT9?;`a)9ce~6@_p}1ongP5xfo_h+b8>@;L*0V&Yc$)dr-_2P!o;oZ%8iJ>>r3Xjorp}4al_lr z?v0<+DEO(jgS%I)AE)}A1I@qd(PA-T>rDJQk_yv)!9J~cD>&LNcWOs=pX^l{wyr>| zZ6!2dP+V8gRC)mKI$;*|^;q8FXq6qQQibUI%UWhaYM2(_XPk|3?)XPN|FHu}@qE!w z>KK*gXv@qvhZcMW=16DU05Dfr(AJONDfw`^m~ER<;gcTc=jEd@ZAu zdIhcEdszWt{nE1>C=}ELm&Eq99UiW7jhZ@6O<3o8kGo_r#@R zDMQ{zl*D-mkw@VfaOG-HiAXTzA?}F>xLaO#a?zR9jA*Xkh7C}*%=$91|0Km%!-;=w z7BO!zb!YUL7f9p=NxGyf{`5MO38Xdz*y(06OoM{)wbeg+wCKKrq`mPg_Ka0*capBB zLoh}1gpGn0Zl;HGz1A#7Q{J>2plaq1?s?a2QBAn>W-WqZUD$a_t#TA!j=V@;91Z7TvTfXJM~vIsK;2UTcxGd zfDh{6Z{TG8A+kjW!FAzXkBK~gM#{18E$k&g?G;Y#y&@(pPf+~J=)AKkHiU3as^b_* z9*4I=J!+mRZGhs?2kq(?&Irup&>HO0xUD^3-qC)ulkJax;`^bvJ>CCa+=5l8x=F)ikJ#>94QR-g%C*! zIm~65flo~XJNn7vnCz}1iloUqOJ8VSy13*^7oq$p_YM86qKDP)l6sv<`)Ev` z%Fw;yc-W3*y>j9c$mMJ)T-@6)s&ifUQH@HdZiZU}FtKZCf|y&mek7HX`}+qbxgTy2Oj=_5!BGF3++T%{{5u<*EHE=XO)t&D&$b9)4S=a?54tWOV#%+=2>U+%^gwAm z+1dEioRmlBzS<83C+ET^r0s*Vg!h?-sbg=DZ%_q31Wqb9Ud_BxI_lbB-ZeD_w|li5 zy|8<%3+#LX@JZ!-@cd%M;N+X*5E@na-Zd*X)-&~tE#^>tN1M%s?Z?_Q^KgsNgs_5L zUumh=wwlQ->Gr(>%@|=xXzjB`&Q4tCT=X$sfS|Cu3w_^Cj0@b$;Wy`Nk-m;Uuj3Hx zRh{~Bk>Jqr#HQN4ut)6v0NGx`1NQM5D~Do&i|iP0Glp6QS^ zc|$d*pjB|{NwMH9O7Hv7P~$^}{@c23Y{~ojINitxay=7Y4U}UMXu{8yp$#)$`Rv3f zyBUQ=mq>>hsY!NKYILe=PIJ;tjBft!48oGIJ-2NxIlyoj(P>^_-u7U%z0p{p$?5>T zbI)t^%`e!g$XjU^^hQ$@8p*~I0-i3j)=$qmSgwf}nG!7D-sOD*0WsStP|z|k?i z{MaSVWG|&56dX?m2h9e!qBtvq1rB=7PY>Ns-LS8v1y&pMbOHkiBZ$t%zt~OcZXp*+ zF9ka*9f5N3%0xVt#{3_hN2e_gj40ldMKDcnA(&PQK9yW#RX3OsD|;pVvjiWA+ko5JA5CV4_v?@Y;Xnf;&(D{XQ(D&#y6lKYv~(l&#p@7OC*E~I8*jJ!0ud89a}*+v9dEKjYBPEt zfVkvf8?1x@O)ItF_y`{WQ*-;}am}1fYXWiDleV`$%8TgoIqIDq^9BlsWi+b#ml{vM zPTc)~H6f~I-{*^hL?w5(o2a*UWjXUmmoIJdgw8%;le_GyW;}D~qn~Quom$_Hy`s>@ z{5VJU9-XFpuI5N!3A4MYMtrj4tYGV>d!>ajc+zW6bE7chjUh7sBA|a|e2nt7K#Z1w z0vU{wjFf4l)jD3Svs~-u6;C(nnCxJd@VksD%R#T|9UjFp- zLaQ;(C#<~oL-8A7Waylr%`$T#MIu3~-9`VLb`!NVe1O{R;(mT?C>K-WO%K{vP}NKK zfQysn^PTzRPyjI8x=DG}dzG*lQ!fTQYMbO*lCpxHu2)?zGZHzK5`F7*Q(gT&Xi5((>_!_t{Qp^jtM-mSTovYic;3&PEb~$o8?}=&b%$tW8@=ENh2?5as}&!#0K03=)q z5D1m#QqY9{v@Db`;fJO+6GS#+5Ke6mEm>3Pz}?0JkE_-Ocvs?Q_3kU9!Ap^|b4Bhc z$P?QyHEKr`0xYcdV_4D}nxrWs`n4N)Tyh;#twxhx{lmrOZDZHc;Tzm3y))a2r)<#@ z;~Jmuj}2X}=eoFhyH&E;%pltuv8(GcOvfJ?BR2~+ui%Nxah*>;*>~Uw@c;FMXX1Zk z38(L8)keAfu<#wx{Pn{-L?ccCzxrC(0=1VbLnRGR)Tb5|N(^^>Up_JNYsVjY7|Ai{@^qyb$oh-9Yg~@Tl0g*AWK12g{3(*N+Zs&3% zNXeW-1+*BMZs<_bx~elH?L{yK1#7D~u73JH**vlf{sp1(pmOz#_8JvV?VX%sYuufl z7W8T#pS4bJM!*$Kai)`H2Fhru+fRv>`5YZ=$ewvUj0t^1+^Wu?sSls`OmbVd=>;Z* z1ZD3Q?5oL&UAp11YQ=J>)yAm9SELJQvyWH&Fru*E;PS7I02?K)OqkG4yqSKW4pq6& z&UAz!+W~@y$r{qdyUPWkH=y4=sFuK+a^6m8f#tf; ziApwZXNK5&$9=4Jy|Et*C|Ez(#Wp|!mRFtXF6wF71O4KJpBN=0xYOsV8tVxhYf@F} zUwjhj+Z2xxOAE)JC@EgvX0H}T3pYLdCQS4|Y0OF=nU$=o)(s9le&+R*NU{aB_TdF; zvXkqyoqb8I+PWFbYH4D3D~*f7YD=B*li>#kZ|TVbzFeh;ie-HSWL>T6ElFj4B@vep zF-f&d^1pc{`HBA@@B}m%C)nuWQl%Fokx9R@&JXb%j*55-MLZ|!yE1Xsb8)A zjDWO8vj<#Fk5_lFmonJ9LqkE%$x911z z+DvQ$*lKh>)yx{Y|;nbbBBj8b7M#g#5Z;-fPMuf7V`W{E`APjD%Rd-Zmj8X zn{@K7o;!9yqPfWRn}1uXwUfZa+9QtR-=OQy$3;cvj~!UHy3uxx-mT?4&LtfTfM4Iu zP2N}I_o^B zpS#$B%Bkjf06gz}7%W*6)`Pn0+-_PvZTZ=sJ2XMmr?1^x<0S1Dfh#`$yG8UnUM(Ks z+~T-pu)M>*W(20S7;UGLdPiks$9fCSQ_%P+}jah@x%w{FA zTv90F^qXOpy2XfnK&_feB`y1+{>a>bpIkv$*hhL+@ZqOtenr%!tpyxWZuiof1?a^; z1*CcT#d zWS*`;mP7ZX;u692;T>HE^g`YbZ)UHu&yz3h)68|EbfMtb5cmU)aM@oI{N+JmVBAjc$0wcJ1)OAK>~<>+l!_v_o0FI+fv5xQx?W@2XZ9oGAE8~DuI`WHpYvcf zPtgpa9Mx(hQ}_mv-Jqk4Ctt_ZX$7B*dTa|#meG0~rOS)o-riPl&jMOaPFCJkRHP#j z)o~XYrM{2z1JRnC9rv%(>~DG|?wJt0iK<7-y_t1V0bpB)3W?XjVy@kkiHoes~eA65Y zM`oQHav-V3SylgA)KkQI1(mCnraICs*~%Le3lo-NnQCudXiG+YsVA&|olaRHYjz-n zjOQr|OL`a$<}I!tjCYy6;HsBBsr!*`hP?auUQ(ZZmI7sT$voq1uA@a^Y(&Os)A`_a zM+gk88FOIGN8B_9j;Fh&9wz*Vtp=!DF@U}ZKHuht_8|=#xl`1Qh}tFeRA81}PCQUU zqK2->ZsW+VoE^uN{@JY9v?hJI+7C0n)tUs(*7HNZ0xFfmyrTXCkk$POWUV`74g6Zu zBvHQzlYVhO_FxbFz@GQ(NnW(Cqt@1;?6|vRXsEz+_1om`(w7E}=DNyBEm$vuBJicu zv)q35J-x=J7VdTHV^}#+kF0Oqt<8JMI$t@k+C+&wxOXBd8Dxu(!fW5m>J2H>jSrxZ zkE@L8@0A;+NOG|X_HB7&ra*qFcG-#{ewY}@5iPPD;O>%6II702bt({b-kVup^A>-w zOT`*+Is_>Ap!XPN=4oVwiE`yN#ax;)vQ}}a!TPnj_N zTbuW?aPk&?@Qi<|liZDB7>jpYf{k;n@P7Ue#$dM$}`ab!6Ky`>d zsh%?No7jGCg+c3a+x^u3)31aT?})#UjwfjF`HEvcOC)eqfMPZ8dFU2t_P|loDSZht znMZORTJ%_Ak03UKpUUGTsRS-%2ld>Q?b(-KpFv6FCKtlHC`AsAQIULZ>y~Y^Dd{ha zt^iYX*#&9!)5&S}F#|Hz)6v00&d0&|`8))OJvSrLWL^(Gm^exHntV{@@XuM><}fS` z@xOY^zg1!#N_U?xN^P#C{^Ty7Bc}#PDl0i|D{)8`Rno{7AaMH!RBSmr+uDINWQ%&B z*;zx%wnhUN9ljhYlQXQJwXPPNb1g?C`1e*jmj)*qLl#PXkBi>fB29fN&|e))_2^_P z_$-pu2B!{6w%z59NLX~SJc1GuJrEjuly(4VY7i0xpIq5Z*c$}bkm?#PpQK%O<>?+TL#_2+Yt3iPx-oWrFL|6=BaKI z1W^e$7L_ts4Ewe1IF;AWgDjpEzv{@3e#bDvYIV!v-B&8xRmJF8BD25lB>x>97DI3` zk@MR8Sy`D0S{fyGj0zQ~fx%g(YD5f>v4;;zasAn&M(KsF#)E2(ys!XhY) zXAzN`a34a~xoo^a^@um2CYQR_^g3Nr)y-Eb31?iGo7Da~$1Zee3 zU_?Vef&x{dG}JW4ayoCS`69;6QnkQ(R7qK$ZObGuh;~qAg|Fk4J<@Q>`sZMAA$A!DL`}^%X ziEqr$w=WDkITWsaCcC*NK4X;?!4TAhX&ECfGED%`H-Q@V*~RJxyDB^jaTD$ zkdvz}d-Cc&*=6}ILYioIO3-|A>CG3L~?Uj;HXPlk2T%?nYzXbeX1BwhC_2&L!`5j!qcHQ zyg~IzIN695Yz44L-pJWNW^y)q-4*;FSRo&d6(%~K>AT<*NQnRrc2uqw+fysXiZ*xS z%)YLi;Tufs3hHHm^Z?u9P7xKZrH_tsE1Vg&`};j8g8^S=!BdwWimuS=xcvtyZPejZ z+DR#9!pqem<~@)KTNy8|CC_SI9@VzHEidET=c%=KI=`p1&~EQfe+G-Hr#jz76--m) zBz7q=L(tBuUyBkAC*Ibv4H+gDTl&22Kd67psy zB5KehXH2(HpIPg97@~MMTIuJ#Epppx{ic*sFCLLU-z75{xq9(!(jd%a~jbCRC4r;uKtO+#%Xh>RCWGHt)xVJm%CP|*P zP?Y-%3O9yPZrXvqX;cv&Rvy;At56RJ5vuGuPwnsPz3g&nS!uE@;AEh~zI6Bx2SxM8 zF6{SLw)D9i1bbHG6tO&#R_{DvEb#*x=S{F^m^fpJV!IVQC;8M(Q&RM*(2V|t+CXZ&U668O!2q_KO#fL9@?zB5L5@FXfMa zH>7aOnHPCX_3z;ohcRckW^Y3kK&AEX3Fv=HlE8UfM&9wet10tu5enBr`%;A)QDJAn zdZV~u}s;~y0Lzq6Qsa?0;X;~#7M|FFi%6|0ei|KnES R&1<-ylDyiBO4)Zo{{<`=A$R}) literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/workflow-diagram.svg b/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/workflow-diagram.svg new file mode 100644 index 0000000000..746b862fbd --- /dev/null +++ b/content/en/blog/_posts/2021-12-21-admission-controllers-for-container-drift/workflow-diagram.svg @@ -0,0 +1,6902 @@ + + + + From b90d125e1cd5cd78f75945f1d2956b268cc6542b Mon Sep 17 00:00:00 2001 From: Brandon Smith Date: Thu, 2 Dec 2021 09:45:34 -0800 Subject: [PATCH 103/148] kublet -> kubelet (#30700) --- .../tasks/configure-pod-container/create-hostprocess-pod.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md index 0c33c79552..e989aa868f 100644 --- a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md +++ b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md @@ -45,7 +45,7 @@ privileges needed by Windows nodes. ## {{% heading "prerequisites" %}}% version-check %}} -In 1.23 the HostProcess container feature is enabled by default. The kublet will +In 1.23 the HostProcess container feature is enabled by default. The kubelet will communicate with containerd directly by passing the hostprocess flag via CRI. You can use the latest version of containerd (v1.6+) to run HostProcess containers. [How to install containerd.](/docs/setup/production-environment/container-runtimes/#containerd) From d09282b3f023b390f133f6cb7c6d5f3adfa2a67c Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 1 Dec 2021 17:18:37 +0000 Subject: [PATCH 104/148] Tweak FlexVolume deprecation text --- .../concepts/storage/persistent-volumes.md | 24 +++++++++---------- content/en/docs/concepts/storage/volumes.md | 21 +++++++++------- 2 files changed, 24 insertions(+), 21 deletions(-) diff --git a/content/en/docs/concepts/storage/persistent-volumes.md b/content/en/docs/concepts/storage/persistent-volumes.md index 619dbc8405..ea9538b20e 100644 --- a/content/en/docs/concepts/storage/persistent-volumes.md +++ b/content/en/docs/concepts/storage/persistent-volumes.md @@ -221,19 +221,19 @@ to `Retain`, including cases where you are reusing an existing PV. {{< feature-state for_k8s_version="v1.11" state="beta" >}} -Support for expanding PersistentVolumeClaims (PVCs) is now enabled by default. You can expand +Support for expanding PersistentVolumeClaims (PVCs) is enabled by default. You can expand the following types of volumes: -* gcePersistentDisk +* azureDisk +* azureFile * awsElasticBlockStore -* Cinder +* cinder (deprecated) +* {{< glossary_tooltip text="csi" term_id="csi" >}} +* flexVolume (deprecated) +* gcePersistentDisk * glusterfs * rbd -* Azure File -* Azure Disk -* Portworx -* FlexVolumes -* {{< glossary_tooltip text="CSI" term_id="csi" >}} +* portworxVolume You can only expand a PVC if its storage class's `allowVolumeExpansion` field is set to true. @@ -270,8 +270,8 @@ When a volume contains a file system, the file system is only resized when a new the PersistentVolumeClaim in `ReadWrite` mode. File system expansion is either done when a Pod is starting up or when a Pod is running and the underlying file system supports online expansion. -FlexVolumes allow resize if the driver is set with the `RequiresFSResize` capability to `true`. -The FlexVolume can be resized on Pod restart. +FlexVolumes (deprecated since Kubernetes v1.23) allow resize if the driver is configured with the +`RequiresFSResize` capability to `true`. The FlexVolume can be resized on Pod restart. #### Resizing an in-use PersistentVolumeClaim @@ -362,10 +362,10 @@ PersistentVolume types are implemented as plugins. Kubernetes currently supports The following types of PersistentVolume are deprecated. This means that support is still available but will be removed in a future Kubernetes release. -* [`flexVolume`](/docs/concepts/storage/volumes/#flexvolume) - FlexVolume - (**deprecated** in v1.23) * [`cinder`](/docs/concepts/storage/volumes/#cinder) - Cinder (OpenStack block storage) (**deprecated** in v1.18) +* [`flexVolume`](/docs/concepts/storage/volumes/#flexvolume) - FlexVolume + (**deprecated** in v1.23) * [`flocker`](/docs/concepts/storage/volumes/#flocker) - Flocker storage (**deprecated** in v1.22) * [`quobyte`](/docs/concepts/storage/volumes/#quobyte) - Quobyte volume diff --git a/content/en/docs/concepts/storage/volumes.md b/content/en/docs/concepts/storage/volumes.md index 792ceae69b..7a0be7e524 100644 --- a/content/en/docs/concepts/storage/volumes.md +++ b/content/en/docs/concepts/storage/volumes.md @@ -1155,8 +1155,7 @@ To learn about requesting space using a resource specification, see ## Out-of-tree volume plugins The out-of-tree volume plugins include -{{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}} (CSI) -and FlexVolume. These plugins enable storage vendors to create custom storage plugins +{{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}} (CSI), and also FlexVolume (which is deprecated). These plugins enable storage vendors to create custom storage plugins without adding their plugin source code to the Kubernetes repository. Previously, all volume plugins were "in-tree". The "in-tree" plugins were built, linked, compiled, @@ -1289,16 +1288,20 @@ are listed in [Types of Volumes](#volume-types). ### flexVolume -FlexVolume is an out-of-tree plugin interface that has existed in Kubernetes -since version 1.2 (before CSI). It uses an exec-based model to interface with -drivers. The FlexVolume driver binaries must be installed in a pre-defined volume -plugin path on each node and in some cases the control plane nodes as well. +{{< feature-state for_k8s_version="v1.23" state="deprecated" >}} -Pods interact with FlexVolume drivers through the `flexvolume` in-tree volume plugin. -For more details, see the [FlexVolume](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-storage/flexvolume.md) examples. +FlexVolume is an out-of-tree plugin interface that uses an exec-based model to interface +with storage drivers. The FlexVolume driver binaries must be installed in a pre-defined +volume plugin path on each node and in some cases the control plane nodes as well. + +Pods interact with FlexVolume drivers through the `flexVolume` in-tree volume plugin. +For more details, see the FlexVolume [README](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-storage/flexvolume.md#readme) document. {{< note >}} -FlexVolume is deprecated starting v1.23. Out-of-tree CSI driver is the recommended way to write volume driver in Kubernetes. Maintainers of FlexVolume driver should implement a CSI Driver and move users of FlexVolume to CSI. Users of FlexVolume should move their workloads to CSI Driver. +FlexVolume is deprecated. Using an out-of-tree CSI driver is the recommended way to integrate external storage with Kubernetes. + +Maintainers of FlexVolume driver should implement a CSI Driver and help to migrate users of FlexVolume drivers to CSI. +Users of FlexVolume should move their workloads to use the equivalent CSI Driver. {{< /note >}} ## Mount propagation From 8a0f330654ed500520f4c34e145668dcff1ede24 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 1 Dec 2021 23:50:18 +0000 Subject: [PATCH 105/148] Improve documentation for container probes - mention gRPC probes in concept page - revise explanation of gRPC probes in task page - general tidying --- .../concepts/workloads/pods/pod-lifecycle.md | 106 +++++++++++------- ...igure-liveness-readiness-startup-probes.md | 62 +++++----- 2 files changed, 101 insertions(+), 67 deletions(-) diff --git a/content/en/docs/concepts/workloads/pods/pod-lifecycle.md b/content/en/docs/concepts/workloads/pods/pod-lifecycle.md index 75e4a0ba34..5d75bba37d 100644 --- a/content/en/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/en/docs/concepts/workloads/pods/pod-lifecycle.md @@ -233,57 +233,87 @@ When a Pod's containers are Ready but at least one custom condition is missing o ## Container probes -A [Probe](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#probe-v1-core) is a diagnostic +A _probe_ is a diagnostic performed periodically by the [kubelet](/docs/reference/command-line-tools-reference/kubelet/) -on a Container. To perform a diagnostic, -the kubelet calls a -[Handler](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#handler-v1-core) implemented by -the container. There are three types of handlers: +on a container. To perform a diagnostic, +the kubelet either executes code within the container, or makes +a network request. -* [ExecAction](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#execaction-v1-core): - Executes a specified command inside the container. The diagnostic +### Check mechanisms {#probe-check-methods} + +There are four different ways to check a container using a probe. +Each probe must define exactly one of these four mechanisms: + +`exec` +: Executes a specified command inside the container. The diagnostic is considered successful if the command exits with a status code of 0. -* [TCPSocketAction](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#tcpsocketaction-v1-core): - Performs a TCP check against the Pod's IP address on - a specified port. The diagnostic is considered successful if the port is open. +`grpc` +: Performs a remote procedure call using [gRPC](https://grpc.io/). + The target should implement + [gRPC health checks](https://grpc.io/grpc/core/md_doc_health-checking.html). + The diagnostic is considered successful if the `status` + of the response is `SERVING`. + gRPC probes are an alpha feature and are only available if you + enable the `GRPCContainerProbe` + [feature gate](/docs/reference/command-line-tools-reference/feature-gates/). -* [HTTPGetAction](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#httpgetaction-v1-core): - Performs an HTTP `GET` request against the Pod's IP - address on a specified port and path. The diagnostic is considered successful - if the response has a status code greater than or equal to 200 and less than 400. +`httpGet` +: Performs an HTTP `GET` request against the Pod's IP + address on a specified port and path. The diagnostic is + considered successful if the response has a status code + greater than or equal to 200 and less than 400. + +`tcpSocket` +: Performs a TCP check against the Pod's IP address on + a specified port. The diagnostic is considered successful if + the port is open. If the remote system (the container) closes + the connection immediately after it opens, this counts as healthy. + +### Probe outcome Each probe has one of three results: -* `Success`: The container passed the diagnostic. -* `Failure`: The container failed the diagnostic. -* `Unknown`: The diagnostic failed, so no action should be taken. +`Success` +: The container passed the diagnostic. + +`Failure` +: The container failed the diagnostic. + +`Unknown` +: The diagnostic failed (no action should be taken, and the kubelet + will make further checks). + +### Types of probe The kubelet can optionally perform and react to three kinds of probes on running containers: -* `livenessProbe`: Indicates whether the container is running. If - the liveness probe fails, the kubelet kills the container, and the container - is subjected to its [restart policy](#restart-policy). If a Container does not - provide a liveness probe, the default state is `Success`. +`livenessProbe` +: Indicates whether the container is running. If + the liveness probe fails, the kubelet kills the container, and the container + is subjected to its [restart policy](#restart-policy). If a container does not + provide a liveness probe, the default state is `Success`. -* `readinessProbe`: Indicates whether the container is ready to respond to requests. - If the readiness probe fails, the endpoints controller removes the Pod's IP - address from the endpoints of all Services that match the Pod. The default - state of readiness before the initial delay is `Failure`. If a Container does - not provide a readiness probe, the default state is `Success`. +`readinessProbe` +: Indicates whether the container is ready to respond to requests. + If the readiness probe fails, the endpoints controller removes the Pod's IP + address from the endpoints of all Services that match the Pod. The default + state of readiness before the initial delay is `Failure`. If a container does + not provide a readiness probe, the default state is `Success`. -* `startupProbe`: Indicates whether the application within the container is started. - All other probes are disabled if a startup probe is provided, until it succeeds. - If the startup probe fails, the kubelet kills the container, and the container - is subjected to its [restart policy](#restart-policy). If a Container does not - provide a startup probe, the default state is `Success`. +`startupProbe` +: Indicates whether the application within the container is started. + All other probes are disabled if a startup probe is provided, until it succeeds. + If the startup probe fails, the kubelet kills the container, and the container + is subjected to its [restart policy](#restart-policy). If a container does not + provide a startup probe, the default state is `Success`. For more information about how to set up a liveness, readiness, or startup probe, see [Configure Liveness, Readiness and Startup Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/). -### When should you use a liveness probe? +#### When should you use a liveness probe? {{< feature-state for_k8s_version="v1.0" state="stable" >}} @@ -295,7 +325,7 @@ with the Pod's `restartPolicy`. If you'd like your container to be killed and restarted if a probe fails, then specify a liveness probe, and specify a `restartPolicy` of Always or OnFailure. -### When should you use a readiness probe? +#### When should you use a readiness probe? {{< feature-state for_k8s_version="v1.0" state="stable" >}} @@ -329,7 +359,7 @@ The Pod remains in the unready state while it waits for the containers in the Po to stop. {{< /note >}} -### When should you use a startup probe? +#### When should you use a startup probe? {{< feature-state for_k8s_version="v1.20" state="stable" >}} @@ -451,13 +481,13 @@ This avoids a resource leak as Pods are created and terminated over time. ## {{% heading "whatsnext" %}} * Get hands-on experience - [attaching handlers to Container lifecycle events](/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/). + [attaching handlers to container lifecycle events](/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/). * Get hands-on experience [configuring Liveness, Readiness and Startup Probes](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/). * Learn more about [container lifecycle hooks](/docs/concepts/containers/container-lifecycle-hooks/). -* For detailed information about Pod / Container status in the API, see [PodStatus](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podstatus-v1-core) -and -[ContainerStatus](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#containerstatus-v1-core). +* For detailed information about Pod and container status in the API, see + the API reference documentation covering + [`.status`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#PodStatus) for Pod. diff --git a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md index 2ef2b1368c..1553787301 100644 --- a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md +++ b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md @@ -226,51 +226,56 @@ kubectl describe pod goproxy If your application implements [gRPC Health Checking Protocol](https://github.com/grpc/grpc/blob/master/doc/health-checking.md), kubelet can be configured to use it for application liveness checks. +You must enable the `GRPCContainerProbe` +[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) +in order to configure checks that rely on gRPC. + +Here is an example manifest: {{< codenew file="pods/probe/grpc-liveness.yaml">}} To use a gRPC probe, `port` must be configured. If the health endpoint is configured -on a non-default service, `service` must be configured. +on a non-default service, you must also specify the `service`. {{< note >}} Unlike HTTP and TCP probes, named ports cannot be used and custom host cannot be configured. {{< /note >}} -Configuration problems (e.g. incorrect port and service, unimplemented health checking protocol) +Configuration problems (for example: incorrect port and service, unimplemented health checking protocol) are considered a probe failure, similar to HTTP and TCP probes. +To try the gRPC liveness check, create a Pod using the command below. +In the example below, the etcd pod is configured to use gRPC liveness probe. + +```shell +kubectl apply -f https://k8s.io/examples/pods/probe/content/en/examples/pods/probe/grpc-liveness.yaml +``` + +After 15 seconds, view Pod events to verify that the liveness check has not failed: + +```shell +kubectl describe pod etcd-with-grpc +``` + Before Kubernetes 1.23, gRPC health probes were often implemented using [grpc-health-probe](https://github.com/grpc-ecosystem/grpc-health-probe/), as described in the blog post [Health checking gRPC servers on Kubernetes](/blog/2018/10/01/health-checking-grpc-servers-on-kubernetes/). The built-in gRPC probes behavior is similar to one implemented by grpc-health-probe. When migrating from grpc-health-probe to built-in probes, remember the following differences: -- Built-in probes will run against pod IP, unlike grpc-health-probe that often runs against `127.0.0.1`. - Be sure to configure your gRPC endpoint to listen for pod IP address. -- Built-in probes do not currently support any authentication parameters (like `-tls`). -- There are no error codes in built-in probes. All errors are considered as probe failures. -- If `ExecProbeTimeout` feature gate is set to `false`, grpc-health-probe will NOT - respect `timeoutSeconds` setting (which defaults to 1s), - while built-in probe will fail on timeout. - -To try the gRPC liveness check, create a Pod using the command below. -In the example below, etcd pod is configured to use gRPC liveness probe. - - -```shell -kubectl apply -f https://k8s.io/examples/pods/probe/content/en/examples/pods/probe/grpc-liveness.yaml -``` - -After 15 seconds, view Pod events to verify that the liveness probes has not failed: - -```shell -kubectl describe pod etcd-with-grpc -``` +- Built-in probes run against the pod IP address, unlike grpc-health-probe that often runs against `127.0.0.1`. + Be sure to configure your gRPC endpoint to listen on the Pod's IP address. +- Built-in probes do not support any authentication parameters (like `-tls`). +- There are no error codes for built-in probes. All errors are considered as probe failures. +- If `ExecProbeTimeout` feature gate is set to `false`, grpc-health-probe does **not** respect the `timeoutSeconds` setting (which defaults to 1s), + while built-in probe would fail on timeout. ## Use a named port You can use a named -[ContainerPort](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#containerport-v1-core) -for HTTP and TCP probes. Note, gRPC probe does not support named port. +[`port`](/docs/reference/kubernetes-api/workload-resources/pod-v1/#ports) +for HTTP and TCP probes. (gRPC probes do not support named ports). + +For example: ```yaml ports: @@ -533,12 +538,11 @@ It will be rejected by the API server. ## {{% heading "whatsnext" %}} - * Learn more about [Container Probes](/docs/concepts/workloads/pods/pod-lifecycle/#container-probes). You can also read the API references for: -* [Pod](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#pod-v1-core) -* [Container](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#container-v1-core) -* [Probe](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#probe-v1-core) +* [Pod](/docs/reference/kubernetes-api/workload-resources/pod-v1/), and specifically: + * [container(s)](/docs/reference/kubernetes-api/workload-resources/pod-v1/#Container) + * [probe(s)](/docs/reference/kubernetes-api/workload-resources/pod-v1/#Probe) From 27b24fd4b2d8c31a7bce51dc4805a02cc53931dd Mon Sep 17 00:00:00 2001 From: Jihoon Seo Date: Wed, 17 Nov 2021 19:34:51 +0900 Subject: [PATCH 106/148] [ko] Update outdated files in dev-1.22-ko.3 19-26 --- .../docs/contribute/review/reviewing-prs.md | 36 ++++++++++++- .../access-authn-authz/authorization.md | 15 ++++++ .../feature-gates.md | 8 +-- .../ko/docs/reference/glossary/extensions.md | 2 +- .../ko/docs/reference/glossary/namespace.md | 4 +- .../reference/issues-security/security.md | 2 +- .../ko/docs/reference/scheduling/config.md | 53 +++++++++++++++---- .../tools/kubeadm/install-kubeadm.md | 6 ++- 8 files changed, 103 insertions(+), 23 deletions(-) diff --git a/content/ko/docs/contribute/review/reviewing-prs.md b/content/ko/docs/contribute/review/reviewing-prs.md index e0b07a79a9..bb98753252 100644 --- a/content/ko/docs/contribute/review/reviewing-prs.md +++ b/content/ko/docs/contribute/review/reviewing-prs.md @@ -18,7 +18,8 @@ weight: 10 - 적합한 코멘트를 남길 수 있도록 [콘텐츠 가이드](/docs/contribute/style/content-guide/)와 [스타일 가이드](/docs/contribute/style/style-guide/)를 읽는다. - 쿠버네티스 문서화 커뮤니티의 다양한 - [역할과 책임](/ko/docs/contribute/participate/#역할과-책임)을 이해한다. + [역할과 책임](/ko/docs/contribute/participate/#역할과-책임)을 + 이해한다. @@ -35,7 +36,38 @@ weight: 10 ## 리뷰 과정 -일반적으로, 영어로 콘텐츠와 스타일에 대한 풀 리퀘스트를 리뷰한다. +일반적으로, 영어로 콘텐츠와 스타일에 대한 풀 리퀘스트를 리뷰한다. 아래의 그림은 리뷰 과정의 단계를 보여 준다. 각 단계에 대한 상세 사항은 아래에 나와 있다. + + + + +{{< mermaid >}} +flowchart LR + subgraph fourth[리뷰 시작] + direction TB + S[ ] -.- + M[코멘트 작성] --> N[변경사항 리뷰] + N --> O[새 기여자가 어떤 코멘트를
    반영할지 선택해야 함] + end + subgraph third[PR 선택] + direction TB + T[ ] -.- + J[본문과 코멘트 확인]--> K[Netlify 미리보기 빌드로
    변경사항 미리보기] + end + + A[열려 있는 PR 목록 확인]--> B[레이블을 이용하여
    PR을 필터링] + B --> third --> fourth + + +classDef grey fill:#dddddd,stroke:#ffffff,stroke-width:px,color:#000000, font-size:15px; +classDef white fill:#ffffff,stroke:#000,stroke-width:px,color:#000,font-weight:bold +classDef spacewhite fill:#ffffff,stroke:#fff,stroke-width:0px,color:#000 +class A,B,J,K,M,N,O grey +class S,T spacewhite +class third,fourth white +{{}} + +***그림 - 리뷰 과정 절차*** 1. [https://github.com/kubernetes/website/pulls](https://github.com/kubernetes/website/pulls)로 이동한다. diff --git a/content/ko/docs/reference/access-authn-authz/authorization.md b/content/ko/docs/reference/access-authn-authz/authorization.md index b4d221c675..115966e077 100644 --- a/content/ko/docs/reference/access-authn-authz/authorization.md +++ b/content/ko/docs/reference/access-authn-authz/authorization.md @@ -134,6 +134,21 @@ kubectl auth can-i list secrets --namespace dev --as dave no ``` +유사하게, `dev` 네임스페이스의 `dev-sa` 서비스 어카운트가 +`target` 네임스페이스의 파드 목록을 볼 수 있는지 확인하려면 다음을 실행한다. + +```bash +kubectl auth can-i list pods \ + --namespace target \ + --as system:serviceaccount:dev:dev-sa +``` + +다음과 유사하게 출력된다. + +``` +yes +``` + `SelfSubjectAccessReview`는 `authorization.k8s.io` API 그룹의 일부로서 API 서버 인가를 외부 서비스에 노출시킨다. 이 그룹의 기타 리소스에는 다음이 포함된다. diff --git a/content/ko/docs/reference/command-line-tools-reference/feature-gates.md b/content/ko/docs/reference/command-line-tools-reference/feature-gates.md index 9767966cab..44815299fc 100644 --- a/content/ko/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/ko/docs/reference/command-line-tools-reference/feature-gates.md @@ -125,7 +125,6 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `HPAScaleToZero` | `false` | 알파 | 1.16 | | | `IndexedJob` | `false` | 알파 | 1.21 | 1.21 | | `IndexedJob` | `true` | 베타 | 1.22 | | -| `JobTrackingWithFinalizers` | `false` | 알파 | 1.22 | | | `IngressClassNamespacedParams` | `false` | 알파 | 1.21 | 1.21 | | `IngressClassNamespacedParams` | `true` | 베타 | 1.22 | | | `InTreePluginAWSUnregister` | `false` | 알파 | 1.21 | | @@ -138,13 +137,13 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `IPv6DualStack` | `true` | 베타 | 1.21 | | | `JobTrackingWithFinalizers` | `false` | 알파 | 1.22 | | | `KubeletCredentialProviders` | `false` | 알파 | 1.20 | | +| `KubeletInUserNamespace` | `false` | 알파 | 1.22 | | +| `KubeletPodResourcesGetAllocatable` | `false` | 알파 | 1.21 | | | `LocalStorageCapacityIsolation` | `false` | 알파 | 1.7 | 1.9 | | `LocalStorageCapacityIsolation` | `true` | 베타 | 1.10 | | | `LocalStorageCapacityIsolationFSQuotaMonitoring` | `false` | 알파 | 1.15 | | | `LogarithmicScaleDown` | `false` | 알파 | 1.21 | 1.21 | | `LogarithmicScaleDown` | `true` | 베타 | 1.22 | | -| `KubeletInUserNamespace` | `false` | 알파 | 1.22 | | -| `KubeletPodResourcesGetAllocatable` | `false` | 알파 | 1.21 | | | `MemoryManager` | `false` | 알파 | 1.21 | 1.21 | | `MemoryManager` | `true` | 베타 | 1.22 | | | `MemoryQoS` | `false` | 알파 | 1.22 | | @@ -289,9 +288,6 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `DynamicKubeletConfig` | `false` | 사용중단 | 1.22 | - | | `DynamicProvisioningScheduling` | `false` | 알파 | 1.11 | 1.11 | | `DynamicProvisioningScheduling` | - | 사용중단| 1.12 | - | -| `DynamicKubeletConfig` | `false` | 알파 | 1.4 | 1.10 | -| `DynamicKubeletConfig` | `true` | 베타 | 1.11 | 1.21 | -| `DynamicKubeletConfig` | `false` | 사용중단 | 1.22 | - | | `DynamicVolumeProvisioning` | `true` | 알파 | 1.3 | 1.7 | | `DynamicVolumeProvisioning` | `true` | GA | 1.8 | - | | `EnableAggregatedDiscoveryTimeout` | `true` | 사용중단 | 1.16 | - | diff --git a/content/ko/docs/reference/glossary/extensions.md b/content/ko/docs/reference/glossary/extensions.md index 547cd934bc..daa5e37841 100644 --- a/content/ko/docs/reference/glossary/extensions.md +++ b/content/ko/docs/reference/glossary/extensions.md @@ -15,4 +15,4 @@ tags: -대부분의 클러스터 관리자는 호스트된 쿠버네티스 또는 쿠버네티스의 배포 인스턴스를 사용할 것이다. 그 결과, 대부분의 쿠버네티스 사용자는 [익스텐션](/ko/docs/concepts/extend-kubernetes/#익스텐션)의 설치가 필요할 것이며, 일부 사용자만 직접 새로운 것을 만들 것이다. +많은 클러스터 관리자가 호스트된 쿠버네티스 또는 쿠버네티스의 배포 인스턴스를 사용하고 있다. 이러한 클러스터는 익스텐션이 미리 설치되어 제공된다. 그 결과, 대부분의 쿠버네티스 사용자는 [익스텐션](/ko/docs/concepts/extend-kubernetes/#익스텐션)을 별도로 설치할 필요가 없으며, 또한 익스텐션을 새로 만들어야 하는 사용자는 거의 없을 것이다. diff --git a/content/ko/docs/reference/glossary/namespace.md b/content/ko/docs/reference/glossary/namespace.md index 584f2fc2bd..417ad0672f 100644 --- a/content/ko/docs/reference/glossary/namespace.md +++ b/content/ko/docs/reference/glossary/namespace.md @@ -10,9 +10,9 @@ aka: tags: - fundamental --- - 쿠버네티스에서 동일한 물리 {{< glossary_tooltip text="클러스터" term_id="cluster" >}}에서 다중의 가상 클러스터를 지원하기 위해 사용하는 추상화. + 쿠버네티스에서 하나의 {{< glossary_tooltip text="클러스터" term_id="cluster" >}} 내에서 리소스 그룹의 격리를 지원하기 위해 사용하는 추상적 개념. -네임스페이스는 클러스터의 오브젝트를 체계화하고 클러스터의 리소스를 분리하는 방법을 제공한다. 리소스의 이름은 네임스페이스 내에서 유일해야 한다. 그러나, 네임스페이스 간에서 유일할 필요는 없다. +네임스페이스는 클러스터의 오브젝트를 체계화하고 클러스터의 리소스를 분리하는 방법을 제공한다. 리소스의 이름은 네임스페이스 내에서 유일해야 한다. 그러나, 네임스페이스 간에서 유일할 필요는 없다. 네임스페이스 기반 스코핑은 네임스페이스 기반 오브젝트(예: 디플로이먼트, 서비스 등)에만 적용 가능하며 클러스터 범위의 오브젝트(예: 스토리지클래스, 노드, 퍼시스턴트볼륨 등)에는 적용 불가능하다. diff --git a/content/ko/docs/reference/issues-security/security.md b/content/ko/docs/reference/issues-security/security.md index fea97697e2..75191efdcb 100644 --- a/content/ko/docs/reference/issues-security/security.md +++ b/content/ko/docs/reference/issues-security/security.md @@ -27,7 +27,7 @@ weight: 20 보고서를 작성하려면, [쿠버네티스 버그 현상금 프로그램](https://hackerone.com/kubernetes)에 취약점을 제출한다. 이를 통해 표준화된 응답시간으로 취약점을 분류하고 처리할 수 있다. -또한, 보안 세부 내용과 [모든 쿠버네티스 버그 보고서](https://git.k8s.io/kubernetes/.github/ISSUE_TEMPLATE/bug-report.md)로 부터 예상되는 세부사항을 [security@kubernetes.io](mailto:security@kubernetes.io)로 이메일을 보낸다. +또한, 보안 세부 내용과 [모든 쿠버네티스 버그 보고서](https://github.com/kubernetes/kubernetes/blob/master/.github/ISSUE_TEMPLATE/bug-report.yaml)로 부터 예상되는 세부사항을 [security@kubernetes.io](mailto:security@kubernetes.io)로 이메일을 보낸다. [보안 대응 위원회(Security Response Committee) 구성원](https://git.k8s.io/security/README.md#product-security-committee-psc)의 GPG 키를 사용하여 이 목록으로 이메일을 암호화할 수 있다. GPG를 사용한 암호화는 공개할 필요가 없다. diff --git a/content/ko/docs/reference/scheduling/config.md b/content/ko/docs/reference/scheduling/config.md index 4680bc868f..d31897054d 100644 --- a/content/ko/docs/reference/scheduling/config.md +++ b/content/ko/docs/reference/scheduling/config.md @@ -89,7 +89,7 @@ profiles: - plugins: score: disabled: - - name: NodeResourcesLeastAllocated + - name: PodTopologySpread enabled: - name: MyCustomPluginA weight: 2 @@ -116,10 +116,6 @@ profiles: 익스텐션 포인트: `filter`. - `NodePorts`: 노드에 요청된 파드 포트에 대해 사용 가능한 포트가 있는지 확인한다. 익스텐션 포인트: `preFilter`, `filter`. -- `NodePreferAvoidPods`: 노드 {{< glossary_tooltip text="어노테이션" term_id="annotation" >}} - `scheduler.alpha.kubernetes.io/preferAvoidPods` 에 따라 - 노드 점수를 매긴다. - 익스텐션 포인트: `score`. - `NodeAffinity`: [노드 셀렉터](/ko/docs/concepts/scheduling-eviction/assign-pod-node/#노드-셀렉터-nodeselector)와 [노드 어피니티](/ko/docs/concepts/scheduling-eviction/assign-pod-node/#노드-어피니티)를 구현한다. @@ -195,8 +191,8 @@ profiles: - `RequestedToCapacityRatio`: 할당된 리소스의 구성된 기능에 따라 노드를 선호한다. 익스텐션 포인트: `score`. -- `NodeLabel`: Filters and / or scores a node according to configured - {{< glossary_tooltip text="label(s)" term_id="label" >}}. +- `NodeLabel`: 설정된 {{< glossary_tooltip text="레이블" term_id="label" >}}에 따라 + 노드를 필터링하거나 스코어링한다. 익스텐션 포인트: `Filter`, `Score`. - `ServiceAffinity`: {{< glossary_tooltip text="서비스" term_id="service" >}}에 속한 파드가 구성된 레이블로 정의된 노드 집합에 맞는지 @@ -255,10 +251,47 @@ profiles: 단 하나만 가질 수 있기 때문이다. {{< /note >}} +## 스케줄러 설정 전환 + +{{< tabs name="tab_with_md" >}} +{{% tab name="v1beta1 → v1beta2" %}} +* 설정 버전 v1beta2 에서는, `NodeResourcesFit` 플러그인을 위한 새로운 스코어링 확장을 + 이용할 수 있다. + 새 확장은 `NodeResourcesLeastAllocated`, `NodeResourcesMostAllocated`, + `RequestedToCapacityRatio` 플러그인의 기능을 통합하여 제공한다. + 예를 들어, 이전에 `NodeResourcesMostAllocated` 플러그인을 사용했다면, + 대신 `NodeResourcesFit`(기본적으로 활성화되어 있음)을 사용하면서 + 다음과 같이 `scoreStrategy`를 포함하는 `pluginConfig`를 추가할 수 있다. + ```yaml + apiVersion: kubescheduler.config.k8s.io/v1beta2 + kind: KubeSchedulerConfiguration + profiles: + - pluginConfig: + - args: + scoringStrategy: + resources: + - name: cpu + weight: 1 + type: MostAllocated + name: NodeResourcesFit + ``` + +* 스케줄러 플러그인 `NodeLabel`은 사용 중단되었다. 대신, 비슷한 효과를 얻기 위해 [`NodeAffinity`](/ko/docs/concepts/scheduling-eviction/assign-pod-node/#어피니티-affinity-와-안티-어피니티-anti-affinity) 플러그인(기본적으로 활성화되어 있음)을 사용한다. + +* 스케줄러 플러그인 `ServiceAffinity`은 사용 중단되었다. 대신, 비슷한 효과를 얻기 위해 [`InterPodAffinity`](/ko/docs/concepts/scheduling-eviction/assign-pod-node/#파드간-어피니티와-안티-어피니티) 플러그인(기본적으로 활성화되어 있음)을 사용한다. + +* 스케줄러 플러그인 `NodePreferAvoidPods`은 사용 중단되었다. 대신, 비슷한 효과를 얻기 위해 [노드 테인트](/ko/docs/concepts/scheduling-eviction/taint-and-toleration/)를 사용한다. + +* v1beta2 설정 파일에서 활성화된 플러그인은 해당 플러그인의 기본 설정값보다 v1beta2 설정 파일의 값이 우선 적용된다. + +* 스케줄러 healthz와 metrics 바인드 주소에 대해 `host` 또는 `port`가 잘못 설정되면 검증 실패를 유발한다. + +{{% /tab %}} +{{< /tabs >}} + ## {{% heading "whatsnext" %}} * [kube-scheduler 레퍼런스](/docs/reference/command-line-tools-reference/kube-scheduler/) 읽어보기 * [스케줄링](/ko/docs/concepts/scheduling-eviction/kube-scheduler/)에 대해 알아보기 -* [kube-scheduler configuration (v1beta1)](/docs/reference/config-api/kube-scheduler-config.v1beta1/) 레퍼런스 읽어보기 -* [kube-scheduler configuration (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) 레퍼런스 읽어보기 - +* [kube-scheduler 설정 (v1beta1)](/docs/reference/config-api/kube-scheduler-config.v1beta1/) 레퍼런스 읽어보기 +* [kube-scheduler 설정 (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) 레퍼런스 읽어보기 diff --git a/content/ko/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/ko/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 446953327f..999bfd192e 100644 --- a/content/ko/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/ko/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -69,7 +69,11 @@ sudo sysctl --system ## 필수 포트 확인 {#check-required-ports} [필수 포트들](/docs/reference/ports-and-protocols/)은 쿠버네티스 컴포넌트들이 서로 통신하기 위해서 열려 있어야 -한다. +한다. 다음과 같이 telnet 명령을 이용하여 포트가 열려 있는지 확인해 볼 수 있다. + +```shell +telnet 127.0.0.1 6443 +``` 사용자가 사용하는 파드 네트워크 플러그인(아래 참조)은 특정 포트를 열어야 할 수도 있다. 이것은 각 파드 네트워크 플러그인마다 다르므로, 필요한 포트에 대한 From f7a9e0e729945600200efacb46e4fa557603bd85 Mon Sep 17 00:00:00 2001 From: amandapunch Date: Thu, 2 Dec 2021 20:51:16 -0800 Subject: [PATCH 107/148] update date to mention kubecon North America 2022 --- content/en/_index.html | 2 +- content/ko/_index.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/_index.html b/content/en/_index.html index db4c966102..965be6abcb 100644 --- a/content/en/_index.html +++ b/content/en/_index.html @@ -43,7 +43,7 @@ Kubernetes is open source giving you the freedom to take advantage of on-premise

    -
    Attend KubeCon North America on October 11-15, 2021 + Attend KubeCon North America on October 24-28, 2022


    diff --git a/content/ko/_index.html b/content/ko/_index.html index c6350f1559..f45a97995a 100644 --- a/content/ko/_index.html +++ b/content/ko/_index.html @@ -43,7 +43,7 @@ Google이 일주일에 수십억 개의 컨테이너들을 운영하게 해준

    - Attend KubeCon North America on October 11-15, 2021 + Attend KubeCon North America on October 24-28, 2022


    From f6e8932b282ed758043bf54101972ec1008a6aed Mon Sep 17 00:00:00 2001 From: Guangwen Feng Date: Fri, 3 Dec 2021 17:55:07 +0800 Subject: [PATCH 108/148] [zh] Add translation for the missing sentence Signed-off-by: Guangwen Feng --- content/zh/docs/reference/using-api/server-side-apply.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/reference/using-api/server-side-apply.md b/content/zh/docs/reference/using-api/server-side-apply.md index b2f44b83be..762b038ef5 100644 --- a/content/zh/docs/reference/using-api/server-side-apply.md +++ b/content/zh/docs/reference/using-api/server-side-apply.md @@ -840,7 +840,7 @@ with an empty entry. Two examples are: 可以从对象中剥离所有 managedField, 实现方法是通过使用 `MergePatch`、 `StrategicMergePatch`、 `JSONPatch`、 `Update`、以及所有的非应用方式的操作来覆盖它。 -这可以通过用空条目覆盖 managedFields 字段的方式实现。 +这可以通过用空条目覆盖 managedFields 字段的方式实现。以下是两个示例: ```console PATCH /api/v1/namespaces/default/configmaps/example-cm From e1bf8f22b24413038dde4327c7a766676beba3b6 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 23 Nov 2021 17:18:57 +0000 Subject: [PATCH 109/148] Improve docs for HorizontalPodAutoscaler Co-authored-by: Chris Negus --- .../horizontal-pod-autoscale-walkthrough.md | 160 ++++++---- .../horizontal-pod-autoscale.md | 288 ++++++++++-------- 2 files changed, 261 insertions(+), 187 deletions(-) diff --git a/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md b/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md index f5582b9416..02018745d4 100644 --- a/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md +++ b/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md @@ -4,42 +4,59 @@ reviewers: - jszczepkowski - justinsb - directxman12 -title: Horizontal Pod Autoscaler Walkthrough +title: HorizontalPodAutoscaler Walkthrough content_type: task weight: 100 +min-kubernetes-server-version: 1.23 --- -Horizontal Pod Autoscaler automatically scales the number of Pods -in a replication controller, deployment, replica set or stateful set based on observed CPU utilization -(or, with beta support, on some other, application-provided metrics). +A [HorizontalPodAutoscaler](/docs/tasks/run-application/horizontal-pod-autoscale/) +(HPA for short) +automatically updates a workload resource (such as +a {{< glossary_tooltip text="Deployment" term_id="deployment" >}} or +{{< glossary_tooltip text="StatefulSet" term_id="statefulset" >}}), with the +aim of automatically scaling the workload to match demand. -This document walks you through an example of enabling Horizontal Pod Autoscaler for the php-apache server. -For more information on how Horizontal Pod Autoscaler behaves, see the -[Horizontal Pod Autoscaler user guide](/docs/tasks/run-application/horizontal-pod-autoscale/). +Horizontal scaling means that the response to increased load is to deploy more +{{< glossary_tooltip text="Pods" term_id="pod" >}}. +This is different from _vertical_ scaling, which for Kubernetes would mean +assigning more resources (for example: memory or CPU) to the Pods that are already +running for the workload. + +If the load decreases, and the number of Pods is above the configured minimum, +the HorizontalPodAutoscaler instructs the workload resource (the Deployment, StatefulSet, +or other similar resource) to scale back down. + +This document walks you through an example of enabling HorizontalPodAutoscaler to +automatically manage scale for an example web app. This example workload is Apache +httpd running some PHP code. ## {{% heading "prerequisites" %}} -This example requires a running Kubernetes cluster and kubectl, version 1.2 or later. -[Metrics server](https://github.com/kubernetes-sigs/metrics-server) monitoring needs to be deployed -in the cluster to provide metrics through the [Metrics API](https://github.com/kubernetes/metrics). -Horizontal Pod Autoscaler uses this API to collect metrics. To learn how to deploy the metrics-server, -see the [metrics-server documentation](https://github.com/kubernetes-sigs/metrics-server#deployment). +{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} If you're running an older +release of Kubernetes, refer to the version of the documentation for that release (see +[available documentation versions](/docs/home/supported-doc-versions/). -To specify multiple resource metrics for a Horizontal Pod Autoscaler, you must have a -Kubernetes cluster and kubectl at version 1.6 or later. To make use of custom metrics, your cluster -must be able to communicate with the API server providing the custom Metrics API. -Finally, to use metrics not related to any Kubernetes object you must have a -Kubernetes cluster at version 1.10 or later, and you must be able to communicate -with the API server that provides the external Metrics API. -See the [Horizontal Pod Autoscaler user guide](/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics) for more details. +To follow this walkthrough, you also need to use a cluster that has a +[Metrics Server](https://github.com/kubernetes-sigs/metrics-server#readme) deployed and configured. +The Kubernetes Metrics Server collects resource metrics from +the {{}} in your cluster, and exposes those metrics +through the [Kubernetes API](/docs/concepts/overview/kubernetes-api/), +using an [APIService](/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) to add +new kinds of resource that represent metric readings. + +To learn how to deploy the Metrics Server, see the +[metrics-server documentation](https://github.com/kubernetes-sigs/metrics-server#deployment). ## Run and expose php-apache server -To demonstrate Horizontal Pod Autoscaler we will use a custom docker image based on the php-apache image. The Dockerfile has the following content: +To demonstrate a HorizontalPodAutoscaler, you will first make a custom container image that uses +the `php-apache` image from Docker Hub as its starting point. The `Dockerfile` is ready-made for you, +and has the following content: ```dockerfile FROM php:5-apache @@ -47,7 +64,8 @@ COPY index.php /var/www/html/index.php RUN chmod a+rx index.php ``` -It defines an index.php page which performs some CPU intensive computations: +This code defines a simple `index.php` page that performs some CPU intensive computations, +in order to simulate load in your cluster. ```php ``` -First, we will start a deployment running the image and expose it as a service -using the following configuration: +Once you have made that container image, start a Deployment that runs a container using the +image you made, and expose it as a {{< glossary_tooltip term_id="service">}} +using the following manifest: {{< codenew file="application/php-apache.yaml" >}} -Run the following command: +To do so, run the following command: ```shell kubectl apply -f https://k8s.io/examples/application/php-apache.yaml @@ -75,16 +94,27 @@ deployment.apps/php-apache created service/php-apache created ``` -## Create Horizontal Pod Autoscaler +## Create the HorizontalPodAutoscaler {#create-horizontal-pod-autoscaler} + +Now that the server is running, create the autoscaler using `kubectl`. There is +[`kubectl autoscale`](/docs/reference/generated/kubectl/kubectl-commands#autoscale) subcommand, +part of `kubectl`, that helps you do this. + +You will shortly run a command that creates a HorizontalPodAutoscaler that maintains +between 1 and 10 replicas of the Pods controlled by the php-apache Deployment that +you created in the first step of these instructions. + +Roughly speaking, the HPA {{}} will increase and decrease +the number of replicas (by updating the Deployment) to maintain an average CPU utilization across all Pods of 50%. +The Deployment then updates the ReplicaSet - this is part of how all Deployments work in Kubernetes - +and then the ReplicaSet either adds or removes Pods based on the change to its `.spec`. -Now that the server is running, we will create the autoscaler using -[kubectl autoscale](/docs/reference/generated/kubectl/kubectl-commands#autoscale). -The following command will create a Horizontal Pod Autoscaler that maintains between 1 and 10 replicas of the Pods -controlled by the php-apache deployment we created in the first step of these instructions. -Roughly speaking, HPA will increase and decrease the number of replicas -(via the deployment) to maintain an average CPU utilization across all Pods of 50%. Since each pod requests 200 milli-cores by `kubectl run`, this means an average CPU usage of 100 milli-cores. -See [here](/docs/tasks/run-application/horizontal-pod-autoscale/#algorithm-details) for more details on the algorithm. +See [Algorithm details](/docs/tasks/run-application/horizontal-pod-autoscale/#algorithm-details) for more details +on the algorithm. + + +Create the HorizontalPodAutoscaler: ```shell kubectl autoscale deployment php-apache --cpu-percent=50 --min=1 --max=10 @@ -94,47 +124,64 @@ kubectl autoscale deployment php-apache --cpu-percent=50 --min=1 --max=10 horizontalpodautoscaler.autoscaling/php-apache autoscaled ``` -We may check the current status of autoscaler by running: +You can check the current status of the newly-made HorizontalPodAutoscaler, by running: ```shell +# You can use "hpa" or "horizontalpodautoscaler"; either name works OK. kubectl get hpa ``` +The output is similar to: ``` NAME REFERENCE TARGET MINPODS MAXPODS REPLICAS AGE php-apache Deployment/php-apache/scale 0% / 50% 1 10 1 18s ``` -Please note that the current CPU consumption is 0% as we are not sending any requests to the server -(the ``TARGET`` column shows the average across all the pods controlled by the corresponding deployment). +(if you see other HorizontalPodAutoscalers with different names, that means they already existed, +and isn't usually a problem). -## Increase load +Please note that the current CPU consumption is 0% as there are no clients sending requests to the server +(the ``TARGET`` column shows the average across all the Pods controlled by the corresponding deployment). -Now, we will see how the autoscaler reacts to increased load. -We will start a container, and send an infinite loop of queries to the php-apache service (please run it in a different terminal): +## Increase the load {#increase-load} + +Next, see how the autoscaler reacts to increased load. +To do this, you'll start a different Pod to act as a client. The container within the client Pod +runs in an infinite loop, sending queries to the php-apache service. ```shell +# Run this in a separate terminal +# so that the load generation continues and you can carry on with the rest of the steps kubectl run -i --tty load-generator --rm --image=busybox --restart=Never -- /bin/sh -c "while sleep 0.01; do wget -q -O- http://php-apache; done" ``` -Within a minute or so, we should see the higher CPU load by executing: - +Now run: ```shell -kubectl get hpa +# type Ctrl+C to end the watch when you're ready +kubectl get hpa php-apache --watch ``` +Within a minute or so, you should see the higher CPU load; for example: + ``` NAME REFERENCE TARGET MINPODS MAXPODS REPLICAS AGE php-apache Deployment/php-apache/scale 305% / 50% 1 10 1 3m ``` +and then, more replicas. For example: +``` +NAME REFERENCE TARGET MINPODS MAXPODS REPLICAS AGE +php-apache Deployment/php-apache/scale 305% / 50% 1 10 7 3m +``` + Here, CPU consumption has increased to 305% of the request. -As a result, the deployment was resized to 7 replicas: +As a result, the Deployment was resized to 7 replicas: ```shell kubectl get deployment php-apache ``` +You should see the replica count matching the figure from the HorizontalPodAutoscaler ``` NAME READY UP-TO-DATE AVAILABLE AGE php-apache 7/7 7 7 19m @@ -146,24 +193,29 @@ of load is not controlled in any way it may happen that the final number of repl will differ from this example. {{< /note >}} -## Stop load +## Stop generating load {#stop-load} -We will finish our example by stopping the user load. +To finish the example, stop sending the load. -In the terminal where we created the container with `busybox` image, terminate +In the terminal where you created the Pod that runs a `busybox` image, terminate the load generation by typing ` + C`. -Then we will verify the result state (after a minute or so): +Then verify the result state (after a minute or so): ```shell -kubectl get hpa +# type Ctrl+C to end the watch when you're ready +kubectl get hpa php-apache --watch ``` +The output is similar to: + ``` NAME REFERENCE TARGET MINPODS MAXPODS REPLICAS AGE php-apache Deployment/php-apache/scale 0% / 50% 1 10 1 11m ``` +and the Deployment also shows that it has scaled down: + ```shell kubectl get deployment php-apache ``` @@ -173,11 +225,9 @@ NAME READY UP-TO-DATE AVAILABLE AGE php-apache 1/1 1 1 27m ``` -Here CPU utilization dropped to 0, and so HPA autoscaled the number of replicas back down to 1. +Once CPU utilization dropped to 0, the HPA automatically scaled the number of replicas back down to 1. -{{< note >}} Autoscaling the replicas may take a few minutes. -{{< /note >}} @@ -444,7 +494,7 @@ Conditions: Events: ``` -For this HorizontalPodAutoscaler, we can see several conditions in a healthy state. The first, +For this HorizontalPodAutoscaler, you can see several conditions in a healthy state. The first, `AbleToScale`, indicates whether or not the HPA is able to fetch and update scales, as well as whether or not any backoff-related conditions would prevent scaling. The second, `ScalingActive`, indicates whether or not the HPA is enabled (i.e. the replica count of the target is not zero) and @@ -454,7 +504,7 @@ was capped by the maximum or minimum of the HorizontalPodAutoscaler. This is an you may wish to raise or lower the minimum or maximum replica count constraints on your HorizontalPodAutoscaler. -## Appendix: Quantities +## Quantities All metrics in the HorizontalPodAutoscaler and metrics APIs are specified using a special whole-number notation known in Kubernetes as a @@ -464,16 +514,16 @@ will return whole numbers without a suffix when possible, and will generally ret quantities in milli-units otherwise. This means you might see your metric value fluctuate between `1` and `1500m`, or `1` and `1.5` when written in decimal notation. -## Appendix: Other possible scenarios +## Other possible scenarios ### Creating the autoscaler declaratively Instead of using `kubectl autoscale` command to create a HorizontalPodAutoscaler imperatively we -can use the following file to create it declaratively: +can use the following manifest to create it declaratively: {{< codenew file="application/hpa/php-apache.yaml" >}} -We will create the autoscaler by executing the following command: +Then, create the autoscaler by executing the following command: ```shell kubectl create -f https://k8s.io/examples/application/hpa/php-apache.yaml diff --git a/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md b/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md index 3208035a97..acec1e6af9 100644 --- a/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md +++ b/content/en/docs/tasks/run-application/horizontal-pod-autoscale.md @@ -3,41 +3,59 @@ reviewers: - fgrzadkowski - jszczepkowski - directxman12 -title: Horizontal Pod Autoscaler +title: Horizontal Pod Autoscaling feature: title: Horizontal scaling description: > Scale your application up and down with a simple command, with a UI, or automatically based on CPU usage. - content_type: concept weight: 90 --- -The Horizontal Pod Autoscaler automatically scales the number of Pods -in a replication controller, deployment, replica set or stateful set based on observed CPU utilization (or, with -[custom metrics](https://git.k8s.io/community/contributors/design-proposals/instrumentation/custom-metrics-api.md) -support, on some other application-provided metrics). Note that Horizontal -Pod Autoscaling does not apply to objects that can't be scaled, for example, DaemonSets. +In Kubernetes, a _HorizontalPodAutoscaler_ automatically updates a workload resource (such as +a {{< glossary_tooltip text="Deployment" term_id="deployment" >}} or +{{< glossary_tooltip text="StatefulSet" term_id="statefulset" >}}), with the +aim of automatically scaling the workload to match demand. -The Horizontal Pod Autoscaler is implemented as a Kubernetes API resource and a controller. +Horizontal scaling means that the response to increased load is to deploy more +{{< glossary_tooltip text="Pods" term_id="pod" >}}. +This is different from _vertical_ scaling, which for Kubernetes would mean +assigning more resources (for example: memory or CPU) to the Pods that are already +running for the workload. + +If the load decreases, and the number of Pods is above the configured minimum, +the HorizontalPodAutoscaler instructs the workload resource (the Deployment, StatefulSet, +or other similar resource) to scale back down. + +Horizontal pod autoscaling does not apply to objects that can't be scaled (for example: +a {{< glossary_tooltip text="DaemonSet" term_id="daemonset" >}}.) + +The HorizontalPodAutoscaler is implemented as a Kubernetes API resource and a +{{< glossary_tooltip text="controller" term_id="controller" >}}. The resource determines the behavior of the controller. -The controller periodically adjusts the number of replicas in a replication controller or deployment to match the observed metrics such as average CPU utilisation, average memory utilisation or any other custom metric to the target specified by the user. - +The horizontal pod autoscaling controller, running within the Kubernetes +{{< glossary_tooltip text="control plane" term_id="control-plane" >}}, periodically adjusts the +desired scale of its target (for example, a Deployment) to match observed metrics such as average +CPU utilization, average memory utilization, or any other custom metric you specify. +There is [walkthrough example](/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/) of using +horizontal pod autoscaling. -## How does the Horizontal Pod Autoscaler work? +## How does a HorizontalPodAutoscaler work? -![Horizontal Pod Autoscaler diagram](/images/docs/horizontal-pod-autoscaler.svg) +{{< figure src="/images/docs/horizontal-pod-autoscaler.svg" caption="HorizontalPodAutoscaler controls the scale of a Deployment and its ReplicaSet" class="diagram-medium">}} -The Horizontal Pod Autoscaler is implemented as a control loop, with a period controlled -by the controller manager's `--horizontal-pod-autoscaler-sync-period` flag (with a default -value of 15 seconds). +Kubernetes implements horizontal pod autoscaling as a control loop that runs intermittently +(it is not a continuous process). The interval is set by the +`--horizontal-pod-autoscaler-sync-period` parameter to the +[`kube-controller-manager`](/docs/reference/command-line-tools-reference/kube-controller-manager/) +(and the default interval is 15 seconds). -During each period, the controller manager queries the resource utilization against the +Once during each period, the controller manager queries the resource utilization against the metrics specified in each HorizontalPodAutoscaler definition. The controller manager obtains the metrics from either the resource metrics API (for per-pod resource metrics), or the custom metrics API (for all other metrics). @@ -45,17 +63,17 @@ or the custom metrics API (for all other metrics). * For per-pod resource metrics (like CPU), the controller fetches the metrics from the resource metrics API for each Pod targeted by the HorizontalPodAutoscaler. Then, if a target utilization value is set, the controller calculates the utilization - value as a percentage of the equivalent resource request on the containers in - each Pod. If a target raw value is set, the raw metric values are used directly. + value as a percentage of the equivalent + [resource request](/docs/concepts/configuration/manage-resources-containers/#requests-and-limits) + on the containers in each Pod. If a target raw value is set, the raw metric values are used directly. The controller then takes the mean of the utilization or the raw value (depending on the type of target specified) across all targeted Pods, and produces a ratio used to scale the number of desired replicas. Please note that if some of the Pod's containers do not have the relevant resource request set, CPU utilization for the Pod will not be defined and the autoscaler will - not take any action for that metric. See the [algorithm - details](#algorithm-details) section below for more information about - how the autoscaling algorithm works. + not take any action for that metric. See the [algorithm details](#algorithm-details) section below + for more information about how the autoscaling algorithm works. * For per-pod custom metrics, the controller functions similarly to per-pod resource metrics, except that it works with raw values, not utilization values. @@ -66,20 +84,25 @@ or the custom metrics API (for all other metrics). version, this value can optionally be divided by the number of Pods before the comparison is made. -The HorizontalPodAutoscaler normally fetches metrics from a series of aggregated APIs (`metrics.k8s.io`, -`custom.metrics.k8s.io`, and `external.metrics.k8s.io`). The `metrics.k8s.io` API is usually provided by -metrics-server, which needs to be launched separately. For more information about resource metrics, see [Metrics Server](/docs/tasks/debug-application-cluster/resource-metrics-pipeline/#metrics-server). +The common use for HorizontalPodAutoscaler is to configure it to fetch metrics from +{{< glossary_tooltip text="aggregated APIs" term_id="aggregation-layer" >}} +(`metrics.k8s.io`, `custom.metrics.k8s.io`, or `external.metrics.k8s.io`). The `metrics.k8s.io` API is +usually provided by an add on named Metrics Server, which needs to be launched separately. +For more information about resource metrics, see +[Metrics Server](/docs/tasks/debug-application-cluster/resource-metrics-pipeline/#metrics-server). -See [Support for metrics APIs](#support-for-metrics-apis) for more details. +[Support for metrics APIs](#support-for-metrics-apis) explains the stability guarantees and support status for these +different APIs. -The autoscaler accesses corresponding scalable controllers (such as replication controllers, deployments, and replica sets) -by using the scale sub-resource. Scale is an interface that allows you to dynamically set the number of replicas and examine -each of their current states. More details on scale sub-resource can be found -[here](https://git.k8s.io/community/contributors/design-proposals/autoscaling/horizontal-pod-autoscaler.md#scale-subresource). +The HorizontalPodAutoscaler controller accesses corresponding workload resources that support scaling (such as Deployments +and StatefulSet). These resources each have a subresource named `scale`, an interface that allows you to dynamically set the +number of replicas and examine each of their current states. +For general information about subresources in the Kubernetes API, see +[Kubernetes API Concepts](/docs/reference/using-api/api-concepts/). -### Algorithm Details +### Algorithm details -From the most basic perspective, the Horizontal Pod Autoscaler controller +From the most basic perspective, the HorizontalPodAutoscaler controller operates on the ratio between desired metric value and current metric value: @@ -89,26 +112,28 @@ desiredReplicas = ceil[currentReplicas * ( currentMetricValue / desiredMetricVal For example, if the current metric value is `200m`, and the desired value is `100m`, the number of replicas will be doubled, since `200.0 / 100.0 == -2.0` If the current value is instead `50m`, we'll halve the number of -replicas, since `50.0 / 100.0 == 0.5`. We'll skip scaling if the ratio is -sufficiently close to 1.0 (within a globally-configurable tolerance, from -the `--horizontal-pod-autoscaler-tolerance` flag, which defaults to 0.1). +2.0` If the current value is instead `50m`, you'll halve the number of +replicas, since `50.0 / 100.0 == 0.5`. The control plane skips any scaling +action if the ratio is sufficiently close to 1.0 (within a globally-configurable +tolerance, 0.1 by default). When a `targetAverageValue` or `targetAverageUtilization` is specified, the `currentMetricValue` is computed by taking the average of the given metric across all Pods in the HorizontalPodAutoscaler's scale target. -Before checking the tolerance and deciding on the final values, we take -pod readiness and missing metrics into consideration, however. -All Pods with a deletion timestamp set (i.e. Pods in the process of being -shut down) and all failed Pods are discarded. +Before checking the tolerance and deciding on the final values, the control +plane also considers whether any metrics are missing, and how many Pods +are [`Ready`](/docs/concepts/workloads/pods/pod-lifecycle/#pod-conditions). +All Pods with a deletion timestamp set (objects with a deletion timestamp are +in the process of being shut down / removed) are ignored, and all failed Pods +are discarded. If a particular Pod is missing metrics, it is set aside for later; Pods with missing metrics will be used to adjust the final scaling amount. -When scaling on CPU, if any pod has yet to become ready (i.e. it's still -initializing) *or* the most recent metric point for the pod was before it -became ready, that pod is set aside as well. +When scaling on CPU, if any pod has yet to become ready (it's still +initializing, or possibly is unhealthy) *or* the most recent metric point for +the pod was before it became ready, that pod is set aside as well. Due to technical constraints, the HorizontalPodAutoscaler controller cannot exactly determine the first time a pod becomes ready when @@ -124,20 +149,21 @@ default is 5 minutes. The `currentMetricValue / desiredMetricValue` base scale ratio is then calculated using the remaining pods not set aside or discarded from above. -If there were any missing metrics, we recompute the average more +If there were any missing metrics, the control plane recomputes the average more conservatively, assuming those pods were consuming 100% of the desired value in case of a scale down, and 0% in case of a scale up. This dampens the magnitude of any potential scale. -Furthermore, if any not-yet-ready pods were present, and we would have -scaled up without factoring in missing metrics or not-yet-ready pods, we -conservatively assume the not-yet-ready pods are consuming 0% of the -desired metric, further dampening the magnitude of a scale up. +Furthermore, if any not-yet-ready pods were present, and the workload would have +scaled up without factoring in missing metrics or not-yet-ready pods, +the controller conservatively assumes that the not-yet-ready pods are consuming 0% +of the desired metric, further dampening the magnitude of a scale up. -After factoring in the not-yet-ready pods and missing metrics, we -recalculate the usage ratio. If the new ratio reverses the scale -direction, or is within the tolerance, we skip scaling. Otherwise, we use -the new ratio to scale. +After factoring in the not-yet-ready pods and missing metrics, the +controller recalculates the usage ratio. If the new ratio reverses the scale +direction, or is within the tolerance, the controller doesn't take any scaling +action. In other cases, the new ratio is used to decide any change to the +number of Pods. Note that the *original* value for the average utilization is reported back via the HorizontalPodAutoscaler status, without factoring in the @@ -173,19 +199,13 @@ When you create a HorizontalPodAutoscaler API object, make sure the name specifi More details about the API object can be found at [HorizontalPodAutoscaler Object](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#horizontalpodautoscaler-v2-autoscaling). +## Stability of workload scale {#flapping} -## Support for Horizontal Pod Autoscaler in kubectl +When managing the scale of a group of replicas using the HorizontalPodAutoscaler, +it is possible that the number of replicas keeps fluctuating frequently due to the +dynamic nature of the metrics evaluated. This is sometimes referred to as *thrashing*, +or *flapping*. It's similar to the concept of *hysteresis* in cybernetics. -Horizontal Pod Autoscaler, like every API resource, is supported in a standard way by `kubectl`. -We can create a new autoscaler using `kubectl create` command. -We can list autoscalers by `kubectl get hpa` and get detailed description by `kubectl describe hpa`. -Finally, we can delete an autoscaler using `kubectl delete hpa`. - -In addition, there is a special `kubectl autoscale` command for creating a HorizontalPodAutoscaler object. -For instance, executing `kubectl autoscale rs foo --min=2 --max=5 --cpu-percent=80` -will create an autoscaler for replication set *foo*, with target CPU utilization set to `80%` -and the number of replicas between 2 and 5. -The detailed documentation of `kubectl autoscale` can be found [here](/docs/reference/generated/kubectl/kubectl-commands/#autoscale). ## Autoscaling during rolling update @@ -202,31 +222,6 @@ If you perform a rolling update of a StatefulSet that has an autoscaled number o replicas, the StatefulSet directly manages its set of Pods (there is no intermediate resource similar to ReplicaSet). -## Support for cooldown/delay - -When managing the scale of a group of replicas using the Horizontal Pod Autoscaler, -it is possible that the number of replicas keeps fluctuating frequently due to the -dynamic nature of the metrics evaluated. This is sometimes referred to as *thrashing*. - -Starting from v1.6, a cluster operator can mitigate this problem by tuning -the global HPA settings exposed as flags for the `kube-controller-manager` component: - -Starting from v1.12, a new algorithmic update removes the need for the -upscale delay. - -- `--horizontal-pod-autoscaler-downscale-stabilization`: Specifies the duration of the - downscale stabilization time window. Horizontal Pod Autoscaler remembers - the historical recommended sizes and only acts on the largest size within this time window. - The default value is 5 minutes (`5m0s`). - -{{< note >}} -When tuning these parameter values, a cluster operator should be aware of the possible -consequences. If the delay (cooldown) value is set too long, there could be complaints -that the Horizontal Pod Autoscaler is not responsive to workload changes. However, if -the delay value is set too short, the scale of the replicas set may keep thrashing as -usual. -{{< /note >}} - ## Support for resource metrics Any HPA target can be scaled based on the resource usage of the pods in the scaling target. @@ -255,11 +250,11 @@ a single container might be running with high usage and the HPA will not scale o pod usage is still within acceptable limits. {{< /note >}} -### Container Resource Metrics +### Container resource metrics {{< feature-state for_k8s_version="v1.20" state="alpha" >}} -`HorizontalPodAutoscaler` also supports a container metric source where the HPA can track the +The HorizontalPodAutoscaler API also supports a container metric source where the HPA can track the resource usage of individual containers across a set of Pods, in order to scale the target resource. This lets you configure scaling thresholds for the containers that matter most in a particular Pod. For example, if you have a web application and a logging sidecar, you can scale based on the resource @@ -271,6 +266,7 @@ scaling. If the specified container in the metric source is not present or only of the pods then those pods are ignored and the recommendation is recalculated. See [Algorithm](#algorithm-details) for more details about the calculation. To use container resources for autoscaling define a metric source as follows: + ```yaml type: ContainerResource containerResource: @@ -296,30 +292,32 @@ Once you have rolled out the container name change to the workload resource, tid the old container name from the HPA specification. {{< /note >}} -## Support for multiple metrics -Kubernetes 1.6 adds support for scaling based on multiple metrics. You can use the `autoscaling/v2` API -version to specify multiple metrics for the Horizontal Pod Autoscaler to scale on. Then, the Horizontal Pod -Autoscaler controller will evaluate each metric, and propose a new scale based on that metric. The largest of the -proposed scales will be used as the new scale. +## Scaling on custom metrics -## Support for custom metrics +{{< feature-state for_k8s_version="v1.23" state="stable" >}} -{{< note >}} -Kubernetes 1.2 added alpha support for scaling based on application-specific metrics using special annotations. -Support for these annotations was removed in Kubernetes 1.6 in favor of the new autoscaling API. While the old method for collecting -custom metrics is still available, these metrics will not be available for use by the Horizontal Pod Autoscaler, and the former -annotations for specifying which custom metrics to scale on are no longer honored by the Horizontal Pod Autoscaler controller. -{{< /note >}} +(the `autoscaling/v2beta2` API version previously provided this ability as a beta feature) -You can also use a HorizontalPodAutoscaler to change the scale of a -workload based on custom metrics. You can add custom metrics for the -Horizontal Pod Autoscaler to use in the `autoscaling/v2` API. -Kubernetes then queries the new custom metrics API to fetch the values -of the appropriate custom metrics. +Provided that you use the `autoscaling/v2` API version, you can configure a HorizontalPodAutoscaler +to scale based on a custom metric (that is not built in to Kubernetes or any Kubernetes component). +The HorizontalPodAutoscaler controller then queries for these custom metrics from the Kubernetes +API. See [Support for metrics APIs](#support-for-metrics-apis) for the requirements. +## Scaling on multiple metrics + +{{< feature-state for_k8s_version="v1.23" state="stable" >}} + +(the `autoscaling/v2beta2` API version previously provided this ability as a beta feature) + +Provided that you use the `autoscaling/v2` API version, you can specify multiple metrics for a +HorizontalPodAutoscaler to scale on. Then, the HorizontalPodAutoscaler controller evaluates each metric, +and proposes a new scale based on that metric. The HorizontalPodAutoscaler takes the maximum scale +recommended for each metric and sets the workload to that size (provided that this isn't larger than the +overall maximum that you configured). + ## Support for metrics APIs By default, the HorizontalPodAutoscaler controller retrieves metrics from a series of APIs. In order for it to access these @@ -333,8 +331,7 @@ APIs, cluster administrators must ensure that: It can be launched as a cluster addon. * For custom metrics, this is the `custom.metrics.k8s.io` API. It's provided by "adapter" API servers provided by metrics solution vendors. - Check with your metrics pipeline, or the [list of known solutions](https://github.com/kubernetes/metrics/blob/master/IMPLEMENTATIONS.md#custom-metrics-api). - If you would like to write your own, check out the [boilerplate](https://github.com/kubernetes-sigs/custom-metrics-apiserver) to get started. + Check with your metrics pipeline to see if there is a Kubernetes metrics adapter available. * For external metrics, this is the `external.metrics.k8s.io` API. It may be provided by the custom metrics adapters provided above. @@ -346,20 +343,23 @@ and [external.metrics.k8s.io](https://github.com/kubernetes/community/blob/maste For examples of how to use them see [the walkthrough for using custom metrics](/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/#autoscaling-on-multiple-metrics-and-custom-metrics) and [the walkthrough for using external metrics](/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/#autoscaling-on-metrics-not-related-to-kubernetes-objects). -## Support for configurable scaling behavior +## Configurable scaling behavior -Starting from -[v1.18](https://github.com/kubernetes/enhancements/blob/master/keps/sig-autoscaling/853-configurable-hpa-scale-velocity/README.md) -the `v2beta2` API (and from v1.23 the `v2` API) allows scaling -behavior to be configured through the HPA `behavior` field. Behaviors -are specified separately for scaling up and down in `scaleUp` or -`scaleDown` section under the `behavior` field. A stabilization window -can be specified for both directions which prevents the flapping of -the number of the replicas in the scaling target. Similarly specifying -scaling policies controls the rate of change of replicas while -scaling. +{{< feature-state for_k8s_version="v1.23" state="stable" >}} -### Scaling Policies +(the `autoscaling/v2beta2` API version previously provided this ability as a beta feature) + +If you use the `v2` HorizontalPodAutoscaler API, you can use the `behavior` field +(see the [API reference](/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2/#HorizontalPodAutoscalerSpec)) +to configure separate scale-up and scale-down behaviors. +You specify these behaviours by setting `scaleUp` and / or `scaleDown` +under the `behavior` field. + +You can specify a _stabilization window_ that prevents [flapping](#flapping) +the replica count for a scaling target. Scaling policies also let you controls the +rate of change of replicas while scaling. + +### Scaling policies One or more scaling policies can be specified in the `behavior` section of the spec. When multiple policies are specified the policy which allows the highest amount of @@ -396,21 +396,27 @@ direction. By setting the value to `Min` which would select the policy which all smallest change in the replica count. Setting the value to `Disabled` completely disables scaling in that direction. -### Stabilization Window +### Stabilization window -The stabilization window is used to restrict the flapping of replicas when the metrics -used for scaling keep fluctuating. The stabilization window is used by the autoscaling -algorithm to consider the computed desired state from the past to prevent scaling. In -the following example the stabilization window is specified for `scaleDown`. +The stabilization window is used to restrict the [flapping](#flapping) of +replicas count when the metrics used for scaling keep fluctuating. The autoscaling algorithm +uses this window to infer a previous desired state and avoid unwanted changes to workload +scale. + +For example, in the following example snippet, a stabilization window is specified for `scaleDown`. ```yaml -scaleDown: - stabilizationWindowSeconds: 300 +behavior: + scaleDown: + stabilizationWindowSeconds: 300 ``` When the metrics indicate that the target should be scaled down the algorithm looks -into previously computed desired states and uses the highest value from the specified -interval. In above example all desired states from the past 5 minutes will be considered. +into previously computed desired states, and uses the highest value from the specified +interval. In the above example, all desired states from the past 5 minutes will be considered. + +This approximates a rolling maximum, and avoids having the scaling algorithm frequently +remove Pods only to trigger recreating an equivalent Pod just moments later. ### Default Behavior @@ -498,6 +504,18 @@ behavior: selectPolicy: Disabled ``` +## Support for HorizontalPodAutoscaler in kubectl + +HorizontalPodAutoscaler, like every API resource, is supported in a standard way by `kubectl`. +You can create a new autoscaler using `kubectl create` command. +You can list autoscalers by `kubectl get hpa` or get detailed description by `kubectl describe hpa`. +Finally, you can delete an autoscaler using `kubectl delete hpa`. + +In addition, there is a special `kubectl autoscale` command for creating a HorizontalPodAutoscaler object. +For instance, executing `kubectl autoscale rs foo --min=2 --max=5 --cpu-percent=80` +will create an autoscaler for replication set *foo*, with target CPU utilization set to `80%` +and the number of replicas between 2 and 5. + ## Implicit maintenance-mode deactivation You can implicitly deactivate the HPA for a target without the @@ -509,7 +527,13 @@ replica count or HPA's minimum replica count. ## {{% heading "whatsnext" %}} +If you configure autoscaling in your cluster, you may also want to consider running a +cluster-level autoscaler such as [Cluster Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler). -* Design documentation: [Horizontal Pod Autoscaling](https://git.k8s.io/community/contributors/design-proposals/autoscaling/horizontal-pod-autoscaler.md). -* kubectl autoscale command: [kubectl autoscale](/docs/reference/generated/kubectl/kubectl-commands/#autoscale). -* Usage example of [Horizontal Pod Autoscaler](/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/). +For more information on HorizontalPodAutoscaler: + +* Read a [walkthrough example](/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/) for horizontal pod autoscaling. +* Read documentation for [`kubectl autoscale`](/docs/reference/generated/kubectl/kubectl-commands/#autoscale). +* If you would like to write your own custom metrics adapter, check out the + [boilerplate](https://github.com/kubernetes-sigs/custom-metrics-apiserver) to get started. +* Read the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler/) for HorizontalPodAutoscaler. From cd511eff9c5df2578d7a924888362e11d68c9547 Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Wed, 17 Nov 2021 15:46:48 -0600 Subject: [PATCH 110/148] Adding blog post for dual-stack GA Signed-off-by: Bridget Kromhout Co-authored-by: Tim Bannister Co-authored-by: Nate W. <4453979+nate-double-u@users.noreply.github.com> --- .../2021-12-08-dual-stack-networking-ga.md | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 content/en/blog/_posts/2021-12-08-dual-stack-networking-ga.md diff --git a/content/en/blog/_posts/2021-12-08-dual-stack-networking-ga.md b/content/en/blog/_posts/2021-12-08-dual-stack-networking-ga.md new file mode 100644 index 0000000000..4955bf3c0a --- /dev/null +++ b/content/en/blog/_posts/2021-12-08-dual-stack-networking-ga.md @@ -0,0 +1,56 @@ +--- +layout: blog +title: 'Kubernetes 1.23: Dual-stack IPv4/IPv6 Networking Reaches GA' +date: 2021-12-08 +slug: dual-stack-networking-ga +--- + +**Author:** Bridget Kromhout (Microsoft) + +"When will Kubernetes have IPv6?" This question has been asked with increasing frequency ever since alpha support for IPv6 was first added in k8s v1.9. While Kubernetes has supported IPv6-only clusters since v1.18, migration from IPv4 to IPv6 was not yet possible at that point. At long last, [dual-stack IPv4/IPv6 networking](https://github.com/kubernetes/enhancements/tree/master/keps/sig-network/563-dual-stack/) has reached general availability (GA) in Kubernetes v1.23. + +What does dual-stack networking mean for you? Let’s take a look… + + +## Service API updates + +[Services](/docs/concepts/services-networking/service/) were single-stack before 1.20, so using both IP families meant creating one Service per IP family. The user experience was simplified in 1.20, when Services were re-implemented to allow both IP families, meaning a single Service can handle both IPv4 and IPv6 workloads. Dual-stack load balancing is possible between services running any combination of IPv4 and IPv6. + +The Service API now has new fields to support dual-stack, replacing the single ipFamily field. +* You can select your choice of IP family by setting `ipFamilyPolicy` to one of three options: SingleStack, PreferDualStack, or RequireDualStack. A service can be changed between single-stack and dual-stack (within some limits). +* Setting `ipFamilies` to a list of families assigned allows you to set the order of families used. +* `clusterIPs` is inclusive of the previous `clusterIP` but allows for multiple entries, so it’s no longer necessary to run duplicate services, one in each of the two IP families. Instead, you can assign cluster IP addresses in both IP families. + +Note that Pods are also dual-stack. For a given pod, there is no possibility of setting multiple IP addresses in the same family. + + +## Default behavior remains single-stack + + +Starting in 1.20 with the re-implementation of dual-stack services as alpha, the underlying networking for Kubernetes has included dual-stack whether or not a cluster was configured with the feature flag to enable dual-stack. + +Kubernetes 1.23 removed that feature flag as part of graduating the feature to stable. Dual-stack networking is always available if you want to configure it. You can set your cluster network to operate as single-stack IPv4, as single-stack IPv6, or as dual-stack IPv4/IPv6. + +While Services are set according to what you configure, Pods default to whatever the CNI plugin sets. If your CNI plugin assigns single-stack IPs, you will have single-stack unless `ipFamilyPolicy` specifies PreferDualStack or RequireDualStack. If your CNI plugin assigns dual-stack IPs, `pod.status.PodIPs` defaults to dual-stack. + +Even though dual-stack is possible, it is not mandatory to use it. Examples in the documentation show the variety possible in [dual-stack service configurations](/docs/concepts/services-networking/dual-stack/#dual-stack-service-configuration-scenarios). + + +## Try dual-stack right now + +While upstream Kubernetes now supports [dual-stack networking](/docs/concepts/services-networking/dual-stack/) as a GA or stable feature, each provider’s support of dual-stack Kubernetes may vary. Nodes need to be provisioned with routable IPv4/IPv6 network interfaces. Pods need to be dual-stack. The [network plugin](/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) is what assigns the IP addresses to the Pods, so it's the network plugin being used for the cluster that needs to support dual-stack. Some Container Network Interface (CNI) plugins support dual-stack, as does kubenet. + +Ecosystem support of dual-stack is increasing; you can create [dual-stack clusters with kubeadm](/docs/setup/production-environment/tools/kubeadm/dual-stack-support/), try a [dual-stack cluster locally with KIND](https://kind.sigs.k8s.io/docs/user/configuration/#ip-family), and deploy dual-stack clusters in cloud providers (after checking docs for CNI or kubenet availability). + +## Get involved with SIG Network + +SIG-Network wants to learn from community experiences with dual-stack networking to find out more about evolving needs and your use cases. The [SIG-network update video from KubeCon NA 2021](https://www.youtube.com/watch?v=uZ0WLxpmBbY&list=PLj6h78yzYM2Nd1U4RMhv7v88fdiFqeYAP&index=4) summarizes the SIG’s recent updates, including dual-stack going to stable in 1.23. + +The current SIG-Network [KEPs](https://github.com/orgs/kubernetes/projects/10) and [issues](https://github.com/kubernetes/kubernetes/issues?q=is%3Aopen+is%3Aissue+label%3Asig%2Fnetwork) on GitHub illustrate the SIG’s areas of emphasis. The [dual-stack API server](https://github.com/kubernetes/enhancements/issues/2438) is one place to consider contributing. + +[SIG-Network meetings](https://github.com/kubernetes/community/tree/master/sig-network#meetings) are a friendly, welcoming venue for you to connect with the community and share your ideas. Looking forward to hearing from you! + +## Acknowledgments + +The dual-stack networking feature represents the work of many Kubernetes contributors. Thanks to all who contributed code, experience reports, documentation, code reviews, and everything in between. Bridget Kromhout details this community effort in [Dual-Stack Networking in Kubernetes](https://containerjournal.com/features/dual-stack-networking-in-kubernetes/). KubeCon keynotes by Tim Hockin & Khaled (Kal) Henidak in 2019 ([The Long Road to IPv4/IPv6 Dual-stack Kubernetes](https://www.youtube.com/watch?v=o-oMegdZcg4)) and by Lachlan Evenson in 2021 ([And Here We Go: Dual-stack Networking in Kubernetes](https://www.youtube.com/watch?v=lVrt8F2B9CM)) talk about the dual-stack journey, spanning five years and a great many lines of code. + From 1a3e293393a3f6e3346091ce4cdabd89aae9303f Mon Sep 17 00:00:00 2001 From: amandapunch Date: Fri, 3 Dec 2021 15:16:38 -0800 Subject: [PATCH 111/148] Update chronological order and remove korean language updates --- content/en/_index.html | 10 +++++----- content/ko/_index.html | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/content/en/_index.html b/content/en/_index.html index 965be6abcb..4615b5db0e 100644 --- a/content/en/_index.html +++ b/content/en/_index.html @@ -43,12 +43,12 @@ Kubernetes is open source giving you the freedom to take advantage of on-premise

    - Attend KubeCon North America on October 24-28, 2022 -
    -
    -
    -
    Attend KubeCon Europe on May 17-20, 2022 +
    +
    +
    +
    + Attend KubeCon North America on October 24-28, 2022
  • diff --git a/content/ko/_index.html b/content/ko/_index.html index f45a97995a..c6350f1559 100644 --- a/content/ko/_index.html +++ b/content/ko/_index.html @@ -43,7 +43,7 @@ Google이 일주일에 수십억 개의 컨테이너들을 운영하게 해준

    - Attend KubeCon North America on October 24-28, 2022 + Attend KubeCon North America on October 11-15, 2021


    From 208754663366f375b0664a5fafaa442c8dde123e Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Sat, 4 Dec 2021 10:13:50 +0000 Subject: [PATCH 112/148] Link to https://k8s.dev/ docs about good first issues Where we mention the "help" or "good first issue" labels, let's hyperlink to https://kubernetes.dev/docs/guide/help-wanted/ (our official page on that topic). --- content/en/docs/contribute/advanced.md | 2 +- content/en/docs/contribute/participate/pr-wranglers.md | 8 +++++++- content/en/docs/contribute/review/for-approvers.md | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/content/en/docs/contribute/advanced.md b/content/en/docs/contribute/advanced.md index 2bddacbc3f..d273a522fa 100644 --- a/content/en/docs/contribute/advanced.md +++ b/content/en/docs/contribute/advanced.md @@ -82,7 +82,7 @@ few PR submissions. Responsibilities for New Contributor Ambassadors include: - Monitoring the [#sig-docs Slack channel](https://kubernetes.slack.com) for questions from new contributors. -- Working with PR wranglers to identify good first issues for new contributors. +- Working with PR wranglers to identify [good first issues](https://kubernetes.dev/docs/guide/help-wanted/#good-first-issue) for new contributors. - Mentoring new contributors through their first few PRs to the docs repo. - Helping new contributors create the more complex PRs they need to become Kubernetes members. - [Sponsoring contributors](/docs/contribute/advanced/#sponsor-a-new-contributor) on their path to becoming Kubernetes members. diff --git a/content/en/docs/contribute/participate/pr-wranglers.md b/content/en/docs/contribute/participate/pr-wranglers.md index 3e12c2706e..fb6f54e2d9 100644 --- a/content/en/docs/contribute/participate/pr-wranglers.md +++ b/content/en/docs/contribute/participate/pr-wranglers.md @@ -29,7 +29,13 @@ Each day in a week-long shift as PR Wrangler: - You can also tag a [SIG](https://github.com/kubernetes/community/blob/master/sig-list.md) for a review by commenting `@kubernetes/-pr-reviews` on the PR. - Use the `/approve` comment to approve a PR for merging. Merge the PR when ready. - PRs should have a `/lgtm` comment from another member before merging. - - Consider accepting technically accurate content that doesn't meet the [style guidelines](/docs/contribute/style/style-guide/). Open a new issue with the label `good first issue` to address style concerns. + - Consider accepting technically accurate content that doesn't meet the + [style guidelines](/docs/contribute/style/style-guide/). As you approve the change, + open a new issue to address the style concern. You can usually write these style fix + issues as [good first issues](https://kubernetes.dev/docs/guide/help-wanted/#good-first-issue). + - Using style fixups as good first issues is a good way to ensure a supply of easier tasks + to help onboard new contributors. + ### Helpful GitHub queries for wranglers diff --git a/content/en/docs/contribute/review/for-approvers.md b/content/en/docs/contribute/review/for-approvers.md index 5c781ec53f..7081427b6a 100644 --- a/content/en/docs/contribute/review/for-approvers.md +++ b/content/en/docs/contribute/review/for-approvers.md @@ -121,7 +121,7 @@ finds issues that might need triage. `priority/important-longterm` | Do this within 6 months. `priority/backlog` | Deferrable indefinitely. Do when resources are available. `priority/awaiting-more-evidence` | Placeholder for a potentially good issue so it doesn't get lost. - `help` or `good first issue` | Suitable for someone with very little Kubernetes or SIG Docs experience. See [Help Wanted and Good First Issue Labels](https://github.com/kubernetes/community/blob/master/contributors/guide/help-wanted.md) for more information. + `help` or `good first issue` | Suitable for someone with very little Kubernetes or SIG Docs experience. See [Help Wanted and Good First Issue Labels](https://kubernetes.dev/docs/guide/help-wanted/) for more information. {{< /table >}} From c1af8d4c1bd5ea704765e58edd1a323f96c923cd Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 1 Dec 2021 22:33:19 +0000 Subject: [PATCH 113/148] Present scope for IngressClass params using tabs Use tabs for the two different options that an IngressClass can use to refer to another object, in order to specific parameters that relate to that IngressClass: - namespaced scope - cluster scope (the default / historical behavior) --- .../concepts/services-networking/ingress.md | 99 ++++++++++++++++--- 1 file changed, 86 insertions(+), 13 deletions(-) diff --git a/content/en/docs/concepts/services-networking/ingress.md b/content/en/docs/concepts/services-networking/ingress.md index 5f4837fa29..4fb7a2c215 100644 --- a/content/en/docs/concepts/services-networking/ingress.md +++ b/content/en/docs/concepts/services-networking/ingress.md @@ -219,25 +219,98 @@ of the controller that should implement the class. {{< codenew file="service/networking/external-lb.yaml" >}} -IngressClass resources contain an optional parameters field. This can be used to -reference additional implementation-specific configuration for this class. +The `.spec.parameters` field of an IngressClass lets you reference another +resource that provides configuration related to that IngressClass. -#### Namespace-scoped parameters +The specific type of parameters to use depends on the ingress controller +that you specify in the `.spec.controller` field of the IngressClass. +### IngressClass scope + +Depending on your ingress controller, you may be able to use parameters +that you set cluster-wide, or just for one namespace. + +{{< tabs name="tabs_ingressclass_parameter_scope" >}} +{{% tab name="Cluster" %}} +The default scope for IngressClass parameters is cluster-wide. + +If you set the `.spec.parameters` field and don't set +`.spec.parameters.scope`, or if you set `.spec.parameters.scope` to +`Cluster`, then the IngressClass refers to a cluster-scoped resource. +The `kind` (in combination the `apiGroup`) of the parameters +refers to a cluster-scoped API (possibly a custom resource), and +the `name` of the parameters identifies a specific cluster scoped +resource for that API. + +For example: +```yaml +--- +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + name: external-lb-1 +spec: + controller example.com/ingress-controller + parameters: + # The parameters for this IngressClass are specified in an + # ClusterIngressParameter (API group k8s.example.net) named + # "external-config-1". This definition tells Kubernetes to + # look for a cluster-scoped parameter resource. + scope: Cluster + apiGroup: k8s.example.net + kind: ClusterIngressParameter + name: external-config +``` +{{% /tab %}} +{{% tab name="Namespaced" %}} {{< feature-state for_k8s_version="v1.23" state="stable" >}} -`Parameters` field has a `scope` and `namespace` field that can be used to -reference a namespace-specific resource for configuration of an Ingress class. -`Scope` field defaults to `Cluster`, meaning, the default is cluster-scoped -resource. Setting `Scope` to `Namespace` and setting the `Namespace` field -will reference a parameters resource in a specific namespace: +If you set the `.spec.parameters` field and set +`.spec.parameters.scope` to `Namespace`, then the IngressClass refers +to a namespaced-scoped resource. You must also set the `namespace` +field within `.spec.parameters` to the namespace that contains +the parameters you want to use. -Namespace-scoped parameters avoid the need for a cluster-scoped CustomResourceDefinition -for a parameters resource. This further avoids RBAC-related resources -that would otherwise be required to grant permissions to cluster-scoped -resources. +The `kind` (in combination the `apiGroup`) of the parameters +refers to a namespaced API (for example: ConfigMap), and +the `name` of the parameters identifies a specific resource +in the namespace you specified in `namespace`. -{{< codenew file="service/networking/namespaced-params.yaml" >}} +Namespace-scoped parameters help the cluster operator delegate control over the +configuration (for example: load balancer settings, API gateway definition) +that is used for a workload. If you used a cluster-scoped parameter then either: + +- the cluster operator team needs to approve a different team's changes every + time there's a new configuration change being applied. +- the cluster operator must define specific access controls, such as + [RBAC](/docs/reference/access-authn-authz/rbac/) roles and bindings, that let + the application team make changes to the cluster-scoped parameters resource. + +The IngressClass API itself is always cluster-scoped. + +Here is an example of an IngressClass that refers to parameters that are +namespaced: +```yaml +--- +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + name: external-lb-2 +spec: + controller example.com/ingress-controller + parameters: + # The parameters for this IngressClass are specified in an + # IngressParameter (API group k8s.example.com) named "external-config", + # that's in the "external-configuration" configuration namespace. + scope: Namespace + apiGroup: k8s.example.com + kind: IngressParameter + namespace: external-configuration + name: external-config +``` + +{{% /tab %}} +{{< /tabs >}} ### Deprecated annotation From fdfa669e72f31ccd1076506a296a13fdfd7faed6 Mon Sep 17 00:00:00 2001 From: chenxuc Date: Sat, 4 Dec 2021 20:30:26 +0800 Subject: [PATCH 114/148] [zh] sync auth for 1.22 --- .../reference/access-authn-authz/_index.md | 4 +- .../certificate-signing-requests.md | 130 +++++++++++------- .../extensible-admission-controllers.md | 4 +- 3 files changed, 87 insertions(+), 51 deletions(-) diff --git a/content/zh/docs/reference/access-authn-authz/_index.md b/content/zh/docs/reference/access-authn-authz/_index.md index 4a67bd9440..24df472264 100644 --- a/content/zh/docs/reference/access-authn-authz/_index.md +++ b/content/zh/docs/reference/access-authn-authz/_index.md @@ -1,12 +1,12 @@ --- title: 访问 API -weight: 20 +weight: 15 no_list: true --- diff --git a/content/zh/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/zh/docs/reference/access-authn-authz/certificate-signing-requests.md index e9d5e62c65..cd82025d19 100644 --- a/content/zh/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/zh/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -8,6 +8,7 @@ reviewers: - liggitt - mikedanese - munnerz +- enj title: Certificate Signing Requests content_type: concept weight: 20 @@ -50,6 +51,9 @@ The CertificateSigningRequest object includes a PEM-encoded PKCS#10 signing requ the `spec.request` field. The CertificateSigningRequest denotes the _signer_ (the recipient that the request is being made to) using the `spec.signerName` field. Note that `spec.signerName` is a required key after api version `certificates.k8s.io/v1`. +In Kubernetes v1.22 and later, clients may optionally set the `spec.expirationSeconds` +field to request a particular lifetime for the issued certificate. The minimum valid +value for this field is `600`, i.e. ten minutes. --> ## 请求签名流程 {#request-signing-process} @@ -57,6 +61,8 @@ CertificateSigningRequest 资源类型允许客户使用它申请发放 X.509 CertificateSigningRequest 对象 在 `spec.request` 中包含一个 PEM 编码的 PKCS#10 签名请求。 CertificateSigningRequest 使用 `spec.signerName` 字段标示 _签名者_(请求的接收方)。 注意,`spec.signerName` 在 `certificates.k8s.io/v1` 之后的 API 版本是必填项。 +在 Kubernetes v1.22 和以后的版本,客户可以可选地设置 `spec.expirationSeconds` +字段来为颁发的证书设定一个特定的有效期。该字段的最小有效值是 `600`,也就是 10 分钟。 为了减少集群中遗留的过时的 CertificateSigningRequest 资源的数量, 一个垃圾收集控制器将会周期性地运行。 @@ -121,7 +129,9 @@ state for some duration: * 已批准的请求:1小时后自动删除 * 已拒绝的请求:1小时后自动删除 -* 挂起的请求:1小时后自动删除 +* 已失败的请求:1小时后自动删除 +* 挂起的请求:24小时后自动删除 +* 所有请求:在颁发的证书过期后自动删除 @@ -159,8 +167,8 @@ This includes: Email subjectAltNames、URI subjectAltNames 等,请求一个受限制的扩展项时的应对手段。 4. **许可的密钥用途/扩展的密钥用途**:当用途和签名者在 CSR 中指定的用途不同时, 相应的限制和应对手段。 -5. **过期时间/证书有效期**:过期时间由签名者确定、由管理员配置,还是由 CSR 对象指定等, - 以及过期时间与签名者在 CSR 中指定过期时间不同时的应对手段。 +5. **过期时间/证书有效期**:过期时间由签名者确定、由管理员配置、还是由 CSR `spec.expirationSeconds` 字段指定等, + 以及签名者决定的过期时间与 CSR `spec.expirationSeconds` 字段不同时的应对手段。 6. **允许/不允许 CA 位**:当 CSR 包含一个签名者并不允许的 CA 证书的请求时,相应的应对手段。 -PKCS#10 签名请求格式不允许设置证书的过期时间或者生命期。因此,证书的过期 -时间或者生命期必须通过类似 CSR 对象的注解字段这种形式来设置。 -尽管让签名者使用过期日期从理论上来讲也是可行的,目前还不存在哪个实现这样做了。 -(内置的签名者都是用相同的 `ClusterSigningDuration` 配置选项,而该选项 -中将生命期的默认值设为 1 年,且可通过 kube-controller-manager 的命令行选项 -`--cluster-signing-duration` 来更改。) +PKCS#10 签名请求格式并没有一种标准的方法去设置证书的过期时间或者生命期。 +因此,证书的过期时间或者生命期必须通过 CSR 对象的 `spec.expirationSeconds` 字段来设置。 +当 `spec.expirationSeconds` 没有被指定时,内置的签名者默认使用 `ClusterSigningDuration` 配置选项 +(kube-controller-manager 的命令行选项 `--cluster-signing-duration`),该选项的默认值设为 1 年。 +当 `spec.expirationSeconds` 被指定时,`spec.expirationSeconds` 和 `ClusterSigningDuration` +中的最小值会被使用。 + +{{< note >}} + +`spec.expirationSeconds` 字段是在 Kubernetes v1.22 中加入的。早期的 Kubernetes 版本并不认识该字段。 +v1.22 版本之前的 Kubernetes API 服务器会在创建对象的时候忽略该字段。 +{{< /note >}} 1. `kubernetes.io/kube-apiserver-client`:签名的证书将被 API 服务器视为客户证书。 @@ -229,8 +246,8 @@ Kubernetes提供了内置的签名者,每个签名者都有一个众所周知 1. 许可的 x509 扩展:允许 subjectAltName 和 key usage 扩展,弃用其他扩展。 1. 许可的密钥用途:必须包含 `["client auth"]`,但不能包含 `["digital signature", "key encipherment", "client auth"]` 之外的键。 - 1. 过期时间/证书有效期:通过 kube-controller-manager 中 `--cluster-signing-duration` - 标志来设置,由其中的签名者实施。 + 1. 过期时间/证书有效期:对于 kube-controller-manager 实现的签名者, + 设置为 `--cluster-signing-duration` 选项和 CSR 对象的 `spec.expirationSeconds` 字段(如有设置该字段)中的最小值。 1. 允许/不允许 CA 位:不允许。 2. `kubernetes.io/kube-apiserver-client-kubelet`: 签名的证书将被 kube-apiserver 视为客户证书。 @@ -253,8 +270,8 @@ Kubernetes提供了内置的签名者,每个签名者都有一个众所周知 1. 许可的主体:组织名必须是 `["system:nodes"]`,用户名以 "`system:node:`" 开头 1. 许可的 x509 扩展:允许 key usage 扩展,禁用 subjectAltName 扩展,并删除其他扩展。 1. 许可的密钥用途:必须是 `["key encipherment", "digital signature", "client auth"]` - 1. 过期时间/证书有效期:通过 kube-controller-manager 中签名者的实现所对应的标志 - `--cluster-signing-duration` 来设置。 + 1. 过期时间/证书有效期:对于 kube-controller-manager 实现的签名者, + 设置为 `--cluster-signing-duration` 选项和 CSR 对象的 `spec.expirationSeconds` 字段(如有设置该字段)中的最小值。 1. 允许/不允许 CA 位:不允许。 3. `kubernetes.io/kubelet-serving`: 签名服务证书,该服务证书被 API 服务器视为有效的 kubelet 服务证书, @@ -277,8 +295,8 @@ Kubernetes提供了内置的签名者,每个签名者都有一个众所周知 禁止 EmailAddress、URI subjectAltName 等扩展,并丢弃其他扩展。 至少有一个 DNS 或 IP 的 SubjectAltName 存在。 1. 许可的密钥用途:必须是 `["key encipherment", "digital signature", "client auth"]` - 1. 过期日期/证书生命期:通过 kube-controller-manager 中签名者的实现所对应的标志 - `--cluster-signing-duration` 来设置。 + 1. 过期时间/证书有效期:对于 kube-controller-manager 实现的签名者, + 设置为 `--cluster-signing-duration` 选项和 CSR 对象的 `spec.expirationSeconds` 字段(如有设置该字段)中的最小值。 1. 允许/不允许 CA 位:不允许。 4. `kubernetes.io/legacy-unknown`: 不保证信任。Kubernetes 的一些第三方发行版可能会使用它签署的客户端证书。 @@ -302,8 +320,8 @@ Kubernetes提供了内置的签名者,每个签名者都有一个众所周知 1. 许可的主体:全部。 1. 许可的 x509 扩展:允许 subjectAltName 和 key usage 等扩展,并弃用其他扩展。 1. 许可的密钥用途:全部。 - 1. 过期日期/证书生命期:通过 kube-controller-manager 中签名者的实现所对应的标志 - `--cluster-signing-duration` 来设置。 + 1. 过期时间/证书有效期:对于 kube-controller-manager 实现的签名者, + 设置为 `--cluster-signing-duration` 选项和 CSR 对象的 `spec.expirationSeconds` 字段(如有设置该字段)中的最小值。 1. 允许/不允许 CA 位 - 不允许。 {{< note >}} @@ -313,6 +331,15 @@ Failures for all of these are only reported in kube-controller-manager logs. 注意:所有这些故障仅在 kube-controller-manager 日志中报告。 {{< /note >}} +{{< note >}} + +`spec.expirationSeconds` 字段是在 Kubernetes v1.22 中加入的。早期的 Kubernetes 版本并不认识该字段。 +v1.22 版本之前的 Kubernetes API 服务器会在创建对象的时候忽略该字段。 +{{< /note >}} + ## 普通用户 {#normal-user} 为了让普通用户能够通过认证并调用 API,需要执行几个步骤。 首先,该用户必须拥有 Kubernetes 集群签发的证书, -然后将该证书作为 API 调用的 Certificate 头或通过 kubectl 提供。 +然后将该证书提供给 Kubernetes API。 需要注意的几点: - `usage` 字段必须是 '`client auth`' +- `expirationSeconds` 可以设置为更长(例如 `864000` 是十天)或者更短(例如 `3600` 是一个小时) - `request` 字段是 CSR 文件内容的 base64 编码值。 要得到该值,可以执行命令 `cat myuser.csr | base64 | tr -d "\n"`。 @@ -522,19 +549,19 @@ kubectl get csr myuser -o jsonpath='{.status.certificate}'| base64 -d > myuser.c ``` ### 创建角色和角色绑定 {#create-role-and-role-binding} 创建了证书之后,为了让这个用户能访问 Kubernetes 集群资源,现在就要创建 Role 和 RoleBinding 了。 -下面是为这个新用户创建 Role 的示例脚本: +下面是为这个新用户创建 Role 的示例命令: ```shell kubectl create role developer --verb=create --verb=get --verb=list --verb=update --verb=delete --resource=pods @@ -725,6 +752,15 @@ Kubernetes 控制平面实现了每一个 kube-controller-manager 签名所有标记为 approved 的 CSR。 {{< /note >}} +{{< note >}} + +`spec.expirationSeconds` 字段是在 Kubernetes v1.22 中加入的。早期的 Kubernetes 版本并不认识该字段。 +v1.22 版本之前的 Kubernetes API 服务器会在创建对象的时候忽略该字段。 +{{< /note >}} + 示例准入 Webhook 服务器置 `ClientAuth` 字段为 -[空](https://github.com/kubernetes/kubernetes/blob/v1.13.0/test/images/webhook/config.go#L47-L48), +[空](https://github.com/kubernetes/kubernetes/blob/v1.22.0/test/images/agnhost/webhook/config.go#L38-L39), 默认为 `NoClientCert` 。这意味着 webhook 服务器不会验证客户端的身份,认为其是 apiservers。 如果你需要双向 TLS 或其他方式来验证客户端,请参阅 如何[对 apiservers 进行身份认证](#authenticate-apiservers)。 From 61d8c130281ff1494d2b599850a305cb6fb1dabd Mon Sep 17 00:00:00 2001 From: Arhell Date: Sun, 5 Dec 2021 02:45:39 +0200 Subject: [PATCH 115/148] [id] updated circtl version --- .../production-environment/tools/kubeadm/install-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/id/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/id/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index fa474e82f9..87bec4751f 100644 --- a/content/id/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/id/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -233,7 +233,7 @@ curl -L "https://github.com/containernetworking/plugins/releases/download/${CNI_ Menginstal crictl (dibutuhkan untuk kubeadm / Kubelet Container Runtime Interface (CRI)) ```bash -CRICTL_VERSION="v1.17.0" +CRICTL_VERSION="v1.22.0" ARCH="amd64" mkdir -p /opt/bin curl -L "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-${ARCH}.tar.gz" | sudo tar -C $DOWNLOAD_DIR -xz From 366ae6e48bb7c959cd2040000ab52e19dbbb5f86 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Sun, 5 Dec 2021 22:26:49 +0000 Subject: [PATCH 116/148] Fix IngressClass tabs --- content/en/docs/concepts/services-networking/ingress.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/services-networking/ingress.md b/content/en/docs/concepts/services-networking/ingress.md index 4fb7a2c215..0bcacd7e20 100644 --- a/content/en/docs/concepts/services-networking/ingress.md +++ b/content/en/docs/concepts/services-networking/ingress.md @@ -252,14 +252,14 @@ metadata: spec: controller example.com/ingress-controller parameters: - # The parameters for this IngressClass are specified in an + # The parameters for this IngressClass are specified in a # ClusterIngressParameter (API group k8s.example.net) named # "external-config-1". This definition tells Kubernetes to # look for a cluster-scoped parameter resource. scope: Cluster apiGroup: k8s.example.net kind: ClusterIngressParameter - name: external-config + name: external-config-1 ``` {{% /tab %}} {{% tab name="Namespaced" %}} From 5f369513e0226d135a56aebb9c66b92c173312ca Mon Sep 17 00:00:00 2001 From: prabhsimransingh Date: Sun, 5 Dec 2021 15:10:32 -0800 Subject: [PATCH 117/148] Fixing kubectl cheatsheet run command comment to be more accurate (#29879) * Fixing kubectl cheatsheet run command comment to be more accurate * remove new line --- content/en/docs/reference/kubectl/cheatsheet.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/docs/reference/kubectl/cheatsheet.md b/content/en/docs/reference/kubectl/cheatsheet.md index 5ea50e9ca6..87451a03ac 100644 --- a/content/en/docs/reference/kubectl/cheatsheet.md +++ b/content/en/docs/reference/kubectl/cheatsheet.md @@ -311,8 +311,7 @@ kubectl logs -f my-pod # stream pod logs (stdout) kubectl logs -f my-pod -c my-container # stream pod container logs (stdout, multi-container case) kubectl logs -f -l name=myLabel --all-containers # stream all pods logs with label name=myLabel (stdout) kubectl run -i --tty busybox --image=busybox -- sh # Run pod as interactive shell -kubectl run nginx --image=nginx -n -mynamespace # Run pod nginx in a specific namespace +kubectl run nginx --image=nginx -n mynamespace # Start a single instance of nginx pod in the namespace of mynamespace kubectl run nginx --image=nginx # Run pod nginx and write its spec into a file called pod.yaml --dry-run=client -o yaml > pod.yaml From a0c6f3fd6f49e4b5eda5e4f6e06b798799f4176a Mon Sep 17 00:00:00 2001 From: Suvro Date: Sun, 5 Dec 2021 18:14:32 -0500 Subject: [PATCH 118/148] Replaced annotation with ingressClassName (#30171) * Replaced annotation with ingressClassName Updated content of https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/#using-multiple-ingress-controllers with ingressClassName which replaces annotations Signed-off-by: Suvro Ghosh * Update content/en/docs/concepts/services-networking/ingress-controllers.md Co-authored-by: Deepak Gupta Co-authored-by: Deepak Gupta --- .../concepts/services-networking/ingress-controllers.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/content/en/docs/concepts/services-networking/ingress-controllers.md b/content/en/docs/concepts/services-networking/ingress-controllers.md index b19c973fc7..033533e35d 100644 --- a/content/en/docs/concepts/services-networking/ingress-controllers.md +++ b/content/en/docs/concepts/services-networking/ingress-controllers.md @@ -57,12 +57,11 @@ Kubernetes as a project supports and maintains [AWS](https://github.com/kubernet ## Using multiple Ingress controllers -You may deploy [any number of ingress controllers](https://git.k8s.io/ingress-nginx/docs/user-guide/multiple-ingress.md#multiple-ingress-controllers) -within a cluster. When you create an ingress, you should annotate each ingress with the appropriate -[`ingress.class`](https://git.k8s.io/ingress-gce/docs/faq/README.md#how-do-i-run-multiple-ingress-controllers-in-the-same-cluster) -to indicate which ingress controller should be used if more than one exists within your cluster. +You may deploy any number of ingress controllers using [ingress class](/docs/concepts/services-networking/ingress/#ingress-class) +within a cluster. Note the `.metadata.name` of your ingress class resource. When you create an ingress you would need that name to specify the `ingressClassName` field on your Ingress object (refer to [IngressSpec v1 reference](/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec). `ingressClassName` is a replacement of the older [annotation method](/docs/concepts/services-networking/ingress/#deprecated-annotation). -If you do not define a class, your cloud provider may use a default ingress controller. +If you do not specify an IngressClass for an Ingress, and your cluster has exactly one IngressClass marked as default, then Kubernetes [applies](/docs/concepts/services-networking/ingress/#default-ingress-class) the cluster's default IngressClass to the Ingress. +You mark an IngressClass as default by setting the [`ingressclass.kubernetes.io/is-default-class` annotation](/docs/reference/labels-annotations-taints/#ingressclass-kubernetes-io-is-default-class) on that IngressClass, with the string value `"true"`. Ideally, all ingress controllers should fulfill this specification, but the various ingress controllers operate slightly differently. From 3f91237afc73846b5638360124c1e3948312a1d6 Mon Sep 17 00:00:00 2001 From: Ayushman <53306550+chetak123@users.noreply.github.com> Date: Mon, 6 Dec 2021 04:50:32 +0530 Subject: [PATCH 119/148] changed links from beta2-beta3 (#30059) Signed-off-by: Ayushman From 8a8f9c40f9f386dac6ab9c7f117f521c5bc79bcd Mon Sep 17 00:00:00 2001 From: Wang Date: Sun, 5 Dec 2021 21:05:08 +0900 Subject: [PATCH 120/148] Update admission-controllers.md --- .../reference/access-authn-authz/admission-controllers.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/admission-controllers.md b/content/en/docs/reference/access-authn-authz/admission-controllers.md index 0461c09f53..17354fc58f 100644 --- a/content/en/docs/reference/access-authn-authz/admission-controllers.md +++ b/content/en/docs/reference/access-authn-authz/admission-controllers.md @@ -30,9 +30,9 @@ mutating and validating (respectively) which are configured in the API. Admission controllers may be "validating", "mutating", or both. Mutating -controllers may modify the objects they admit; validating controllers may not. +controllers may modify related objects to the requests they admit; validating controllers may not. -Admission controllers limit requests to create, delete, modify or connect to (proxy). They do not support read requests. +Admission controllers limit requests to create, delete, modify objects or connect to proxy. They do not limit requests to read objects. The admission control process proceeds in two phases. In the first phase, mutating admission controllers are run. In the second phase, validating From 16602983467caba541eb7fdfe4602923a855f91f Mon Sep 17 00:00:00 2001 From: Mohit Sharma Date: Mon, 6 Dec 2021 11:18:32 +1000 Subject: [PATCH 121/148] fixed the list container images by pod section (#30207) Signed-off-by: Mohit Sharma --- .../list-all-running-container-images.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/list-all-running-container-images.md b/content/en/docs/tasks/access-application-cluster/list-all-running-container-images.md index 133eae902b..30c4841c6d 100644 --- a/content/en/docs/tasks/access-application-cluster/list-all-running-container-images.md +++ b/content/en/docs/tasks/access-application-cluster/list-all-running-container-images.md @@ -70,7 +70,7 @@ The formatting can be controlled further by using the `range` operation to iterate over elements individually. ```shell -kubectl get pods --all-namespaces -o=jsonpath='{range .items[*]}{"\n"}{.metadata.name}{":\t"}{range .spec.containers[*]}{.image}{", "}{end}{end}' |\ +kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{"\n"}{.metadata.name}{":\t"}{range .spec.containers[*]}{.image}{", "}{end}{end}' |\ sort ``` @@ -80,7 +80,7 @@ To target only Pods matching a specific label, use the -l flag. The following matches only Pods with labels matching `app=nginx`. ```shell -kubectl get pods --all-namespaces -o=jsonpath="{.items[*].spec.containers[*].image}" -l app=nginx +kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec.containers[*].image}" -l app=nginx ``` ## List Container images filtering by Pod namespace From 63420166a1d3b4b56225792b71d536d05010171e Mon Sep 17 00:00:00 2001 From: prameshj Date: Sun, 5 Dec 2021 17:28:32 -0800 Subject: [PATCH 122/148] Update docs to clarify the dns configmap format. (#29988) * Update docs to clarify the dns configmap format. * Update content/en/docs/tasks/administer-cluster/nodelocaldns.md Co-authored-by: Qiming Teng Co-authored-by: Qiming Teng --- content/en/docs/tasks/administer-cluster/nodelocaldns.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/content/en/docs/tasks/administer-cluster/nodelocaldns.md b/content/en/docs/tasks/administer-cluster/nodelocaldns.md index e2038a7223..4568182251 100644 --- a/content/en/docs/tasks/administer-cluster/nodelocaldns.md +++ b/content/en/docs/tasks/administer-cluster/nodelocaldns.md @@ -91,4 +91,13 @@ If you are using the sample manifest from the previous point, this will require Once enabled, node-local-dns Pods will run in the kube-system namespace on each of the cluster nodes. This Pod runs [CoreDNS](https://github.com/coredns/coredns) in cache mode, so all CoreDNS metrics exposed by the different plugins will be available on a per-node basis. You can disable this feature by removing the DaemonSet, using `kubectl delete -f ` . You should also revert any changes you made to the kubelet configuration. + +## StubDomains and Upstream server Configuration + +StubDomains and upstream servers specified in the `kube-dns` ConfigMap in the `kube-system` namespace +are automatically picked up by `node-local-dns` pods. The ConfigMap contents need to follow the format +shown in [the example](/docs/tasks/administer-cluster/dns-custom-nameservers/#example-1). +The `node-local-dns` ConfigMap can also be modified directly with the stubDomain configuration +in the Corefile format. Some cloud providers might not allow modifying `node-local-dns` ConfigMap directly. +In those cases, the `kube-dns` ConfigMap can be updated. From 798aae5127089600cc2b50fd1c06648920711d7c Mon Sep 17 00:00:00 2001 From: Meha Bhalodiya Date: Mon, 6 Dec 2021 09:20:32 +0530 Subject: [PATCH 123/148] Fix a few grammar issues and typos (#28387) * Fix a few grammar issues and typos * Minor changes --- content/en/docs/contribute/advanced.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/contribute/advanced.md b/content/en/docs/contribute/advanced.md index d273a522fa..f82e07f28a 100644 --- a/content/en/docs/contribute/advanced.md +++ b/content/en/docs/contribute/advanced.md @@ -27,7 +27,7 @@ the documentation, the website style, the processes for reviewing and merging pull requests, or other aspects of the documentation. For maximum transparency, these types of proposals need to be discussed in a SIG Docs meeting or on the [kubernetes-sig-docs mailing list](https://groups.google.com/forum/#!forum/kubernetes-sig-docs). -In addition, it can really help to have some context about the way things +In addition, it can help to have some context about the way things currently work and why past decisions have been made before proposing sweeping changes. The quickest way to get answers to questions about how the documentation currently works is to ask in the `#sig-docs` Slack channel on @@ -54,7 +54,7 @@ refer to The SIG Docs representative for a given release coordinates the following tasks: - Monitor the feature-tracking spreadsheet for new or changed features with an - impact on documentation. If documentation for a given feature won't be ready + impact on documentation. If the documentation for a given feature won't be ready for the release, the feature may not be allowed to go into the release. - Attend sig-release meetings regularly and give updates on the status of the docs for the release. @@ -87,7 +87,7 @@ Responsibilities for New Contributor Ambassadors include: - Helping new contributors create the more complex PRs they need to become Kubernetes members. - [Sponsoring contributors](/docs/contribute/advanced/#sponsor-a-new-contributor) on their path to becoming Kubernetes members. -Current New Contributor Ambassadors are announced at each SIG-Docs meeting, and in the [Kubernetes #sig-docs channel](https://kubernetes.slack.com). +Current New Contributor Ambassadors are announced at each SIG-Docs meeting and in the [Kubernetes #sig-docs channel](https://kubernetes.slack.com). ## Sponsor a new contributor @@ -122,7 +122,7 @@ Approvers must meet the following requirements to be a co-chair: - Understand SIG Docs workflows and tooling: git, Hugo, localization, blog subproject - Understand how other Kubernetes SIGs and repositories affect the SIG Docs workflow, including: - [teams in k/org](https://github.com/kubernetes/org/blob/master/config/kubernetes/sig-docs/teams.yaml), + [teams in k/org](https://github.com/kubernetes/org/blob/master/config/kubernetes/sig-docs/teams.yaml), the [process in k/community](https://github.com/kubernetes/community/tree/master/sig-docs), plugins in [k/test-infra](https://github.com/kubernetes/test-infra/), and the role of [SIG Architecture](https://github.com/kubernetes/community/tree/master/sig-architecture). From 1c90494c38d4c2cfffee20a10c44c11f94258ad4 Mon Sep 17 00:00:00 2001 From: Brandon Smith Date: Sun, 5 Dec 2021 20:02:33 -0800 Subject: [PATCH 124/148] 1.22 Windows HostProcess containers update (#30699) * Transferred applicable modifications for 1.23 over to 1.22. * kublet -> kubelet * Update content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md Co-authored-by: Mark Rossetti Co-authored-by: Mark Rossetti --- .../create-hostprocess-pod.md | 129 ++++++++---------- 1 file changed, 59 insertions(+), 70 deletions(-) diff --git a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md index 2ab2bd3661..bedcf0a88d 100644 --- a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md +++ b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md @@ -9,100 +9,80 @@ min-kubernetes-server-version: 1.22 {{< feature-state for_k8s_version="v1.22" state="alpha" >}} -Windows HostProcess containers enable you to run containerized -workloads on a Windows host. These containers operate as -normal processes but have access to the host network namespace, -storage, and devices when given the appropriate user privileges. +Windows HostProcess containers enable you to run containerized +workloads on a Windows host. These containers operate as +normal processes but have access to the host network namespace, +storage, and devices when given the appropriate user privileges. HostProcess containers can be used to deploy network plugins, -storage configurations, device plugins, kube-proxy, and other -components to Windows nodes without the need for dedicated proxies or +storage configurations, device plugins, kube-proxy, and other +components to Windows nodes without the need for dedicated proxies or the direct installation of host services. -Administrative tasks such as installation of security patches, event -log collection, and more can be performed without requiring cluster operators to -log onto each Window node. HostProcess containers can run as any user that is -available on the host or is in the domain of the host machine, allowing administrators -to restrict resource access through user permissions. While neither filesystem or process -isolation are supported, a new volume is created on the host upon starting the container -to give it a clean and consolidated workspace. HostProcess containers can also be built on -top of existing Windows base images and do not inherit the same -[compatibility requirements](https://docs.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility) -as Windows server containers, meaning that the version of the base images does not need -to match that of the host. HostProcess containers also support +Administrative tasks such as installation of security patches, event +log collection, and more can be performed without requiring cluster operators to +log onto each Window node. HostProcess containers can run as any user that is +available on the host or is in the domain of the host machine, allowing administrators +to restrict resource access through user permissions. While neither filesystem or process +isolation are supported, a new volume is created on the host upon starting the container +to give it a clean and consolidated workspace. HostProcess containers can also be built on +top of existing Windows base images and do not inherit the same +[compatibility requirements](https://docs.microsoft.com/virtualization/windowscontainers/deploy-containers/version-compatibility) +as Windows server containers, meaning that the version of the base images does not need +to match that of the host. It is, however, recommended that you use the same base image +version as your Windows Server container workloads to ensure you do not have any unused +images taking up space on the node. HostProcess containers also support [volume mounts](./create-hostprocess-pod#volume-mounts) within the container volume. ### When should I use a Windows HostProcess container? -- When you need to perform tasks which require the networking namespace of the host. +- When you need to perform tasks which require the networking namespace of the host. HostProcess containers have access to the host's network interfaces and IP addresses. - You need access to resources on the host such as the filesystem, event logs, etc. - Installation of specific device drivers or Windows services. -- Consolidation of administrative tasks and security policies. This reduces the degree of +- Consolidation of administrative tasks and security policies. This reduces the degree of privileges needed by Windows nodes. -## {{% heading "prerequisites" %}} +## {{% heading "prerequisites" %}}% version-check %}} -{{% version-check %}} - -To enable HostProcess containers while in Alpha you need to pass the following feature gate flag to -**kubelet** and **kube-apiserver**. +To enable HostProcess containers while in Alpha you need to +pass the following feature gate flag to +**kubelet** and **kube-apiserver**. See [Features Gates](/docs/reference/command-line-tools-reference/feature-gates/#overview) documentation for more details. -``` +```powershell --feature-gates=WindowsHostProcessContainers=true ``` -You can use the latest version of Containerd (v1.5.4+) with the following settings using the containerd -v2 configuration. Add these annotations to any runtime configurations were you wish to enable the -HostProcess container feature. - - -``` -[plugins] - [plugins."io.containerd.grpc.v1.cri"] - [plugins."io.containerd.grpc.v1.cri".containerd] - [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime] - container_annotations = ["microsoft.com/hostprocess-container"] - pod_annotations = ["microsoft.com/hostprocess-container"] - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes] - [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runhcs-wcow-process] - container_annotations = ["microsoft.com/hostprocess-container"] - pod_annotations = ["microsoft.com/hostprocess-container"] -``` - -The current versions of containerd ship with a version of hcsshim that does not have support. -You will need to build a version of hcsshim from the main branch following the -[instructions in hcsshim](https://github.com/Microsoft/hcsshim/#containerd-shim). -Once the containerd shim is built you can replace the file in your contianerd installation. -For example if you followed the instructions to -[install containerd](/docs/setup/production-environment/container-runtimes/#containerd) -replace the `containerd-shim-runhcs-v1.exe` is installed at `$Env:ProgramFiles\containerd` with the newly built shim. +The kubelet will communicate with containerd directly by +passing the hostprocess flag via CRI. You can use the +latest version of containerd (v1.6+) to run HostProcess containers. +[How to install containerd.](/docs/setup/production-environment/container-runtimes/#containerd) ## Limitations -- HostProcess containers require version 1.5.4 or higher of the containerd {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}. -- As of v1.22 HostProcess pods can only contain HostProcess containers. This is a current limitation +- HostProcess containers require containerd 1.6 or higher for the +{{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}. +- As of v1.22 HostProcess pods can only contain HostProcess containers. This is a current limitation of the Windows OS; non-privileged Windows containers cannot share a vNIC with the host IP namespace. -- HostProcess containers run as a process on the host and do not have any degree of -isolation other than resource constraints imposed on the HostProcess user account. Neither +- HostProcess containers run as a process on the host and do not have any degree of +isolation other than resource constraints imposed on the HostProcess user account. Neither filesystem or Hyper-V isolation are supported for HostProcess containers. -- Volume mounts are supported and are mounted under the container volume. -See [Volume Mounts](#volume-mounts) -- A limited set of host user accounts are available for HostProcess containers by default. +- Volume mounts are supported and are mounted under the container volume. See [Volume Mounts](#volume-mounts) +- A limited set of host user accounts are available for HostProcess containers by default. See [Choosing a User Account](#choosing-a-user-account). -- Resource limits (disk, memory, cpu count) are supported in the same fashion as processes +- Resource limits (disk, memory, cpu count) are supported in the same fashion as processes on the host. -- Both Named pipe mounts and Unix domain sockets are **not** currently supported and should instead +- Both Named pipe mounts and Unix domain sockets are **not** currently supported and should instead be accessed via their path on the host (e.g. \\\\.\\pipe\\\*) ## HostProcess Pod configuration requirements -Enabling a Windows HostProcess pod requires setting the right configurations in the pod security -configuration. Of the policies defined in the [Pod Security Standards](/docs/concepts/security/pod-security-standards) -HostProcess pods are disallowed by the baseline and restricted policies. It is therefore recommended -that HostProcess pods run in alignment with the privileged profile. +Enabling a Windows HostProcess pod requires setting the right configurations in the pod security +configuration. Of the policies defined in the [Pod Security Standards](/docs/concepts/security/pod-security-standards) +HostProcess pods are disallowed by the baseline and restricted policies. It is therefore recommended +that HostProcess pods run in alignment with the privileged profile. When running under the privileged policy, here are the configurations which need to be set to enable the creation of a HostProcess pod: @@ -185,10 +165,10 @@ spec: ## Volume Mounts -HostProcess containers support the ability to mount volumes within the container volume space. -Applications running inside the container can access volume mounts directly via relative or -absolute paths. An environment variable `$CONTAINER_SANDBOX_MOUNT_POINT` is set upon container -creation and provides the absolute host path to the container volume. Relative paths are based +HostProcess containers support the ability to mount volumes within the container volume space. +Applications running inside the container can access volume mounts directly via relative or +absolute paths. An environment variable `$CONTAINER_SANDBOX_MOUNT_POINT` is set upon container +creation and provides the absolute host path to the container volume. Relative paths are based upon the `Pod.containers.volumeMounts.mountPath` configuration. ### Example {#volume-mount-example} @@ -199,13 +179,22 @@ To access service account tokens the following path structures are supported wit `$CONTAINER_SANDBOX_MOUNT_POINT\var\run\secrets\kubernetes.io\serviceaccount\` +## Resource Limits + +Resource limits (disk, memory, cpu count) are applied to the job and are job wide. +For example, with a limit of 10MB set, the memory allocated for any HostProcess job object +will be capped at 10MB. This is the same behavior as other Windows container types. +These limits would be specified the same way they are currently for whatever orchestrator +or runtime is being used. The only difference is in the disk resource usage calculation +used for resource tracking due to the difference in how HostProcess containers are bootstrapped. + ## Choosing a User Account HostProcess containers support the ability to run as one of three supported Windows service accounts: -- **[LocalSystem](https://docs.microsoft.com/en-us/windows/win32/services/localsystem-account)** -- **[LocalService](https://docs.microsoft.com/en-us/windows/win32/services/localservice-account)** -- **[NetworkService](https://docs.microsoft.com/en-us/windows/win32/services/networkservice-account)** +- **[LocalSystem](https://docs.microsoft.com/windows/win32/services/localsystem-account)** +- **[LocalService](https://docs.microsoft.com/windows/win32/services/localservice-account)** +- **[NetworkService](https://docs.microsoft.com/windows/win32/services/networkservice-account)** You should select an appropriate Windows service account for each HostProcess container, aiming to limit the degree of privileges so as to avoid accidental (or even From f04516f995a92c60e7af814223bc5b807150604f Mon Sep 17 00:00:00 2001 From: Erico Fusco <5590224+ericofusco@users.noreply.github.com> Date: Mon, 6 Dec 2021 04:12:32 +0000 Subject: [PATCH 125/148] Update kubeadm-upgrade.md (#30135) * Update kubeadm-upgrade.md `apt-mark hold` is still required when `apt-get` is used with `--allow-change-held-packages`. `--allow-change-held-packages` unholds the package but it doesn't pin the new version. * Add missing changes * Update kubeadm-upgrade.md Remove apt >1.1 examples. --- .../kubeadm/kubeadm-upgrade.md | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md index 0b0139151a..153243ffef 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md @@ -78,10 +78,6 @@ Pick a control plane node that you wish to upgrade first. It must have the `/etc apt-mark unhold kubeadm && \ apt-get update && apt-get install -y kubeadm={{< skew currentVersion >}}.x-00 && \ apt-mark hold kubeadm - - - # since apt-get version 1.1 you can also use the following method - apt-get update && \ - apt-get install -y --allow-change-held-packages kubeadm={{< skew currentVersion >}}.x-00 {{% /tab %}} {{% tab name="CentOS, RHEL or Fedora" %}} # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version @@ -175,10 +171,6 @@ Also calling `kubeadm upgrade plan` and upgrading the CNI provider plugin is no apt-mark unhold kubelet kubectl && \ apt-get update && apt-get install -y kubelet={{< skew currentVersion >}}.x-00 kubectl={{< skew currentVersion >}}.x-00 && \ apt-mark hold kubelet kubectl - - - # since apt-get version 1.1 you can also use the following method - apt-get update && \ - apt-get install -y --allow-change-held-packages kubelet={{< skew currentVersion >}}.x-00 kubectl={{< skew currentVersion >}}.x-00 {{% /tab %}} {{% tab name="CentOS, RHEL or Fedora" %}} # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version @@ -218,10 +210,6 @@ without compromising the minimum required capacity for running your workloads. apt-mark unhold kubeadm && \ apt-get update && apt-get install -y kubeadm={{< skew currentVersion >}}.x-00 && \ apt-mark hold kubeadm - - - # since apt-get version 1.1 you can also use the following method - apt-get update && \ - apt-get install -y --allow-change-held-packages kubeadm={{< skew currentVersion >}}.x-00 {{% /tab %}} {{% tab name="CentOS, RHEL or Fedora" %}} # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version @@ -256,10 +244,6 @@ without compromising the minimum required capacity for running your workloads. apt-mark unhold kubelet kubectl && \ apt-get update && apt-get install -y kubelet={{< skew currentVersion >}}.x-00 kubectl={{< skew currentVersion >}}.x-00 && \ apt-mark hold kubelet kubectl - - - # since apt-get version 1.1 you can also use the following method - apt-get update && \ - apt-get install -y --allow-change-held-packages kubelet={{< skew currentVersion >}}.x-00 kubectl={{< skew currentVersion >}}.x-00 {{% /tab %}} {{% tab name="CentOS, RHEL or Fedora" %}} # replace x in {{< skew currentVersion >}}.x-0 with the latest patch version From 8b8b9636c9c1e6af4c36e83ba791e8f48cb37674 Mon Sep 17 00:00:00 2001 From: Guangwen Feng Date: Mon, 6 Dec 2021 14:37:19 +0800 Subject: [PATCH 126/148] [zh] Update ephemeral-volumes.md Signed-off-by: Guangwen Feng --- content/zh/docs/concepts/storage/ephemeral-volumes.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/concepts/storage/ephemeral-volumes.md b/content/zh/docs/concepts/storage/ephemeral-volumes.md index 373462a72c..10e0015512 100644 --- a/content/zh/docs/concepts/storage/ephemeral-volumes.md +++ b/content/zh/docs/concepts/storage/ephemeral-volumes.md @@ -1,7 +1,7 @@ --- title: 临时卷 content_type: concept -weight: 50 +weight: 30 --- From 556d37b3128035534f0bed1a2b49763415ac8b1e Mon Sep 17 00:00:00 2001 From: Guangwen Feng Date: Mon, 6 Dec 2021 15:11:14 +0800 Subject: [PATCH 127/148] [zh] Update volume-snapshots.md Signed-off-by: Guangwen Feng --- content/zh/docs/concepts/storage/volume-snapshots.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/concepts/storage/volume-snapshots.md b/content/zh/docs/concepts/storage/volume-snapshots.md index 8f7db23c70..f4ded9d560 100644 --- a/content/zh/docs/concepts/storage/volume-snapshots.md +++ b/content/zh/docs/concepts/storage/volume-snapshots.md @@ -1,13 +1,13 @@ --- title: 卷快照 content_type: concept -weight: 20 +weight: 40 --- From c2b5d6041f4913c0b938244aff9b95963afeb59b Mon Sep 17 00:00:00 2001 From: Waynerv Date: Mon, 6 Dec 2021 18:51:21 +0800 Subject: [PATCH 128/148] fix typo --- .../reference/setup-tools/kubeadm/implementation-details.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md b/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md index 6222685845..137a9bcd04 100644 --- a/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md +++ b/content/en/docs/reference/setup-tools/kubeadm/implementation-details.md @@ -259,7 +259,7 @@ Other API server flags that are set unconditionally are: #### Controller manager -The static Pod manifest for the API server is affected by following parameters provided by the users: +The static Pod manifest for the controller manager is affected by following parameters provided by the users: - If kubeadm is invoked specifying a `--pod-network-cidr`, the subnet manager feature required for some CNI network plugins is enabled by setting: From ac929239cfe8ee1c312684f56b25866da1644a46 Mon Sep 17 00:00:00 2001 From: ixodie Date: Mon, 6 Dec 2021 06:48:52 -0500 Subject: [PATCH 129/148] Kind cleanup - Remove Romana This doimain does not work and company appears to be defunct. --- content/en/docs/concepts/cluster-administration/networking.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/content/en/docs/concepts/cluster-administration/networking.md b/content/en/docs/concepts/cluster-administration/networking.md index 2b5c398a46..936d63b60d 100644 --- a/content/en/docs/concepts/cluster-administration/networking.md +++ b/content/en/docs/concepts/cluster-administration/networking.md @@ -225,10 +225,6 @@ stateful ACLs, load-balancers etc to build different virtual networking topologies. The project has a specific Kubernetes plugin and documentation at [ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes). -### Romana - -[Romana](https://romana.io) is an open source network and security automation solution that lets you deploy Kubernetes without an overlay network. Romana supports Kubernetes [Network Policy](/docs/concepts/services-networking/network-policies/) to provide isolation across network namespaces. - ### Weave Net from Weaveworks [Weave Net](https://www.weave.works/products/weave-net/) is a From 8983d73fff36307a83df706f20c0afb57006a0b9 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Mon, 6 Dec 2021 21:07:33 +0000 Subject: [PATCH 130/148] Tidy HostProcess task page (#30762) * Tidy HostProcess task page * Use spaces for indentation Tabs for indentation are less easy to work with between different contributors. Switch to spaces. * Fix table for HostProcess requirements --- .../create-hostprocess-pod.md | 135 ++++++++++-------- 1 file changed, 72 insertions(+), 63 deletions(-) diff --git a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md index 9e18805cf8..10052fd68e 100644 --- a/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md +++ b/content/en/docs/tasks/configure-pod-container/create-hostprocess-pod.md @@ -2,7 +2,7 @@ title: Create a Windows HostProcess Pod content_type: task weight: 20 -min-kubernetes-server-version: 1.22 +min-kubernetes-server-version: 1.23 --- @@ -43,9 +43,15 @@ HostProcess containers have access to the host's network interfaces and IP addre privileges needed by Windows nodes. -## {{% heading "prerequisites" %}}% version-check %}} +## {{% heading "prerequisites" %}} -In 1.23 the HostProcess container feature is enabled by default. The kubelet will + + +This task guide is specific to Kubernetes v{{< skew currentVersion >}}. +If you are not running Kubernetes v{{< skew currentVersion >}}, check the documentation for +that version of Kubernetes. + +In Kubernetes {{< skew currentVersion >}}, the HostProcess container feature is enabled by default. The kubelet will communicate with containerd directly by passing the hostprocess flag via CRI. You can use the latest version of containerd (v1.6+) to run HostProcess containers. [How to install containerd.](/docs/setup/production-environment/container-runtimes/#containerd) @@ -64,20 +70,21 @@ documentation for more details. ## Limitations +These limitations are relevant for Kubernetes v{{< skew currentVersion >}}: + - HostProcess containers require containerd 1.6 or higher {{< glossary_tooltip text="container runtime" term_id="container-runtime" >}}. -- As of v1.23 HostProcess pods can only contain HostProcess containers. This is a current limitation +- HostProcess pods can only contain HostProcess containers. This is a current limitation of the Windows OS; non-privileged Windows containers cannot share a vNIC with the host IP namespace. - HostProcess containers run as a process on the host and do not have any degree of isolation other than resource constraints imposed on the HostProcess user account. Neither filesystem or Hyper-V isolation are supported for HostProcess containers. - Volume mounts are supported and are mounted under the container volume. See [Volume Mounts](#volume-mounts) -- As of 1.23, a limited set of host user accounts are available for HostProcess containers by default. - A limited set of host user accounts are available for HostProcess containers by default. -See [Choosing a User Account](#choosing-a-user-account). + See [Choosing a User Account](#choosing-a-user-account). - Resource limits (disk, memory, cpu count) are supported in the same fashion as processes on the host. -- Both Named pipe mounts and Unix domain sockets are **not** currently supported and should instead +- Both Named pipe mounts and Unix domain sockets are **not** supported and should instead be accessed via their path on the host (e.g. \\\\.\\pipe\\\*) ## HostProcess Pod configuration requirements @@ -91,62 +98,64 @@ When running under the privileged policy, here are the configurations which need to be set to enable the creation of a HostProcess pod: - - - - - - - - - + + + + + + + + + + - - - - - +

    Allowed Values

    +
      +
    • true
    • +
    + + - - - + + + - - + + + + + - - +
  • false
  • + + + +
    Privileged policy specification
    ControlPolicy
    Windows HostProcess -

    Windows pods offer the ability to run +

    Privileged policy specification
    ControlPolicy
    securityContext.windowsOptions.hostProcess +

    Windows pods offer the ability to run HostProcess containers which enables privileged access to the Windows node.

    -

    Allowed Values

    -
      -
    • true
    • -
    -
    Host Networking -

    Will be in host network by default initially. Support - to set network to a different compartment may be desirable in - the future.

    -

    Allowed Values

    -
      -
    • true
    • -
    -
    runAsUsername -

    Specification of which user the HostProcess container should run as is required for the pod spec.

    -

    Allowed Values

    -
      -
    • NT AUTHORITY\SYSTEM
    • -
    • NT AUTHORITY\Local service
    • -
    • NT AUTHORITY\NetworkService
    • -
    -
    hostNetwork +

    Will be in host network by default initially. Support + to set network to a different compartment may be desirable in + the future.

    +

    Allowed Values

    +
      +
    • true
    • +
    +
    runAsNonRoot -

    Because HostProcess containers have privileged access to the host, the runAsNonRoot field cannot be set to true.

    -

    Allowed Values

    -
      +
    securityContext.windowsOptions.runAsUsername +

    Specification of which user the HostProcess container should run as is required for the pod spec.

    +

    Allowed Values

    +
      +
    • NT AUTHORITY\SYSTEM
    • +
    • NT AUTHORITY\Local service
    • +
    • NT AUTHORITY\NetworkService
    • +
    +
    runAsNonRoot +

    Because HostProcess containers have privileged access to the host, the runAsNonRoot field cannot be set to true.

    +

    Allowed Values

    +
    • Undefined/Nil
    • -
    • false
    • -
    -
    -### Example Manifest (excerpt) +### Example manifest (excerpt) {#manifest-example} ```yaml spec: @@ -166,13 +175,13 @@ spec: "kubernetes.io/os": windows ``` -## Volume Mounts +## Volume mounts HostProcess containers support the ability to mount volumes within the container volume space. Applications running inside the container can access volume mounts directly via relative or -absolute paths. As of v1.23, an environment variable `$CONTAINER_SANDBOX_MOUNT_POINT` is set upon container +absolute paths. An environment variable `$CONTAINER_SANDBOX_MOUNT_POINT` is set upon container creation and provides the absolute host path to the container volume. Relative paths are based -upon the `Pod.containers.volumeMounts.mountPath` configuration. +upon the `.spec.containers.volumeMounts.mountPath` configuration. ### Example {#volume-mount-example} @@ -182,7 +191,7 @@ To access service account tokens the following path structures are supported wit `$CONTAINER_SANDBOX_MOUNT_POINT\var\run\secrets\kubernetes.io\serviceaccount\` -## Resource Limits +## Resource limits Resource limits (disk, memory, cpu count) are applied to the job and are job wide. For example, with a limit of 10MB set, the memory allocated for any HostProcess job object @@ -191,9 +200,9 @@ These limits would be specified the same way they are currently for whatever orc or runtime is being used. The only difference is in the disk resource usage calculation used for resource tracking due to the difference in how HostProcess containers are bootstrapped. -## Choosing a User Account +## Choosing a user account -As of 1.23, HostProcess containers support the ability to run as one of three supported Windows service accounts: +HostProcess containers support the ability to run as one of three supported Windows service accounts: - **[LocalSystem](https://docs.microsoft.com/windows/win32/services/localsystem-account)** - **[LocalService](https://docs.microsoft.com/windows/win32/services/localservice-account)** From c0e8dd526b32b2963c0e5eab20120699b6ced78c Mon Sep 17 00:00:00 2001 From: Jesse Butler Date: Mon, 6 Dec 2021 18:15:42 -0500 Subject: [PATCH 131/148] update config for release 1.23 --- config.toml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/config.toml b/config.toml index 5380a72bdf..c71f4fcdea 100644 --- a/config.toml +++ b/config.toml @@ -186,30 +186,30 @@ docsbranch = "main" url = "https://kubernetes.io" [[params.versions]] -fullversion = "v1.22.1" +fullversion = "v1.22.4" version = "v1.22" -githubbranch = "v1.22.1" +githubbranch = "v1.22.4" docsbranch = "release-1.22" url = "https://v1-22.docs.kubernetes.io" [[params.versions]] -fullversion = "v1.21.4" +fullversion = "v1.21.7" version = "v1.21" -githubbranch = "v1.21.4" +githubbranch = "v1.21.7" docsbranch = "release-1.21" url = "https://v1-21.docs.kubernetes.io" [[params.versions]] -fullversion = "v1.20.10" +fullversion = "v1.20.13" version = "v1.20" -githubbranch = "v1.20.10" +githubbranch = "v1.20.13" docsbranch = "release-1.20" url = "https://v1-20.docs.kubernetes.io" [[params.versions]] -fullversion = "v1.19.14" +fullversion = "v1.19.16" version = "v1.19" -githubbranch = "v1.19.14" +githubbranch = "v1.19.16" docsbranch = "release-1.19" url = "https://v1-19.docs.kubernetes.io" From d5539a6558cc0fc8c9179335bdcfa4aeeca17dae Mon Sep 17 00:00:00 2001 From: tom1299 Date: Tue, 7 Dec 2021 10:15:21 +0100 Subject: [PATCH 132/148] Fix broken link to Ingress API --- content/en/docs/concepts/services-networking/ingress.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/ingress.md b/content/en/docs/concepts/services-networking/ingress.md index 3e2aeb6773..fb9d1311f6 100644 --- a/content/en/docs/concepts/services-networking/ingress.md +++ b/content/en/docs/concepts/services-networking/ingress.md @@ -570,6 +570,6 @@ You can expose a Service in multiple ways that don't directly involve the Ingres ## {{% heading "whatsnext" %}} -* Learn about the [Ingress API](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#ingress-v1beta1-networking-k8s-io) +* Learn about the [Ingress API](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#ingress-v1-networking-k8s-io) * Learn about [Ingress controllers](/docs/concepts/services-networking/ingress-controllers/) * [Set up Ingress on Minikube with the NGINX Controller](/docs/tasks/access-application-cluster/ingress-minikube/) From fa84bdbe69b6444f33995682e5c6b6698db5b411 Mon Sep 17 00:00:00 2001 From: tom1299 Date: Tue, 7 Dec 2021 15:59:22 +0100 Subject: [PATCH 133/148] Update content/en/docs/concepts/services-networking/ingress.md Co-authored-by: Tim Bannister --- content/en/docs/concepts/services-networking/ingress.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/ingress.md b/content/en/docs/concepts/services-networking/ingress.md index fb9d1311f6..f75ae7304f 100644 --- a/content/en/docs/concepts/services-networking/ingress.md +++ b/content/en/docs/concepts/services-networking/ingress.md @@ -570,6 +570,6 @@ You can expose a Service in multiple ways that don't directly involve the Ingres ## {{% heading "whatsnext" %}} -* Learn about the [Ingress API](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#ingress-v1-networking-k8s-io) +* Learn about the [Ingress](/docs/reference/kubernetes-api/service-resources/ingress-v1/) API * Learn about [Ingress controllers](/docs/concepts/services-networking/ingress-controllers/) * [Set up Ingress on Minikube with the NGINX Controller](/docs/tasks/access-application-cluster/ingress-minikube/) From c214d37d86c0241a789f503915cd7b0568c4809d Mon Sep 17 00:00:00 2001 From: Deepak Tripathy Date: Tue, 7 Dec 2021 19:00:47 +0300 Subject: [PATCH 134/148] removed the italics --- content/en/docs/contribute/new-content/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/contribute/new-content/_index.md b/content/en/docs/contribute/new-content/_index.md index 5dee6a513b..93bbeb750b 100644 --- a/content/en/docs/contribute/new-content/_index.md +++ b/content/en/docs/contribute/new-content/_index.md @@ -27,7 +27,7 @@ flowchart LR direction TB T[ ] -.- D[Write docs in markdown
    and build site with Hugo] --- E[source in GitHub] - E --- G[_'/content/../docs'_ folder contains docs
    for multiple languages] + E --- G['/content/../docs' folder contains docs
    for multiple languages] G --- H[Review Hugo page content
    types and shortcodes] end From ffcd58fc321052e16eac5c80a39e73d61aa5238e Mon Sep 17 00:00:00 2001 From: Karen Chu Date: Mon, 6 Dec 2021 09:57:21 -0800 Subject: [PATCH 135/148] Create v1.23 release blog article Co-authored-by: Mickey Boxell Co-authored-by: Puerco Co-authored-by: Rey Lejano Co-authored-by: Tim Bannister --- .../2021-12-07-kubernetes-release-1.23.md | 187 ++++++++++++++++++ 1 file changed, 187 insertions(+) create mode 100644 content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md diff --git a/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md b/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md new file mode 100644 index 0000000000..721c92b5cf --- /dev/null +++ b/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md @@ -0,0 +1,187 @@ +--- +layout: blog +title: 'Kubernetes 1.23: The Next Frontier' +date: 2021-12-07 +slug: kubernetes-1-23-release-announcement +--- + +**Authors:** [Kubernetes 1.23 Release Team](https://github.com/kubernetes/sig-release/blob/master/releases/release-1.23/release-team.md) + +We’re pleased to announce the release of Kubernetes 1.23, the last release of 2021! + +This release consists of 47 enhancements: 11 enhancements have graduated to stable, 17 enhancements are moving to beta, and 19 enhancements are entering alpha. Also, 1 feature has been deprecated. + +## Major Themes + +### Deprecation of FlexVolume + +FlexVolume is deprecated. The out-of-tree CSI driver is the recommended way to write volume drivers in Kubernetes. See [this doc](https://github.com/kubernetes/community/blob/master/sig-storage/volume-plugin-faq.md#kubernetes-volume-plugin-faq-for-storage-vendors) for more information. Maintainers of FlexVolume drivers should implement a CSI driver and move users of FlexVolume to CSI. Users of FlexVolume should move their workloads to the CSI driver. + +### Deprecation of klog specific flags + +To simplify the code base, several [logging flags were marked as deprecated](https://kubernetes.io/docs/concepts/cluster-administration/system-logs/#klog) in Kubernetes 1.23. The code which implements them will be removed in a future release, so users of those need to start replacing the deprecated flags with some alternative solutions. + +### Software Supply Chain SLSA Level 1 Compliance in the Kubernetes Release Process + +Kubernetes releases now generate provenance attestation files describing the staging and release phases of the release process. Artifacts are now verified as they are handed over from one phase to the next. This final piece completes the work needed to comply with Level 1 of the [SLSA security framework](https://slsa.dev/) (Supply-chain Levels for Software Artifacts). + +### IPv4/IPv6 Dual-stack Networking graduates to GA + +[IPv4/IPv6 dual-stack networking](https://github.com/kubernetes/enhancements/tree/master/keps/sig-network/563-dual-stack) graduates to GA. Since 1.21, Kubernetes clusters have been enabled to support dual-stack networking by default. In 1.23, the `IPv6DualStack` feature gate is removed. The use of dual-stack networking is not mandatory. Although clusters are enabled to support dual-stack networking, Pods and Services continue to default to single-stack. To use dual-stack networking Kubernetes nodes must have routable IPv4/IPv6 network interfaces, a dual-stack capable CNI network plugin must be used, Pods must be configured to be dual-stack and Services must have their `.spec.ipFamilyPolicy` field set to either `PreferDualStack` or `RequireDualStack`. + +### HorizontalPodAutoscaler v2 graduates to GA + +The HorizontalPodAutscaler `autoscaling/v2` stable API moved to GA in 1.23. The HorizontalPodAutoscaler `autoscaling/v2beta2` API has been deprecated. + +### Generic Ephemeral Volume feature graduates to GA + +The generic ephemeral volume feature moved to GA in 1.23. This feature allows any existing storage driver that supports dynamic provisioning to be used as an ephemeral volume with the volume’s lifecycle bound to the Pod. All StorageClass parameters for volume provisioning and all features supported with PersistentVolumeClaims are supported. + +### Skip Volume Ownership change graduates to GA + +The feature to configure volume permission and ownership change policy for Pods moved to GA in 1.23. This allows users to skip recursive permission changes on mount and speeds up the pod start up time. + +### Allow CSI drivers to opt-in to volume ownership and permission change graduates to GA + +The feature to allow CSI Drivers to declare support for fsGroup based permissions graduates to GA in 1.23. + +### PodSecurity graduates to Beta + +[PodSecurity](https://kubernetes.io/docs/concepts/security/pod-security-admission/) moves to Beta. `PodSecurity` replaces the deprecated `PodSecurityPolicy` admission controller. `PodSecurity` is an admission controller that enforces Pod Security Standards on Pods in a Namespace based on specific namespace labels that set the enforcement level. In 1.23, the `PodSecurity` feature gate is enabled by default. + +### Container Runtime Interface (CRI) v1 is default + +The Kubelet now supports the CRI `v1` API, which is now the project-wide default. +If a container runtime does not support the `v1` API, Kubernetes will fall back to the `v1alpha2` implementation. There is no intermediate action required by end-users, because `v1` and `v1alpha2` do not differ in their implementation. It is likely that `v1alpha2` will be removed in one of the future Kubernetes releases to be able to develop `v1`. + +### Structured logging graduate to Beta + +Structured logging reached its Beta milestone. Most log messages from kubelet and kube-scheduler have been converted. Users are encouraged to try out JSON output or parsing of the structured text format and provide feedback on possible solutions for the open issues, such as handling of multi-line strings in log values. + +### Simplified Multi-point plugin configuration for scheduler + +The kube-scheduler is adding a new, simplified config field for Plugins to allow multiple extension points to be enabled in one spot. The new `multiPoint` plugin field is intended to simplify most scheduler setups for administrators. Plugins that are enabled via `multiPoint` will automatically be registered for each individual extension point that they implement. For example, a plugin that implements Score and Filter extensions can be simultaneously enabled for both. This means entire plugins can be enabled and disabled without having to manually edit individual extension point settings. These extension points can now be abstracted away due to their irrelevance for most users. + +### CSI Migration updates + +CSI Migration enables the replacement of existing in-tree storage plugins such as `kubernetes.io/gce-pd` or `kubernetes.io/aws-ebs` with a corresponding CSI driver. +If CSI Migration is working properly, Kubernetes end users shouldn’t notice a difference. +After migration, Kubernetes users may continue to rely on all the functionality of in-tree storage plugins using the existing interface. +- CSI Migration feature is turned on by default but stays in Beta for GCE PD, AWS EBS, and Azure Disk in 1.23. +- CSI Migration is introduced as an Alpha feature for Ceph RBD and Portworx in 1.23. + +### Expression language validation for CRD is alpha + +Expression language validation for CRD is in alpha starting in 1.23. If the `CustomResourceValidationExpressions` feature gate is enabled, custom resources will be validated by validation rules using the [Common Expression Language (CEL)](https://github.com/google/cel-spec). + +### Server Side Field Validation is Alpha + +If the `ServerSideFieldValidation` feature gate is enabled starting 1.23, users will receive warnings from the server when they send Kubernetes objects in the request that contain unknown or duplicate fields. Previously unknown fields and all but the last duplicate fields would be dropped by the server. + +With the feature gate enabled, we also introduce the `fieldValidation` query parameter so that users can specify the desired behavior of the server on a per request basis. Valid values for the `fieldValidation` query parameter are: + +- Ignore (default when feature gate is disabled, same as pre-1.23 behavior of dropping/ignoring unkonwn fields) +- Warn (default when feature gate is enabled). +- Strict (this will fail the request with an Invalid Request error) + +### OpenAPI v3 is Alpha + +If the `OpenAPIV3` feature gate is enabled starting 1.23, users will be able to request the OpenAPI v3.0 spec for all Kubernetes types. OpenAPI v3 aims to be fully transparent and includes support for a set of fields that are dropped when publishing OpenAPI v2: `default`, `nullable`, `oneOf`, `anyOf`. A separate spec is published per Kubernetes group version (at the `$cluster/openapi/v3/apis//` endpoint) for improved performance and discovery, for all group versions can be found at the `$cluster/openapi/v3` path. + +## Other Updates + +### Graduated to Stable + +- [IPv4/IPv6 Dual-Stack Support](https://github.com/kubernetes/enhancements/issues/563) +- [Skip Volume Ownership Change](https://github.com/kubernetes/enhancements/issues/695) +- [TTL After Finished Controller](https://github.com/kubernetes/enhancements/issues/592) +- [Config FSGroup Policy in CSI Driver object](https://github.com/kubernetes/enhancements/issues/1682) +- [Generic Ephemeral Inline Volumes](https://github.com/kubernetes/enhancements/issues/1698) +- [Defend Against Logging Secrets via Static Analysis](https://github.com/kubernetes/enhancements/issues/1933) +- [Namespace Scoped Ingress Class Parameters](https://github.com/kubernetes/enhancements/issues/2365) +- [Reducing Kubernetes Build Maintenance](https://github.com/kubernetes/enhancements/issues/2420) +- [Graduate HPA API to GA](https://github.com/kubernetes/enhancements/issues/2702) + + +### Major Changes + +- [Priority and Fairness for API Server Requests](https://github.com/kubernetes/enhancements/issues/1040) + +### Release Notes + +Check out the full details of the Kubernetes 1.23 release in our [release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.23.md). + +### Availability + +Kubernetes 1.23 is available for download on [GitHub](https://github.com/kubernetes/kubernetes/releases/tag/v1.23.0). To get started with Kubernetes, check out these [interactive tutorials](https://kubernetes.io/docs/tutorials/) or run local Kubernetes clusters using Docker container “nodes” with [kind](https://kind.sigs.k8s.io/). You can also easily install 1.23 using [kubeadm](https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/). + +### Release Team + +This release was made possible by a very dedicated group of individuals, who came together as a team to deliver technical content, documentation, code, and a host of other components that go into every Kubernetes release. + +A huge thank you to the release lead Rey Lejano for leading us through a successful release cycle, and to everyone else on the release team for supporting each other, and working so hard to deliver the 1.23 release for the community. + +### Release Theme and Logo + +Kubernetes 1.23: The Next Frontier + +![Kubernetes 1.23 Release Logo](/images/blog/2021-12-07-kubernetes-release-1.22/kubernetes-1.23.png) + +"The Next Frontier" theme represents the new and graduated enhancements in 1.23, Kubernetes' history of Star Trek references, and the growth of community members in the release team. + +Kubernetes has a history of Star Trek references. The original codename for Kubernetes within Google is Project 7, a reference to Seven of Nine from Star Trek Voyager. And of course Borg was the name for the predecessor to Kubernetes. "The Next Frontier" theme continues the Star Trek references. "The Next Frontier" is a fusion of two Star Trek titles, Star Trek V: The Final Frontier and Star Trek the Next Generation. + +"The Next Frontier" represents a line in the SIG Release charter, "Ensure there is a consistent group of community members in place to support the release process across time." With each release team, we grow the community with new release team members and for many it's their first contribution in their open source frontier. + +Reference: https://kubernetes.io/blog/2015/04/borg-predecessor-to-kubernetes/ +Reference: https://github.com/kubernetes/community/blob/master/sig-release/charter.md + +The Kubernetes 1.23 release logo continues with the theme's Star Trek reference. Every star is a helm from the Kubernetes logo. The ship represents the collective teamwork of the release team. + +Rey Lejano designed the logo. + +### User Highlights + +- [Findings of the latest CNCF End User Technology Radar](https://www.cncf.io/announcements/2021/09/22/cncf-end-user-technology-radar-provides-insights-into-devsecops/) were themed around DevSecOps. Check out the [Radar Page](https://radar.cncf.io/) for the full details and findings. +- Learn about how [end user Aegon Life India migrated core processes from its traditional monolith to a microservice-based architecture](https://www.cncf.io/case-studies/aegon-life-india/) in its effort to transform into a leading digital service company. +- Utilizing multiple cloud native projects, [Seagate engineered edgerX to run Real-time Analytics at the Edge](https://www.cncf.io/case-studies/seagate/). +- Check out how [Zambon worked with SparkFabrik to develop 16 websites, with cloud native technologies, to enable stakeholders to easily update content while maintaining a consistent brand identity](https://www.cncf.io/case-studies/zambon/). +- Using Kubernetes, [InfluxData was able to deliver on the promise of multi-cloud, multi-region service availability](https://www.cncf.io/case-studies/influxdata/) by creating a true cloud abstraction layer that allows for the seamless delivery of InfluxDB as a single application to multiple global clusters across three major cloud providers. + + +### Ecosystem Updates + +- [KubeCon + CloudNativeCon NA 2021](https://www.cncf.io/events/kubecon-cloudnativecon-north-america-2021/) was held in October 2021, both online and in person. All talks are [now available on-demand](https://www.youtube.com/playlist?list=PLj6h78yzYM2Nd1U4RMhv7v88fdiFqeYAP) for anyone that would like to catch up! +- [Kubernetes and Cloud Native Essentials Training and KCNA Certification are now generally available for enrollment and scheduling](https://www.cncf.io/announcements/2021/11/18/kubernetes-and-cloud-native-essentials-training-and-kcna-certification-now-available/). Additionally, a new online training course, [Kubernetes and Cloud Native Essentials (LFS250)](https://www.cncf.io/announcements/2021/10/13/entry-level-kubernetes-certification-to-help-advance-cloud-careers/), has been released to both prepare individuals for entry-level cloud roles and to sit for the KCNA exam. +- [New resources are now available from the Inclusive Naming Initiative](https://www.cncf.io/announcements/2021/10/13/inclusive-naming-initiative-announces-new-community-resources-for-a-more-inclusive-future/), including an Inclusive Strategies for Open Source (LFC103) course, Language Evaluation Framework, and Implementation Path. + + +### Project Velocity + +The [CNCF K8s DevStats](https://k8s.devstats.cncf.io/d/12/dashboards?orgId=1&refresh=15m) project aggregates a number of interesting data points related to the velocity of Kubernetes and various sub-projects. This includes everything from individual contributions to the number of companies that are contributing, and is an illustration of the depth and breadth of effort that goes into evolving this ecosystem. + +In the v1.23 release cycle, which ran for 16 weeks (August 23 to December 7), we saw contributions from [1032 companies](https://k8s.devstats.cncf.io/d/9/companies-table?orgId=1&var-period_name=v1.22.0%20-%20now&var-metric=contributions) and [1084 individuals](https://k8s.devstats.cncf.io/d/66/developer-activity-counts-by-companies?orgId=1&var-period_name=v1.22.0%20-%20now&var-metric=contributions&var-repogroup_name=Kubernetes&var-country_name=All&var-companies=All&var-repo_name=kubernetes%2Fkubernetes). + +### Event Update + +- [KubeCon + CloudNativeCon China 2021](https://www.lfasiallc.com/kubecon-cloudnativecon-open-source-summit-china/) is happening this month from December 9 - 11. After taking a break last year, the event will be virtual this year and includes 105 sessions. Check out the event schedule [here](https://www.lfasiallc.com/kubecon-cloudnativecon-open-source-summit-china/program/schedule/). +- KubeCon + CloudNativeCon Europe 2022 will take place in Valencia, Spain, May 4 – 7, 2022! You can find more information about the conference and registration on the [event site](https://events.linuxfoundation.org/archive/2021/kubecon-cloudnativecon-europe/). +- Kubernetes Community Days has upcoming events scheduled in Pakistan, Brazil, Chengdu, and in Australia. + +### Upcoming Release Webinar + +Join members of the Kubernetes 1.23 release team on January 4, 2022 to learn about the major features of this release, as well as deprecations and removals to help plan for upgrades. For more information and registration, visit the [event page](https://community.cncf.io/e/mrey9h/) on the CNCF Online Programs site. + +### Get Involved + +The simplest way to get involved with Kubernetes is by joining one of the many [Special Interest Groups](https://github.com/kubernetes/community/blob/master/sig-list.md) (SIGs) that align with your interests. Have something you’d like to broadcast to the Kubernetes community? Share your voice at our weekly [community meeting](https://github.com/kubernetes/community/tree/master/communication), and through the channels below: + +- Find out more about contributing to Kubernetes at the [Kubernetes Contributors](https://www.kubernetes.dev/) website +- Follow us on Twitter [@Kubernetesio](https://twitter.com/kubernetesio) for the latest updates +- Join the community discussion on [Discuss](https://discuss.kubernetes.io/) +- Join the community on [Slack](http://slack.k8s.io/) +- Post questions (or answer questions) on [Stack Overflow](http://stackoverflow.com/questions/tagged/kubernetes) +- Share your Kubernetes [story](https://docs.google.com/a/linuxfoundation.org/forms/d/e/1FAIpQLScuI7Ye3VQHQTwBASrgkjQDSS5TP0g3AXfFhwSM9YpHgxRKFA/viewform) +- Read more about what’s happening with Kubernetes on the [blog](https://kubernetes.io/blog/) +- Learn more about the [Kubernetes Release Team](https://github.com/kubernetes/sig-release/tree/master/release-team) + From 1c4413c2b5a8b63e3458ed1146f011a6ad4e3a7d Mon Sep 17 00:00:00 2001 From: Karen Chu Date: Mon, 6 Dec 2021 10:13:12 -0800 Subject: [PATCH 136/148] Add Kubernetes 1.23 Release Logo Adding folder and image file for Kubernetes 1.23 Release logo for release blog Co-authored-by: Rey Lejano --- .../2021-12-07-kubernetes-release-1.23.md | 2 +- .../kubernetes-1.23.png | Bin 0 -> 1564064 bytes 2 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 static/images/blog/2021-12-07-kubernetes-release-1.23/kubernetes-1.23.png diff --git a/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md b/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md index 721c92b5cf..edffcefce6 100644 --- a/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md +++ b/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md @@ -125,7 +125,7 @@ A huge thank you to the release lead Rey Lejano for leading us through a success Kubernetes 1.23: The Next Frontier -![Kubernetes 1.23 Release Logo](/images/blog/2021-12-07-kubernetes-release-1.22/kubernetes-1.23.png) +![Kubernetes 1.23 Release Logo](/images/blog/2021-12-07-kubernetes-release-1.23/kubernetes-1.23.png) "The Next Frontier" theme represents the new and graduated enhancements in 1.23, Kubernetes' history of Star Trek references, and the growth of community members in the release team. diff --git a/static/images/blog/2021-12-07-kubernetes-release-1.23/kubernetes-1.23.png b/static/images/blog/2021-12-07-kubernetes-release-1.23/kubernetes-1.23.png new file mode 100644 index 0000000000000000000000000000000000000000..329a062f84d6bfbe7ccd9f09e1e4641844ed1b30 GIT binary patch literal 1564064 zcmZ@=30#fq_TEJ$B@Ri5a->3OBZLN-cTyCZXrPcZ2+_PvIYO~h#wJaY=1H119g;LC zX_6vI8a2=TpZD9D{`X!#m#)73eed_aYd!0Ep0zrcc4%&yG;!8M8jUuIv2~+1jW$7) zM&qlRz>9yGVB@(EfAQOH)jv+72}~vb<0`Ip9iq`BXpD_&yH4M0uHJc6tmjNaukn4J z>b={K?fCLmJ$~I9t#@HG={f71Dra2XDV(dbJ@`_`gTH1e3u)-u^xDo1c4<7fBq2O} z{p!=F*S&e+O26v#o%>XK?8WFETu)dR%|ffXn&%z8Ix#ABrpLE08utoZMAa>&HIG`# zjI7Qs1=9SoSQQ`C^C@npkn+08~a z?J`miq;D@&Jfv!6COZ3s_X!&#<+wfeLgX@i?s51_=Fz)mRS$j3qw(v;4>w@fCftiCnvG;b+A4W+oPV;KbkCf)U(2L91L4Q-ra@k?o)3E#s|2^&4 zQy+3`p7UlrGsL$|KJg3UuiAzE8oP?N#_u@s`m>={v1a@yGxChnYdFuy!87J($JT~E z(-De1wM=l*n$U~n-jaXe@M-M14^|A8N^YC!&a?bN13l3v#5?48=eJ8qoF_DMp1@yv zXIR}`?Wy+OGqy!h2SsO{P@jx*U>;jQtuH15+a_&cCMu#BWs-h$fyE)w*)`@M@-Op)I zS7cp`tu4~eZ{K*%x^W&pVLOGhsFb&NhBv$G&XX1PUq3T)rvKqsZN~}tzL+Gn@#RUg zMG{%BefB-$io5>t60cwJ27I$tVhVX}+Xv*0SkEU2^bMaUr#a;eiK~lmt@UCP2X8G@ zy7)czdWavj6>5!3@vYbzYCFXiJ>%|S?{N=OGdzrcWt&p(SGxnd*g11E&(#S6<+In5 z?H8I(-Eo@LD%ryeQg_(%PqSXlX!=q*ErYWT3u^o6*U$3^|4sJ8WIy#*w`7tIX8C{I zJwblD|Fe(D_db^LTXN3Ji1UHJ?6c4AVI4QW$!>Ub@brDPl&&fGw5Sgoe=_5wWKA?C zkjNKxqBh}$c2tE8&IQ}RZJg)mt}8uuaxvRXa1~qcFA@5@mCKag1nN+G=e(Qxm{7Vw zf-$3bYrL>2m-i;>Mawz+X42x$vn|c*_Os))7M1G71?>apIs4PTiL*b7&$xw_29eF= z^JU{t=D1)gI2Pz%iDhP6EoMk(7X|9t6A%)l-dLt}x#`mj@!M+G8E6(yorQnjafkZg z{_{NTNz}{8sGH!Q*_n|m2D=5b&yttdbCk}Goc4s;8r#PcNFJ20dd6L@Ljs{lPI)|@ zoUKNEOh?zUXEtNjUn1-h32LW}smo6vp>{GAPu@}flCJRe#$0YZ#B3^wkJyIuJUea_ z;VWkNdg?CzIAI^;iO~fKS!TydR-*R_pv+PkWke72yEMrI6UhL60bkZ@VgGSM(NTgM z&LvYf*vWa^-_N*3*HWRenG-XX5r`Rv0b|LHecVbxNPULEsu=&T(?5`9h*GEB?lVEa z{ruN@C2q#zA{x8`i+Th_8+0!PC zZBje6j6N|_t|`><7_TGmwT>0?u6fn6^ogcH?ZUOSdfSUr9lAG$Q$h7=8rcdlyEId^ z#kqSc7O=UJef1t^5K^X=+;)|D_giaVwzN?DV8(+AIVK^LvsH(#Qpf!U>b+ z$s{e<^CV5}xMh-b&`pIg{~32}qoeRFvbS#*r}L2g-$))rKSQ0C0N(0i zksZsI?5s%#^-5Cz#L^VkohMm5jlvW<7a&hLJ95f-9=2KnNug?Li$t%o$)~O$grg)I zUM=D3)BY`5r00_}6y5NQ+vEyANud`vIG0l}WBL>uK$~CnD^PSf*N?;XXF1oOC)d|9 zaXvnhm;Vx>UCiF>KAK^O4gEK;T?F6DWOA;km?Yq9FAlt=HK#;Lwn$o08}XFd2t|qW zJhXuMBv2Jis2#lksOlFCKD!y;$g*0TtIm3d3gLJm1(%2&A^FN&|8sM$T&<^4#)FEV z=H;eb?3dKm@KAfz!@%hrIz9c_whQ4j4UbX;DF;+9o}reuuxgTk0iytDL64(8Hb_ND z`weWub3rZHDI&CHuTn`r0@73oxV4d5fbt&X*i3&tx~@GxJ1FT_m`GhB_cigFAV3om zqh50^m0(u_-!<#96cBi7dNfh# zWZCqkNAgFU-Fr=qWzxp?6lVLi41I}l`>rT)+O|P{#6&jMc=~+9`LaN2xSjSl zol`BW9X_@E^l0@4C-tY^cd+~t>B6uMKXJ1!{cSh>$2pn*ilL!-Bo}Mhm1N~#UM)HE zX8228*6WOJ%ll`Q6|jYi3P;(wyc!hl+6I#9%N(~wj~!B8F(PvgFPG6BkUCPk@GhQ` zBjU=cC{ZoA9?@8Q++^2mMkQkns*~uAxp+kTKV-8NrywyFWLr+*l)U*4whfN0QKPcB zlbmw>jyuXODhcxU3bE6^{@lTpujmSg1;`Gaqaa0ifvkzP())^nFHr$&qiSil$wLeG zYSyn+wSCA{r%6hl*aY%If&Wm6jYBoatUs(r|p}b-l)RRb9u4 zSJcTPo7a+nj+H;pqcPF+so9iSbT!}Q>1#}*NJTX1p!O{MAt>webl#7k)FzUXTlW@L z&(@81X>e>@*c^m=E+2f>ujJHmv~eN*VX2_jSX^l=A$M-y)jU>x&b*l*Aat?O`w*63 zj-{_7k5^hj-q=KoU*MMT-ISVFHSY&fV{5Pdg=M_MGJ+_UMqf>Z3SlHyL5IL#Occn) zWEICpvx{|Pz9OuxJ$K8S_goP7A)Ega>{*jwA-j*liuvGu3(xa7Uyle5xBKn+S18Ku zY=typ5g>i>9?AUPFwHl=%4VWK-?_OLczxQ2B({WwZ7V#plQ8|$F3$qHz!OZ;2?{e~ zj;@l`t8^h8NUM3Lo~_NW!CY6ntS+$^FA0*AKMNI$G@3e#-bw*inG~tHnKzIu^JGn8 zCQP~|VaQlB)15aXUWY`ArU|}1WJIVz_JcqY0Y?!5?=y}qxSR4pR`~+|@z1w|Z@YZV zS-oeN5f&D(Seb8g(wM+-6{q%l?T^yPK75|1Ih=FkKlj^t9(BnJfVLGu3d=xZ&h?8R!D1ymO)^K2%SiMfH|MHiWzeP)q;{xhSM zlu6v(+Ck1e)KBA>$pIw&OxyY)-t7*#eG6BI=W=EP?1?E(IbsKp^f#ZP}cVFub$% z!(&#yp$$NV??rQC=W5q4cGS`HY)+yW#ua6^Omx znp7iTNE9cZ>&Mc6Q4m?lUt~REw$HewF2vG${K<>np=bstBipFEjsvKyVk!JBYx3Ia zgX`i`HhXgmh9~3nFLg)RxUC}5F!;<%or(s?K8m5&o+5Zu%cM#b1^AE)qub{w`_vs; zA~5OJ`1LqcMJCy9+jSEJZjGOODjBt8pDCBHl!D1wq^~rGbUETSV)i5iWF8P+CTo6r z`q@}!T(|9^wY~46>pu)65!%qWnjJmAP%J<0!nW0WGH#%XBPe7@Cfm|T_6ITx&+}|! z9GqBqMp{ai`CS4JQJOf36b_E8x#&s4w`XTmML=PDA~z!6isZB5p#Dmm(Y<=K1D{_m z-vapbI{s+Dn}TJbD@Rr{wh?F?q|kiOo7si}EFy z3_|>w%8A5YpwIyPD%*14bA_1das9(=$tlpV?70MH*>k4=W|LL=Isu_lvb6KO8mz0J z+|;?#Td6bvYpvNDf5Qy&OEmXOOA4t^U}mvh!nMq?n)oA?I~(1G=rw&`REbJvds9!C zR{pctPY__ns2^sBobJmVermJQX1J?jnp=k!rBXBapl2v5p2>^6sQp-Aj|-G~-??E~ znaQLI9Q`PLTY0!n?Dm}{%6$IiNPaE1;nAT^W)!~5Ao;t%(%SL5nt`J#x`+`5J zzg9DD*&4Mk4{XB$3n)I$TzU%Nyc(H=*gemCC25PX_~<}Q`ms*cp~0;F0F~jc5})F` zh~GfM_StQy0NQwma0YpY#|eH<2iv~bSZDQnwYv4Wjd+E^5o4L3A$!&WJjWdR`hrYFlA4HuZDPOR_ z0j^FjA|RO5{&IOuY>UaK7T1y#A2SLT|A=Ivpy$t@%gV`x8blpDcu>mF(6F)F(ITa) z@x+?YhNWRdYv8R(-jCti$@LVzoxVf%PD7SL@^u!Sot^kl#Gc68ckkv63^9KJCAm&X2aQn( z*k>BXqfiM+a_YPDoNhaGK*P5 z7-#J|SZ|jZzCVgBDRGdC@dR^^BpHxfWf*CNYBR!1a#N2R57paPS}wl2dH&+XixIM3 znv0a*c^Pl%*aWOL880Azn^4IN#l)S9x+=gyxrY2jo=QP z57t1vCf4Y>og8j)da955f~=A57;nM4GYH_PCf5*1#~TXjXV>&?W_`5a^ZNVTO=H*9 zc#-ETz3y%aQiI%j$9p$8v&-|Fe#=cHO^A9dg{wy z^bpb*tBdpNDBdPt?^H8rRM}!*;J3E-LSa>9rFw>uo7h~XH5H(70J#eF;#|mfA3tsw z@x&yljUdQODndq5fO%(6;RPPH|JQCugg(NVF|tIlyt49@3H{~!_wVZ-n^;-3eBaG4 zpV_w`F;nsVK_C|KJTQq>Y>5cTER1p)4J$}61)oKdG_6-=fQ)9&;`0(Z@; zIf1PtS9)XxGS^|SB_*r9GeG%i?d9~5fu=_LG<`$EJd@gqJsE$4U_B!37}78?i6@~~ zz8sb2&c_vm!Bd>ZX86#|^ik`^h3xSLd-uMsvdQwhdiAPg?)&$9Q8>ur5GK7JoZ5~T zW}W`N-!a1oFlZ392S`og@4|%(>74~@krT4t^KKo6`|zdjcAi7e=Zaz-lU;;h_PkxS z4e4w$1fS9|s-jJ*KWje9i}K^+%D>7B&HoNUafY$;Qi9@11`HDXK0ZDcH|q?=Qnx_zsg9+<;F`Gtk5 zDt;1-cV%TdQG2{4TkO}ypbpeE7^RZck0uLetlL(mV6iF3l{+BZ_SHUD9?lPYgp zv}=*iiL`1gd+0+$`cOw+K-%Urb_CI`N^%-yf~3i2B1q1?Pa7EU6s%3~gPX1%O-!%a zdeyn75*bEq-}!m*j`$ku@QD0NC=hH9TB099{ME12|BI}G>TFUi1V%j72ICMxVgUTC zY&7Q};M1xPr|SgfpC!bxZnUof^_)b=@@uO9ue{YxCgiStH3y(Xr4iG>>lXXLUe`>6 zsIZd8<~Dk!ND$YwgTFa9ii%`6BpJk2WWn~nk~&tT3L$9v z-=&N`{)6b7jFK8Bben3Z5YzQQ3qmgyXN_=_SLUH*#{Z|vj>I&|>}~HNHBJg%*g9;KL>zrADBTu@-L@!|5P0o_odr|(QZTjEhg?(loB{m!3VsyRI zkg34;jt9iyvlQ~4BB69C_XAPog^RH%! zC`lDD8sSu+&mF5$T$jk=u_oWXMnGDwPLLmZFc$5#OwxJ~-bI=&?mSeOt+dJVA^XxW zauG34%i2WhOI5pvyZAxa6+gFk)1TK-*;rH}}ObL%iSeB&@$Z5WRHlSEIE8@P~idHNNOA+$P2 zJ-)zPEP z*8?vLezP^nU^@%Q_$VsMoGuztdc@qyDyn^bEq!gr>o>cIYR6vbloa~-j|(>NM2yx( zkj6`M+^_b~i*j@sNFsCOp2m5UCh)ABrD`Y*m6Zli02QXRfTd0Y>0s$`q=UFf1(Khn zcKLiXc}dF_Da9^XDk>O{3JR{J9@^12jGGjf&|Gtf74cs!B=6e0p^)NN(y$m~%bv9i zm46;Hm-fI;JUW!8+j+TO^{*N1xpx8rv{I__U%%G)($KJc)vB9diP-Vi`T3z$Ex!JJ zyOOG`{^Ge31Q+bfyU~%F&$>3FbokKnus@GcL^;b4g)lS+Pg*ODmsbj^w$V&lHsn72 zN)+Fz=!Vv-iz|9=^0nheEnw?7N{GMkvL(t=RtZNrNDJ zi;pDP0jB!HNApw}!Ea=gEwrK@Ju*XN;B~;MQTL7?KTb#n2oDHpd}3l(pTfm0OS$Q; zW5N?T3xKAv%ZT6DH}z)?z5~;{o@`a>s43{v`G>m}5%Q&{_i}Apx;G>(8Al=vucWEF zqo>M7nqlPpeUq*f`#fnIKqq=9VjSq>KXV{EHX!%fo#4R0DNk& z4AA@C!!lx(!8FiNM#rXl_NZc(o{Bf%<{tt7c&wPj{qkD&gFTU6H7bsypPpaFhHqs- zxR}%1_wTr6Hd!?_0GBt9=zkVJgp5YZjgfEGH|j2qn`^=jluze_EVDh!g&wHOmw(TO z3TB-df4~Bl{%{9(#d;Y;y=(aJ%yf6eu43yHotQF`8h9BX0moVBt3T=DqRfbojlCwR zzi;36$Wrx`D!CQ2%ccJ$45b(#m^KNB_?n*=WezafV43eKog1^znG!k0osFf8mag5`8WuFCk#JetF7`Y91CstX7&t%Vw zb7;yR+TX7g|6ShrF)PKp?35s_Tg(B zFZQ?|qJ`uU?jQW-C1A2KcZWt=b-`lr%D#u^5eCo-k78m5hq;tix^x`+Q;P7!Dn^HPS&tZxE`oxocjw}({9hhGY#CS!dt-%5(o1dD1$l=>Vu$}|&-Go= zQXN)^$s9NW!0dqXGXD{^kR(zJFzc(%b+c<^R!^h7xI>JW>!y8~b{I=g`zS}FIjskj zXq+d0AZ4{(jjc5y1tZA-aFsQj>gBeQ-uH;8eC!V3c5uaCG^v8%qChl_KXU-Y+PKeKeaE^gsx-geR0a}lO>n6Q7%<{b$@Lpc|VoYG^k@}=E zqrAwNOx(9yQHhjzgtnI3Knc;h5Q^p(x!L21d7sRBB*}5TFe1V(Bkn%cWuGT2Y6GnU z?_?WmFErMxh}gAA-@rgUvJ~CU z+8v4@fntV_vB6V+?>uSHu~$^@eQbE~lJZ1>)+pn=Y^_#IQD{5{gM$YmU(@$umAV#} z;w~tLTlJE1sI=`0kT^_bGOmE`#8j-h9^HWebl46Z8Au&7K}-rkSeeS`3}R0AkG=%j zoB4z!hd}MVIZTe$)N~%A6BI~aU!M_Ewpe*`?T$aXQ}hwCHCunzFl^U|vLvS z8+=JP7+p>QqXSJb;iX4H-yHsYb=8NLy_vlkKFOsN`jfW(7zM1`1^`il zcj5hs%*bFDrisu7!w`2RjbwdvQ8R1nC0HV|kN7YxNo5@!dGg`705&E38GH*Q=(N~u zTI}dA*+VE)`@dx6WoXY37p8sC_z3@j+CN0IVhDg1ejcgYNE9fDM1!dGo=QuH@6TtH zwAiDncLEU?Fi2D5u)-@(-gRiH>1!2dj*TUnIFsXuF(Ylj)tI8XvKeN_ctCQ0?YYTw zM^D44h5Ja>4OV6M{nK;O)&Ryh4fUIy9^j(!Ws@l!qQAxh_^1A2p3}m{45?w-U@5Fy zQWgmTw6PvWXHske?%Lm|<#q=cjlKFDt~%V<=FX|=UvxM<8&U%AZL z^yw>VkQ+S+K8`~s6o%r5p^Xel8&dzOAmLrV7mlc{9C^-qOjE?L$Ptzq#lY91IDD%k zbx75fu&J?NVS%l=RP(cMR)LY?Q`(%5+hpx_6uPp1N$zZhBd9WLf;oQUX+xgq|0Cb^ zQ0C`n>&lW5;NU-PgZ8y3dERJ9lJ?A!B~pw%y1F<3&{wC(9En`FK2y@ zjv?vrQ9w0?Q&@~*q}R|CYdw{Y??Mx>{Fl9Z1A3CV;kVfm_!CzylQPO_CJ|Ep?b{J} z#qclJ_!TrfI}6ttRxDzSuuweYm~$-1g!=P{=d`-o|LHhfBm)*g^ZpQ?SFVBsf%pN^ z5w9T4xTz#EHxB}hFg_B#gcuDCITH#2T??WJ&V=i8MwMuF=E%ffy zG45YFmF5kj?ent>S%V!zL!CtEg&M^)WB~AnzHj-+#a4?$?@;nt_+S68=}n9^A$}mI zM(ocSNy-F67=^{sZf(t)Gjk|ebud9Suei8aWeInmUDTeY<2Ez%e>QFyv3JPyFMs!6 zG>r#TK$fGAg9-ObJea^m&lN5)G0}Tq>V{+d2~H&k9D#R0b{O|CySI(;%}eZgx)Hlr zlF)Pv(2}_U549;NfPlpp^5Z%h(jTV0Yx2cj1a1=L_M*hS$E?Unm zP(m13lqRc+3srw0`b7en5bQ!Ysfdq#5Z! zzId^Dk&ilza+V}vb5s*CT1U5s{U53^_2@YZsgb)3Z(;oB|jkBpYsQ5COL#@n2k$@K-}R;A zZ_}k*tb753?GqTW?<5}CUpptqmGk9p`Q>tx6(W}o&XjqmnYcLms$S_@?c=_5t+<`JFHv;EB&KuiuzDS7?iu*SB4*9-8{PGP6vIc9K5tx}9Kp zChI=u$!%ao7AzX?!6T|yWq8+Mvd!U)V;iap{hb?YZ0>|fF7&wn*{ZN}m#m2Q95yR4 zF)>6v^uELd$&)Xx+zpGM3px!?!4ic0u!Km1D0TEdinqnc%gHVD_d!iiZ0vD_~6%c=ziik_}YbApcI)Zz3b!HJ~#UBT^#2US+-y8W`l#>KHX%iy!c0- zCq6lturQl`Bi9Taxf^-)l8n+LyQ7;HO*k83h9_n!l_*TliTiX*VEg20ImbRLdQQA> zRx;wv;g@tl^8~+wmjl#}*3mnWlbvmwIi{>+Prx1AYAx@pzER#g+T zceL0W<{#AADIB3E`>^8ZL!+3yP9=32zN2*`+p8lpqrMb|B_;LKTNKyHtFz|fTvUy% zzh}>;(OkYQwt%@tlh3_~tzf?S;nHrKPtIPYJn) z^`tW)era9&2po|?ec7+Dk?!2Nqm5L4@x7p+;MK`}=F4v1G-^``!<#0zxa5tevFVMP ziyo97vD>$5Vb95vx>Fqd!|8(F-bJF;o^=njBP0vsBo`Du$Ey03zAm4CNd8+_`R)wY zp8b_OnMNdP1HE=2Y9-8ZSiYbC+0VuMzGO>E(uclv-{sxn+u9ZjZnzzWm_ab0Woy)r zmh_^WV<>A1OP2;slh&j^N6g8y<7N9Z<+JH#qV7tCI&pd$QZsI-FM#)W!SuoYxRdRqxz7Yh1KUMLU!t zy{uH8Li;w8-IdyzZTNO+Mwmb83Ca9JD~PJzxRR#A5v}@%V?Vf5KpX zNE9Es@Gg6HrSpkFc1>?*Lt*LBmDAmWj#llF^1d#K_TJ(N+;SjGUM|O++xq$xodE28 zXZ=;(qWk+DDw3o2F6k|HL8VwGxFO8ql|udrZtilQ1Hm@ri2RgBUC9xxDAo6?$ z4;OiftGYIRzqw?eHhP*CcO2Vm)wGwyS{bTMdD)r1O9kLC;AgJCNaXUJ+qWGWdvtwz zLkfD|(*>t*dczeqK33Oru6Sw0`{{o1(O}=e9ZLWieE8{Il!Rq|;b}nNox)4!Oid)YbVfX=RC+#(_(dG+a-O9w{v%e8OoMFc3a*eleS;f{k{yV!2$S<*QN_1 zTNOP|_O|Z3>gBa~!r8=NZW{fXY#ys^P~L~1gu{!PQ9s!{ZQ)Ig7slDvUa?7!)Jbjo z+MO_?#FM-0VRXU9a}q5Qs6DeLk|5_77NE=WX6O~wJNN??Ohp48x0Qdr`=tL|6HX@C zO59ly2g)=RUAA4vR5bI1Q=A?^NrRtTDB^m;jFXPdi*Weoo~)TR>4*g%dgeO_KGq7n zylI%c#&U|3HlFzzkc7=C`4U`Zv87^~yQ!p(p#5=G6clE4FiD(Uhwh&Vutyaim_q_b zC0jF&?Y(R3D*mFori;nXchSCz=WMQd+ZY$Q#$jYQF_@NdpG0{B73GU}$g*S0^)f=; zTt>GDc z#H3pYo#_*+zJKQX)l(+h+2gFCmcP7Y9hQ~By1MGiWYt!%8q=J1zCT?v`V z*qQmhqqE-kw%uGBO*e|;7;MtIRF6@V=-lwMRl{=2+Yoz?JytoAm$+}eQjCcMsnb_ z5=*fswuhTF5W1VbB^E54VIr|$n!v*YIP&1V%%CrdnjMa?-Hqf$E-wtJF!nXirC&)r zfH!Hr+j2-N@z`is>+YI8org*)E1hrIO9swZz?f_=HH*G~5^hV!&FNkCFW#lH#C9%X z)2b?+A0+v#wtAm++g`YK-D!X65(RU8U#y*CIPRtZtP7?xg`LHosf&Hh7Yc4*_^p`Y zqrNHGYO%-PK&_hI={d(b;&PT+8ll-^3y!gD+9bN{w{IE>6N-f}@8o*l1Os>m1iJk; zucpV!h}6b*x)=kIN=ize*tgt)YT1mvUn0eN8- zLPOJs!z{i%J;#^(?^zUG(B}wHr}#BZhRbhX2@4NLebClKhS|1nE--p4zPHa;)89?C zMP^;h9qeB_=W!${MNgAAl);Z`Zi&--`{~pD4~|W8snL>CUOWaUdc-!K(@Rd07hVOG4A;jz~tyG*Wu^ybCu9pk3)eg03G!_3_D6!+D|!t{<> zsSs)pn0A%|0U6A6uDMCc19#J{-yUhx=;a8F28Vd7wb*~#2RjtlQ}kK8QjZU7Tq6a7 zlA8nTK`a(Hu+$r+xEvFH>JSu58ZWcK0bzwcd1}k&tnXp1L#4)`id|>9zTP(1r<7f! zb_Cj~5S57sxY$8<9nZ}Dl-%@V0y1vd3kT|+JSjD6Ji#?4Vnbs0SQOK2AD_HD{`vl$ z{tfU>BC4$ydp8Q!A4#cVd}J$Z51R$THEXrg&fgfqR#M5YrF^uaOa+IJTc+;rB#nLPW0qz5S#IuWO|m8V-fJL?iR{yj_aX(g8vhD3ompCEfh3)D*2n3`TUY5Z!6}=%qlURU6w>V?ypDWGBhfsDUqHDzHQaE*?@toL11uq$|hQUe~V-O+vYTcMJ@2Z@f z9Pb=%TJiCtUEBTUrm4T7Wd}wS980N0i9NiGo7PiG<*Z-|YV7B{sCC8hGBXf~k3JM< zh^GfbEo@0esHL-T+;w{HrVpyEBi|f8Y-gv# zp*}-^MMMQej{gae%1Q8+XoG(nTd)465S~CqK%C+Mhb9ZFvTkDkWcZN2(ok|S9T%PJi9>6o|KxW(Wd}L8k zPl7a|J{jL`p}^;C948o$I*l0X0~~9to=h|Ohg7(t1iv`TXvr-%Ceqo-DJzraekgLR zb4Q(Lti`d5(xEy8H-Lm^(}mrG-~+(J#{|gkMLr5^*WSH>8PVYuf(%Nda(?ld!3XBs z5b)W(n{}#T;I<6N9`osDJSEmrURYr7$vbb@>+b8}D0)1ss!;D=nJs&`C(`4-jK1HF zs6F+Hnw5WX(b8;5VsK8Gd7q0GC`}ZNab0?|>RdehC%Fy;%h|{P0IXBvs7l5&;pl zI9m4o;ad5`xgP?_w&N!rd5B;NlQgDkL$f0{jqJ=;gv9mF>aRk@c)sTT!A;3$){zPs z@&43_j%O*qh3iHjwvaNIyzM_N!U9SRs)_}19`p6kuLviu+sVtkgbv@okpOnM4(}l} z55UBWz^;5eIzMWa3TJtNHlptH^5TWZt5xnSx`+?H+_k_#coMDFmWZB<8-J=gQX7(B z1x8(5mH6Rt5XfAy=Qy%f`D6QZ%cA#{T%W(C*z>H)DNZOoq~empgP?!lqh1RJi^lfg z7h3|*g_;*)!j!*)VzhO)Un##D!M?!;%I4_Vg6DSD@7bg+X|ef+06h@F^RPd`qB_#k z!phv!jte&#SU+VvsT`tTHy{XD8YLR5Ch)#Mxp|`NVwfMWy{Rl~;4aa~G7N))n}%wc z@8e5^#?i{fk?hQQV9FW{|20})e>b;CQNik@&l66GQjhl;cTm**lcHikP2$9&_O6c+et zg0aS<-)!uqMAEktc%->JJ-JWccLAeAN$Z%{Vt5VUchHZ=?tNB?HV}7(UjXLBTC?B` zOwjszb0784o3D6Sa3@c+RIb>xGh~093?p84+c7a|H{SNNl_)xeGiplYMQTc5RF!y+ z>$)EZ1xN>eT3qC!HBUn5&}&gv{Nz)P+}C4r^&%OD_kUNe9{uRHjvS5P3eEMC!z3mM zZ@Rv>48r`nWNFh$M)9*}>+QI2FD|}V)7<C9Ss^m8O)o$@*)44&_p`1#+3?F;3z!|F<0{wQ2iK;v21y_$A zXy0?o;hVylGiSQTveP?q84hAff|Vf)Rxn^{nNba;hGjgo^Dh?8a1Vl=2yPDRZLX^8 zBX}54%6KTlZ`!Lz8j4~b&-ZtdQrCQe+*S{q(oOl4D}{p?lNeD$ z{_-Lh?LcZJk;b-I%853$>De{+je9e!Uh|+j>#OaxRRvIu6%K^J!tyxJBnlr$|KG!_q|y#x>s#&e?Ku(Wy;@134a*B(k8A<;?IQVzzNJ7tMJVSkOB0S2qn` z2uu?Y*$6-Nh?Av`<>H!cQX*XkQrBtQt%FiRexk&=2c4DJ8m)pCl!pkh6V*AK`B?XA z=Zg{g_T{TTHV?Yml{)qI^9H00w?M4rUaFPxIMG3uly zW50ht7N#O5!Ldj2BZ8kD_;k}Ids_D=>d78)aL`XkNI;OoPNO<7-`&1l`#NIWD#8b> zgc>9mK}&wM6^ZsAO0FwcAf(eAm9XOfTJ)-~a zSJUl1a=%q=q*Y;DUcBPh$uyT23fqZk{%?AnBFvavhDu>4dN&IAslO{BInv5*BYSN! zxI>bOl$8)4O3+1+VqG(NeDoE}n zyQkNd3vP&RA~|CD_44zxju}hP$jYnVB_oXAMh-QXFPyVpTF^WE`Os987`Q30h*z0A z*X{Fr<+6p+LXsva6Is5U^&)UBw$4P&lHdV*q$Jn!ug}lUfFW-X<*Ts_W!rAw&A3Wh z(M8$3V)S)ZC@ah59K*AWp16VB13l8{i3qy+~_{bj|`mHHPYhVA2@ zUdBX%wukqc$d$0tzjZ%>kVYTnT_}yulv8;rd9ozJu3=!Ne=IkfD;NpEhlY*&bJDPh zb388N!6T2Qn zxjL~T4U4}TIShVc#5iUY_$0zd6wKZs>JIn^`-d_n%;N3skh(!vZN&#=P4GhXvsbFB z%9owg8JWQJ{C|xWXh!C^^{7ET#Qwf)Di0dWy9J(@s5^RV6&L4jx{ljRc{8HZ-G=&( zEpuJtaesr8d7PO7?2}oX6 zOn|&^BFxZpe3K=Idzvf}22!T9;q!zd>ab!82F7QWbF)>5=QIcaoW3BHkeC!mLV(@y zfUcXLJ^Ur3;yJ^{lwcwVJpJ;PNKE*QmsjZ9hahEz zpwGHpOG~^`o0sN1Q{GoFq+p|8>n;V-+taiY2XQ+~wgj347NX&=YO;uM7$;8<|K=cK zHZPB>_3m^y!xjIhO6}WK{RUH6#4il9Ksqo6T26nHCpql z$V86)3%y6GZ7!FI?TNAiXJ53YOB5zcO^N0E)dGTB5*SP#e}z1r3#>qd_~GY5oR*~% zA5ZrAu}6xY)7|Gu=bSnrzzdj$sSjfm?$(>blDgF*6VY0>LU)HpEf6EeH#a+vqp93& z8-%YNFT2>G5vUbrfd>D)g-%@O$PvIY`XMptFA1Yx0-3(SZ^Z=9|7t?fGU@0g>c87& zepbh3Hgdy)3D#V$m(*o(%2;I=Qw*dc4XAj9#D z9Gyl48}Gi9jqPb^kL2>!bV)x?bCWg|eYiu0m}AGpAhQcQS-YpQz>~Ze+w3bV{rBJV zv#z=$oLAm0C6Z=o4NiT8{pItuLA2M-h0e6$^HhhUxx z8>sK>pUxM4iVf@#H#4-!2u1ffB|JPF-4{6hn)ejvMd)m$%vjg^kD+PW|0YJz4_At* z)^1PqXxYXZQ$z?G1R=ichM%3YbUnY4`#|^U-J(pQG*jK zXB8*XgTz0;%%wPMVG_rJfA_mckg!+{+ZA*|bFCn)Yb|III~+X=bpN#*6U6zuQhu*( zT+B0vs*;ro54bJk^=x{AWH#vN0r`hsLa!6;#=Gy0sPLW056?YtHpeRa_M;^gRPb#) z5!XdtB!t@V7+bNpL&?|hnvf1y46Q4pDG}#N9;LJ)0H!| zCeW1QWVfLKdvf1u&*1ezfsPr`_|rZu3MvLNN9kSsqZ`x41>|=st@iX5Hb=#vm=h*L zV4@Qhp!}OfM$D6Rn2F2{UMN01&$(&kPUszjB_aD!92K_jOS9iDt$FWS+u)sBw{`@- zxn@<>{Af$fO!vMIL%l4r#y~cT+^%CeY})V zJ-65(=&Yb)#N~rA`WsaSqgQ;3BT_tJ?}4WNQPR}kA&Vbsn=$@ONWrBF4q^{JEPd!) zgUQzT7aYS7#`g)15iyap3V-#96%}Jb=fH(fA5$?FYLu>r{{^h&qk3}T40x-s z6Ic)&D`1xrZJTVhjcEIY*aaG0@BekftW+r5a3(|N#|X>qg$-QHaZk|=+d#%_SnvIA zzHU$w`)c^dun`3JtV46)YqR6Ix8E2U2#HWAx(T=K0-YqMF zyJOs~@(uExd4@0nGsc+vVG@HODf%w^7duu{bq!{B(?`Bayc+Sco631#m<&&%@w zbai287vK@{f}<^7b*7WvFpajMj#%;zBk@M6PD@Fz=4Y?V=>p<1=vUMEpk-$e#06S% z2Z@uqmg*{VoPLiwMg6OEiVl=`PQYCSL;p+r7c(+gZV`by5*Q<223a-FVZLj3{B%9LY=M2r>;@nHZ=xDdF3P-#j7>fPK4R|?=e|w)=IJwpzkxqrdl7Z6gNlt9@@4Hjyk? z+P{c@_KJ??3z(oFYx3`95ODm9|pgi}ejlI}ezo??h$yTdSI zdmkPkQ)h72dS;1l-L_eqQG5;@rUAvKUWs-M?K0-uu>v2xM(ZB)Oyd6==>Tx3EF@%M zn|}kd4!-XUfURBbZ1t-Q(nSCTSWyegv2HCtl5fPA>A?roN8V?yd9KbOd!D0Pci^AfKq~tZTSah<%0e$B7b+} zZlE?9N5qg0#a7f zQ3c{vySN#%RY1ukrX#+@Zu#v$6JF3NV`8#XmKJM_Ar06w&1;InsWu>)U4sG@bq6U6 zvk035Sr}*od4XN?Q#`gly6FgdMwp603%J{HA84E4hUdrbJ<=Z2p{yae7=376*(y3O zK=E@IC&ZkXi!f(lva&N9Tg7;a+%R#rrG=xI2;$u(PL_?`;c4Dp@F_S zukO1wLsBib$mwUt%i<>=8oL@x-~hRG>$-)ij&`b+rL|>7p8DXh#d!Fe?h1t9WYwV^ zHA7!kk^7Rui<&6z+V}BH{d)`+ubA)@HWy}qjmXx zX>LkW!{$t2+wR}Q%~XaNcl4x`h%lMg`SSaW3m5%7&K9G4`*eYO6tR@j?KN9A6T!() zx6c^2)%cX$`V=w5RL2@D-iUIPH7CA>G(?GqHbN{Ee^uLl`o}E5&`>%8AHuY+?=f7b zweh6aOtPk9Xb{ZEvDA0hb*rN4CI+g)-p>0b*zj;fel${jG*?w?^_KXPBYPY>$x7wevkuuKdpy@y_wV=ofB)yXU%kBU#CLo?*XJ7V_xrle zfe!P2O*Dz*$H#vQ8Q{Kgj)y0QTnnfMez`bPxH@WZWZ>IF&-3g#XN8ZVG}31)aEt z6k7%&+JSg})&K_yxH1pGqPYTREDvWcki{UL-mgmB}eAs2HT^rJ#d{F-p);lP4G z4bg7`2XFTrN_T*esT!X&z}d}gIIROe40|iY1Q|wLyy2;gPsAwfDgFPY(DxSK5xned zQQfVuPs@AU_xGtaRi3TsXqxNDF%*iJq|za3R=WL(D}SaIiIqnE65aV>{KxO#|Lm{d zKQM&U6+j*2H2s00JMYX2W@pV0Do4BsoHaWORr1agAtSyUAg=p@h7Y=MSM=Xk6dnT~ z1~~j7FL*+D%WPZFe?<`aN#)(8^XV%7W;r=IZBVAxZ2u|PzX|Dn31m5~mkxCHf=3S; zOMs_-U>3IuPa5NY(3;xgap1{+SpgHU-wYXD!Lvis=GBX2sQOF)M+&fnhUKC;k3>Cy zd4Nu#<5Gm|T2DNwcWrG=OW`tb{IFvnER0)B0yhBW6JrJX)4T5OGQ!+bE^?4b0m%yy zTsCGxR(I#T>^JS+YfKmHS|Pzd`@hnj>$m>R*Vee9+%#KJE6RF?m_JnCG*l3_c4~o} zfEsc_7NQ5hf6vp?nHgJQki$n{ao)cd*8F>}A@c{uK({vhIihO^pdCuk+k@_v*`U<~ zkh{wn$e90A7qCVLcjHIoXrAC>Weo2dh@vF)phN-H2uEvM>b z*;kMtgd<2RBB#L?BCMBdGY_!$jE4e?UyM2Qh#ns~GzJDjP*nrQ^#ejRP(jao=m5Wb zBNP?)@hHSpgSVmpX5lQ(AuycSd%pK-Jt$e9+BkOr4WprMYex9k@Uv^P=6eqyHTEHb z#K3~p09ad;_va6y{iW&8$RQU1kC12B3wQyD0uR&PIJ4)hA;DIIrI1SBz7gkVLJS=) z5Ec?HhsHrkXz{P+p|Nha!0rFwC5&;7*8CkBE{E{z*b|E&@C5%+IsR9k#A@)y?lOa5 z!-gs#pDm*|5or?CrzhV_^ObpLaf3)9`Y@9Ku`5)3)hm)POmOoScyrk17^_f=@=X0@ zV$i@wg6tkJ6sRCT<6D^@#51;aHsCyxX@jjD)jo})rKcjtJpt{1qWmac7|L?6xO2;j zS3qP@3XC~TC`g*0+qj_oEiKjlJWQ`M2dROGJ`*CEGAqdWi>s_E9&(e(k4BT^FOUFV zqNbLuhZMWu#;m2l8;}}xa2GzOfVCg= zSS9&&!>^!8TH%)iMHc$&V-l1D0Pf%F3_UpX z0N2+Y?9?Sq$|4H0%*;MI|4ooa61-$RA^*vS1eEE*c3bSh*?msb7&DTl{dhP@;s9!` z#e?y>m%y7Lyj~b@+ZH54tw=I72FXwZ5f3(^kdKI!Z_6d;U8j7A{lJZYVLYT#f0jrb za`z)5$?!%Q1W-R$9} z{Z|q+08ZhHAt*fjwX?6)H3{?p^!W-LB7nhD>rkAxfA|_fiBi4tf9abo4G%RHOh*EE zLE*qktT2o5(F_G?U)BEz#bo&b-UsIQ(9KntiuaGsR_6b0M~TlFh5!pr6w-T;JjNI0 zZ(915X>_M!z-|gz6uWw1oY~tEfRle#ipR&JP$UljWgLQYg?|X3&Ibk&NsPI>vsJ`N z311?rJsm}+5&ySpc-8rgc(C*YqC(OWn*Q|kc$``7$$ak%9JOiSjVz1a!9xEjaNN_< z*)2YhnAZRZD?&ErB}54z;MzX`{`IPJwGw`ghca1}48?j3C@9jzZ^FmAp|zQbj0CF+ z^_f=sd$NjWFF~z?P#u4JQ{vp2I4ol(?*Mq~Rpou#-s!o}NJP5`G0m z7Vd52q%o)%UZ^`k=CwbgvULd&B38H(jJrrttSA3hgJur)405r=w#MbTuzZ8Mb* z=%=s#2TMCF-?QMwA|uhaD%~`pwIaR^P}Y;F9fw^g0I9%I!%iHAESqYOgsWx(*aHvn zn<}KMid$9`_%MgTXKw;|&-b86V(iHO-U{>PC{|BjR8{5S{%!@tRq(EeyX6sPaRUGw zY#mV5>u3Zj8v|_{fGXJMHXr0)nTReaLIVpZAfeykt}@D-fCQF=ofuuS&BPckc2HX_ z-InM8p5I(k0s3?V%pEJ@6g5+jwZ#9ABFF5#!qY5cQGu$5f`WqJNFb!1(1e%}7x%Oh zsCNu4+!d#KNYz1j0G#L0_?cRZMB6VbaKVh@KU2q*cH7xNb~N+fwm3a&ez9NedH?Vy z*^#RrSOpPv6Cg*+?)(-Mi97*oGx3^2`vOB8!=6Y0nmSc9M~M zqSkc}u}BD`1_WEKMhW8sa+(S-DiA?o&YWOgG*w}I1GVqlmsr$V5jak*edBRnZf6%@eignOd!(B~QgnjnIGnU#y6p+9wZ8)UE?o+R7f5S8H4T?G+(q+jWf zmj-?vQOF&_eOU!SKD4!IA|)>n6m1R}gcB6s!AzhDbj4e-3yAn@IoCPmT+|P#L}O|S zcfa3wC1ycigE@a|6wUF`HJ#YI*7S(ufr=JmFIK97@ec$ab0dxcO@|%45Kil&L zIzwzxzF}x`)l7>M#N^G04!@E8=6~|<8IfV7M2k=S1%6PV!3FsthwWNLTDjl>L0tl@ zE7C^?%59|ZV1qw9oQb9J>Zp?$APSdh4z?*Bj{K-rf0I#0JP!1;x0CeUSTkv$mm`V6TA<2g3JI zZxsLyh=x){Ab}MqCh|lBt`#u@soAx!v_yb-ce8-?ip<;`klXiPA5qbWSyf*2v9a+- z@dP?hGPsdma5%p*Bc!!L`{DYd6#Phbp794U_D1745yF&&Q;M_8Z6C{H1tTiVxO zTcvl@ugqilUf>9K*W0`I-i-Q-W3N;k2Al z^O?_|tG&O5{DG#)oO=1!{q`@09Z67t?x57wNJclFb`f@VLNRKTydlUJnd1uFK1}z$ z53X2rHD+okF!35reA&9XbJ>o9x5@AlF$u4M&F&}dBe-n#Ka3M*t3PJD#v4|zOnjd0 zdd>N{vSn5A+w22vZEftshsP2wlQmn?XArUtbFvNIW8K`Cz{G)Hzid!&{_<-E-Av`j zdpjGaOq%1_M?$p@wg%r_JNeG=#FL}{d6=eOws-o@dyYN5qIrkshsaeF72(Q!FZaz* zjY#_eBFducY${TdkGWIcpPwKu>hzrbLs&AhRf(xn+;NVib_{Z_8oqKlHYTQFRnaqp z0#&q;XQ(w1^x$&Ua7!ekAcL5i!fKMfc+#JK^xt<6!C1BzI&EFo_RoG)aPVtm;;UBI zE6x~M9h|AB1EqHNZIKbUpJUCp@;mB69y z&XPv@pf4{7*4^3)7~axjE)tjtF2;X;AA3@+n#(9&vqn?9pE??ybTDSiFJ4XpqJaZC zrY_|j(G1`98z|M{er;2>Q*e(61wuUqcN5H>u=ClS zrOTIg6 zLTjedfuLPDAM$7qG?X)eSwCMj9JaW#q)69c!#MBG{^ublf_!2^@lM*i-LVtgyA6wD ztL8Of)c(Di3LLyPM9;c12aL3kWuZD;7GCE-V>-8^`C|>Mne~1CtKO1(p&y#aJT%^4 z3nF+WXJoX@&561%jy#5qz*<|A9zT9u*7X++@|~F(JMAl18dnvcU4C8Ch}fG9Gx+@p zVq}$aDbvYTw-ldu2*4iIT?=X=Qybz6Kj;x$c2%ilJXmj1(BBH@8ku=7`c5N(9`&|0 z_RF)c$a)1K>qVhq%JcP2u@f0f>XpffZ@trB%ykvgbS}NW)&P*7^RF*#Owkv>hg6E4sc7UK1~F`VwD zskoKBJx%7p?=xxtm^ZvGa}mBISSlO-)0(Gg7&)X1QVc8+r=J#%jlcjfr|E896z=L3 zm_#c3a7_p`_9aEyMf|@<-XP1YU~;TJIQjYW20We>g>`XZ0Llpds#avI4%5QUYVgWn zLe+>s+R^y!8xw51V%PbXJ=6Ym$_L-?ZSEd;A0Zs{s(pSMCH6?2Ty5w!KUl3epL3u_ zbf`$dp?mlmovEepOpNTFtgf~;YI?6es5BZ@{RazN791A*$upz|6X>v!o-b^Y4>^co zp(10VB0GKTNXbnx&x~*wyW{AD_=R#|fOG4<@E&m9mr1=z!_(vd2#E8_R2x3%*yzUc zXORNbv{;FqOzLL%!MsXi!NE8)`iS~X4Op35);#m55PUAOL#hoyYgv{GnOz%$E{#=7 zE9O3V<^+98-llEv7Mr!Pdy8Il1M@OB^Nzw98?cCcppj?T*wjR714HRzEuDLQ$Ai#?}Yrnml^YW$afzhhx zO3LEcDRG)N^!fP8G%gh>l1MNeg-`XW5mfgxZjCaYmZqc&)?#Cw`M_vx5T!Ms2;WT1UL!>Zk zy>4K;>0qsHZ1dECWhD{1h-lfD8dW04%N;wPnUQf3!c(^1baY06 z`$AH;>X4QV5fi@@#?s;N#{5hyr%{iFvvM#VAt7XkHgL@FgdqD{^5sTtcV;3U!D$RtIG@hC zSC!c^>q?iMI-Kz}B~mO1>^N7Fft9l8B3R1;84NWe_g|e@yll+#@9QA9)Ce_rAJY5w ziWNX?hFosoV-W8Lh60oBh*7@uaE2SR&xcFM$wjJVcV~*gBYU@I;6`>CKOLFZo_W-C z6nji{fA_ubKUN}5$9Mt*G54A_pQaoONQl0IcBU|WIKyV@xvwc|>UU;d5AJI(VSF|t z=iA4dw{k-WUY`i7@E&k(P}k(oAuFs#`BbC0zX{Ipn>TOt3i_OPH>1HVQk7lH$ zsRMxa)j0Q4f3dCe7>?*s4Df+5oC;x3=D1ut++4MYKVbwf=zeBpkEZdRU!<#D+_*&( zA@;tIpY@R0s|4su74ob?;x`m>fRKg`VUoH1@Lqea^OmmkeVo8>b zV>`-lW0jPFyC28AxS%ZHU?`RN*VoR?+0VsBLCypN9?q7i4Qqg3vMh=?A5Po6uP3hr zl6LWLch4ZhhJu(5cVR+&(u)fo7oHo2hJ4tArBB`rTx?`HXyhJSZsopIV^;Taa^7c2 zUvcTvTc?BI*pVJZwGa+jcwTAbc_R*=R|1}wq#GsSjy&%t%lvwTv8KmU@?Xlq-% zAf!IZ`lHX-ke z|C5F(iy(#gLJrB;T@>wW&TxFP#^Ev^kLx1n3o%JZN(NdMQDzxkVpJU^hq2)=`t3(t zZt3vK$ioxXS>_BozU;T3xc~UTVRwIVZ{Z*RJAZF&c^nqbXS8noz{_`(BH#?m%SBiu zBqe*g$9<#Mt2xnf1?(skv7?u~U`J)2z>XLKdJ#L~x?i);0jZfBni{cHPgtGz*M1++ z&wNkO+T5>`&c8ljsTJR0^R)eE_l#TjynE98Xpt2Kl-S5LB{jFdFK=%a=B^Y1X3GTG zU}VX8diMCYosjV8DnN3=0G`O1`Vn_Z+e@Qk7E|Q6LZ|;X^G5asTwo|rfa9Eto)l(& zTR-6%e=j}6$8an{VQhKz?YcwlfS=mX2_!%ZAjxyKpg60R98=M`CxxnT0lW{GSiIns z32+qfVKZ=^A-e2I(VK+UcyCO=G%36Azb7CB)BgWWT-k$fp!OkVl>Ruip*AFdJaare z^LrxMXYL%9d#*FDZJmm?PX8L&L{eY4kmciLMY_M?zc{I2B2;Ckm;DF(zt%wMyx4YR zv01jawm0T{?tLUJMl#u>;&sp6g^+i~69YL( zLqmgwQHt|=O=3^$mtuB`O3EYb$&F3R{jS8;_6!O7j9$vt3xK$K`qpEV`iyC%Pn7v4fl^iO=4pa=ITaOQQrfhJ;I{8Ijgp?M^9wikNs8OtN%pkFa0_xb~ zmPC;&NKQ@3yYNV9@qnMpbLuMVz*atN{cI8ma%iq+V{(wdau!M!Z4#XNXN!mj7j4I> z#APyDn%}?eNvTV7mxbRCF+NXDK>;SZ6yq`1oKxVZFz+Ozm@*_0gzdH?4d7G_Ck}Mn ze185}NO=EQ?tL0!JQ-HuMTjEfAI`NV)D3mbo$*3nNe=2YQZoB+J9f&^!DW*1TJ6o} zM<&r2G(}j0?<0%0FTIlU{7&1hosaCgl39hUjcF#w7ni7i?G67N59e+HOn52pzArTl zA1)VcEh#+R*7Nd`g&PF?ENu8#MfNE)6OlmQ@WXKPKzZ3RkK33`lK7{dR2(YX>D4cL)Hm(uv4(73n_?J9o-32cURY;$+wRuqxi=syBRo#mRPdA; zjX8UCR&lH)%}sp0{FZuOFnS-Q#7m~dEsFI@2@!qKq)k68Ygb($AGX?0b3T+Zy$waX2UyUgNayk2`YR7w}_Eqw4;G^3%Tn}m-W zshMqMpx^a9e`qARk3z^BvJB8_xd9OJ_#q^}p&YXxaE@3jH)$Z&%J~i@?%oDi8DJ}> z;-ep}4(DX1SEkU&N!WqN1u3yv8qh*-KYfvzM~&Z7)@d@`|6#nhpvIlWR(+5xSNYOmu-ld;2QN znRA(e`cb^IHO51yQ2dCY50(s55wfh9`Terh;hRzx$@TBA(_!!LqvyOf8382tdf_!g zhz8>3Ia*@Bc%p9V*@cL;nG~pmM_C-y{er$7zTl!FNyVMHVkm#^-#Uq$ z2|KA9)*nbH5_HP&E&BVjcx1W&qk?;h}aZL4y-N`;};%zG}Baf4u{CFh+O<6JFh+9k>*fI z*8LursEA5TQW^86BA?sp$$l|wU#x;bGftoEzHr4D8{249Ys+oatx8Y2cxg5RH~anE zP))#V0U@V=$oL@2XpwHjqQRZHN|em9}5!PdDLObEmyHgplKiJAIdjWMznmhgvlO$eFE-Cd3_eE2fVST17 zJlzxTXhf*8Br#HV%Jf>y5a|k^Ai6nO>>&6eq>$N84~Ls76=5oL#Xo1CBeZ*80^1AGy zC$ztwO7UZ2F&y zJO*PU0cwEa5?U>~9m}8u@3EIz^b& z+!(jZTPOUYFrJ+5MM8W|>C{I%OwZxDrz4NJ zM5t33(W7t6Zm8k?DW4Vx`u_Bs&Bt{$DqTu;pZ$srW${P?4Gf)8ff=}_zqzDI{Lqs4 z9H%$2_v#g%vnA5=PE9qFNMiZDmlkTkAn;YJaAr@Vv|n+AmH$r#`;iqAsqoheOaj+CaHjMVGN2-GEmGHXYGY;Ig-45!&WzSvkdKLa*}8AixPI* zChgwsTXd!rR10tK@LILd9nZjBap5X-UJ*=^=!`lsXUb+<&3wB&Q!<-1sBa|EYK-t{ z_Otav?6$NWUGe>%x#FPU3%#)~h(%6ktp+eNi}ErE>3vZ(3W~9-;wq&JD{xaYri`tK z&@h#V9of?kB-(MuM6%$M2zRxV${R>TJ_J-`Xz5n{J-D;%=p&^Zy^xo!{&%@TAVU@= zl1+E#m{?c=G(G!Iv(Ii^FeYqcBB!L=kbD4YV+_zbVbKv9gcO|_1iYJ1|)FTg4 z=~SuOYPvvqbQX_#8_RsO+`%vzdyCr8MX691g`;?r}&$>yi77X4)VMbDyatRM0~Wvrr{mNtJWpg>V3_Bi-#1a`Zq7A)2r z36^yID`H7V)I%ZpHqjm4lMNy=Y<7uihd+3C=pWpe;V`u)jmfVucQSItFdYf$a~;ky z&KdktW0FIDJsexRey3B#n5ekbU$4+D{Yo{09P+WdH*MaJ3!Wo;@4naCTb5apAaGymaN1%x~66dL)q>J+YfXO_zA&e#T`vPef>5s{LuPdq0LUB z7mm0IV?X$FIR`cn^YxL;mgD@GB);%ghWGn*G@WN5rD9`MXlBs-$?tiDHTXezR=K5v zz88`NS>6Mf@A^O2a@oKRJo`2dPX1dRdc^*%wFc}c_|ykzhRUNcCP7mC;`nExrd~%1 ze79r=Mz>%7EdiTu+0rk6U-;oNoXBddR&qD>0YUiWC*I2=3{{_p2PUK|KC3ImmIVm) z+-3Zs-RYw1Xnu+Rjd2j+$jk2!kKM2JBCGNkjg5??BmOj2)T$g|v&y`=uh8viezD4z z`EiSu#!)uBdI2*>;VH(ikD5R3l-(A|Z47vT#jbc_YDlFoP%AE8=sguKG@4UByOg)YcR12t0M4$tyt_94*W=A5RsAfI2G-f{h-&_S}`%B$U@m-m2PU) zSC!zOIol3#HC6*h)0e3u1Se;lRC|aEDB?F)r*E-WGV2)^TCcBGeq9b2WtsKsKC>fb zBQC;aEakeYWM$D7Nz2EJ+4!l=9d+Udc_dP%N8~kApQ;YfZrSq(SmBcGzSNsKy%xYU zLk`XhIs-EDhBMCC`y%QZ(KCaX^AX>k1_$C-KGk4dzuqVhqBi$sV0oLN`!DoKCANHv zf<)FKr-ou8hTQN{4WNQ#sKK654?vHAF4r9osomjhfy<9}(tlCJ2O#1}2EP`&Z2x$&q_^5}>VAuUuspUW+5 zTWC!GsHE#n=RmPxl=|yqzvxeW#NpWp)sgXP9G&+HQXhDXZ9FfM<`NM-3=Y$Pz&L?2 zU2z?6bw?)kPT5DE8@XZ#o%oVF-|`Nj>MQMqT%{dgar!O;sPR>um;{`HiqusSC!u-S zrU7Tb2bKns{K?X{+W)1Bu8&7~XmwVXO$2@~otIVMvf1a)4m6ReFO}TtP(Q`EspuD% zT(2|N_{A#zz+E{b+C(ZliS^H(N4CM%rFY*SI%)?itdEf_dQ<%V10Nx=O*=u165(-b zCVLdB`6o>}Wm^1#-T zjYggcK1|HV1`?ANqF*&No$HEoo_+Hu-MWMk6VH)HJrnXgg_*PeSeOe-W#xqEd@`XR z0ri28g_d~t`vBL@RLQ;$pT6`WH=bmVfr8@a3yjUB%O^wtx~De zQZZ@isb|*(BMFMhW2pCBDrmY^K`9MIQqSmF1%+rR18?R5^cn@zUF!plrIDH+pXyIs zk(~~!_9I3b!i&gj&Jc_pAiMal5MGvvs$n*srGs(#$}z;s|6kO8=yd))q9=1UV^kD) zTeSX%9|HTs&iPMxHJz|VKL%fYVCF1LM_&=B>bE5l;qK)M&-oVUsrGy?moiXuF~7G} zpx7bTeK675DZbC}biH+z7_$YNx@iP%w%)3n9v5}Q&_%Nl?L~D=NM_u4CuLx2PvXVB z)}m@U*}4bLPMnyzkA?Y^!8WNUPLwO%*~S}Ct((sMaVfiHK{iOd`a97~W1B|w$8f;p zR{siDX+F7A>Ac@gdeLp_01abYmox413j3T&tcEJiJ&FQPsGMos(_W_-A2L)g#MBa& zS<=0{ICI%a$fTofRJvLd#Zu@di~7?0TBw-d_`lKwZVmL}3N%HUAg7e|TH!zBy@0ei zRlP(EdbB`5>{&QC6x_8p(v4jaY%aX^fb`pnkL5f0@BDM;`<> zMKXZaA2OtWVX_F5pu}IQrg~4#pXx6kE^$6{dPfR`6#MuENd&oOR`3l+q2(h4zvdkedca8B~C}4Y7oDPW#+^i&?uHN2jjoeu!*vW;u&c8@BJc~_$i$mfs4}1B?)b2 z{-^MM9HUz6Tv>tQo77~&UJ*%8O|A8>2@mJCH8>3WsHgEb#fjT&LZVrX_1D$ADEB1< zs5m!=P1J{O)Qb(O@=|4R0N8R7;E zMc$5a#YS31Kae$6dzPyk)jlv&z$9qoZmYu{U#`94N)vye>FOdbB5EwwpVsU`AC#xL zNF^p)CpL`pN**fXqmpNHL)o7%`I;FNW6>My;5b8U^bVVjHoZhDTX3T{iD28hGGO3@ zjom5y!$XXm)e`>3U3>5BEa3(7oUVGv;9DiAo^i8a{iW7IiDZ<GBs$;5#ddNWT@8QTPQQm8&_vP~gdH zFjwGx0SBFQ%E^0+>MWtKvh3Q`Yq@$BK!`jVE-!?^Z?x4xw+V)Ma=FR2@*=^fwqkET|a5lEZTIX_Ip zNRja&O_2pJGwo8d3)f1=D&@FZzmiQzy|{-`=OZ7XkeT61-Y8WM+53|~u+yTkruV4H zaD}4`USxeJ4_>#Sky@@({qKlA*k4Qc+D!3)WmVT zlI>DYPB`SWs?b)%m0qiN$>Dpo6Z0z4Z|+o{CwiJ!GohZ!dTO^TL*uiOf}HXN@dn*tddJK z#g~bykoy)zxsC^M%4#LcH=f1Sn)bsoq zGq??I7~w5fz4p~S+10Xo-DkdH*|mH0W=Oe_(?@UR%vJz4fcu2cMh6zECWwGxVYo^^&(Ikp5ugBhsV4-VEcKc_7w-gO10d)*6g?$=C<9*${}~Uit(^v# z9dz)Y^CGHr9X(k_c3##6?r{5@hO;z(oQ0(51dx_Bmj3gwazZxnYi@ClNZU2A*- zr6Pr)2KEBwx~HMK>Lqe2ngGxKNHS3mjlvkp(#Mm+in>Tz>xI-?)pzaI&JLpxK;I9`i zUFxOQJJcsZZE_5@)!=iYk2oJw zCd%XJyBPB}0{f|2Q1kg+BULQpP}9xPD*liClM*)`O1EvNrrbYa=<4SboBFNK!NXyt zzx2*_#h`t#bfUuoo@;B@Kh$OGt-h#om`!n+eD%#ehi|il#6OQgOr$!L5SX)-@}$g? zbhi76^Y&7$+c2Z)TOxTgiTWRxhzbY>ME={i_B%2M#No7iLb_?251w6C33T^9no-91 zXWJhJ`kr%J?72=9QN=NZK?~-lHl{C+Y}B%xs@q-R>^k0b@s+{*F~lAIRU3gK9h&F> zPIF$LyOAdA{34TQ%CBn`Il(6rO8C6e4RXHgi5`V>4BwKFlKMJ&76>6IuvpAIiCSYg z!B})84T_$^XRQE<2T8=GSgz(k5(?x31$|IF1K$kY`>txQ8rIAFQHy&;qqy!)57@l& z2kU=vQ}ESVQ&^r-zSkurn6j|Td`Rxi&USCsG5*;POf*%AnstSl`#@@5VmferN7?=#=b zV{@%0S{-q0EFp0|8%_|v=2*w$@qJo)f^KI zBvfpkT@p4T8mtlpKA8_<>_U$)QPaq_e)!4k(kWv!(l}QZ6wJ>X#Vm$uucOEpxfF+K zjyi(M3O2A4yqV{9I<>FIQCh!iO0iXx&ul-yk#eq8X4YQ9Hs(S$(ZqS;6KDHm+aCTRo_gcoc@TUToCeNGH zO&8J089`0v=tkq=C!m8SBi3H3LJtwW9d;=GGj6ecyGN_s#mqae+|oyAu5s!Q-;1d| zOSL&w>+vorQkm>gEmH3hT@+i%VBZ%%lOKHH)5oOTMP3y~-ZRTgn46y8BjT^(p-Cwv zQ`hu0Q&?!{SvZC($`@%UjFfy&N_>G>bAeQ@*8^9gUxFnRZ!Bj?|6rCfHX;|1DJ)P` z)b-<1^yr)6nNgVXvz;5|5*jO9Ya$PAknmdy4_j_Eua3EBMXNtUV?s^#y!PhRUhRtC%V!IQS21V(xzYN4>CI3}mcz z*QgdNU@l^U9{p?-qMU$InB^<&`60z()Gi>2Gu#42x1qSO7Y0cB87d7LwVhq7*MCxp z>nf$Yvm&r#B5xAAD$5Ph^iXyWvx`S-tYyW9cZ%irlCwOzp+wD8bQsQsLfq^W0`d0 z>L*oaR6&Z!wXxmxkq?=9%ndZj%1kJ?bYG~{c-$~7;l_eQCd$FYB$Yf%#nzdDPFyAf z0cu1e1QMIU&bGyyosWw0$=RC7n3;mh`9cz!D1HzTMNrdi_7C{3pK1HU^Zr>-v%vg( zjm@Hnz=l_yx0}oO089dBBGK7S*-Ksk_DV|XppLpC>H~g z3WT_GUQ5LXYb;AevAY3jx=odqgy7f-B^CE$e{m1T7)HQ7a$W)Mu|b8VX-c#NEdVv{ z4lt(QL8(z+wm&8TM40Jc;fV>U0CUP68;4bJ%8Y(&(qZVfgeH>GHC2|UJUqhs?fdy+ zRgdchF6LYxiWo~Mi}V**mfIlaYxfrs8v8T%JQG(^ z@q%oFt3;Pl%O>rCq*H-NGr8%Equ4$R!?wZDlc^6+L-tGqrx<8d-IQ`oV5}rc{{|Tq zO6X*k1Wum8TF09O=ldqT6P-UuRA*G3nU@@}<8b51dY1r)3SsT1*MN)AZlD~u$mK%5 z;8%58#*#tIiBDqeY^6pi8dtKps z-aFx8QpU#RmMv~Qj3Rhjp$jytz!_;7bFnWr9Tme|gQX6Q>+^%lzf$jy ztaGTn(s^xAkEomRRY(xZzxs)C$^SAc z-l3%AmhA{xjv6yXwm#+mh6I|z_~SWM7Y{Z`RG&P1R*ZHM;H?0H3amNK-5 z0K3DB1Xo&xc~fTxqol#DIln%?bl==R$}pYtvbn%rxiIvlsu$JK?`&$C6VHyF0Y)uX zI;i>PXKCTz11p28MQyid`EWoQREsaz{-)xu6e&4kRdFYTFd{i9V{!ii2@|>T23gtM zxv^cnZfr9(n=QwrE8`pY>y^wTdK{_>KHf1uZU;`z*gSC_aE-8^pI5BD_(M1-(pI29 zg|hTT*mtK}XUpeDYIW9=@Ab|%L{a2?6L+>o1F9cXE2=2CB8O>8u{8XW81LM)x zLCgyB9-yb^{r#W_Mq)nb&!MIE1}S*y! zY~bL(p*Sup&=yI#-uGej_gWV`lr|x1u%=3Z_%=RD`y+0(SN=Jr67nzRP2e%71P*zx%;e6IB zmHW{Vqbk~+mAaJLGScYwuGd!E_z#rYem9+iALxHdmW+;AIM>;AZ&*^rev-;fAUu*; zqL8kut&#`tIw$K&s>>cxMg=Q)S zVuI3QQB1$B7M<}1%EYW*V0FeC=l$h@LV1`54N5(TxRM|55R=_Vgkcfv{u!`5utK{& zVjW328=~5W+2LgLVDDPp{;^=b{W)_Y_8?P5L*bPUO!oxt5=NIU8jM+T(wHJSJ`m@3 zKk`%FXoVshnl5UeKx<6nhA;drPn-or8y8hfn=`^yp1QMIJ`g|}Jz&B*?*bVEARYCa zPuaL}A|SOi`~@93V;@f)L_tpmC9fk}zWQLbzf*~bpTmoee4DbL#6!$m!NwUwC1@8a z^w3wbv{89Xd7HYzhyZh*H&Lu@E1evn!4G;&9aG(=lm#SGM7bmiOlvYPC_3L~{P3tF zigs?R!jU9xv?jl?D9>kqUe<5-{x~jh_|C@>wVM5tcRwD4xDN_!Cw6OXR%#juIM4sH zo7;cI(@{p!QN<*+grJz#D6j35pU-AXC>E)6{pI_0SKD!Af9|>8(0#@_RZ}5s`-yU2 zdzU(^ZHfBN>JkMk@kQ(2xV?4Lt=~}$vK~L?JT9Prpra#3UcYaDJ4!xo8*0{mMjd~gp(1nU=e=cKUST9zD zZDv$7H!|%x<6!9YWUcx*Q#GpRPw7v&xtccRALBuh-X@;|h)LGprV=e4k2>jBAw0ewdD5Z?Boffm6>R2UO zqD}sh5O2GeOQ(h^k+?T&t1*h$burj@RtRZ-)UT3hd!92&=HBt zDd>G~;ZfeFGdK83=mLH9f+4GgkyTZZNh`U6k-0yW4&3SoS~8BVkPm|%k`|5v*;`(N z3Der7t6VlOl6|MSu+H-b6&CUSfn&2GM)DYj0b zF(QQOhIHM7GoO-WI`6d$!$+3*d+K=2=VgWU;YSvk=$1Cul}Qt+X~{dh`+nl6Xv_WS zYZgB;ryBPK@6e+u$IV*0EF+Ja?|17r z_H>r~TRNf%UhMzTuNVqxM@V#a{$1=j-`?6wi-?po&{fY_A_S`fJ-tXo_*5IbQ}Jbyn;eN%7<`3n z3|i@4ZzsP*`!T$6-gi01NG6QL{=Dv-J6W+3d3Q&7M=(sK1@Cw%2^owndn*6vX>6u)l&u5Z z#RgBaj>KMWacg0}O&!OJMR_tb6Nm9RlDbL7&a9L^d9Eb|#|uX!7QJ*AJUT`WRNWRU z#VK}u<~K&7+)W9OV^)7x-Y`xgGNGzZR7|FhZHz-lzd4nT{)J&-2b6}}9aSAVtz6uR z7A;aOqdjXlE1>pt;7rq^7iij{c?Sv5(C!5g8Pcf<9l`*Sf{K*`0PHJDf0z`zklq$2 zz}BDx;cpY&j}QQ7KB1a+!Be2@)}`QF z=}sL(Dc*(kab>d|p6tgG{f;-@$KH!yOgw|Fiq^?+@k@;;b68k>$R^$C=N>2>?$9Oh zCE;{Tkx6#Y1L8tL+P6*_5p8Tx<^lv;#%1bX^8Ftuv|FlT$g3A+&sw<@&>xFKFq$yLfBwxaq9ua__dh2-;i? zY*p`lR%c%Nx>&`q2S$a&q>d)bvA$g8UF31s3JtKgK{ea70xYY~%A*Bobdi zA~C4>BXqhz5qB)$JRHjj=!yyfKMj2|>vR3Vi-7QyKm7Cic~>Sot13nyvMQYxBO#aY z?90ct`>CpB>l=ZI$HOI|7vfg945}lm) zIT^Ikq1qIbYCY%PP?L_|8{NY(pIM7rsp(;}?mmZEZ|4cls(VqzzEC_0Nx$$NiG~o6 zSahf3qNrr){IS1^McPw*+}p*Bok=l~4EUA}ZPrsfehcok{2L_HjGYU6QZy zeaDOWgGV+}b%i-DZ4gIAhH0xP#B?!JG2}Y6MbYQpiCUEI^fvOux!xX9H63fL)$DQ< zIaxS*TqJC~l=&F`E0ulmYo(ksilKV-RqiZqM*!8fp0eVQI`uCy-p;vTrsx2X21Yw=tU#s*WLfV}-o}|+$M{Vrl z?Vzpd4QEt@>n{ktuMdOo#D23*M2CjtJW8G8P%JZ~v)Q`+kuSc3mr}}t_AV;@MCzBp zqwAIok8(0oIEveBevoH43~DF5Ry>0xzVl;#3C7>0x}ejDLtWLiB`4mr7(C-1HNMhH){kYbsHRaP<& z$0s%2ReEp5sUv>v+32BgmyCvg-5)gwN0WB}oN#}{ytI^A!Ze6$y$GJLBL=SQd9yVEo&V~qm?iZH)J z#chM0&gzS;iS4y-JC=g+1{ z6A}{MkQG+=c|IAv?m3tj+>V zfDt=2Bw$EUb2LYh05?KB(AB=m zkvaP$^DziHUnRCQaTH-lOyR~%2j$$P_;!q2CC3&oG}0`Hw(`dM)V zTq>5fi(=;+><+pKY1z$Wfgo_Rqlh6QTGrt|NZ8AL@UgdhBBLuwY}u-!M_pxZcA%Ogh>WE2>E81vsmCPV1wD@I8| zT$YB;6q{q@xchG6^;f?bQOX3$?BCDz2&!7ZrkPToX4RBd+sSvMFZ^goX#(ro=@<>) zp}WK~LPu{$^j4*SEL{e?^%S&`lSu18E4N6oxPbIj0K#4^^sU>hZWvTSjbPiFbi*uC zm35Pm)8Mo!Rb8F5-`m>bf2UvI6HNK(ah3fRzmmxqzum%+m!A_|XQr-V-vjyH0Eu?o zRoE3>pIy)DJ5cH6DEf%DBLK_rRoo@YOrnWcBKi56g=PxB`dJ2cedyh@ztoiYmP_uN zyDvOB=Z^a;9@vmAZ}H|vxf7{nLGam}1(U@rH`zc&ket51A|>x?=*X)sBERhv-g(7A z0=bG3lzvGsWLa0zfrmDF9R> zM*=Hm@Bud{_QrQp${GtC4bfDqr618eZbPV(yJj6-HCDO?^Ppal;;fSr4V1+%P&_qK zzs{HHHGhOl{pg~P7?Nwqm%8fkM|ng9ZnO_Qs^V`-ZLE)uesiy3;umoXjD<$dyTJ~> z#{rwFYrdWd>gpz7S|%!0rMBK&vsa80mhtRuph{Vfv)nD^|Tla3Z-Gqt|)UccQ zJUSu3R4eV?FypX1#}qa|a`*Lhj$=;f*dRdSr4Y&NV(p{1rRofjVI_4Z#ToxIccSOApOdQ0jOp+k}+iN95dFPY^HF zc_cy41?XoJ{FuMP{_Qx2E5unB{Pgv&#!3kLKr%@w)4K=}Q%h*N&mb=pssL1 z5uA~9B=A)O6nNP&hX6MQC9B{%8wgaba_x9@uwC3Xj8+f=WZ35!2UblIxO$IXG#XT4 z+4#KQ{=XQQuID_GX8s$1hq>@!ik zaB=9jdz9qdk2jmiz3xPAI_0{_{OtNGN2A43s8-2Wx7mrWNI-;eSh}~2mpks?E7{lc zSB1vW&z*0~5~W7?G8bhvsQBc_IX~1y3C$Qdm_1jc8^U*CDGL$4KljwF-XU7Ktvq#0 z0gvZ3o2M1&MqYGptI@Bp_nSQP=(WDfTvhFK?#St^gEm%8Yw}+XDZG57vA?;7II#vH?i1eG@B52 zoKrdBpoEq`@$yV@Y(pdB;Yj-x4g_J2=MY&TKgz1rou*oUJa#s!DC^^(L$D)bWQs5A z3U9EK?KMZ0?izf8rD~gtQiL-~EV8X16C!Ou$yXg^o!+>eLb;)?gwnr*Z_WJdMSFw} zXo)W?xFgDL*JE+GIJL;^Lh*>p_W2&xNTdMKd`Zuh8y+@mes})XLI-5MKwTD3#pa{{ z+rS!MP_Fz^z4bm-jIU-D)>OFZs~w(--bT%A=Bm!~dtTeB!4wk`B2t~_5m<}$h-y}& z$U?4{fi>YUV3^0p$5D|$1;~nPFf2jWCO>!Qgt)4w9t2E}7hcZ{aGvF5bP+aIQCy4S z2N*biRa@x+pj2<~>P-|1EFwCs18_+y~1F0JaEmzM(ya{x4l zJR@CV_P_C>ZxQp!#0GtdRrGr#LSw4`Zdg0l1bfuprT=8&&zB1(&z|w>4eaZhT4Lv~ z1qpA#`)hn3>T>0C8ou4`oha0m$o3PK{?1{Yr381Y7y;2dwY+?Wow!#v!ML$I9sP!m zu)$4c{#iFW;=)XK0W51v<}AX5xM1v}<13S%;mg=G8{@jtF2T!Psb8*&jI!)mBY@O{ zTcf`*KW(8!@MT8Scc6CMu3NoD&)h+@&f|?ueDtytTX|1Uj!aW27Kz$a;|xNB*g$Ya zX5`wlR?S6&5LZw^7RKZ1s61^4rac`0lYv*D98@Q%rNRtKI! zr&%>^VPlv|Hy#~6`1?#uT7n*OCcTS_@&I-t-4&Za|m8=mGx{j z#nNyAIs9@{3>M}}dA%qOAlM=BIFI(p?q>EM3u9MHNXgh*S>RrCH157kii4r>Ni!_m*Ir?BUy?5Rvxd^gIDGF$~=;!>M8NX`+ob>vUBR zrB7KB*oqi(kX{dtL}yCFL-C+DB8`Y40v|5olQ6c{?eoJbnkK}W2j!<( z!@@Wa$I5FH;woZ%Ce5R>i{xP8`TixYH-jGYe{zJ!8@ZF5_8pfeC*CO*s*Y~PREG5I z=G?h+OQk**fP5WY-|lckt(Yr2{9{+QT)92hQjb*=mieB2ENgrhqwLJLQjQ~_^e3%) zPb(l-^zmMxv5(6uku8_bLU zGs#Ccc>jMmzeWB801^fMzgtA`|A9oVjzB~JA0WmuD7i@h`7in8Njfzy%1Jfj?1(O& z`d=QNQ?4)~XRfBtM=>SgeM(?E>(9hTeDBlmvNQ-gntuIT*C*PBl~+xU>4O(!(20!$ zE{cd~#_WTyesjsQqN!;-0-p7!KhlXzq~|J*>bUSyylFgv?-f`YNT!*2i%qFHroI!P zb}M9hpY9VF-JiMtQbIhm8gv{3iK5ej=m=OKkBN3KbKc!oyPoThCgUSa(anq0-Q7W| z?%Hdd6i_Vf%wCLj1{`ac4_L!?EUw3t+74dxhHTYu^^Ud8V6v_ps8p{F>gJ!>03lc5 z4e^E7{GBJ|;jIzZTUix3cn%u78VtM7whCUY7kIu6p3^3o`I9H=4(F@F$<)2pBvPyV zs!kYx%{Js+suAI~{bE&~37*p*E#2`>HT9=NXouSse!izAk(%c;i#_L5Z}juZ^6dah zxEeX!W!n2*16xnOS8F<{n$1H`*2{GA;xtb5gK_rwjbpb78a6xu+8#rJzhL~2Cf6Rd zxGXB=*^QbP*oW(X?Fa~u8t;0ce8c8zLUX0!eBXE#_RA2CO>}4Gp%PwfdzieVl?RJ3 zFdHI=b%7XGu}}$cKA`}tC<3Xn@hk>^sy+H+S;wE9@s0jM-mZLdR}m$5zPzZC43Qu% z!baK~*_HZ~@XYZ^JLW&0kI^E(7l^qG-j<()B)baBm<0(Yo2fB>CKl1)ri%Ur%?U$R1glqi^d$0U zCQz6B4deSc&!L~~6r{U>y>8YDxtcwkBD#vZ4kNnS#oAzwLp(u+m#SN&8Wiv&Wuu80 z_LDXiCuh8i3oN<)hK78|=DJ?MdbwEGVWE|V64kS^<@1iHcXabx%5-v<>6#**M}YOJ z5lJ$}(X8H_fk;UpP$x>b`Y@u{ZvAy8p?*7axcOLe1=L6uxrL|46&^U*c9#mQjJIrkrmnKIb;32S+>Id z-v=C+X4uET46)5LrA8?d%M}gVsBv}OXx+JN1p=5tj-oiLi%p#eIgS$e>7hj=l8bJe^3Yo{Zu z795)J4HJORNsTu_MPimUQ7B)j6^`dz<0%b`s8GjGF<;`N34C-KQoiRz0OH6F&ZL!D z_>9NC)Agp5v~)DECrt4TKsD3>qU>Toeq{3HM(DY~wzCJMUI1rv+x8sSuDEGfC#eN` zagzsAeglTQ0>BU#2&0~2O8JkZ_We%4iokqh0vUGzI1(TNuNJpit6?rn3yrw~*wLHB zkx+I(+6HWk+}v>o^EsJS=JajysA2r}XC9y6B=KDBpBF&D07$e0$gn^H(p7elq4w$3 z-o_32@kiArhDg)N$ITuVsx0w$<;>K;_CBeLQ2YRv;CmZCCX)lV`H*hS-9vHFms^Qb zf2f^wNi6(T82FAe(mTJn?VtGFRyv<}XF}hfVJXbhDydJID=1|&8xSmQst-?__uamQ zQfp{e?E#i|yB#5N#u@$HEk+~8DwuH;X!Dc81T5VQdyZpoYA;nQ3H+$o_Tu~uH{8ZD zH@*F19@}0WziO%o5PZR0Z~C)>y{{+Rn-axC9l_x~M{XyZv-zD^*3ka0rFfk)2+8sO za$|!V&;J5Xm4$#%ww^loH6UF*mbs1|Dtgo>VTmKU5Q-C#Lj~GHQ$ovnxC> zi6y!`s#vwJj~aG~s35YGV26St$siT#6t1f=Aan?A5*2HezIy7Zp+l9!KQm}AT;kqO z%mXMKj1+*MZG^dY){^j+h*I=RKWzPt3u6_7ne56HRP|J=+l{W%sn(|SRH-kw# zEh0+dagR3*s2XX_j`5&W0wRFRiI$6FDt4mxBodzTCH{x>%>-roKRN|C5;rc*Dek)V zOT2*D*=yzh0NEcVjyK6wr~f-)fW$%JzbJ$m{hJeZz>qrsU!oovkW};G!6zV+7y<%> z7{E(gTN?zriHv$E1e~(}Nu@0w`1~(s%0>shF7-d92H-5ye*4lc`U~bAG^1btvp?of z7Qp!o{-b?d?t%9mb36-7s6vyQ=9+yBlc&aTWH+8ZnGp|?Mxky-rdO)ip&P15$@`+A zW8`Sj(sJ;r>9&WIJ(IBg*DtB^vFAC4KK9iMM9p7c@0)u?D4S;Q$GOxCS6eB1q*U{g z&m~(3GG+eu`_S%D#>1!c)L&29$8;s>(b;1&24(&4&QUAMeLk7>;FlbnqipCVsDos& zTWGs+wj8WJ_!d5mb18#!djKkbO1HgNCMl`cB8*+>V2&f~ zbcC(#;`KUEgz-*J!&^vg&QkYJ_QG3It`AN97lD%+aeZ27)6*N~pcrP;n4`KrtCr{ys}>Z&`@jqrY1=)9IbQ`)P!?ys9m{%Ira;#>`w%dnbe zyk`hdDHvN^*gvW`M zjBp^h&UrX^%Xsb^>r1H@bjiCDO0Fr(Y$J&sCrWi#oAZJDlm`d*rzWh`eXb`TK(&>A zwYTZ79oL1b#@Tr>z*r}fF3;=VPFr`atQ=hzw)#_KY&3n*7*l!lC-vumPanlZvh-Re zn3;3JSR09^cu14H%Uxu`ff>JFN(Z;xo9?T9?u|i-8wof5owSU9EMN)Y``Ft@#CKx- ztpOP+;YZqT7iCBhbc))%HTZ-_@%!hkK;N--|LgJgZ^zpk6)#;61nyz2XUB|}H;yNk z9~nQ}JnUS1%KSo`HI5>jt$b90p5gjIr!g5Q@Ar|x`V~{aJeo<NwCi#eLD*1a7a5J28rT~!saw6sLJcm0criGj<{>a6u-bX^s`W^4Jq z;baSU^q0uJr%s)o(ZN;G(tD>%BtlVJIfaxeHT3A%>!5RaByl1+IeA$KNad1HTz@+a zq}Ymxi7k}ox_9LJ&m=h2Bmj~I7WwD+fRF)5e`GjF8fJr;P%Ft2CRa4pX$ zgh>~U6cC7aFsx~0uc`6qIXGAfSQ56WScQ#@WZAm8kt0yri$p)4<`estaG-cntmN0$ zJ$OSz9^UyLYc?ER_^JoG0y)bReAKzvm( zJsH#X!f8@((HMC*Z2s1*k7y3gzj_k4R+2#tU61B`D`yf+EtOOJ#ak$kRjLxceFLYk zZO<3mD~DW&%j_J5SJ8;KKV_*5?Cf-Ea}Bq+A30HXH^EM)Parwr7g)-jKZ2(NLc}}1 zd7CZOVh-6#u`uu)Hh8;bDV^Od{ZBNWxeIrLRKKKA4pRRJ7Plf@wvFp1pq?3Q=i+^f_HKu)v~)w**xfK_$Wq zTDVxYR0OW#<4%MA)zuU}JM z)3HAkxZ8aZ9;)($B2MK)#lU2k{rBEfKlV;^{~iz8+GqV%g5}gQJDnP*5O&F?)!I*3I;z1v+XkzLJo%ER>k2Og<+dSg2$&`$>!^TKKtP7&wO(Ft7Z%3G z6$yx}-vSEDObd4~$kMBu4yz`q%pJ+|BYF!rObDS?Jv_TFeam$5E&C-Ni*gW4s_KmP zTd&)oxs{)BKcBMRdAqxroqKLx`#9Ck_fYMX1{3iQ7?{V?RR^zPt^UhHQB>#GMl<5Cx%tNlcPoDL*+@LGp|*CtxpbeFdzyQtE! zRxIH>%?7k``p@WN0HXI3ei(d>LLEO^a;Td8(uW5^$_*M`6ik3pvJ%%d(9sGRR=rcK zr1`n2PI4Ib@huV6I{LL1Y0JN;v=Vgt=>)_4&UT&G!Fa5^4EHPIL2{Z-Gl_U!E46QN zg4=gRwbdfDsMgb6DJ~VfPZdULjXM-Ju^nndzF3{cDS1wVhA$*b`;7DldJo_YbYwJ~ zIuCU7pr zpOM4QZ8$Jsl$#Ob&p!z(pJOA(T=`j|{DZ6J9eyo~7q0s7&YeeL%@Scf_j39SD<`Is zv=<4o^IOSY^w3Ujs;nIXwYz}&@PpUli{3{*$aDR|Ym+%+p7T#9yzbaAOEWVw^tUnV zB*4b?IcjPx{!Z@8m%I9lxwCt??4|{xJIcwVRB_vFZrG`hM8HpcO3wajNlFeWO5ahA zASJ&X(hb>-y7u|q`ThI%ac#gv*$uezVC*V4Dll7jcNnOur6u|1ZdM6lB!aO3b}(1s z_i4M9DDpe#*Kc_`jlbqCJ$q6w>)B0L*>iDWfOOwtpRZ_EdGY5D(e4F98)Ieg;GgWA z)392cC2QZG5}rL#a|c!u9kOZ<=U=_|0@H6>c0)CtAr&T~RSf~6kIP5QEJHvRo#M3P zYx)TFAHZU&JY+t7&p@5tWR-B88}n*Q^E>j%L7dNdj=Snlp$X~hgf582_W{Zjq}lgK z?+Lq%@k}03H{8*k2ZM>UuV_WfCHY^f=$vdlVP_u+Ccck%_oBIDOG7u@-58Dzdil_Q zg)9Bw!Xci(Iyfj|3e!i4xAS9%~PwO@QEc5b12cx2a%w|G`zk(1WRg^d7?tSXN zf2=TdXQgdg6HV6dDj!G5In7oS8Z-RJqrz{Hkl6Vx?2@^`c%j~t>?=wVa@ zMpu%EYpnup&tW^G){-*B)uy@;98)3ftX4hwa| za~f1e@d*B?H$%R(*_x(NB%<}Gy>pKL8WhVa_wX0mWMJ#cu_$}BR%`4+WO6boemMnp z@kjlYV2_`b%v!PKlP4)bASNaQ*{@M*J#`(oi41;&l~mTeET5eGA_|9WieDZZQ2_s* zJ+rN?Em(HihbGV4%+eAd^W!|nto-LEpH+4Pdz=BwTUAq2qRAIJbwLNETt@BCm(jYN z?BjnnU+^C!Kc)6|q=Hj~rErJ!6^pBSmrD~c<-^FWH+BQ232Pq*gM`+a%qRx&AC zeiNfxAaC4Cv8`FeW2a-^wz3Qoizl=cNp15d@HBj>rkcL~xbk;Cx6v)#y$1mV9JQMx zOlO_lM+YrUa~}=)XstXoKNkIcIHwcBkp1Sfom)P>XLoAfBW@CpY0}7eO#OOf6>2P} zwdb=?#m-o{-W2KGWkq7zjoaJ3i+5q9Cdr+YY;~U=IvCO`jCWN0X5hfQMvZ-Ht@ljX z{JMi?58bf1d;EFm1;|JD#93B<&Y9vq@@c)ta@+ZNz`3g8rWPUWZYl0u3wK*RR??D% zxYwa^kCvKLkCKk8pP`TY1gYw%%diNmRvL82vW`L;DomlZ9gqKPVnJe zd7}7qNt{`Tcyv*Nf5yU9+ER(K z`*di0Cnsw_#o=+Mxiz7_Whr;JRCcpli{a1kCiLm;@FA5Q)ScZSf0YP73(8qX6Qtot z;FmYj=dh|{Lfd-mp@@ILZW1brh<}%~y^8QWIWOlE5Dpw{W>LdQTUHej35u1QJ6$|7 z*Hi)Npx(s}8>oD=RBYc1mMnV!{gX*?7`bgscP23UK|K zPKDwMM*nyHb1DKYy6pche;egJ3vQhFp$%>X1eP!R{*0AjrQ2uSkB8k=V;T1+sUr%$Cuk}WKmcPjz8!I_SB8@n z;W#@hk>RpIQy zcG@`D>9d3HFM+OK9P{g!eW^I0yjLL#Syl?z%dOu zXBfxozr20nxqNnKxi!jk#0cy1m*FcVTQ+ruA|U@r?vCDRHhn%+=S-2c26R6kYKY=r z!Y5;ew;pp@w)s*cAK-v$m&Wj;GEz*c8GZFZU#d%4JzU znOnI+rp9=?caq|tTv>VQBP~9qIUzsGD~tQRmsyr<{kQ4M*6XsJBk5>^Vl>BiqEeWz zmh&3%Lm!hd&)*FVoP{cisiwAvok)jW?l8419oh%1%&R0mMcJnwXncGDpH+LpF$vKE zJGtX|+0Zi?o=dDWm)EoOaCRG>EKiOe%I^VO1xGTX2)$e3Pw-1Y{1t;0kRCXpRB=azL{L0Rgk9 zSHEaIkWdhl76oiZASIKO6r;?$#GQLx*poJF_>#V5`wCe>FJ+;jQ&8QMaP&H!ey&TjW0k-;u-)c($CH)+sW+l_V(x= z7_bKFFrl#U7Z3nFRcLEleD zqh{l6)^8r?Vx>QCa-IbLkU*P{ zS?lR@&le=pn$;mJjh?M5zFPFm4PDm#jriA$n(zlH#HWB+!e`^DbgapfcMx~aF_E+6 zO1c|=prvJOsr!rm7_W#S5@l}sqBM>s_(>WOY=#Mupt8LDR>Wag{&@s$0SQNhKBeA1 zV<5k{9J3)b1vUGn6k8vc(odZ^ss%2!l=G1i zZ>bpkwzA>tUO~rT>d@>drn`mfG4@YM6g1ARm7{+@@Q4z5=1b>I!q9hOW^znW-9m$a z4(D(rQfyR{b68kX&8=fbnfwfzi+y=6aubQlzH^MS9$23Gk!|jFPO$PY8yQfV>?>x> zAM-{VAkWYbKY-M>y)IkT?z$663`9nIl9srrxJFivs(DHvY&6)(5Fa2q6x8ur<}#43jSIEUsaiB;Xqa@7R~4h6oo3geepM`aQAupGt1`LWGihq;hup_t_#-R)^&KG~O6RRwUA*!2qL&dE1GGB@7-KH&d7`#45gi^CHU z_XoDICrnKAR)1CB1sPI5Bgg`&@ocZ!4a*jiiK^8@&UNR(F$Bs1yPy~-Svf~je(b#} zTdI?b6;mZlmS3xZiWN^6#{}l?gj#J0Oaan3l+^<9SaLwnORwdgSJi% z4#||W7n!p?zv)!v0E9@V;SfNG22z74fi8^UrVI1aSnNx3P-0#2zh81Vf1xrE;Agu? z;G`r04C8QF**IW_H2~}bPfR{TM>4RvP;R+HC@Ci=XU@rU@r5i>L& z`%d_i1kY^P0?T<9Tn%-vh9?mF&YSF#(@}KS;N1es76K`KUqKMXxuobsW)cF2uUZ-3 z>D>;Bue+dy#wQXzm2QsYbCx{i3;nX3BcEH?l)JHtPM_KIZDYC)=gxG?Z;ut8?C{tmCoMch4 zk9Hhoe3YyP{onM$p|3t6&PAmSM9<%YJa18=kOT3YCl#Mdrd3`D_~k~2w|l-1zjv%y zN;az-GWLhE&{!rJqV@bJ^xhaaT!o&&z~0f3Y|KhFHYP?YJD0il_bZK7>mqCa?1GAt zY5H1RO|`GD*w9m(Aab%$ap0kGa196SJwSg4^l@`d>lK}cV>YRP zBOm9{u6)6ci{-I2H^)p(SrThyzkFGJ`SWZ?sX}Fk>0yuGiy#38=$p4}h#RbG1DRG` z?m38|IgJd<^aLu|$=b`~6re)k7y)M}usj*0WZnkAxqwW$tfIm$Fpx=4PY+mrgF;{h zfY}2EsFFOjP{CJgl|y>Valqf20-y#n3kzVOlr|9j06gX}7C8{8;q+fFfC}%_9xF;o z(L|HtX1UU%gYG^s!`XABpYq)25i|(i^U_Q&OML&{|Lw$un9|jWp!6+q;lq%V9d`St zPi38)ZK9YxE(`$lpsMyjLUWHj{tH6BP2wJV6hFlV8LV|NMXr3;6&t%-+5B zv?)mPg|bJVw%$&@p3=@C2QTa9GEyf;?Q8z%bx<_^B~N?dJ3*KF_xjks#)z~`0=oeZ zfj(=aU-hIFO8&GoayITxL9$Lxe4d-fn;2hJr6|?waS{-E&F0#mWxIWf!az)sj*YCg zz*_ItgW@h$MO8M2*Mz9Q{#r)VOaW@({_a!qFW0M*MMH$|YutV`NQ=I+uq%vi=J#gB zfB)wM69WnuE8a#od$bY_kt9wsR-BD0Y=!Pf;6tV)G*PUnR;O5#kw@1~EE}VB#zM~d z6alJTXJXQ6Ul$W}kRP9*R>_3W&Iu%^AY=ce5y)}5g}PCNeX0~Ona;-#o5LBXVwztv z`ifp(e*_BM;&ABq!iDvpM_n~e&gH#*RRE>Bdl@fC`?=Ij=X+YoU;e>tCQcCy4OY6=)}gK$!-n7DI?(DrWzIP?-4x3f+7*l0|i|vlQ0yw%4E< zZ<;2tO1vcUR)J#EEdD=1`0|C{*B*6D?+3kCTEjBpz-RcT|41VUu zhlZ%|kkLX37go()NE3t40U*Q5`x7RkFTdi<{_}kiJd}AXk@Eh0tu7XTwHkI1yDFVL z0Oc?+I5=MryoH(XjJsL1GZna;4-_-jLqjP^N$rR;y_xu|mQ&SK0RAQ00uVFfQw%@% zqI}E^`YUsT{_;hnrUbDtK<+DF2!>pxu(JZ_Z=F0)^#Fl4;J*bbY%0)PuCA^km;4V_ zej<}*U1g#eIqidi&X%oy>Un?Wf%9EUB6 zi>m%ZggTx;#te^~*@xH@jW9X@QrO?W#*gUq9oy{fX4uyJa!7pZMV4LQDGfmGlLMtp z5`=jnd*yrs(>OYV6)4~{x4R*<@bTPfh6)DfA!2?A@j+F0ydxV?~2Y! zehg&q|G!#*gx9ZYp2+yyg^ktFJ3kI5c+ta1PhSeZz0_CQ8HYu>yAKXn zoH?87T8v-V24?!yFO_`@opr_Si8!mewee>B3Zd3FaYg@W%MAHi0v3i<;nP+sUPnoMpmqKl$GwAk< ziPSmZ&C`t$i32o80X@0eTqGrEenj3o1m;;mXzIz^X5d2$!k2(7G-y~@Vzv#fH`z%- z3kxVuQyzwN4}hO8gc z=e3bB1w&v0I=ds%aM*k5ZVt%`d%vbZ|9m>iWKMjQEF+B^|^dH-)@XzmloBFtyX~zF(8gm>$;%@}a zMN5+9B8?_bbdg1$>OMmNB6~rk|sW2 zm;iPx0l@bZ7&P7Gk=2rM>SU)qSZCRDHJ<3mLx_LP=vo@6_9Yph_YnnjP!{8T`txa0Yh8 zS-*@ip#H}tpFHYB8|{1TEQxCGzxASWauQR2Yjo#}FSVYYsBuc~2$3bbSlT5X9o>@v z5I?As99iVhZoCjIMdCHw{cYBt;A$6lJU?^Z7I|oF1>6Kw`krxeIK4}WPJ0W{- z=BnS7;Abnjdlv{B7|tYu%Pb=4;HO{1x|@~56xsIq>r%(Zepf(Lk2)21Mz+TjzWHJ% zb;HBM7sQ(b_OHAyepLc}YPds9NOH*#2_83};Vzh$)x?vsNIm|m28vEVr^#i{r{Q)Ye|b}}VjUJ|9k;p`hM zHA;n0Cyrt4!PF1huinC-h6>@y(bos(_Cj2rPIf33C|P096F9gfjPX8dK>zr+WM*)naf??<$7ZcMm`E$=BXK-rBnd#RCjzx0->Fxzsn$giwVD)4% z;$#Sm1;|DuKz{?P(l|?zJx7|r4%Utib-@;3IuSZ*Yq&~2YP^KU>SR8m3`Y_vC8&L! zh$RDYHEQ#N)hxAixuUz6bjjWCpwwuoK(ru$cATqJ*?$CTrbnwA+u60$zCn_j=Up*JAYaqr1Zzk*OikCO@mUCk)DL8Ff#( zs=i#gy&0@IzkHWRM`VUVOx_RI$tmb#$Z$H}EY_EtIIw%`O3FL32n zn$06VU^`@HR{P&|Ig|$0(^8pt;hPnIto}9%h6j=!0Iz!;hOv9X!U4J70#@~k;A9vY zil%FV&r;5zTE@aenbogvF$_@Y7qZO1xb!JnM8-^G%N`NUlQW|`eGD8S0 zJvot&{}3}BTo9n}Db?9Dzad;&s>P9CNKte|@M=jV)!!rDb{f*Jx)@C&?6hc!SH)OU zV_5Gz5oYqyEkc@F(;PL`+mUnYli1g~vjxFe``i`jEed@Dw~dm2n*N$r@rVB%DcFao z9xfU;oH^cZ@w$d>%$Uz*h1;{L9v>+>IGtMLji`tMyVV6CDTQ+>Q2Q@j)Q2fS;r+VGC}HC&%^AA2ndZPhZoqD9fNHb??=X(%+55 zV^DqDhR!SJ`b^t3>&!E&5neKu@Cs1aekR@`RC_f%@*Fl(T}1jFze7q$j&kKZ&6W;c zinBuW%rQn5|4l?6y_%vAEhL=Rpo1x^(ye`+OMTD2d}rkqLLvdmqFJf+3Gps!JovDZUh+Q?el|?;XnQubu~8manZ)t8yu2Kc0@%5@kZk&$GgyMpnV?X_JMo$+7NTC}ac&DCp>OZel_?ywCY-*mKm#xWhPs0pP zfwU@&T;fRj++a~(??Hk6XWmsH=~DudAhaF}go6ydqcRCdOON0&6Pb8`6sF2puoPC$ z$x0-KYC^hfg(qxDMpWuX>;IOL+atRPKOxXi3fJ6e9yjFVQsP5q71Yv-c9qN8$wg2o z*=AkOpdX%MM9wG240aVuRi((JgHDpTrV7vW zrtI3Py@C=VUPCK#tzsVO$~&eUa^mQ;4?~zZn~yzbpnyQm?nmcYXD!g_HdI(%+-09m-+7nO2+@a%h<@*e%`?a(2~7XZ{EPp= z_-XN6qFXgItc!Vkgj9AeH>agiuosx6fbH#y z#Xn>EbDy(PY%d>%z^1Mn#VUew>btK8XXT@URdL;gWv-b$oIYYJ6N>^rJjeuh-fVwf zXu}@umTp(h_f|4@&ghYDOdHQ#VGpb8w)AW+-RPt%RbRxhu?3K5oCQac1+uQTXqn;* z-%rb?y+zrw5<{R8((B%G+B>>4yjvhROoShB`smTcVQB8-Hg*D{G{jyK9dUg4{XlB= zH~&~+E$0}gGXA>?Ux?MznVTf7gC>s%Tjb_MN~G|5C-*A|6_~h!tc>(giT<}K#V7Yq z?cdm-zP}qS?`StZy>e>6k2Npqr|3^Ez6cXZcWVRUfGNyAL>;`T8*9A$o3ON>vW+L~ zSF;TRWYdzM056agfx?;d$k58NU>BT-S$E=~Chltn2K{?ldU0;NY+ao|f;KAD<3E6a zg6#bIDX{*z)moh73>aF(EdLskV4BTA{z0R+t>TFj6V@?9DE} zHNH1Q02vT?=xhFL$c;F~-o-_Cu^F4{?#aZoquK)uMz&5)gg_wvLDb-4s%px5W&4%+ zEnNc2ioahtD^&QIJf?}uaG(K|KH^xzk0mX?W~mQ&w#)TUyozO7`wgF@K82P-@KU-* zt0CZZcSGIDWkxb1hLk?GTq`;Yo>LRev-{a!NMZ*U#5tNT;brtdG*vX^| z?d|2QQ)8e40aoK)Cq4`vs@Wvuk>tYaI+fE9On&74yN)C|F<{|?!M_iXh&Gpzl-s;| z6V7yEd5yNmUbITlUNK^i1~{VLS-PsuTq+R?2dr=tYjL!(2D{(wz?9IwCtA~%N^;6v#jxN&veZwKf3r4%zk|5p(ZAZczG7{0vuHl^<^cGB=ryY zSMTqKblc6FTrFpcU(8f_0SMf8cXYj{Dmd%r2?<${QoiU32WHWfB+uz7m#K4e1;TMb z_`Zu49%Tc%UeOq9$$YlEC;TMIy`2%{IUA*1R!+*Mpo0GGKDXB|bh2A` zaSM2Bm|n0DDJBr${mXbB(*Pwum}XSx`iM(Bn42{M=9PK)sun?sX5EUE{=ny;)lNko zpFu@4R;U9=jqZL^Q3Q_y%gMTdW{gn@)_DG~Xt_&{`6P|(_N@5AE?Duh!SD~(OVpkq zG=w4pv3$EPxUX%y%n&;xt0ezv1r2?=(VTTGP*3F49J_MMP=glFP_qHA;O~bF3}4H~ zNKU$;H5=1@e;>B{tNi;iRP8iINW(uqKMmNp!|8F--giF`w-EtPi{wx^8BJ$BZqsdT zE(>5i{V~<4)6w}^Z3=OB1Dqs$0nF@0vj;At++K1h*nuc2*$wp!R*;S7dH%7tI)C>M zcYDmDIWlcm1W0zb2c!akP?1x!1L&{-D{*OQOUeqs_JATn&yT>M{|Fy3v44gn02vF= zJ2#*Jy8o;(O?gX4O*r+6fpRt^_6`)t9MwUYi7pL-WB{N`hci7u4?-nIXt`7?q_ zs4BpRPp6wmDJ+-_VhXiKp0f$Ow7$(Fzs}4bEBaS;8QYLs6}IvbzHHFf&rww6Mt660 z{|udWBp_0KOsNHWa95a=Nk7#2c+mGz5aAm>NG!47-QEPwQ=J7rzzxs)9dsUKXw|e$F~w-^&PJ zEhNd>7Tjs}_uDOQZZd0aw^6uFX_{%G`$p{jo^dnF)nYTh#)NEpTcSM$#ZF40d{p82 z@**&Ro9-T6FVR|`Pv5?n`aev)cR1Dm|37{v$39lbI&|zEp{!$tlD*10NK(k&;~aZs zhssVFnGuROHYFp<-m+!y^?Q1~zn|;+J^$$Pm+R`f+#mP*{dT_%g=|7)1abP<#+DlU z>Wum20dS!s9$Uchm}f_Da=%o$Kz(J5WYAPCfJRfEBp{zy<%}~wx(jl6${1F6V$l|A zoxm2_cb{H7lH57~KTRxAT0DI37Q$F%Z;~I<6`EGs1;dfh^XsS(yhJiXSY$OURmoo% zDAH{{v_k24fy$EJorbhs^Rb%s`lj zsC3A(E5VcZ`iMk;es#iyi$9%P#pK!eLtvNrZ=LDnI-QF8VNnYZf*rgjoDUuSQt!$| z#>N&zUx8=;wIePNF+iQ%i0vNjE#-A2jT zbmnpeAe+sw6?Z}Ff%i27X>V3Sb~`w%M!76vR0^Q1WvsJx#m9;m1VR0{*bfnjs#(0{HCOk`D^hxG?2*og^(F;d`cmG`(*GW#$|I~WiCXvwGa zDU$_Ho-O|)s$5D{P~|yk!*e|KovrI0R%qwnE-HAX^+7u$lj5NW1`z|z`aD~*rzj;J{e{Z+3GLJUl zOT0&jx>W*;8~^pldEqFNY7Ju=p$geeJJV^UB*)EEB^Uf{QT?WoHw@opLVvF}E8dXL zR$;jq4m$I1I6P$Qd_rv62GgycF)+biz;ZVg`=nUIs0a%x_`|c0<|d{L4fdCepqcZa z{^q8$6^*l<7a8rQK_g^io|~>m!%gl)o0lP4bbKR+1`ic*L%%USHRp7oc)2>}PAzhv zAwe4!4PW(7^T-djKDRJzKhbC|7jc~1xlh*cm-w0Y@)78Abvje2miX*%O?t@8p7 z5r8_4 zbv}X)Uiz|()2m&s-<3U>31S97XkpA1C+Lbz4-nOWK`#V2pk8sE2cCvX<6qvj8EWn6 zLX6aVi2%l-2NItbXM&EFyly=LYv&0Hqo{3zj_lY-@b^AthAYg}(9>(a@lQHR{@}Q# zhlLYKUXwWFyHlY=l*BO48z17hojwxuGv$65Ty)<`UP#Qko96xwg=T%Lk*ETbUIb)j z!sV?HpA~@87a~)HUO$ZZ$TO$|uOW}Rp1xD^e3Do_!-N_d^)_0gz~h!OtMfQ1Lpl*x z*X+alOU4K_8W!9dFaG}Abo{N7EFQ(Ibv0eEzqyo->m$d3-=IXqJ|mB%`C&1W(v_3;A|vnUrDLMy)h`JV}R7p>q3>a99k!-)XjUJ8zndP z&=KjX+*>fU!uVK*r%=ptw#YfD%JaUWP@@@p@Z-^8(hzm?)Zt$-hw~Q)qLqs7wF&td z;%!azByFBQee#`g9xWb*y4G(XA$da<&No4zN~_19$W}v<(z%yEUCxHaJ!hnXI%T*^ zvgtBph3fpZ;hV=zeRnxjISYANgOD8Q^P28V6X)?w(os@DLG+g^0jv!NhV%_5^=JF8 z({`tIXTLZjDdaC!*en8V;V%LMC^o-1LJ#FfTGQeWwg^inW4HUjnULjYqBt*rU?yZ~ zreVACypd*%UoZj5ji)633bAMvjC4SSn=S*0SkT4E&RgGZ2j6Wq#$?83MXH2iQYoT4 zVyn(5|0N^;M(;ETHN|^eG1Yq%ZRDo@*tniIc6#zw3M)BaqUD4za>r&FTFHF7^xhPE z(38!eoiZJU-o*2A&d3yo9L42=;)G#;zU7c@8uY8W%Pv13hrn&4v-GSiK$=cgO_%AbsWxzSg~LO&SyIXX3;B6;xy z;dzeF+2Bv4%HHg`?R=4LhT0Xf?+HlS*@6XDOqZ|npFTrERh|bW?a<#~tgxb#ExHUS z|H86)QCr^r?eIeAQK!~ia`pxP!N19{{eAh1t)`%dX1h0 zV0|~yf3zTL1t}%2sb)GmcZM-nY0o;0m_$-xV7pqF5OcJOoY-+Gb=tt5CJIjXX zu@-E&IRrjlkqdBgQS!)XIb9h4+f0Z& zeabMzw$E+JMbX>3Ip3Zv_C%6=->5RrS(r&+d!dnnLx~w4gdr*f2WO_m8qzlH#~R@0YPZA#r@nDx;HJYp9W*5 zsARurH{(Sg2U9yn6=HJ=R^$+0Eo2D+9JhrmFi0gq9cL^nje#=(Nzv?*Ti%-HOfJja z#GL8ZkU)?ji(0OiM9_L3?V@au-f1C6y-W3;G=FteBvTU4=j*eE={r$Rn0aINO6Jx0 zM=Dz~13&%rLe80`Mg}%!_oi=DamSaz-<}LB(y?Tyx(i5$eA2;Nhh^E*YTW5;Eb4q< zoI^TyDowi!u-LA?apM0U!N$SP%paJz#{Ltl=qmyutc=4e0N^3WEB2~WSk}#}x$Mkp zzr3QUi2~7Isi~<~w0=OO2#i+1odq~re);l6mrCTuygeu=XNhXi>~_~kx135PhJC;a zhn5K=PEB7bFh71_yj3tuuFj&Fw@xnVbi&e1Q-($txmXJq`G3@nCwX6Czz-rvUXxy~U z+3?R#q~qVDA&bo7eAwlH+VIx>CQr_!L#uxvZD%zALW}IRRVTB?B`_`iSe0J?%nCgsPo)(`=C(ayfa0!RqQ3b2(-RX0UT1q4x~ zZMxL0+R_8qn>;XrrH}n}23m>q#WE=ETV3$s*%*=h_KL;B#~_;h3<0rYsPY6e{#7I? zd3s+3f{s;m9o#Cohbe%H&C;PVd9UjXhcLP}m!~j{4&B~(E!%c6pr44Nzek7LGtilt zVI?QcToR*aT$Zuq4`iQjG($4eMLH1~dC%xvW83iy3s5jk1Oq>&Kga&4mtw(ua-4o^ z#A2s>xy5R$N_3F?PX<``C7kb#--%hqR^WLVM=*3eTi?8i#AKB^hbpaQPn{Me%_)wu z01elFpY)|zjh{%_1w**;Qz>H@ZUTlNr~GTY6ogT;aekiK?*TsH}A#) z^27FaRX~s!UcJ=xRHX6fi=UcwF|fTr(I>=PDh=l@lVzN+ypNcl3sv$O0gvKMc|eME z6cyUhkd6n;bk{)xJ~(vfPh&l)`~pr`G{s09J(Wo(RDhK6{y`~r){Fz0(OqjrnUEqC z>S_OK_lu}Q7}r`?g1dmk%rt6L>#!6@Na8LU1P?y!$X!>*+Nh3?^rPF?zw4OBZ+Io2 z<5!@(@l|Bnu7jl@+*(WWrFox0`0qVQ6?{7VUN7xI^)Ii6R8XCmhr}|p?88RC1|~-O zTbXhs&rFRUhZynH%+whT+CJX-sR`bu?eBT>*Op*AW!ZVP3w`QIaS2$1ZqeilfLJB6_uyl z7a?KOEOo6?4p)i*%W#SbGmJ^$ke`$`vsFIkaKI4sKz1=1i@Uu$Z)c+2!{no8W>kGo}_Vh&|g*w<68o1viZ?xL_18yLZ#74`1C+%Jn$ac_!FfSX-(9`8b&D`N%i;$j#`|X zW#qJR`ql0av_yE*VFYW#<>lH;!L(SM)CTdB%as*rI!EhaEpNO^E@uHUj)QXekZ)0X zPj+jPdWQ(fx97h{-EtQ}67*qByk_BE&Mb94vB=k7&ZK$PJfrlh@3cC?K4!J!plN5C3WRONVLR6}Sp~S&S;>G5 z_mw37B+>hagC;9{;iVtY4!j`}li{~2?2ACnq(tg(K#6qVnrO20Cjc>wX~ZyNf~V5T zoZ6uf7FU!!w1Ey7Lz1J7^6m$FL2=~_EijW$ne3DUr5Fv~B@Lb>B7RC8-3L$YWD^$R z=0Nm((rPWw$ep3{2G|J-mSA3vuiVbIm1QHD^=y_s z2rkm(OWOBQd&VaFs8wzr$f@fkBZJi%Sl zsc)o>FH%1>ZZmceuF*N%x|!fQpG)EShLkGl^i8P8Qvv$|m3~t$)rLb>oVg5Z;KF{r z^YVs103wyg?Qm>dpq{H- z!!wD93I-9PN#+<^r0+$ne-8+|?PB_YXvY23c*0J{HI86yBx`Nkc|!Kr>wC&yVc=j7 zQ5{8m_yZ(8RcHd~$et2-yU&UG^FG7VBUtMDac~&f+hVWCO-R%9!0}A?{(K@T6@=1a zC1*j=M=r~lp81(SHtSQS;H1Txz`N3^nMaU!=ezCrud^&VfvVy;vac6`v1S?;eFGf!)tyOnyqN-Fbw?tv$_letQGsX|CVq#u!Orz&A$oZ*-XCzW zQf<2$y!wKBk7PSM;BV~@SRGkt2`Nl{{i6VWI)Y|-MIKn1sc!d&P`%K>Q%UI*isoK7 zCy`LW^X&6!ZF9nxB+MeeUhgkLg$p62V^ys%Nb#c@%fR2l6Q>0G2lMCeKQ1eqg37;) zG%`?2TXdRf{KGNc!|#Um7a(*DzF1o>eMGZ~3QT%5)*^^&LNSrq!bN1X+^8(&l@BE{ozuS%n^t3uCwo#*8MQlRm zQU@{3v9l1C@5D92<@9@6?Ckf~*AHZyg0qhz>bGa69WZUP&F{?5*qe?&=XyB2aq#JQ zIt^V*fqMOXMPpT$fg%AuVssLTN}l%#aqoRAcz!E!s<7d5=g0IjiH@Ye+_hbo8^Dm5Qh2g zB;<=YO7c>{JjG>ysA`^G`0!6G%D3_}+CkYln-w}$iTDv)oG=l|98*PxycWnG28y@H z79n*ir2HYA(_M5#6GnuC83#8qkVF#d*$JU~TYWkM6(odwr!^VNXUMN?T`(9N16D#3 z-;_uSC@6qHNvZbCK#`nEA1M5e@;7Zhj2>3d4{n>=wH|E+s9AwE0-~Y5TX`TS{ilR} zBJ-41K8H81ljzbkhu!lYW*4ZbDp5i5yx&ddvh_2N?o)o{?_krVlQq>7xrp)qZ5T`p zcN$j=FPX3Yu?FU-)GIywbQePn&?Hzs5m56D9RPbv0_^V&u(#s6{$1&7n6%;Oe;TX5 zim-aSe4;u^?lJn{4Zpzz&;juUAoEQ6Dj9e)=%@gMQ-Y9QcUXop8(FdZbtcj3%%mZ^ zHK>NaIZ9ASZ!D<~R`!{YRDrCG%-4)te}CvY7j!xy0}>`z^P@HPYj0tR#9I;LBG+PVi<=1q6Ei@>ZtTCteTK zh;>xL`iUfYA|)xz?9qGw91X@`SNZtT47QKts4`J2n8WR6VDOo37V*%@`dm5(J|$0d z=3MVaQan$n;qX2`{MYtRW5&=}YlfnH{3Y?l6R3VY>DlTjduO)4Yv$+krlPwX5?lx^ zQhd7Sc4$Acx-}0LzW#zp&Bj$(-f4gk6)Ju|a$Ags5;%ts# zen73MhUzW$u@I*8bu}`Q89Ko(M&&LL}+4&U#$9T~b4PeZ*G4Q;JER6UYT)u!jbx#w7G5h(oeBJ-)N8=3gI$a3juI)ubD~G1_COY zGFCk7t!Sv!+RNjc)jpl+BJ*>%mJH|!{iJa%VJIZVhec7v3J^uM>2Kjogd-6njpL6x zdft9m^#tE+f|GUu%9%eDZ^wcjsv|osg*#>K22B8&h;fp_P-1^0ED_T8%_+??}9->;kI(n?U+h;&wT#7HR+x=LVQYI!II0p);(o5hD9_fju$0^TpktY0)V zT4#m0m?ANxe~Qw1oKO6z{STHwWqLxN;UiPtK__eV8BSsF-X6=>b*EL@*>F^y&0oMv zjHh6GCQUNM_*z}CmE@V2>Hz5y6i2IlRyB-gi;2mjgC*jrop}c=n7o!>P|g&?Q2~wx zdGl<9T%B#jl1*(NYJ@Xv8;@SnNFiLyaekkBsx1izJ`P|L8;Bie*K*PXX{OYQ}CjNH1d+#3LuyE1a>s`$$>x$a9ZXqySt5iJKpG zi7snQ6QgH#cbA=?5g%<0w5!MiHx3hX%Xvu8>?b#llO^*Yge7PFKKGF(nKAhMN_>A~KI-bw06<5c^>VAZvP(do zHlUBcvugD?1A6|`!{1~7+i3gDYeibZ_sGr!;M#uo3Yglw6623k$NMiD-<1p9r2&q3 zfTZmBzRTSXcsO#C5eN>A7FyBd%$}k8;c3VoL`Q6mfNHF6h;FRhYt>s0h3KXbM zGtc3af=QCKKY6zdRau7(6%mpUXur~&=EaA)V9o12jpE0me}(uGQ!6VLLg^6+h0AYc znX`gzqq0V84|?SE|B#Zbe=*uAq+`n^*2a+c1QOd;D)OUpj&OgaiITY0S9LQ8w=3qL z>DmJFAWja)hqhm-6Vl6`HhNr}@gO7o*7W&yH&_4zei{i|+8fg`4z8n0Y2}o*oL;%b zYILaYu0s*`3WwQ3@)eS$nrZJLEIKTSdPuscd5}1C5DQ9p-KE9 z2`-S$rTIGhM`|eGOl_%;#X3XF;kNf~`3vJ7F?2F9o>ss}&$`|W@|TWPyGZ4AwcYhr z>Z2PUo@3}VUK2o%ys*ElpKrS?Xc*|?zlT`<1D8RJ`C^d4r;3cOoCZ3Ikc=2zIfp>h zkc~84Dl#u|HMBKH&w)c6V-+09=brlsUbsNCLhru{;Fh_y&eFiK*A-Sq3&~BlLj5JH?3q4Zq93%lM=JgIn0e5m;8=S@%BccnjS z7`3c$JB*H|qPE_dqpk-d`qW_|3`EQR0$0KGlgX2nmyq);@`B%5I;5D!hC2fc1GG-8h@6cfO>d~~VaPLS2MfOedb~a+ zEe!p0W&g9P0l`}JH9NG&#o2%BLxPRm3Jeb5R9TxAtCS@%|xGD=UVXoq^46_*YFC6ny*e(45u03XB5zmI|H`6Ng8NIT6&q<-nMz#dN3&zbU(_7|^6bAPQ1V_4!{Fy{UTeImIgcXgZq?zU z$s`3K;>DfU^E&O~x=E>*g~5I&bKbTyfUQRYWw14vL&3D6KVWZUgWWz zJE+l&1scYzrAq8s_+c8gmGg@b2Oc|2C=%SK7EtH2?5z|TsV@N7Rj1t33Qcm^<$bP9 zM_(8MrXm7JNnkW)B)*TDY`!0&MhtFRnnM>#?C-bIM|yQ6>XdJe+w#JsBlmuakz+VQ zBju&uZ#hQGkH615zU7Tq{=KAe%jq4dx}kZ7KO@|-Bbs-^3t*BSo8wg^o9>I2?^U$@ z@f(=3oT!~9TR$Ch8b1`89`!F63?#BC_MjlJp9`?%xUemK!9ZqYG6fL zn##!esVeACHx6LPo%3h}eUgn<#C=LYZO8!931;4ijPC$IRVP{rI1pWNJ48eP$Ch^h zf8ExWD|wLwD1s}})P%>dIS}(|0_cRV%!^tnq_Fn(_Cu{d7=ynbIhh3jLu32QN~Zu| z2d2$UbF=sU70Gdz>8CCgww|M&!T&tR6c8A*02e}_Ndd+X6rj4LEI(&J%D9ysaeV9p z(1c$)S6}VpM(-NT%UJkE^4W(6r_c*@ z9xeEkN!)S#&Y6v0Sdo6ts6R&>`{wM6i^bSKRb@ozaCH!Gm+870uM!XRk*`_r132$?v*nc8T3z5QkL(% z@UwN4#eG=c1E0SIZok#P%b>oJAsYNJ@CeFAw%Vx!YQoFb+Ytff=^cqpfsA70knR%_ z6_?;a&u909V)uNQ${yIqIX8>myXEo%YXRZzTG++pmKP5JwwKngHw#ss3`*ipE%*gzQozn(=^uw;hq;uX#%$i? z;?&)0Uy18-zXwYb+oF5flvUuIf1l0GWD-?>5#0>&rigT#ItpGAcxs@2&{4r$=1#8M zvCyW?X}qZKY~6_f^XvA^v_2xAV|le&#F#5OTn&E4{rASq7J%&YYPTYND(cLly#;{K-$%JVfiE0-kyqjksw>46G_lQ;s5f+Rlh;O*b#J@?inE#)hgZ-W>_qM#IC zDvHKgr8~FpU_6&c_;H%Wg*ls@{5E$ih!J7wXPVJ{LJUKJ)oAU%4fd=OHoU z6;5)FE}3sl2E5+)sFPfas=!UO`H(h)Hh=_mrX>@#))+Iqxm+gH;apm z#g8S;0OthHTUI}ZY~;fz;H&#$JwMH(M@Jd3F59|Wo!hToi9h}93+R9W<3Cb2xA?r@ zt8b4hmB6TrLMK%s>l)$@n)g=UTZ6{SJlHFQiM1CD`q_7GYd*yeYTR{CuKvlfQNa?F zQTvhei*HgMe&|+nxLi&bZUtTwNBiMIG>sU~W%a!U@)Ejv_E}WMkK*9loU57qxl+U9 zMR?uWPK?Xe3^P)l)x~?ouoe}18<7h)Xq#j4H-Qn0uwYG~{}^=Bar_NB&0$~ZYTBIP zM(UWw@j7na=j<#L!C1m;o1tfl20Cpwv(E3La-mjP)$bO*T{3bbotGx4?B6>Rjm2}E zu*!BC50S5E#R={iU!#-$79qX2tb>HZZPh?rZ!%ZvK^d%M0@7TT-4R4w!KuXEE?j;0 zl^}y=&9`kY^KzM!lx@@@v~0~gIIn%wVyg{_PSG=!Ml(?&+rKjR|2cywe(a<6eYDCxmO3)$x2^=UZ7z zy{z=l!*N75`r;d^na3MUyc;`%I}A}rw!=7Ll2OliGvj!uud8f>YBQ70`0s#_%4&sO z1Pb?z0BPNwv{`h1-grQyfrrz{RxTAU&B&Gy9eZS>AFn7T*TeS?<u z3_j|u^}4Z{yT`_z>ol3e_y-rT{~#coXvRyZ@duM@Ge>yfNGJot5HgII_2{sXo<~$g z>1VYY(Y7CFQ|q=Lo@;ghoBZ(d&ag*<*pvOVs8)=8d)85a}764jE3aYV!b z7#RzjGgPCu8=Ih!)%x>+>k#Gb+jzfbR~QF0TrzYQ9qWo9NpE(%Yhx{lcVvneGEK5& zHl5Uq_bc4IFqy9ZWBj|Gi;1O%Yt=97Pni{kW$7cs&(%|2-=^tmUQAmQGs>!NB(ky# zlMrb)Qa~9uKT*AZbwK-2LzH*pX-(3vBlK8L)+Y9%v({_;<+~2Rghy0N3^<6_ljC?; z$SElyTdq$573i!2y>0C0U-x9jVrh#g@Bb$4fjvWkMX3^~y!vf=_ut6MYT4rXcQ~k6 zI9+lWs3YwrZ>h9HwDgSk88zzO?*1PaV9-@>JltFz*?J?N@%p2vfr0(>bm_>Aal1;} zAA>HVw%V<6tZwP)>CKBj3+Be2vv)2$CVML>N0DZ+YP(fd@ARiS9vtLmg%tEwtHLQh z>-AD{&v%}JASY_J1F0AeFr=sLj*9a6crMBj9im{~m+MGlCA~k4UFCWU`_9w++|K*l z#)@M$?asuRM&N7l?S3@iz3Z}1v+->ZsV|!>!8&iYed4ta8l#9CO+kT(K?quF_KN~ zdmg{tSf_NNwOQovV>AJFcD5#w@Be+6im?6h=p-CWX*%=Oz<$eq9ZAX&m`k^4SvCmX8-@Pv>_j>o}HF>b}r5=7n>6CEc|jd63HELDH$c}YL$yXZ+z zLj0vsfQF7fyoX%$S3XCen;}PpkC>yl0xB zxaY*2kjEBLWLa2LAwi=RN&M!bFR?3ObzfqCJfV;#6vcl-LiP)YVq-q5I$>>-GfM&` zj{B&H4pWY=32W@+8l0y;uP#7x6yfIiga7re@4o(I^U~q9QDFLLY7!fn?ZCQ>(V(mbyI!MOPTmC=~~ zXh&yf>jWx@hlfW@OiUND*ul-iQ)xfQ?J!;=6q;T-ymmDsqzajSuc*?tdd}jFjGsK_ zV+mSZ`?~SH@^R~=XHNC6Ks~qj4iD|s-em?IPbq><>o+u7Rvblt%iv~K;=@ARx*(K{!+ch!uoyz3a=N^W!>9c65{zR5hQU0N@0 z@r-cm(MMB`*kE8sF|$;HR)h}OCjqH~*jFTP!gd`6xez)RBjFm@G47oOT;3x^X12%~ zkAAPz=grVR8Ui(?aOsWc2mIF%vRm1_-qkH>YrgM-LB&VeK?knuzS!$&jXMtHWh<@s zEo4L4&$g&#mqvN4pMAxbvQNY{9ZgTG!S-pT+mMJXX^aOIN)3%ohZdYmgg($|%2Y;Q z133#$hjXga6aHM#gB;&EgCK+UU1`Sj&O~R2whe1kzS}cdLX@;6WXr(_YRTa7kJ^hv3%l&wIX_Nf0`xAC#fE5#shmyH`%X#Cb&f!5bmN=Bfu7>ph~!Jd(V!w`;V1bLUp zBuQ8k?@Zm{VolHMwx(_iToWR1Q!@T$xyKaHtizuq@w7q1(}Az{}e-0q5Q zVyAJ*UWLETq7j-7-V>55m=?BI)Rcxdoix2MEcT4cD&u!sEn8j>Po`;@Q6cu-OqQ4FO@1#1%rjG|qsgyxy2ai5k>n29> zs|YPLU7|T}sh4&yyt>OXQ4hkyLY5g1SCl zGqDCIyijHa*skxbbMt^_8mqdpX;eH~}z_p8TWi z*}UWok1olW+ixc0`G8uEg1)#q-~OTbNaom5({G%=pYQW~ZxS=O3?6Vh)mOb-dHr4mCtE~d(o@uIwONuCZ??Pmz&_ph zIc$9M8I-bazD)81B}8WPaJ#nrB*HC-k~7V!mjKcnt;-0x;7@JfF3l+}pF1h0 zZ4102LFzw}DJfq&eDRfecx^mDBddpxFPAn7LjwBZRR-=(OW^8hk`~@AOw&yh4ctXwTurlg>*rshQOoyJ#s5ghKvS{=?{r!k}(!&bkdCY+I;5ljv!) z*C5(T;TpO|8)3cfQ_Kgu85~-(MJzsP7a1(*q}&a2V}?}*E+8@x$3v$+rvXb+(t)~5I;v+Fj8CEpZMzru0;gVBwX`lXC2!Ym$0xwDRGT&JDdWjo z%=nOoAUijLo5vH$y5RU#V;0X?a1Zw#DHAI&dBI#lPaeq|UQ^e5Jh_)SAImwL^OQxr z!d&nR?mIQcf}}Yvs8lxq9J%3`ZNrzpqH<@(QM)TsAXO%bIS8qzn%Ekgjc_Gu9nOM85n8R;} zBHwH7+*>b^@@ER*$(VGMisSOz7cw1oTC1T226mNFG-HaV!Ps%yCM&e!%XlD*z(N1d z%}!;hrt)zomRpk2(viUL+un9@7^&c3$p$u*g#|S50Hxm#`uoaw@p02Vfzs-N;D=EU zJ36`4pUwYC5}oO3L}{Z@{m;8WqNfIQ6=*0wTg8QiKBXa%IvUF=xeg|wENKnDXHsm0 z+%?@%MqiJ8nHl@@tu`T!HD;u)Qmq>%G_-b$oV+b+f%%15TUQsIq~oKgpKniHw%g-v ztn-TOHuBwETBd0z1aTHD5qd_$S~^n5v>h7XXK(ielTl4vObI#|cA*uVeS3Z-8V~ZREOVFu!Iu`2Dl7EA*y=+h54cBLoPkU@z$T4})jGpw-bRml1XMv|O z&k0Zq%6w;y+cdTSgWr58R)KHu;L|aN5E^3sXm9>Rd?!JN;-0Gu|0+8jiDn^;kdo#+ zj6@)R*bEL9RAkfPJkqAU2!v-5mlq${8fJg-|H*!1y^5RJ?0D-vJpSCcTC5JgK}$fqgWVnFvgyD&IOW{<9U)^gG0Zho^2n zOR_icYtTj6af)%5^b!+amSw!|n#J}wv2&-KqcVSvfxknsI=}O_uG_-~BQTm;nO7%4 zA8)43i(1y)!B0UqJ|$}AEcux2aG+dOf^~GV&~DPI!M&?c%)fKz`~^H0am+f-|BDtq z8QN`eWcDJcVd5C!d8eDwWioi(9gu20xbo4%3qdb|80OExiEfHw)rlHg;1UP7^f6%N%yeDODf!pw1+r=ceA zp_XNj$%QbY<9}BunOaFfEpgY?iLb$i8}K=(VrLu%iO6MWYu|BOz)^;VOvp1)pvj+J zkK_5&SSTr^H@HU|N1DEcgQr@wHddGfi%s54hN>Upe%X z+xp&ABC_w?%zb=9;X#t|u_!M%+!x7}5XJu7n?|X4W8&k+0&01;4QeQkTp4uaqK@RL zJ3cc|bk6yuXrLE4opQ#w=ByIZPfdC{_UHCY)?YfZ`~??z$O_t|8iqwD_)uiqe4J_cs` zZl`)@gVC-o1ON|;-o72x+^iTI7iazSDZ<#?gZ^s309*h7C&Jj5FJ}RdY_jh}z(X_X z`3-n>dVg|g>4|eYvhN6#>+PD7hhV{eWDDaOFNm>WMdegJw)i)Et;OUe7}z_FYlR#% z2!L)G3Ws#2=3}y#y>v@)`!Xik)93$aD+2@QU-5&?zeu zW@eNbSEq`*0Ewv6OxDwCINKy-gndQFKj3$E}DHFLxI;rS(kYjfCoZ@CTuA zIo@Ih2{L_7fMz{U-}B51YCd{I9)Q7gzTPF7TL?;&9gqZ`1jSjCpDdfYSg$bf z<}F!B-!@=xZAPCOOh#<{y@Ntw8|~ zD5&JqXDyrlbP)Kl`~1x=&soYYeQBo~-_!SRqV_kj->W;%7EeBt1kS%QERo@ACh#*L z;G1WbZb!Wb+!hye*E^=BA{a7^n@<(K;@q-k`z$YorZ+Fo*^TCJWSbLGx8Xpn7$y#p z#=e^G8aAEkJ-|;sI~V+7JLk*b0rlYBsE+*jP)Ifh9}VfA$U{!93ImsUozUR-_h1-I zK&gj!m>>s|&LyxayWWx;ZD6RaQRox{DhXCq}R+9p1*2TS7uNz|^{O7$X9dg?0GY;nNJO!A!FM?2>n6KTh;m+3 z&a>bt2}gtbt4~jS`$1+9KyTS}pF?lE^ZiEoeU^;3yN&nAD8J#JE9Ngw+i<@5VEwCB zZX2Vb!G!j9jkW5Ai!NEkJ=_8J)Nm=&=qzp1QDc^BSm$jS*%cT%ruqYKh-=_Knig)f$1$=->4l82k6< zXe0jr8zO{c{v|&iJPaZ^44f?mUZKKjU@e&lx;(Gj?qC)J)&*dg7#Pr<0B(MDbI}6M zzYUFNJD6VxM#0~|`r~n9SvYbPma(wVND&2+vok(%gZv5CpYi#~N%+dEW~vOkyv--D zmE4OaGf3beHqi9tXHIa&uGNGR7o)eN%j=)i2n}#(-;5ki!a9pKcXg2hV?=CRS=*4o zHKiLMLYoTh^Ej`%<#xl^coFL#sb44^d%K?*kMM|M!M-Rh(ONS5n8%=h46jHL|D<{( z2kDj3Ci{^4*OAGoZBVwV|BtKp4rluf+qjcRNX*!qP@7s+wYS!)QDW7mwbf`9H4=NY zR#CgC)}B?gR%}X9+R{>DYpvLu_uJp|Jn!)y??3**apaHO_kCUG`8ltv2U0DgG2hz8 zS1r91+3K0FpwrD=hfB585)rpkx<|FL?iLoq(Xj~~Ng2Cm4En@aIQlU@6)8lRr^S@I z85%E{4MKD@Kz4`Px5W#|t-`fT3}KKvMHq^Z0*!DLXzi*tA6^Nm&Q(iEb*@pQ3LU>D zB>GVt4o)83Tpc9}ztvhE4O9nbwJ@lkHT2Ey88OPXkpuC^Khzaeamqe>l>)OmPDsza z*O?y^5+-|43?*@fab7NQx1V+M*&J0U27KYYxzXD6LReXfWEFFVbJTmAh=*3g7t^dS z1gl0Ks$k6;`DgACW(R2v1q4cIwPJQX+joAmAaL41^6rp9IgAUO0D}J6*IFK_m5;1_Fc$I6sp1%&m=cmJED#*_vk2xbz>x{9EUDz z?s#`*DK`7>`7m9*vS>YhD=a?7In=UP&DZ|)DbcHoSLw|c)qH%R;z_@g9v*K{?0F;7 zsY#<+%%$-rg_!>R3r{sY5%ddW10(x*xlb;>RrA}&UEBSS4`g77G$OQ|3YgGjPyf7I z^$!jKD(G;!@(i z%1=Jb&P?^vU+#uTzN_1ylnBG!`vB5)+V_-Gm`V8h^(GTDa}N$v^Q=EHA~V~~&ZU&< z<;xqTlaqFj_uZ!&H}AwcCR@xMa*?a)Hs!?HXEZ_(@r z%_=6>nOIo5fU^J47|81!#p3m`zMuSHt7 z_!rvLysCf!-GlH7UNtEEy-L0oXsMfrt{XL_?OqOI6BSWIAKlOZR-tt}LSJmwpl{aN zBekS!l}x_KqNvpF)ZVgvhqjD$3J++@@J4ZcSz3w<7=88-aEQKKQ_jl6N7Aw>?PaM3 z@4wm0%=NJMt$#5%D1G~Okc8~dzQaxb^eouSbwOMzvBxKe=T59PxagY$z%@*67+4T> zE~H%HhEo>C&PetPx|3^kL5}3hc*er=#b`(?EgZyKb&2L%5~`c658{wN;8a==EID zuJo{KDVgO{hBy+;onv2n>VRB~zY4qG8SrN}py8Qj5FrjQ8j*Bc#)(kD7CYk0v-0t; zfhn+Yv2^}()m~;kbt}G=6gb@ZGd>fE3|q}DFPhqa)aUFNR z?b(V^tiwBANhV!PtRYWPaw$|H1+^~lXDI6Co1Xg`aM(}^BBKEYpJEYSqO}OBq)oOV zH>-snDYFF@IP&57Pn2tUrL`K<)(F+NC>LIhtaY9~K~N6Ef8;IE&YY;wT6Eh#tb0*2 z`w5eDaaMU9JtTiG?3nW4GiMk9P;3JSNppi7!WEO8ju&n*5*lr7v3XCM>fF+SDWX!S z>-fOY>IJje6D^4#Sg=dv44NU>XQdzMsS%!v73*u?!}uGgy;;Iqu@ZNhX12K5hv{L+ z%|DFWuJ2d=NoTQ9?TIu3Nj0eDTcO6b+`A+&XJbkQc$xSUaxBU~R7UD2-pux1Z-%lp z_EA_z)bv)okiy)@w^4s0!j;3EIlWpcUR<5D%c?*v$Oe94EvVtdu2e|1Yfx@T6SJf$ zzMC(WpFP%Pjp&Mk)>ZH$F04djUtaJ!MakHhWVR0{i<|2C(a7X9WxGZ=mVzjybS|_N zXt(y){Ci&Ja>VZNbQNWtUl6F-v?T6Z~=FR8yidLzUZPz13ZVCyd++=tF5oNY8^ znBx}n?Zo9i(Y$#hEPnHQ-`iJ*M4;+s2P!`PRS6}f$iYF_^Q7(WsVO8MzjIy48QtyM zKLB|kM_ehiB||oW>7J`;7~}jPZ13F`Q7oyBo-x~N^K@Pt10VA7!FVW9qUu7X*vhsh zn=Sq7$BLF<-B80J=TbS+|lGu{EpG;$&GoG!e!cumLl z-}(P{2`HZYc-kc^vraJyczTY5qU{gXf5myp8v&(3k50I%>z%xRj=){eXOyx*_y<;! zy2b6$jYifxZJs~tc?Xb?e|9G^F|qgQpORO?z|r4y_JV$wZ5I@xBQ$A=;Fn4$LhRHj zkfjF0vibZeSX|hbToMN+XeuNiKN6}7Db1F&$WR=)(7*iY4fj9DQvBg6$?;CnMOHBY z6uz_bJu`P$Tq@0Bv5(Y$!^I(>IeKuAoQMeV_mkYSvqJ_zkCf26Yq0=A#(~3w^=#xN zyt+9W^ej_J%o8c%#-#pyJRQ~Vx;4-LC+ikO&}gT?exxpxhH1lgD9!z1OG7|Fhk;0< zSktHqcPN&s3AM36VU3GG-An=Bu|oJDdc5OtcsW0}%Hy0r4$24fWDT5A1Q=R;CY+2E zihgh4pk6djrv)ARl+K3NO7k|kZ&<7NEh<(+UceQ5ca_^bi|8O-N`)YAcSkg1^qj9o z@COnywYnkUw+=E;5}<+mf)tKk8LYAq!uNy%PISuyrrjNL*Vj9~_dNCTbU5l}zMTKf zQF^-niX}j`E&Tfh75IL+hu_1Js9pzgs&hW( zqnDvZ3wqDXy+V=#GNN6UH%SZ+9b2NFUFxYQ!8jQ%r^6t^i)>a;uk-k7uyHlm@wk!d zf!|J_O|EY+kTb1~{tZ0yvy)va9o_vMaxtE_MmXN31$W;jZ=)S6ahB}-dkGc$Jr(1e zXW4z<=68&{QVZt0F#C_!nF}K%jCEUSbYTZc6H|Moh#~IA84N>CGDWEJAy#kw{qC-W zpz71;92YUUW;f^8SxQf>qs0k-UsdA<5>5%{fakHl3Cn$UoBnFCro?-1Gok&e3!HVz z7yB7zX~WQk>T&;qPxA&v(jRj*U};>;Ba;V^Et$!B1sV~Pmu?h97r4!*&i|B?*^>+# zy;1mONKxEez*~NrHpe{$Q6Q~17l5X(KwB@wKOJ3o-7)rjBg#-Z*$hEQ)bItLeK321@W+=zr@Kf^mPzG+zGKK2Pgk&%nWXykE9S73mS)?cXw9M zCc79KNvf7_ni->sgy{AI7QhJD+SmH=E`OGZsQPhp1AXl0!?0BYx4v*)OBOAG^qW+Fwg#LLx&$57PCjJUz>2y~a5G+>zW8 z77^Tz=LBZf*cXMzX_! zL@LLlThjmFfLSIEtW$V{^Udm$mJZ-;o(4?&j4e4cOIKyahuySNpnWd=M*n*vcE{n| z%|qgF>2In&Hv_51oY`~JHdV>vk~8=CTqd>uj|Jdi*@rJ0lT0V3C|T^^c#+5uZ0rn-a`ojg#*4gxFWgl-5VO!6x^7C z#)bIF#^?Tbvn2Yv_ZL6-MB#mlA&u`T(&y3QxyHVjy^sMx!|l#68j9cnB1ScOlX-Pc z@nGzB#Yb;qQLOQ<8r-blfusV~(T10;xgg(88&0X30$R`}#cCl3i6rR4`8hRI@-<)+ zQVjc)J+KMAJUWE$YC;c$k)DiF6>j%a_w%}WOpgHNNN>o?%e$|B)K1X_|6#q`dftm} z-J(|vxa=dXzA~k4nw#jOe|4~cuf#W9c@TT!rfnu7Y(LgA#2<5R=k%7e*V~DzFOYhw z#KA=IZRzsXL{4KcsUT_P_uRF{`k13^3V*_ob>9cSg=k8?&j z37D{I0a)ex;1e%q8ieYm`6C`~tpL!%lO;7#mz1AHs45rE$Fn3U5B?5KjY3D|OBlmW z&fIH*9?)O{LB}|LXYYe6S$GM)gQO*0545`T*t`qdmZs%|#Ki=`p)eax?s=8%yDiJ8 zyGnPI@<2?dFuMzF#O&cO8>?M41CAEgXJm69KSVL+uBsPp%&ty*{~kolhJAtfZ@Vvk zep-o(pn4GSW&4ZWX+fipi;fTxvXy^YbvloWZcO@*mN;ssfI?N6hGJ}Y38I34Qv7x{ zkCaAH@Y0qpU`13)y+P>Pzy~pPDeJK4Yie$$CY(1W1x`;Qcv<^83^W!7r#)#-1| z$|NL+S~8#hthP>IVr^kGHohCY<;Uu?`Jtuu!H_oPri3RQ=ULo1HS`rXF^(dx zr@a*34$G!5QE(wJZ-roo=KQ@7U6E3helE@0a-`Hc$_SSwmHYhd0ti72eda00@t%t| zNKfvE{UDiZVSbTYcshKgjynq{#NvHVQPcTx6{huXFvlcQY3(^d3?JaY+AQ{l6e)P@7LI0s7Hr<=$U@|?f(d;! zcgx(#D-5w_%fpQWCSu)n{Yz`yfm$su<4>jMIYk|2zJavZuz;tu$WitV--Tkx*6DLY zZo_g!*L(A0Zg4_WH{Y?}o$-0Z>ijxo;e*(Ar*nHNrb1bQ#D`Lw`sLeEtO@RrAp$KN z*nN!Ov$P}zAeW>*}oH0mIWi-KC?fRI6MvW zzp~!?mYIU0P2-oNMrIIgy6VQlX+T%rJjHPjGO5Hi_$FDCi5V!T(!i=f&-~l zMdTLSn3uc^H4i$bL1Q>-sR8XrK{&*wyOA@tdRJe;#Kw(`NVHtsuxO zn$sG$Ze!H_>1A6-%h3ZF@oO??e+2!vhX{D}_OD^<);FfYa1C{Y-LBh-9(L+{0d}vs zXiJ?8d05S9x{ADR&8L(9`n0Jo6fllmxucFiwCmX#Tsvl_r_{*N3K=M4ti2FI8hwDI zQmQpWS#>%q7>-|=e~HmEd_ZI*3C0l+abDdeDH_{mMjyU=s(Y7m8mh3+uYwq9La zWM-Owt25;6>vsmwxQNjZuj>Gb#sc6foyW&PR*%05ZTwnB6W_kwp0qj58O2E}&I4)E zM%e{mG<$r$fR|MLQ{fM(`?dW(ec2&PClAQ;XB$`J8T#c2)cxULZLmiLhhqPE?~db+ zru%xjTH8LbWJi{RU)y}RF%k9~tU_7z&oub=c0c=T;dv00d$yAE>EHRCX!5X@pYr4f z3iLShe>`7lJl^Wj{v{LL+LLjmFIf~G25$cFnr~^HmrXkbfF3sAc z(@jSR@v#q8LCk??ZtdnWKcC{d<4+YHA!Kmlw6p?b!qOsyu6i<+wE1<`qUN}&Pm4=< zXD9T{n>Hra`*EAoiiXNSV^2gSy|dxx4v38~kDpy}J{8g`s2&=U*oQauEGyW?r20Kv zh~x{s)Y(BPhGXKc(9rSx9taJMzzvTO9;41wQmAe>N3948g4?7YADS}U)$XLt#kUl- zZlqFk4@GsH4ATc303Up=QNK4jy=_v`8YYT_r3K?cR?qD76_Q;BAZQu*YU>>JIY4s7 zDynY4B>_+bCV24rK`by`QvloRH!ApK*O2#zl%smL9II6JZtgG_n&;B$saa`2MPSbUc;e!>^ zf>lq8bcn7%^7$n-Eopv%kSafSC$%6_M4c`6;PJpNZIl6l9udb6!&v2t$TrRd`ZRvY z{n>P~*ArgUjH9`t)YTA>j)X=*YSOr1BjNY&l?b1@vQ9p>@(~p&xYN6wMjGy>QfRxf z{gQ0e&y$4%u3C}Oqj_2cg=-sbj&gs!tu7P`;_3+x6Z#;3>b^gJr@;m+3Af5Pwmuug zs3hC{)~38VZ~w09I*)sfKYXU(9W+Q*F?Hb`{e++QpO@L!II`H-GJU*NV!C+PG99qF z%}JgM=}19Eqhjwms?!9hfd`2#_7T@TZy8VqbYFd-Y5ILLiR4g9T=BOC{DmDFUf>j= zBIM#CR}+LsK<@%eUp)=P4JGs8>eoRM!H~3`WPxpr2AIhgbCno~CR#RJY-L$1UN-N7g#%4+M`R2D~}=vS4Y*)$7AI??2dk2 zS)}?^q!Y84o-I3iSP!*^T($ir+nY`{)Z~t+N?N?8JKj)kD!orPA@cXhFnBAayW{+S z3u}Pn`IvVQE%s(R^8J7B>niZRdVaL5Yk1R_!FmAzb;jTS^Yt8zk3#CEMgQq_FaZ7O zIX;&8w@Biq`wu%`UmD!Uln`1(p$VoI6b$2 z^ww&kOAOD?Z^r$(T9OV6+X&26=|C9>tVsk4t(fN3@yNsFP$FezKfM zoTBNvQGt=xWY4`P5M8(nw}CjSkn2W&0x3*7%;7Jz=r8z;Qcn&=`KBybwYF>a7V3~$ z*VldunwR^ujr8&*+dqf!*qel-XEJoToOHw}s-UPGM(&&(6b1RRN>8q(gEFrP5lSW* zPyRtm!BbGZ!-kB7If0g9!EuneR((YS)K~EL13}A{YXcm(3#3x#*7Tl4QqAYy&2DNk zxviW}avApPHQaYkSOM(9H~~T(#j`K_q4#!jU(yCQAMWGK~!x{ zGd`l@56?kQkX2zY%_Fwt+v8Xwyc^|!q*E1C>&b@}zxh2472Ekx8F2RAX|BBLyWHwx z;$p>iQ7!~1yn&x6D1eh*1l_N|+<$Tu4NrwC4Xc))1?ADqn(fFY51%;89Sjrs5Iz&@ ztjHd?Qs#s`f;9$vP(osaXJ<%M(n%k}UbWW7Cj|$A=YGz1(Z2~fUiy9k!bH3e|8jp7 zUn;f085(9i(gfY{EEI|}-o+Bq|DX)fWM2vTsrCiRy~pVO#je%U?V(M1M#9S7GXgFj zh6`K}5cks$gcNdCdO(B!b>fcD&GRkR^W$e<) zWy*$Y5eV)nat#{Qq@7oRRhC#@4fF31j`zMF@AGmP&pDPXsQgfJC?bt?Qb)=5U!3CleMxCxgQ^&sF&C6^{^ z;0)5q7ea07K&a-v5GLMm9!!D;r(Zd2WQk%B@@sSA2-LRvHq&-^EL7x14>V_Xizv_m zOnm_f&}GDSwGX_>~xBmEEFyThPEu4TV8}zk*^b z@!i*B`_pnLwUgG${ZCiJ)!J&~)LEC~V7lLkn@MM+LiOqGWba{no|fzCwQ$56B54G& zFx9=HFKe#gafnX#mnF1VRL6LTHg#Yl?cEHXS0+25K5(T z2lAXBYGV3uzUUq=dnDNpW3@k&$767ZbkGb_Emhn3(w)ZXGqG+ylf%W0tDx!%Jz$jwMHT2pUra_j1Um@f?&j&?DJdb0$><1SWCDIbl7j`$I}InVL26R-Yr#(*Dp zyo`^+>UfwG0;S3AT8ESX)`t2%Gk0Obo6r9`Uw;rQz{r2~dJqu#uh{;zwkFWm*H;^M z6{@GN?+_HkB3iW|yPE%Ey}E_c(b4g@|Bka0^rx)gP~3e~_;zmcvTRFGJZ%|tU)IMJ zYp-)4*Aq9RgsK#&$=(&_yZdG7TI@_rD+@TJDV}855lwD)DErY<{dzJUFXu6BTVZLK zJN$q}K5lk!1NuobS0vtL6mYmj0x_=5o@ls7bEHEi^zt4}QykMvpfvzqXkVNN*{2S> zU|}H!WM=jqrF~VO1NIjo&o5F?;48S0c~rO>JW|}ppdLg|TFxPJ`!#o;t3r}cQ9Z^? zoFD|VI<0Vml{gX6kOAZ8iwYXZra4?3FTWwl;7q=<3P=+&i0_aLAzH6i!w19_vK@#R ze@SDaub;dR8Am!zfO72)D?B^IC+uXD!ZfTX81i3Uj#49h&!YBai&QxoQ5dGbdKTM44pqS;45a4fyo7WV$$yUx#byz%Yn;M;XQ5rI_FVilp- z?FcrR`#kiZ?9o=`_!<^n0eoR`W^wnGqF-yt`H92sNFi-TV99kZ>c{&2rKfT~4QTGo z$7MU!&{=y$i3+2F=anF*4YR@nqfBrh+a)#WUX>J1W3pVj%5 zXb^i8d7-$I2KO|u8RrGws+c#z-h+<}Vn&m3ngr`s5^nuLSo_ASj?(z1ws%xwGIJeo zo+_u={}x1Cc68X{Zoba%#}e^HhMO`}zv7}r5x6MK>#m4TYl*XzNsRD{5r*wHzmTrS zi(`+A<}6&Z3`xmf7yKm}A144kEvIDX>EiT^ZHM!nfZC35rV(6HLhv!sRolKj-TBm= zVzZj2I}?+7p(ST!D?4+;$PBJ;dD)+^3R$(ZotPIJ!;Okw^w}7N!0}YUoD~DmFqd*- z)~!|Ng8&IVNIJPzS_4#e~_9j)uzF*$- zq`=`&p8A%@v#thKWIFpA=XA=VPUGhD6ZzJ>puc5n>+9W$M>BpJe{}yxa;|E))+DLd z_3~lMKWe@7KWaV2^1qI??qA0WH$aPRmNeY)4`yoVsQWnW^{+H$|KE<4mX`Ln|6ARM z*eCjrrSafk{pSqnWR;SDQbR)yA2>pZjq2P4x16?yzby`@v-ycDr>|{K@1vq24Z3+( zEQ5xW#`sRklpO+ECj08~v18s$V`=$a<6MPC*UeDsw$G%~4wv;^jTeg&6$~oeShRSp z8!Q(}q7YbMziT;;doJ78ahvN)kzmebuQ*UrDJvlHMt@u9UtoVV>9g6t-B)c*mYMD4;IbyOF(t7%A-8EZa)hX{ zv>VddJ)^WchQ7{+x2#aOw4(WHrxh5np;s?6w{8<`v5*)o4a0)$6OuU_^|Su)Vn!E5 zk<$E?+5q?H-uv}qxxgbj)HS}>$*9YatZ;(yTK=qFs36hKV)rANy5|#~dl0i6x066K zuRDN@=Q#~o1vf!${PRF=iRN}guw+E4(BmiduB`4O5osKTO&D(;ttD*8JG7*Vc>u={ zg$@x{PG)d*!0v!HY$%n6G$tt$n7oQaeR{a*ef3+B&A#B8V3A9&IPw0bVZYp4*~mCQ zqfcSXeBd}l9vVT3ZoYCAlWWM))*AIKzu3eW+j{#`gk2oc5`NZ**abDdh@onbct6$G z%ld4mWOCz{J$*(hL#3@nH&@w%J~1UEpE`=t+&3Y@DdR4eY8hytLD3q;3TmXP{X#vL zK)g>i?U1J4BZvj11lx&<7(0X;koYOzq|>m|(SkPKV2mZhHrU0IY(JYM&AlK)laoW% z^$!7GZI+z#@*70yPf64S@hy_7>zQq&O zTAiHnL&GGzz~{X8@Pnsz*!>lAqd#t>IH`r^|Epqk&Mba?VziB;y>)2{$hf8+UjU+9 z|H*V55ags0R_96cm$G2ynAfh)Qk?tKNCwa&#;n-ml#~?EfPua~1Oz}JEq|vC90Aox zIcy2?YR&BiWL+f`Ei(wy`~X4eLujXXeQ;U38^r>uw)(+`T;V;?2j)p<3E+*L$Ab35yp# z#V82&aLx7$?Jgn9%?P3HbC27+y_wiUr2ihgB$Vrp;=WxH|2g78A0?n1zEFhK`6bW=}ZsY*fY>ykxZ=gAoT@o~Bx?O?$4_sO<(r2h@Lh z-Onc!;YpW2S_RggL#Y_1cRgEN+1K^;YqxqxMP-`8IXB(r56^CF{G2@GhD47gy97dT zZz(r5V;Ux{8WTp{ko54x2Os@o@y$#hAfLbL%D_+p^dRbi!$1!ri3knXE2u0X=wmGz z`*+0tSXK$z$D8B0&8(^q<~->=LB%q4<`R9d&VIS0OR`fv#|HSRO+I*(_voUZH|W%? zxOwZoAN$bzA6b=lH2w=z=DS_KxZs_DUxfwNWc`~7B=f+U*2pJvepoz`gWciRNMWF1 z2X7qNkx1FY(r-K^LCLbHP3q!wX&z1U6e^H&zG?SBf+_w_iOEj*i<`k)Iqw6$44M9; zOe_BypqRbA`MS5;eL>PgL=>m1#srfgaVmm> zSFL?SZ^Oq{jd^yG+#pm0R=4D02X0*Q0RGV%nNImRc@loyPlFnKRn1msNwuwpC3UWB z+5+zRvHeRzsPIQDsn8hX%e4?jTnsP%?*)|7^J*j|{)*BC4)sCvx;r6X;fxe}5EqaUa@%)LJ1! znmG8>W+xKbaKHlNMu*tYaGruaac@~pJLl*)Il4N0qHc+SmJgc(a;FdNc~g=Xp&XBL z6s!*BBv-W~mzh#fa{YpPLBR|@tpj!16gCJf=-I}KzuU9oK>`xf< z<8YvNB_;p3Q3_UR5D3VuxdBAFy<0iYGYgg74sAAf8yn`60)L~)jW){2<(=Tz%+1AC~ z;EVM$Lh7sB=YL#lc2OhXtnP0nwD+%8RIQH0k{l^i`LP!k$G z*(!XXV0;qsPF>jR{?4D$TfqfU#s-AQ)V3sgm3l)_Z5YH1#i5}V{>0_avw>8a%Dg9* z^qhf{6XNg3`pVnsyj5<(gy>^F26j?yS@-w>Y}stgee-9&uxFfZ_HL$xt57e}r~1-K z;&k2imvifsA-~S9c+TfOmiiN**YE44eAo|vNj`Ay|DgkIZdGN3`LXbSEP!wWJyTLS z3DCmuzl}%~B6&AlaXF1J4|9l*Nbt1s)~7mDNS*&i8*=gbY(>Q8lMl?R-4Xm$`CFGW z|B9OJX~$eM%c#Oz#?d)*z)72yIVh%+-}bcs9uK8b8t)bm&+eYZDRcL%uuJcrZ(Ne=^sc9qT=_GC6f$}%gvj_;2n+5TztV%st#A{T3B!9UF z$O&lyl3G&Jx^~xdqER^}qvlRJInQx=DV2WB_fpcxF+`{W-@Wh8jEs51dt!7k(FRDx zM2+ri`;mS&^SGpzqF>mF$CM{y2=PMNjj7Lv%7W()qx}4XyCmq$rfHd)7IUIym1|rX zzJy9hLDKV?xb3O)omA={4lOm*Hc-TmNWmq*TT5;4iQZS)_)8k-y8g~Y;jBQ{E7hot<|{YYzibpyL7qo(83_O zmx!Ko`Ue=;gmYA8{TYzyR#>w&TB?CG)2WuBA|=O8eeEgFpZp}iIp9fJ?Frdu(F#b_2Njmc zbcj_xIWpO&r=ARS6>obtrP9}B`-`Exu<9Ac&YoNSFyKduUad$S>X=vJ^}D!9r&s#A zF}n)(1zHNR^GKeK8YmHB^V-U<7s^Gjy5BvH79&!E>RbvPHoYTfIY=KFnVi5d8fyuP zD*lvawV$$1o~k;%+jj4M|ItS=&}qRyKVBPl=7f5}Oik`t`Px&=wN+ttZN?()K(%3cYV4JYh2be=XN2(=A?9tr3OmGlaY8Xa zWjovZrvrXv(^Z(sZG;p@ec(5(T}@%&*}J&l?2vomIhWnr`7=0+y($*X>3ST&pBxzu zG3a4%zGxc!2$w1OAf0MyCFnVQedeY9b4>U5w#XUW_lw~*xkz(lr94+}OQ;``N-1sL zOmwY#$~fN#y!F}YLpfY%eaq@VDx#;$04WF$|;4Si7cFcnhJ61XAI zk}L!8XJaMl&8qdP&|zRa+rv1LXmJ1nN$#*yuE-WmCPN~~jnaBb;7gE9NeHt*Ef=zz zzhUtSu`jqua}dnK=#=fOT1L%`y35JH6=~|?)<(h05}WVtW^u{Np)TceMRB=)7tTed z1=UJ31O`S>@gTo$S03+}0BZ^&3P?GH3Kz7AN&)EbEH9Qg-Fq~g(_!w(xo|33!1F&F zQ-i5wc8#*p^K~!{d~PANmJ+}?v9e(QXz`#1Rgl`*CL!FeSPdef_GIsmu?q9J?2t8) zLEv=RHF`1$%KI;8#x7Rr&zHzCPp3pePqm7O5$qfcW;75>6dMA>Omkh`j2UZ3erIR539#oVhj zeSwl#_PLktT0US*KzS-a@aGUWY-B>R1dCAlfr3Rl&ei?duRHYzQq->TRm|$ zTl{~LR|CVVp32#ga=5ya>|E_Q>~Wk z&>3>FolB%5AlaLP#1g~UZDF4|FWO9=UqgObsu+t5W0l{X{zGrM$jNmJXhF6_rfp^6 zhi{lufySYboNVrkT86?g=TRQ4BJXjj+3o?Vqvn;vZvQ5m7V|Ht`S0!8PjmK1*F4oO z{w946x=#aJhS4lGIk1YFY`x}U1cmXk$WZB9I)JU7pKYn#zg_Er{)BCa=Hw8s%>MKm}4@y`CiT=f?e*rG#sjA?9^N zv>b&mWy9x&%0ME5NsOr^vss;xi<11z1+m#+Ha@SM?h)-U>k89%GVa#&oUL00r%N?x zt7x+Po07tx*BK__m)SZ}3Dd0Caco~@YB{lTa?m&C^3`N7p(>_GH z1PY_5PUff!bJ}6HOjVjxq8u1L;}>Ans0V*PSML+ys(xfbVTEE=#gG@-3p_8!n%bD$ zw3D5up(w1V#)-oW4Xs3qRBER%c)K7hV*_CemEViTKnMVpqZ|I?aL`mfX6gX zrXLY=_D8cS(IjJC>5A?z&3ugBd)2pJ4W!hA46MJrq%eeihbx@m zDm(&w!GjPqEc2&xxenCZk^@byCFfnY1daS&8q zE5>+>D$a7ra=84yu0p@2IA=e;ujQe&+-JS|z zj`X%CvkIYqhHcn#>1P7Nh{6byNvm*b6{9M=Hj3W-mi*G&Dn+Hv;npzyIT?l6tLCSa zS3a-!MXGGF7Sd?%ov&d9HrvwlYR|8pyvqH%uX8h0n$pzdH#g+e6`g$8ptd5Cb{`c& z=cE0sa^ey&r(+rub0Z$a!edNT#vW;{?4Fskc+Dq2AfCC&eO6&w+#Ik-YV~xY6JmiY z{H~R3I(_>s5V`N|`$NZIA6E|sMJLC8CO*`BbHB5H>MO-8=frfwUybUI=gUzwuZSQ7 zF|HZ_x{f<}pDa_(B5*JeM!Yvq+iEK^k>#mT6d|Yb0aI#;%px`V2z;SyB$N4B49h_I zRv5iO=xN)l3@%#3ufQ*O8B6Q2E?FtVD#{IC@o7wW^fjJHRqtpSU?7wk2z?{g30uy= z&)g}D>e-8qM4cX{$Nv!(F;@i>2fKHUC<~{ruHkm4|*O6 zzBKxdIZKGuA!bwmQc*KJx|5EU5a;|-fb89Qi4H8!dMs@MLG~M%Tyb||9EI{3d+Ki5 zda%#l;o_Wo&vxTo5PNSjBE<^Xq}@6&_P!{t_oE{FUtkK%|Jcr%ai!6~*FWlYLn|m|wNb0gwDnp(RrK zgwPx9T}uixm7B}j*Mz8+%oSaKIwQnlj%k!yWq0a9r zVN2hMwJ7mWpYGx}qaxij9I<^;!=Vo2_oGO3MQc4Nd(JF*7zmejwial}Y}hp8)UAe& zk3wv2`3iVYNio=fj_@b1qKs8XN(E9*4*j3NLjxQ3V-G90Z7p zFGb54P(P?u0%Mp=aS?*D-^1DPNxYHR!$s!$i%)aJ439DrF=2^%$-?rfWWK9iq+tS6 zque|)^BeWHRk|h*I>F7myP+W5`{?q3c`@|Pd{{OK==_&ARlDCAci(Is=>*BIskU3) zuR1--RSe;3pU zAAVB`_|n&06-C#J^pb@z0WQiia5P-D~|i}#W@ zQ>+vlPXkb1jSQ)%H;-}}e$1&6$3$w?J*+%LjQpG9H>%Hq;GnqYOZ?gXb> z=dbfD7FDp#S6`fyC_2z}@h>5TcTJ{+9nN<_HhWxI|Hw~0h)+*|=IiqX>E1ICL6#(C zCU8+FugUif9KLMDhwN=;6By(LP>)Wn7Rc*V&R!=QW|WdfDDwf@tETtq7rKUvr@EHN z;^Or~^qtomYBW4k@KT-_=j2IXD4M(E?&>^Wo!=m2 zYJT9K74l2V?H@nAzAYwsb)622`uY^mrV=t--vIiaCy`glEPpB`+aT(6%Ti4eE~X;_ z`+VZCBD+OfX@KkuT`8oY?dKxPZUh??Jdg>81$3#>r{J_fuN@!Cx35ps%Qo6bwf~eW zlR=XUE>DlJsvCk+X2|@8Q_)!^ZX-J^&5ydp#(-Vjg0*a3lXwKJVyqK{hEXeEIp9kY zC*!IXB#&gqQKihw@P7kb2H7_$6=H!IPXC28%o1T0M4A743kcJb>&OdjoDUs&5qY}; z8O~pxr$vtq3u{>L_ZTP6$YzoxHe3CgFZC`SZ(_im-mv0v%=i{F^IIN(!3!$+X$!azoyi+00_pZ`|XsalGiArBp4QoocX z(m&1(tLa@u-7BOYbRQ*tql5AU{a9KGG6>7{{!pN_2gD}R@SfN7y>F0*qeW|l5TVx_<>_KC+eJ7@R*Ra&gF=cYFh1gdiTSlr7ke(~a{(L`F=%KS6k| zqKSV|2lLuc7A%rpQu0+tJYo;NFt}lA8~laQ+OWPW^%>3MQ!-}KcsTpD>mpoancH_u z`3+12Obxj2Y*{z-a1NGHIF&n%S(KsXR;!W%>s2M%z`pN;gDQ%VgPbDwu_22sQ}Jre zFle&U4-(qHDsja6quQ;7Hs5h44=FCo;#E=XJf~%*xEv=Uv^czw&NrB5FzONfGnhNy zj=Qc<<2!llFCbMXK7+k#zw-f7&U$P}$}Pu`+!$>H!bF$TiW}%2Lp$o#1TOgY%kQP_gRpay`H(Ieq2UZHU2rqb!(U_18cmOTuH{s60xRH{-NVx{4 zKMf0z4(HK~QPv%6IAb&Ti8Lk~sF3>7ofMIoc*YjNuEBQW3s*TR_ENOemM3b2i-yA^ zKZW>5$|QA5a&|zp`kx5pg;eAGgZtj+SvBj8to`BEPk|iuwf`h>O6Rx#B9saLL11mz8AqnC5fr5{dphIpY{!El}VA>>aO9L33*8M_YFf#_4E_`Bq-~ zDO>p+(wB)ZD;;*5zHlNDB9zzls=Nmsv-ykhai zPWVysaN#6)AiEkwn#XgSJ2Y^*>wC+r4h#JNrkrvrNhFw&AK3vB zh(}jAoDl8%Uu4e@_#dX3<1e%tE`c%+Y#OaQK+9TsSbzzIG=pw)StT_q z)CnLZ@X3ep;^qA(g7Zes0+DRZxjn&^4ogKg3hp5kwr7`Ya2{Ei;O)fdLE35BSbTO; z>(?@lJ+FFDjbbZs_}aI817Sba!Y^*bHDXZ{P(|UKkCXQAm^?moF#jI3Cdv7+oWlam zlz+)e=`5SrP3?`$xL$m%ey)@B3ElfBaZqqZyb>@(8JH7KnAcKD$OHB($lDE! zf|S{kYrj=#GLsIlNxE>O(2}gsF#~ZL)QkZ?VN(@HG!(`XyWhFh{{9S6U0J|zF!-=u z-Fy!`;p$B4)HuA@2_F5OZlc%9^u2*&$dMZEyip{o#YCj?Ek6>F_1WmDpB;Vd`~jQb zs?*thz8Q`TT1cjKrZvjO9w`~^lw~I$J!GUxxS|ev@ysZ0mFQEF%V!^^R%hc7ta58d z>8|uE^OINS!3I5*o*kuV_mSc28jifH@{?Ng&W`T7?t*R}a{&1%r;?!<2a|zBIgj=H zefX1YUe!+o z%Xbo6d23}vDXG}l{{aRTB&>HS)mY6=3+J=Eou1^ zD_TMZoL>EmcW?4Kw8Rd$MG^L!BB#kYTc5jr4TAD$Osr1Gw7h4HRzb-gFDP_unp*!F zGzfHoRiI~iJr_a8K4G(!P_Go!C!a>anU`|*qZy5octXQ2O|^g(@B5KQ+g(BUt@aiP zW^Pky1ZwSoVXFQQI9<^OvCVI7mv?Q#Hj*4yb)}*va9gt!)bR*U?&^AGKoZogI|$g9 zHDa_VCn;?RM&nZ-Suzn8}fX=mUx4r3xXK1B&Ewre4%08t0!{pr}QA?Ba-7b^7*Eh zk#<1K*2>4S+4D+KLe|1k3H4C7U!|I6ou2fr{#Osb2t1kdc@bwjcIehyrOp)C(HEio z@U%V0BJ!&POuW$b&dr0uC$f5Sfklxv(F4X|N|ax%5g5%4{oi4c?eAmSbI9>Avh2>fi6{&IOKA$ipYmw{Khoc&={rYs z)Ge9fvMz}b7cE5P9LdDQ%0l@D`fgevLT0nX(^<%D@QvWl>uAEC2cvWpQj`5N2hcA9 zr(%{Joe??G!Ej1Ry(nTWRS2>jsVfY?1{9@Seo*V@cH0inO#?{oI$q5)bQ5fNNiTQc zS<2p#g;v-Ax6L#Bk{KnDJ|A?5O#c`tZG{bSjJ3gHmHSIC-?499@v?J6O_xM!oU(*cFJ(WrPHoNym0e>BVtikWV&1WI>!Kdpi4nz~dO z*I4N+@b)?$g=c(n^pN{^=2}F_C}&L0^mj$!B_0(%MU$)@0?3rYxHoSE6N!%xZgXs_ za#_tiNsrciJ!DhcTk_e%#2&Ps!%I!3$6c>RDBPLpxc7aF&aUoDI|mHeS#WcljIw#0 zgjmlvpIaBNyT|v-hkL}yfNcKmhZgY-DaP~x5K&LL%SE_>4(v7I%cEue^mvHRGm89$J_S(4ubDC;&guA#98aromZxThI4Z zs1w6Qa^Xm@Wcp@2Qj#6o!q$K*-`O(X6nZXxm=1ZlEJg^%zOUcetYZ%8dRf^?p2NxII zF!ze2d!HPjVtjs%+}(Di8dC6qlSXVx#<``4pAa~#6$fs?7%xP7X+;Q9O__(W%i{bX zv_wX1WAW)RaeIj(72sNWEQs}uL}zVAzwH+l00AxR9PL3}j&?Q7c|i-h`@20+1Di%T z$)ih!c^#~{YH#2~8erbD(Cu*E5$zoQ7tq+I^f_|R?6%=pufa73)u*Btk*(9RqOc{dg9l})g+zXy?6;t&s? z%@9VJ`+pbZN0;6MWXMGqgqsGq%LY6B_oBo_6TIIQZu*EwAUY^Y$b*6eX;&gB?&L(MukF3#6(7v^^p1l*ln{R|FT(<-L ztoqW6z_fYm2R*M^2sOr!&bps2*NYaN(DOiam+&(|iy4quRPqsInd zl!?&rNSG`}Kl25+@2y@K2Vzrdz%L~zIW4SXUcP>^%LTZ-_ewbq&mSNDFak)w`Wg<$ zGRS!%H4ePqbKH z-mt}ynHyG}vth@8`3pbAY9Bwj^A9X;ZAvOpm_h8=nX>0Fu07dj!>(eDxWfrB{FHJ~ z$3#!85FcK@d??QrSzOc05&p7z$eKum|1q)359Wc7(6b@YZS78hyi0i&RAK-5d$#A8 zkDo(?9v__<)aCt=v@6Ai=q+7_vEO3#yk!+j{K9@E?1ON!msPK>!b7f9<{R;4%*nww z%`jFZ2AC#WqV|S7*OSYO%U6md-2P(L+(a~(-1%@55wl^FDAFyD`v?< zBSc+KdDv{O;R;cAT~yR-iiJ^r_aRH)eau^Prr;Kk45PCM@Is6=s7|`SVF+6MhS0&+ zy30E#y|%2s&hV#uZFo6Dn8H}-oe6`Sihx`D`7V*$f;ZJ z|K6V)}_!50S^TZVY_I$GNd*RzR8VV*cG(IP<88tj& z1Jw>8d5Z`gGeN96*Q9}WHOYNf ztr08PyVy7ID~anpR1z4T6Z;2ZCJR}i@Z6%XrstL`v|qtDNLhLP1Mi`YPbQ~PhYU?E zugoxhKJKD2L~K|KvbI?vYcro*YUsmt=}?kO&*d4lL58e34N$8q6$O$pzS_NC-4XT? z`T|Dk_ba?_FPrQIj7;^eE(#XO{JuC?mraa%PhpjgkmlqleuJGxu|$Rg0j?G|qn;Q% z=?>&RWtsYQ^-W4nUc)HGtk5nT5a9F>{EgqZ@Rbl=k59CBFVnM%cedYTai&Ix_6DQwMHDFo6!h3J=%c znMNrlm)Y`p$2G{)Gqxum<~|=#7Cn`ui9**$m~tyr%d2hjmUUa&0qh0{Vl7PM_Aw20 z9GV+w`8eT$H6T73LElE7n)#fZ>_^Q96{SW_aL{9+CAt!5i|v(+4`! zvch~*cf*-4yfN zY(Qbr61xY;KY1}RILvH^-{0SABk-ZeWj7?|Y_XBbcURDrg7JjcIopzqY=_H*>{fy7 zpCRQzc}z52d*>}~A=L+t1m_y&L_eE#3_lb1mDQ<%N?jSWZlzC?Ytz8H(TL>*HMOOtR7iwV-84f$gbym>uT6w6TrgprW;8nk_Zj2`tw9OP? z`9(w`bnWsB+^~j`A5Jayz=TqUk~f)$N_I*tOf17jY;-I;py#C+qD&nEhl=&sw5tH3 zu1$V{$;4b80&-)FZK7)G>?z$}JR>30kFk;*CE8h{aCU;zJ$z@8E0o%W5#(1qf!&Ec zSh;H!$UJU@#&Wlzrjbut@h(g&YwP8vzW+I?$6u}S7VgZftlq=JLleX=`-Zc(mbL#{ z)9K2e&3XGzsL31yIp&g@QJC*m_%r;xCP4>(!h;`YVXEj9Z=Ho?fMz)4wJ5NCtAqoC z8c+&q>YvbE+NLua{f#TMH^<3JbI1ueK0Br@ zg%}?xA`d5N$3(~!IesFBu#V-LVFFS7?_bbrj%)+Z%k{CYko&;oAJi~(6Y4gYi-#Dk z$q2dm{m~QG@*wc&jk@Imnz;VCLYz#OH!#%w1 z_w;4j0l{k^Zk{G>n$!GNe0BMt8Fz5=b+4X}5x-Iv?y`|C=2cRIEH7jtl+?wPoqX@q zDsE?$Rt^gRN8N;20dDefw6DLjs!=3oQ>6g-Xk(&Ua)y(ge?CI!;mTTNX!$iAIcqql49A~apAMJH^RNw>^y<;#lT#JWw6$Wp%{rG0WA?pEp?Du zx3%Ei~pX@&oZlb;=bJv{QeP{v_I$3VA-x6p(MH2h9Jrap9x`M@J|q)EQa?W13mH zmK7I~Vi@jZjfatjLJocHwJoLM9&vOCO|8TSDh>3!tkP2F)Xg zRV28+|3D&i`Nv((3=h;DVPa!p@ChO;7kz0QahTs<;cRUU%n^0z+g}~hzSZ(SZS4CcpPl(AJj;K3z8Q*7GshoX<1MzU4+|@v zCw1ObqjU@IgGWOjch5FwTq%Ah%v+@VJHQfecjC8R;kBk)qjVByKM0)6Bk@wyPR>UL zz(?3s-g?OHVB{(rk18l!Kd(@DKSqOzs7J@aoZZO(LXtn{?o{(G9DJon@Xi|ObiLmB zYsWj=?j(!`*RV;8uqLXYb)!n#-+6I!$x!F})qTipD^u)=Ii`|Lrxe3Ob(ow=q{6d_ z4=l-9^e7_#~Mo0Ws6UISz00bKZm;(NbTzoW`hKNcU4myRwXIX)yJQKCZRa3ip) z1($R5?7ichxg(>DCJ~auo+C ze?&_abjL{_)+e&)Vgi%=s~FxdWNzm70`c~3IQiD4);!T|i;s`T3{Ni&)5Gs>qRqhgX;Ubm6>q?g@GzJpwz z|L6_5UN|z{UnmF!dUA%9SvaiD9Y_T&MDd#m&JP?$d`HcT1tAUPkrW-ND{|~)n}Ng1 z-E7O4D8YzNgwm+0HJcx}TVC#Fk8^c&fCgcW_^vCw@pt&J+=>lb(9=7MHr@sVTr9@) z8N~i`oA)_*kR{eqFsPN}%EV)x0-f$#2YEzqK0pa&wB05T) z1QBJedz@uJmBAZJy&SNc)qf%uuQ9%W-qC3N{NJlOVN5Far^naAI($iOLGe~S(kz-K zHladcodH2UduLY>ehTSj9avNb2dau%S+KJh!9fTJ3A>Qgt`X6>DiNP$ZL-eO6Fl;y z)+D*8aT(v=g8mfs82G$GmTVYM0%;bR>7t|7bO1MxK_o1f7Mt)y$#Dk0khX1C4Mbwxx&GKb}YXqp84Gp$#U zidm-@FsZNV5*|t})k;dB8KH;(YQ%BrE0%G{RZ@kC-s#NyImJ`AJ}jI3V{5OGwD1=C zUNX4R>-B-OJm53rUX2RUN*bJWM-HHub$|Z;rvIEvovgeZU~=yr?bo5K08+Ajq;Px% zV~s4}$PCC7{4T=sV$XB#Wh(K~DBdEy`bmW+%K&duwACp1X+6ztr(bn7wOYk@9# zSq`q~u*ShgUgBS9r4e9F--uI;%W#Srrq5NPZb0BF=brPT-b$^43zLlTvbiCd?X_K0 zjj7t@&kZf?@Pj6t`faBEu@Gm`Z?DE)9{b**+k8(*_!_FH3K1v45C(FqKw^K@`*ZL> zf`7FPZr45Ajqfd+_2t$Kj4IL~je(9n$8RK=#z2*_+s?n-TRr@=O+-s(YE!100DC}p?O0}@&GcP6v8KD#Qs z%W+`+OUG;{3f-5(9adHk!`m);N`I5H(RjW0tip`Td3ldB!O|6V*T>FSNeZ1Kg3u+T zpc@}9yotlVB7OW3J6!Pg=9Q=(Xn^D~Wrqm>J&WOOl7d)KP11*Nr3Ov7inRZySMTJE z;W>IS1Vj{8c)VWgQiueq=hEZy$nr+yMc2NPhK7dK$?js?dbSgua`_-XZ4ES!pD2Bd zc5$`bvdJYE4a>&s*|(fUdJ9{G7Vpk>0G>sBo!zDSH-5?(j0WaLaP5rt5QUW(uZz$=ZY=chCPI;n0rt zIn-t?dl~dlTl@QQwbPWD?G5r)6b~Xj2(xN^)m%b-o$6;3$2C({x2K$MR(PYs;0^K) zMBgpOdol^_!EdV{0u3lYXR_~8<HBP8HpOz`b?^oe=;4ALX) z>wA#7SjhmLTC8#4F$Bj{PisDSXg}Qh`};t1{9fA*U8 z#o3Cg*;zDQOWp$Jb?8)ot#7UEBmm93G~Ty-$9y|r=%M79Gv!eJ-b%Uv%0|Q^>_{4B zzdwNpnU$Eu)3UT}LUetHDZC1Btw_2}txc-WW7N-ufD!fT~lZu zJk1mDsMc(o|KNH>c!E8u-up|{!*FO&qQ%4cz2h~P|UZ%hFyK1=`a&v6_;c|H6 z^2I{uZ4(xqpL1ic-%-6+_^D{}{X;nZT39|X6k|uxg4{8}n~t?KJPMARhFoqA6uuK% z#A?4t)Q|vK19J9+2o+%fTbZ^hNj|c~mMo4Cpwph{fV~LSc)ZXM?|xb|SbrWjag z-i~wG0lHh(tH5#W=oD+Y&eieXeq5%xoa(T3U%3iQOdZl9ukg@*`2n(=0@JA$%MOqk zJzbv$;W?RnMp{D~=4_RucsN;iUAl?yJwO+F7oEEm?K_}4^`^9JHm954t9zv+T)z^I z&gUVaaYKIYEoY2<440>5qs?`4SVCQG?RGG9RIn2h#lUqMmAu?Bv)u?24l-jcB*cL6 zP`9uA7A8YecoAo==Yfy6(qDhTsM6mxluBB-QA*P9){pa)8ub@DZ8mls@XuzB+%fx8 z68$#t-Y#zAGUeCWB`jNd!)0-sVZ`zC`>3;w*R+|pS8+eIo;pYhq^tuUvq%)IT_*qb zp;D#Rcd9>PkYn%ryZ8E$pT{3TG(RAHxx)nzL-_3%V=F$IZ+oGY62BgmnU^;hMj(>@ zult@pR%`nG`?s4U9?{p((BS6m;&Z(HInzHd+apOLbQ$Uku{@3&~f3`C64xxwev ze{H)$`o&`@W=4W~-B*x`5rXsPRy;fp!0^4nI|1OSElgfXXLM#*Nlum}TrCeA(MNJH z#fm@8gmX_|uHQpjBnc;@EI*HG4{aw2CD<5SNgE1mX4T_)Sa7QO^$;zJ`hoCLzMusr zA%XL^&Hg$^fV=tT19v}1{?0`;prH%kv$NbRmW$ZT3rO)prCo}m=er2pRe4&el--IE zDB{(Y?{Of4aA+>bLjiU- zVhXk3R^epb0hGjXa(Ja*4$7MWC`Qr?+4mF=_?UE>0JEvM(_CJ8sg)OgAi=0x6uIfI zt&)KTN8JgrwUkxTU=@^AhoQwf^muK_t6?i|E5fGt_1FmxtASXOX{X4UL5Sf7A6=gF zA7p2O@|TbeR#Ojqw*(w*rlLU-0=IhYS2?cxd*%`aZadpvgK^mh5MP;=M9b?dgh+74 zJ9|n)4myS7es{ zGNG0_fQ&OxRDgHf%R3zF+WM#4QU`5Y6NAJSWpkbdUt0q+yKlfDmr`}%RbWJSWt@WL z7PhYjB3dhOuR|9%*6l=g`(}kNWSyu5o9d$Ace)8zQbw;P5T3RejCF7zD`F!-H&rPV z+d`@|)QNp^_hOyv<9VaTi7IoQVMC+%89@ijCI9d#tTcW#yvk0tvjcNao=&t0#8{LJ z8;!GzC%pT0I+k!Ct!T%HRb})2Vy=Q$4wh%<;Ah(Cj3MH5T;?{A$<5*8$mP=hGzxW* z4qq7M-B0NG0N|!^oaMiQbOl0){00eQHkIV!NSJ<_FN2E06_RdOK1w4}{QLmqE@i1j z6^2pWvnB}IRd5E7{S4*GdMgW!|6blUC{rgVmQe( z)^pW6)^jqKxK~*GhCMEQn1UQ25wy@W&s903>zzUPO{#f$*_w~PbQzCgz*{vbwts$L z1h}nzqQYCbZwH?2O4$eCg?RjJktZ&Sj|ck~+2gnR@?SWxOY0&brc(v*&+tuw|K=dx zF@r}LU5oJjUaFfm8c=^KfiD^GGw|%`e=@yM=gPS)HSXNA`HH#bI9UJRPj;u_pf2j0 zL};Qc4COQ<70?>gB@6c3sbvFw0N=Db47q_{`D@6weHk@XAp!EgPFgH|QMzAq-dmWr zD>$1;h~VYubOmMy>Aq)xJx%_lNTJS#7H^RaMY!)zTi6<*LQLSmG?L60j1#56Y0}MS zGaaVbd!HdvCG3z&grMXq&E4DT(MA>8#;Gw=5(v&eiu>=b&SPxhXW6M=i3q0Jhj zv~l<4g7Q^GdO=kBW+`Sm1NFWvCLi-+=G`bxH*fP}U0fZO7hRb@E>oLJ9tBbMTn|D0 zHXVpMyPcR@@=URxHv$NLFxvh4ggK=DS;WO89dK3Uwm~o=b{s^R@u4<~BpTD@&+xwM=8=E(rwRUgYuCa1ID^^q-R2o9h0VJ_FQ(mFTef~{$y z*aqt~s1EK=?1tD;`N{;q3oy{r~}xw&cr~ zU*R`yLtNt?veTGL)fkzcXHW#LcGJfRbjfc^Z{0n#PUuJK8&5hQ8bx04Pl*zi&^F${0WSx}mbR z&|x#MY%fut$5kM8fJ6ax!B}V=eD<~&xH3`<2swR2r!OtWTpU(XORaWy>oZJC)o#Y6 zZ{g?oz=<{m0mw{3JW;0S{mYk(;KzGT);G`S_H%Ck9T-)x+*@gMeZJB=)Dcb0#&fnO zFLEWtVJgNf!K{CTUIT^da=*YSQW_A$>guua@Rb0yY#m>jj>neD)&)IpEaZUTRbItb zl8~QRUL^_kd$y!{>>ql=O)j6^EYQTz_U~jSkPKUifL(x_ON0!RC|ZBdjP*Z%uOR8V{B<)74)IdAcMqK*9^Nm=q(7|@=F#QU&8bH+5#1$j13efaK#g>55 zUwb~G;Nw%!(r=Em7TPEI)v!k3lVpjiR@gW~7;3ylfJ*><-)eYh^jQ>}OWU>?!G5$Ah$2S*3Bls|K;Hmo+ zwl`v~!Int+Z^|nxM@Le$AquZlk_;0*tD1Hk7RWPqziRmW&wmq8GlKWuL}=uCmQfg( zx;R-GnuR)3qAkt0Jh~=pq(W&@7URBsgS+rvlmje9lV>r$+=h`z*ib)>{FRjTb~8U|U8;ms9vx7C*j} zFAlK6oZ0#IaF9n{qyf)v%|^AcS|Abn`xch@_bd{jub;3ZV#8BDXaxxn55M7;n}}Zn ztb8u+R8%lkcMkVMoja<1D(FS=ht!YhH*@UQ$TKxZQXzs)#%Gmi;a$ko)){-=gVLBEQA2^&k;RptifTQdAiC1|>A zNqkq6dOqh1P+^gk=TTXC_xm`7mXu<`%{zzQh`yRUrrHFaebnm{IRY*f$!$ybS zg(9`gVL{TlB#-6mE}l5Gu;5y)u-`BQ!OGK!ECL-8xHaUWx^E^FQD>;q|GK)~tdNNX zALjRoIu%adcuAjrHEnP=w})yNbLbpQKvF4?%jzyDmD8d+cH9~m;tHjZni;%|Bi-vr zCA}-}vt+Icwo3ogEwzW}$L~}jF{Ezh!C?W}+J>vXK}`Did}9OCGm1sxW!3bPJ_SBr65@A@{g+t>N}0Cm^qXvXuI@iGI=fbW)VhpT$UkZ| zPPl7k_$mWNQZBh`xBt-OC&%M=_KInZay$<0rbNiRSDw-z#Vx5*G#ph5V2U0U91KQ! zzymgMq+l>imC<>%rTxVMo<7=G@9Y$IBM~>2=<-qAGw!4K2&Qj#+@*kNoTWm9f!wRJ zOkunBp9QvRN23LgLj7N&-kgipW>n#f8ORnHDYsdx;H!XzD> zer<9~IR^K5$c>{|M88T^N#hNCxcN|pyWMGx0?8fb^{89hHnz3pNEH$iaTW4`C}s8g zZtI!W$%}8lM_Ioc98|e?(w@m3n~+6UzOmA<_)=*S4LRBoK?%Rsw<3X1{Fe9Z7W_Im zF^Ud6Tpn3^^qBD7*K+7a#wW|s&oK@zk9|HPTF;!a7$_5zv+sN4l zgYW-VXN)RjiVvAqn9BYecsbv|)8JyjBO%<#%Gf3!nBjK<-gl4XLHLOf(2&w3fL_=v zvdw*D=XyT&HU}zj8x<_kP2}FD=OGt1{Rsqc8$loxI({W9xN<{`UFOn0K_cRaDQ@4q zr#?L`$itYTo-hC1r}}}r28CXpaX3r0;?MJG!)m@Vo%`mdhZoXD&qp#`=*> zZ)FK6Jg-cSCmBt+1$qB{+Bor59N9`T>mGr|LOL(lY%wz=&Ae*T%I2Ir?!Fc}^h!ee zu+(>BR$IQin|}U;v-^Z8H&l!Ib%t}_rc&=vj~i3n(#(LV0Q1MMtt>;kdkc|uk^sCH zvFC4?%jubnSoErT!#&V<03o$~g@(AekIJ&L#Ir5r{`b4=QIm%;iO#ZYQAA(9PY_ix z&?wM$xX69~CT6q5QP9#RmS1l{GJ)Y@m}_HYx-EE7yjxl35mt5h0TC?5%A~I;_r8+7 z+z=e1S9S11;jkWoIC0pBrZlF#u58_u2;Yo$Z_XQ_oDGk zA9q$^c)5JIKn@&PvOJZRFYQUbiXEu|(^_gz2k6WaI}7Zw$c^w*)bcbXoqug~Bm{Bj z7y%@26ZcKY<=y}*cm*jWbNk(;Ul>rK#pdoY^U%+U^KS$)eepc19P*K_U@Ua#ge)@oNBO=|)%7Ai) zH5EE{JW}{q?j(v(XIIv9ghbzy^6jj#@yo)yh;RQInGb(mf`XX-H7xks!DshJT#jq^ zt$*%?ygc%?@PEw=ej?ho)3V@(!}b>XxV3bsiQ%W6BE8ts235d+V(8>Qqu{f~e;Uas zVUCPRr}96~(GwxLKS{_FPfEZ0VdihXkPwurCM5WRaWNuN(Bu0u>MZq*`A@FpYMnXK=X?7it3ASu-ydlxxM_ES zZfkRj1Nv~Ld3)k96CCt>6e_P2BZHLF%_F}e>T2fYezFk2zKvf$5dp*|eDrz1SipY) zxrp$7IWfHZ-q}C2-Yz0H7OqOjR!a9dLjb?O%n(+|sMrkTLDXBG281rpyllgVgI5D|Hb%6s#y-FId3=yKoz<&Tzg>3hrHLF|AW{Ut8`hXi*RLN5 z)9grGlS@-!D3`Y|D0@~bfjQC<22Zm4{ld63JtE-BPSi%`|9UyOc-?G}_1wS-XGc-y z2q6uL+xz-2!}MlZOYnSeiT_T-{5}Yl(qbDP{;la@!xvx27oNx%%dgT-OI&Se5F#^f z(9_|fUuza}ms0p_g~CqE6d@x%s1U#_$?K;B_Eb$Z^ua=I#P#xNVR zD#pQm4_UIIA@;fN>~UqJ7%5O}YK%8@Z_ZQdGA4&k(6`U}&+Xd&QpAJ$=Zb=%#eIgm zdn@x*F?c75h`ZmrgjLR@u+9Mh9T+Y z0;ZD0D>*fBCsS1fnBEZMHBQUV2@G<`&#h{~Zd7h*n$0BCLXEW6XCJAFwfHv#Z`jxy0uh0SN+PgsEZl(Broh@QmD&Tcy>&s|6z(1`@fDRwf9+BS+ew* znVFc~#ZDjqPgZX`|5MfAx+JZksfo`dBJ=e0#OojrozkEV|7?kM9cx6h9rVv4{#QEX zs4{2&=A$%EJA0dv2sdYvfp;t_6a;A3*!xTr&eZXI_M>=s0BJz%i;SR<{P$MC|^UWJ(U0jobj;_h$+#muFGi zAVc%%zAqY-+A?{2-`KbTyq6{%;X#Jk9JEHhkaP#k;?o&g`C219jJq*z1BQ@qPgZ~a z1LUro1}zc%J%8Wr-t0`mhEH!>SW}Y!QiC1k#rC$yRv+e=l84@?PwkF6L4W`!E$&CE zju(}=8l)fxCvgkHPUjZ|)HIAQHv>SL2+sND&XNePUxi8}`gXq!o6zhYJz3mCG__i? zx9wHYwpi+86GFfD_gswMUtbr*Xv%|6?tDj*Z;T1S(U4XJ$=TZ$#FJd&avkI(Zq*bHcX zekKVWh~P5u@3eu<-_;pEQ*d`o!SxlVM)o~s0LgcNY|o{P;CNcNkYcvn3mQ0rboszR zpWJ!YtTz}0@XBE1itc3X*4CR84wnF{j`W`&Mysf1aBD z^r~n}6q|IhaC%VJq>!C615KZ&7}-%N#B~T#=shCM5+gGFZB+L6lJ>wen`lY-Re8+T zz&3N26G-6x+a=1f)rf;MiWhL5vjeQ2oB?s}&Bp4KlsrUCW{DVuu&V9Mr^pGpULJ8= zyzd}hc=d5&TCx9I{}`|s3J$|tDJ~`ZsfjP8D32d_CsTRX$Yzj8qF_JR3yBF*r<^9F z!dp1h+T!Lk*BNL5V1I<3x2`P&@$Yx)NkZ={))7}e%WU^dZm)x0=Dn2j?icO>%%0x@k_=b zZz0yxy@iT|(WNBP9PkTf@>Zbms!yS+N%Nnl*wm%Yi;Rn&7%X5U20 zUo6$$>%Ca&p?LjTVXo7c?)`f+9a;@-0UMj*xZn#>TgN~CU%q(teYk$4zWzwI0Gjor zrtn!UoAVm*(qfzgt+VZT6}P{|(mvUkQ=V57TQBXJO)2Mk*oofU3( zlY*tw-7vOWe+z*E>gtoE7aCgf4Jc8*TSdaw?46_Ldw=LyVdQ>wMY5?c8LLF3e`5Bo zX9&N16?a~;z{Of2EA5?lop;Dk`eTN6EcmjzniHtOpb?YcF!?qJq zol?dV#cRj0@<#^NJCbmVeb+|C&YtsgA{-bV#XqHFi&V!4qq~_lp?7V<)^Wo~Z8enO z=FanEC>+}Vj{5}Q(c9@;O}T%w^7A!SGnlR23f6!DwV|-V@7S(;=F+3}tzujrZOTzicxiIt3B2>T;Zheo9bOF1gf9zngd zM33U?bGQs?C5f#iPIV)8B&=P*^gB7jgOf}KLqn&+-;sL{VcjlEL|eLJl586iGIlyS z*za&S5@wfCYi8)0$^2I8Vg1uY_@i~NpsM2w7fn|Trjr_gR-3k3@uvIQdCKiw7CQE& zuj_A^Z+qb`LN+bJECo>c6wCN2qa&s~5y_CxonaC~I(pOWliEJBWQ2h3@KbJ}#2pL#h z`SJH#dUmm<$kDTOs*Sa9FT+sN1EVtctlL|v^3Q9ZHcvi?9VWf(3`2oWTR~IE3V_NY zBVYg6LAf-h$98*3=xptCh@^^a{f0))fv1F}!1B#g<8O^G9mIdH7ZrKO9;BUqIc#l> zJci!EjMF;2Oym#2)rHt1R@%{gKi|?Mrm(fw1rEU|ED~+b_-;MuSC5b3m2EKeD zlfGQ0w8bk7%1KQB%v9anpCEv7>1%Mnj{lpQmrmwy-uK=GZdmRmQR)5MDvhA}9KC4&?Mq0_n7+DN{U0Jx%a6^S z6E$7DTX)v;$xgo_Sf&=WY;8I2-i;O%ni|}$?$4LXsed*`{PfvX-yimY#;?K* zw}brn7fLtSf=bv;5kW!srTvG#+CXMQgVr~ zA}~VOE>Rl6V)J|*gH^r=@t;mW-!T>RN!uqjh(|B!FvR_!JuN}IpMs5!rlpJ2fv^~Z z$A7qfup_<*`TN6d$M(jFu4lhYAQMz-uT29bte}k)OEJQ;<;cw%YvO*_BjjL#tSrL+xy1sJ(nZ+1=t*Dv*y}6iu@{1q}>d@!Zs-{B1euoAX zO`;oc`c*(OVeE1m+O}Tvb`#jP{e$XqV@xW_cI=TzeoY;Z`-+|Oohrd)G`=(u{f;3! z)4TO)9=D8r-WXZM5eBmp zzza3ZIN@8amEnCHFWA|1m8?TH02RovM^S?7&k5Y=qp7ut3Oy1|e6R&!hC*(=BFb)I zfM8BqASe4Sd$gzEEObI!?$;2Q%0=iV9HL{%gTd=ifM(7+`mj7sv1s2kc<-U9a%yq8`$u+kXUk+4)s*be2sBca}NsbFJCpn|-FM4n+n zM>LlHsih~goPxOOB=J?okY0rokq=m6^Ka*{co#>v$t7F}2jh!d$gF}DpfyC%V zbP8O#GuBh`TFUyR{Z^J(*Nc8(O?v3=)Db|Hyd_^>0&AAaPPT5lc-t)m5B%5o(I{#o zDN*1Z8>-Bg^_TokDwmk@FZVco`!B2<+m1OXfwvzdL1Z6D!WG;WU;onp950ldJv{za zXUv9{{@Y#pm%AnvcpT|e7ktI&K9(1nWhSxUviw=V`fz2>_&=9b+Hl+C z;U}h!Rs8fob5Q*utK$SE^rNW_5FzAgK+ti!kQBe12g5@29*~)}t%c{NRk~(dnp$*H z=h=Y>NMkIk%&gK7e7`ZEg){lL<|U9xh+(MYy@`QZ^Zv|ilUEZHAmt=4d>;dP`m|%N z=Y~l`i((nuEBbMWF*B#C-ghryuGvWnubM`fcP3c}Wb=SzNmmvIjq@MhL;Cv5f&g{8 zQJCS@)UJBFzsC1xs{ia^5}Yk@d6@kM1}7OPz#pTjIQ%$5J8G_ucWqOf33ZbM*93sI}Vt^mo2jmk+ zBAF0w-591?E-uAKv9&f+WLxFFaXp~aoMtzxY%~>gvn9knd&bESeE*=Z@zp~xSR{Ey z_DKS@XFeW?!))yOZ1x#XOW>dqsg;k)!J`KJBJhnZ)|o}<`QsC8%5fNhDO1o#Egi1k zk#e;AIu9wodY3)nF`1@rKsP=W^Q(?#{CnQ(G&Ca$D6o?C+wtA4oMnY?KqXsvi(8^) zy>+qWy-jQiAdsv-Va0AUEGDb);MLte|LkRrJR`?fMR(ZvjT98`|T7JxH}FP;4)&&+taHIvzJK?To6 z4s8E!9^Y^2aqbb{gzj=zKA14(?_Cm#fXNSl$u+c!-ZH^QT!p`&fGcQte)UrUW`aBh zvea_8SVqmPA0Iu62X6fZlf<0rIAuLed-2#c9mDdGK*~g23qo&&7r29`MaiU$h$NpN zU@8=fVt2o+O?c9IUxO@Ihs8waSTEMS7lUuwh{Z)Jf@e)(R^Vtj*Zz$%9Yw^)wd9#DN+J1p`?1 z54dWvRX~m@B?;rBxV_nZ^vG_CszI>@x=obpWzuiCjL4VK*#$OZ4(Z&-5?@_SKXRB% zqb9uvk4Cu`lXjKNsZCOz5G6vV4Jty8-L2B{RM{dwq!dvUpbs5q$9-6VpEUW51+yHFxFJb2=m3}lc9Md z1^0K!U&r(>MCg6FWn-N43+haO)#KZ@b$)U2sBhm$qhcuP&*w#m80^i@_Xx#Yz81eD zMShl?G<{dr(dy3&a;jg?Ot{#wie+|}1U<_GLoQfoHN1fxg*#o$V8zlWQGb<4IGus= znX*hpWX%cdz)1tzUUpz^$1mH$EwE8-Yy-%`;YL5xEe-1x1_+D+5+FP1}|JcE$1#>)Um@`Ab9AwHV3k4&ItW zCyz{(R6FQL)^rG5uE#gZGcgSu zI8*v>*&^Bt;wbjzMd61=No#qV;eKxHtr0w#>}8}!M>_dZX|)jf9DVeJ`ojv=>EZbq zR1x_U{2@aHXZA?Ebs|%}Fi5HpR+UbPynow(O$No1yI_hVRC-PFss}{QkozDHJlV(g)^wpvUs^gB&FeOggXSR6p!+f8J9jhWE8t>ub|}ZgtZDek($+ zS5e-4)a?|%sDD9yTU550YwyuSjcd>RXwOwy5Du`-Q0}!Xqt$&Eh;CIuw6;Z&%?dwi z{7gy+!R`J563ebL_+o$dv%+nTNjbDby0tAnYLpQcft60U?Jq4#m;zW!CPT)p{Wq2E z2UT0pjd}1F2?Yt~-#*x+nQaBqrP2A(l6B!UN5Vc*Z?tp~-@VNk^CiF}yds%v(4bP} zo9CF?_epDGkaT~5;Y7O&C89Raw6Le@<45m^F`O@q+wCcpah$fw z^AVjSlqXQyX7-T6Nr= zQDQ3V!$O{@r(Z#Tbb0x`VS(S2qDG2Ek?TQyKGnSv&t4~&J?e}fVd3GG)zxl4oIn89 zXZWXjg7_pP@IdvKYw4B1*r1d0ssK9R02nf?`j6rO3|YWIY1FrG93Y0S%*@OlU|IQH z>jYS`f*fYgJev2WW#0f0guC`KGxlAn>~ziNm)b5L_4FOAKK!#*D1%@YCN627QyzG=tsJiIHI5hU4Jb{th zuoejy@ZZ?JqDSO=&uvEl``Xk;FqfW5-|TvW7B7{+xmPPuWtQ&Idsc2fdo?o-Q{dD$ z&4+gs3>6CCh%-eFa)ZYpeok14orZwMfj(9s|6FJJoi;7wodspqg$3n^6u!Z6EX_sI zomj}?gZ5eH@WV(v1ac@hNGD6j#D@B!6Kd#piuyr9V0J9u;AN!*0%^!=816^nQtn+j zl*h9mjaaaiSkfZ2fQq+JPF6yACk^r`XF~GO_+4ZXL}YF%F>#S--3EY`z}F;)>)4zNMi8JjNlau? zF4uNxld|dJ=VWYw^YJ?fve_Y6;ND6UjLR@l&YcYBIc7o9#CD;eERd_=>OC@Up-R=M$u8i!`xpdZN`v@lQcy~b1)_@>J0g-T)FxPRz;pUOuyrC=7YxyJgy zjgPUB4cWpt*Y4!m(%WY49V8L;mfNic?S@Z5Bqzrvb%(|ev%F=rsl(u3WJh<&r{i+7j<=NyqmWUsd)KILFnC?A+D9Y zHHooWf$108(72dQpMJ?C>CTG*wJwqGr6Wh9bEs%V7pD%2r?b($fS~)(?DMP*?Q7l58rMlkW(+c zC+4@lV>f_h4hIECOn@;!Y3#?}y6(FWdAI+2WO1_~%Sbo?03>HeGp+ttPW`MYm>9`D z5a#_893nb2@!bIsO)f6$I5^+~rke9FEuF=i{Xp5Wrag(l!9mQyV&{WfEgi$t7vJ}^ zWU5>(_g8k$`j6AmDQKUq-#F3yZ;bhu?m_nHrFKry5+@MI7g^UsSwe_7q0j zad*k{r(PLk*jcm%)ssvj3{uViQj~D3>gKo4$z!E8=qh4THubTCk}n-nowP%}vih}1Cr0|Jv;$mN&k1V562>`Dv=&?uFvo>Vh zIWfTo%y8_gDrx(L`L3389-u+_B`XCe9+ZvXLQY5rX)#!*Zxg6Pg0z^e)9Vql%JN5u zJq46=Mt}IKldfJVnulS1H}SFA!R6s67g3t5ELKp3qwXZ`5cr(yCF=YW<4EZfR13uw zAar{S4xUuptzi!iL(b9g>8aSo)( zJ(OAy{WPWhoA+-}`3}o^p13FilMc315s;u9g)0L{C}{Hu1Po>=*uqY{Vf%xw<_FWi ze;-EQEYE@?#xWrr^g^^z!D-s)OBX1s`ZK{fd9 zYSfv|$Cmn-9pJ}WyXqY1d*)&@`6O?zk_hcx{g{hjx6ZovDf~acoB~*;J=CDIVfb_b z-=j;@^}V*d{eQomye;|wTN>5pd`WcP!B-0yHj*<1lbn*M2UP3p3`9ce0_^aaJFzpp zE5p<8?B_!gekBo5g*n_;6NE$z>CX%+|K+*hL&=du_M77*t)$f3$rLI))2MSH()32m zy_^OOcO8yQ`zmG&phlRYSm$NK0{1!ZN}Yy_iM%GEubB%G!jN*M>}Se4-mFlN(JusJ z#`b2DswH$xjL&k{Mo$_%^!Q$4TK+Kp>-Xr#R6?N1(c1f7*ifT_AXJ#AM1j+5zJqlc z*{oU}B_vq~OOLCchzf=IOqJoTGf>*Rxchtn@z0^)s`~u((43v~UhgGy>^CL!aYBS^ zFRPapbgib)S=pp!QrWHMSecB$WqJ0a1$cN)%!<7~(N%o=$4cFqqNH-=jdDrJIUfN?(agI*uwhz%iDRyj{Gcvk_Ck=vW9h*t7&UW>yBqp?JcTXp8Nk!~^um0<* ziJd(jEA^dhB&qrJwv_FELrW5bNdsycAJ1jVUWbbvg-Y8QMgc#Bo`Z`ES>2omEfIrM z#8A4ZIq*frTvp(~vEYL#^H@_eGl0UOYrnm@a>k%hRUZ8EKTPWx+6}ge$s<_6O*1g1 z)u)%wN3$Z4%zvLRK`1v0RpPE1**8t54601)t9r@EU6>k7kE%l68+f<#z^CUFsWcP; zl*Fwzsd-^x_623wq`(L4eDB{sh>GcvANSoi>}U^;e3TX>+GYy(J(mfE;ut+^ochr{ z`Qw^d8U5qW8)3+EO$?;Wuxlu`^sij2k~gGMUDr&`NT(^)0YD^@e@kloJBw6w>#%pi znUyF5|4<^U1DzMAil|mp;2-BAEfU}3mM8KH0`WIPb3lrFQGb2(0E9lo%V;XXM6c2(1SMcrf;_cm^ZO6mX!Nof2%7H&4bx?i4(|=RNd2iS^ zV&uc2i@aa0s|Im)peGp|hFakXTMi!S$KHJBTEG%@;rGpi>4Q=EGd@g~U&|^a+C41* zDA5ZwKwO0e-g5fQ6o*&Xs8%=|zP}7*h~d?$KOPm3@tu@n2>5bu8R*KbdLL42Qp+Rr z7{+l_VQ)Ncb=8N>WANPL<{{y}+;GXBcqP-!SY{$ev0~Ky-oB1c=K{Ebm}$|I8`B=W z#gaVLU?+}#JJ2FV5lH9|)9ZH(NA?~Nvx%7Od4&$N)`X_Z%7)vunKK)(ik+F!-u?B= zL|=b7yw^(h2i>jM_;8HLxz5SwSuio+kGt-Z>}7)3(;R{WmeE`?XI8u!(+)vvs|jRo zDL_XbUh=w*Gja=hGyb=1OXPv;r%^^Wb`q*1#K(2cXTe%ZFr+`Pn1K>jX~N%Ug+g?r z(FpRZPp`;OVow!7?e9!MFFL;2h3H;x2(&lyJAE1e1c**)w?$5D$In^JmtxYc1gwnK z2JB87e|^MiL!Y|IYoHVG-7*oA*eY}ft7pd%7?t*q#tZ zqYjX9y`O<@HS%U$b6~Dd+tnHT@&1Zg( z_9WR*{IYA={~RZC0V9faYGv*ZY>S89EKkS*U(E9VCHVipvK`*^XkcF(VNfp=cUe)Y zmk|}kVfvfayw|w>FSL`=;>TM+9_?O8w<@X316ooMK)v@%ksT%8A=|-OGNYy3pp!~f zb&co(eZ)i7N2J_??+m*)G0&;J*fCpT(nM<6R5(-p{>Y~5$lv>Wr$!Dvl3s)L5|`>@Z8z0g4VPX)iUlg7Za>?6=8|s8=3sM7 zj#f%EL=JB^ku{)=swDeT%UDAX#N!@mr1I?uHax~BBT-_&ysPnZp4xM%lAQ3XudJka zSHEZgXmq4Ncu9%!>YUfa%nUwLC+c+BMZ(k8jN06^yq*UVB*k|l3Ol!z4}f=;pLoTY z#cb3+{MuOG>5KP7@tYNt0_=5^8oV+Ws|=~!#nok>ydU+;Zq_gs0f{&yu(+=bq8Jin z35oc+Sw(z#Lcou>BAVk&mHC)ywS}uJ{w2!2BpAns30pz*zE|h=PNRsPis)zngI7y6_t z(OcNb227@|TiHS^?B3xenyW!8hFqYgU$f#YE;m5SPYto(h>yX|+9?8?i%aLCEx?z8 zeY!)Bn5iS=b7g;}4<~2Pcq&M&?yMximzFbsXkp9qQmFzUx$v*CPTJ=iz3o2mgvzSmAvPeJs z5#YOe-TI)v9k@YHwv^-4x}!#};Rbi5V`HstdA${u%^P*be`D~|@|kt+2Tne3F>9ZA zi|o#nu$K^IjDwsM;v^GBz#uG?Y5n=Lb<1tw*}U{{*)r$78{4dLb@yWZcy8ccb;vdAo>XeWU#4Ug0QD$z%0xN2(TOg}+6%hwlA z`Z|d@sFxIX>Ln}9C3)-Uif=}X7e-t?=45UCwTicPm}{bYxd(i2CM0|(jZSB4>?X@j zf7J=Z@cvHH?=dt-%{K8OKw{MAzo8|8d)IIdGzV0NX*>O=@CP}VU54o-B9-9TB!7QI zI*px_MmJNixi}wRK3*gZfgH5wqk*rmT#oy0&(y>;1ig z3GTc^&0+g7S~DLXpV5Vd*!XzTle04gpO%&uDmuE8b%40C+I^d*X_WEZX(y+Kr{m8< zpwkGcsiK@`!S`r2>f`hB&l@-g=zq?=I2>6Q?Bs&By5HT8@)9WxU^qCHzUS{^cNpmD zyL(>n_HOeABoRyM=ashL3s*6mhT7ofEN03mN8?RmAP$Ln?b`c@Ny+f~Q3ar_&MW;x zXLrB$>GNq#LW|L+4??<#R|{4VC|sL{%VNr7q0?_hC(GV~d~)$}@gLbuz1#WktPj?m zGc%wlyriadWCd*$eh$|C3H*)}l0w^49-*x<2M7vE6JdgPWYxq^$a7$;%>5Qtx$uUk z)wUMDhxu_B3`D|*sG}m!D`@9%h-hacC(lP=`*^1BF;WvT%*JG9a-Qu7A z_n=WW8fQKfrF96$vu z3oNlTe`Z*Q!+H(+E$rS%1pjLky_7HNTv5&L?G{bDvXd`{ESolbA{tfqNtEgbD<8f) zvCTabP+sx&k2y4(@~blTJ)#oqfK$WmLp#|&yTOXBVzGB8DeP(k1|;+@Q!Jr%@0WWT zT}E^|jWFN#S?90}Kw`@~RhB#l-4f*W2q?ba4GHeR@nhL$QpbQ@pB*oG+SbDhGM{Nd zxAJ04-yu1jk2Ne1h~Qax2_2dWz=WD@KNu;0Q+r*(wtjZsRHTLJV|W&Rog2n6;3ld5 z<`#R$%bPq_UDsYxwzKwlw(8eV5kIAU0DA<+Fb5OszmR_^SBgE#WJghG-ik53wMCVYKn^!TP+aRRzbe2j&+2odN! zvl{mU2ev3!NqUVo$6+j!rbFT+NNdO`?+?KS8!G#kcgW>38AQK5=;vxi;=6l7Q%Mq$ z@TL>-^RK3c5(Sjfj_b{F3jWf)emx=J*{gVzpU%?igvYs!3%t_VZG18P;4LqoW&nR{ zg#P=?J-mR!0+FR9o$BQ)o_C6qjht`SZ8!FcFew4&%Cpk7@DVLEeK%WztE1`J=EoM3 z?KO()YhQ`O9{ibu%cf)y)bHvWP5!!zf%GV9ru91zu4!6n(GM}~nH{G=faWXIp4LwE zj@IXTK6u=A_>y$>s<`QK=Wo}?UMtR4EN~3O=DA~qm2qx7SCsyPAuJP&9CXifyMY?W zT6cFY=%Xsd)iMT0e;TQ~IV37z@nmNT7ZDohKGPi~Fo>&0?PtjkV#l{mB!Gg~K|B$D zNt7sjAv?J@6k{{rbAsA#PjyV+&hK6?H1<oX)L$Dcq-4l0W_Y19XgkLy7VK=FO6=oTvFxXrjjDus z-{=Jquv|AF37*Vsd{?f17>8=YoN7Y_KzIghD+j7D8Vdv_nD$4>#DD}01-Ag%IC{+# z4Y8u9NU|h;GkQ(Jlb7?5*d;YFhMg1GSSCpW!D#~dlZ!}fGpai66I_8ltu)R0Sr{7p zT|*5L>swFh-0cpUZ>+n3i97!eESmw`rL33R0dJtk`4-yOFVx2J;dhRO8eKs z!@+a$z)2o9xR9=<&)8K4oM)Q&%Szv7bWD zHF^4a;>rsEC2Z~OasVb-8kXGe%6S_8P&-&tMbGZfp<^pD#+B#a{2+9>0pG*!Gel@%wwV=n7!$aV9_QWcE%)WWY_Dx)R;oI+?Q|5#&c ztY^v9m@DL)T?>njSagxFg~U=sFo9-R$OLZ@j9|k~A#~gIJ{{DQR73CE^>FS((oW@S zXw;&HDUAt;JegF%07;6$5yTRuX-D&{@-2!-e4-Ze1qUsT zg>2u3M85^UIgPGN%^a${TgwFz1Z*jaV)kVuSxs=D%u(=pjg5xBq(hAqOluJF%^6HpZ4z)m6WlFJDc$X&XxS1Pt)@SI zyG@%D6}Q9VAqgG4jJ@mIf7cawajZNzxL!fwWzih=she*9O2^RaTkDMjsrEt|QA_fhzTxtfA-A2rcf zxA7y3fD6IU)zPE$yJhEQA9Hr2rf>HgcS|raIBONB8Jw*GqOt1IeDB})C#5neLIuCL z{OOszr{GxU)buSiC4_A^(RM)X1W z(1q2(`k_;nL2VEGTGKFBewivkO<2G^IAfiI=sZ?e^=#!?G?r76onkt+4!Eq{e3AgR z$KY1(y1X|L^;FvW8hcI&X#(*^Y?k%TQCq1hYEz2fx4Lt}d5CTKM9#DEpr-c@2Bl!X ze`kMwB=(uEk05I3%j4lv&>t%oo7ke~I59Q7(}SxLZ}$J^1(3B1TMY@7dl6I2SNqWN zOE7#ZvT{Kez7V`(#kyZq&K}ovL~YngNB4&-we^s>puE5xAzi)?X4vtw_+nOonKg#m zi>ECAG$8~Z*etGnOf!wL`N}i2hM6iBB1t~hhI~lTYDm@Dl0bxOvBnG+f8euPn@w=l zYvsK(>}<4g;?jd`@SrAhe#Ctfo7T!uXs;v`n{s3F7%(AiLRG-ah{cH4Z}eXGN@VO& zYU+^nboU$MV#JUIBu!}R`$7034$~o4nc_8(q5nX|U|egf4A9GL0yvHm5)!Bw7+e;s%7J^v(~(v^w`Qf0FI715nh`&Lw-Rj+&xPIVeT!_wPEH}=jo750L-3s(rH1K6 zqE)inAwqv^ABd10r{zCfh0twoH;fx>+vQf|*G(d!LDcnT!+Z`>B3n9wlpC@vy^ZuA zLMT#H=?he`H5Lt|u+7e)(;MX+HkZYlR=6@IJ{C0DnJ-Sfnxj%{e{&k5xpk*kXvPbS z^$pvq{i(`sE{)&55E|w@$_)lo7%+MZ_j~yuP&I%-*Hby_xKSR3sqc0*FDWYkG((F=jqRU9F zrE4VmSJEOGhh3A@;gLtEQ=ewXdFh~Utj^>!VA}}8$7t#RDPOrAiFT~w?2M|9gX0%R zzEJ-zYxIw|nV_KA6E>$cUv1E1pJBziRQ;&KwneIWF{`h4(}S4G!08Vo3 zRgYwulTwKQ%ufo{p^3vge|yrl3!`<;Whi4>&q-8w3o&=Y_X^HtoVd?<7WXv#JB7Ik z|7dyuWlS(v6GdbE7^&qR)WUofgJV+(z2LEUZN{ti-E(fUxARL5DK$Awf}LHJ5@omO zmxElK0~J<$aGORG8Z~!D&YxBBMlJ6&z6lInOxqYT7y7Af)5t0IXaCK5UKihhE)ozm zK(wHnHpQ-WgG(-rt(1+W)>5 z6KE=kAey2mVD_Kkrx2?JKQ4j2GZY<^ar2d_$eIZt{C23xRjGVe z|D2qU3R39y7xQdZ(Em}sAhBjDmX}gooz>V+D=#)Cv^5ON-CLjis0usgEX5`dR9Mv) zIv;vX#fUYWVq@+2bZ0O6_{A^>Hzd2kaFevKsExU>_mZv6QJ{+e_ID*xx?~8n45NOf4+B?sjJzs=yh#Djaqkw4T@ZYug;|{%Kor z->w{|e>VN!4X58k;|Dc!ijm}4B$>fMb6-a#5Q>EV+oSLwt$)5#QRRLg@2j`ZDG*_Z ztBVD-rw3brLb^o>r7%RtbnkS?qVHzkcgeRBRJQ9}DgD~P{wwypLs#JiDvdP|LGWnw z_t&=+G~5O(TooZgUB9ZoPb?aj#cXqOop#%j@>1Bsz&!c3DR3p=FH;Tg(dediHloZe zRWZ!VbUd5XATEgKXeAZD!Jd7-n8KY~ahXSStGd_=E7=-}dzIPRgS|YF2W!XSfGSKc z2yYCpT&y5m}w|@O1KWVf0!=Ku~ zMM&+Tqb*Km z-DyLpw_S6CE`21=c;#XM5}+3Vktv4k`or^C-Ls=1?u||1iyl$C`lFvB*XTT+yHDbg z1^L^lUX3wQBYe{4@setR=m*YDhi*eUu#Fg@FUm6c;*zlThi$^Qf zj!+noC?|YZ^q~`3ig+tuV?Z<6>9!qPuJs=ut6^Tv{Nj& z!&Wr039OMF(9)h{su22E`tE~kXnjffy}*;IackYIwnW=@#>kBPJ z#G0e?9+Z>f`ng7&qn7gJJ`u+aFRSu!4OcTNSnXOS06utwEYd-M=k?0bhJoZ%fN?fEXViP!sHxz4-Uwpkgv-9*qW_ z?GwXhZ*OlSeq|?W{?=TJm8t$MFQ)%>{ihxK-@P`Qfr~ekUlTQvWWdDu#2O4RuT}DI zV`gi9%L6k>(}<~`Q)|$rw6yFd71G_K%@bhrl+W{{9lb-zF9Nth$g&yp`1l}nXyciU zK^UHBf0owdsqq$>TmgzD0K3~PiN{9c^o!l!g5}jM;s`x_>-tH1m@s*nr!9XBjO2g{ zF4;k)e)m)53koK+X2wbqOpT;6$liXs_>g~wyK>^P`*j!qJ`kY%3R&Qyi$UsYS!H5F zkc@MK$=sKpr7X^F^YS;6go6G2fwSJsOh|2tv-c)9c2gj;xUPc5bcO6G8Y;p25k`sm z?#T}|WuOPiqFH6v-fUog_@`Og><1X6hLHOLAxYDbNt)RK^b`ITCpSmJ`z-w2?M1=d zKaYy)i>d|ZujpI0(qNPuR-dD=NME6FjPC2brLV^<;lDW$WE6`jUYJEaZfm1o@cp@@ z0`iP4!}#74zFvv-z}!*4iDl0$GM#kHKo4dRdL{IkWFJ}cxiMEj&{+CU?p^j-&F*#1 zLFuV3mmmx>2AzzzO-62>G_wH<4{P7Kj9^wJXOAc5J}m}Mwh<`CNbvOuw*{7XFBMzz zDt-N#*+dvS6gIT3>?b}&tZq4LMfaUjL%xmSp|p_9^F%H+vExftfA;UJ!cfY>^_I=7 zU!4k-M0jP2!uQw%-4gO1r5e9)2HcnLR?E4klcc@jWBtFSiv5CU`%C)xhH| zs}m=;A^;v{$*7rpsXwUU5ZqM$$&C=yz)PD+--p=r772aC-CxYn2ZGqgoxSE^PYWUt zb6B=}NX^_#WE@EHRC4)Hm}#<APJVsa%HX#L2=&grbWz|vAM}v26tX?;cA?{80<%sI;?9x0g6TNlt-z{V7_qh| zS&ff{ZXzCi2j>b01>p)D_?xfJS-{Kqv_qi^^Re0>(!)w5TZwC>MP3fQ)0ZzlxRKyr zd!}CeKZjj-N&a$b&E3GcaKKS=qI7j6Aw{K#PFUUhK84dBAjJg}x zz&X?z{25%3!C)?Hgp+3+&Azz$A{}sgIj2J`R;Y+4<7(}_j3Gyyjf1@5x}{hb-4N)N)Nsx4WvJA*Jhb*pzO zoMQm-TW)=C>^a$-@!;T)1mkFT*KIYPwHNE*>lzWVjNy-N`dj!~sbulsBd1yv;(ein zPZm2oww?t4{P?xIHTx>~t*BBvHWzUz^CzxNouIs4$E3GeA+n4To&$>YvzNv@VE9YLGFE0hb{ymTRJZSE2 zh((rM!zr8xtk&bGgJS~%i0<|NBRJnj8tb)76aPwFR12p6z*XOqCApljVJSpK(M_%m zvpeitq?z~7lbrXUc3QE1VZdB%zLZM)Du%9jSzT5pT0dZ&PRhj#yRG&P3$ZXgD6ZH6 zk6ZJkIaKH|nef%#BfX`3zeu#N)u<5BwavB~sn@R&&|Ex`k z-%N8#Ot#6J+Dty*{DVUQh90la=A9k@Y%7!OOntzpZbR!}&Z%!Mkz&{$Dc%F*JQtHd}msCNE$0 zcq+e~rZE|}nMaT0A3h?fmny;53!UX(=qC4;Cu?T1$L&K*!clVY9ByQ` zV`mdF$y>TR19V$Z=`6bbvzU?KD#36b*825*;l97#SR`v(epU%zj7RQ$o6PsY$E+Dz zNEa4eAf!@V4!$nZ!4Wt#Bav~AY1l|tgmm~KU8?2cb=vWB2n`oq6G|RL|CD~*AJTd1 zNj^TdI*!2NR#hMAw1XocK|*lVKJZ|XnEeP|&~_DtnCN{jpI#qplH`rG)Twsz z3Nai%6V@&bCZS-hkpxuD!f*8!4=@j{w~U2#4wDmG^NW6AAm15DHqf6nk2#5x`$B*R1e9dCV^A>Hd=&Rc3vq1w~04Tda0UH&27)*!6xs~CRn zc|ME>B<;e0V4!Tq!Zf@vXR)t{hjs16uOXUYo6whkyyB23U01FI*Y$ZOrd}948`-E5 zX*1aw<2%OxVFd}Z!fn8blZk8{<7bR&SjcIm`5fK zTN(Aji37|i?)BPU1RHy}72NCH`nP^~!=Ox5ShNN#ECjHLUrbo$&=XV^*)B_a zxO(S@VRcpy^0v*xqT49h)`Mn`>uu4DNYU0t`oO?Rt|BdPB#n{WF+1{5=8& z3K~l{rRZ~gCUHQ3O{Rk)Fo<{f68>zYdz|N<-+Ye*J#Mw~e5O1y`OPj57~K}=$qVyz zTdKX9C0cZ3H15(W-|q^)J!Hw0dUNcPW8XUZvR+sLg_G?DP}-M%@;+%c%31&% z)Q6WpOxBofuMtRZ3tk@%xn3mP@k4|3=mroxt9{slarhhkKb#HS48&Gulb)}c*RqYY zJm;mGG#o2UXTLNDYc;sUJph3W$>4E-K`e&*6P&=LxI%j^vlgPu{0?5k)0%YoVaUKw z$uA!}cPWx+W_nw7V6Z2a3eMQ6R zNA4{m<>K!6Pe1h_r`R)ZIXotNS4a=Y60{+RbJx`wCc50m-%LUkS%HNbT${ioB$1JmV^ z-DOW!{!Gv*iQ2yOl*4%sTnmLr1di{TYif(c* zjC03yX?<%d#pdG6Jj?BtD@0(l6fAZd<#uU~-KCR4dpKL}n`Co8 z^a0032Kb16G-8=B0r|h+{Q(&Z%EG~kn@?=&+PG!HramxeQm%kUw!oqz6B}iG*gp}C zx0<1xh%cUxncUB`Ln}3@lw*TOAzcXaIbwI3H2UDkI;r2;WJ3noSD|ltG$;_?DXC~m z^JK?#>8V>@@PWqqxE0=3Cia%x_23LNyf_)ZaPpRC0#PKDKpqT&$z8}(O0c{^*d(bY zTdf3p8P0}jYQ|Iey4DHL=~F2{6M1U#?i#zx+i~AKRB5_{u{m8hd+0iADVDSQS3F)@ zoC~b9;$qNB9-kmQqo7`M2p$QD={MB_3XSA<%#wP7v~Gfml@3^LB%CjxR9}Wt2tiPq zdhh*2Q$8g4E8P~q?~LWH*OjG%*T2^*2Y3vCy8Nku&e+?F+R@isl4oJ;L-C#YK~nP@ zq}(e?TwFAIlhfR<`!*5`E5N2KJoC;0!HTgdEhMt3>zQuMZ*-2swK8%yW)=L47H2b; zM5P0?1KE6p-)-7BBOzI3EScMk<8;e z6#15TZW^-;G9xV9vwFp~|~bzkO?o z*7aM}f9$nCGwn1vB_IPtN&BDg*&>2sS#Bi=ro)!u|v3l~W z^EUjtd5N(8e(IC6TGRdcHnpEaT5lc~(YaBh8@L!@5CSh%SScO!BZW1>v{4lBL5L zWRw+t*&ughp>|Aet=NB3*gNeNi^>HlpR zqoX8%^~>qzbP|Z(K<)Go09X*WSE{oltP|*08tGiy7X~nw0uBF|%fx>)1oZ=exa5ap zh5>5^Fb@JNp{IG9KyNg#du&)bIgJMPMaRUL0k?E+Zf?Z94ww`a0f&JX2zfUAuKKhU zApYF#fACX*tY>!}F%*L*5IT}qzqaM;i++ybyPxd#cS{FTS!7clzafPZe`j$hEf0Kk zPMB7SF0>;UKMnmkrp@kPifYV!W9D)?z(>f33Cc1`EM;v|4UQ~Hdykx4`*r#8?+^(E z>1oG9PZ`qJCZzj(=9ecO7C({^jelNGl_3atMpeQ0c~*{SW>T6uyohmWlsp4%n4U+f zsPoR+A|hkb_a2U8$me9I97&ANC09$SN^?pw^|Es*I#ujh!a)W=F$cZE_a>cUavN!-Q}{tu zqv*0TFz6uykHVgK00$3?aUsCwQAqr#SUYSl6SS+9mm4TJu2po!k}C!^#FA{K5cf#6 zcLC=?n@G$Tsjb_^-nzC^3OQy6ZgDmcbd8!|?TflO*W9DRfWzA7Gfpp!@&A#RAI7EV zeZdDiV3-jvQ7jr;h2JICByK}R)_@g_DNS)(x^Y~H;GL}t>1DIxuSqoTz1*$8Y1fnT z{;~$7KiAzrP~*TYX+6Gr25|D=X^8UZi^L&5>i{aC( z>zMQ0$8YbQo}YPqcPwyRC$o0><8mMn+lnxB?`Jj|wmHE7X{}QjIr9Qb!IZexjXKSb zRsvcm^CnIGe8OnSG0(+o79 z@_*XgutTRFpO}lD=1T;xp;lk&gs_5D!&_}s-iuHRwSulCI%vyVbyFFC!DD}+=*)+m zQQ}b`3FCT9`dXKPEnH?0uBTDR2D&UB6x(~__n<$oycFykUsSy={nP8sC_T7j7F!9~ zieYN@m#0@Az|Qf1&z?~MjSvtuwWyTzbZG|%EWkKN0hCAaQqTv$un7EV+bk%y1~?vW z4bqrbHDCt8qeX^@cq?>5ydH0T!j!NbDa@GO6}H-K=T!6hPIEOEMo@T1H@fjLQXYav z+c^+IA~@&I(NaG(QK&Z6oZ*(!jKQMQ0`^|{&qb{+pI7ckgk*Nda0BT5JYgdRFb&c-)( zH<1fD-&kGlL@rF;JUiirNU*kf9h{Q!!P>l!{)4^EC0afzKy&g@ zRXZUvdu><48L_-0B$i(~WCVFIX4V865E^v%0fRy1#X}Ds_kL`C!-lTUTcAhceWoX8 z;kWI|sqA^TE-fB}J9Ael@U_|O(SG|K@D}Mlo#r=_A#y8r_sMdrjYz9kG;Y?&O$45G ztwS+0{UTTRYBTfJCwWN&OaYW9v&vBsT&$j+l{`<(t^%r~%z_cT!iM5FPP&x%qn17_ zN*_h7=dF8`b~qdDNAH8f3#jjxo5{k#x1ALmK^r@E|Az%onffWh*f6*t#9;ltxJ?*Q zA+JnlR+cPUuKEVh700Sl#rpryP}*W>2P!7%VDS(#?kB})_-pfM*w;t`u;gVwtcx-ACY1I_C(0Td&VQ)G!ufpr-z3MC;+5XN- zs3YK!#MvI?CPTHFloA;Xb+=&Y)35k2x^%mPi-f=UF4V2OSFO8h@CvD*X~~W2O*WJR8Fn(JQ?x2P{^Nxm*HBsy#&s~V1`F0CY z$AgBPi=U%*sf*zhA6``>5R|&Lb<|rJV)oK0X(H#)jt&AdPfz&TT1(iXVb9yi@$m-? z9f6Q(W7M*-@aq>t4rGJ@5b2|fqaYx! z)j({fEB1z}UOaoZ{g4?So^I)~xRl*5?+9H;BbsUBseWAk!tp>czKy1xCT-c-KvvG7 z4*F`q0JR~Ob;k$DlOK5XfQx~6BKZFnVN#u9ivb__ygF~<=0i(Mv`XE$hhUVLj*c+{ zz_5AJn)QKKR=$OMIQS>Mj}=f<4QL6vJBNooKnyH5pmb(r&;gU^Umt~^pWpVr+g*7i zp`@C`Y`tK5_}Ww30%a}?H^jRg+9f^}4+akGYPq+nzs5ySC@>*cO4Z{Fo=HtSDqxA; zy|DX91MOsmo?3?Bsf@^)*deFdp>=%exb`a3c8M+pM;|_-YC;8?c?kCNP{DY77wCpy z4vYr0%#2*8%RWzF049!A4fa?5jn$&XU!6j;%eETYrK_KD^jkxkwgCiLsGRBbmP*e7Jf8xVltVW{uum@HZ zcv~yeOe+F)N^1#=tlosaU_hWy)RE(z$~4 zP5dA)-&PHO-(Y#n>)`ZZIWbBYv3QViSdvy)>-QG_2d>-v1^d>@u*CSg$VB#w3Gw`V z2Z<7&5RA(^t(rBxhwR%2y+^oO_T6djmDxpKg0TFTO@XSrC#UYz3QAy6!^t3mC8r56 z+&7HHpPzK;%2a%J_fh{#i?PZv`_h1@FbcnzfbX^~fq};S&&1M)n0SwoL_2-F3E%}g zQux7k_o-?uz2APFP=G<0^!+7&?f#wDZ_m1ha}P1TsM}1heme;V7|)2C#OGp7q(kW0c6wY7`jSpm3u(S-Deb%g_hAr8Z_!pdCXQCZ35ale z@0tNE1IM=qk_?kE3f9i=mNQ3cny^fU`Y!on)@@YIPo#q^_+7~Hj#Mm+i$;*jt(kDZHnp>@&F|#Z~%hpj4%O@{0NNA?}EhLGy@PKM&@UQ7LQDd<|Fy}Yd zBKa0taKWRK8xeia0XgH``2yfpVEG+LS~3M5Y2aRQL~TqVAtLe)z#;yLkUE$0tQJ)~ z0l%|}jgM}6mvza3b>{!J6O8{YEv4SX`Fj0tOvwLg@ZbWR#ZCYz{&uDu3}_9Wzbks; zEl3+zN$0qE{>Z`c@Bo+pPiKd!1TD}6x|$7H=CLvo@zS^z2ZOYr+Sn0`n7o<~1di~? z)^jTjz-!N;Ey4dZnHAB7qDH52+CK~B-49u#LTM|km+^SZ)_+?OR6gYgWtF6{I0<5tLs$587PfU-~&x1bL8xwoVlL# z!lti-(Yv-XVclOPVP7Qi#_JCggi(7D8q7Rb4^^_rTUV6-n@5=ZWOgc>M$z;IZjWEkOO(Rk2H#JR1d-yQ0jwfAl#Df=Qp0yh|2apY4$$>DI;QY6fa(Y+phBW+j20sUF1B4EP%Yu_tMwQ?kHi$H~VNz}-q~n01^a@L019uwn!)Ck-oo$^8+V=`{fRiCCYh z{st8oKGrf4i9K&Q(^ue{I8H6g^wqQ@q>{ePU3niHb2jF=(o`4+=e*M!^S5Tnj8VaoVGW6+KI0$9DUZ4?b|@dNGe3ioyowL< zxmfT^zWSvAKV=`oUm1?uSafuFBEjUJ_i30J<`+c81AUHkRKQ$GMIr-VqMG_5&jR~Q z-fE1wA<}}H*H`wo9z#(ub)CtQYG0!t{wn)<`WRsJ8yirk22kgK+7JwpLaHaOC=l?Z zd)P2mL%{T67ee@SH~8(oH84S}iSARG5MgF4=An;8z)687@sOd8OUc!1cJhqu+bdj* zh$Idy@7Q4xOE$bI(OWvXR1zU9i&{hbjm9L4b;z*U(3+bsyM^(uOZbWZ(PFtGFY95W z$TY_rOjb+mB_>kPtJZ#IkT~*JVtL)0kN=>AA}UuLd4WCR91RhSfBaJ6%{JTAg6c~l%#UCSbE)A5*|knB~}BP|Hr z8B+kGiJ_naz%%W4Wi!GLQaYDN)bnas$VseqjpAS3yHw1eBw!{sFUSqAi0 zDmcS|DOEW#pC7WIf+ZK|DvNxxPA}4e;BTE3&x4DX^^*;#HTh=HWcqf*((H? zDf*Npjef?Nq}nJRFe}VauwXFO8YKVZ-EXK=A=S}=o}%&s6%Lo){v7^8m!Ac~=aN@5 zBG@%$ivDi(#yWmthzcv3BS7*)bPC0z_g(W3^1K{mk~Q#-+^E z*oE8G+x`!_4Q_YyVHx0aKM#Bd&kgt@kl>5(*$|n(UVgmj=_DE}rq&@dH+R$(o_Aa- z_;=OpJk$zAr2`*ZxEMsiR5gR(N_zRLJ;mQ>gp*Y3sMY5vVTbA7KL2A zk>!9Pcud2B_&A|F|Mne%K-IB#KoIXgMU}p#kd~}#qiQutnQK{^ z-Z68RKvJ{AuIz1F$C5#y2QP#5coSp+DZ~sBl%=FtPYvzcxFd2zRf8cWs=dbIiD*1U z3`#CPcFOpQR=iS7Sg+{7Cim^pm$_2u1lfz+5#^fljuka{Mb{{)C0GVJF6dGhzxp5 zJP{2|*K!)NAw+{GiaG|Tg^VyUK-sj%>5pC@w|V2pM)yO~S`Z9Bp+Z_4C&l0g-+*pK z3@i3NH>!Q%n&L+=xVlEl8@b+uQ_p#!%&4sb-IOr@p))a~;S#$|xA4}LlX;HT8Jo|+HIUn%Cy!9@V=#8P)U8z~O5Hv}5%W^$Xwf-4A&D*yAE z0wmPVVmXxkBd4~$Hil+Wpaqq9Z59kOxEw}Evaf(O-~JGiDQgi{ zQ+VT9^69HBPP=MHMP3V5P@C$Ze)yH5421gapQ4y5bFPsdOajzr+jGF%xSq3@vuy(l z&RtKbcdHGRWIzKnl7tl2tX(@!d(hW63dU(x@fcDt64g@Y3e9sOzn05^E;R(%LsV-s zD5O~f6EWf!9yLVen$^L^#vcly-zAYs8FmaQ;YUe`i5 z_HE~RFrilL*FwIDh|+%PVrdC*B9zKel8N60$s*6Y{dmmI7^z}mKT%atI<4lkL8W0+ zg;QwfX5?kNT8qa3kptX(+ol!>pz{G4Auy!N;z8_Xo>n13U*1w~_|o;H*0H$yajVz8 zsNm|tZPT_*5k~hau!bZ~YtVH%OKaf1Q68_o8Z@YNam6RkI0R|j|K)0-H58WJ=&@{h zRJ?qsKCRSctU@xhc3Sl&u_XujH#O`isO3i8Bu~4Cy2AjB*wYISkK-_1&M|D3?F2N)(Du3I?ZoVV|2&`A zd+oS;j6UQ0$!6nnusW%=Vx>pow$nsUr3o%1byTu?c1Nf(7Q zRmsP}{016xU4FsM@zA6-FoDG81i6;sPKHcj+JLt-y=VpTYPM;L{8fjLDh)y*BG-^h z)T&`7Q$%H=~M{5-Y zja{%^bPO%$Woixn!WprrUkYt)rN8(A_a^*mg+xn^yA z3&*Av^i%8Y2?NxQ_34YSI5CX=h_)4)O&LLA&dx*aU-|QL6#ZR2gLW>lx>+yDd@R*C z5B8b@{RD4Pwvr(S{!t76Mo5cF^Wi6-k=dsIog&VFwd4kHl*svzT>SwK7&0F4)c$MZ z{^}a{PnzJg-rIKH+_J_)fZB7^^@xK-qbnZ?^WQ<*Y6tiVib{lT%w9u~)&%!CUknC*%w39=O{QYC4Sb_E@)pWU*nLrccP9Yo%J@Kjr8h$MMMvq_=%@(u zQ_irkSs*He`0sw=XC2wYp@D?6olaDj%Hf-=)&$G=kQ41aZjObi!nKJ+p?=eR_^j-? z43*LAU@Xe#URy&E9Y{5`X*5z++hWwz3p{MUdyXX8rF;an#J&j*3|IF-x`!w^2mbYSx_o;nNx%}j4_*InAR@%h%5a5@vM zNCC&`+RI64LyP`(^YZd7bgg1q#xQ4rk&9s+Ghi9e*CKMIU;=`%vy0}X!>{xJsNq|F zvkzW1vwXj)3IPW!v)O~{{tUOLqPZl9-s=_yH=Kxx;&NQu2-TZIie{R*Xi+P?IWGBv zyKP@&{HAUZC}*&KNJ{ZFO6F|gjgx}2z4Dhi4&_0Md;QL2X`J{Z_V?G#qFA7d)0qdp z-oG&y{rX_@0iI+J6HCQ|+m;qG)1`By9wi3$dFfP8fK0@e*+*Z^stg-6;)bXfOHHl9 zYrO_RAGhv`zwQrwzWLPG8ays0E%lHLV&wSTZuOK(^k-}{8y%%lTWm8KK!*DMS$+)M z5Gvf%pbuZ{T^tw9I?jm?crG;**6uGp5xZHaC-f}vXOJ%Fd2G?WW!D%7YW5+nkWC@f z&o1esmUVh@nAyRQ=u~%*0>Umom2Qfj6i6&>6H*nT-VEwqA3}2-zHiOQn!#m~!-e!b zZ#{oTclG#3jfxAt*CKpbpS2b|$l!s7g4(`)>BHs ze0!Q#3NHCA2ixi4Bcza)#L5B8q$qo07FMA^i;eUWnVsFkBo4V?FBL8echlL_`lO=M zu{udNKI7Uv*FrgpHo{kq%YjNl3~kZ{> zC*=*N@U)XQIR;K``OMp7BJvkH?oJf6fCD)ZH23rkVta2cMA`q(?M!(#1l{&`zX?c* z#{vc8BD8^E4X5Z>x~_Gm>sK1N-%dvCNwEb$rf9GfGwJWeh0yG5JRwiV2e-E+GXS4n zvsfP??vuyOHxYSvM+V1N$|)-YEaUcoPh3G!=k#0)05yU}x$P+6QDgqoch-0+GTo2A zV~0psM*HI{IwQ^pw=J2pruhAg_S!t(iI@^f;eRLY^h=$#9U@#9X$dU2XPth~y|-=o zP6QTXM}`vb{yO&^jJFvPb8*FmOhi&EPsa!u1@7-}8ZC zv5a5M%9LJ>Tb&2P3dtZX_^c~XqoPmFkd<9Z&Fu${!E88m85P{v!`4gqM@j)2f8}1_hOzYWMhZ8Cz%Go}|+D#H+}AMUN;hr=R4{#~SC?6Ebq4Fj>Sr1@HyrY!!A?~FPk zeQjI|xfd*1@k)uat{P_g6c8^%e#X2I@EHC|8XttUKZByCpIi}^Ptutn<2B!}!+7}> z7BGkT?PxxCMgt>fiz9C=+yN4+`0%OoO`Fk>vG?NYCl9yP9N+;j<4wsJa5|J`uk|jc zO%5=^rK2n}d4s=VAU#+0l?KV7Nnu`Wspxn>1dpFXmTn$pJ)oMl79(&Vf(j89)wwt< zM;F0Jxm%|{>w(!%o--bhdBP*ugA}4~VCAG6g;E67vfX@_XAo|%+f;+h(K5u5qH;_k zRUV-R!u(cSPK6mSMb_@QQ-DkX@t%>m2GXX7Ni(sFu2=gwLBFnn`FQ;WK2P$ zV0eEfkNMOn7R1#*H0N|i!juh|89*GWj)4gJIN`FgLQnJ9tXLVb0K?bb=0@5m-^_vr zG-ws+xa98=vG63`%M?25SFs0D0BpM)4Y19Z3<{ zf<4~VH6wYxqu;-``2A}mg#Jv=~viHQn)mCdDDCwUqe3R(%9d~;_$7&=pX1tE$+IAB|QKJ~l#Sso; zo-m1q(Y$Po2$bR~@6mkziFCDD!(8fXnTv&0Bpd5-<9pdqneJ;N1vM6Wa&o{&l3_X9&t?YQ^xUF6)6XQON*C@rMGzAeR&iF03AlZ>~rvWUB~;9KKsoKOVuyY=LyV;CU0~v8|Nz}zWONp;)d`1&*|9BrS5{;li^7LE*(G?jHi_0 zKD;XL+jzv&9gHC+fUbGR@woEn4XTRsg`aS+H7AI&!2K;Iv>-ci{0j}RDFKP3Y= ziah+5b+A{vYcO6Sryi5jLOdkJmfNw7TkE+8f=Qz1xtgUrRUH%@t(T)WkIG(C6DJ?X zGeC+^u&F=-4!3pMn4fhS<*68Oa~ew2NT4MRC>6?Jts$-_war0OyP$}j!5b}kKE!XHDkh?6L_HPuJxk$!41$bx^TLxW%D(6VuH(K!_f)h z_M-J-V#AbyRW^AeJu1x&a|(R*0^0t}aJM1ptQ`C9^;r;toW!dX$bL#DBUkcTsvOmB zkO8&FKFxcLiLiR1-CDfb8t4J!jmA(=`@oEDw!YM^yHNvY@`7#aBNXnl`_(4JR9sI* z2yL_o!COi{zY<`F`xA9ya zJoB=Q`uKR5YdNE=%-CkAYO8ZxIKwk9_WsoH^xEbBumA%FDXCQ#i7gr7ypDBZF`@aJ z=UcL*3rnutDdZGa4r;q8R(t?0dC9?#QfO1)LfA%56z=8t^i8J;$jeOnN8b!OPiF8 zij+?ko|j4R06u3D4+$Xx#sgG!`uIECn(F1)GU58$3^&r^z22ks$nwN7^2qbRsns_M zFu0P@6P@yC8)ir*Zury0n~J-^yHj=!@fU#-38z$S?~V#5Rt7;Bphnve5?{yqmd0QF za`)Fpy3)D}n#|ls&Y9^qyS_oA0^5D~&JL|f^q~akQ-_j-@c24ui*mKL^OnWxDFE!D{dI z2$cyt_7#E_ccvaqz+^CLx#sDC(Oeu6R}v^gTJF}Wi5b!A$aq#LWY&12qs~OIHiK7S z$xhsZM<;DwMJ#pg zQ>JZKj36g~`a#PzXM3wsZOx*P!^MCHIb{t|ctnaxZam;9x@DUqjRdDQ^xjo*IPLCw z8|0c1ZLX#-*&G2oQ!Mza76a^eR?=cv8)7LZO9DcS4X`$xg1LtKRef?c@uAP-UL}DU z1KmE2e7hyvb21Rzi@|K5q5ilb+HFae$3_H%;fL15M<2e zb{=^qut?0VsUeq^mIlDA&c4K_w^ex50>*&J0+1Y^Gup~vD{LU* zVS8r>42lL)Ks`MvfL8(khza@!N&EWFXSS%DZ(Y+%sH7%7Ie#$*NaSx zT2$IXHCrm)%kat}Uthv4}?QIdCW14*B0kih@8q{w6 z!|~L~(}0&=`y&~-QDFJYd~#JC0R#yUkTMs4MWvm^siCV{4!wqr_pe-G9zw}qJir{u zBEpmJMe?~e;0!zVkY}Kd&OY&we_alm9h?fC)FC6!Mo3^%Kw|Q?{TEQj#wrs8`r&|XOVMg~EoNu#bujlb!PkN|+sd$Zb zRXg(C@(Jf(=ps3l`%J)cX__~QBpPbtoblH-QW;m-d?$E3uCT9U@@8`9s~hOl4_nky z$LKF-m8bm*=h-8@+*i^D?|q>6zeORj@2RLM^lx^_iVt~euWbivFElu7SF{?A^Iqv5 zA9>h%9*T+_Eqb^vb4k{r?b3J~*ZKv3v=i&QsXHAF*yL}JqSnhU`3EHQfwJK?~fdfw~Z>b91Ns{WEwlwqhlX~1B=yU6F~f7Gr?9sq`Ft*viqfokH3iaf2~sD00z z<;ft6_w(G86J$lbx|tnHMvH2F(V`R7Gx!;awbdh~xFE|)!ETo7;Q1CVxikkw*g8ha zk7t*|dX`!GPi8_wTR)1|WQ$UJ8PytGjurT7U7bgKfS??=%)}T2&14E%XLTuxe)*4H zVX^b_<+#oj*cGR<4{v$KI zVyX+pn|D*mlfPUNOgVk)jWty^Y|MG| zK8}h;tdgdGdtg}jsS(V(dFWCM{F7#4o643u@=yDPa7}g#77f~QbYIt#tkE;6dWyV!Z2b|NZmvNY zZp6(kdT>TSTJ$S)5(C@w45em^5X}LmX`GQFW%7OW0A11DU;z0d^nz)XLS&u zU&_94QBcy=cTr?7t;>U|sgX?^DW7B4mzC4Y4L+1sbm@q}i@K*mtGxY{xTX&my!xcB z7_2Kcf;!iz`7%Q3{jQp5I`KlTMeu9Fv;`JUCVg6HePoWMe7w)fFYME%KO$ps@Wao# z>eHu$WbMX;uhzZWb{o_GO^}=xyy?T8_B4dk+RvvFEfEbZ)zR$k)vHhaYiY?_`afp- zd~OprG6KHz+7257XcwI<*!^wq;dz^D*XwY7&B>URE4oL&tvHc1`K{ohLirAnNa|04 zaI0k_S_;quM^tng9q9-Q-j3=yiNG|8xr%ksm+F-4*)VK#!qe585=2yG7o#%A+Ls#T zHF2%tp3GQ<)vd*5y1fSYzg1=RNl{8h)%MO1lGoul?N9`ZK)eoZbUEsB)cY`M#@&!~ z+(me*Yyf$zfOmf#mk9xRp7ud~H|C;_k5V5YDW1n{^;hV|2fBYGT<|G!^(xlEccz|8 z)jY9GJYgv-aA6KbZEJt)S|Ga-z~rv6Y%?{^TmW<2xVX|bdH_+ zevL2_<_Q5pImk@E*4*)L$USmql=U;AU%r-w?>*NS_5ha>rO#n_g=ZriQ0(KNQC|D> z8dU=FoUFLp2ax4JiDl-7ox`YBZtYI{dfB+yDJObhSBE`g_Az1hT9NJV11d<=M zLI^-0Aeibr0YVNMQhfFR>1p^6-B#&;rT6Zy79hXivO@j^Mo7uSfW$nnotK*59@{RU zKTSq?qV<+ng2>4St+wr$ZKf-i3`#vPNLL7z0RicgK8N|@{I4<(CB0mNkWhX*^GTDc z^-qRY<79*f7f6T@yP-wB{{S&!H|WTa=QP=h$wO1w>%@-1&p{sZtLNf{x6YuF%Ig)5 z#38M{3OJP`NIPw1`0g#;moNMZN*F%ph^(?hCK#3_H_z(9*+s34Ls{E}(9u-Q(3%Cc zR!A}Vu23Y_(NEZmXMz{pk60p4pH zym~IIhWb6O*fx~w4)e;r<>5ldS$)6v=u*m3jeT7yUvBbOJB+mI530m0$vM;wwcb*8 zY`d_9mnw0!=RbU?NEdu0dpJ$jTw?9J^1|0hKTdHPlRhF*R}Trrma($Nsmvv@8WRA@ z)DzuW{Fc(!Zn(Q0qL(O^ZZsib#eAuUC&g!j!lj3`Ke>B+mzF%2)>Fso<;!T!*X-B> zj35%&=cx&*v#TE}3%`wXn{wC5^5JxIZs`ucUSrW0lxV5Sdy1cM{{u^8#^Z#;zV_FH z^7|`#GRNWR2CzN|H2#B(Je@i-j$G0MH10xH)@Va`co`E@dv|7g6mZu`mF|~xES@#X z_c|8KJaCK2_IpBYzq_@TO8KU>mPnAI#pH4B*++@URo;37Z8_YxV@z*r_^k+jk)SG6 zS^J~7_JRiO8dpfEj~eJxI!lv_J63w?FHYhV&Gv-t8n+%MrhMi)e#k}Jb;S=myyzwJ zT^q&!8{mz<6^FlaVx-d=Rt1#^xEJF?Q>l{aKhby2nQ8LjW?aq4dqPN3l?$PviqHNz^{jUb+B_okj z9g>j~U-IiSs=b~#E!C~-rHbc=LXpNM137{Ye`)?6c|N{I+dg-kUJZCi{`htZidSaV z&ps6sbASh**1FI5`ll(Lf9&W~GGW8;M$&VmX-{u&yg}=k7-xp7u+d;P$6?S5@Y^=> zSTtAk@u4+2IVVLbNtOw^`~~;-a0Z7JfogH5I+9sS!g=~Ow|DPF;P1)IBUk*;F^|N? zwU*9uaqfEpblaawYODqZKRIX|*gt-n&rTzvZrT$oP}*WoSaWb_Y*XLfBPsCCU>a_+ z75m62$s_Q?Z_yKR8qS9#j@M!g2c)uu=gv4{U;kwKD7h(Tap~)73@i|rM@z9rb>4oj zXCC+CC*%w#vdStQK21a8a<{eDv*<;ZL5M&6NqcxQaZ6MXf0+HtKgio{X|S1I7Sp~M zTs{>Zcd>MK=UsA7{r8+xt_3#Qz7R1iUE?L45P&`UY>@$70vf{l>8R+F>CGo0fp4bZ znCdvLD7ccCdBargu!IkqX$g?L+nT$l2Ue9n8kcVivcr@(sephBpm?R@7Wnos`N5Yj zU;bUdfM2-z`Jt^kf3|ACu}pv(kAGrBF3T;gCTqNz@Rb@b%94`BD+v1~7)mnx`n^Kn zM-2Qhrr2kwUhzB+;RQ!ja$DjYVAHu!@9CCPB3463n2J|=#n!dV?z&dtuP!~e z86Jj#MWr?-_x@b!c|RqwkG<%tx`bO9Qf>v6kZ*%lQ6S75blir{YmoNHJ2V@)z86}T z0ht$lE|uDf^h5^7h>u}bRODZN-De=hqR25NFifk5CeO)Ssv znNNjc)MmZep<$mqG8Zw~VcqQR+Oe)(oLfpGYEpI~;}D-_Hgse&M93F~KaPpTC&mhheC{>h$-=uzrPY=jzwJmd0t08 z+g7c?8t^;lXGH8^2?;3TfcPy9PnG6~@(Xixmdb?0b43xFttx?$sgNyoEKtF?vIJ!W z+KH5Ko)Kw>uQDRfe&;D$guJL=r7Zu#Htxf=!Klq-r;9;csQQYjAmO#k0q9SCmw9uj zl<7q~1GJw4^5M97RS5a%jeKQ`=|gmXYZCNbb)M6EeIxCb-5D_B1vKr*>c%CtQb(lC zOL$rOfD+%Wo39ys7w%`Lwixsgiya13#LYKmr9o{=jtuLX@if#6ijT`wqHrp`QCbhC z$|5s__3Cyk*q54e^^AOVrZlstVXsaQ1&?RiH2v|){qJDNw@NsDn`aKE$RrGa zSj{T5oiKp*6X@E0-%C;+w(S%mL7$=P9SIzsp#6IP-0+JH%X#lyhZq_5RMAhZ(o24a z_2jXM`RU=38(`jym2s@lwup!HeIYx%S$J|Y5#V~=L@TQ6d50UjTH280cdvow^lK?> z|9q{vaDtGhX{(&);(7#K-IegBB&r>#$fMEn_H2rIEyStzaQf$ z_UR!=LiE{DffETn;w8CLxD#yP>KR?MmhRFD*FoQqTmc?w5KkSd87lEYeO5#6b_ ztt)4MNx>3_^GxLxY<80_hMm}@s+*m9!!=t?ThGQ!^~r~9jPA!l(3Cz_k!Sw*)Jo)G zV*dUVt$`qh^C|W-;c&LsS3houk^cCU1Qgg#9F~+sj;&V>lqp~|t9Z+u00_s^LB@J# z@;eR-HYm6~|9rUo-mMQOV9=j^xfRF1k;KvXCWVsVC3f@1LKEJZ2q@^|vCEq;Q6M30 zLDQoSgh*Y^T8y9A2z=)hS~<> z?dhWVQ$FoHX1NYl&73B~H&?0c3POV^o-+gyoTD*j+RL=;0vyCZZJa0~B*Strh~bDK zoG@I7ZiOlVwvrkhmy5SDhrlTHx2D$8e{FnD4Rbuo>Y7jw?PHB~p(oBmP4_y2= z5`G)lF;j`~ejEDh1k4ozqHveANsjF-tLOpfqKF-5lNAw7NoMCT4v5}b5VLYwmR7kwm$&G)1#x{dS;j-Op zFyv2R{qb?@L7C9*Wyh;2TU$%qeY?~M+p+$_#-3~@pG~W5^KCD(aUT@`h`-{$2l9{~ zgC?p&zD=}$bV81zz3#_lK2gzP8x zvjY7<^y5}@<9BY2TS133e4SzkAMzhCKd5ZH*t${l$w=^IFv8j-<7mDgd?B6&{d;>T ztbaByrC((R(%N^lolbL)SyluZ^mr|g%ZzrH7qRMvZmdGdjkqIxnqRMEVAW?0?`EWa zsqf@Ku-HAXTNtjY%UKxUbJJ zact#>Pi^p##D0iEJF7q}rSoEA=*o7D{sDDfd|4m)!IIHkAbxAXh%TGA`*~m=CUs_FQ?$rQl+lt@cCl z#j$UG`G}zTFDCNqJr7*;Jg>`!qb4ISLA^XIzWy!M-w8p-w?A+5bqTT(Qa>D$C%5`N zn_sJ1`P)(nYi$y0;UtUK-BBHY&ht(atzn}#78^iFf|{NUx+ovbdSq|Q>soqSiw%~U z)XS7GKlPds7q#~-V!Q2bfp5HI+zD0|UP@9vXSbiv|DO4P8F}~VTKHg++)w;fLR=DI zWk#%W1I)=+5Hg8GTZ3H2UI14I73ut^qcQzJv^Vq9r~d?6F+fKFq5pMKHn{J%SKH0~ zn+dCVY4*E)9?WAm?;EJmZIRg(lW(%Jd6TKoQqo0oW<`UoJE)l9oG>a87puW-VeLYB zR}qq&Dk7-Cm3)4CYP%#(+Mj6&()PmV&>Tm($Y&fGuw4f6L8W*wC!@-PLJS!O($?1u zFTkX8?XH*HW5nNDRU_rSCf^n0LZEnGaTX>LP?73w!_E^=FuXKuVK{Wl)^vZfb@`32 z&q&_mFthdo##MZd0&3f;tJaD)OS~C=rE7}Fz)v0 z%wN6AmdUgH{ge35v|HW9+0(V`i$5puPe0zgDKurMc{to`8qn?JY#c^mSt57%o_(M6 zRNXUF{d16f|HH1tJ!eJ(CC+zht_s7tHy!!O#{`)=?XTS7t4%FcM8g-0JtnwWsFegC zTc~9WS&C8gM){0k2JasnIWK`I-br-!VY;EkSw9G((<$ z-PCh+c~L?JncBQZKsbez7tZU#r%6OX{~udt6&3{_b^DotA%^ZQmF`BQQR(gm5$OhL z7={vQkZz>AyHi0L>F!WEhCbtazVGHd=K?O~f*YRyp0(Fr`?nLZZ_SO~Zl_hW*&Z^?uK>l(c;iKS`Xwv4qX#0Tt~vPby4s{O!-pJAP$`uzD6#YFzjW+ zuMz-9@X+03SV_*;+Z^Aph^*9#Q={=UC>Di2JWwYK3*ZTld*}P)m=)vEaf0_S5Ei|j z8}{aBW#3>FSi%;J67AUag{+Guq_IZ*Gvwk`ckuk)@nT047OlNPt5M1!63@E3tle2I zj>o?r-!8HV_h2Np=AYZ=ZDM@&!?@SBuW_~gGMqSN)@{T;Eb~Acoa6&&TOk)n!FV)9 z>mYw0+%Gu~!OFx>Xqy5lGXI+e&@6n%4#vVI%*{br$>yZ<_c$}K#4Xw3Jzj|nK6`_4 zp58U%s_KqipXg_G{$b-ub!kAr{gv{~>BHc`M+@h!PGmub3w#;XAs$Lq)BYwScGB+T znpZmpLI4?zZWI77G5me9uN@?omQJIfr>eo<4 z-w&w+dzD9%vp?!!fbGJf?JJ!%-USFdD!SmW7LizlYkV!^dBx6~^`m^c{a`tG?s#7p zAqzF+7aYo|nsZnW!1W*4*jhV@GfAEnYZWImY8_z>NPj5;?C}~f-`~fKzXB)-qItU+ z?D^W zy1Uuz99}uukCzkXT9V&(6I+$g{sLj3ZxA)3*7yR&t=j9o7$tv`ITiU^p_vs+1;Z9Q z)iJDYLL$4l23IF(M!6+&rb%+#34=tFG-^}H=5nYuMR5|A;!+-h?0xszR^&*nz-dsr z(|^8`;mx5{!Pr%Z0?qCqQ74rRmfkmo=g+Y{@`Qm%&MQWA4FOs{3M_;0iZ~Bu^T={~ zj_O6GCS5++a0yzZAQoNWQ*_oOR*cjUqFK%n+ipE5dX>+!-DFJ2-gsb4 z>8jjEXj_+Xn0V(7x9^%l@>zz$oY_&5nNwWL{<5TqTQf${!%flMGE6xzXZ6AxXI;gBMJciGyv>7VZNlJ+=;?S-c)+Sx17#GUt>x3>9)>LkZ+ zLVUQ6HGX!%%98OA7fPOIJBUUYvXN=6(%nvS?j;+}lM*_aTyS9yOuEt6Wv$V)aLH_+ z>mq%d2~pu`9$%pI+L&X~)fWf$dQPEGi94#n+X;8CzqFLHX1Rrb|NC-QQ6i_H=tGs2C4qZmKPh^DMJB(v(dd-j|(n5K6b$_WhI<;jM0G8-7wkQ~I=7#k#_U zh%J`&G1cU8XjcMBpG(yVI5K=uoQMp$WRa7JK-uO+jXs?r3IzSZ$kDMX(?*&ZkPNi) zgRKL=I80xlpdm@-FbnIJmI0X5upoYsMfx9ozo}ZK;h^|9I174Xc9Sa4*m+@B1M1s%4dR0icQ%)JD)34tu5lFc!^i2|KLbUB zzU&GWgK^Vgq=sVAVNI6wFt$<$VX?%s1Jx*k#XWhb{UYB9SMqMVAjBu2dI98 zruP=EQ*CAE5(H}N#vP_q7~E`U>Rc)$sKpIZ4ZUrEn-`l>7Jb zz$*oy%&%x%)0#ucz_oErFT|F_ux_XW1pP7Rx*mb;n~Ysw<~nbUA2xhC!%3djf$c|C zS>1zJw?92QJsv?Hzrw|M7|!2Sr=flz)t5Ry`IA4sEv#F}rJs!TJ7jkFyX7{6^DRN8 zpI2bm@LpAV&=dj-ff~7%5OP^6s}rHy;=_g*4G{I)!VSG>;cPT+SrKQ!R{7l4yM)0ry zUEukryrHfo)qeM%ml4MT5l1!lDs3w>-sj>0M3SDwEqKYIs}-A!QHnXG(<$kFNF@vQkZ*BEg4D|a7%h zXP;V7keAu}T1&IsR8TL5kD<5CuR% zC6UOEHXbtbV2y{&%jbQh1t&bF72>3_b;Wt5_3w;pfE{TJJ;#iw`n?<@AqYM%fR?Gd zO*Qr&`A@8_?2jMhLbfR6;~F<{Bng?FuAg=j1Fl6?%1fkF?oG0_i2m?KMR^6COAiS& zDVs^@e&9}1QXseW^*kKwPW%8$31qZW>Iw>^%NED6QFkcUc?v!*QEL?`sd58s)VC8E zz7scM@QRXg^tl~1qMyls9BY*au$XJ;pc_wWrSvvUGsI}PRjhNmc%Zxc_FQbesT}f# zzWeYKAn{?8);SqKaVTfVa2j_#i)k1Dw={%rmfYom_wD{12?NoHu>cWL$yi#m`uPNg z$t_tXzj22hYyY%#9{y@HYpcnu$c0pxc?IY@M$xL0C3DCnu$di%d}ry}fzBDQ%gPQ- zlA~__xU@>n6o<`;1Q2eSqz?X(3W>-Th*a^lAa=dbvho0NoIaG>bF=&S?By{H~>WE(RpYrxdE5f?jP|7Wkf? zbTq^Dgak1i7Gy`Cak2Mh(ekJwo(I3 zx5;PsY9w?mEjWg8-;E%7+b49oo{0RNp4X!+n1O)T4jg*;3eRVWeD!keTLVVeVKr>6 z7kNJX*W$o-5v6gz5*T=W3!RY5Ma2UhJVkJIr=Y&htFny)cXOlY_Cvq9&>WtA1l;T$ zCPn6`f(7#J;C42b-R0Y59) zx}W+<&p8CSj5;B}epvz;_aQ)l<*mye?$F6hUJxqI=6X+%kW)7m8WqAF%M$hZ_e2o@ zm`WaxeIqUzB*YHQn8uIiod z&=Y>yi)Ja1V4S7aZhT}~GU~~cBHXA2o1(;C>oF`hq75esp+34-zk;%LP2$H!m*^aO zha|B4jnX+q-a$PD~MHr)M=3MKFE}7yIUAu3WML=9GH_>@?(2+qiI>YsF!4~=bY;8k&c!|`b z6`ewgwH6ZzMt$f65|8XH*joZ6SH+ivNErc4Ly@TVHnq?*r)hOyGF5%|uI_}>Hfqnu zA{m`yUX(L@2}L;u*$T?F=G~10I9z4~_;sWFJU5?mseNKi)@MroYNgz1&t2V^UTpa@@@<7}@JJ)})@q-EobFWrR<-ej?cV$NogC;%P6LqF z6zN9}iO}ianKF48{II2l# zyHC42ZP0KKar+y>t-kUqlL$UAD349C8h$h@X?%3Y{8d+9lN)S`Ve-vq5bLXMIT$p| zT%wTmTpsEUt-+W1ApBG-=3i8e?SI6C zmVWO7=EsqxP)stp))&3^+tIqwvulFY12ZE!Fd9J^@DZ`SRsBG*@}M;)U&#rhw?I^g zsuR!1?uf(BXO0(-l?Jh5rkRTl{)~qnF9Qs|m#M*F^{)$2xHazj9KUjkP5da&wuTU#rw;s%eC)!)0hxxA788g0UEtp6JAwTI<5 z5$O}p|{RJJQh&Wrwq$4^=E!-(svtO%~z8A3%&B{|KamZM#=(r6FzF?9qS35`c_ z$CGelMREq&M-RvJBiBjty>T$iCWj}a4o2zyArLIW3BI<)1LsbJ$=H!r6G8%eK|F!xXScWqG6_*mlrWSK{!PQ;M z{A^nNW}4w0Q^cS2S=j}Kk~QRuO>0BhP0p{th+00TNIB04RJYeCaX|AZ4eZkRERi^$ zgZ5KW;HcowJWwDp8~fP`9C)=P8s z!O0+M<`^x;_j(aTKhFl?c^QT22 zp~?ErDC>rB;cWM)Y6$>Fu$+oT3lZ-lGSU30?rW#OlY{&&sY$a;oWJtK>cKpECQRZ> zGUO%Qvi^SwZundRxxSPY#5GLkBnWCB*&x8zHtITp@CUzpgA>Ngxr1zNEfuXK6kp;A_x93KKxrD1uv==zKZ5 zOd-%Be}_0e%*T0ufZbW(RT>)YUxG?%;PyD0WJyX860#)&&bi)x3voeMw%Va@0-A5Ly> zzxtPX9AR%VMXXi)bJ}0Vh`?%UxD}O@Hl`Ff2mXblUH6n9b{(G>h)GD!7RLQQH!L{( z3ljm;5YZtS@jJElr>m-=-#R8(0Qf|hSn$BWJ2noE%|+X)0faf=wCc6Dftc70B9w}D z>Xt@O)^&zpxd28HQq(XuSQBOSaYBNaMpHU ze;jJVY0f(6nojQ4oQ!blfSHSkoW&^^qz*$$$yyJV{MlE3*hVB9@{JI=bN~cqiWPr( zw#Wd^s5WX@*F-)DkF8bqv8;2N$=|84k>_I%$Y*0UV~DQHC1zUMs_n zwoMp1EStSEFrfv4_DZaHBWrBhyk2i!q1SZ|fO1)U?cbD10|UM~nY~1EAH_-GdnvE< zB}qW#+h z>~$F{po!QiAXgUkXm0A^ZGauk3hQ@8gFkbGdHtnf0I3B*vI*vNy8!L$U+8*n~9@u~Fi$F$q08Bed8Ymq#?A{A=F-5+%4^SWtu z=9+DDmc6cP)%lcNn)r&A!zuz_*`g_A=_StXJ^fn@whqBL5_Rh2|;5Z!KM^~Dy0jUA!0yLZNZ4-4pZ*GR5hYe@mTd@1gzg3RSh9#2HE*7x4Y>< z_rbiG#L>%9E?y`VJy&I;!~Z%K2Ym}_a^b#WgrQhZK9gei8pyW<#Xw|$B6Ho-Il3=D zFk(~?sLy5kkDFX+3Y2bA?-Owxg%i;dMW69OMm~smRm+0a^s{%>vW@^q+f5PQ)PXL9 zAJtOc0jX6K$lh)cUue)_t0axNmpaHtqDJ}Ih*nQA>H!loS+~a?dFGgVuyPv5+-QL zPY8~<`o{BpgqPxY-CBsB8vK&J$`viC)0Qa(g2DvSfMnfo*P%V~ z!v5v^9Fp+>wB2VVwcIw%oWEGn&U^iYjNRzrjuWctw$8Ky@;|d}wwNSN;Uh3-ng41QeDp1Ml^t3CG zl*ArsZRXUyzIh>2Z5Gu7PG9mII%?eD6!Snnd7L4*ikWSa`z;?5GH0PiGqz-iO0ArV zq@|TD({MaUXoUqpJOcx9aU=kIn`Ezg=MVAN65p3M#~vp$7vnCBu_r?HP>lCWo<}i` zJ$DT#1S;QBvcOq>XMk0B5Jk0FMbFdtFA(7A^NGO2AiK(X$1{%>67&mXosqtQJG*vG zfmKw){osypmb{emhbfZ}%@tt6Wtb?T<3i;88;|)#%^&7IaRZcE>iOoeR|odUBxw7z zfbUb#@^KNVd=lQP0#>0v4iy)d6_3Av2i$c zXTx_=-b=lQZ@2)EhqiHpcr^Qb+mL*b4>)Y4Q-GxCmtQX*Ro@DdkBtPOFHy5T;wJyC zPPrcom)`Qv@Ih`e)eFG7F+N*(Nt$;)C%^-hC((Nz>7cu*LT=E;ceu;{?dGO2Sl?m` z(5K|ue>7HA1^Fa9;MW_!bSL@Z!v#Y{>)q+hGDQa^$lw}v5#h@;;VgdgC#Ydh3_iGt z8&g>Epi?lfHqabnP$T&mxd%>+76}Nm>}$qU_OT zl`&F@L_LQH$)_|iGs+XDhZtuTD1Al#&)@aJF+$fZ(=K2Fu3t-c0)&g|u^26=c@aqB zdx$S8j#Xxy;d;s?BI6GHf#!B%<8V1abW!^s@T($DTb}`|=fjJYu{$>LTsbfpycN>V zEta*LUk74v>dfr3-&fvB>ujAvFNY>EftMVUHSnrB{_G7ICM$(cREBhb6GG5*(rc8!~%E-HyCXC6)g~O zH1i63=;_XzcyXmSe?-Ust)&m?#fhF|Ivsx347`AOX$&A zrQ@k{Gh=+@($*`FGWuku+K|zA?lhk>;^V{AO;;RGfZ5IT>4adL=kprX)h#5a)HJdO zyoa@(8*VXPvA0m|2m~V`6ML7F!acu{tNm{lzzrfKyBhSK8waLw$_X+zZOiarsAkHH z&il(!TYqh;WYw5Nb>EFvCD2K{F&yqIBSD_ZTP&j8*COwfgu#+MTUFE;f1csaIHbR` zw6``Vd8_>HoOYR7?}lkP!KErAK%9-vpVNs`!IXm;6_{g`9dxHBm+LRHCF_rU$d zs2igeot(h9W_lrsz;g{bFZ<@#)c{Lo*bZU*TDM;xOEZG7XPqHGiwUsoK`{G+JXbHW z!VrZ7b?tx#UUpN-Vg8?E^6p=$P!e1TMre(7#GM_wcK&)GjuK_h-0?j=qMmSxiFJA_ zW=Ziq!&eYyN&m#W4etbEj#*fBFd9mJhdr4%r^J_Vj65OubZyCX8x>ReZxiD3Th70U z=xPTA0>UAQcB;AXBgRgMB)w4tXQ;5S`gHz<>Y;Ts-CKIDbz~mfSN;ICK+LxUa2CF4 zf&&|=1W*$my2iWDbX|lDWch`+3UUb;gNMrXN6gk*GsG?`xjB#(`CAJz%?HkxM5ZNr znh^-rEl4KI_)uO{K^B}wWg<2j%;QU~X8MDRA6Qz|V`z#|>n@_(@9Ac}G@#2ovjB#0R{d>j-RXOH;67gX{5Wxb z)^6#$K^QEi@@wS$QI{+KrrU*MZjE(^k z-@NWR-gnr6kbj)NLRFCdRwbeleUtKLd}Mrz@c}M0K(3i6$!#iaPEhc1Q0fDo1nJKT zvR8khyJzk*luq-9UDT2YA3=T_`-ZmFvjAK zkD$a=yD#|-VyoN$+e~#DBIycLO(Ag888O6ez%Nt7t*u}gG@JhCCd%pS#c+(-PE*M2 z#kS3S^Xz&<)jYK6aZ}s(HtV(GXi{}!?}p5>|MBZ_@}9Caw=Rv~CBAN9SK*`H?>a1Ch0- z=F2<&s8lW`j_*z9p4%E9)ZINsS$Ga5>)hRQEK_IP=g_~M;JBGwHuvz=hs7rYf5Gpu zH?857T@19jtQIwP#|dsHqoVB~?!e|f%C~NUGN!?j%LF*XqFuSoRRxJvc+YL`hi6XM z3%3NxZiZXC1Z2BLE@K{!sMCCVpBZpWXSJ`x{P#}p!~9U*cJoV42{VkijMn_--VkD= z^`}S_%i3!Df;M>k(cLNICqWN&hRO)wQ^*{m*(uJ|$o_o19FCa9T)XF}4!uUNao zH}w5`kJw|F4iQ*68)F~sx7p8EL*la9&!0lnok$?O-{t}llQKGK#oU>?w5gj!#3)6m zL_Bd3Hm^eO>Sdwe1|l)3PZiqvPI!-uv;P;2Aefyp6DcVvmLvdgfYxIT{@xJAec7(f~d6ARO`!EE4j_%lJ2HW zhwiT*(&ZJx1^s_v_SsD|z5{oqV_1s-QIV-gNu`~j=>&M&s=&fa$i(o)-xKLadd%Vc zpD0FE?!P|+)d(Cuv`vB@U!zLEtb206!6NLW^(zfGjDG>Z3Q`)raR(|VKoFdbB0Jgw zIRdO-c#3MG0KimjVOS3|#R6#lTJWse`sIv6wY?%RVJBgR)D5*Rp2tb`bKw&C7y}6E zc1@w#2a?8~OgvVXs2g0lNN{#TXOPHo={<4KXqAqp_N;lu?g3bbKuoX2$OTNR2_u#X zV*>to;Kzxu5CGrl&Z41p_JuYQkJIhpxop>?0TiWlT<-i6Ib5tg%A`Ff zKk<>wa+)}Aw#`X`Ko;Q8JW?9}62*@d3XAP0Y`%Ma#3g95*^Y$-ztwRZytE4$d0L_E zJdd(iel$g`qB4jm(TnIf@gbz?lIe7QU_RMaBUo9OCpxM&AMtKK9Oh5SV&&#P5uQYL5VxjqGG2EvnQ2uatV@0_*`^i0iA^@}0w5J=0 zX{d+IWcs+ApSPriTWJq&#c^_QW?Q|>9v?vTTI2qAv>aV_?EZTyGy`{d>q924#Me(< zG3%BAf2^Ayrtm~WYQ9M0aGI|vt@RgmaUH=`pvav{NgTjPopOv~07s?ar*`l!z*piP z(4c#g)~Un>I}+UXnS$u~y(iNq=>j2?c9mHq1*ncP z*{otsd}$Z~4NDwdwk-p-25aznymCNsUaQCf!El;m7@PuqoC|es(A*e{zPgDrkE4ED zH#|0LKloP7_=(&f$9b*HbOo>9j~j>{D|GA}76-#<=G>(=zFBB3+U-nfH^?U@vLW7+ z5V#)&qC7-z2r4j}Q5I36NfkVUHc9c(@=Sxk{oH8@!b$W2j3cN*P6A!oGo{I(PFA4^ z6qW1E|FV@f`z5mfzqP2>GtIJA`yVy7Fm{nA5P1!(=A7Kn=%9boUh|=7AOKqwPTOeY zhKEo%FruI$5LVSvWNHYrrV&x$3}usoA=YUVy*2Ah*R?CyL(R3q0m~D#CYxzv{Oyd8 zsU$$nxC}pAN|Y9oq^oT(Y)UE@V*a3!s~4yVE%9QK<(2IL|L{lWP|X2=ZNT0=;1*Mj z5v>t$suMo8#ou?lc##gdjgzk@OTA$mf{jYVE$rp-3*k}%n3a|@~Uu6?!E>mqiB}mW2*P5 zShSY~I|SzKNbr{PW{?PUt8}?2VfO(Z6aTy&4H>Rh9LskEdhEeG@WkO0v>I{B=Xq zz@*;LU~G-=i^szdJ3O6cQ2b4il`nj%VOb89Z!aaetX^z8$&Us zTVHxQ!jcjHVB)b?Z9uWJ9WUR_kqg~@hrz!%qZ`*%!Xb$zfCt{xTu_5b(CbbJ$B)It zAPnuiwByrR)n8xHeV|D3mA`9?he3q}J`xs#q3l5h$sfoq<+`ix-K$>De|!q_G^%RI zvg;xX^yw61S>csekiYfd(0{lnJlTo;)teJ9^vc;M;3ORie%fr}?BCW5AIav9EUPp` zH30flEqy&$;3zCqXg`sbIa}d0jOn`TP;eS~dI>KJ5JKr*=k@Tc4h)xomD-BJd#+@- z_t}ZyHx{3c>C+r*7=2ABwXVw7%^FPILVd2iqw{mq27&r{M=T^T3z~Ka%V_ zMY2^5-#3Fi+f?cHJ~JUwQn}SEBAguUXnuc)^-dgmPIL_4K*YsDJQBM_Q4symP@+27 zjXb1qhx&aNg(gtBu(){7SpKH);c0@Wj>HlEWa>%ce4=oJI?O5;I0-SOHBGs~!yK!9 zjkBnZf)F8=<|e_YDvN!s_QX{_pJ=Jb38ZP2Gg5v?{^ggmtF6S34fXw|BpCJmAOR0zy~Y+WY9 zSRw3f@hX8BHfFTqWE%2%2*Zc^nxqH$vQBse8|GEV466@h1^flkg6zpmj&15Ke)`Ca3X z_m0i0dtZ}TBEG)^sC_^Vn}7%v12F6;`J3;2LeKiD$Ody!-;h%AdyWJI7#@Z*1O@E` z0@RQW4okgjGWjzp5!91;NdF^3kAzZfQQbtAtO6YDb}T#n~mos6J2G%0-^;;u-aJ3b;E`#GVXcy4JwZ2iR`HNtq9Oy}&s zEFYLdoE7i?$Y{ORq#(K;C|p|home%;R$%(p1cOpcee*O<&-YqE!3sy;j?CVClXI>6_AwzVtphF$9zHu3uQ5DqRB2ref9I`?X=(N92Np5 z^AG9$AOW?=_r|FLy1sJiWOkxOQK>B)vsKKer{DdnEZ8>H9^j3&)$o=Mg65qjPAM&Y z-(A;f_>+zu2;h6Rs@Hy58U^2Zt_RaR!qpyTPn6b^pD&0-F0D|rTl|Q3)I;)CzG~Z< zPLOj|Cp|HLosowEt|9}%de^|T827(ekBx-8nisTB+9GqHfBbv~cEFXMp9AN7vzPjw z`(to6I|5oF*B-a9u|@Om)9XoF->xraMJ9wlI*8JsXs63du_(GCQbiYIRCO1ER1Xs!I{iC{0Tn zkTiqzUmYPAuKPEYajPw5~A;H-$KG?Md12me91Y|0n znN}hE#@w9~??#AUdZ3(CA|*cvwhx?9*eFW$b$>LJsfXmqe}qUd6Kc|T>NBf8SGSJ= zK@4r$8|JL6UG&x|F`6W6IBwlS65xDCuMvF&Ckuf9W#oQc0-9ptTWN6xBqR`FQ~ydN z(7hF7igLBbZ%ERPFT)kO=k30>XMgzZGY%>6J=BQsJSLKcZzfv}H_4y3C6s3P+?B1v zSRPs~vZ&vFP|(%r-3FlB;`Lx8>Nxq>+p5a;@BPY?9d>eui`7Hw1; zG$dB61UQK=SoAS1R%cVs1^TUK4u3;PHD1$OqVNE4S42FgcSLJl)@X+m7??=JT&7We zTKnfX-nLkP0L(uCvdT+EUzrL?VkMKrcILpEAz&0X;RrBF=wk+d_um`#t@w*D?z)ct zSy$9*v&^26>?UG@827Ul#B6nL4bIoTmoVLYHC=~oCBX`T@FDP&0Dbst`|VWzaDG^Q zHWE=y9cVu1$I!wTDgADgg^y^iLtTZKU;pG3M-kHmhkeL@+psJ(S;^&pgK2!TIqG>E z-H;+gtPp%^QnazChNL-xVnNkmX z(LQu37R%AnX(A9=U+s@96mS9fnu~9VDDeyF5Cpd@pONS=(CtB>BU924vzcj zQj=I{iJs$cx^G&@{s}cRBjlnVJkRgfS$xo@hZ2e$j8whNbp#mfglt28thx&rANn?Q{>lnl9SHM)MtNc3ChlpCZ@O%> zfc>{Ej!sKSq7d?feKUPX{^0<%NO}~dJM;?WA5FP*I&J8 zYm5HPoN3=6@u%ae(+-`gAxnqso^1bh^!BYTqc5CmyfNapM=#+uCo}^`pED5_^u4VD z{7*9R1i1~WzkRKVoN!1)tH)!G4`tA0$mVn)6v<2Q&NtfU27Bx18<D|xl2ZpHYV17d>{9G^=Yn0)U=W4rZ* z($VPivU3GYODGHTGP=#dQ|CTXH)rq9t3{%R0C~2^V*w57rno(z(sqU)(Ebw=Y~mhp z?D-|d7i|c_TJW8(K6Q*^*(b6a_39PP(WgK9bgQqI8f$xv9{X#gn^m=o)VZ?Moo}?y z_rch-%Ly|vERnbj(HZ@r1(TfK|G4Aw&jvVW%sW0rt2rTscgFz{0pg*cZ?^vgj?KPi z(L!I-Mh2Dme-j|LtN+~FcUavyxe4!ej0J0`x*LD*Zn@>$4xJd=6aOn*2@=vr0_HY0 zJ!=gc!Q8&?W$O{J7g=9k8v_tF-G>l9Ld6m?Rayv$H5@4~r*!yO3$N7d6{PfX8ylSH zZ4=WgR$%pBjK#^7z6wSFAMs2o;lNLNbx~0iSkY8V zgqwwhY}k}c&g&B4larvf&kZ#`H!l#?=^Jgss~n&-^@Gv`rERMs0kN!6v}W^BgpuKS zMql$?fwZU72eL*C-!p{>Gyu@xYq-^s%K6@UvJlNnfF!s9+Yqn?p6ub5LXVKwyqJOQ zYGd*!AT6>%9?|8|{O}Vc#zdi#K| zYob=fJt=v3U&@Ff!$Vg|Snr{znWP0}W+Aop)^#=7lSJ8Mq0{I7;!9y3#AEgDTp^^I zv@La(VEd!>zpXOyF0cpsRTBCi=N5%82Lt-O&aH}8SXxYP#_Hcd)*tE?n@^XCkNtCk zD)t(kPv(SE^jOZy?WH|8cx6sinm9La#6%9xFc`A#7)^SFfp{onF=o*~o6(mb!uqgmB8WB%%7 z4g|m!p9&Feic)BdUe9v;*1Y$GZTuWxcZ&LaNjlrKB;@;N4UJ1EI^nWG0v2mRu@g`` z^bVS@3`yS`rLD$ z_QN527&rg4)FewEDbV@PxeP~>p{c!6UTlh&&Fn9I8dNrY)CGnSPw^wL7g=PP53-Lt z++pXdHI}|K{jf5|-yR-?utk?XIQ@9>nXQu1^JOLH)yTWJa_}#Oi|2Y6ZaW0dR^2Tf zlQe%-do-L*-70a(H-2B=|!lCIK z@9^j45DvgSY26{k5An8g)5L7Mfrh50WG(stdeniqSpnyi&-Y_oUeD-caBg1sqxeDh zBDR2o(@EA(Yl6+_7^&~eneBCy7!I6fLYz`MxU#tt@;b%FPnO-BC~6ls?JW`fm!B}v6f&8rnvu+%A1L2}h!8FJDxUNBY$h+QP@}r`C%jjqMfw0KUlX-+M=)u3WNGwK-yt(Mz2HP%Y;d|)qO0M%)I;b8(lrg~_|NE* zqF`Tg5WcS9eN4W&K4RwvO=!bo5n@&KpWq2q)=Lwg+80(P{C{@dBnzvYN)dTEu7969 z01$Ns0jbgC7+h#Taz^-7UjX_I^{u3#_z2_`QId1E6di$zWX&VtL{==6g5X1EB^y zzfNogI26ZGK@Y-XB{!e5Tvtg~f`gxoggx_D>aNLgjj7Sm5rITUH@rD^|5}IemV2Kb zss5~WA&wyl2t)*-vM#$#BPgO#TLCu1h>$YJ^|8@4EmDDD#D^d@@s#I~aD7JU9dX2V z3`#5G>L{JGQZCR`SnO9!+aw>6DNDepNI}fa#ds0MRa$fxr@7ZEpYw!j8U&>j&SvP% z5+(J$qc)kbD~d*%MMVii^1yM~(A9bo%Is^xtuivyBz>n!t&d}lY72h44_l^tI9MQpZ;}ry22C3Q0lwr38vl$Y zQGrT9crsGNy#FfgYz24ojjfU0;>WY{BAm@rbED<^37*Irc!>BTgZG^8a{>?pG||Jj zzej9FKLVam$UJnf#4CMT2Yt7&JZrgveZ1WVzVytI90>nt)&_>GaA*n>YY&eCP>_d% z@22@lt0ms)uxd|{$Z;=gq(a-d%gL(i)sb>)tNq^#MQ{<7^K&)!&blta<7yg&9&|}G zFpPZvOkX%GvtYmzt}{cXYCf?~fb{LxtY`aOI;{P5Dz}#ODZFZl16mv@{Lcg#PAA?n zUe{dlCUyg{%lMrf@Sr)>I~^(%-6*r3#*v%}bCf=NgFkow$kr9Rd6rh*KJ~70%vP+cguWJ0>&3AyEsH~#@tgH{Ikv9K>rHk60tP< z)wL2DysxJn^z#`iI_k}Y%{5nUAJAsSpUC?r7C6cY4OM3oA-N+klFY|uVZLElw{Fs3 zeD>(FvwZf5p?D^>n^Gk3l8O3HUgax4&G-B>)f=x_N4&O&5k zHKMXE1_K7x?=b#@;P`JudpImKEh_T4eNz3GrcIEG@(Cu8z=#R(YS6R#7urQQy;Sce z$(?G8zhg+GV)SU1DAN(DZ++|k-z>nkjtbe)QC5+8F|D@xDL|!*G{3iuY5p^emL-!l zd`s>{($DGNhvtczMb6w`7}Lvx*)7cog(Z8LFg5D(wWmsdYJy&%ahRssRlTdCb-+_A zwl2Vgh`Ww}V_ldZj%bOVu;le;D?n->p0_O&{_YtS-;#r*32`OptSHW2#p#p&sKWBz zOSJJlnmS4$|Hmr+yM$Wpx<@Mp@0rA{bG5|y{vBm&i^|Y-ly-1v&dg=%!%`#2V@2!3 zT;)5vHHT`)H7;yQ-JqHpFk-O`R>-Qzm~MQNu@1TnZc5rB{4rHj==P3`R`man^;S`B z23pf_g1fuZ7I$|mTHH%5RoXpr2Xva6 z(V&&GA$8-WSo}>T9%j*{p@GlOFMmjG((~+ZLv`@s`!xRcFwuivW#be-9R*k3bdXOv zss26h==zArAKn7jpT0w`^ED!ENCo03!18`8V3bD~q|^hgE>AkVz?jh^9p{H`GG(-{ z7pg676kX{2GjN5pAR;0`UiFzlMgSWOYQ(y#9FQ66JOvMCfj;VcrW-JZcQLwufOHC1h{ zId$;V7ekhuE|phxuT*aVAyXr~j670>HbPGQ5!yc=($s;y#b7P4SOEj;IGuOXdsOiH zNcHXJlrQ%z%^8`^l0aC$bH7^eChJq*ngl5G>msVbr0eN@RI!Iu+1I!&i1kzquaE!F zoSzRniLe$~Xg%wCgmD8^Gdi8st`f|EY}EZwWu~lR;IM4ka10k};(c3umsveE{Ln`f zc)qfRfT5m>_|0>n9@Uvu|5r9}SbWR*N#zP{@8==RhN< z*<1#GCO4E~P6XLAGNHl`AbRWPTirJ=g!o~1!ZihUhg_2bBm$pl1utJ>pgqdZP736# z#F9i`R!&FrGS5$B6VphEbT6te`PRIeG3Jx4s_FEN^l0ObTV`H@o4>64l*AVxB#@)W z)Zt;|>>xovIM3h(SEv4GJkU(lU0G2E=4KoGWfgj;YaM^ExJ`)S)PkP^09cbc0vGhq4xb#=E z{(sXNy#LSfUo2J~OdtJ6CH*f|hbO|x;Q#ayy!~YV{5;I!koQAfb1m2Rfl}e8G*MD| zxkZX=U$bK6^`NNF^phy13@m9csp>a#Ko7w;4bIYU>U_OpoP-z}(`ibV=_Q84gpvKM z9s$#-oG%vy7*XX`demy8tZxW+8pn91hW9w6h?uSK3VCgJ^pJApzq(X$=8>=uZ9?pnp+`>p<%RQy5R#k_$aQPXusgWWyU@l6B(D{MG!>>Bb>B z-YSJau#M)E=|`&wgeS}qf%gV>PqGkh;~gb|aNd*bk>A&J>yG*sf}xVd?shINET$TA zgevNt_!)Cpe586NSgkwr6py_HrA`q|xB!H+zjuP=cs~H|0;r|hwEC)X))epQEqj@} zQvuAL#YqF+$uInjP2KMYBfsS%`XE{;Fb~)>Z>5Yc?D4Gnd+9`0BN%A$55zhtmNlX> zhF6Uky>FmUhsqwkk*&C-`Dkh-WiX&g~wIb0FbU(}zDvT~?p(qM0yCUddx4~R%VAB9B=e_}reFVQDEP~R^T7@z&X zg*X63c7mG?7$wrZo( zj567Kt#U}bRyDh{mB(#(z^D-7UW@ZuA>BW`5arU@tPMIBTzv|#-bj1>tIGa- zQab_{U)x_~cvB8dR_q@*1Pc$Os2m@CZ7Mqp#VV)0Kkj+-^?F`K8Y{` zfWhl&Fmw9&Y}eZZd0NE<`nXr-DHxK+R>7>AKPYx!8!3bZsWA8(VgB#R`P0|e|)0zCv z&^5iG!yfW`*5gi^VIXA0jJyS8aEi5rlXP-YdK_n3cf#hjyD35&hl`~+i?I?4 z*7zyNzb6N%)57u13-=dnTl!E8;0h)HecodKwF+_Zpn=~#_1XX5o@mH+T9-rY;f4x#fL1iejy6|`Ns+sBia#;9zB}8|6Rg* zqcZoW(d`Hn_}}!6V)QultlaNt@iVZwmvHbKFuY-YW zf3^KJxc<_H(YWHemlv;py4tBzuF7`1+PUX{n3D)6EsZ4cRCw5&tg5&-wv+C~B`zLc z$rK$GB}L(t1LA7dOG?5))u^NtnDLWl_Og1Qx#gYbWDVgem0dikQkwK# zA)cr`Kq?P`9Oq2LJiHnuQ=ODuYFy{5vcl$s^(wGM*-}hjZk&yrA9Uf86IOFj+dI-Y z0P1J>d~czRyJ57UUmzUwo_G8zJd+V$h(%2A%HMNo+<&D5E*A8+_MH8DkA?e%*1~2C zu>*u$Z8iA!Jzn~XX!Km(PXEszKT`E1)YqrLO~}2MWpB@{O@4>g8+WxOS*Prp?ISW{ zY)AR)q+jM<&+ZpvIc|no=-)vO;|7Nrc+YC9cN?a^d)qX|B3p}iPmThj%(phpIRUB980At;`nKEDp{|kx|j^{we~R;$$(s zPd{5lzgt#+TaM~Od`nI+4Dn?9CSI^Fjl#4g3h=fnz1_u~Wi6&`e;iHfLiYVMrsNDi zRSO^a$^LnI(4C?BR?lMR#UgiMn0&=oy4{-@r4W~O=?B&vCu(r3tnTm>+vzn!OmDbB z!@>$OSX}9&5ZIrL9`uGhF^atQYk zc^FQaif=)JtJ_6x_G-pUPuMFC;Y~7`UxWIx$^rW{Du5;Vqjc!cn@{ z{#>Kju1$eA@~K%<{80>WykY3|BWiXJ7X)l({QU58&q_UFMeVx>f8Q4H{8-8!=R>>m zLH7^Z<2;~;+244KO?vD0G5eNmgIeqB%x}DOE2(U8V>XPJR;M?G+jlw zutLjD2tO{-*K;)LxiZC%(llQqu`&-h+AE3n9-wIf_RVM9$?|QS_8l^%_@jk_ ztpjE*DEKkHd&z#Xy3|kzQ4ydFhd~5(kT=%W)-wqicl%jCqQmc|$PKg533h`BN)g4F zxJh&WZt86QYcq56TI_67=Z&uu$8vK%AEG(E?hm`?jI1+}jQd#340`mF6{pe7v>0D_oNItgV@;vfyGeS&*o%E8z`+QaTJ4yt6*uQw;# zYU4f|`!xL~T&p(2X9#`CAnG?->by|m4*|pRh!{m}C|CRUzaFJeEQ4>lmKOq!%i{-; zC4|0aK0~g+c+#P98?8&k7FN;%i?a)OW_#f9&kAxOH!Xuapx9yUVa5cmC=pLuDja_? z9W#6!%-WTEIN2a#Mu#M}FYC(4`4$Cjo|}V`mN5$P#`Q>VCT5K>o4}Q5#W)y#au|z8 zON$-DX-r>!^p^RF{mNclIRubBFLd3L4k1 zG0<9%TR|6mm=^!{*kX;j*-3pmLj8P!-*7%n@44I->GU$8>{JQ?_Q6a2g|{?7QpcI~ zH|jb)-6Wi{+ZcU|#!Ch{G~o{Z-GR5{MWom32^gVslG{b3o|2gu>RGx*RC3bc8 z2O%4DUZ^MTz}plX%sXpFADn5Nv=V-BDeIcv_ab9*lVth;wzHSR)XY;Kj!>rM0LDDG z{$`f$f#SB1_6g&)2twPkGYj?9UVUyKpU)S6AJ{}$tFwvnuIc;QNw%q|-ki=ygJ5-m zBlHyv#;leJv)6$rmFqodLlg8b8pG>jeei@yy%g_i4%Ny8!kpL{aG>8E^M_jn4%MB^ zAJokw!72DULcll3D7Y{TfdR>!l(gIJ+P9NU46@p57PfJ_0u7iqgH1-II^Ql>N+q5!wzdUO z4ca~Fbu5*ws4UB(g15tTkeu0vpT<5~iKcQ4P=~neDcc<>8R^;uGWTAH>c~0igmc9+ zHwe2bOSeh!I(Rm@F*j65qUlmyh2Yy1{Jh+wLbyujuI5gp0qCsH)>b82=pbo+a4hw& z!zultZK_{#B9s0{4B=|nNvEy6TNROEDWClGcfRB@U8yVWgi<{UMf|cG;$`(l2Aa6e z3G*mKo5H@Qr^SndllwxFvDxR6Vp6pEYh$B03_bY0IY_AZ7dt)J0HIrPESzGFTtWxK zrmjtcXU?F?%BQ@7YjxK4)kU0Nr&T&rUat2~fn>1LvxJi)b86==w)b!@<+)npBIHPq zs;A`Rl3dLwqHmNPRvRv4R1?#G*Y>T6r`5rqv+goW+Qs&ZgLS zuouaz{|emd6WU(wZgGC@P-`2T6%}?-LoUUGIRtM~?jV8R0RD-g@}3cu0Jg5!G8P@#n9H zF3<6M=Mnk6*w#5sRHp$ewCxsqaO@pcNcm!378UCTLGBdd=dlrIZRsilSD#Xjk)|0f zY!c9%rRW+UMSm=$7OiO~a%iw#WFU8&#A_o|=pm+H8jZxj;@?{IoiH*Aey9p&H4ZWoK~R7B~Kr zxZc9E2+}5@B=zF34=yL8DXO|@MQFlr89;gv@+bTL*3pQI$6GU`IK|76TjZz5Mf&v+ z_?YY)>3uZv>Z60Tt52s8ApL~iH$yPBhOfhW(#x=GL`xU!c@kfcJsFr)RPy(3xDO&h zB*unWrBBD|LTh@RMF&09DXuhToD8k*FNO1=5F92F4%GG#2Q=}HY~r^#qWrc3&-c<4 zd%HVm1Da03mo$!TVui>0(Tg|9QqbN%NU5=Flt0qRPf6uMsOau~_T%6ibxgXza_IJC zgNBJC3-A$1SifOVGR4<)2QH02kYLKxd;Eu+@KGM|w(Swsh&;@v5?Sy~lLXiP{~^W7 z)2L(i&HO(q1H8thiW9>=Nhe?~3a-dGNI%s1Ho9!5(Yi%HRo~@K_Pc|fR8gkwUVrs- zQ&mW;qJ+*Jmv|L33ucjPRHNvxX|?e_gch>xRpg4`VkMpNA6x7>o8RttOGH!kI*TLG zCck(Z&AA1SxR!j;Os#O&rn3OQ%|(-B{(K;uYB87MN-<$|V_ix$2|O7r!jQYmV5R)c z^?@)*`(h`LH@Mb-xY48faBXHreA#=8hTq8;G8jfaHTD6S*`|dR2^syVpEQ7klq(}c zot^*jYg>w)FD#}%sE@vI{L{}7A57qYgPV4B2cE4ha)sLen|I@eTDPt^LNbHV;7v z8B>u4eV=bw^{Ned+uE?XzUa|{%sPHkqsZtC07*7d)-l9vF&xg;mzTt@!q!)@VbxoE zUo~)R*_oVdU5utr4`Cpg2j}-FdZQSEq_zg{cvlm2B!n?SJ=Y)9<&8bfsNqS@c-Q^&F@d|H zFGz?3li~!Ye(>GFQTmRawl6!4pAV8@TL5kswLgl9_&I9(@tUyrgUg9{uir=FDM4`5 zZI26z$;%0avD*b;)p=Zaxw#x4fTUB1dqn^stHrZiD(H*-V+>0V2^viWphfRW63p|0 zteRt{PE>nX^46w8XwJi;#d(O({66b_n{o)`Hr@oAI$8y?4E3KwNEg zj}_gvPbQsDTzT?%B7Gt2z>o9w$RzB{En+6{BoM!Zf?K>$IR2RAvF#0CvdC~#vOgX8 ztCG@=9apj?#sIxM_PfiKTi!qp*?YrjK2I#HFB5#vV6(?Rk;Zrg!3C!Fh_Wq-;ov!I z9OzvW`ynvEUgTG3YT2F}Ymar3P^LeWu|2El>=9&9birvjm~%zGGc=c_S8*W_J+cFl|%aL0Ju4U`1OsTY4E7W;}u0gGtGvFPJZAbb5~AO$}&AaxQD zyr*2pfFCX=0wux}b^@3a zq(;WpS294(%*XWvhslT&NCbAIGmU9h@gaVc`)gJarVi{*M2nPjjOLm7zp{ac)fZMcqDr6hP{+T*#q#lwkF0F}ouNs@mBd<={B5CKePsvn zEp@TIgFkp{8!EzwYY%_-*hg>SF9`uE>4LD}Xo`!}QF*_y3qO+E)U=90W7u-N;@Cwf z7XyOGO;+ZHQ`?TCCE-l2ny4q~kCpdq>6bLW5YEzfbWi9nu_TpHpLF!XMl52m`HNVj zTHvLW|7}@-_gauJf%jiBnBDhoP=Ko6srv;d=jKT2-wOaaGK}I;{S=>^&mX*k?cNZu z2lsLpt;LvSG}YT5NtA{z7gW;MkrJ}Le%SjhOk9_d!pQXOQ5_4=-?Vf{57T{C5nX*Q2!p$0^Pjk} z^<5R}k_Rrg&$`wib?#i2o4TB?u&@nJDOXV2EgkSXpj!Aa3S@Cf7Xd*Ji-)X$ezX@6j{P({%{}|^I^BVarR~1%5 zn?26i*$d^bsGc?~9JvViL?))zAPRze7e_asy2z>qY8R=XR`nTkPt&qA%AYd%Y|FOs zo8dr65OgW)Q}rg{Ui)|5B~DT}EA`HTNpxvyG4|ZPS?6Sd>1Lg&^()b5#~Um-_<5B6~_yIseZK zpu>0jIRPGH0b3sflPF`=>AZ}%b|`!Jq0!6;q*Sj5iIRX0-gGSqdRl#}LO@3Ik=6zzD3QI|iSlT$N${u96bm`4ftf$i?M#Ec7z36mjZlAA)Ci6xdGc%2p*Peg)2 z8QXS5@r$^(E)PtHE+cia6hZFjFb-pCRX2DpKO%SleYK&=zZ;fb47`P_dy2;Ozc|#o z+lEr3LA!F1$W(l}IY9!!gVXuEN_*Z@Sgsvu_TOe#TPtLh7a~fHPQX$2kiJ zB^+9`z0-+l+1yZ%-;(!^+r#-s1M5cnc=TMiZBz81Tlol>W&Z)^q`NCtE?=c=d5odO zc_dEuXk`ztD_XLc<9ji(p=2?qcYapM3af=9y}Rv}+Y*BTnPM&K)IdAa>II%@z&>Tr zYwE)BAj9a7eqZHWfynfkGsl&nI_ZE6ATb$(akFHDt-&J6PCt>dds8@FY1H0AYvo?f zaT`6^Ypq}JCxZv_6`J5THMrn~z38VR3?y2DFk_{^rVEhWPm2Aol=PY>~xT((D zW2QDZu}Zg_Q2=lTa={>vLq_{0aVMxzGlKPZvl&DO`8Xv(X+G8vBH?4$ z1ow-9Ev=pYinbqT#X)01V=9p;-}L5>$q~MG0N`K76s(^YhCHxDyV@4Pc;?u+xbQ7l zeK-a-_SRAJ)bLKaN!-7%>wjIC85xj&Z_(M?O%ds84@`^Y>;WrZr~x79+PG;Ea_We9 zI7SC78d6hwY1#@ii$7PW|K@2K>0b!0siMi0rVp?G*wK-0_I)>it^@>AclR zd5f+0>Fv`{zBnq33sGD59D7pSmJq${;;Riz7;hT-<-c^kJ%4678Bl3+zIA3mkA?_Y zhA8(*gO2a4G<3OGNlwPy(E{zi1xuj#*MPVJz+y*GEYnABi-P(!qSb-mvPa6y)sO>> z_XI<5WoOr%`PX|C_#Vl}51PML3O2shrT>CZW?A_2qq?ofst$Jv7aWgA1_(TTvwv*} z&F61GXfqR4khCfUu4DFezU4pv3?TDzh-V00C)_MQ`^+hV{$sM!dW;y{gT3U%4p@PM zz9;~+SI<7XhI)G|<1dy)Q!%2F#Lp`f)rri zX_oLyG8;-bK&>D`$Y`o!PNBM7pKaMqmN4a-hsoR3GLoA$-{4dWPZ>5wf>6cZ1g`{# zZFASUK#Cd7N3`=EWR5ANMW4uUZug>)B;=fy_XZgb)@m7UvmQ_{flx1Ki}MeR$g%B( zrw~noP}Xu6Ba|c_-Z`vwL`vK}1qfcIT;JvQz91asx)B})Lh5OsmTh^JQgV^Lf${cl z(7-8BSPYHS=U;R>#(_+xptE^VokESOqS7BHJa;G8(ThFSX!gS2vhcE%aV~x^U^NSAnmuD!cPbr7`^{JwU20Kk!x+_D*pMCC?N1>hL zp=q z0%cDX=)B>?MYdEg`n((P(FPamUBOn#TCRhe(nFYqiVs2ePhnJ1)7NTbvA4GH&NQJ} z|A7}QtE{e9ehiAhO~vR&G8+uYcfz#7G9A_U{=kSVyT671#g`vjtfH`}d>hW3_}Ez3 zVg+t5KS*3v_~4!B)wJ~DcSmwLIk_bN>L?iX`A?bM;Q}mdfEqgw4feV7C~d@gKRU-C zENUO7yI}a#-PFI}uCDRAzR@0JH=NH#NJQK0d$o>u3GE{5)WI#iSMgM(vfD48RgeNu zGG#O2C+EIa?a$s7Z>to;?2&Hr=!auo?J1h^sSj=qpwuVFtMQ-Q9cB8K+UYrV8FE8h zm3B}1kzHR}oOFCfI>~=?z--(K2?ih}jOuBbzXwGL?uabg=lVMIsTzc}vYwO*()$hyJrT%Yr6ADr9$5GOq!6RrQSWQiAR3yxmn|MnWHei zNs?N2zobz0y#a_{Le-D}7>+jUS*Nj^)UP)(u;5jb-4Y*t&72 zUq6jV+?0w7w5VlDP!EhUTma0o9ZwrRF1|N3-g=xQ?NVX}sjxzte}74=*YXWL-;}#YV}E;kBPEVAXZGaq(r$sD327 z-OEl^Fj14<5%?~!{+8)%lS){6fZTn7P+Gpc^?$DU+C)L zf(&bzG(4a5cD-4z#&05@3iZJ|FYn1?#g$YZM*P4C;IpYY?@M{FO{1U=^7{MGt}_M` zUqC&DQ8de|E5acXn&@k#{n?BcRn*5E-bfGlli%(mld?JfPXN`xKfxya?NV%L$b;&N z!v^ULfpuZGcso09zt=Ew5S*09SQEBO?nwYr97As$Ktq{GMAqbtA{x6(r*>Q6V?waq z&y1e^48@W8mYIs--HY_OpA&gM;;9%$&=a}z-Ocr-;NDXNXAg8Uzs?X6bUz61J*@S3 zcFA!N(F*x`DuKZvSg5w!D_bm?A+1VvIP%-qr*+Gnt(16Ega?4<;Q3QxVqPiqr#A`L z;NFHb07B%?arf#V{+src9g&oSbRvt`sq+vrP?> z@;=XXVCl#oO-wq-nU#=@BnXaI(yeE*)%qnirQlasL?Uu!)v;ai3K&G!>@0-V0R$D?Y{o_q9?>|CDwkOYragZ9R)HhFy9?#UaLj9jSD z>eWes#gMp-74+bk7Fh#+h9^7lG~uc%z2K7X-%`k~>R`Pr)97Pe3rh7@m_Q27(v|o{ zg<%(A@y6E)bud zo}QDB@9WQOf%=yAc*b0x-AuvPr%Ns_F3{N6haA{j5=zRUt1I4rSi{X70^>e8ut-f9 z+0nCgu@@e#2wE{)>;)7Y0dfsd)BG4l*>IIKQgJg&(0EST3(s@W=$Nb8mE={@3TUD85`g5a8Z+>fLJ{rJV z(n|iWPK#7xhB7}2Q>#2mm$(T98=O@TV8?aT)`W#lQgwfVKU&E*ol&1Uz;{C1WyjL4 zk}3c$kqbMQ$~{%2D_!+>>PYZ~$4Npj$z#Wg*tUjG_r_X;%H4*_mWTnpU> zw<+|H-MOH5J=x}%dBYjNm4WtiA?eMfr*U#eRFI)ze#{{Aq$f_y%8}-_1wX#^4uLcT zC&V+6eKCnse#oz(LhV!Jlp%8C&)%64!|XTGS1pjvZs1^+ARj<*3ez$L5lha@##{v6q>yZ>dD^|DFv&_jz5TlUbeS{2_lVqoBX!e1Tj z!DCc&>V8`hQa5zD7d7Vd*+TtptoWw0M$J!@qTr7@S@#D)seVvnQo=b`UjdozmKmn# zZM&5JbrxxcIJV}2RH~?=b`Pa!(#ap=qA9h&aeYHS>(jcK%nm%BOUwOGrMkR6x{p(k z6eR1MPAqDnM-=}Hdv=2UI^?d!fL=c}iRVQkeyZ7YfI0vWKxDZD2+-_Rt?izABV4(s zW4zM}h;(ZfZtlv50h4p$AtqXi4VE0Oa=z?L%LgGs7Vnoc+b-(;_2qbpNKAO7{Ch}Z z#wvP_t2w%pxFf*Nn$`HSD6o51Rvwnqc`z>f^z3DIb_1;&7z*+x5r6niy6n@oBo%P% z7|obPv||pO`{5-p!I_Q%eXk9`%mr+%qW%`9`94jasdVVIE#D${;sTKuN?_W}&!wu_ z^nA+ZRNW9FFID{`$qAqTimP34F(ESLxAwuhI(w@3?m_D5wEncZq8z2Z_Ve@HRzUD+ zmqRSU>WIsOn8WOj)|7Bdf&+cG-y6jN3F6SB@sFSD@tDsv){9Ie^bprOuhY1=l*6P@ zt7$AO0!TZ5l=tPPdWKO$kJzr@(mLS5=xyv}+5U(?8)?@mLq}F zr&IPQXuPiX$`}IPY`^UTDvn-EtN)`*a#<@L zgmIz=Vz7yi9juw><6N;SAEcm6J~hv4@&p$!QrkjN4We?|@2RY0GIZ`kyc_=r4mmim zg)N%tjy8MOL(pNTL*ePYPdgc~K=Cv-16}O}`EMu`|I`>PK%7%dEH*JQar(t=N{kpL z(*6yUzQca|cR*(Ts##+#i`KLdD9W2}G?pr>V~qao$Z%rzD;=RHnVr;qHF{9=e8r@& zTd6L%c$8*XwpC$(HladKQw{Z@dKJ(0w%qQie8VKwT|1KPv#9n)xfu@1d-dbaytyIz zZBeIN*TGz|s<55>69jW(6=<#+MYG&6v9pC-J)+N(E@r7|0vw{Y&$vmhlJ??`qHG$} zr$SWA(!W(II3R=Nl^Sd3g3*L!7Yn~;;iLwQWOLUC!$_Sb{6nN}d2yWGMy`_tg4arG zqyRXO#L54e6MP%mBY5bz#C1_3{&Y|MN&yZUA^_j~6!YFXjDy?;p3ww)PY@VCY)YT^ zu-vQ{2YsiMBzBjmr=*`I8rk}ZgTtC|4Bwdw=$G*cNMop3KNY7MqU3hh~H9rN@UYOgD!kpY0zoD1=6?rjx#ZV>o$n-PiZxML0fJ48ajVP&2u7*%_p<260eE^%haM0hblDqr?RV;~EI0VXk;Y zeSlONc#m4@EFu8Ps(Ko4lqfnvv`2XFOaiK{9&jw(Q8gyq5voBuD`lP?soQPZeH$EN z2}0uTQC16Rneq|Wkqqswi4|1_@;(ND>40dB@LItk6N4xug(lnj>xrbP_*-p}6yI*% z0q&m;P|ImPC3P~J;L``lMr?+aj*9)=dzr}Z!0J8kls*sNt4FTsYxVkJF$I?GKHv7Z zOCJ+@x|R@Ibc;t=oyb*sj_MKYsuP(GJ#UJTQapt6{>${8%WFXDeO!=+`D9#vIz|h= zw9}vD8$ggbz!DcV&iKy9x#)LSuermyU4JrG%h>@K-%o8U9^*Vc_Cw1Mg^@=4fnh#4 z3BuFz-A(nPGaZY$9Mg_nMo$ZHwH~m1+4;7GS_3i#YWoi#by_-H!QLIWC&=s_zSQD^ zu!@+Ap#bkqb@;uPSz!Pq9n2T6mABGwZ#>^0^)_PtWQ8c*xG_?~`_|Y0VAkiTvu$uv z%<-smt;oh>#)wfpGP%?k12zBcL!i#vrtb^^U*t~_ks3-lER){k?36Xks5|lKePioi z$~irc^p12rFe>INk-K`LL~QpGtIwKF(Sn_vjZpo9IQ3eSP>Y}994-GE;*u9QJ6Q|F z`MA6;YVjL^$;|g~zhmYzC7o>bX--5V)kXYei@&E@7OQR4pJh5Qxgt>2Te`V^wBQPW z8-lV9V%S!pF( zJ%p-~$QWX~8LfZ}(zS@5UkYZrzupxTCK~qjlZDsN`h1eu(}uC8P?4nyj#P@pE`swV znNz2_CB1UE8Boh9p}*=|a0o_?+MKu+08R=p-fS{nF(QJPb|&2W(T$Y$0F8TpoZ8Yf zlfqx~zh)lA*_TIZlWbOObF%*ovYpy(EPA>c%j9EYjzJty?YXz|QzF*4g27WTB#Za@ z%Radt@p^awgF7`9gSIb2Fck-@SqX2R5*H~^Q&WSNokU` zKsax6m`dbvqgy?n=!GrF+v*v#;naQ0d${nxO?+l1ub~~O264sQHLe;&~8yh*)?)2EnxTj`sr#aKL`eu^6+vMpq1y*Uv3I%m z^NW2x>nfOk%S1?YD`7suoQ)Nh)aOQ?7(IylyCCA>6z>@(dzZuGW=_WQxHjrIFYvQ7 z1~wlj-%4LI?BBW8YmS!wx(>{_s_}rqTOI(AvAQ%ol^-bd1-wIxU|C(r8hjZCFucwc zF!im%v}ZNG*(~M~>xmreDtDgci61obIv(14-O%lRh2}+PJ9QAR^*&I+xSF5y5TAq# zTENX$rf#g>Ga@Pht2z|~1YXmak7u(NmRX#PqV;7Ki0~x6Z>M19d;|>ddSoO_6Jmcc z?p0o0@=%f*aAY_GJS4-$8*SiJE5rd-?%i=RX%uqZ6mE1A?uoH9AhI~|M3NnBc(y?H z)~AMtf|!=;&weaPL#;QG!ZBlDx-Ss>!nC>h=HcG2K=1g29wHpvg+bH}g)jH0#ASc+ z(yh)7<*3jgaHsJO3P;%2EO}zV@i_tS*s~WS=H!qY zAHn=c$je=)A_6})4)Oh5o^OPvv@sxxnY3W$&r%_z=UaxJ|E5O9=BX-N=u94H?z>q) z*3Vf)KVQCNSw}ge6f*C0$YiHo8m?2n|Io-|+)dQ`8ixrhWw3mZSTlyuL4T|ly}FVB z)@NCWVH)vdr1axYi?!~dy94|4vb8SirB{%Qry+5dQt*3 zb;-5fKo{sYb*R0Gc<|-xl34>FT!5h6&ziW*%mq4$_qyd|<-Bw4h|I0vP0q<5YN3VV z6h!q0=aD1FK*7&Q|BS+{x%(`jz+!7DCzx1o((cWy|F?&t?wCu9iRq~ZqbZ(nkEZX3 zm$T$rBbT-V`n@l0ln{1E5#}&@qn`6YA7^iH`@jlZhP>g{)LYDSIW;81LmqdsQ?-jN z^dzd8;46b-G#X5qPyy(W;p6N8Ac)Thx@MnH_Y--2VFkgfy84wba?R#J{!<54o5DcB zfv?D`_?#1uq%NIn-LcNwuGM$2y4FBV4i^gQxY)0U1~&pDkrp#)ZXrT~-%BNSIpT>+ zCx>b#zfZ|`TrI_IoCUiZtE+yG+TgegNDFaC5Q1i&*u9iW_R@HlnQR&ZY>~o>#}UNIW5W6STrr!Y*A2vqbZ}y57$#DDRjV z*E5q;o2P3Qw$MBgBuLWHdy#lFH9eJfkDGXD10{0dnA;%xlZ-2|#as%g3+ipi zsWB8#`dRUMO}(V}VJ4bN*MYt0!MUPbviUqpWy9OD23^IyCC05EIXD{PHT z{1V7u?DjyYcRN_W$#&X~1QVyYPs_>3C0JVom&P9?L_eP$SyO=ur5`w5kA#=~Cjwv- zv5gXI;Wp@6uP^a8E9&rw$Me`AF!@JAKaP{tRuc?iMP5T^uL7$AWVlf6gF1_u*zh=K zl^6_81y;T*7tA}O+*z|IT;{g*nS%Z|8sQ~Id1{=y2%&KkIG9TGIddqV+)v@;Hnk^qWw@h%)&<|ppO#mgQ&Cc|upp5iVEQuQD8`%(%UHCNys7Sn zF3q+}gwB^yH3*)BaFvZn2a~JL8JOs%UEij)ZcL@}&ET*&^2@zsNm|oZCtFG*`uN}n z1yEXw{_rduSo7shpn5i|K@Eb1hf?MFAR57^pjB}dS}5E4z5tv6(2+=d>4bo_^JcQaUBsFYQN5@w+v-gdZH>uXT|i$=2eWCo5vBn*teS!Xl$s*J`PZEzY&;KM2iM{P_`g-?UNtLI7`thOyyX% zvEB+#KoCDrvoN(o)0LEwer+xAgVxjnQS$92cRB!;2Kc)?rU_6tT8_~&! zdtgjHm}riNzjET&UY@4xL_eMZaXp-Awhbii^kk4+*}>7?dcB--?C^-@?eWNyUhhedWfU<&6iE&hwYmdL%O zCa`1;S7&RS|C$yPw%+W#p^ZIcEf05Ha4HoOt0ud*46+Z9-1)=ufra^EKerm2XBT1+IL#ideo$Cast*vh`kxt+mACn@ zDwW8rRoyYW`aq*pSmwP-JpX@<)l~5uzhL?5F)=Zw?(V$a90hxD|E->a^~V66<^D!R zMd?_2zs5_#s!O?ZJCTh6A zv|k|8iLOL=aL=)n$ULH@hG;3!jMBY@i0~(}z343=zSiKNyIHaJgECV8({EzVRH(vzBK_FlAnL%gP(J|cxBlEb zu0P&O9O8rwVuzgFx62dfkGi~F_{3%CSPyQ+883(10>5epE znJAX)(oCH7E)185yYS?gjU_T`4&BxO{2JZQwv5@WT!tVi z&TWznpr;mpD2Y#h3X-K+XeQ(0&sr(kLZG3T_*F>0Y8pGXf4<(~2F5UHXpDfB5d9bS zKQc)+4d~fj9ZMgn;``jZt&khUOQbhRjj5}3B!TwQcW?`Ppm#}n>?0J6 z@PN1^n=LiiJ99S~2V>H@u^c&HIy+ThD?F&%f8z{(a>`NjLpBtMDo-#L!GdDNYDXkbm28pxp?(giB}1~ zv&823L40i6jX0y|14HkyO2y%-Go+GZuh#RVwY%vg32(im( zA>=_9pND5=zYU{05Bfg7ErwOA&2c)@zQ~YO!xR0g_5cvz@`D_nlD7#>1&e4}7*RXn z^Vm@eYC8=J`M7pup08-dNhF8ApNZ(pBnJ2__Y+1f+gXV9)m9Oc}zIEk}x?d^-&BXqkk_}5jzmwUi4j|Z&N#T>Jg4Xm6y>{175`3==D(xKYOR!S& z?PW0C+6b5=i>rbbkvoxg>q9ax#s42oUm4eQn1!x-Jqynp}aB?HEX7vF2=T<41YG^@LC&Mc{L9{*^Hg%4yNnbdd>*nLZu z(!q#t;&fNlWr=Tcy%q}T_(#{FY;h096mzG(rAz_MCF11Bk{Qw zsBx^kR1ZD(PpasaX@rFyMs+AOsDfeRk_oJv2H>#fIJB*I?nMYY1w!({zQ}+YlOar4 zi>Jw4$!G4Js89c~{Ch0^p4H0LCBZrWBn&WqAI9aw0B?RP$e)g!7plz9tpT__M`~>i z*4weGN_GiuJ|;U@Ur=z*fLT6zO-M4+!P1W52+I1xR;G(jWj1PNX*kKwWsrOkgPn3^ zk&K|{cY|DiS-p+s ztLOfTs6dU>4cq7a!lj-7(HQ}}*B#>`*H+)lE32)lfK zxR?M5mGgv`1t!>chQ`GS+rm}{WcWuT`-%k0*jNoMoT8Kz?DkFu)KztewgXs&Dv&1NiS=7bd&N#Ch{xe;JDqI}}P~(H;b-j(WpP zZ*TB?1pvLBc%|#FVRTp3;H$ESw?hg7sC2j&R4f4qLf~S3_cF}55wt(k_ZgmSIx@=J z1L@F*#JTNQVvDc}srIwi84v-FNtcd=%IhXS3rD-BL9Y6j&4~(A=02G1fvv?o%kZhm zsjbf5#&jz|mfrk1guZxl+YAS6(0D9Ltr@VTYfbp#~=&G1Tlw zmlt4thaj%;Kw!xo0`sPZB5XF}OgelxZk_goCsHMj#Ye9=w!m;T#9o>p__!8$)_p!T ziYa~X*Bpnu`1;ofyZPm-UnOP4rZXzR;<*3N+Aroo)dToI%0ykA4~g=r;b-Q9h)`Qg+O~d6H*` zk>g{`ZRmssJ|Dxv!(oki-E#_f;c>#faz#0QF?zZ_6MG#a?`IPS-XB~7Ol3RjD=MGl~EbpzmB2}hsq?|v4< zQ-R>P&QwWoxP{-EP!{OSesx>Z_yWeaK;>5QOiSIVq(D!rVwP8Hp--8kXev+V-~tjI zkl~(sfPWe%Ie*3=-uEeZ!_nZpUiMrVpm3eRIgF~Q)iW)mdGxk@3&Q~VunCYC{V?8fE7Kx8(Euj!f{ zGZKNJS08D(HgcFB2pMFUH${5I4B?xT$jZMj4ib>JiQr9i-QpdjS|4>Hl@!R1N@ zw<+LCYZIy9hUa<`!L2ucjNyCHDn6ECzjvQX`xF}L(8~{ zbDY9iwk0=)TzarvEt+_HdQyqNOElNxIS9WKWRc}I44`xc3pxPcx=JpLa>=#=@(e(j zt;{Sy#DngYP=}Mnecjl(ym1b}=vm#=^IJ9+X$l1LgC?M-(>hpu=U2i8y6z^!fi}i# z030U7JJNr=3Gr|x9blx_<}5JD(OLD3LZDvb7=NMa5LmI4aKlO-0XM;Z^BIZ-J4X*M z9-rt4yyF({P_oED5Z@Bfc_ElVqtzU~I~612i@D8$=n1DmjP&2fY8=S}~)%oWPSXy>miW|w8rYDg^3URKq$LvqvqaVe23 zo!lYPF!wgvf3(R;JxcE5+J2DSGwdBvEMQJAyCx>@`*Qsmo@S~ku|A<)E_Yv)ma4P2 z99@e&F0v(N1%G&$R>vo)_seEfCDiL0FlT52p_VkQ+ZEp_t0iASmSif|6*Xkd!p9Tt z_o{)YDKyZxdl#ZIN7TZ76y0O<3CFNT%!2qOjx+i=5S(mF6{_U5jS;QTH_rg>RMaBp z;QcJHS9B4HlR$>nipCg2UHxlZx#kCu}!Qv6YHru+` zzj8lt`&ZaXdw|fEB?)q1I|oT`rpauC9#~u~9@rmr&cZ8KvpPXCM0aARCb$>~oUfxq zmrT%zmfj%1_XJA!zNI43isCYy3FYho08aU;K$R@J9~}@ychDIIh1dFq_{5BzbNu?T6t30-4})(Ra-!FQTlykL}xEjFk&5>?&C1uJD?T4CTOf z^v16(tKw%p@HSMomy5zd@HXF&H}bF-gJDKsob?!yLh8M-yJJz7qA8?42r|AtXg-1r z-4TDA#4CZ}fkB>I=p2LZP2t-<#t+w;CLBn^4*M~fXKNQ!-zC2(>OCm!uF}_>zH6PF z@~BY+rGH=&dOdvaJ_@N>wzze{;C05(+{v+w<|y8jI4_-HfNcyNd*u}SatmF$L?J$< zDL{e`C=3VNW^4h%4>@I5ot2lRN4!*gFTXfLoa9Y3@iyGs)64H$AD%92wOW4F=LDb`Gkie3?L5Km4cI_4c54Z?Q8z~<`p%tLb}g(Q%SmrgSc4vjD_0>V z%7F-^-Fka4aUijjs)cN%B!PLAa;vXxFRRY-)$`6PWm4WO@wyp`lc|)KSyNkF&hjFBB@mYz0#I@zCT~8pU6Z9CHh#QWz2h_STx%W55O+aH*EIs~e z_1mC7hD3M6uapJ{YXL8=Et0am>Wjw$gUQFDiXc~f-ATU$SAAsC?%KHqp*r@IB|`pt z)$t}%-C?P7?};e~WNjAzkxbjeM8Rpd{pbD~LTjuJvMcIrTr#d8AQ3@~(`9BF74jth zXm^}@52hS{)c^QUuW<{zDJD(#tDpa!v_As=J7r1RTL$2ERY&n9RTmGK z$xVkm`4t#`dW>h&jE_x&K1i8Gw+^bl#lim``P-EWgc5YEFll*WFQ@(GOUfB1M+(E< zPOeDQxfbdJu@12sA$qxQs`P1$WDS$*DJ7_K zH}tS5oFq6z7pWu(2HX&^41P@6@M2dnlqG-sd^?q~yTPZ5R*g|r_4_LPbnmes3kK3i zyJ?rJ064gG`06$$xpq5-zxSw0Pud3Hq8xwm4=?4Q=kVtk!hcH)5^0 z~ncS>~(CY$*DXoWp>$>8cbD=(nEEU2bR0xKxzAH3K!RMccI} zs3FQu58}J4FHg=3%bM=Q?mS33$s!=mEdvX*J*67Z>n^@o)Zx7x^Z_a$V|KF?3a8#L zL(G(Ilg=?hNozfo+m*7E`3>Js=(_UfuJIR5msJT@E#f|Y+u!`)%UH7*-h!Vur$u_% z&j`GaBnRW{Grz0PvEkUWG=dhjBRhMl;0V)BVxL@sowS(j&BWqjd}E_B4E`o!I16Um z^HO?y5(5dF(W=^I?udX}wEAfLhIDPu2@arlc|Jw@K=yto5OW-gdBuG8@R8Xu+~~lS zZ`K$|StER+g#M&bOoRY(MTdF7tXBZVzQ{I3Q%@NE6qN~9^t8{{J97)oA9&kq%RbLV z{%09)BgRU6=6qK4@8u?a3EHk2`o$DIZq4u($sZDC{*3aOv7o1HXMZce9g6iv$0%NM zJp%w?g$*lFJ#M^?o?fY z$jy5#esB;{ko3|F?fPkzq-`gwMSwXu+0@#l)=S)+pb;?w#sQbw%S5p=Pi87LhL)F~ z;x1TrF&Pd&2`O-vz*3WQBlD`J2kdFgD_M|hK!Od>pGovAf$DG*RY9qTusYbB%dC9>05&r_UY@>wpYl0+ z1G_mGjioR#GU|TjAg485tZ=_M^(D_MmyOYlPbN)lDctNmjiAQIH!B4cVEfV+XEIp) zTrNu@8Dlgp6(3)ZCx~ck8R>%E3{0~h%10F#7V*&Yp_)Z?THI#2H$XELvqY#V>1F-i zdn5;oXLTsx(2n#)nP*Us-z9eihk``3hboBBWgqwQ=H37SO{r(ZS*`u2Ih@*TqJLH1 zyiXD8TkqlmCwk=p&MACIeu@E=TFKX)e%nO?>Be?Ov_e!}_m5s5A&Umua!R1ZaK4(w z(^ib{ihFYy$(pOtMkKwyhsjfZj6Q3=)t4!V1dDrm55b5OVG0qqO=o|QWK*R)xb4x{ zk!QAy#54n^6&vB@`(8QqxQNh9+Fsh@sG%u#JJI6#g7AHD))^NIX4IHl7!X4q-0U~- zo~E)6Nh>)ol6Bi$nPE zp{b~5hLzx+bQ8(3?00WA5$OP9B?>ieRI~}g)FvMLcuR|Ah2zb~G2f~fEp}NxMS^ep z2>Hl95Z`QKGL8?xA8JI6vkRsAz#uL_w-Dx^4l)6pJD3{aSA@JbOnzrB%WCQgS4KjE zmPjNK*?VebkLi-i8b`g2-N8^qoX`mGX`u-_@vi^9XKW{>O@%IjJXawGX>;!=xjj>* z>ArTw2?0|5}BZFbMbGl8=k z_UgG?UfFHO4VKU8gVxCkjdg(ROXF?Lp9YY{Uc zTnZ~{l~Cb#GHy=&Y$(kDO*czpxef31tP6Z<n`~2?>efi;E zRYUYY7k-P-D1z@sgttdjKS$|QvQhT+=}dTPDIzuXwHfAXq+XnAziZ&${Nx36?q~U!@#>6q#gwg=u`p zb}gE6X}AIk5Gi_|;B>6cZTy7Nk_=42l}$S)=LLFua`NGOtYmK6e!UZR zyE@FX1p3`HR1zu@(R+>Jp2UT9u2*+-Kgz8#pXjoeutPtf*Ys36$A*=?k9nUmR zwn@QFUd%^q)Ur*BYq~sYx1o4YWZl2aTg{7&ierxp{H5FP$M{iM;-F8fgqfF+G8STT zTr1orj7n5gnRNyLFUvr!rCVPLxNfW!1PK0ohlS#dYBUxvX(lrEd++CPnR*p-HlMC} z^m)JE!B`uN)d1kVKc6MtyCgSG5DJm2aga1(h_Jjf&yoK^>NDXD_npY`GeD~J%lAS5 z?hH)yeejsmm>`M5Z+ldGyxSC8njA)(p-bp}uYi{6ATeF$4nBse2s;qStt6H~VAkZY zjoyC2($71Lp*}2(SX+*D1h4-%OR(_}Mo`sSi=i33`LF2SU?Z9>U49*jD=0aP?w^KGwsTht(kOnANyOTwIBEWXFx*hgsqF+GPrljctqg z0fIk;DAzD|CL55Ew(Xa|a$ao-I^rai*w@QpvG?!y^6`u_bu`+q!9Gi9gK5|5d{}m zUPS%ita+~D%<=a@>v|~@bDZDyy(Ku452UCf_v8T8I4^R;5}Q+{z;BUeYGF@br;Zg6>OCowedbGU z12K>pGKur#@R-orlmNbFsQnk7cXw`=k%qw6{*w#+Zns0{6aZ;I77KeGqlfScDcNxd z-mUJpYMGYaA$3hoNU^ba^P9zV;&XaMNV^#4NXL=b*40|qJ)bRcUo~Xk+v4ZG$au&! zI7T+x%ZY4B9;k!8$m*w8gfPDj4!zvYvq{kCNGsm2%3;>!MyUGIVZ_sa=4g!(EU{d~ zzqE52M@LVIzTEmECfyV$6neCE@pQ4cz3?S6OlfA4x~OI^oxXems55a zy=fKn1!9{DV+DChQfV3jKNcYdBKt;A9Nm#iZUI;GcFMOvK}2^<8gn!*rlFl|0&}-NDUk-vv&R4BsIYM?q4!|&{9sx4Hm@sZFRD&vXOKF;oPFae z^HY|-HGTIn=N^>@$qQeDpkvT(v`}_r8kIhkad#e4StY&DKwte+IZ9TvWM=(6zTsMj z@~A5`N2=O5{=49!8J3AHw6#$#5J?Sy^>;!q3z{m+7DJ7n0*`c{8HeO9hH>W%!fIBD zGiCbYT@RxyVT6E#{c(x~i1$xhvrD+0wIyoHbqTG`+Y`c0MuPuGI{Z4$2dY z;2|QzMiz5y^g+vvHH3F0Gf_mTOwl8f!ia&f_*;Q)G6CGuk8)GhE6B-oNIPD}<~1{6 z$wWzU0oVx;^bw{kZSbYNEL0jmDxplh0qJ$Un^FAhIHdO_UeP3n{)0_ZfTg&S#IA~2 zO=^mo-lWY3H6uFA{-q23KdUV`S`OWE3yqX+wg=3(d`>)lg+CP9gnumv1jNt2TjIOK zND_o9&D2;_X?a;cg^2_=Mca0d4BhVR;w~DVM-2?5PHrvJWO82?TVL$?Z^UYJ83NkQ zPPZD#ZQCD0;XI}cHX={?2r&=P5555LR3W9U?od`_Iq2thiYpRkm1;Oi0M9$}#QtDm zZ7uZTyl&8od4iw30L8E`{jCMtrdS8>eZ?Brn>K{eDtB=Z+89z25-lscs1NBXo-Wk_ zuR~z82X6{}*11Y(w`4wpnIYG!3 z08CL|Jatc!pDGU`tGjzO@Jh5xanSM)=gh5fV1k)PxZXV4=N~5HabKvDaB^)qlbTYd zu)=H^%uZHcn$f!!-GsqNXI|)HUn>z#e8$5$w=TIIM#&1yKZ3rkMo`b(eeQPU@5=+y z*W}T7Mv?v6R?9O=@B?3DCDwu+eKCtR22lI$+5Mbnl7*Ib)mio|nuPna>jr*X2LwZw+mS%inbKKmXWr$02gUS+|qr zK$xsN8Mo{od{`WY7(8$yVhTC_%Qv{%CS_h}_ACx9wY>gv+5^+FM;<|tV*wMDpmT&+ zt~X^~FgqV3lkDf$z*75(IF)4i^H+M=pONwm60HtlmTDeN*!V_e(gicQZKCb@zlJ=r zbl}hnZsCe0ipEe8@Jnk`4a52E7_jiwue6o&^D%8_z3?=J_f!I1knpgQl~(LAS|+{9 z-98*D&@%wR;_z>iq&s9vA}N7xEN72O1=6E!M{@9pUHHKv6- zO-A3SSuoV<+EI^9UGgT&r?4OpMnw@t#cniNnsphIcL3{uIwEzV+8`c5k zQ;hr_=E1Z~?}teBB}XT}w*_1W1Y*79QGY(-E-$m~MudQvHtp>Cl~5eQFio;Pu7=wM zoOWlFa5a1P1)X!!h>^517NuLXd}PmJJrS=jTMbcUw;I?sxeL=Iywn!225PKN_l#Ez zY-mNQY}OH;ds+)^Jn*`|>IuyBz+N-S(cEfaIqj=eba8fD>UjI|#~sOW(Ry9e@8THk zZq%K?sKWi4{LZ^D@!R#xga-v%{s%ImEu&C*h_7A6vE6!xT+ZS-ZwdBX$fTPmhMs{2 zNzdoC?Ww1p%z*PlDn#%TI6CtWLU$->oGdD_fw&3Fy45Pq2B}CpVf4x9M$P1w#FX9k zi3S)ZGvcXP?sOw`e=)^YTwU%h*I(|vlRCeJMco4E`pZ%gtu;Z35xaXbt4U3a^%IwR zU5(x2FKm0HY|KXUlXrAUo_u-3J@LIj^t1ecHCzToZZq=5yx&I!Z5Go9k)Ca~!Dpg0 zTc{+@dhY9~)|f6{25?TDc6ouXemD7dZDTja&l&HkUN6X)AGgUmukz_y>($}RJLidi zhar;wlOjC|Zl%$zKkm%!3jkN$nP4`Y%oi_k$v*VfW>H3~>%+piT&H9}?utraxjD~9 zi;>V*&6Q)3_N78y$7y8;VeS0GZ}z=VhTxRc+e&}^+bv31z&?9UILdB}9Eb)cG^x~R zT?a|@2{|7mOZC75gwKgK%7Hy!W}HQMYeh9P+{hC}Pp)0rHPW6dVa7jy!zl0#D& zKgZ@E{BdT8QZs8$XZPPtFAn$m^Z04+XZx?rk*|pr1-+1A1(TJgbClMK}+ z_h|V?E$P81Ws4U)rK!-}r-~#a!Dq=l`75Qo&0KU(k*zvx{n23GynW%PnE7)eXkA1% zXtA7{e0hq5GuZiC4)&GK-wT;cPTO9X`1_yjj-5T^a+2>n?*gmF^>{JQo|KfdFWo%n zTeaWLD);61Cu;#1Be5_q_NlF^0*Dxk{!iz`QK?V{MC1_AW^bGYRUl^k)@lQJRan5b zBG^2%4AWTJwO>d^#l#p}S)u;hlZc6XmX|fnO2d;&{#pEBbR_qA`y~KYTbQ`rXXE7L zWENU}xUDi4j+UI5vS~`6O z!l}o!$cY~xf8|F;%_ALSdsHDTvvMqw=LryAE%;8iSb3p+sIBtTswuJcx#Er5qAT_z zR)j1E2%)rFx%ln3wxngZzjOxy&teXN@oXy!7(-OwcVwsVWLu1Fc|zX~aouXiQT{p$ zFRwpt0NDPnL!_a>KnIgX#k9i4yT!r9$}5X6YIMmts*~E{`?vRYl^!;>TxWs}!tgjA zg~D5V(Mf~d#QUyD*(!^Y`uZY@tYU9IMUM}<|5|h3DEm{CQhCnqheY8gRj|$Pa5;#7 z4k`&H>g@q(!rQ>tYR(k?hNnUqEbVaPsY?u~CzIPzJDz-B}j5=1unt|px6awMx&=Qd)?cg9` zAn6!3-=DDgP&$We5_9CHPDvW)6vUox7B@@UOhf)P*F+EkXu7+<1|`4wf(qD`+3Fzs z`nHem?z;t^Yd&tfPiW7GqUH7h9lPUtcBIGVG1t~a_1Tb+US|XbDQf%Q`PbYI_t?4P z_fzn>yqmCy-IP|dF~=GcIm}OnaNo>G!{q=?ABmmPu|!1QQBxD}wb&#$vi^EpeLI4Q zosLnHXn<%&PSu3LX8K$Ao#s1Q+_Oqn6X#EM$cCO-{Y|r2@PIXF>d-dXH2Ha- zI)i6>(c^$~fcT+2q4)_iDSjVS4H-Y9ZhdiZrvD*78UNbQ3mk>b-P6lkUAGZrPPRf!_)zk{lG!9%a4vKCyewZ9ouxyx{ zi`oGkCd^EhpDzgwjcUV%9t^thrD915Vs0HTZKWKi0`c4JtZ?6P@~rvoqv|#d-nLty zgZWi=deK^&Pa6yGrp;rvZH2rk{4Ry2w$G6I_-<9n!OAg*zgUO|V$L@L6n(bgZ;+}9 zmvlM96n!0Qf8JSk;O*L4mYj@tb7RmDG+!Aa)45jSzcX#7L#(l-CO3WNq(_6-`*6G} z%ndKdXWjDSxFmb@qqF0O5Oz;L4RW#d+kUwHEIQnfTP^4>93uimtKVtB4uGu%<)_2#Hc>JPb% zkOo5QoDcS1!aq!jD|?0(4RstTnv>|!d=vCX{h?Aj9!r$WCdM?7z3N47hpwOj8M;@7 zhC%0xb3i%((ho#PAkQlI)x&gB=!;v}CR=LTCVkVMh|asHTRw6fIUBlZR8^$oTV>fC zC_8zXSv+2Sow5V43~x<79%$vB;t-l*q4wmWDxKi!!m{M{E=^QAAJaeh>TBG zhN7BucGS_q!q4qJae?I7b(G1Z0~~YKzIzUi$U}lVHqT+e?z!Wgbv3+o!szdJUDu_g z#lcq{8aX@HR;a0lcak^8-El?sK0Bm9K<>l*4^|*gpB3wB1i;B^6Bwp*FNckGFljq%;54$c!{l>2>5iw7`uF2& zPGd~Vzs$k^J_}&JY&n*W`nQBW!6VB4{obF>T>|{(V$fypSJbz(+&2=5x_K=C1tL-y z!co3I;Xw!uD9h!Jygd&3E>cY-KVdfRYgs^b6d)m99>dxt@MoAjQ#m5TI>JKYmT+?LIlwTDeuwH9;Xbdy;VCM;DJqy6sWV#w67N0pQ4Ph?3>0J#5xq>MY2m19@wgE{K1tVFRmE^G1B;k1C)Mf>bN>8+ zx%agnpANuLf26wn@hI0p=dDUtqTM^4D~r`MqiKow2ka{v|~ z#B_^0JZU|>5EIX}UHo{CrpalaNaNO_|txOJ=XK%m!3suQU$U(|{U8w2Xi z=KStsKTTk{E|K|HOkrww{w2rc<8*bm0*V`jy z#eb&>%P;IkYl{8j|I&%Ve_Mz7GB!kT5eO@KJAd_~$Z@?uemS)lAlZlJ5rP7bgN~sG zdxoV*AYx)T{pZ>1=D&3xZL|%x_cWq+o+tJ(@kZ(8XTJ5dlvAu}<=Ix3#you7QpLvELe zp-2jhNR+4HOVxc(LECr6l%z}U5PN+$%opPa_!y>ZNaB)h@9w*;oZ!xdSNBbR<`w=R zuGga2+NX3DmhH1gd}Juw{3qZ*z*5&AGJcQdSgzMhXGfR(Sd9)txK7A|neJ=v$F*lL z<6W=77`Io!J#Q9vzVJ!{nOFxt`$Fas+GVE?f~;uoufAVQ320@iiYO<8Hy*dYD&$5a z%>P{STI-yRl~9*oXFzh^v7RZZg?S-3kb5ym?}7xI#uMD}t7#IDh!(09z@HYufZY38 zHn$FIip|GAt{&UTg?F8)m3>T2+3*$6B6vAZpcm)1^QR6WWzFC);H(46Y$N{{)2PuN zawnSwDwe$Q#egNQzbuzWtr7ZEy7=9mxq`Jb+xz~lk*V!9k(3_AuljdT4eO_iT;`p= zS675vAw!AcI>}Lhsn#4{XWvgfy;8zO1+C@~NEO>#`0#eP*SqK*jx3ySu1LI>9HEAD ztu1cFLu`6NzjBP~g5Vi`rOtRUgHqXh3EGuS9^25Bdw0*p3LaKZveLz7Zy#J zh6(-m3;sh*m~;EzJC9FH7{Qk13SPs)4Cg}+v!Ruja1CmXL~Q) zujb|&_|4`AVK86#nnNE(T5j%8e+bvwu*mTi()NZ zbNGc6LO8%fxFUQI5JQf{1Q&wH+}UKwpMN3iUOAU0p@^9L#JAu$k2)f(k@IPn@2^~b zzGSq)Ud)SW(bawPrEYYVmFkBMf@$Fr*O|LzF@1j(&5+J4mJzHE&hHAAP=>1!9wmb{ zWDvJnYU3oqxOy`C1_>anmnt#4EVB4Zk~y^zRGNX0ubcxO3+p0QM5m+n6F*EtOZ+On)4G%#|kJ}f-(#(H_Se&QzS6LA8p-&_(o#5gmD5OvE^5dj?J0Me+X+kH48 z*;-Xd;eZVj9+yaJa8R2eRYN#M0jaf=z%f8ROt5*r3;ChHi-SxuD29UPns41Rn>Rrc zuIe%`1kJhM5!1DI@)C9CGVmCFd3XtK3B&bb#ob4*6bo(*NskP4L3I?W#B$BzcF0Q= zXwB?he|O@kpBf$f^vyCXGWW~2=hV>_coXJ7elbYB=oa()Ko~=M)?6Mg$L!X8czq06 z%vAgnLoB2*{#I#{zE(tx8lpYmCsNXEW;qy#Qa~p_i0&a2+ubR*Bvgl~y!3{c=0>M; z&om8jr}fvv)9O_6W{}$KCtTZ-X@SKrH!}EO=ZO<@FAp+5amc66Md@ zSJ+_ZKhc_Ye&(;)vo}T7v+my&biWhkey#`eRBfEAD&`q@`Jo@F9?XctV=Z*H?!WPY zMn*0-Z)|6b4c0i+4fZ(VjZ{@JyvaR_ceaGW*Dkt*w5pDrX-8e|VcbmdQ#pRcR4RNFlkDOhlA37HK=l`EWx0VyEzy1C4{ex~}{m6shbSFM7%Gg-pfy(sl>tnF% z-Q+&6u9FOs^QEBtfOF?D(ck^!ylOg-xMSeiQE;b=z&UD z$jRuLhHI4@!CK%NiS7s1GyW$0ZZAj|YmbSshEGcyx~aJQ`ww2KP_^x}W3I)`dVTldZv!JLYL^+h z9U|v%_W!~*$cuJ!MK|204l^k;HtZ9k1ZqW6e4>-J-#@o|peUh1rBbJjc zN=h!!OTZbe%aCO8_Pt+^hi*302E$;lIJtpps%`rh(fXZjdF7yX9M`(%WoVm*&NubN zlzIwuZBGVMs|I{cG^Z0oQi|=Lai^+Y1y9apna(lwr!Uty?O8J1DWFGH-? zHIQleS0Rhj9@RfDjG83Ug6xa?6MKR%^q}0p{c5gTqEDG}VhkR^F0%;!TP8n&QWyS+ zVsNS#NuGr#Nlex*%LszmqnT#NFA-*sHwA4!EQn}p$|Xh5GG@3dPGS=XGTgE+T4w@E zZQtijIq}BI1{cQUr!em8$sm?~=T9oBM|80TK)4q+OE!77(w2y$c8^G?3c7*)9DtsQ zYC43FZ12gSAAu{R&wBXnsHOWs$&gG-QPWyMAF>_Ht%C-t@lTD}r;s-hbA;LDyQfqo zuAt?hQh#_ScJ9XGkjB6e3MA1`S1~WW5C#Y@aVxO<%tNV%*f3ihlNDYOQFvLI;uvk% zXIOnCMm^-Ct3)$=N&5UwLSh);h)e$^poLa>Y1iXWmBow?Z*vH94|_Ll%%ydev& z(~AYNl&c*f4%**x?-^p?AL&NGii{pi+XmFdp$Hdp!I@~H&9x2ZHwIZ?b-XKjD&?ob z&ntN&6j>`NCVIDP$87hjqz2_BAq1BrVDydj{$-lN6mpC*A==U?{>NP)ZQeSMuHOi< zLd6y2J7M&WghqCF?1@hA=2~YISBIa#q*fCqm<$?{>%QI^@bh#BHU##8yY?Ki8eOY{ zt%`D63Yu7}pO_u0i@dajo5P~>@p^N|n2CGxhaNoc)ph^@t1qi4y3Y4RoOTd1{pW=1 zWq(5imM$x@rk7JkGX9hErTJG?_g#1lAjDfv&EXTcd32h*yihPZCjXZaguEY%;^NMw z?FEgRI{zvMD;5nTra}Q&e(h%4xI61>v2%Kv-WJ3p7mSIVBp*2U|0A7Z|N7kLmi--_ z_*XdQQuA%DIwZ@Ua^N3mQ9kXy(Z6)^uf!BQ6KnVR1H)UPHXIjT3DP}0TZ>DV4OGOH z>C6+n4OAZiPwy(zLGc?5zl2Re!0A97OnB?!7CSB&+=AjT?i4PqRq z^JDmH(r-TWFQvDeB5NA7jCn`5{}7D2Zl8<6M_@{V;FFh~BEOU)oiHUJT`1BBpPV zv5HEtO8@d`?5a&6?bUn@I_UZ2I3bJfWA{B?S4ff3GC zrinQ8QX85{B)ucaCZ>3#A~5C>CaVPU?;FeeH+&T*|BxWS+z7m6_CB>LuO%qLNSq$k zN=-4G9#x@MDX;9-jtfmObWq=8viC&md|vG$*U)uD_!kHUTQYzD)*|C^f|rUR>(SYK zSd^wp%gE@3?V}Fsu1n9qz9BVv-`c?t$`FQH%e5v*H>a!N>FLBi_lyR8;O8x{p_NtH zwI&3E!4==w`37)h$$CtEYQZ95;+9f}-ql8K!7llgPc;Bu9Jih_{_9Av(TxfU#rz00m*lL6<*)#1lCx-ZkgQT^QF{Wi1^q>fAV7&uo8en)B!_|A7-)4(yS{MgPCJ$;Q{SC z?u59GAWu>XN}00`m5e8h?#|7h3OE3kaHN{{6clzER>GU5!82e4HTcbaw@(JHk`QKQ z==w#nS)R@t$^iZ-|YVivk$AhQ!bpVS77isElQG# zwe(U~Nu$aAWoOH%6Ib~ahl=c-Rp<$SZ<+Oil~CkiA%W&ak@E)9toMRz@nrO(0Z#9S_h!|fDFR83wYhK-%1 zXZS{GA!CWycna?Pv{Sh8o6pBI6Lbpu9Kd@r<@|sd6_rO$}(2g zJ8|yr78)RE2lf1p`?;W=m)t;S8xf*D*{bWilkcXSjnHztNNFj9s2C`(pa84a)?03I zHb-ZHHEavQqKRJ5tUVUMenK~A>yeput(F`MHc2px;>lXer!aR5Gh69~d(`Hc5iAN3 z3<{Tc@a`Fp>kwj`uH$TtSRuijWIWu66@NibnCtc4ZNTdp;wcR@P-ODW>X!t-Hw08@ zYCq`ZZ%m17j8=H-nyJn^v+z)fJjc?j7$s^h+AmUn3ypr_T?;DV`!7_MohcM#&c$Ty zE6`Da{kOLEdyr=p=)-uGxGG7E1NWth{aWo7F3~Hu;{L|H%wdsX-jkW~enbBJ>^>YF zv$y6fp`AE`m!JXce^*F1$Fn~_ErW8%+)c*pK@dPj<3Sy8pPi9~H2HdMiT<$SGu2;HUOIRek&7JjpzN57|wPmZx_xY|x6nWp|g%$B@aCHQ7So&2kEp8><`V?XI z=D@W^>>on?4itZvRT)4x%_SrEohBtqn=yLz!`XH7mQOemZb911|n@Wk+s4C3>#CO24VjZmaFRkm#!&BA<2@ zwk?$mnAEh=;0gjij=v)|qLL5$`;ipA%i-NDUct7@&}ST(cbxpE=*V!N*`mbb_IM^F zXDGccynGH~dM{Oe7gIlQ#G`~Ycxo#Hm9WreJP*)`#NFYj;N4Rnp3LV>) zEc2CyzuM}fou__H5NZ@e_wDBAKIxMu|0oo`Lg5Dbja*o+0ZYe_>RPnm0r3VT?|l^zyx^%E)kDEz>Sx!_%I9 ztfcQ;HI&0>QQnT0a-m}+*F-(7*8JZLqOxe~$;|v(8(Y;#VlBbkfrBNh{QtE8mw(aB z|J#aU{%u7(xVXaqA;a%qKjOt9x&GFxLOKvX7(d?T z-jtuPn9)2VbCsGIg+C_k$VXqiIvP*C??EvPR7Z#lH1(Oy=7)u2d8la$A-UPRL|!J% zq5+SU3vt|2Ec}itjIghksj=}a&{c!MQ}L?8J6~ED^@fUR36nl%g?qB(S?Gnq-^^)B zO}DYHIX*o?_?(snX`_y8 zaTebXxOv(2vAXt2GPG;iJTKskFWbT2TnpLgwVI3o3j3^cgslR~Uh?HFAsy-ha^d*o zdbC`=CA~Bn#O~{UxS-d46B5#_9pAq}O>m}So- z*s6JES5)Zi1NuWh7B)50O{j?$ehzjSvO~*(QBT1Tpu-0d2>o-{+~cPWI7HsiQKnb# zg$hIE;~}Z4=2TQg?1TaY7M;jNJYfRDXA=P`ksIj9sLomAJ!QP0K(Z=cj}OyrKRF5e zsA#K!mYr?9QF>PvTSx)?sFbxd0cP>z)Y7SPzSpk%TajL@=Btxdo;JivEo+(Lo{wnu)Y#^$pLN)H<)R0fKNJ+5K z6q7CP27b>49+c<#^q#WSS6cIDfdT1~hUU?NruInnMa@m-s>^SVo73HJp4zc{+Fk)op67;RGIy%$4c(4BY^NXf zeiBkk)W`SnQz7gmbcw>a@EnISADxLfFTwXp;Rt(tJZNik9O=HAeFPlS)4{p2P$Xq2 ziUBd|!#_MnX$VHs78;XXo2?|d1Mrw+=qh54Z)*OsGnHFQ=uvtoEmms;WbKY!y90uv zuaQI>j^SKUR@9}dE_hO|?$Y2 zX%QBPIuyE56w8Yr?sha6qS{|T3u-;4l%zsZ_*fW}Wa3x0&%F=q($dW7w;i?*#{&VS zbAZxpKXTAbx?9PitSIRdP)cHQT{bQQFZ_o5>)zm+??%-0a2(`Zdi7IN1F2nIgWb)Iibo>%)Ru%xA zB&8Ww97E)DuNUkTb`d8k7C%^5q@%(C+aHv?nDV}a4}QYImWS5)3yh4_8XBYtom7pA zN9W;TggWrje*>-g7G0Naqe;s#laSvx(d;iz&3gPls?IYS4rqJ(gVB4h!|0+D-C*=y zLZWvPHF~e3M2TSZh!TPzx`^II7rpo1dx_3Fx%d7*yvthFvSvOy=j{DFzx`}|s>rO( zLP8C1PSH&TNTjsYTS{y%0+^C^Oq~4?F+4v3)-F~?@0>*M9z`f|&_q@53sMRDmZ+>^ zRib!3H06Tw8)Yg58f41~OcOdFg^C1w6Lhi25lAf3k>Q-}_Bnr@2@_sK+Ffly<4r~) z%r}pURq`Vpz_cIE9nkWi2Lg~PU0*CBiP6W>Gbn@wOl%bqme%~gu=J? zp={>&DFh-v;JtYqrf*rzW0(ODFD_qvrKLfnHaUJ?rbMJZ!6j$tef1eT>uuK5A zT2=(6#qI4(cZJvVR)?yElH!}u8B`mFVtm9vo88HBlNct4k|skFULCiLvtIs&2siVb z2i~jz4sil59f++3jx|9;Y)H)uO16SZKbmxvhKZ@_>P_X+1ubHR2S0JBLbpzHM>5-g z*2P(#h!1xyHe0xLu0@*G(3Yd9IU-Bm#9bf(F0doa9>YY9gQvtE28PvVc};H#u(mjG z0h4e1v?fK{@9^&CC-fcCYr`3Fh8lz4KDee_@suDg5P--G?9YW^CVQZZw!*s1-%t6i7K`w4s;_`9 z-aq_VXTE51%hzl@Ww{Kppu_?GT%pL#0ot7ht4hnqJSB=(FbbOd5=m;}C#!(Fss_^M58c%9v}j+ZXH`#`P#$U5 zuZi#bn;{kS_yRmLMk?l`zihc~+1{EB{Pob7>=u2D(=MhSuW_1w)oS}jFNnB0*x2mC zXd2#%E{M~OG5*U+0>|o=vbYM97LVs4H6{k+-DhBuP>&oPvub6tvH|!xVykL@=3m<| zJ}~iumF^L1xM5fRKg#F}z)Ew(4We(T0fy-g*Q%A(B0ESUREySmcEp!;7!dr?*)_sM z|2NpIrm5NMzTyasH&vXi3q-w~s;vLCNgMpxMG@Uwca&{nbJ}bW@Zzbk2c>||xu8!o z?A2?k{#{v_3)lO zG&w1C6lvZI@oe8m6LxFIcwbx#NK#?gWN=z9HLD#1z}~K~D(p>brYu;1LQ5}d8AnNg zcW2#-k&&wJDwduI1{l4$<3Gj}S9LLJ*C8+WMy^qJdW$+vWV^eAwZt1LIv;AI3R{z`n3#TSu>2NW00!; zFp==EEf^tZx=ENmpS!yZH{wZNWMiNGdLE1MjXJWYTH zYDLhTAHudt@>y^Y+Q>$j;+Jx<pB7t?(974X!)7<;J?hSp^j78=2R1|){Q#tCna}|k4 zP(9{G-kFdQfh9Ra3h75C*O#1AFNd2ce>WyTgimjs`*>asDlc?JXnf7s)1Q$q{E>GF z*P532-1g!GJl2J^W#ZQ+^oDvu{mIa^^tV}P*Xf9Ixhq37%z->Ej3}-FjocX(s&96c zV7zp#BdXUCsiT!eRuDvTch+P+>u2md{0fK8rMy3FttI*uYmn6Loi5TzH3Z%&?jd24 z=r?sw1CLa8?^CZaoF1j&AL-}Y{M?p8vLrY3<`oa>p{(dO^mr*`FOzsbE3WN|W+vS* zH5^6u__1C2_OOHXigNsVuX^&=>j&=p{u3Dxc5SYO=xc?wE}_wl-|5ZG|5Qo@RAYqT zW#SN8q}M-N1kwL1tMb}zISwKa8gs6`ej$hqhr??G{es9IGyNwgynBbXQ2V}XXb5L} zd%MzMrrcR96iJLaB8x4~(_3w?+!Se#D1htW+t?>GZYmoke)A_cZ=Bc&s_U9!Tt2sV zV9p7HNUCO)3e=A(XJ+{QBC`&CgCLaxT6^d|iLc#a0Dn2Rr(*Dn#aNV0@nnwx(#66A zmEMf237QR<_ElN%ugK}w?foenkcLj_&c)|mdt!&h?S z@*^>2k-|%A@Kprhm6(#s(P+cO1QcOL zPFo@hYfqkIbx#BV98G`N$GXv+1oi$ByJaGEcM!`eH3lqT{H4?Hh$*M(?yZ2((aqI` zE}cll(KQ4~{5$mj@=;3Es<`P}s%|KW3gzjLzH6iHUb^0)g)w0G|EL5OGSCSqWopXC>6t`aT5a56RRrz%H9whUg~d|SNc!$D za4(K`bYhyVuI2?cZ^Z9pV56Xfhkiy}qc&}g;Uhtwh$M|io7D?%e=WOS)fuZbxmZ2p z7CeB6cYwBI>)~P<2oL(lZk$T2GkMcDSmr|2vYg z&ne)uj(ngN8a}JSI@D(;r&#@&cMwt}5Dh0^r=A#><@R;NIKgjms&YaHY3P7(x}4{7 z#c;Dfra76%=6%DTW@!x39lHAL$ET&G*Leu&>w;G`x5}w%0wuutLCCH_luRA{=0Q1`(WkOrupl^|beHQDMp}4bmZ`_~y zwFs{It<*?f;kxjCWlfCPrt6LfuM~`7I0aM^U5RPco5OQWm{56B?EqPXe($cOcoW@} z{EEBdK=#`+|G9GoVNEX4e{PIyQ&F!|FTiuquPKCy+HKDgT(LkwVCNcs&d&3lwHLB5p>gHv_$D>fW z4FgItX{&1F25F_>pIrM_a^bh4J@&sjK5WRg^k9SPsXwAAEuG1^As^7^hS=@L<}5A& zl{q|htSo$ohrwS>t>pPt8MkL*V8vChE5tYJ{#FzRBAr|6qmaFXE5SP%Tx^<>_>(P< zDUojsQKlnvcS4LK%^`(Yc*|k1ufp%%04CGcOweB9$Z%byTFt}EjX=D2PDQ;k^GfHm ztJEZ#Xw5q~5gK4rVBnGxa^|dA7^_W@>GTT-B@o_+3hzT&2~;OHn_KC6K;~_z>U@wH zUqDfekb{7IVXG1J_|C9d{g?gV;@mEI2=g|6ivkVR_uG}HBCMP*ZO+O9Q8}3x1p1pn zqgle7Ar4hp5XaDS@ak$bCiK(|PK;}xUx^9D+95#F!?sfLzNKN51yg~4YsSyz-Be*+ z*Su6p;qUmYW9jVxQj5vJ7A=3F6VXr|JGv9YQ{=Mb9k(&vX7ZaZcoP_8(W?O2G4ncI z&3j7!yV@lvd0I^DV_V)ctXI~>VFrmnpb=*o!D5kPxIid`uvg#{N&!2SF!dy*#Y6Sd zQoFyCQTx~j^?LKp)8jVCN8vW7mn_1fi@qmV*%zgr?JwEY)O7Vl-rXFTEryOPHHB*~ z`yzjBcHj%=qQH_yJ0W+=(qJ{zTiNRE$}j*C%5)2kP7UK?2u2##R zdNpsxutSiaCZ!m)KkU5s3+#@xAKRHs;D^XTY8Zk82vTM=vh&p4K6>r~_(3Dsz4!nDSL_Z+hPzhz!(4(0owI z!N+9ddUKXOA;q(-y!=o#cc*IHA5fscz|WCxG_!wzc&+hKiV(leA_5BPLSE$y`lB~Q zicD8Hh~ifD)Y>ZxGgWv*beu>iW!*iF%f0s2e%B}KQ6yaLhPQ9#P*f4N)Wm}z`}69L z8{HAG0|pBVyW{d=cLJjX;%r-9AN%u(i?fO)xRl9Z`hiCYi1sC*%Ht2U*0c&$a)Psb1gOPVjjK;zOZR!Jm znz2A=TC+I~Ppcmexs(;qh-c4og5~R8Bb_e}J`MkvIBbO*QiuE{846*&>ZNm~%@;^_ z=G4}ZB8#;nyNg_WqN^wlmxr1z=f~O}djrq2hIp)l0~-slUh9RiQWmk}X=#lm;f@C; z?9scDPTi|`qThqvW(BMZxB+?@H{tnTXZ`kn zVlR8Eab0|b)^kPTYc-o>0iI7HF{MUr&d6*Bbh#GmU?}qr(@6du#;%ltJ^W)kuvzUn zGkJ~c3y5XOjos%cmah{KN~_aN3qF^C9~l6RTadbIHmWPN9}6+AVES0?S^u=}Ia|}Q z*2x7rlp5`NYt%Fw++Kmcd_|6ZbGQ^HH}aB!B>XSG9b4M_j}=J1+F*Z|oXkiet*>u| zxkHxJRO6?_ip`>c#oIs?)(TXzu11Qly)xY9)-+R6zTD=DfyxmIMgDkk6c$=9LLM;} zg+*axn2Z*W%W73sAp)1@#dG=J?-IwH=R@Co|TfrGuG{wuLqvxCB0o{ z<%5H@9GgtQM<>{19;{iC@iLSCIzY=0!ZvY5J-jLWk#A>n(pez*sMeXT>+;f__oX|@ zLfu!Cb_=KBos7&w^ONOBUU7e%Ca196zVS8-&p4rfVdfe|{ z3#Ed<%Q%&&X>(J4apJ`Dii#rAtufWq)Xe?-sQ%F&{|s2f9751UxN@aE%4h-Mt_PVv z)u2L*2db-TVhHj8)~@%aeypy&t@fyCKgy3nB65|SR=b&Gssa_akp1sH(%WMz!04${ zMU(r}h-?cvjOmUnwJ)0e=umzUJQO#D1pg=sj$wS+SS7${fZtGSF}3a$WGqc=k~ox# zB!xz+mXBd4Gjro=N3eJ+bGjhVy}Jr41h-6YFjGZk^CvK^bS-n=g#4{YFV1ZyBfoYb z`ya-awD#)ZA2!uuKwoJh8Z07WAI(d@J@?I=wP&mmzXp013?HJ7X}vzGtg{i z4L@&g!!cI^2LA|);-@w*k6cWWrrTy0IoPy~Eg_I)&%tX~CGWoo{m|;75sG```qB3e z$$C#t>;5T>qkcEk{S=fIkDy%7MiLRSMi_qis_=3%VcY#vQvKrv2jOKEMkwoQEKFma zDBov|dt0?>f6p80D%jC#HFY^23n(h6#YnxSBfF!1#00uQ7tb7`a-27@C_ZM5%0FE0 zE*rvbDNZsyG5X#Z0GDQM+*{SoZ3&D%reQ!!rFs|@vHAhXM|c*?kwW|=_ESB-XqJl3{>VY`B}9 zn?oz~au>?F@>qgRnX1+H2_$H&!EOPcQfB_dFOeS`bhw*(V@O?&U->+840n82e|qT` z)N#6+D`^^dBvy~-vU|n=>4Ynq(yUK3Kc(PE=d|JwyL2>wAm=^^(qB(sWR2rfHlcnz z&5kMa!>{NyDW+}olY(5|>>M={(TK1}|9V?h^pRF;AcC*uLri7G4A$MPRMh){Xaj2E zKM)HpUkmploT8xlH!BdaS9&Q0q+K0~4^6j$!GSa<_Xis{#U~4}iiZuXR-X~K-LS5k zB3b5&iirq`Q`C$%#hO{n__*JM$-)V=rdgp+09O|K^nL0g4!W-bYEOQN`UId`IegT$ z`HOVxX(%_q-p?T6Ojt6v6I}1)gDN&CZg+aZvV8w;Z%*Ds)^M+(-7=$*Y}8eGB!T8M z&4Y{8l!j`HWG~>|cBdB=);xTFeb#XjnSQdgCs+JVq=D_T@WN-Iw z!LbF}8C00fh|i>5tI_rAq)Yt;0u$LeL=L*DPfMTlaApmp6*{Wrg2724JbM~BRwg4rk_ljp3sCBPXioR zg6M^uO(W;#P!SfX6ku;ZVg;V$!GY6wxASYwo1_A@&9gqcJRu1c_TaB3+hdoV2+>kW zFZY99PFzXd>nR6S3=R!ps;NJMjvEIvFm2w&t&OYpx~>GWy3UxmBRaOS`tyPKLH#1V zCOjh192vaLmm@`=)`-6JGdyfl%ik#+DocoIfco<+xD*QFlKLe6c=Fxg&iz;G)nUd) zcXq}^vr#m}sYv5tJE%(&rNv zCYPW*od1R0gphpRPi33VxfDMO2h->qD$qvic!yoo9lu)>)yvfJ&R2I5wyS^D{$*z` z8WxexvWF|GN0qJRAP(nEtW9XOO_|82jN;`x5Hf0Fm4<)8<`FtkS?)}ok z{4~8JyCt}B!zYCs$z=bD!I!y+sltz7x09G`_UZFvq4-yYt2*gBE~4V*tc3=NgOMF5_5{w zZxk9D(vTmdVuU<;>z9Fr=ar9*Y%BkNEI@x3(gnOZHxLRoM^OACL2GZQ&p3ibBK<>S z9@VKq*@0&ilFz@o*Jyr{s9GtZVHj+X8|_yks_w+#~sj2g^o??D|L<))DbU#0NSS8Y$NE1%o3xEI7i5#yFjPPi5%0am!~ zg~>8sE!Oa=A)2YLM@O$A84jgV>Jr%2fESbcHcuKfnfSiG(O=**j4DL!!!2Zh{8v@w z$#FQNBh6%$hTFty;=SFV{nmmfG9YYHp|d}ajzaZ1WZ#krhr+T~XBM@rYrNY+qADwwE74S!K#UuXbR+JSuIaKJirko5Gh*@g>L0Q=CN ztl!gR8D|l~iyz-F3?sg@P-QcshiKSr;1yR>)Rge)Q)7SkqlyEs@~T^tosSS`EA32B zioUhMb>D`FW`hC1)hUa46RdF$CI z6O6H>tk)3U^t@^I%M{1Z;6g?d4S+}h`nO}~y(g(5ZhAA3J|()JU}ZkHw4IW6Vo2yn zBejY5{3k28Rt{Kdkj+QU+^mHp6U#HFL&3yF8{>Eap2y8}n-;;{qeWUNMDXo>yjalitm}2QchPyB7n^s*+!-f;k#_(n0O~69X&KCq_c) zU9XfKkk@el84T;^PgXvOK%lr+0QI|f8kSyOgbj+oeHjqQEsO_iF07D->VwkhsY@TBWp2Vm1bC4wvo(k=Q53eZ7%j%jDf{91XhnTh>Twu(6?Re|fMYgCmo1f` z1p`(m$t5J<0B`8bag_X0d+rD>@Xd#qKUdhz)w~>|2k_!WnUXNI;U}yT*6YiU)y8;! z59iDbt(R4*{Q7}lKZ0Ec5+9Ns(#|Ae+mu4cK5`X(i$bs)Kyx*(cn6zm??V$xq@K9o z#k#$xZ*WKxpdJ#=bOigxXzC^6-f`e%B|!7Fz9I3_X!es@mry)NYV4SNXIx0QD7>$g z)G>d?X#qYQkXQ6xx0-{vo2-H8_}8a4Um+p*D?tp2lG%86OvRb4B!JZ)HnHmoz4r)i zEs|B1fvq6=wF^uA2%u^eM+r5|z}VgBO9d^zq_$IiT`0Zww87?#79gQnJLZYyrw>dY zK5{L`tppAFeRFVnsN0^gDs^#{kh%4H>CBdiTp&{ZwCzE|m-T&kK$i?@pV{EJ@ibaL zuq&Q))7xO_Oqs*?qIRH`I?hU#JNxo6ac3UdKov27??e%`xt24G_(up;D#h|8x`jEU z!dbsx%L=x*I5AJrb%JliD7In1FiCUT8)0k*IwQ<0JEac=@EJJ33S4%ZCi8r|0B@zQ zSJ?dWl_zeZ?5qJL8>PdUy?pLAey680@V@(V_7mx%_lnic(aLgUmbe+rq2iHzw(dky zO|7)+@6pPaUx?-i`FkP03I%}3zu_;#8FXfb3FO|gn6jZVeklxJR@{G&MS+9l{e%45 z_Zc_iM6VB!jIyf1OHxrq{=nFyg&7OCYJ^%6$*c*^l&cJuM|3-K80JNvlB!ypId||E z1OSNMDv>}*309MrE1c|;vr_di$X75EPMdikSPJ@|W3<5ExMvADDU|$)Kt)I!&WAI2 zG7S)o&uvedkem#MjVb~o3;D&s)sU0ojFz6A9Y>4(Z#c26TBwAHaihJTS(7))iE zK@>L$QH_1Kb`WpvVg*&uSEMgU;A>-Z*&t#17t?T4FfX5a zZ!;8=YH$KDU-Lfs0!o1S6bFuy#j-Ky-53sXrVuU@y}F`>(B1&5nHx7myi>Qr}s+%^e-M5Z2|CI6X;G2!)h)6T6+{ zXU)E!;PV^@$u90WaVKKY$lM^i7l~d*tZpyLJfZ=;56iLMgX{IvvZ|KzLVEM>1~HS} z^CFytUl_zr7AbtQ2{wC{fJRFHl(?GCgMep`?GkqPaS{43JagA*Cr>Py6wkeIzcwX0MCz1fw>l}aa zepeV2%T}(FMW_;w|9qWvb9!V^82ouLL6M|lMhD3cXF7v0)aPfG0!1~L41&Vno^+-L z$e9!GFyFd8vr|T8>!ho!TK~)hNQ*7!ts z(*{Y{7isBy+1;&INZ+i$kkC$AVSs$J%%Rk>zS@|&EIUc~cHvIoon+`^aqQ$s#4q_O z$4XAFPZO2C_9#;8Yon@GFJzaeS6xk=lwxuFX$l{#^{slMo#$?)HMw*jtUy5~Nu2__ zzNi6QTf(UJ_h-gTByy+C5v+7BxExRq58Mv18?M|HrTt$+@L=q4KS2Jk^SykJLVUmh zZ+(n}FG)taFUCUMvzSxM75Q0@u!hC`-x$QPC-fOzOv2vYNvrg~-a&Y=D;woaUY75+ zzjhu!T=li7D)Fy2Z;8B$NC@(5-A9ge@KKlLi5Bm+s!oK?>f8w8MBsR=ct~H}wfAgY? z$%Xc(Be|0`ur|Q5^5cJ1+ua0b_eNN6kANRvVf&?rcB1#ah1IP z5+!kUy>TnBZP+JH#D{?}}Hwf9M&&xyZTXmm88 zvHuaOh?_O)LY=0$n;Woh@f=X=yb@*7#N9nP$>e55vEVgcOI6}Il=ZM}CZV~JyM5~? zx4=0OnSSN@P-G^!X>1TLRl&FK&VbR6{N&v#TO3wD!SnKT0^}kkFcsrT5smIz2Sy6Z zaR%rPZA!jvo%I4W!56_7G~TaJzl9SX<`9xq<;Xwk8{pgRFkVdgN~&Hvw3bW|!IMci zU@3mQ>ff{JVG_E%9#(CG&0EZ$W(d-s(m4(RyGC=Zc+w9e-Dfek8yO@7%y6{KzZ^xRSl=ZxR4>L1d^qcKG=4-Hr;63eo{p%3xb>WiWuEh8Pr_w`tIoyH zMhQqqK`%XKD8&vOUYoStr|2YKs~tveb*1(QNtjX0EX}R9IF>R#UF0-BNA6081jboo zMiRVZATYI8t#iMbp+qh9S~Ej7vY)t`$KMXJ6yg|FTOiNo{W|MyRo;pWL3!-OXt6fGZv?HUiKB z#k%$1ZoI*NR&*Wi4%WUs4K8SvPnfKYdDgZ%$KRtR-C->}WQ83rQ?Q&Z$EWm3J*mZS z-ar`4{;aG#No;hsC?FG^xCfuydFM=N)NAii8b&^`@eTPfd`~bYIPRTK3c2H8BG;c3 zWhH-oCc4{i6M$zhN#CV47XdM&R^T?4ldKRKJ}<8p@T!_$2l0WcT6D@@QN`>9f5`qa z_)+FAFV*{RyDH&1IPKD~de<7E_M^;HrUnX6x=IKF1S_u-iTMKEh_N-xVtqlIG$0F z3{jKBhPR@%@xs_I8t2 zMOFDmMh{xwf$oboYJKvGmhClB*)JSh^EC2vgqtf`Dzn>HmS%g=gS@+x!|>+zDqLJC z^v#X(T-4h?@{bA$!OrLN`Im-;j{mSR6%Nhf8tRuLU;Z8EvQk_-2}I&bt@XV+f&WuTQIsJ?DvTt3r= zjTp^xHkX?W_y+P1#`{76WbJD{(RUym z3F!5AL#d1NJCB$)0h%8rI;NTxh?;0;{d-3F?}rDh+V|q=jTWZcEpp;q2d} zdTOh<&No=y zd^MrvC~t~P3BBYw#`)gkkr$GA(FrkMqZv|==?eu|*0Uc{9rZ#IUax|KL96?~(%%AM z24-IL#ISFyVTR`om1|#=QhnH}f{K1-KuCTQ;NnH7G?RJgq~V;>5{M=0_BJ+)O;#n{ z*`m33G=-dyG>cnHIqS@ZP@$QzbYBZeIh~1BuDvF;luEecnqUrnYTo24>&TGSV*5q< z18Zj^?vS^<*eT7275D&}y2>#*-U38*5Yb2wGX1hDLscS?V1xE_(rC|y@d~Lz+wgPF zH&cd-a`*FVOI}IUzNvq=CFHop58yr^$K)A{`B2n%_@o)KkJDu#S z4*`1-n3lLXXwk&vnr1Poz^_5ofDS!nvOupLhs`@r5A727YrQ)qK5cf_V4FJ#Pog$d zbBMDOQ)_+wuSbif&Q+}VehHj=8B3#1T*~){%QCZs%e#uhLY;_Rcb05)w1G_NmEj1R z(22MBT)6u>n+~5GUnSe&Y>d8k%2{4V8%)Nb)!VG~Jo`o5OdRen&}wjykKOXg`kKRx z4|*Bid5#uVavLCr+)zwB!RX4p_Z|29>Ub)WQ}@h)Uw~F*@ZI~LY<@o!QKEuy8oqC6 z`C03X-QA=)utc!4t>79*-k+51?fLTwUKxS)Ti!2_si{j)-~R=*Z~r+sE7p7z`S+GP zub_NR_r=K?d!?p%(w;5x43qFbmNyLke$`C=D7ju0^m6x3uREWP*{+>5cyOg)cUCZ# zab|YE1$x4K#hQ5a$1)L*%o_*dGqq5;tvr4=!rxDy#Bl@XFZgsd9dh}8if7lWee#VfLc#_yTxsXrQ znLCyDAljl(@79ak*=ApoiHUd%OG^^P_$!M*ME}$l>H#u9KhUkfRWH})*bGOP=xu9e zDJ>Luw{IpWBSa|?vgpIkCgWwCJ+q>l?;e-z-n(f`s5o5)gbE*ib6=i4UYec(=rXMD zEo%Sh?MT90FXsqD-*pfn|Fjy1b}0t<(=kdLs;xM4LsLq!IJ#Nc7nPJz#^g z#18J~%Xa;4*L(Y8mahqC!jtvH(3TyP%7L}=wMC@&`GOg7F>A(n>XdWUaE^N_9^4kn zmsU)$6SO89{9x6>P0jpf=Qa z4UXTkT$nlNrt6x6*uz`z@Z~MlhsMP3kIa$w&1)0+XAa%fFN8*eh_xvi^fm5s?(}Ic z9_G?^{25l(5>g1_X? zxYy&WE$`==c~*oT0J%B?)fqyNQ0)F}A}ck0*?wK1RqKOR9P~grLJABExf6_SG?0Dl z798+UNx|EFoqBNy%ZxH-O3hc{%=gcFFqD%38F)C4C3)?sw^!H1Q+=8s7Ss=#vI2Q<5>2@dO$_LCSD`?6j+NQ}c#;RH2t-TZ*SuIMspweaEdl^_#-q#v((;(>9K;0) zniGUi1h9YN>TgriVHB`RL&ogWg@2Annov%UESJdOJa9CVz(t3v4W{^&F;fz%ir!+9&teiFpHl=cIoJX z*5lI*PFe^H40?7fg~hc8E?Q`6qP>x89@<~EXkYcl7W+&sz36&;2lJ$ACX12;MwUf1 zs6Z&g8xASNz6~@3^(jUuG&9axvci6Tv?VuBsnKjP25JOcXpAFmS>)3b5UB8yqpn&} zAql0yGLgn%^yu@(KLq^9%_-fXZ+$aXhyBRCYgk86?KH$~iqe{!JjwTW%Vqb)VaGn7 zzj7CZbg_a1F5}E2#11FD$;J%;0O2-0JOh1HuT0lg##8-UAQ=UY1TbCkr=yUCHXQPW*34*tZ-tD80=e5(6PWOl7vJ3;B@0*4eT$h&deBM5tpn{7Hn{5B~vL&2^FCi66}?q;-YIRen+x$Dy)i3 zUXdhV4ChmENaz*eh`%Wm6)int-6_jiGqJtJW$3W&Jow#x&n{|pcEP(G%|up-^B{5f z8IaaYCf7bM6}d6=rUEtK*V_>_J=k8rcJI3cv`Jq#X{kRI(r(f!G4K0-nsC(KFghGg zZh*c@+Zh)v5M#xHvxcjUjtxR@`L&_$1=?WT`tB@+mbaf*_8}Dys%zh1 zH4#UHs60{0(_!v`))ra(E)6osVZ{~nNFC5~>&j4%+_ZcMlGXIc4oBMyCHR!{hqwJY z^kxWW;xbWzp(1nuiv0Ip$+TZV2E;_h*^3~CR6l1fa&6rN3K8|8KHyO)9%nfMZ|jKK z;s-|G(`2X&%=EQ!T>9rdEKi*L)c(>cIB1jb{S5K9F1fds|;cMj3~QwWB(RqMok}9a=p{A( zuX(IeR8ij>hg}|!$$Ps@;Jvbz2Drp6|t7!lJ#EHr2 zsntR4&tDkS9=2|>Ef$9Zf&?d1Encu~)sOQU)T(RZ*)JXTEDl3&@<)=> zV-#veT4cU1rk&K44WxUAWUVL#laZj1xd9$v&V$OOF}mBI2)>=R+kMv4=;xOBU5P~a zdOxx}%0a(`v6=!CD*}d5jfGes3T4}60^#z`Tw4Qxc+&MaGI{S)kBDz`%gV8BH|2e+!m)JRc9i$dWv?w6(FFMX1d};>Flv za(IuVFd?SE2~@%<=ZN*V44{;c z?92U|ZVeCH>d=fH=WC+W3QaU>f|~qzg20<3oVRvg-kM_HIHJ%Q?2!)n-R6vGpvzDW zTIX7PCTotL3?y%<%!l;Gj^$$8=;Z zi`53DK2f$wV?2pDE;SPB=;)cxR0QH5Hy$7X+B23fSwCk50>gm2Zbw5`_QaSCb`m33 z+*gRr>cE}7SFja!Khv2ln!;C1q3skz9pngIdV0hY(njskQnrk9r=9w(w?I2hXmttjathgCnCX{93xs9r!ac5C`?3WtPhdSXA{-Y z8d<`k6NxNG;O+j$qkNmo#IN-{Gy28+&k?c~>SjhCs>G&(9F_k->m`-$(nO63!H?d7dD_lyN-i^C9U$+>Y?(0c~Hi))mIQreOdEhO2Ow^fsd13lr zOOjOqkiXMHD;SkByyj5eWkLBdnvgMV#iy$1yb1kscr#x{r2&MnE``X*Bi@Y2)1{Rg*V~ zA1Dc;a9g?XFfmbc<9yO_(}huV_c1bmFJjim<@h3(y)^#`_=47l-K-mmVOYf46kf`@ z&(i)1Om&%N3~V)dTcmKX`=;{^?dkL=CKj7Q8<5^Z#shbFdybnp6XuNZgh}(w0U7rL zHw6R-tpvtyJt|%!gpi#ir7NUe^6@(Lv;B1dUd^--QGI@k%3kY=Ei`T<)83<1N!#as zF}-TaLcDgwydDZPelZ{q#e>d4=noEeY-ifTRIOwAFeIAN0@^8weVg$zfjFQ+QXNJT z~vUCdBa?gX1;bW?UpD2B?MNmXZrQ1`4hlx{I?r>Zz0~@tB#GgN(a!Ka_uA8R&FNxQ{ilST3^;X!KR4U_4qZ~SZ7Z#-mE^3GYcMsh z)=+*B;!)?4z_r^7wZoq2eLG}mD zzl*YaF#o{!%C!9yi|K|RNHw!{m(>HI zxz;#K%O!$IuZI%h%lQR?)ICe{0OB^xs0tV6zUgtL>9pR+OsWx&@`d>>|KSi2_a z{BO+3ZtF$Dzr>~5{O(J`+s1-_slh`37X-I@^q*0Mnsbl7T_#@dLlR2c$uX0g#+RnC zbOH}4rZ|&aHVq}&Jy{mCxC1WOjz0zFT@`;(#T4;G6AO@y70C;KQ{O~>9}@wVrPYwW z*pDNPOX&hf!;b793z8#hzF!QUy1q6b->8+Oe8p(_acRGs{@OVAk*l9p{WlVrl6o%q zeO>>k2u{G5hbi&Y*S!MzpO6`A$Bji>`+K!d?uOoWYKm$ZU#NPAvknlU#A1NIm#PSJ3)yi=EHv;w&dRMitiK;i-0MMh{EsnU!Jif+v?FbD`F1CO++~pW0NwE? z$}ASaBC7vsi_Ez(FS0o^#g3i~h;+!;P3D~6Jm=-+q$V?#2&G>G8eg*vsaHbe0jQJK zdKuN2bpE*O1019EMOeeUze~FkGTeB@U-*>Gjv|j1CxwS@K*4;Dz`H3DywIvS46mK@ zW)Rw_ks2cv@E&5EiXnQ~D1UWj4Cd>7={UEJ=ZpWvV05aWng3T5c2!H`iFqJ-WYf#< zrsz0Xe0CE=yet|68_!fIEqorx668vm9;8>cFn!W~ve&b}<^8b)*X(6Ye6wcDW4K-y zp-{*53EB5u$dGe)A(vEK0dYlqp_ z#+}v1N#@Cw8fq!F)Fefj$6>gp*dAoZXybr!a}16$Zc~x;0Zy+S%or`r+P-%HBFK-cD0%7%Lh;L8Gzu19!_vz}H;_RdhoQ19h2ECcTQvC)Plyx4PE>jB?t# zbFti9h}8G_tbrq!fO8vjvNQ^@9VZ=0wv%29Y1#z&o_qJLxzC40{r3BpG0Di9BJQN4 zX0AnzA)qliyqo7a|7(#y<<)AJ2KOaD%8!{$ramV8&Tr~m1)%MY(=@P+rfg`s)_ZRF zNJDix+&8~fQCDDew5IJ?c zzH0f=>fE*y|0^5u)B5;E&-)9>(wy_T=TS@fN#k+L%C*4>M=FtJn!(ddbsvM&eSvE! zXDvNX-&W>fWFg-8zCEUIA;R?G{q&1#>(`{VD%UTM^1cJDAlJOPdIH-Sg_on_x0+n-IR%mOGmEF~Ot7lh z?G2fnyzAhAJOkU}f>c^0x2_CxR-{Xn15}c8&yOx(OykLqAy`3^ubEIG0@oGOIQkk% zZ;-HNC%=SXeSQtk^PO5OJl7_jA;EbS^_}&bk9x@0Ms+QVcr2M;+*s06=p4`N_%^Co ze{%#wzMsEdm8VZL{0K|V8$ZyH6$6updX3`W<(L!8`%JW)Z+vti4Np}G23;q90e)3s z$MNVx{aiS~FR1*aS=it@+xASPrXFh^6hykQfk=6Yx3tJb-~#A;2vYjuLJz?Y5z>fM zhR@CAiMXs*&9>YVadMWL2Q-I0-dFq{8VW>k+j5eTcI8tSPDNocFsI48e4PtZS333X zCa@zSI@B|9T_Vncy#EJuRA6Eff-@Wefr9Z;E@egdY%Ky>WNL}W%iA4iXPjjTNmk3S zf$w=zbeu@r{~t|P71jp0WJB=a?pCyTu>!^2-JRkth2ju`6(~}?xVuYncXw&A;M(GD zn|pWnDIZ_*$jm=;=7_7>vrjh6srcDI-q+Ps zw6vgEFzK&v$+Of$~)ZS3uexbqH$}(>S#Mn1JZSi$aoDssdhY z@q-ytPK3NVLsYGrIs$7g7~nbrKmFx+c39sCC-UGUO2Q@pttDB%kw^K0XA=a%j%cXFs3%pcmTbVXR1^ z#m73Bj`jtbk&JZyOXOKnqrx_6DwotpY>_|4p&gOCXec&c458#PutQ4w}+_&!FAZW6ym%c-++q7M$5kZ&u z!(*3y^Bpt$<-7UXODp?-K06+5WG-eu>0aD=We+$6T61r_*p!_A6BUT`I^B%=t80V~ z@Lr`N?_VLVZ5fH3HN^_RNH`h53bLQd?wEB4!l91CmF6zN=>Q70)5dlScbiH}{|;Vr ze|!-zBVb_crihLncD+AO#hbqHlTw{X#Ag+Am6S&?Jn_4+-clBy3%{Oh1YwcRc)6yC zLY~)6dV4_{YPwFIKT?)(uE}CLj+?`?V?WBnZCA&Lrrl6H_9T5}1J;2Uzh#kuQFrhdc5Uxb)te z_$LOU5Vrrefhnf#50`lD;mX{c{odZQ6Xr=MGG#LiGW+aW)V$z=wjm2;wOt#=Y(pTR> zUPK7ISVf&6Od(_qB!i-;(!|O1!mPOTSbgATo77S3pCWDh1KE576aH|{g+w^UmW(n7OQXQ&?fsq>d;BK z>*ps_N6>-yq++^{`;rgjxj$cQ1^4NDD*=g;R-d>pZO&o6_x06kYYoEv;! zAXjF>cXJVutSJKen8ntA@VxoF@MuoZQDbYi0DW1E_(t)GzsttC&D&}iz@<#K_+g6N=$k8L?S~J?770N2(TNz)5OV>&xw|SZ|G*UCND| z9BM+AtTKtN+yC?)lX|8#)VWONLpu2ml*^ZQg)dM?EeMm6JT>^!1WftRt$Ujy^lOuX z)v5=dLrJiOEb2^Ko&9%=S%Url6Fq<8=Ce>1G{1?Tx`*S1DRdaX9%$vGyq6P@RV|dn?sS_~c;}NN$Iv`f zbGTn@TG)0!82In&%f^xp{StKS&hP8IyE(6?BEx_}Fh$OnOI&Z}yT1R`#oRi3y{+>;PK+qr zARP^ZLr$Ld+=xaDxisw2`OziGTGW6*cYSEbd}=J`2eJzef*`q(FB;-TH2UPk5MB3*IUkglP21@nqv%)~#)R;Kp)&vtjJvveF&ko<71=@rQ<- z>1H=Z`_~vCz`4~52W)<};RLgj#Bbhw^#=6JX<#WT3a|N|>~IRd5Cg)IDfz=vyG|R< zOa8*?4d;|2B!775xMo~ z;(3#Jn{HwhpmsMv!&L0VQ;hu}57#ANz7c+u!%Fdu#I0^4{-SVkwol?P{F1*#bIF;#Z%&S-;KY^??t3DMTv zMtC0(xjyL1=fo^8WK253exPrMZTWCdhj1=Cq5e)3IcxFKJHE42!Q$kQkb1QkC`!{n z^^5n`{2!V-vmmo{L#J@gc)+vH$lAvi=0;(r({VqoNaPCRL!jcFezRWjJ;w=Y&ukC0 ztE0qc;M#}8HlOza)nZOor(m$-msXzxr_SJ$u9xOLIQw3*i2@C|M zP$m01u=W$1LH2t>?`S#P0Xu8A&L1xD!HBG^|AyuEN;5(iRET_*ehtfzi6gO3%xVSx zc0tV?rsRrA@W3$7(^Y;d)@vxMiuYAe*s(K^Um{XgO8y()h2?Q))Bc|wV5>;<7i#wt zGGnc)DVFG6kW=q1iy*)Ifa@8N-%6k~^0d!BO5jgDL+;mrM`_VO(UjC+ z1Uk-vyZ4$&F<{?GGaNG`MbQWzoZ8y&mH`vJ-^BokEVb(tbjzrfrjtirP}M32D(rhP zjoOC5FAIaFxZR%jS=_jnr49&zA&2dS1}JJpb&^2rb3a?HdmH29e`4K>X|d1L=Y2Nn zvd3SfTQfJ?YOwk9&K@6)sJlbD{!$+)RVSzOX^4FM%@CkC(`C^~9z@}AS-zvF2;cap zr21%~31ZMedvxPk`b2kWBh+0pLI$&Gd+%w)A6^uVJVhI5F|Q1X?KWU`{NIK^CN6vS zM$9L=-_DmFgBJX!zn@K*)gBIsP1q>?k1Y~Af}pSI31uE^F(Baaz;UfdM%NZQvy=pa zEWJr(!*uaMwMwizSi3O~a8 zWPrq4&@y&}g@sZer$RHzpVYA$8Y0##mSf;b{S+6fCBQwghQ5yD{k?`&cbg*%eLyBgk>TECeFVv|VO|o`SC78>*S>0Vk%5)?`K~n8z;Z zzJ-nOSPkF6p1B%YYUwH|-aQ}Ik9~OD8-du2ed=BTPy7z0IYfrFO^g%#kFeD4SFYK& zW3~ec0RnPf>%4%n6Rig;&VxytVT$UVZNhCpkbz!Gm_<-TdoFWw*USeAcL(U_V=r`UbLJ{mAc%*UOYi8+-cT_h@lPQLx{gDEbwU zUukKSrh6e(BWbK(+_Uh^>tkuEU2e%bLTqFHNj`|G=0&j*-W(Xhw=r2DWcxASRQWqb4Opuqb|+3=#$ zCKl=xDKQ%|t-}@<*P8w%M9jHuiiiXR49WKu^^f8ga10?3OPqGskS5TZs>fD^(0> z`2*CJgBnK^N?8k3MsHFeAk|XYV)WAde9^7#L3!MS5jED|0yD1m5Wi9$6Q;u2(fyd%GC02WgO1X4|3L-#!4zbZ!(n2u zIblMkVFrdG2m`e|*^y=tQ{og$LA^{KEQk^yelv1{Yb_naAK85w1gI9i1m%Zi^u-m? zLM+k-F|;oDtYuF?^bys>GW^0aSdIiyysdQ;%iVZF>at^n0eHrDA%YpvU&-s21a-Cs z>9s@+(yu4a_%)*47iWgPX{JMD_f#q|!BJurho8kIUuBbV>P_BZ?RFkd zlQjh=qrClG&QWSSJf=Z0v1=pY?P#^U_dv?gndC717)o=&PMW+BUO4kD-;P@ktF&FL z)BdoE^q1*IZ(`T{^ysjvhngq4^T-SdL{xbCR{VrzT=~?eDB%`I~rFL{ZYZA$1tD#A^e(kmygL(cyeP#_OSs|vA4d>ZpQho?m#b;6g z<(md~WYMdpiGbw9Tcx$pAvb&n*>_SIvtSYO|)m#AuN zHTY^m&X7^xtrJkwLz}F6-n8UFuRmyq+f~YgOzaM`OgWsV+UPB>hu_8B0f=g3_9&?R z??H)U$57*~OT{&~NRAdD3HmUa?`PX;ZuwNZcXwDJ#IZ7wI(!#}Vp8h%>>YzOT?Kv0 ze)1H0_-Wd|`g+cv?R$f5@}@{+;a}1JgO-;tZs9(I?v1;5)FSa3&7Klom@5yxd zM_!P^E0(cJHAx3ZfL$$yIXTVeuu)&Ba-qBG-saK{8~*=;?y*yJb_-Yf#M+*wlTq4M z5jT1)Ef{dx9&P<+7jVr}ds2hV1+vK6v_u8}xQ)cNbbUbi?=vAx+O{Wl0m;W+TZlBu zTXdeN0CYkzJ7a}%Fq<(=k{#Ic2z=q&R&azLl*nb$zi?{jGbfK2A0nshogyW^(w|p6 zFVc^3wD3-x#N?9GXnYH4jR)b%hj=7S|Q7UtR~fOQnzZkd8x_@1l*)6 zNyG}&!um!nbNk~Qi^t!;@nBk`9GK#eskm6?gTRq$!QZu3RO^kx4cM5Ej78bs8%N&n zDf+^emi{N|;h`WcM>KXq$bn~b6Mpi!zp8Hr%^3sobpVm-s;*Uh=3f-wZ)~WqiQNQW zbTLD#;*2K5Ahc#4LI4+(@C%;O>W&c9_gv3@joHQX2MYQL({@K{OC z?;&HqU>w1`>P*otWc(0}9XOc3fqHjrg% zo^#<$UNs^#nG8A!BggB$Jpp}2e+?Y{_!^8s!k4I(A}S=;a&WQnP0w zj$8yW^a|Bb53H8oceu4M!uuQxwtBJNA^$9Ng}qi6MgD!N0~EFVpbuGX3Pg-Vr=1*U z_-uUY(&U)CW6&lGaBoHh=b)9)sls477{Y&$t`qBz!ySQK07J^y)YPEZDIE-E-dwBp&Rhvw1 zt)pDud$ZYjx{?BdtttezQf%quJA7hXlpemrvL~31*Ns_92{@~zs#~p?+v|Jeh~R!) z50nd#+p?7Z6aM2}EJO*^sF(dJync_4+o&N{Tr8oeaU-L>mU^)(e?qnpWCL0tMi4W5 z2|@6*e{D3iXll{h=?S)g0rpG`j1e$n0bN+|Y4^9*)*ZR4`RM|(O>fcc`vG(Rn~F9W zt1g2XBqT2clZTBfkV!=cWF2q@$-Py0(o>;Oo&5AMDOuKE;@FN9lH?*IN!6EDgu6RMNJki`R!`oCK zwg-Zxf^hNJYuqh)bUa=jzGodxh{x?Bz6YSdzv0ntyQMA{bL#!csk+{ao(25=E?7BF zPo(lM6K-yKC;kUk4bzdA6*F*BP;eW=$dELb?IW%&bu;}<2$h0WdnF;ICB}t8s(?B5 zxl*mTb(C$T9j@#n%POIJtQGM&l(Sm$044% za>i+;%`Y!#0u7~lsustWf1QoT9zE3_P(JJF2Wqagl?LUQV%g@NCN?19Bo*0<*F`a7 z*&0k+QG53N#`Ty@3ypR7Bigqa&PzC-^h6A0BOLKy!_bjhQG;WZ8@o08Ed%G&R#zvp z7#2N<$LKKh`E^%@9*E+9>?rzuNjgocVp1tcu6g){q_myDh>_dy$4zQ6mF*}sgX@Rd z%8IhrHRj+%k9ySs_NK~8kNz-=*Vdn&020=(m1(BxI>H_2uua2a*gjKmZ!?B1EruJw z^Z#4`pZh+dl#8&SbI_kdN;t4?b-lCXtBR9c4}7tHN(bS|B$J(W;nz=dpuLXH zR15x6;PDAS#|eOYC-{cSr@jm>OdMh3x21&Wr+1~g&nTOi+R>}9ZMt<_KQ%CJh4i5R z-&Bq!_yDyr1oyV)y$2xkrA4GnY5sQ`C%2z0$%MDBB5GWiD+pPeA=DENT??|4FCu^s zhkGf}V$##tQkXBhn)?ig$O6JYl+Rp}XP%T~)&oPh32u|0HK9_y7(PrVc>u+*$ijMd z5Skr9Fci4YQFa<3?!mwyg@%X#ri*7r)C(C(K1yeWPcpa1{aT9Ruzli@`-3a6(+mK@ zL{8RB0MV+-mdxuU!_0>j$>(`c)dHS{?X7_tsD=rAS}=FG2nM&`%O)=F|M-C{|P>zPE(e(Ibo<%RjzZ z7I{e$_M}f_?mvT(5FDYlvot&WC$S62ANuZ6D=;8Z!BioF4kUn}e5!NCpI6&>rg<)% zp77CDEw#@0j=8z;d&a7gsR|~;J{tO%e7Sw=aAFi=6`F5|UrstT#cc2n^o}D6H|eRu zwnrD?dUoc_l6=Ma-A*d~lv)`{lvY=3Q;&GGR>>yE?r;9pB^1Cln&l}UU%m_f;gUK; zd!d!GPW6j2`^%nx&`Li|b2emZP696e7K2eU?aRB>OK_h8-1Y{gjTjuWnj)f7^%7{# z%Djr&=?7EtV`ewk!nZG}^Roev zl!IPRtU%)`kgcQxpwsdLO`8Y`btrbuqa7lStC?eOR1(?tcKbDRhavo4fB=|;|I5z} z>~&!)g|)r-2H^KG%U`hlggSs|^Fdo+(gi5IWyc?HWrtK!bnyX5Opeo=!hZh>zm?qv`k`+FW^XxTm{T|4Z(>35yoBMjw{zX8?{%5qg z{Ri+>a4x{)lRV6_g8s~&Lfi*N+_dQ~AA~R{dSxPiUazbP{N=FXa?4lBVfddh+Q7HP zefEN0gPwyK~m7AjJm z0Vfy;3FF%@_$C>AQzrrHVedt+%PluU5=P8p2lp5AVoGgl0 ze&B9JayKU}%alAwfLzwpJu98OyYv05xI=TK$6n|k9i*Cd*&P^6-G7{KMBRL!cefkX zH>;-E=nT%4$DQw*{VdMGG}G4s%T<(g)rJBpk?7Ts_k96Xm;>%cYTIgtXjIlfh8}yS zc03~nwGZ18e_*Fu0Ce;DSVb#&i(9s5WF0mwj%zRWLx0Jl$!j1D297hz9+-cMDGR`y!r9|?vQ z!?NSpSucGuSdm*qgq^jXTa!2qq?vd#e@qwJMl(EGBq*^Fd#HEKiHxIGCPaNo1$x}p z`5dWgoj|I2l`gFxAY7b716^`^$qnl)q9=NF1|qKd2PEynETdtVo+&);_UqKlvRUWq zwBL>8h?1^QhvP{sA~3THa50i~k2A*oXr>}ar@&LSA)Z-x2)Gx>?2X)TxEdLfofix2 z^1hR;xH&Ww>6SU|kgPf_9W zU7t;|vd?-w_#UPZzX6zZsV{lSp13PHSrS`_b5)BbaKA|!h@$vuw)!!ZQdcH78Bt4R zx9klyR==rJrWQ+u4(n&`?{Dj@eLPwG8?~1rxRTvBPlzcAlvXlFGGhFn1}njlc)DQ8K1?l6~)?<7}47WTZ!vgKqqSe zbAybiB&K}cl*);`DDm~nif)aV3H5tRyDhQF?!CZXJ(&7f6cNQF*WYM)?wneT|*AjHCq`2!M9S_=P-cwRiEg>HjKY0V5=W{$P^u)#jKwF{ zuuoLDBcd;JZNWdqz(pztS7|}2QWbhF$~1`SW`ywA)C5#{yCIYc8o^d1#a2JkS-DF& zO|Cw|fyQom&#k__mKtmQd+G=m)Z+q}^@C3kd%F;u5sbY##nnnH+191j299RQ%_ZBKs9Z8#O0 z*{_*h&vtu&{PsBRy_^&HfhivPG!Ivs2Vlx||0N;xJCc%oooOKOs^jV3JM03y41~04 zyiZL;{wum9X?>6-ws1K4i$Utts66+v4_x+lA@8cvR>^NBoPhi?TEz}l@>E4&MC)tE zF{5#Bw90{V{IXl5`VjA6cp`$Uz`q#{rQJz|`Wc{K(JiIs*C`laZ_-UV&#rO)++TX4 zNjAGtvm&}6pF}`tzF1gYNQLbW>cyO>-6OkL^}pgG+ADsvu5>ZAy3Pz&H(fDsl{m~^ zG;=Fd0juRqp~@Ulgwp5YXaF?ZS^cxY5+Xfk5D0a_hiVZ5G3XWWho?veKv?RLX7SZu}`4p(Sz z%rY;Cp|_d;E!2{WY2rs}O7S@@x~Fzuw?fOuT6-YsFs(!-0DqhfjgOV>;ni>H4#V87 ztWPn>1E0fhPu>4qa{PVKKX@cMMMO^=oor%VF$oUfwQX<@JZ7JtIRY|Mi&zyZe~%7* zHpl>onU<3aPM)ze5I#R!kYPbY5MN>LunKj(G&1HQhOSF4&=>_{ho}_5zicWM@i)l$ z4)f7rU!o*PbWB(rdYM9ZWzB;3ZA53aA&}mPB1|CWbw;IQKeZRisUZ+Q%9D(!`Jboq zomjSM|IKglIhT}6;q|C+dqf@-mC0{7byP-mGB^%eJ%KDd-PmDXf`wVTjPXs zi+pAjSu|qf@<)ty!GB(81lt>YL=$Dkr9~{8iC`l+@vR}bY+k$s&e$ak?>|NO*zdjb zcu>oZkbW>9N)Mxj+W#Zb8og8% zk-H)iO4OD1v?N86;5i|Ikv6HGwim3f?XS^sPxK#;@Yq?pTW#Xr-=JYh9NhF%_W4aA8Zh&rEDp(J z>oN{HQ`_2T1?Hhd^-#RI;&r`Bp6DB(+~bGk9ES8wo4JWLIEO{g12sJKo_K{P4$naQ zBDkjLE7V#9H59>&jru(9cMo=utZI1s=+#7Iy24JG4g?-_%fsnH^_XY+gwEeSXbget zdhT%_W=L^-wh5u1=e*O6;6TbUUn%A7OE*c3r9z*I2eD~=dIP{w{Ln1}+Hd00XL`M+gtmLwY?iPuzxo;I%f%-22K%n+?L3~0fNpM$M3tc`uTm!BT_qG58GG?06=E3 zpmeQPPQqr^$oNaV+T2U-Nu~O>O8;(|t6Ofa{n0*(cLw>R6p%|IGI5^JqTFzQIBue< zc%D`%04vib1!+leGTdO3onRv8_}qOw7rOVAp$e1&S!J8iR48it`Gq+pb|JwOkL+>Q z!c)X~Ke_pRrOfNUgt164JZ-#KHoQ!j4TTXYwivY)DO@Z9CG4P#289Cx59gG8wuLwK zeFQs!jwGni++1@5HewlP8o0wCFJ~Yj@tha-iKWl8jv6*x@}t&a#b6y}2LU{hH?ep< zQ;&Z}{O!I%;BE;5QK&V{Ek!X61flqrOSWi#U&Ngg4;gG@o}(3~RfY2vej87M^3r^(`vgPgq%d919nd&a{S^ zsc=&lMC&I_I&=q{t`YUITv^1+j>2MMoiS@As$6ST)Joj@e*5{yBx;G{l`y`}8D<(#QAb=l4dh8se2d%1+?R!e{ps<|L>x4cDi6 z6T>#RR1+`qEe2P*lB0H?VH5{%#I=|kxwPei##n(QuX8y8n zDY~5Rnc)SZVMYbcd%YUWd0PB@&87w$JideROL`4?N*kWEkT*@+M*qU~f_{Rm;idF59%w?fo~ta)+oZl1$V* z5$a+0#gzua$zvPQ7fEaJdlbCuvA=pfa_BiWA#^zhap@w?NGv3Ua~;_TX6F|XRz+v2 zcH!^rWSm!f1tFRG72JJ|qw3_tnydSxsY<{;5v10}a1I z`CbLI@=P6A%V4&@&h8qU`a&D<6Qk~V_=)EuuFG$Pqju*sUGwi;E7IRMs>)iFMiG0; zv2_NY?su|D`i(9sNCU?VyFPww>OSjkDH$Q(3)HXFoFcL*Q+{Y^<76wtDQk*X#vu>x<6ejXLvP!?xF3SZ(`b zB^Jgr&}GDQP9420;^wwN#(H>G(L&UN{X};YJiQIs!zTS{{wW|+o`1O*Esi9I8BNy< zWzA6S+}5r5ZrYfRvVJJsrlg`}U%#d@QO#~wguT8oVn4d3R!*$TO1VTigc>Mf>hRM~ zn)Y+++PAj%In2Lz{6W*5_Y*Jq1)D{?Z5l01su`EbfMv{w+ccGBn8D5vj(bR_T zyY@6|{lN<6F0;8>%;TLmW*5TQ5BGm_p}+*@NX2od@48kT^GQ%31XICPd>xxF6yd%K zU=)gg514C?9PI>R`bzsE62? z|DS`hE0`h8AOVM>Tm}Ci9|ST{z`OO8NU*-sXHspdAPWP%NMJ4XI%p*Jgdb^r=#HZM zHtz~TyP=EtrMN1_9LCF>W+?(hTbKibel67-)Kcc8T6NvD$>~K?{;MDe%M-)Z38Woa z`le}4gP2vMmS8biFE!F--IW;o*ndW^$U}WoYpWh zeu61e-c3w<)wyh5KsFijIoAp7l4a>7**#bfT;9hQ(qlw63%dB;JD`Yc*(u}*#`TnZ zp`hy?MAB6^7iWWFXBO1XFP{&ey|S9zKL-Ubzm45N&mmr0*GJR-6dVsfSDz%VOPTQb0q!B_5WVJ z0*&pZ)d); zk9}7XFx_xFyO8tcWO>a7vGpHu>FzIG5ic7a4fQh|yj)^w0}o)q8V(@nc;Nul$8~RG zvlJ;TkL<0MP4nJ~fU_q@_xO<&;jk*a7F+cM<>Cpvzl*Ao+qcnkcd;92PSV;*nRpc4i=8X$;;a`>j*n^i3wgnZ9b-lp@sjaC6uXl-CVZD>=zVWMgMm} zkkllb>A+K=sD9#ehdGF&E4CJhI8ugJy1VScpvN74j8vtk* zb{(XLsmaZp#5K!2%!85^2FKspndc%D7wd^&l@P`?Z)Y97PLZrV z2;*UQvHujo%oX(^I%eyKQ@aO-;fz(D}nJ zVPW=K>Ro*9XeV40HR9SeZ>I{4U65H%z1pyJ9WVr6zK9|VFk+xB{ zA5XGXUuH7my9s*ZnuL@u98-pHLi%s#`)<{Tv7P|5ZU1OPzhmsy)OXR~;+6p`KHblV zz$NDJDNl4laU=|@2&CPul(`g5ng;9mMJa>;#J1-EqizIz z%M`qYNjNwnVN2@p2?H@UFc{mWB0Em+mf4IYI1Ce<_`$_~V$@r>>4aJ6=6zhR;f61^ zJdR@au^J(fk#|lkAs)V-SU#|2)EzD!9*vo9#)EB{B69f*3j&XCl-mR7y81#}@bsaJ zu~ZxQGWG5)V;4p{)37TN>(0p>urtXzOz*0U_)>?^&t>{XnR=P(#@bJC5uW++g>T!R z=Rth#>yKu#k=`pL7ZS;XYJF2W%d3z^ z-$d_+$FpIZB0#V|W5#gtEcGh2xVV_}!-rsaWK2h%D}jEJ|K|d*un9{v!ty?2tn-Ro zu$5I+Ek1t+a&vRTZl(SC8<#kl{^ws-p3~0$*y^w&qyssddxaW3venUG zZp~{b#=WbjnLUc`zMLrLnUpR^Y1aByp$!BnDkNq#I`=s6{w^K!-CzO0jUbw{44M*% zT_m~VZ5rs<`H1h}T-H(ex*Mrhma0X1mT|@ai*NL(sj-yp#x=Q=?NR4^CybBFD2l`- zx?Fg&lslPSS<2YA(|J^TUSAArVO?W?zYQi)9lZAr%W&C1?}10Y{rf5M_iuuUX&0E; zexT9qsX*+YG%PQO6Xw4A?(`3DXc2vXwXr0OJo9;CBC}_0O+hlip~uYt*kihfQSpZ1%ZtM+S^leNY_79T^1Y}>mq;3s_)bwm`!?;vGIJV|sj-|+Zzc4Efz&c1i_=51BOR0YMWd@b)+&;G9Vm)wYo?#cG6(-& zb%f*qeB9Xau069L`(WhrC>FR&^E5y~7_Dg^RKFJ1hU)Sna#XgtnDDdz?Lvv(0YM<~ zr^Mt@PCPppe?lI(;96QZ(PLxQQB9nbgv`D_o=mPo#u;iW-(zK%ohMY6?JM>3mu0od zW8a_vHmC~Qho^wZFJ(V!!?QIu)Mp}u(x`ay00XWBF$h`?`ZvpgYIycIw)hF-U3q&ZQ(SoDFz%Rei@0L>-r(H0r zQ+WS@H~kM#>8yCqr$j{~ZEt%T)uvJ%`$wLJ3bUq6rNCiDuY5<}E2Ap)e#QY=M=DWD z$Ke?}21D)G@YmDdVuW}@Q&AuyBFIHGP(j|~>`E)AjJ;-7o|_l~yVjZo0Tv|uZ%kWN zDc;DMM4|wpc<@zn$%}q!XfPD1_#!AkxEI+Ufe4$kr^6$)$NxA%Nj2sR5V6_1j>FzN ztR^@G#a$OAJEAq@4oVdGucY=VOtr7~(<`NQcvx7C#p_Jx{ol6(*^92bAW(D1-W%G3 z&Q>oX0ZR6{Xh0lua5nvnSTH<-t)TZ{cOd+10$_7FJl>FWB`NBA)RV#7MZmzQ@ROU= zHi{B4^O(l`TZc{s(8~9+Y?J@;bVTLEfj@p@n7~MFVvo4^PC?1EYZXtfN2sZAr!&yd z&VbP_jlHA5`iklA>g(_a3JLdQPIMPI+76dKnt(UlZ)z!JIv40YOxu~UU#8;Q#r0%f zW0;=wZ#yyQyl6qb)G?v;&-`~f8I_3D%5gpu7U$3qtZX+}VNOm?n!^&XVAfk{85!_^ ziRozzH#gV`dnXN+KhqWP#FsLfGL?RN`a1*`8VWFZn5Yx-zvr~JvH8Hw9Wpp54ND?# zrcOiyGcYi~GPPP~9W(I+ecy%+{zK_Ovyf=K{-*KYo>RK+I0ct=Z{W~Z@*i={u3%4b zG#HPOPOTSFx#Vi`op{YiNr{MpIA)kuku?0HauL8yxDZk|_XkiWq%5I`=tvc&`UfdR zdJ7*>ikUSZ5oxK8&=uTQ&h6%+2INRu5G|kkIL?v?YFkRYRT|fdA3mC^05tBhte?Sl z8E$UO#6-!J1{-3(JLfTl)dm~>7E!&Ss%B?cq!7i#G%P7P!r}DK-qXvkRUJ;@0P^{H z+Li7gH0SOB7FgODowao=Eh9m7N=XZ7(!sRLy()Q+vj)_sNW+1cR&h><2C>3k#xR}> z&Li@W5x3jw_)M4nfIR=0n89uzggp%xA+*^+!a8+V^NT>dB&DK+~cP;w_F>)sXn_c z7%W?Z?WUF+9MT%gbk)CMrbTz_@5}rCv>Yi{oD?g2!&5y(VKA2|U=buWaD9Ugnz&D)*3@l|et7z|yWG2oyK$hACn|dy_NS!DR+(n+TT#X?=CY^u5RQkL zYw3(3oFHuqYx=Ob0yR9*xSF(buM?k_E#te!=_kkdrI`eY57DHqc0bEU(jVo#%lEP; zU6nfx4DiGZbTQ&GZ1dK~YI~=_10LMTD%?C(EF`5*{Z}EEzm+>U4O*D~94j&p&qQQU zs$sz=RN7uQvyoBJiNOJ|2Eh&4e(z3vT<^-tOd#H{WC!yL{@1f za;^u_y4~>V`V^0st!kxyhCBN_2;xI18{yKk%i?fdHM zp~Za|Suv-84}C1TK&)g0A?HUgFQzz!KlLwvh8UQG5hsRS03r?d|3lMPMn&0hUC+?c zNOyNh!_d-QB3%N~(mkY57R-=8Sc}a$`|J>t6F^q^ zcro9nBL5y9vg(5}_&Qi0kLtKKxYMalek%_>wm2Bgu&2#`?$lVaR9}32g#g2x!nh*2 z{or2mo&Muw#}LnUg+C8>X>C}iKa(W=dqYmzp#7GF@W*bUF6W&h1+bT3f^W-aWwq2xQn!b!BJ>gj9P$*f8$6OZ|6#s8nsD4;fT-IKizZ}&yCfL!UCd)tUzRA&kpb>d#{ z*%SPL3w^Viq>dM+?xdm5N~IyFiMou!ojo4reIboJTzFDg6PtB5!@g$yp_|_CJEEEW>BwLTH!dzl@61sg7`H0X z@hhUBYPK3m92Ld)GPh)?_<0=G^}i8ri9B@<-`&LlT(<;(12@6!Q+d>>GvP5IAqEdm z8W)$wYA3iO`%|kk4<=b7f|gd#-v&n>X##g;S;PG%%Y>ADG6TehIfCFmv1w+F#}{d`xg$i)*QstP{gLe-QE_x zv1>iHmRRp8X4Na3)ZCBn65dY|#zQv*j;js1_JXT_)8`W>+i?9-Ad75#I+<2c-Lqbk z-22@3m5}Aqa7egF^^4MNlow|B=;6OxlXMg9jUM7Z*ELYWHP&M;>U{$ft3P&LmZj@o ztYl}yNZj{yLN2?hQ~ayW2(!RHiHgC~>1ceVTdm5BL4Lw-kwY%rNA!CzNPSojvLW>b zU9ao(Ojk_q^L8zSe|FPc>g}~aWQKVw;L~X@5!e5QncgjebnX*xH%+K6><)03q67(h zim%?tI)A#ltg5KMJkPlPBW@9(5z;@Hs?omPJWi?Ve+xN%wA*r17!o;tPX6*BnBwcV zbJ`p{gKz7)s`LAFV^Ia_OtF7++rHM=*Nj3i;Dv5i?Ll$+`Wh+E%^f5V|E%knuJ50T zErGXCdd_zUo=BB64F<8sYVE!1eSi?IElclXOdg9-T`Fv-;1bMnIhv${5QjuCY_v!X z*SKmEpPN+w)x;pmZxY=6VNgLg|6PkprEN7fZox%Gf94&1kFjDl7=9}H_qlPl>H0=5 z|M(9AYH65N4K=ft-uve3`#zQjWE3?U|J- zoTI8A&X@C!!GGVLh}3=|ZuU(|R;yPk92wmVziIDrcv~$kp$^*DO?G>DGNY)|&4#^m zZ!@JX3r?BIczc_zRT&&ijK`L};>|Rfr074H?YYJ<`84eq`nn`<1zEqHF9iIUf-j%G zf^H(Sr=xwefBo~U$58{$)@$tAr8!=U5buDsfVm80YcS+Ug18L-NWg>FC`RKwu>T_f z%m2{MM0j0f#X1$3L>3pxfEfh7(}2ed_;8fNLcPpM*WbTH42+DY%h&CM$e3iEy}iAC z+)I>cuMlBwzcl#A_?@J7=|{jk%URxX1o=+rF<#{+)934jgA9suPd|pTT=j{v4D<5x!-uRWOC3`J1m?g8laQuq|h>CeiVb4`7 zR8V=2b?w($IG|oqi!o%%d&`E8VB4fpK%r#GgUG)`)4E%$!7MRpCwdD<7bxpJWUOLX zoi*%l(UhMZ3)huHgAr(e~M_fYbaEGhuNr3(K`CRsUhO!7S->~}0?LL;0}Y@)%+o4E0O z^o6}iOeBwvg&2D1g#ys_en`iu&cQfim z!J3lzKi`cZ{B!@R8rsO14k)>a};QwAt=t7 zk;vsXxuQCH(`P;h8V{1fFV{mp*{n$KT=73s`U1#%SLV8E53*Dh*W4D3U|E+<-}_~j zwM`wm<3@yaLaB^gnN@1hvAtDJc{j6E?S-E>H@|rYF3t+q{EmK|nH=(zR@ZwsDgNho zSemB#amX_midoLhng7*Ue^@@Uy8td-OE(y??I)h~5OuP|5b`dzW-7Onrc(Nm)mkJ;o&Tw z*AI%i9!hrUVl#DixGM!tbEQUxaR2cbYGP+ud6 z>^R~RgW`r3P^NQRLX1%iWHbjzCR;cbD%mV)0!iM}WEHBGnI6S<^k+THKf{fjEK>Ts z##}zd^17R9Sg-DnHT$r(a02wVgVnscEs01MqJRI!y;-Hq?EPhY`S~UXcyc-Q%(%66 z)VH>Fs@~CV$M==xxhekUN!bo8^;*^i#7}FoL@S?yg1$@s<9LRgjtV?HUE7mj48~9v zXS+?$E2FbV*nMn&z#JE8oohU6ufvNDhIUANeZPKhj6!GZ`EDuHwu!R~6_x*3 zo+JgwFhF9-dFMK#-L;0J%vI$cYIyg9pqHevL_U&bR`qsKZFX*;|ZG1bVvsUt}{AFIMcUTB(^S%CHW(Ecp zuA7H#@wnUD+nA3H`R?QU#@CS6b@Jm*lgAm8RqYBNe1HUbudJ&2^3|h4(Xp{FPt*eL zrnp2!V*or{9X5I5K59Kz1v-skqQ~B2vI1sC(*|O}j((GB*)=x%vNbN$nH?y)9Aqrl55tVGHoUM(-f=m~B5F%c7d8YxpdJYpJFW+4dy4~qMouP`h zrqhB2Nn$`62$$r2Fv~10J;}yLQ!k0eg!)bUqI6upk|3~q$~)A*yseU2E~zd6INe`o z!GRW`=N}i{=ja=6xBd`OdNyvRSOV#&%xoMaz|0u3UryT9^|^h_^PtG-#wliZcl~e8 zHWLA%s0nbadLf2JMx0+BYq8X~veGHdCuK#xfSgl$rI%dqmyIar~8`OC5M@{_RdYwm5x_vkWI*PM`kG26=8{ zmY1sW)xXAi8yvdW0R7${GDvlM)aJUFb_e2gV(G82HYo_FHuh&w*v7dnjC;kt%qm-q zNj&SyWajzVtT{2}AY$?>4spyWpkuj~{QY(=id}_y)WqyJgsszY4mdYtHid;Ve9^Po z7;>%T+qH@gu6HvZda0qX4u96=%X;UB(}fO1Pbf_D;a_`{mJoFXwFp}AL2WtKRMtc? zxZ-x%IDFfwQaL3EP5IyC=XnJ>r=XzYR}q(-;ms<07b&RdtbrM*52Xa+vsI`ymL~?V zmB%gQ6S)94M*q9Q%&_0#svqp_(E>?0eI~9!FJV1sfjw~#18Jvf&lmV?qHgF~S{41P zJti`$^o^$S{)PZeuY=gea(PS9_-ffQS)m;#@0u@D>{y;G2w4ISY^@K63S62mZkLnV zL%$s2uMQ(L5EWwG_OZ`;{?&Cy+Wljohc z^2Hvl18cA)_C7vo@XhG(WOr6<796SKxGY8>>I3H8HsykJWrO~V-JVvn%=rD!k!rg! z*VN3+z9^H24=*6&?=QxZ#>mJB?5?q*zE`I9_ULma0iqz&>!T(1Mwkdyrfybxdhh-6 zwb)BHG4S#-SOJsRHPHD1r=+A*W*K=N@$uuwH^RbEEl1600?S^sDJdyVhjnuwK761l zUjW+Ifx@pkU0vNypyn8GLVB8g`h+<(HAOo7K&-jXu$n&czq}@ym;6Sa{Nk98u(#Q` zhf);)er3Y8Gm{HBImHW5*|I@4^Dc%e8*IH71TEAj#JV!vnybxK7bXZsjk*9Kq=YSiMO_W z1)WS0d3Xw)ZYnviVO<;r1+f6sr#KC>55I6v&lhUu-?J!tj+SV3^|?nz)CF~~q--+a z>=x~AsMJy74RW)`HOdr0w}vcR$(N=@ur5T*cLk*9vY`>%wD7pSH#ylBD67OwU1u&o zKYSiyoFVW&9}XiCznsjtDb9j&`#&FYc7{K#(ckP}KMVTrtE|LfJ^qfWdK`*^8S#y8 zaH|EeE496YUcepmu9GDxp7Q?Ei6lzCeM2XJ(nG=*>4Nse!x8QHe0N_ z{zgB^I<6yp7gEA#NJB!!cZQRcvaKSrBS$HbRgOoQY#BwZO`A2&CIzNpg+o*jq7yoX zTLX6O<5}V`3Qc^9MXF-`udo?Ww=goFU&?BsVI5bB^CU(4ATg>ppdg-=lz)oXNKb@I zpbM4nd7V`xaMI%p&AK}FxP|`fS7q-}hD>bgB=Bx<2C~K7xxRM$>5}(6`f1INtn^x` zq7t3>tyYT_^?aZ8!xag7V|cLtme}|~@FNa3b`S!0Rupq$h48mBL-7yvbkT!O*sSWVk3brK0L3hJe&Fk8+OT zr&0OAb&!RxO8YZ+Iw2T!9o?OibFP6gF9vPs*&JtwaIO1%4&7@$?o(e&fFl_oYLdBu zg~zTVKHKutn{b63>b(E!?;YydvCc)bu*X=7Oo+0ROx23=Z(o*zo#mQXRscPL!iY%H z@AO9#I*xI_!9+#VGafhBjb-a;AVHwoT#1dH zy#KP|M(Uwu#fuXJ!xultWMhNk3#>e#8oJLkm@m{vO+1w66TEuYG$P12XNwr^{D3qc zvX~4WcXY5vcx4arqJon|YPDL#4rEVQ4$&EC)2H7F;hs*_v(b|*+B4A>8k-vi|1#c<3JVa)9ou2KX43v&RLp$=+V+s5?Ji z^?XJnrih|VADN?>;2?bgDu6*$q>`Y8AMi6|(FMDhJSlEEzv5M=n1<2^AtDf-q#k~_ zWf9!4q1A5Gl90;LPUQB-hMBULf~|ozYEC!!wFlz%}O@ zM#mLd>+|PpQ|SK3#nTDI?DEs;U!1?MSo^BX?}@lKQL&TolS7cRL$r-?%$ELgP*Ti> zYs&`)XEN3MC^(xh<#}=A@RCX^z~^Z_8sqMs({09C_k9SU&oIvS$rqys=n6;VfQuCN zo2NqelgAZ<)uG`>v5O=|?Z!j)TtucoMMjTv(4OW}M&Y znZ_KQuOG#xwDe6paADM*q_EASpJbM)PKU`q@LeQ6^W{-jNbZv2?W2l-G@DWQD_?)= z#N8(FcZZ`0iLC~AluDTuL9kCiQxlVt>3RUdop5}r$s{bnr0sZTtG}jHH#geqBGO>o z`Iw0ZVs!s51t0Y40TCwUP*jEq1f%(@ma^=O;X8kdq1+$8OTA$}p?0@b((3p)i#&oD z$Ad~We!HDFCfYG>Qk#S=LDYOsi@2 z-P4(6zY)^_aZjFGdG|Ms8kOGnO5Vg-eIdo!4>0*#s^A(o+%t;2~liq zs77cE5W5hby!}`<;{r`ooeD&gyK{p*@S8S2cPsmmRcb#>a<(DQL61AS)+wG@y-qvY z5w%(}0}0zsNI;!2&sTDlersHRtJW7P8@Tw!oh{3J1~eN3gV(~HF^M1^iRjnZH6R`03 z-yebk4L&s?Mny&atujXj_M9kS7xZ8o!=>p2QeCBhlt*A)-g?8sgFCke+~qv@qbvTu z7T}GzcpSi}ufe)LgPe@vf>p(Ce*8ySkpuBo5>Yg^HcK0K2ubX9yn!#mB4$tn;4L78 zBftC1n9~5Y$ep*g`D|@#%hC=5u7Rrn9_k4m8#IH8no)>+*eZWU`l0qQRnnkHsEM8M zB8M8%qyw=_#SEn8zY~t^t3p0Ypbf>%7D~W{+@DFSAP*kX(`7W9s{89qj6DBkqKm;iqk}yAQIn!pCGP_I_5QrN^P$@wEl{zpb*=k=44b$yXWki zyC#+FD$zo}AnGfnfGU;;wm*@3#g7bK#hS!pc6Rdc$|@LUEA1-4&`H#=_!bnT=6h2K zbaLVY8=&E1G-}6L347yFvr6OB-AmTSJEj~FBg7`1eM)-WuwY4iCsG&coswSRjkg;5 zy{10+8#S2aUoAU{$=>(a6i`v+uXwwC_TZl0_i>6nXGbyrP1$h0tBR;$TjN?iO7_?h z8)8WQaJaG<*mKR%4fa|^EAJ~5f2238cIRR6h+dBs#x%dbascihzwe*V&~66gC_7u8 z7R1B4OVo{#N1Zd#6>ijvT5yl1pf0Lg)VHqw8~(baaoX_Fs-X`(X4??)JVm zfApRl$rXw5fm>vI$&@qyWhO60NI1M46bgM$GApmN7`puf*o)Rkt>pRzrB5 zt>q}P82#*6?uVsTnmM*%CK5N*LPJ^RY_{bZH6oRG$hrR9O=*SQo;wqHukTg`q|J`^ z?W4m8MCTTk5mfs!ssYj^TU%6Mko%sM)vuN5L2Ue#KnM(N^>w}(Z+ZFo!%k0~fw66^ z{r;$@tYJA4&>=u~q$sduakgRu9DkkBF?&X8ucrfWngkX~ zuVI7b$pO#(vW5=;$O(}Odj51AES7sd6&J0XWl3jt`;*a-F5EJ!SnKAaz7Gs|3R9Z` zWQ(t0&f^rSKEVo-SEgt10Yiomp+i{a{d<>=;sO|ILk%t|2!=O5nmPX z-^X-PMnVp9M~Ma9k~_tYs!3IqyH_3EaNxzFxba4;&w$;SoCY<(1EUB_=y?o6&Ld5# zug0e$hTR&`?;zv>t5mPI&zCha+mkwsn-FCnyl-f;Phha$-Owv*FTJsn&Y0*cO+t2-yp@oXxw(G}>N(`O7}j?su?YM|owu)9)wl$^pH=805x(5} zbfCKt$om!bs|v1i`6U>ypTy3ApM8YU2v(qnQD}$aGcw<6?WY)9Q*>C?r=E?>cr5k;7J3?>PjCy+F}E@gdrJ{Ksgw$zM%Yn^xMu#}AxpohHx&YUm!1+-jHzbZnjT zc~8BBXZVt;=r{^up7a@S-V`xE5uO~42pp|}8QAO^ByDoi#*~w_XIhJV(unBxHO@3b z!qLSA#-)(Ho?@==hD1OvBKZLeXdI%xVkhhU93}Sw_r})>dv~NrPNS+6^1(I6Hpp+l z#2q!>U7_kqJN$EH*kJ2kE9o2s^9p3EBsZu$+2LJiIkVl|yc=1ion70kn9ZK>{nE5Z zEUvpe+FU5soyr=(`8{ID6jw1&v?a>G>SwLn)`NFH@jN*c)}|{ zWUn*A2UF+_91jp|T%3@lygGo2ngScoU9ye&%v)V~@@H($xA#*xthAGZCaYetXWRkO zNsdLY^%z}!{qBbc5#S=oB_I$EAdUTeHKM=@l*i*}v1!(}{sLvdH|~W10|qxx0(=($ zI^d9X&a1-(;4=0KfTaR1r`1rxOpjOzwU#Zl)5i01T|2%}gy!8*gV79QJ9>SHXpuW0 zy3E@>BgGtrYxF6*6kOWfH@Ts@dK~lMy3)<5s^V(h7Ci=o05ju@i1YsHuqTDx0JK4= zuVdtn?{WAq^v91MQ=hqd>9oa7!6l0Wh#EinUc2C6zCT%V4t@K<@QXFk>_x*ZgPE*7Al8X!h~ET&v6Ym(=ZiFX*Gwt{39R5KBX9#*&*QO#Pz zA#{D*E_iWXYVmWwTM?=!o2W*yVv(jX({n$o0;MeHl1KfiiC`eZtgk_YqT;E_YPBXy zIO6%@eC)SSu9cbdt{D(Ew!NOR(n2oq@PH4Tl>)Dy28|!4#{z&3;z*5G=~GT!spX?@ za?0a5Vp(?~(PJ=cSbQ#ln>iXy)>PHjTLay&b#927pc@Sd<1yPkzYu#RWp$OmTVhZ9 zE!V@QobO-WJs>VO1S0OM7K%2CcD8aGZbsp|&KV17D7+UuNk*mo+ZMbm zIY3pTL!cG*4O*_u)bAUsi_>46!tQqJzSQZwws&i@IC#G?BK&@5ZJ3|H^33m3^S7rr zmP~4QgTk|Bk~m2dq=5r=AAd|!DB%RA_$!N)r+1`ZbE%La7%?*nRF@8(J{OPS9q^Hh zo3ioJ&*q9H9s4S5>}N-(m=5DwlUNXrLv+%59NOONFwEWmV)~cIKoc)qRN}_zHyRHf z-I>5v>@@I8ZGL+{-okr?8tT`0P1EbWDLH!1kAZ=ScsJ@Ed6sV;L}-jtq@dzwiFa~$ z@OtksPaMU?K(8q#=8FFC37mD+tZZ_!;m_(F`C;{#iDO;Pe!&^5IEB-Lo;PTDvhn#4_<3^Xzq>CZ*1?>E}9vV_sRJq5qmsk!IP z(xMPus@&eA*qL&AU;PEk(!tu~Ja*g}OyX*%nBYZJgGPVv(^r@eofywe?rr>v#i|Zt zp8Z=+jlp2VILNRK_rzz{y{5m-Q681CxbMjDSm64wf2?67Fh$*|)C>W|n{@fd7=kRU z;D$cbzFDRuZ1ORDi{;)AM>%!iV?@hbv>r@>*zI3GK{#FYmNu13kuo6d+?!m6$f`dN z3#bs7W`r9_Y3ymspNeX|eo+z-5D)-@$S)HU8lX-)lY4ytD;U!FKnKfhq%SfA;6HQb zX|xqk?&DuJ{S>w{IOb2D`EX!j_<|n)T({Y`Rm}U-5G#y zsHj6_7ggj1hljn5u-?0;ez_a7M$HBj%W1!NL)hv z8OD=9@=Wn+-V!&)yoVv<(R50Ibs+nh$`;OqjmbRs!}v*lEOSp-fP8t2W~`0Gt}d56 z=3k zJ^Y#jA|`F#QURJ%X(7!Z{bCv}<;06Z72&#s;^zE-j`*hgbi^CN=4Ankl%wzt5tnx%$U#Uxt7+o1F>3ce<1_YWi zoavd&QM@w@lSa_^P(dp3H(w5(6V$e5;)bqZL$hc(bI$YU733d#L8@dQx_V>SHSHxK zR4`5KvedgH9d}&bk~uE3fx_*NPt%&vj&6*8MClDbIw+I8`$nr&Old7~z*ev_Knc`0 zEUH!+UZH*&IO>GpW{JKvMAJxZYSCE=#teTZW+f) zcM8<^R*abU>6dpF+eX6%TlCRYk`>akCfuR*m5-Cz)lv@G(_lxezque=#k05jZklXy zkKBzjhZ3CnAy% z{t4K}{VqEh3|Tgz!dz+BWiiB2AVP*oipaZ*t8Ta zsTb(}D4@}6_Jnmn1G78*wJ-fL?!a959P38-agnUL=>{AYg`Wgq3AGAsBv3hoK^C^F zH95{J#i(Q;@)Ez`ey_0+_ba$44rGKKv<|!M$%8iP+NE}NB}l$lHZ8jhV74Vyz(nWz z_TCMzP>?fM#CGs&f-=64SGxv5XnBkRrrbhw7P`H?>jvPBZw|yasVM`_Pur?uk>AXz zNPDYXyB$>C-jyb0txM&S?fCo{`}BKb_gI8|cx52I-WGw=Hv}$z?jO*B3in8hajC7D za=F`RPTt&p&5+f*a4v~W$8W(Ygy6r>t2h!tWSKCK zVn1T=*sRmPL=mM$`kHp?iZ3^Ya|)?fxg<<=6)Zi8L2=Eel@g~`2mT6(+dLR>KSby(d7p?7Z+fE=C=9OQl(H92aIAx&lU*-!T zRNPU?Qv}KqW}tuQxG$>tMKeyBLGj>>t#RouC`25x^w_1_dR>EjN?UP9I}&gew8M*S z@$}E}@C!FfBM}BwAcj=ne%Jk{MGO<_gFC}7fmm@aptl1XpGrF-z1@CBP$?n!rk`uX zA{$bkkYgWsERyeramTNgpa%+51=8?J)9$Bhlr%Q|up~3SYoqm=!7A%{dc^m?2$yqO zAZPu1bw+!0DUcqzZ8Q&LGb~EoDEkwO7N8rggm(k;=vFTe!K?Si5b6n0e zANX$3czmDIoDLo;Y<5`~x~@(#ptnM&yq^pHekqR}znyHLt1OpFv47|mWZU%CO4sxD zTdduvFjXk8=cMdRP+(0)qWKB~a*z{LQRv<~N%+`^7`9NC0I1|r?R7JLE|_t`NQXSVfc5de(QOHz;&&UOH;51PmOtO zN>k9&QpljRem+Z%xya2i*W~Y9NJVjdv9;Z!&2~spjlkfQY({G8oqpz}X+PZ7{^F+A zBeixPO27Z)$`=kjSs?pkm$HxBs2$oQ#LzU&TV{G z!Xjjyz%AC`%a}1O;eaDD)|ZP##ScP0##yLGV4$z()&6~YI2*!AmL@w%h zP+%>YoATam?>rO8H(+J^ zwwyN6pzKi)3A=JG+|IGVUaupK<&K8=boc~#ttI}>0bw-)K2}He_4o?oFv^(x6!qD` z@lL@?UbFx8KnM7HU;T+EIOB9?K07}}m6C*%v}ZI!7%e;)0E8>+kg13rQwheeWd;o| zawEllqeagZKg8#Y3tr$@rnL-E$SB2jBmbVRL19NB&rfBS z*1OY%R}mp8s*xNWt1!I4>(V-kLgCAASmwvaCbhG+wHHiNBO~YpgoIPhDCg(rHz|yt z`YZ{>^F^bMlnaiS##ith*#cG9kz#Opop4|U@Ze7Me0f+NVr9@-L`cBCXND{;{k~JS zaAgYylsvKEAyr@i_F)RSu9(?J;;+$?G!IXMshOF0L16&${0V%L!_Gh(ML?(T***t7 z+*9*#WSHDhLc;jzt~XEKUi<*jTblbARvNH|r!x`}Z{ZNe;ST@` zWe?2NA~4Btkdv|`a_n(b)H>G?njC}Efv3416=fQg982S>uDG|*)tN3D%kOI%@*M2G z{M@OyM5E6NR^*8sLCG9@nqkB!+zs}aXV)txtNEN{U3Cj{tDBs!?l{?jkhi#gPve8i zXD}>Xh2r?JhQj~8gM7>=vA0Rn?JF}e2u?RHK_QEhWJu|0i_sHC<^&stD-~iE#y0qK ztRQ5Z#5LeX^3+K-A)$wuXL~Vr$$a-JuLyUr=s4!nvY--?cYT&}3#hY@ma3?b^~Uug z4iZX*(qvyQY?$P2rhMQ1MbgXg^#Ca@%L=$0jy5Jw>=T7ZaXW8ksuM&ZqFjONH#cUg zBUg5!NMtUu{id;dq_>QLPT`CWJICB}3<_(YO3AM~EstCKL6!J`nUdBfov-`$3H3wt@FuWCpdFD}uVZ6av=f4S*n4O}f(@tEaA)wLJYZ~c@J^>hc+gPZ zB@O2kAZlMjkT8M+9q$Ta$0?l@tIkro4c|>FIMMHcHmp&T2b|<_BD`up7rIJ{U#mop z;N5puSja^LADlYOR+%E+3c^F&ARFd5ZfzuUxOGK{dkEQfW=|g{FJH~E?@JRJ`D$^N zZ)ObqTwdN-;Hx9__ThB(O`u=-qHn?{^kLo_<+J>X`PuHj)Z>qqXM+`UWS;z4`wQ(& z+diJZPdJny=doYV5l?lnY2a;_xrcVh`s3%8Si~WV1?G4+pUC8z3atFx-eudz$~=~V zR*|cDqGj3Ek4^WM{!5wInF0t=v8U5G^RZ0P?|@DR_^V$&OKE`38aV#$?ta^x322^y zL;B1AdqdA9_wPS`=-JJ5Q2X4~1;k*i_?+tha%LE}J8s=vG_os`Rw@*$!$e}wz%F#XR!!g!#?|;0gGCK3@qvd?S_FIeDEwnYfa9Z_^?SGn2}WI zKgT8r>)&eBZZ5yN4Ez)m&wO<;3?apS`YctP4Vx0jx^?WN>0;A-YRZ9@cS8fJCt2d?}Tt6znQm|$xD7#+>VH?vXxd#2f8 zgYE-;YJ5HkD+=VcdGGYx1jn0i4yL<)($3lL9DWxGZ|0gN39B1}6vbg|3V;0!rduH? zMy4j)v+v=JdCGx)7!N1ebGPTp5YFPQmZ!We)u9qbm{3To^Xt^c zv5H2T#xrgsoU##g{~E4}^jf8hz2A-R9lVoSrosdk2q9ZM#hv!+0(IcU1l3U>%=!&k zMN6Ooa#+5*YCl>AeE0V;Z=+(hSiL|gC$Rz7j|2Nu$F>x2ofw>&C?G7-?TZ3zQ#o%C z7!j^MEA0k`)5@;~>O8_Ah5<{E*4wiF%Epb;rm^eQ^d6x&WaA4_TCbI?!M{$;W9f$y zNi*0JfdXIq@vn#Wk&_V1m&Br1yn29d6Np=V`YgGf-?NGmKB0oy@ie@D`m{8BGre++ z9?x+cl}Fg}V3aW@biOP!NchC2*@>KN^>6iNxwy4gCp&WfE0tMUN`Qp#PYPoi_z;#u z&nZ4Z@{sM_sqd!}o2w8qPgM&`f17vm$;f(Hn>Xc(kxMzomG_2yL&O_=8Uq>>ak4_p zYM%XXH_n9wncq@fNuM{CnPYeSSSWLqbg;>OEIT&WYqybEZCzy_sy0Nb?#T*cw9)=l zR9f_VPLpIvh>ptWo$Z!Qd8yz#^KnKkN942KYcqV}OIlL&U+-bV(IhRk3v-h}AlrUg zr^pBd`D;tx5}z4_ZTdBE2Bh2hmHe$_3Yfr8L^i)D3naGhHqej$CgH826~H8Xi-X8> zm*Pqq_jo}l^N_--!6#!A$WXZV^TflaleB`YZ^m+tqT}c2qQ!bq5ZkSPK};_4IO4EF z2XZ6qfy$nXfqe~#{Oh94)XqV^IeH0?f&3}Z+;8RW)@d0J)gAs54J1hmBUe|4HDx`$ zs62i*m1dsn=7M?+v;)W3GXZ5)t?KhnQx@5+L%3P)hXR>f+87TK9u(@^aH2F49C z*iZ89!K!Z;07&=>I3NI>aNDe{$j69ScwqTZ?PoYCS`H0Gd?7r6tQXdo`^k$K8F+EP ze-ao^IbI5NY}&!ME9?6q(eeTXhyMo!a&)zB)oyqGdaBg6adKYvn)`+)MEMA<6YAaA zU-sn3C5cl2G6l|Y@y|pr{4@qJuN!FPJ6F$9(rPSjSyav%Uvu!R94J#ZcjhNSx^gWX zX|ZX%x#SOV{(78+h7PjC#4%v``DW_oh9~UN`WkqxhGk}T5Tc=7uM>|oBJl7~_Ldtp z@DJ2Jy8Lv@Msi_j6QGKFl^`aL@w>#K8k3fc7PSalx<*zWQJE*btge@ul72WUlbK*wnM-p7YHLXBv^#6xX3YxWa>MuYZBH#5VcIw%M+H5z2 z1)ViaD3|x0ETq`B-+vG#_bTo5Cb@a_`g;8oAp>3B7bF<#l-}di%b1(9q=V8g6p~>y ziXoT1CWuXr){6DGivr3s$9-$kh+>NHC<606DTlw|Aj_yA)ASR&a#W`k+eQ$)1aHGy zdl<#1fY&dEJzxI67GSF9>HZf&iO=zAg$eT0#^>RAvmR=AH4WqLK65WG;k4v8Rw77L z6l&_-W8lB-XL?3tg1TnU@c71e!PF0DoTWYVD-&I!CZ$fp6^@<2<4JMH{_12@v)3q3 zi=bQY`Z#sm%2OMNWb>{q8Ursm5~&6y+2!qn%>lQAg~RaW3&84PNaQJb!qftjMpH}CH2)* z)F%atjz&(;)&A>Yo!cJ;?L+25MKpGSObu@7J3a0q(3S9xIv;3hq2oV;&AY*he)K%w zp?#&L4XoJDV#%zY5mwv5?Ri|bAh0@I3)xt-A-22v`1h{_Otkem(Md4uScA#SgxV!| z_iZ@&XWp{JGIN%USNz$Ai4Y4py|`A)tAP%_GpHf*6+l^3oLT3=LkPSQ`|BFrm7SRO z&zN$Pz9x;y@>xe}!j$I|ojKG?0y@ z&+C0V4uzayrnz8??Q!7^Cw^0HlcE_bUpaL4s}HC{zaNH7Pvwvg^uLBAP28tuS_0*0 z9yU;@2sv>JAVL`dOr2(C)cFk;$8sbYAc<9J31oN(;W&8JEuR)^aT!7cb$wwjt#>c7 z`GX~u81sf51qG2{U3IhT%GsQLJK@eZLBKo_0|evkPGo=m(^(CH-{Asd5*xlZN5`N> zpdZZbqeQ$y^6UArV!>u}#{RAcXHeke-}#n;t-Qwa3>jMLq`mKSl>~+YeN0TuhYxF- zY;0tm-QE7taVCMgyU)?&!sWjwCtrWG5=ZSc>yOp>FqSF&M(Fl4NW|l)m11hDqGxAE z7S!49hh^$=maMD$H{4#(qJ@YH#DFpIsIrZ=ClbtE-5HU$|EV~3&|DfUOPn2)Jl1nm zP(6VWmKS~0Ny2??9~IK0wi(!*^Zvdk2fD@kuNY@0fm}ep5L|;qBFCEOh!KmrCY)qm zz^otSDBmEffpJ}8_Rc1|7Rm3ZXh`_**D)o@W zw6MDl;`Rm9K$dcx30cIJD*9`5jixb~9LIt#X#LIzqzodV zpmkdWAw{@c7IfP1iDMedV(eor>CezZO=bC#s+E@MW%OxombXVb^29@u^CoAE zo;j>XXdnE)a;$&+lpy?7EEm~Hn%!%7U%gmf%@rL8LOeyU6em-q3gKA zlUPU04&@tE4*7VcEf{TdA2t~Ux#{rVCtB`ETdzf6l`_dy{dMNW``g)*L?zq0V%fLx zXN<}U=`7{)DgrXW**m0on%9jWmpz92>QV=jOz|@=G$dY?*2@9-b~uPpMu5Fu#=cvJ zaDNo*@ld|gn9F(RT*z{vF&yYV` z(Vqt6@0shDP78Ry$8&K1-KNIfwn}f}KhX4jx2De=9cd?xql}|~1DqD)q$PbMVqmfG zQ$hRl$amwUV$FL$4Xg}0nv;rts?K58)05cNgG;DXl*|%KEMIYFaV&k9aMRCx zG#z!f3uqBVq?%m~cTSPrKsyRX&fD&LJrrIKZ=Ik!RD#%j*2?X)E^GI{A>)HM7$UU6 z6RVwaO$T10E?wJq!>Vsxivo;TeJsLN$^{0tH&!Z>v;%eL7JWv7WcSy^DJ(s?08E1sMIh48oBb4tLoc*$NwABy` zXGp5EmFjLc4UV0{U)4)-izE9TD2GvsBEH~;C!|RpCkP|Cqt@cw{73uREk=!)7DOTY zL_R74A+i&ua*t1qm4^X!(g10o4;R?f)P%R{4oKht%QNNH_BP;_iYP8Fu6uvXB?-_4 zf1BOy%qcR^RIgQBXw&%DC+DC(Wix_WJKZn*gIQTJz&{lH2O3fi7r~CN>qZd)XC+b2 zsLwiZr|Ad#`+U<#SILx*(Tc{-mcyuI%fN9X6p{2>x-~1Fi!YG=!Fv}!4U-}Fs*sg} zknWV{6+n_w*{+lPep(}9;^G=`i9Y%O2H3vOSQLO6D<6>GIr@ov96@mj2)|X@%^83} zKrkg2-zDw$%qM#Lc^9#(gC_VEk4Lb_(F3#nf(K$jp-EJ6aR$aE8!ahi+Sz*pO`LIh zn+rG+tTfQAq_FXU>oz83_9CK;R0p{^Z-HkXROd#I0An-Nq9|xKFeb)QEsPCri>pyQ zb!a!1mgF^GM(fBis`&Ffx&Hf#_9jYh8{Xyf+sc5tF>9|4S1qXn^*4(xn6P`N9hty4 zBzi`RD}yx?GBQ~nUTE^`KBw01^Igf4pN(_mfuRH2LmD&O_0Z4$$9|s+IO2rp%M%tp zEWGlvx__O}^V9FxthHQcN_9nfP@_`!}_kH#@NYAC7>9RzM+j6a-f z$0!74igZbCN@`P29@i`1Ih~=3Id**FE2GJpKh4VuC^?Se(S% zZ&jZximsMV80RZHvf*|OSgU_Jnxd6BU2b9okhX*2k)=!=#Ku;~apC~X2+4iT57%*T zN9wfe=~m_Tcm0>idE@10-Zj_g2>oIq`Zp>AY?oPE;g}T}&m4twgzE{9us3-N)-@Y|D7*o)*YB{Ccg_z42!ef`cJNU;hQf{4wIG)sE=9Fg#!LY1k zs$C{EUHVa-`e{oQ4AN7J$i`m5!E!DgsBQ(S=st#m6Ksc3S^6 z*3J3UyY2*gLQUfbS3J+xoL-4TQMAWab^NcK|3ZzCJy%G{Fw)1)J=S&l0)Mo7@pH_q z6n#rcWUjGKizZkH!7Ltb{xvf9o8Jrzu|-`kfAd@9JxKV}PHmJWG;$tk$(FTQOisA^ zHOLDkF1dorE2k)8@;b&F&i}5|Mz5YFQM0M~u-)`zSJH=;mTs~tkW2$BwyJhYd~}^T z0XxXe$lw~AX1~|bF9E!Pf(XUBwW61!36vAF4LnDs#be@JNDi7lKAMe^u=&xf?-zzhrkuWgBUouQABW67;k+(UjPc#lpP4p`QUq zRt?WNhtR_$`HZtV!}kM%QDj~rw;L$24W9tPJz1vk&i;RNy;W2cZq)WYbVv$F4j~{Q z3eqsNAfPmegp>l(-Caru4Bai=B@IIfLr8ZHJ-`4%cf8~OdEWQv`wnI;4rbQkVO31-1Ds z^ZN1Nx6cmXW+-$VINvl=nt{iUXZ$V7)nb>tXr?QtAU=1X{?n>b4l}9|{a4=<*AW$C zqaobfBZe>gv&|2EieucjW2WYFn8nzhgO~{LvEHXjH9LpwPN_z*Li6ot`xwfWFkCrX zXu`48EsImrZ^>VoG=de!;328ZCnueLB1UY>1K(gyAP)t1Q<+SPmZt0U-Q&_tR)YAF|6Ya7vi zNQ9Xd^(zVcm>=!)&63Ua3-VB2{+AfpSVO|ivlhSvQJX>GO`hSHQY-dZwQ~M^Ip8{1 z_o_Teb}9nkhwCsTosK?xN?L9d=&PF>MNk*^$Wm=%bNh4+~Ij+_bwKUWN$xje4+IFq%SR%WJX_;|3 zXadt@@P5Al1WINQ)*B@-RgJcIWny6mGMtOzPy%hg?tW;ZTiioTlJiD56Wwp&FR$T> ziQ>S0C7g2S?kk*Cu{8}ydjp-L(0Z9uXhJd~I={H^N`+SNRQxq|zo@iGdtB#x33!_f zCOdNZ`+nbp0pJi2*o!R=hbKnml) zE;C4%ZdHA4B&vd=9}alwuRbt5ZU9X@Zd)0;MIWwmLmK)ng}|aWpPN6L%(MbJA|M)r z^2|D+-^I2oOrp34i$uB+O%qnYHeVY;4Q^=Ug1jH z+Iu~myYrRBW6j@-a(t_gVmo1L=`PV=Vu*#wj}u|c!LVz*KSI{v^?pox&F)%yky^|} z!!7^K%b`MlKsKa`Xe$;wF;+ShM~<0MVSd!o@^$rd-eP~3D`hb0&`H?sFPvGb$R;Va zA7+g2G-Dptgai-CiAl+?DrU?zdQUP__RWY)VGA&zj|ygRv&1?3tmaHjfI8%?A2W(v zZnYWKSp{f1LFlD{ah2dmM)3)0gnOL*`3%xleuATDZBgwn+g_OYY>F~$a2sjsS!JeW zH+mE!%$2dDNbf39z3cM*i*7W*i1qy|cr0^ZjeXLOs<*q5oxDEuiTMbxbQLVn3*l{g zx#sN#*ucgyGOT}+8Snj6Pad87-Ew`T{eFKpYO>2`iL!~IAbkJWS^qn!ZEhApg^^wq z1t&e+qdfNbsNt?65hh9{F=)i|zS!^D+}yN88UwzYJeA|Vd#L|}YKz|g{wKBupeigq z5Ys=&RRpj&qZ2im1!=h?c6hY4*R>Y-Z_!q;To&LJV#JSDLVbWf6_C)G_jHsUh*`OJ zxcq{7oG~Uhe2VHVa~5lBaQc>oQe7JhdPC9_yJ-LjYoy3EHBGC zq!KaCkSxSHdF2NUGBON}d6cvk&ESn-ddFGMYKppzS0!#ul^fbqcuA@xzNk^+-)Jf*^trY}*W4dl+#+z?Z5v2fL zMQg8~!X0sl#01v_B;Ba99@`vknvKa(*U|Ny|LPmV#}L)kWuy<&#erm`s?W)g$9Y*+ z2kvjl9UwSV}lN*L40H@qiP0Z&W+GH2@A8yLe_UM-!2*m@(!t{ zcxc~rZTS-wGkh6)@8ragY*3121to6!XzAPM%9_o$J8K~Ny~JAnsATlaVRy2%2_?I< z`MY5uZ^!T}eJ)7+t|{dldeVcL?rvrYOf;8@d0NKT_7L=a%SJKg+23#V#4Y#Jz0FU_ zRQ+K3_!!dE7q@w}k@0cjT+(2ke#V-;LS%Ci2ONENjz0a{;&@I2#sty!ukzrkmrW`o z4)qQc&j)eMiG{<}NEDFF`O6+zKU_cbyC%7c^b~a_@Ljv;7Pp2}Lppb@1d?fR<_%qH zn}rO$1r7c0<$R1UsIpG~qFO-7wo@FUGXRc_gg?2Xdt_rJFz^K)B4w9{(d2!rX>Pq&0 z1xj&3yXPv@7B|P&zxp-~epow*#rW9&r05lYI+ncv<4zU0k-Ev|KCx!HBBL5Hz5e#Z z2<JbC!Ix@7`p}VL&gjOYRCJ$1V(UE$U9Q)+gND0A~#TjPh0mo2Yq*#%))oje6 zEVwegp4-Lt@1 z)gQ~!HXY2qqmXLWT)1zd5hAwFCi0A>qKefESFDy#nzHK{(2ww*QP!2w7zyWcd7*}5 zeUU8hEsFxpprOE9FP~G`EVodg?vnTNFaGHj}MTvbnFj(*U7n&iCLzx}%6Lq+iaDl>CLarWr<+0l0_&mKpi|4)|5bq>th zmy*Ld-*_6}^#={h%Cf0i9n-5AnL|bTV4py~`n!eySU^Nlr`ED%<1+_MiZv0*rsVNR zbaONDziNg@^p+IRi9%wa+;HQ8ceDC@KmN^jY;4F;?G(su-vbN9wg^s1^8$W|G3Y{a z4U&}jK$edGNKgy5nUfB+)DU1fLZO?Q*)KsaMz^Bcn_Y?wGYI4Npea{LNDTojVp?mrA z0yTsdZ@a=m)HHouTSh*~`CHFz5LzJ9Sp~TzSq&6D97LcSm30WVy{lT{G78AKNS7hk z&GyXlw~n)hKB00@?$<&C=SRN8E-&9t zUQ{Tgg90S!Z=-6xH9CgW(KP%+1l}FODWo!>qd*`!wKEd~_$-9GgL%Id)=LTMp+d&T8d8SgTTZ^~vF-BxIt<`;aOE{Ar-H7HO5 zVs#>X4ZHbjKxi6jfOX$`;@+RYkmNO|@R<#<+FA<6@~T1@neSPqX&olbqQ*ZLShkjou0=&fvwERPDqmXeLW0Qvl}6U$ zD8H)YCHB?BF&SS2YD0ICP%~3!CZP-HD>(}zw;U8b=LKmSGH+>%%pFM4=?Co}&zx%E zYq4ys$5OH+QBUduDrHTCX)O`c)clh5o*50dnJvY2t zFLT(R${`9*>De+s+|>58{U#`;MRMp3O^etdz_NPBgE~-vhn8`|^Wd z$=$R1bGbx%x^ZoUzsr&!%Ync|DdNa4Xcsr|FXCGLpk7Ht7}+;U49HtG;$-pm zh=Lw^$)mKqt7Z49)os+rw@&tP^f+~NXBi&`nf1KQK_aYCql1d<;!B-%*Gz2UFW5wzqrIh z$;MTWq%W?v?<`1Pf+vXhFMY3Ohc6W(B(S5^oVvgNry#b{kI?%xTSW6C zK$cC%b#K}Duvuc}{C83f7_;0&_Jq1102vM1ojC5SoRn9Cl(`72LDBE!=Gd`I8I*LV zDKw(*4T`P@aWv_RJCG!Xx4;R01DSc`N7ie@lXS>CDT$|Dg*D=PI*Rb1!J{;u^uufI zXs0n3(Ba9P)Ns+mG4R#qCw70hCGBaeHi&UfV&dYsc{k&iS0n21L&3lvRI>RW8#IEe z1s5?}1*Kg%3c2w3o&?$b?Q`WPc0FJ98Rc;&zcG@$jf*nU`4^FKE#X*kRD8{$Tv?B9 zj{cef!f?M4`hUw0Mj?VTOVc$KV2)U*MwHYLyNtt2(&}#z8Nn>Tmbs7GAG89p;~m|T zV5u*Mf2vQwd7iqteP3s~_;%7=Xvr&brhLDy^P+ki+LY`L+W$Dmttd1n^3TrB3w_`7 zAyk3HAnN`ghAKl?QC$v-+;tB?$u5qk!^pl$gN~ml13$`o+kuK5Mt^lWp+QZT%BN$) z``)r*?WxKxa9h2xL7$}NnxdVjla!(-roT=tIi6y|Se>~>bE@+CSeP-m&iA`diB-bL z^=oz8Opb^`68fB=@~$i(B`CN7$bVr8*|P&=r=jUY#k{Jzm!pwux8D~)Y}Vm8ong>S zM+^L}p*;@Va9BYD2cUP>?HS-7tPJFQFWV%z(aCn_X{Vjk?#u)`EaQ5}s)-D+6puq^ z8N`CF+l~4rxjfknPd7dvr!jQ=*YxPEl7b!MWY~-D>8;(p8~}W&eEJ z29yqBb+4C6iu#YA^lh?IK{z>&32#D=)hR6Zxw%)r5mno-sP_8IFRD;z7~ru!aiG2h zi5dAqKQf#^FPD!0x?;Hni#?f5ILDB}nsqI{2|$n-J9K|amAELt@6{Q)xyeUbxiat4 zJtsdZ#vd_ymY@N!taovhJql4BN(xADryp4q0h>)rkFVXaxgPl&b>J~v4TU-!m5H}q zw5W^0b(w|F)QE8)Z9&6u_v0){$)Jvhzv_3hLg4j5^H2*}p~rz-VRMV+UXIvfmx5i^Nn~)i= z$FR#tM8o}kh|jLM{UV8H+KA~9q?{Kh6XW_p{=GwE`-tk(3rV(Z;8pH7^jmWMR4+V& zzM3Sur=@RRYu^itLyt4ha!k--y8dn`jMI%pj|K)vz=;aoNuD#*kInu+FMugLjINmx z0#ir&(8=Jq7~>9a(6E6x{y@01A3yAK&P?*Sp6FJ~gv4gIhzT*6D|T>67JbdcPhc#U z+ngxIq;VW#Vi1*UpBfLi7o1`Yb|p#|!@9>2+1GG4C?g)Kr{^i;y?Su@D}FmYAerN1 zB)aW22Ks$>F%4|frTjEdrUVHc*|@oLh9t^MxDqiM!+6XF6ya!tc1|9e)Gjn*4Rw&L z{{1hee{v^vqfMY!qEpO~wsPabFV8Dw9+qXzapYtHCm{XVt+s8X5#mY_YApWz3#KcM z=j|;@3Z`HDjT%6s%&V&$s;%V726qfIdYMThYM_%&pvRJ@cKN?1M;VY}@IM!f`19NX zt^cnKUZ!=0+&^Teg_=2;T7|seC;q_0;p*N!ux6fP#PP*8%$7!|67>APbi`7t`1xD zUqbJr^a}{BTPW$|UoiBKd~l%*H3w!tlaXfykpPX8*4C+w?#Z6(kNuCGg6zgpCN?hL zeir|hku+=tWXSsh2@962hBwIfxm@IXnh({YjRW!=f!9cqh8HK>oa&}=}qQF-0#*f+Y`Of(ogp+%L^%}<`)DX$*7!nA@`H3AE|o6eC@~bVpc3oZPhS<2u-+Q7bH==jmtiWpF3i2K^FjB5JzDmH zwsLEV$)*#)xxG_(_re$ZSO8{pH}%B_=5F7~Y2@}yFk9&RqJ%HO5s^IDw=R0`ypM8a*c#w&3qU!68jCE!#VMxERV@4N7vgzY|Fh;FLk40C)2zQHWt;0G&ITEi}VAdy@-^6}CWt_D@= zQ~V#Kp_`hji9>>=@sy{T*G0aj1C`ka`gR@uGc`|~>{rHvT-tY)TU_bY{G#5j{>Zle ziiOzlP__Pa!hpi{$Q72`M!25*?Efntp{y)U*6P;&l#I;2ue*CTCR!JF)EGWOX<~P% z@^{pqqp(6D6Ic>`U}_p$IR%UL@s>rOJQK!r?K6i|9{8u4-&80BFr*{IxSor5Ws{)?JqiAAld)%R6^G4i1D2FpMxK1krmshWcS=G<>AjtkZS%UQG<0>7teR^hYv$PaiXut_$o3 zqFrvT1n70ecK0v~%Q{?gGSh!Q-U}z}$#WnH3s6esj*cFylL>pyWbAZUbz~!sP*$BD z$h&w?)R}qh>cBtSyOzu7Izmi}_fz9~WGiC37|T(AN=hfXkC|eE3g35kN}ZWA;ieZZ z7s@R1sxyTq1^P{-is$CLV}mn&ukN0}8wt5qcGHCiO9khCkUOaO)61q@;Ta{#g!^7= ztibD$@S`9$M4A@2G@S7#v3?#Y+Pgn#&+)?t$GsH^0bV9)nZXA>1v#GwoRE~9OSioy z!gp#6Fz;UMyB);CJ6W80|D%V{59f5)XViSCjRxnndpEzR&)I<#R=nbB7^i6&PjXC1 ziUSdN)%Ft=3~*?Oed(+{cbSm&??PNODN-%g)9{TzA<*dvqFy^Z?h|-uD)~KS$zolV zRs)FWyWkDKYF!My5aZU*mYZLBG7{gU5o?aPHliKUue1kF*PVZw^}_?`5<^G7lRkah z;RO=N=V^L6S#tN`=3>)chM1#PHBvSvT6Xoc)QO>JgX(L?HGQo!8VRJ#b65jJ$#_v9 zi+3F37e-Vv1w+*jAX)KvO{qjvEGPgdEpyWN7OX~cuAu%zM-KP|_r}>)7AM4&9jIGT zSN-4|SGoEav$>m==CqTO-l1Et0oYuKpc`&PRu49IjF&S9-fs)sZ`Yktyq{$(i@ovq0 z59S(?2pyd(b0wunlP^qkT>^q`f+%kAPhKiuq{`BsMdwA#&a3hc_&yT$5MaGh7sW<) zP>GrpTa^^p3j*);B6@w|Ef)1S$0kaYZ83wBuqXb@#5ut95Gap39QNpY5L$sMC-~03 zU(M3cSdduX912pOapd7SXlvkLhtO{kkxYbbN@{@AQwuGyq%0-}7z!?#*BS>CuIat^GV|~{(RQ~lQFnajvg$b~wG!TIeOQeCv^a~PilBMWTTajz z=#nB#gdPUIBR#{7#d~|*#>o(#oe((0J1Qd3B)TaB2WG@ChYLX7dC|rb;777}b;W6kdMWi`>EBf;D4as4FP`*uDg$VAEVc=G+Dj99s zptT>ie8l?hf>8h0AZ|0z^+vvpCgk;^nq2Op9%P*Rls)HP2;a1tsj&{t=Jodr{4z4_M3B-|(8yVK5T`VRljc+St5&jUbeYPw#*OmT zac|3Xu>ptQZ+pDCO={X2&IwxV(L2$j3E`?hoza~>t`YwelEZ8H+xx}?2lStM%Q%UF z98i6%)87@C@vo~Xp})BcEc`u{>1FH1K%+XT-5G;T{V>La97maVE3z{E#_k+2$^+?n z^KsJd#Y?Cn!wZo_b!i|VX3L^AGFbNYOKG%j1lU%N&X_y|;J0m_3%g`2Di;MMzc?>` z68-6jNBj_c@v@QIs}J;4ts^c|L@Z_&j|(U%OC8w3P^KsCCqdDDjMH|ZK}-Vn4jac> zjRDJkFe!a2A;?rtEoPQ4F=aw}=6M+towv$&0tkuCq)FQjbB!wukU&LB)JM9+(gFhZ zy>`h!^g8kjr04_b@mXLaNynQe2%%>oyiY;9t4HYvBSQEB{Li*4(4;idi zdZckiL>u@u@WfkQqVn@_V~b;vA1m*bb|&G~1J5v1l?jJDGsReJI%4rCD`C77+}EKm zUuFDlnEc}r7X`R_B6E=ZbgJOGauBav&c3?#Q^)+LJ9^=7B>dfB9o$g zmUZ*%7tIVs7;w8e}@}8%G|BKI(2x<)BsWE_@h?luunEq**{r*x7=N9NoX|oUT%?0_2a1DLdtG zgkAW?wm`UFN=|jy-^^o*Z8>H|s|Em^!VYjIjtMNodY3QoHXWPkov}VRYiRep8Mb#X z&nGRjDb4j!B`ai^|CH{s6>z8Yu2g1IGxwcHuSkK4bnOeI)=K58*8i4bx zDk3M{8NahSBfvrmD64#6(y@29_8~LElRx5kB^a8Ju&fOd-Fo&^hZjs~XrGVHU+_7L zt}8zhJtw)r*G*-nrSxRw62TkiEbSwa<*ewJr5Ng^1N!~d6yg5U)e($7XpZZkQYkJ9 zV9gnT7g&?u-UaY3NNL?EAHO8mZ-nKpizIGTK<0ad^pnJzBl+6&asFHvK4V2YAs|1x zIQp?tT9@op8dV6b;XtOTj(*-^_aNTPye7}+h;80IZq+}-a=)w_rN}RO5V7huQ^oDlRGE+iU?*N@0(~71jI2DAp@=hko-#vU2x+ z1Ra>vHDBvZ<_Jbcw183Ov)!{nSF&h^jkX+>u&MVz{PbVX=FXd3S#o-wvnb~!&AT$> zx5*rXpIzT1&+c<^~=X8wz?|J`S z?0-iB_B$}NL4~zu^%D64UjY7A{DWMi@%Ljj6eI)R%@JEBUZ9`CX}9`pj%Vw0`)l2FKKjCQ)7j4f`f&QpWW4^Jw%H`8L>_d z=?o_sE5snV84})4F4*m-J29rBQrRYx_3X(6295}KpOJ5f-@cEko>^5g6u5bNHD&p> z2f>?Rg=5B0f<{+NTN$cGGp5@iH_VtVK!uol?m!NBhUCoOAQXG0r( zF}t(0SPm0SCTk!4e2F48`nf{RlP>DRwliOkSIoj+uGO+7iL!niIEwXufGhL)oZ+`g zX1RaX&}Qh<8Y_wOVoq5%D4v9#R{CQ4KNV)SJ$7ug#^)jSIKv#1-u%+)dpI~1Y8vT_ zY~MtHzfihvoaWx)?xi{pa}*VKn~S`EwnZWKemOrx$nz!NsfY)|!?c8QiDJfC;E4ZhDx^9tIzKk8%m5&e1~Jtqh@q^tve`>dT+=5UwG_F=p8rMQ{wJS zb>jL+K;y&unj|1`McZk)3`Ul6?whm66dZqiU-ps%u6*sFdT;Cfv*8!FZ_h(Gz;1lS zaDKaV(2K(NBL(P(r{bnFSHykxSx7_P(^Q{mE%%4`hmfk-X#ADSL5bp*n)3S_!bWf} zOw6eZdHDbq?h9S~-YVz({=oww-w^yGPH9z#zaI>aZ~^YB+ig1ZQ=E5`5=1B3>m6ef zqh4(pqld{)+WClY{i(Tq*Qg}!Am+v{@xhlv?>nB1Fm#PR{<(H6r;l=$fNrU8BEJ&T z4;@XhHBhTZtHH*{RJ6M;qu+_Ik65b$c=yLHI9j9_j$B^un=R+Sx~}f0AU~1MpqepN zkx6N)gdfbSc_&@cT2ExUYwV)HdEXeywW)htuAtxK^3wed? z^xLNZW1qXvJdzy@-j|2m3pKyb-pI+1c5j*rW7~h*MxjSFHM#rd=3cbzn~ipb5Z)2e zfJr(0y~mjXPIa{UN9BWJvQ;|o?sGaURmsDv|EC`JSM_RIKDr+Mg|b`b6lf+d;9|e7 zkc+pj=uDLgWoR;~&_b<5PNEn1)%7#v%xo%(NDABERj7?s;E+V^48!9+8^W}j#?#r> zUB6h`N+2f-TkCUDUtuBeu`KW|VcxVjmj{>7wbU`HjsNEfB=nn1=5(kS&9|hSd#|-T zF&egHWiN)Vm;rYD1dQ<^s1pHGnWzu{uwvF>WsT_h?$kKuLs?(~Hp;Jf&W+HLVH*G` z&Oz*XJp@S!!>uxGdHIQ+pVaxMt)v(7jiWA$}p8c!2TZzha+|%;4R)oiOD0MOFR6~KlwKM zPWO8t(_atQ>-n8N4eho;-Oys5t7?OuqsI4@Zn?GWi{4|c^u|}KicCW|~ zj#C3&a!Kscdt3iu3a}`D0 z_;i3no{NIn6Hegr_%_38Tbl9Ch$W})!L^%`=%7gT4B@u$i3J^xa2t~1mmWS&_>*tf z$I`Y-A)bQbk#_j7OGR!8+FMDXR3{1V(We3U5sI8w{trhHHBl}p#-BMo{Ny!6c~?__ zInPO`v&#@3S180-lbp^oKgVhX&++{9Y%0(pLjO zWvEd6{Bu?xN{9}Q+s5T9kURyHsM=sJV_<{mW1rXNWi|r+!EEZqi9@CeJh*a=0do%# zi%WFwZU`he(+PfIj-~(sB?`V{AFF+HZBuuF;|e?@90PrnXI*Bhvi4j27QJvAKS8@4 z;ZiYzy>g^!@4ABRl>d4UDq;BNGsndTIe7CYtJHy6?>Ys}P7$HDMUyJ}SSC0rz$-Ec-W`6xJ-;WMu zHR$m7V!`&ecN`vpX){|q*bY66?fAd0M~(eni|e^;1}+}IrfmO;%5aeVPv&ciRhxKd zRztD#U&oDcwEADioh)(IQxX5qXZ_8B{M>{vfZ*rp)%O>9b%#EZ)Q^(hm^}j%%=d=~ zF2bDo5~(dc=1=#y!PBSd9xAeXE@PWvT@q{zx3*LTJj#R$_<|Wf=;9J(d(7nz2PA`R zVx~@w2PVlE5{dAa)(To7?C~2xqMa6u(=Ol$*9pVHUn-^1hf}|#m6@3>Iz$rWgaiUg zoe78ZOiBgXtY`>e#sIccc9L(`ud4He;)DAM9~QcD>hPm>XO+c(8aY z_30Hy2(f^4gw^vq^cmzK`B|>&jc){j(DVqCfnD#d{FUMeX0^4vyg-OE*Px?A2@%^# z;67dMh;U}HkuUN^cSpg#DIG&c{Vi1hB1aLKAs7gPyBA4z|eI5+20+ZgovE1I%FG`s&FB~GWU@N0>rGRJyk@hX}1owVLR$# zj1cHcDE~`?Po5d&eMT=0;PGpkC(}<0%K5~eDNWVRTz}|OM61=kf1P9Y=jQ708XF=f zKI8*SKqeNwm$wf=^HeMX!7w)$c?rcJpE`oB7PvTPBbubQK7@Y1NuJDgu?utc9723y zE^(l2GZz;SNp#^^w0Bdwy(21k{QNnAK7Mun#qcaUZTTp(d_V5l+NA+_QR3cJ-|JYe z?e3jwA8jELMHaFDGX!}YXnLr3U#pD}T34>>pt`+e=n4)^I_^uCh*-3H{4l{2c9?uq z(2^+}CyVnoJ5Y@wn&d=_0**!R-FflN!1t%bIPnJ1(8U<0D0#JY<>C6^nA7vtssAKE zu6A(vsD{4K`E}^hCpmUCD6wRm>q$%HMq>i%fhFdzc%<45fSE>-kaRruisg-9++8d( zlb#vu$x?%icJ-1Fjs`tM)PB>kk1ZiM?6Y^urzX(NU9r*;Y^BS>jEnRK*4@)au-(XJ zeCU=iQsABF*rjc6g6=a2i7UKJ=yIr08MGlWu<)6# z`zlXDM_^HWfJ=N{bP7--#%d)(9em)^jD-608XHW1YtcXC4!|Vqi};n~Rh#YOZj6MG zPdWURZ#~|uLh!~o#@KtxR@LK~5-+K#`b`O=Hw&cI3Ck05`?SG)0)-QA-sc_s%r8Mp zJO|8=Sw_|R4rrTjAqCdo8JRM!M~&-tsuSa|sEI#xY@-kjXujZf3EmurK3S(1tG657 zO-^_L(Hl$DI5d<%e7YF4fHfT?iGE9x1?%`1CSi;tPx;QSEys*Z5>ubTVtke7^kd`F zgm;@k&7mK@1|MqTI-f{3?F8^Pf4CJt z83qX+r+J&hrauZps#G?i9VLqiIkc#@4VxqGqTRC0Y+=Ro`J~k_G7U~19r`G zF^~-FQAQq{MRQzHLIgG>WQW&siDqp4Z@g!@;Bag3_IjZwB^8}xKe~bPWl~3ec{rF{ zyL3a=9QLv5TF@is?t#B?9;Ja|T%WCk-<8|$D&%bKS9m@gFR=L@cw7qb(7co45A)aG z&ZYZCLFz8XYcUJ~i_XL=gic8J4Kak%#Ywra;h#U}?AnKLFi4;OQKepB-_yxmnjb~J zStNCPkVO8p??T>RV9Lpdz7Z4*T0{*8#gNUaO2fK(dR@^EQ*1{QNKwj;qe)e$|3hL2 z)LinBag}q)4XW)V`ZNb(^ZetHPUaZ5%d38q+-RRZ?;rbOq;#M7B&Fw6eA-;(F8Wny zj&(2>877hooYABlgc!orDPc7S7ZJ@t}>7g!|j%bZ(5 z{6fB)t^_Z&LPEC=gh<%^*#zFbR0{>Qu58ipN8h*gO?g*p>wbH;36!TsL-DouJ|YUl zGKm9xes?*>HV5tQGIU=YjCPM?BC)GctMHgpvLBy@j4pgv%yJ{@>l;C>w}hn%*1)EA z8zWX%JMASFb76LJZ2ERr5g~|w2_;lBY*}G}81+G0j*a?{$S}L?In>PeACZCn|C#cn zZ|1I8_+s~14{J4Coyjg{Ce z%Ob-LKiw|xgn})oYWjF*iZ<0H8~Kqh2L4=V$oU5luzDw;o4KeQjnd4{RT=c;F@2s+ zscfBPvNc~`fZ^wOC&Z$a^Jqo|S&7xRica%L11WIZPErvnoMkxBC>q01H6axmhx#2_ zZnFb%H6bS=bi)s74b+h}QqxwmpNMnliY(aq0JgS(g*|L-fj&K{qWA7eW@i|R_!pK< z+O!;jyF(gakb~0RskVcB=g6}f2RZG8g2lX|Fhd}>)bPW-)6+(dvS3_ z^n2=~Xk=cViu5CZ%ZAoG~&8JczD$057YkF5se{;1F%z@zB12Q zZ_-H9Kv}!2qYX(oPQ|-RmvbXD?5$+pL28rWMegIK?gsiLyZJ1ga$jr;(^wa1e3%FY zxrP(H^L@!V#GZ*$?lYo$v1oSFy|d|Swh-y%83Wx5Kbz%bS6!y~4!`VypFm20SgZ7> z;xY$((Q9`CQNGlhx8#OKi0aW)d0dNZZuxeRqRXK2F$ESzo`DO%r*)Nw4-e?ZR-3NOwaq0IXd<5h~y*#9Ax}91uV@Z zr2r3jPNEXR*)M~94`)Yb+vbfe>zsC;@IW@R8!E%)NYM(8f8?yVumrGwAjZQK;1Ol{ zeiV1uhRejV%=iA=O^x=l`x z{x~T40prtbtH;1pjgFyV5A5#Xso#Di+Zu(WC%Rga&V2jNZ13gCRiE&h*RS<`4-6*g z5onR-pKTOw6P>;XU&y29LP|p?-BpNjZA@r1s=+FI5Yq0z!7=HZF!@*VDq=C|&*^|u zLEh#w$cN{aH><`z;m^lm~`J)J?G0@xXDHK9# zTOMrRdl_!#%2nrSaJ93cS^C<~-n0;zr`~-2?lV2dNNx6FB@LE3ly@lECOzXqnH zc<(2==cR>o&8k1m%Y3pg)@C>HY+Dy@JUE?bPD5ZZucZA;?~!-Ki^%v!D;)Vj%s={5 z76vHOel3{cjvsPSFN$)M5FbKr4FL%DS(L}x9Twf&+geb`zhBe$6qmQgx1K9u*o$am z&NTa14H}fQYCG(E2#r;7uJqWr>b-g-{poM%2uIU*JzKlKRpHh>Frk+NFf3&FIY_^_=X=*i~5JmVN>e5qqTu@;s!?@ePsJqmI z1K>0pjbd%rP;P%CX|M zcF46Yc4d?rHX;9rHsHZX{Q@vB*F7L^R@3^tM29n$lO<4}W1e>nUHCkpwDkK&30Kp^ z+(FfiJ&QUAZhx)jDoY*vR%a!OijOQ+>1|ebxV^Rj8PbX3|(F7V$UQwWhS>n9O z3ecentt3RsWEd%*GpX&hQW$UPIjm@R*1%O7zI0Y}=LMYRX{B(Y!LXsgz;cg_;N%Nu z*0!pJ`R1|hy%`WB`6(C8UUhS+#F{VlJ};()qnXbIPkYrSTMYfElsjp;>v#@xJ995b zUd>w@+T_7EW4>D0F*qSMgM73rDlK7yU_)~(rtYCf1py7|n7HrGOPTm}^N3ASj!f@D2xl0664 zvUTFI+g*C|nE&nYgavGOa86x~v>$AA^rh{c?$*8OY2)av*{bJs5wg=;@=D9+VNwze za5XUu>w!u-()t}76q$H>5{_t@z?YL(0;2DZRgI4uDB5n_D;0aaJsBJTpG-0*NQtbj zNS(2Xv6z*zSiR{3d49~o`0zdtyXo$}w`P>N=jEvX(9mrR_^a{fVj&(z z$%z2hv5nEW!n;iEOWWK=X|KLXSp7xgz2Vg3GrQtk)N$Xb`6ceIA5jx;1hU{E!bzk1 z4Il)jO;J(tPeqT={|1C&h&#aRgP-N*%7>%SkSMU)h;+pG7}L8JZv%I!nDUyycQl6V&=?iftRn2#A9OZxp@S0@en6g9yV^^-RS*75xJR~#@5t$v+gG)4}Djfa7+ z>#T;PhOssx@24b@wP}uz`(d|_k^DGtwMrGC8FC=Q!m zzWVs5>WO_n-{j{!begs|hJ;^Q1ln-te!q0+spz?8>U7jDz|aST`{ISJa?K}FDC~p; zD}D>AwPu2`ueKaP;@E7T69=RqP_ZH4I&k$89lVi)Yb-yF4bBN<4%6&xJ&zf|%2~m% zV_5y1_%};V1lRCMQ?N7hs>Z7!oa+U&sh8*$8J$@k8M3{v_HkK_#|V#et6HB2>91fV zpP^T3_hID{vCGW9db*?HAh;eSfhihJY{~p4rB4H<{;o~CUkO{9{k=_j@F4oje^x{FIzm8%c zuI98Zjm=br;H+YMUPRG9c51T6Mgj-RFUl_ajs1UvDcB z>#rTOKj74Q>IkA~-wU!!wp3T~eXQQny%t&(cR1B%=%!#0qb|A|Bl+Z}ja*H#uUvD5 z(+4kh)crK_AI(&_59bR^l$l#3I+%A?49DAGQY_t&21^{_YYYniv{cmmz5f#I{N=no z+VE*P<&!GgUohp}h&@jx8q?#{HdDBhO;Y7wU>p}JjS4x#6hkC9wr#}ucRk6vH5I#^ zVl%Pv!4+D*Gw>j8GubvePRf?VVz}NI1gsT)hGvc%_u#$Bl|(yx&lw;x=I8{Y%49tR6U6d>`-oIf?|o zr}Z=0h}aj~Cs*V6M&3Fd@LzyE&iR^ACJ#3 z?w~d4(EmF)b==sE0L> z(VS&3Ekso)3ilhX%pw{3(5c0n^SsH#vGB3YYFP#rvf&n|??w-wq3$0XE!G zmrjIAK0(!Dzhui1&0~hB*yo8>sECUs6h(<*oD3_w>Tpl*l&#B+zNaL!T$qJmL4T;_vh<|lh0|qR=$SSOEbs*c8=1(ga zybj!<4A@#en1fF^d0*i9;?F)WQbTS&ZZus#xh*|Rhn{9W`vMh2wlJ0+Gt?gzzv3C2 zMQ5ritQvwthcsQl6zdUAf zI$D#4a$kYeM>8+OI>b0aycir%vGLB(>A7hZ2RCeBH`Gt-mCz`^wx`ycw08YJ>VD5B zp#6B+wKX^)$4W?ilmsxh8&~sjxqU^M{!l?0wRX5X}ei^hL`D065u-ZS_(RkE^P95HFHGbpBVHS#yBr-c zL|5eUv2AM4p0}`jysQ*8?xLJ%(QU`N(w;@xpYHtR*&0GWf08s}=Z0o_RhiK()VC;9 zV^6)^_86(PlPZa`;8vk0i@U-j#xde`;0%*N9f?;AaAo*e;S;b~?hiJD{&2~Y6*dnz z(O3-Gt79`0wLqNN@KiU`wiHc2S@lgF%4Zxt1eV7UOR8(w!KJ+4aGQ=s_X-meylHO5A@Bl^sES#!Pr!@vRW$%>VLKvMQq}e`RF!+}sEvjK*Vo zu4t_K(m`)p2J@UvNk4(jr9j!&Hz;yCz}?3swtXHc@qA<3%xlU1LAAbI+|96A5T6V@Nui84m-9vq`H>>ay;;ng4Oe#0h|S{ttE3XnYTty z-=6^zyVQvSt(9^xReMEl<-eygzt@&UPP!7U#h%GWW7_|uSo2d^(*+h?wmv#&zM(#^ z`^zG`u|n;^eY{ldn~0U+w=}{{bFX-gHnOUWfq0S1Itg1033cy%dx1f-#FV=zw?o0O zLT`gEjNSSY)tA6AwKw5NNFc3B!18|f?Pu|1y$4O&1AKf4X$M`V(9x0-^CEI$pMM@A z`~8VhY7KarI7@PZDM<6pgZeZF@iQPXFbC;#hh6X)xWYAmv*H^)i2v1o6E%bjyC-Au z1*CYT5zl*);KiE0@Sp1us^9F)&ALFQX3Q_n!L=Fw-(Hj%vFu2SbiNjImz4PtFMc$+ zsJQ37K5cPhx4+z>bfJU)JDpfV`khXcoa0-B`u+ewoaY_;r>R@{?Nu^2N~jY-Av<4L z4g?j#vmqiyX~ySa}-)|bm(+mj<-JR;DcW& zbRBjx)#YSD@#PG_5QcExIk4@vwOHT07ZziYfkQN(`iC#TW&Z;RTW z5xVoKcBaRwjM5!A-;#Yf=VY=~a&Q02zj8ajWKK9p0gG}A0%`Q-`?|}a4Xa#N1TSD1 z+z&FYx`|{4ZzZx<+|G*4JsOczF2g^h-(ApiiqG_V`99-<@E#`nGQ+4Op4FGU52)8l zA<`7{cUMhGF((Nm2%#X>ok6pF=IFHdmT8K2;rh9ZVtD>7%dmuay_7I+NB>?cSc~(+ zX*Fv_J|E6%b%249LL?V}rfruAkd*>T&}y-x@kNx^A_GQz<_AFc!+ifnim<=URR?Ku zy<{(VBl_?^q|P^dE1%j1 z)-Xs=o-84d%!uXbcJ1}xOHS0pA+{9{nI&_x^094ia48tEITT2$%*b`s$FlU>vnm*>p1ck<<4H(mSQN16h`2857%*6js|RQ8PbWeNRfL_pz`u%!D36Sz1n zi=uwO$+Zajw5r(J-pOLc8LBk=HP{95TG?E^Z~OOf1>OY zl;G27hLGAXqyeHb^$)=2Koxzv67IxS`zU;&iy{>DDCOJFQ2lOMF<#C}W~QSk?<;BM zWmdU7%)i20g>9OEE}&pTi<5G0t%T?5 zHq5Xc5hX=(gR^NeUyPf0aF->$gAMtcs>ddmh`lLEsnImE_MF%Ckqf43P4b8wyk1ny zyk>y5ZWT=3ZVj3Am@?p(lElvHqp$;u5Tt(><4*$+|06Ogxn!9}_79s}VCj$}&HjGN zDaPtg526mrXf{htc=bVDkT><|QG%gfh-PbV_x<@Yt>HfM2vPqCD_-kVZjO{~eO9DQN{r)2qqzwAtuhFfu?vip<~b3He$Wg3nRQKV zHk)gyyMct|S!*~=_MWMzZ0*gzH@s=f25;TM0M6ijYlDYC%`_dK`l8miD_6oT#Lg{k zg<8JDd|`G?j}>hJU)yhM*_Tp5?Vt48g&@cGF%p`uzdNMJW{xzERislK3{K!OpVx8J z3Z4kuhYU0h*uaX0kYjna&H*dWBrqhv!<3L|(^bo|7TAcY@aZ%b;6G~E7-5m&$>4k0 zMfiI&>+wMK^hx5LU%`8j^JzB2u(TNO;5Q7M)rMK=EL);W@5yj|PZ#NPw4MXNklp>Z z_I)7Pou{zk%|R(?L#$Zg^8K$B3&=r~KIp1=LvZgV*KxYg0nf_PJ9}%~G7xZAGS!YL zvPO0yyG0=RjmHd3PWGn?#Y97D;6QTUgEt2LmIEKjTQG0q-Jd2}7Dk8meb5Ui))k)E zOR4rrO3ic;otLnX6mD8yiMCK#kvwBH`0Y~G<_&B{l&&YWei9}bGpZl-$AFQ*O1|C*VI2g z;7NGymhIg69mc3o^4iC*5Lx@(!&p%QR~)~=8vCw(o4@_5!5p{M!w9+mL5y#BdCs*5 zD=dqAJC1R-$GU3q>nikBO6S z$-Hn?sCLUJ_fMf>b_%OB$hy+=Bf6zgYW2jR^Hbp(J|=7x2m&)Ft$KR(>XG@Ik_7X{%p1ww4RCUzw-!_jT2pT>%``VHx3P*|SG*Kn1|xszEFVv zt)Mf?QSK?`)mR!bk`zg^`qAXeY%aLM3Q5-kS%4&oklL%e^jUBuqy&U{FK`5olCXp3R*k59{ zuVAs9I4EwqV}G8$_%_=!t%4ocTzY3M{&><}|Ks`mh;c((!ka-s)ajL`-dGbU#R!tUA@t7U>0tc?S{0`oy?7ESDBE(I6uwYrm6&1@_C)B`q1~e6{_81AcF7fx0xs zAR$!#Orf;qn>gH!TkAG7pX1a^lVKi0p84`{$5Wv@G*)t%F3f_O9I47KBsRL9KEO89 zl+2p5lw^RMq^KG&tJxx+OVCs>eo2-WWv!?5%OX*K_Hg0k02^b!>!8T~s8yS6v+z7E zj*nf**PvqJPcq*cYk0drmnZwi0QWR9AjTIN99HPW>Q`Dk9+-S#i^qjKC`xeZF>Nq_ zoOfN^9%&hq?H0PZ!G)d>YUA=|TRGQ}7KULYMpC3H3{Zd>{@>Zq*4Sx@`!Yk!5{X>+ z;@|bpl*_~3Vgu}GkQzd43Nl67IV}mug@5q=Pj?Il$3`!O141>l2w%hVBmIXB5G6E7 zyqVb4ikm)IzV-GNT2wKAEmS0o+F;6K%t5#fM6zNHABuI4M z;<9|4!dNWzUA?z>CrG$T`%_}*W-+G7V`+AbY@2Px+jbuKv+^KP*}wqZm#^xx4R&@Q zKURQ|Sx@eywsfKDC5%c$hKr}x_NJ&*pB$`Ziq%lqg2!$>fn-%y-N;|Kp1KyHR z5a6HK*eU@K{VUD!*A_LXGhe{ZHGMq}WL?o22CMRoYCbk*(S2VV6Pk{2qZ5~@PrMH} zdmDryTbfs>(RcxAAhg}i)%Qm#6oPryZ<$@K2RoU#TT|rr4iZX}Nh)D*h~ViU3-HBEo*;J* zU%!r*T9j*dDNBoZ9;TNRFL|B%l<4)M3f6CbIKoIR@YAsE^uxmz5v-TR;DN#WY2p5K zy!{b(#Pf;p^myK3odxENk^DSrVPboLZ{P02q2Yd#*s_Vnka@K6F@$;pXQmJvyqWRM zfC7>yZv!0VA4OyFII(F>G-gLwGKX%u^=zDeRaUs_qN%xpZGU&>0ngVx>82ThqO?DU3apkW`r$OM`6rFO z{d90U+$y_0(D@^|KJ3i=`vt-e#x^#PdSZ-|h)yLGH^jKQR5~t|E^>iEQ2tqdy-P=6 zrV;h#^+mWb1D;gks(1z86a@eW-)dE^nTh4Or11@3NPbQL@B*^q`Td}X?t+|$vz(m9 zQeXG20gkDaQrf8QCu;rY8Kh@stO0VeT^;QWw+u8R`=Ik*L(lYuiSuOD$xZ8kXwhl)q zAF0Mys!z_}KDoQn&31RjuoO%;n2^sXi+S&zywsPSGzCUt@!#7mA=n1Ksj=)L#Hm7^ z;WVzVI&0{=)RnzuxjRNT3;Spy9WDEhg>(lrnT$Dmx2t;C;n{mX^PscINTa9r_Vra) zRmG5z43CbQdU|?}{pPzMjdMYTNB|Rm=ZrXJN8KIO!C3K#m@%Uy^!9hujd(l-WvLH2 zp6S)gY_}704DU3uE*8)rjjh{Eg>LsHE7-h|$0q8ir7cckU3nbJWK>FfpoDj!-XP!d zcrW0p6410k=vjm&O8KqHmC0@Z%a1SNa2C8+Lk>&Fje+3NZR1jTR z+pbLb_kFo8<;r!A8|%rH-~pHovf6CrD{+nEWxAsF1=y`ZG1b5Q`kT2-OX!Q3Qxw!f zZ?`?RqW5bc)z4|uM;Zy<)s;37pBZ7L5lWOZ{f_$n+TpXSq)1i=vrWJSaPf6%t)2ZX zu*gp5DnO8fGTt9ql1-d4yLbSeMazk6L4t=TWsVhaPI z=^pAJWN+}QRf*jOH2R$%7 zo!`#RCgel%+Pt|1HWG1VAvlQSU*KbaA3rdsKv4;{Hw*383k- ze{eJXT#ePZ41F!x79pevAnX;CWYO^9m{dmA!3!4rTk1BOw7czXs$6i~Nho8#8v_IJ zc@IX#!8<3Vc99QDGyC*j#q|aBy;bAJui{X7qLv2wPFh7|+lY%jNs950(@I7D4q=Fv zh92iB2Su4CemyUCLYhr80PR7#oaNk)ify#-_0i9`@lK?vA)pGdHuXU@vz6MD z`lp@E)B`;}B_(7GglMchCRwIwI2R@}g1!KqNdXb5OX%{fv2`4kr{et&?ZCPxYjBMx zxc;dSTPLDBfF1gDwqcIW_CY!nmya5oyoQ(05(yW5;eI&{o$bAJG?0yh!_?Rq2{D_5 zhlgwFv``_kR)dI3bNW(bqI`ifG$pSXmMfM!$MEnADdbk-SyL)+v8GP?{RCZUWhpLl z|3(nvhIj-b$C}n&6=T5;sS>sgq%PU_lRvO#wdSb5(?Mq%8yZ@5E3{r zz&|4K%rrbAP9Wm3!szx}wB$qMXKQs{&6U|4Zem&q)V4W(wIAGH z0^UI72a5--E+JC%Z^=I@-42-&COFfMh~V{6bwsUx5_|$k*1KeO_#oY=cL;$-h22@A zG1M;Z#@h7-(!G{(sqr+BIM^*SLa%X0?1Dv+Fq{ThkRZ`%9V|C?<=oV#FGS%LI5&KP zfp03lThCe<55{tJ&{G3$wPxPxMZo3sY0=B*s(*ckBCUj8O=evD zO7dxqdH*?^*TwyCQSKIy2j;x|tLMD8sGV_(tHvH_>I~Fok1ox%Jx2}TzY=(?u*#o1 zCNJOyd7trkY{X~X@@rg`Avq!@m`9PCW-$?iTwGpONu#-gyDsWAf}OZOLx?j=Th=!V z89(DF&!`FXv&!2wovzIZv`SCo{lWmW4ZryV^TXl*9m7c} zC_23)9Fcu5<4WO&s+qwY-rG2!9geIhfs+Sx$P-^;!1IoHdvML+dXnEG>ch%?MfW1d zZAAatR+6)4?58`ESJ5YZPz5;Ct`3J+DEsL7MUR!kB>{ zozv^$(xFuClWnUaZNybjl$(HWdPdQbtCX_fn-$r3R!jPFCpl5vuuJkJkgvlfDax5f zw>BSc)hM=V5U|x;RlGs`v%CJzSMf-C#i;rfZNX7ZS@iCvjsi_&8@@R8n3a)aluNQk z_S@DFO-*(-#Yp{mVqQ5TGV4R7f%~aK>PU&ZT!GatEQ!FL9tU~RNYrl+CY1>kX2U zCi@3Vr~r%TY<<@vKKF*cB(SGs7+D=Dju>M9C>Dtba0dL4eT%5?##Ji_p%x(*H^H`y zG_gAo&z46$p@%DE*R?NWUx~_Yl~>Rt;$9KFNP~L|8oYERxir7+aXaX?hE;?$+6&w_ zm)Bu_Im@Xjw%1gn5L&Gi_0Ri8mE^^&A;z3zko^X- zxSjdXB>k1B=U3)ui^O<<$+B8ra$z6N#czQ90)-5DzBc-L zWNUO6te|)9@!Bfe48mQb) z;Gh$la#OR$zB!Fhk3-7dzlQJNQLv&Bd4u^Qr%BCMyC2+7UdJc~sPU(TuJuYwDvHJ+ zlhWzWV8@MWXZHrSS{td$koCjNOar&H{_Q^}`Uiw~14IY#zMqCUFJu(qwr!{mA+I~V z(VqW|DahrA^LNdE@bd2R`yIUo3M((O%PKiEx>N*Z}h}eCC#Ults%D_)6TMvgnZY_&AlOKwH>Q@+ui<~^g282MFsLvhMQtd zpMUfTfBL;D;|3mw2uUNXIwBdmKU!T=Q)yD!Cv&5>Jw-i}-AkRAeF^W!!QvIaKvr}> zVt&U0`)qdq((})kxYDsMg6PKnZx{wGqLRpEe`r=gXXAj+v*FZMI0JX37QmP7J-iPa z*JGX-**PY3-mYy$eO$W&ixo7}{lD36-R#PeE35*%AB#;j`wXwsV>R`y za#b}`Qj zE#{1d2=&;SKY79~7na&g2^^V&9NEz$H85B0R}D35Jf;BSt(>*%Se*CFShfNg%dwZ& ztByCGL_?o3EAD>r5;Mq;4h<;+0Eln~1S!{Xcu1V?=c~Sh#je%)=L1Eup0k?9!r*5T zQ&YCGGFL>31Ac=Y3!>v8eT zh1}1t%gP04sQU}*Cy6At$^j)Esc|4trP+IhUSo4he0NUahDo`8Sv)#xTl~9NQyR1h zI0mI=H?Rc{9oc`(g1)FyMjW8m8rNOzFexXA#*zATu`^o0_Zy5<{z0+J7T+rQ(3WH znC9@#>5`-sG~`#laDF8smSoR?K=yAGMCv=RvKG5!pUjcv8#PZJko{_+PL>@2v07>; zinu$Tf$u*okH)`D)eP)!LGvHD!IX;+c*GAvvKXw(Zb>5O{g@=)(<*2$ErF3q?7bJ1 z5iwZY5zQ8!hxYZwse)s}GOG2yWVU{^!>LZg%gGe|Ga~vtA$cUpNP)}JeBoRqRGByW z(QScHCtYzfl^{Y>wGE>FTC>pQ>v1n>Bu~LlQ72}h)xZHUG_nSqj|zr=>Bn7rc@)H+ zgB@};IXS^O#XsG_I_0YFwkRcMCOnqVQ>bYk&+R*luqOI;i)G!{$O}CB@hc7=@Vysb z=vG6#Xf!mYc%;Q~y;mP~lheOr!7eBv$AK(}_nm}8^cX_AaYZhCwEvY;2$+kD>h6%fgHBy#_wzh7%X`o1ONF!*#h=Y&a2 z3=IeiD+e9ujv|sf4f~dsNI1oO-o9m2{1Zi0OG-o2b9gvvyx72q3=n@<^XnQO&N6m_ z+s8@`nLWB@e67U35R^@AHZWhlOci9dr?=i!&Yl_LY}q21mM#wn znCRr>2eDe!n&MH1Kj4L`g{kg50^S}=Vq=HIEZtu5aIX4f{6>f)8K(7hTPVIPk1)$g zu&$}aHN4@#0TxZ=zxF`+1ec$!<&{+GMiP_I98K5k;g~G7Kx_Dpq~x^_^ne+UTjan} zFbiT_({Qq};xQ}VRySG=)6!vf>c*iE+)1a4h!kRFv-`G!1u#M^N(?Sb?zzMbR%^4w z(Bk8}5f6AFGEp@_3mLi(Hj%hgRXbcOZD3ZQwtQxPT)zDU;V&CL5&Dio=F=Gd`%N!UOa?Qelt);J7Di8Y z259!OSyaGex;&?hIm7R|R`KPqIIi8PX3`%>WrC{+xi-vzb)}@D7n)_lgmGNdWb7Y| zq(lc8y?qq5;|kFGPvWDl32ZIIoxsO#e~oXzx;ttx449WLheg-GY&es<1@FPPyJSU0 z<>RvAFNT#u3$!P#;vw%8d?&(m9oI&)LR<{*f^L@T8#n4K#84e>Drx%c8Y?lFvIfZ( zg?}nO{w;Nyc%ciAk|#c`tpvXv@mw3=@&$uwdiz+AM@M~(37)ULDtaf5hHiG36gTDz zsY27~{5JOZX_~7{W z&09zy1FCAy@Oyis{5`S-l&IPNS&9$DtyhvL3;6 z_;K;1c$A99$!Ej`J+V4zYg}DPdv-;rsQ&pVfVVYRuW)yrLwn5up2qCURK^^rr?_f# zmyTgS6MU27fc@x$*Rk7v40%7554Hl1*f3`^y=JtD3e?^g2T0NR5%KQe`hDGq>F`z0 zo@v%L(;ggUW@~myzcfx=;`+-S;N6&~j(eWDryYeVN)%Hh!Y>Ug9xVB+SsGEUx>EAH zF~*CTqTYa?h9BH8Xli8g`}^J=!Nax#by!#!ac>`0lvqQ@#RWBFiw)1nwGN^4z;{2= z=|&|v?A_eNFDM9c8WExg^@&9FR`)fWCN;8}`mQj)ou_8D&^)epm}_x=a zw;WJU;VxEZZn_c7nYZIP%a{hSQzmwx z{G}QyyMwsc@??ETXmB5wqnmo?(gq83VJ^g?t(am7gy$pryIU@NDHoZKFL3S10?ZR- znUHI+1mne#{`g;IQ7;1feB+|=c7|{MMk%k-bfv`!Y#55Qe=CU;X+MH*hik&4u_#Ds zTtGeYi*xQK0Y0T2+7=panc!>kio1J6`W&V2U83E?p-l)U_xdSprQxRybZ$q4xK!h^ z@{rFwEPX2X*sK57)L*W<*_F`i;}VGYpwSMQ9fima-Pzd1$cO}-sECrSJ6zVNe`zl~ z!T|$iY~ROEn_~V}tKGxR1%kS^zrecbfg-3)z45n+@$@*43Q}_>rZ3L;h*pGc_SFQd zX`o^WJ7y*jg){2e#oqB{`HIOaUQ_Czda@Xp5|GL3>Zeoo&h{0ps9aqG4)& zal|W9>Tj#}`^C~tud~YmdM`kUh6e@yj9YtXWS7mnX70Ij;)A6Qof}J8zdCwIo=Blj zC)XQgJc_~R)Fe>2YeZCo)8Y|}*8C&>MO#Hh1wvifgxBu)v?q9Nrr6gIAJqx-UDtqI z9{GiGEPD$W+@4t&Apiu;^ClZ;{9LhDe&m*J$^9PFfcsLKltuzb^E_34Ga}~IWy3|q z#WQ!>*1#z4M`O?)-<#%7zWK+SGS`?oBJ)K}O{B-WlNbtcL(meN8X7KZJ3ct1ORuYm zUv!}e8_U&4;OEl)Oi==2|9>a4nOQkin@HY?W-1QnPnan2$o~B{%M)k{A!jaTjGSY zgUPsdg$Oz(8jGp_0KDUaCh+pI7ex?V9eH7R!2Y#Crg!~A5<>?3;R6GNPAlL-WIzSv z%n(UX^b(;fdAxY>x_cRfHwYyvR#3U09UO=D{0g6&!BzUMMd~ z^ZHmFL+hE95XW7#cJ|9ew~hJBLFq`;kQf%L>F$89(qo!LMXY_~ymQNDNsKWpj`!c+ z$yI*K@=?6GxWIV(7IS#C(%7jw{Ps52>1w_kfjJNfGC%kBlo5~vvajCCC64<=p#eVA zNc{q!r43I>e_$sjA>vj3$Qr}q%7&3E`-&6R5?map-bt$NtfE}n$D-6M-%ZV7r4_== z>(-d)sWwJW_&GiV4P8U3{IdmAH`7X2R^jOtQ94DZBRLsEkI&Y)zYoI&8#+L`6WRZ& z74WJFg;dSTa*9wgsfiv!Zc3EBh2RUt=;ba0>gPm1R4KZ zficFG%+H|(Hgv(bGZaJ`4 z0ySUaR#*wW)yJVprFiurnRjIHXz)i`%lp3Mv$E3CVLse|0MscVfzw?S8WT3fvs$|e z2Xu)8&DUf#mXN%Y)CPGZ9d$h$HA(Qqbuu5)=bOxt91(czuk29lT|;@Z5yrsI)Q*rK z;FY9301a73*I=NZg^X~{w?`;M(v5rn^YO!UQ^a{x8HZSwbgPW`(vbrELPTRy69N~H z9oYXMgR-LIwzl&f{j>Mei61Uw1}EB%KVq%11UmOXsHvb)9?v87U9G{_9pBq;a&PLN zA3xqaUi%TqH=gv0z}ykHi445ZZ@!anb|pXpa!3TAjPknk;%smuJ!yXsg`90k01*zZ zuO92*9f$;}5el?9CPzobA@W*>Bl?@#SQI?-WavQ9)&k24vzf|Hl5ky|OF6_+U?nbkURve63uU~`>=Wywf7E2a*QLu=6PonF9` zFB-sYO@|{f@{dPO2rB1ob(SEGpJ1M;Ru=f#F%m1Kcf>=#c^10&rmaBvH2pw@7JW^= z+jRO=^#qlAPm6=iRR65ZcqoY<(I--9YQCL62W>mUXsL7M*xs(_yt#=*j2(V2<>g^L z>+52O?Vl<_5AjUDy;Iq<}I#PSio- zvKmpM`Bt|xk_$hE>36sKX?k4cFzWXf96Pm#pubSL3QpiL0OB9_?b6mn?A2xDwOeqL z;p+_@V9ijh_Du(18b64jnjrS&YdV_)t|}ESM3TE0f_s8yDTBqy+r|;~7rrOZ*YhLX5oTuo@eSDzGhtR0{kxK6!kRWq-5o$n3an zE5n^(McY(N3-KH#asK?b!d-0-V47npD0oBJSmz2a)fF z@_rKSZHQVe+sX2OzUrNXui!2D$1_GD+U-t1sya-b07G32udvhaCkodRIsD8;sn_HM zmcuNvG>{Syw!~AoqBknxViXcU?+MDWzL5nXn!f*H0A`K`QlCC(l&k?_?&6Zq_RIjM z@V3E5wuTIzzgpkiibM%54F}r{)eW%pFc9N_uC=-gN_&>_HeDV)F@MZVsL5&!*>~XW zHAJ!=It3%v-;{lG>SgWcF=i<>n;XN)XMZWz$H4hz(ox?MN4>n-zoFf?&~2q|Z=Tvs zrgFIQ=p$I~>q5&zOidznloQfcqf7G0xIvfqU!F;=4WQT+pnvv<m?6>hUQmF(%~p!-F`2wjIZ!vc_XkL_13QLsNlermMXfVy(sLu zC`#7yzsm`w-)wzZVTJAcmFR4}Yw!E?{BE6wf{1_TbgCk#1$@A2MELP96vyuDEyQWC zEdi#UafgXpa{Y62%f{>EN;cw(Rt|eF>skvvR6&1Bo#isZX+DS`1aw9Wv+r6J>j}4xHJGs>0Ni31=4m-m&=D^E9`8U z7p%IG$SI1E6lI~PGs^yxO@v>FdKVOJGt^&v^;HvOQ7Xx6T_iiPnGmBy4*J=*`3(yT z%M|e!Ne%x!O1#PIr=syd$T4#!=R@_X4{Rn%Yi80MneF);GO)DcnCaa@NhgcKwYNT+ zu@kL%Cb4^1I?a+Teu%_PXq@TvRJHu1N8@O#${Y(p!51Yl^*;m!1KB;_(Z-bbqLw>~ z0wV1x;|c?;AKr|jvwxS@0$v1lM$`98f=fV!8(r1U=%?L#f`uDCo~BGW2E+iH4;|He z$XT1!xdIu1w*!`puzJNxJn;?n#Kk_XzQAsHKZf)@*K5aA?}VHRh_E{}q&>hpW69>} zksNJG85e)2PZ@*O@PI&S(CJH7e7JYY%rwkG(nnjBB-#IZ*odx2Q@gA>o~>`t$gE;< z*>JG-X_5=es zW0RWDmV7IxM$qNtO~$2lM-9Jj_>9l}esA2M>CPfzo~PUyZlr^6s?LbUJ7_*xH*Y%N zC~5cpN-&MYYI#dDo9DKI3#zoyrX{14T-WYpe#;o$JvH^N>0;tJaESe$At~7dd9Gu9 z-D7Oe8(HEm-D1`6;qJh(6ZNFiLgL;bfMynYXyF-*e9t}m2h};qpdfSrYf}c*?V7dn z7^AZ<6Cp2x=ivEZB{(=*7~x_rvy=l|1PZI|?kkY1 z-&s?hym)edBOzs`8#VK_4V5!e-M-;F$*l@*DR2ExP4(as>=r^k^!F|XztDXqroT@s z_gElQNaovg!+*6mkOsG^A$q?jtL-hO*~%O8sbsXwL#4JS}r0{ZCwj`T|d%#H7O2JL*>-(U?t<@ODB<9ci#%>WTc(d`Lg{ zFQn_VHX~gv<-blBpaj4^3cohi?|6;k%?ROXr^Y5kId%KU!~?Q%lsoCK{Yr3Lp#x~PpE#j>p(wk6a`j<=gpyrWl77^zstHKRhST_5 zs+ZYJW0eR2lVQEd_AOYtjS;IZv#g)VLyvVxvRb!wZTXzvF#WzRgM>_=KpHA#`-`|0c2&vtFjO{bqpN9s}9$7hE8 zWi=Sjb`iDmayq@bc<2z<R`HbV#!+=!Z$Z8bAlazhm?2oSS2je_`X7~h=Y`9n`nTKYyy zT3i3R@^x008_vNnkKgD?B6nRD+=seo?I>4%XlSVEW<7j-&lTZCG`Z>O0=geBh3)Mj zN_PZgEd~BjZXBMgBQ{PKa0}djBBKHTE4Efh2rkk;>%(ilodQY}giSj6pTG!*??Nl4 z5srz8rzOJXq$S_ z?j6S=+o1!qK9{WKseAzw9_IZ{FnVjI5|bR6?T_85rp~WZWq@?z)?E18k@VBN%vLJ1 z^HDX$fWD(a6cCOXvzP%YqcAhe6#iaT`pM7&-*|vV^4C*cRaL-u)JyX0&zBRyy4e|a zmWlHvQ`5YdbEOlpb`_7Zu&_WM+yS@emf%w5aHuTQ)aQgX=u*Q>?4U!uq_xfRm2`eB zb9gx%xfqr`3udc}cIZUU9s|!98v?JFtu5!3I~@FXsx;y1Vm?cIGnlOx()Th-mNcs} ztB+8?EA);(s_&uzQ-x1E>HalQ&do~Z6x67z`~bYz;&4Q8vkMW%77I9?3V9sR#U*5t z1?M*Z5&hkFdtJeOP%Fh%?qPq)O_s}5^T@mxO+7^bVawA8@YvYK{6rG9F|=^azQtH# z^kpCF0Ay{2UvfFiSw@S7MFhkjMlq)B`7Bdz2mTTF8tK%=Vt4^cIjTYRe`!YISbi}= zdFBxlfqqC?jS?_ zqH;Q+-ATy z%bWs}{+$iVue39#rS^V4cW1TBlzy?{8P~ZW{{-i$SN#FRV#D z^T-$bgJWPx4wczIF3?;?q`*@)hFsMHI%6uZwzaL&YpTL*8$9y!Gm7k9)ck=_-h4fx z%GMKuUR~H-Uwu9&;m3zN$F6uOKDkh&xi4;Y*Yj#HcB;%``=X>7oA~%Jo*>R{aJm6;|JRDo(*#6 zH@&}Js4h_4D1Dl$ER+4*@W7W%gpH(=gG~%uHcTzqki9DE5@ zGaNdqEM-iGucNtKbAD>Y@?meSZG{iBP}ldgL=&|#^+W=p^oQr-2v zKmN|zs&ppvvkX8-6k-^3y$sMRr_a1UC~cnhLO&5$eH71g0nY;3$#2v)X79N{_(mXs zKVd4%9v_b{S5rDQFQpoR1>OSv4Fvl=7O{((j}Yd`v?6DO= zZW$Ws{?gJRAl+SpbRz`sNW;7S-g=0vk#?K zNk?j1AX4z+>ngIZu~@loZBs(~T+V@ycIoHFE;}SeI4A%|ecX!*Xe`f6Tp&Acj(S=* zeFQ^H#xs!LU!46(?=A};h}f^?99(|>n2r8}eTOSB8=LMj!Plxy$MRj_`_|l+bTQsi zK`;9D**C~YZ95tbeC2h@9nDMZx(zC$8lq!2#!cx#DY#<-4yxa_pk|gW&c0 zf;$T~OQ&XeyH~vB|9zr0{1!)6G#*=HH^XI^qTX35-|ZiiZmdHh2a>?KPCjjjNL3+2 zyH7qPQ`^Lsr>9=%Q|`QC(CN5d#=0s*E=yY%nRQ+|D$-hwOu4kf>%)x`=j#dbmQv)! zXy%1+BU#74Hr~Gui)iWml92nw$1a#*U&xQ|X9UJpDOBf3{{0c$W~63 z7@J%2s&I+9a4qPx;(y~sdXLDLlw45Y z+f6TY-cg@uL*R{uT~TzJn%{_S=<>w&zdb|j_Jz=3@|$>P?}=?*m>hOf>tRv34;YMu z|7Rfl!up$=OxiPu#VCK6}IK6M-=Z9Kb z>(3+F%C+@VNpmpJ*vI&_0GwqsaBf+2&!G0d|Kx$zz|efnCMFrBvWc+QaSQFp$l;!c zm*wu5BQS;dytZ~#_Vwy#CBrf!v=q1cPe|d2?;3xkx0#jH^w^Ob^l%c^*~N0jjO|J$@b3x z*e#LVrZDw(jo>w!sWMiXQ*w2wS!!WnzZ)iCNZO$w9iDNHi(}YTX(Cp~Po65$=J;zFU8^S+qqs5+`0CpmEKb0w1*L1 zkkj}{P{hZhO25A}Zj52SHFt9cOZa(rVbg79+gdj$_|8j9A9P7%e?Z`SVba#?84Zq_ z=O%6Po^_I7ir?BrW_6BwZ{?}knST2D`U*?(M(|xTJ zkW({AxkbO&t7VjhCvyxIiH~>pf#nBuYzK!=UURG!sV^=Yx3q5M9+U%+?6dK<$P-^>2%u(iq3y|8# zr0Un>s46ltN}{xTS1R#N0yJ7Bqtgh{DK3*v{FU$}fg&WJ*u_=MjMvocSD(vz-RP)5 z6B!_;ko$hEY(LaWd$djx$(S!UeAu0S=C=h-)IJ@Iud0v&FNND12)tTzh4OQntq7)= zcThx>wK?DmAayeZsO@x4-mYibdk&YJdDX(dN=;8sUr$7ehkLgl8iPWVIh#>iy^gzk zdr=!4mp&I88yW)6qDK7E|LZZmUj8QV^ZC;1bs8XZYns>xCUJ~xo`xu1XMYFWfavo@ zXx8&JEsZ9Cidm>&Dxyx}&9mt}PZsi*zgc7>BH67=@s%TR6AM@--q&kRxn9H+0pj+F%p1gbnW!Kygo*g?RNsNn@02; zzBzl+*c&F(L(O%JiwtR5~j^G<0v2Qxjs$M&(U@ z_*5Qh>nsBlQ%R{jQ0McAEOal};I9v}&sAFv&;X)(U=tBZNr{)GMFD(yc{1b6k7sK@ zI{p{4=H|G~yav|Qpp;qSJsmbJktOtH+^c_~`flg@o(D~DZ!gA}s56zGi7&0!QPXo# zZyKPf=l_DUX^s6~#+bT z_~Xc0`0iPvZN7A4{4!cOHDtJvc7KwtJS+r4bIQq5RT%s56J__FU~LhcQ6>qKU&xW! zJ~L}dnb8rAW}gtu&ZP8?{v1My1=82?@u_Q`3aa=tGv>N$$FdrIrUm*A zTYRp6AV#&+M@aWx5B_-xgU%Sc(#ApOc!TfsH|8KMeAuDf145^paUuKN%HcJ-XWy|= zJ;Ra+#3P1K24yk;k&N}V4MR6J%n z38y8=Pj;V^Zc!{`Ou(=JalXy-Bb~^=-*>DBOVY;7z0pCcwKdoHO{dwT+@j@qcBpLcHE|IGx7dr|Mi~;S8=^6&G)kT zyndKMCM7>F-Y)}HH_g6Kw9q)C7>(2}I|Z;}?XY%ku!ape&+v!Ef8^9`;lfbT68(X? zn1GfY5u|3lGd_3S2M|F`RmP%h{mVH=}S)!I&Ak)bjt&J_)0N!5u*y%a?Cx&`&|Tm%_xele z)6bXCt=HM|>gPcX_2J<2&gH)6%U3=0tZso#dI)I#W!bP$8q<8!!>Vc~azKmp8 zZ^|N58nnN2++e@xmujF_B)#=!F2vr~R|f}X|8d=4vv|Pe-bK1jZPrL`UVv&l)Gt8Zq~a}*#) zepFjEg#BM*%Z;|LT{iNh`)(Lp5zWY+=5vJ{4$aMdQNFQpj=&H8Gf(%9lDTWMLAb~S z`(QDb7&+gzq&Bw-0RtuJl)NRN4+T9`ND}*K@1N(#lpu!a!vTqecOcs zp7GClID~P}`3_gM?v%mA`RG`Z;*|Y%tB(fJoa4yb<*mz^c>Q_a#e#w^q0^c;l73tz z3k5Zxcrt~rv_3ni5=b>0~#CYN7v@f;1_wpC8U z+{SezohIN7vk0x6P;!eD6Tfxh_r83T8#(V8iYmaaH}WY z*(7!!oo0KfIQk-Lp&ts2AUkVqG=}M^Z_>}356FE1$&P(Lt+hJrTDH{-BFx z_MKfHMI;VACB;*AicLe+84WfS(vNe?c^HRv>x;JkLT|A_g=(oa_Sf@D_4SzuBoN(a z_lJUPiD++7Q?j{;uSd?d1W{ZBaLfd#qzFFEiN_PGJELnDwR7ZeumKgo{ExUaBdQ;t z-gxn$gMRgZop4VpCPZ68?9or-BETMhjE7EmHKu&y3E zk=xNNA^Fa)SV{F^ZP{7Jji?H%h98E$s!%Zb=2*5hGt%OE@~V^UJHDQ`!uR&;adSD*mX_Yt0Q-o;!h&ncsO`NKC zjM!8QynDb#%$Ipnpd&<_KZ-x!G&s@tl@;Po7G!kgQaR~yy8?`ECQ3>w@O^lHOosHM zpm~<8gSb|+KX|_fO;i&*|Bqg#HFg*~A(u1ckFYsj}|{$wtl*3HV6B@;z|cB{lUM+ z5q(Iv%Yerl`HhR|&e(wRz1Q)F46O+;0?V+`IP6=(k=-WlbGa@1`2W&cn3pMZdE$5U z)^ZMM9=s;zCAT+Q(pFK#`Eow&8aKn-s!)w2DkG{<_ODWN+$&tc@y}RZ&IP{$EIucq zLU|9*a2E0I9p%Y|NnQWE-Hnd5cFXzJiF*~n9g)ubI3dUh3Yk`y5L;1KQ861xpazBn zdoC{c|8?Z*>cVesd|~T~>VWVfY(~HC|7ihG0Q+Aa2?+_wXy8DZ$OjG-kJmZ<@HOrN z^pkt(e}i-1&SF+HHoNla|IyL!Uw296SDBt2^bh9$Dq^6=Q{ zH#!>LD{XPD=E`H;d~YEtF(z&k#B=TmWBWyu&-{5p=KJliO>&O5$4iEcT$;WHN1a>a z)>#0P;}a93akgKu94*!-^z{+#=1F|O5B32@aG}7}Z!X#0PFq-STSro{5G^kGL6PKX zb-I{FADtIAP8%ADs(f|6j49H;xf!nN>eKx}YkO05gl|XCt`V)C` zV_dhW?;qsgm9|>sI`ytG0Sw`Yl*P&fqu8FVA z-SER{hDaJ}G!w1fp6{Ks1phW^4XXFMQef_NjQ@Mvp@}eVr73%_H^W)6TBWOVB4z8a zon!7`HfytXAnf?Ov@F+?HSX|5gb|N0Ww^~GmPYkd0*u4rdh|OtVSU*&#sZj|EHvc! zu^BOq$2lg-E1japnIQ3H>o@^D$<+ZgE&9%wiaeMXeQR9|yQyZc%m1$#U7$&SWV|BA z4cWVNA6Z7FHe#QUzCmFO7?#3AF%_l1;Do5+equ_x;MVE(e!Z|ueylPVxwQStv372r z5DN*1Q)glPs{iT>!}Fjc^6hANEv7Dtqr*3^Q+?B)Wve3j3f@M@^%#Ef)VTgP#!=$8Nc9LI1>Eg3=yrFlcP$IHeM zI;K?;PN~>)JR5pMp`M$`>4}St;E+sxCM*Ad=R+etYlKV71upPa^V;nGOYj0Cs+MBe z5}q=myM?n&TodJ^hY1e z8*BK~j~3wvhm>??i)&%E7cW|S$02vxq(K}^sNup+T29NWsp5@PjUv19_W0OMo3L<= zuc0m*;QnsqHRqi znXO)}_PHrVZFp7|tj6GbN;PiJUy*2pZLXW>sYC&@3jxj z`ML3@k)EdWF(yER!cT#F@&ubZ`|{r*&c#7fN>Sj;>&)MwyGE)Wx3i zx}j!n*c2w5%Mre%GnqQqGiAancu8TBde-b1{*CUzL;=ljC1{-(=T`B%wsgCRx|f|z z%FqyJni5)tF81g<;(9~ew~bDKK#mHq7UmHU`1l?eY%Tlf*Dh|W!*@e(JxX2$AE~+@ zkSeP&+*(F=5-Ah0W#T2zwn7a{HR5c0G(&^ugw0wC3?2=bB#dpWOO+)nGG|)35ygND z%=1Uqu)ERFjIuW4726^P?!A1c5BuO!fdr?oGEGRK=P-K zXa1W9X95qD)HHiwrTrvFRV5BEMno;v;uK*vfA^03(vLDti6%?1*()Qj@tgL}5Lpg1 zf6utXPBy$Q2Tm2)#b9G3z})?j6mNZLRU8WrNb;kiqo+05;u!}RfBpJZXp$%Yoj<(d zZ7{Fh$I&c=eEXxYw9F4OfsYDwq66U=baEDxQr&$?IKmL8#Yv2xGO=Rh9y*3l_EwDe z%?$x5mrHP8V4fj5D?3mniAyN75%lGR5#lF zl^=P}CgT{X44z7HkQ2_hm`L~ly@E({xKYx@Z3qEjm;f^)7x|=SDkhP1SX^qIplrbt z6g>mx=je!Y2l*K^`=)SHjOaU&87s6j^MAc@Z^orSo!JcJ3J zy;8^!_#i*sH+j|PrIB?Lh^JA(SIpo)mIde``9WfgsAHw3nFpDmzc}~kj(a-{VHlsg zbL4WGY@sVN%b$N23yl*n*1E!mVu!$=bTQDP_3*Jf--;(t{${OM5saq1I>>igIZOm~ zAx&(>@!>AHhcG;u9jHdTq`R6yx0pT!76GRYQpIw z?~g7RoeC`&IR9y_!SR>C(zE@0;otd$mTEz)llDpv+JMz`OAV6)QvanIlJ&6wPr?cRm7l@A5Qt3?E0hKT|Z5&YBJ=p7wlW=M?Gp+grkU< z(q;P>+0#5??NOsyk!ODpUM`DvoU`*8ZxO2MTm`zKKMn@ZW40F5Gd%L&jN`xh!U*s5 zQ`;xigS&}coh?u5*ztdzevzHH-J&{f%`s@t2VL53-eWwJFu22<7?XD&^3#I{V>gOh zPdzK$*9eg4Y~2lDBu!hnOevh)B&sMKV+}i^|%fCypCl9U3{+GZfa#O@>i>4b!6^P6tZ>CFC;T^IvvjDfEZoQxz$S)!b zL=7-iQe=wWg|U*R1Ag-OFut&f5FoxVdHd+bb)E* zjcr@1@rHw$W!N(BHhW79z3QV?ddkYo_s|l~K63^pNG5wMkAAH1F@Xj?zvYkN(kF7 ziYa`|Wt{ZV(i^-k7l1wPfGyL zz<(j(_fqg7-FdCPN({2?2FBdOg%gXTx)6vJBVqxuI*O_`q1GUGcM$m`pP()FkZc$= zb<6LC&s4H1zWY&X3-pR-DG#dPwXW{Z^{T0n1TC^oE5u zAmtO^YMIL89dgA;&hk$-3p$8N;Z@E)`vKQYzxjs5o+8{Ou)|VcCh@cA-{xXX0ye07(ZQ!we>?rY&wThiK9ql8d# zXxz>CHdj;Th$*~_ETnnt`ecA?PxeGIYY`vp$xc{}E zmKeM#v1LKMZ6KbI6wtxv`+E2mp7L}%(!LY-(5x0Qw;dR6Eq%>XY+P5Gnsggws)f;Xqnrit=O^`dzh2)Y zA;z^x;}~DxBAkmJwdWoElzIF$aV z3?ntE`UkLU=i3$tufB`|tH_YT9)lKFPK`TdGbAkPVtR+3%8M-t63+~$2GQEy&02vt zB{)n?mIl8Vr}rHK%V2l?&I~(bZfbT>6l=?K59`|rG?`RrtKcSe^M~M6?2K=0uJxrL z=1!$no@PnpJ7;6$6J0dd)784bi?!RL`_AYm{2HQtoz%(~EhqAv`gWsvKnBl_nzH5B zsG8GcdG_z*;7lh@>6)J>15Ok^w=TA%Qrd@ud>ws`6zWu$6y=?+HO6%8DhXj+vyuEu z;mPgjh0bmUZ)e&%icG5%Mdp|F87z^u*V-PR(?ju6v1R9Lr6O}njdy`3Yg9ZEH8}WE z|Clkw8UB(b8iGz6Kvq1p0Q40lq}zjNrK`|zek5pQkTvxx;GEv{m`Lzod9T6nWS?-vH~Rg+Y|{3@ zwYGCLsrE-mxM*daH<+ghnZV~r0L}iY+ue7{9;l2n6wn5yOs=QTivMeui_;{=PahKB zG;r7_$(ZiO@nFzhWU9~jFtufdn$Hc>1tF;6mm*=B>9bn_D{}pILMztepqRa+$a4j5 zRC*%v9=cenZLNBi{mC)fj zORM}y2tk_|g&`(t$e|`SBj&$DzT$h7Yhb@YEKHVtpz*hb!&i;h6SfW9$yjMUnRu6 z=_B+&q>i+qQ}vqM3D93#2pvJ$cUlu;9W+v)vvE`TKr5k06FmpHAsM{O=a;(66sAs} zgO=w>T$~B!!k^ukvaeFn*WX+ng8~okqJ=>3DJkhswduB*a?uw*;Z=Vc3s&By_azRA zR#e^U>mH_1xJ_elb`fm}*uFbD*vF*cky5HJy&Ia2uTy=7KGe>;H+u6|NX zlW((}e(@#a{F8WZIEYob&DhoG5qjtxN&u0);x{ur9DW^JEiPVeXbb_dq`S}mv_{=V z5_lm@;IqIa*Wrov(e3q%k`fZ_4)%bu1m&rtlGkzG?Qbv36u;QnGvuc?WeEl&TT*t? zb3L=R#@&D1?_1Wku+jL#l3=8)tJc?-1-%9ZHYzAd{PN#n^k~&KuizDYnOkNo@gHBl zh2-XQT-vmMBuEM~Emg|I))pK$hJMvU?;TI*rmdY*_2o37;01F03?op$FEu#IROrgo z=*xc90Q@Fiy|1TWW@gs-t_`iQV181&8Pe;-mbf_p+;k|)q~6g289vU+g-BVBTX<-@ z`w+hY^bA@t5Y6ds+Dxb}cE9ld>h~$-Pqd-r6mNF-G%o;i5=n+;1P01Ft&EpREa9B|Gk=-fdDns`qw*L?3+XBau@{|i8n z^BNr6=O@$jSn1p=zMP_CuU#Lh)8yczQI)OFHKDbE-UYw;0XrQ3TZdgL_JK)YL$(mWK>C4-&}JL zOto>vp0X~j_3E{qG^Duk^>X-ln25pcr(Vl^v9Xa1GLQ+LI3Wp?Ik%MT@k$mY_fDU5 zY8AzNNmw0K>MfJ6DucoMc;CpFQk-yz#a+$tHVw>=#c}|{Cy1Xw#+$CfC zWP59M`%?GsTNJ3SAx%SqO)Poxxt?gJ!okew+y;`f-`(Ou+uS?SJy0I`xW}))zyKe7;n)@9hK_qqXstA?&Irmr9MW@W}kfb8G$*HhW6e*C^hTf-WeGf+jUA1QX z|5Y3sY-s?~7Xfg8aq;o%%kJZEY8R;Leq`Q@TK!q5>I!bTcMsFGtRJ+)Uv|^ApHQ;m zB~uiw<48@F{fDH<$(z^YU&zz6J5R9v%bJ;1DEUh!vf}A7ZrakT@l!`DQ^rDBt5UT$ z7R$c7q+pP{`yF_`*T1X5(RtwSac691=A8!T6AD{eEMO@UslnNaa(O$)Dlud_tRL=e z$3DIw{7Q}wPWfMbtQr^{wcIK{qziLFaiHI%cRzxa3mkO*OkJ|yTG&jNlCNI8K-4sr z=M(Oj1MD3^B=8|iQb-r3?@&&XGX*1$s&*Ar<;N&Rh-9Bn+wl(;9}b2PHG&T-;G6k) z8~r+!0vU{JQJ?t2Cs@ibsi$n}UP9nkn5@cigGiN-JI?zibB2l|oXrNX(bFzc>g*PG zq9Nv`YrRxc?8G_7oN3%RbPU*B7Ao8i(*4VaFNzE`4!@GCrs|x8ndOBlD)93R4b0D9 z*2jGpj5Cmy=CAgkiZO6;YPN*bT>;oamd(kTLDbavNk}eNx${>aBPO^z`|HXJgaT>< zBsK1?i9-dolb9l8|2Fr%)D|kFu{L8j*+aR478T{?e7hxH?%1CIm!=5i(D`048 zz9}cbpb}OXVVzzOejbaC;@ej9GE&@f8H5M>Ysvo2TgztiTzO>_%YrfYGYe{Ad{>0K zTgIQczDN0%>&WrS9x>DN-mf>lv0`_x=bseN@sI5bHMp;TKh@KKTqegGtDlmsQBCZp z7KNT~?Oy$6%E>4y*o+wqk?0IUJB3|$?Ds*%G2(l^tT_-Od#2 zEiQMv8#j_WuHc(y+H;uW`Vg2%{-pIRpfAP%K8$C|%&oM9Nl?{s99kM8yqwVMDD%K6 z+#(ecuy9EmhWI>(a&fG@=&0{YU#%uDGR%}raJoeGPwDbZzs{1RUAJG_;BX#`1Hm$ zNBa9*`p|!AH-tc)D9@QbS5GfBI49q_jV^}n*Z$Lmrfui<;V;2I*c0RKif^|kOMF!P zrWjF~J+Z!r&KdqZT&06~NzQ%>Q2B5l{Bh`q3PqAVGxXJq3;z72a4|2Q=8z==q(QV1 z+}_bCENBZQKivovb60p`pJ|1pW!QEj2Qq4fZp0I{^1mcnp$oL)^Qh8XdT@n6Ag`nO zWFO9NGw=Vg_rHJtUi&n=yZP1E4#g|(+`d?aA1I-KAim7=RyhdXD zJ$W1t(`ERFpBagXQYrstNG9@NV2F`lAAbLySYQ|k8Qvbv$nfE7aBRi37S15#Ej)b(SbbrO@nVBt<#a8nQ<^>CTf|5h}D-Lul&H zmt-H!hvlq4R<~s1f+lH@$X+x?j!+*j5Kc z>8?pQ8iG?E8ym5vdrvTh;jZHe3t|zwq>-)GhZ@63ixesH%RpJEX1n6wLMsWMUi~#P zBXR>n+?hKPK{yOugQ@3bp%d7lqSC#z#dLv2ZOjU=-C{Ty)X^69a^*SI>81kaa8Jm( zaVhID!J)M*Is^LmZmhcj%^VJ@NIpyRuCe0y6Wb7ITl0iTXx2hmo#Vfg?3v{3?;#5r_|p zY`Qav10~R=E#Eq67<55vSPgAhm;+)@@oBU9GqN7=RB|TOy=UJ=w z$Ps`{HU|6{8No`a{Pjsj*GtZXDbV|3)hI(`h-hsa`=kVEBY6e-t2IUY+;6)ZJev7o zCT^x%LuiUOGQVj;tTl2y>zpb`X+GwA9A?_o4}>Tf+neRi8Na3>_PAJN<%rK6&7dN? zjGk7vVdnW_8Lr$3`NPNk%bHqQH>Ng)qi(gf?j~{b@Uq~sVb3#ZkL8eQtW0%0WTlXh ztS$XMBZTfyiZd@Xa40e{)yx^~XaAvA(;l7d3`UUS;O(Jh>%9Aia?8B0x7c=})7;G= z=hklE&M>^?+q8CpK`~+;M$TQ<6q!BxxJ_OWYSuX*4!hHoia%sIcaV#EpB#aEU%q^) zSvJFq3{3$p14AYJSwPjPUTDNwsQ;<}c-Q)#KWU3&*ryVNiu^eu5m|53`EKHUIdtI+ z&S9g9XBe#lWynMiOMS~0rfViJIQjAl*YM-NSWH#rkRf=PFiS=pidEhmG1VP}eY?99;WZa3p|szj8)-PhcHMMZU+9fCY{QzN$#F3wj=i31 zrmS2aRwtQEaOWrT3MI}mx&}D*#OYnr2|BRp!3xyA0~LFN4+&!AgC{x~86n3v`dmX* zWgCh&DZvy&AtSpD#MC}*3O>&cnV|Oj)2?4o%YTNDLtmN6%3CHKO$lOG^N?9>y)sFS zTN3^x=odEhp5a(gl210JZpqI0~aL;F@>o;sCdU9|zn!=nWaaRc?NpT9uhllU3 zRwok99x(p_tftKuJO z+_PVtpTn7|Tmvt^I(xZn3yfPlg>njZyy$L!s>37APVdQW7cpu)CU3hkE@XN9pnTQ$ zWP@qByLDRJ$-b6*_xbE@DK9=z$;{f$iG&Lx`n19B+g|<+k@0`=IWf@l{(a z5V6Qp*xbiA;t9KVu`fZr$1B9lt28%weGjaehIUQ|zNYu>NrEW|vcSX?@p46te1AKJ z$v>mcpYLQ*j%r`rJLbElA1&`vKXD?GF!DRSaU5bsf|-L(^?&u{;##egwiw`kIdAOl z-@g`9y4ziAe>K>+?B9klP~S$HskgNf)+<)^itd>QYl=@m)T+636ah*|5@Qh_00dLj zlyZz;ld5-^!#F|o;WyqySFY^0L+uxa%p}~`&S3TxLAnWS$El6Mp~3}`CKJ2&{Uj& z@NSd{Ugd8Nc{7Mcr3bUO<8ozB#!e{NVjs`n-~`&pYR|sU9X8z~M}W?G5Gf#*RqD0@ zCQH$gO6;D9{FiN{wHyr~ATM}z(Z~^4n#ct}0 zNfU5N^DOrKn|1?0IInikR_NtVUSok`N3*IV|23Toi79L9=$n+yQG%2x64;@lj!{Q& zT4VUhUg(6+keo)lyAe*V!zWajEqgB-YgnQZhLkMAH{?%c45yYjB^b@j4B|wgDYY1q zXgC21T;vpl@=jY7+q|Z2o*kdUSyjNad?+^Z#dnakfz*3TP}A7tkEBbu60&bAHdl4& z{68(g&5<$6DRfD|CE`EuLPiGsK`~0`XKF53U_q4&x@vySKv3j_vsSZiJpAc)mqmRj zxVVO`+fv0N%_D`jb#mtRT%Q2a7%Iw4FOI!bw?2rfHOn3T%}mvyyx}+_&J0vb73Rdy z5!Bzi1=6$ej*~_Wj*~9WGbfmUlP&Vt-zcPUf^Q2t%Mzodj*4=JG;xlFVbEQbba*?4 z+#)A4{dEu}SPsMoHglXh7p~+FiT(3t5AB{|N+4c%LiDk_kX#p(sj{evng16v zG)v;4kT785zYzevN|LcLJ4Pu}l0la0Wu+A${WzBW8B42uX~ZW1r`>*Gkx#xHptV!; zSnRP8^VPYz^{;`{zo=d0nH+pv!yDUt$((&_uV~JP#yQtp9GwPsMOVZ>Ty@yvcHB2# zHX-K{*G{T_&ZUxR@EaRf==(G_SCK-J*T1RQGpYKw)E`Sg3vWkGG4hZg$Z+>MS- zde+G3fC7eKzRVD7jCrr|hYZ5N3!yM6Kc~EESXRioN;O%5A7rDrZ>DT z4|{<=lh;fCW2scbbm>yN6uo4-71>Blf~zssCh{-!agnE`!Q$r@N&j#&66JX+<%i>H z@Mo|J`tq|_dw|OQIyoN;JlpU%Y`*1^L$SQM`9auYk9&CgoQKby7Wm*6@#TA8pE$rX z-}J?cOO69f!Kl)`S-X@fobox5H_1iDPHrv!UC%SMUDuc9KU)KEw~Noyy@px%jhYX?XZt{tA%50lw|ImoYqW`9}v-=YT-G#-LsZCs0@O zc*8BmS2$Pvtnr-Nc@tOfdfpr@WIyG7b-Vh6i{)t zvqXA7_H)lxc`KPVjvf~UAP@+Dd(lFaEk&%b=~{ zZ8U6xD{ohc+04N1aXK8d|HPYjdY>Wp>eO9BSnuFQuL}DTX3I)lh3*>!zW0kCaW1px z%$oBEF-_$7Pal2#wd!nq`Q{7hsnGH(#<)af(6S~5Nqj&0#Cx$YrR`1zM#(|LsRAt# z+W7v)f7e#(S=Z*We+ruO%BYE@+e`^%^5=^YL~-^!Q^!Cf;yi0oH(X$}CFl!!B-!6{Apnnpy& zGtA&n{b+_(6p>f*>ka`X#7|h3^XJC~FZg7?BbYUdBxA6)Asa}uhkkE4 zFhmlCm99QVOb;dSPRip0Mi@E(fe3Vt3;K=sK?9y3V$WubTPTEQ@95nA;L7uO=VRM*sIgN7yr26H3Ms4fg#xDM z;mTaYmOz=lgSYpmszWTGDPCvy3KKm78OXNRf2qcR!L5P&T)tc2EM_FuyZvQ&NK-i~ zD(PudmjpA@X+Zf1`n@KaA*pKq#BFo)z>)?Tc^1&<}nciGU=@Y0( z^irPZ^u#qi(RwN@?Y=qaMqHjvA*=OT@N|rD^6pbxj#|f%04sbdkV0ep%Fg^&oYB2J zo7vGgtt55%{92Jgw1|*kN;Z|sBhNS*meepSO0%C{vI@%)L@yrYX!)c21zkA7L;^Xl z#^8D87c=LXP3ljP#Q#$*^?D;mX^L0#+1Uf{HgQ+Q!snUxqHWLoy@Da=(Kbva0S9RW9}SB0^Vz{8@>GGk(zc{wL|?d!kPx5+9?Z@e53zNQVn6Dl-+}hqBD1 zr}cH|CZ@if+5Z@Og}U%p6x*9L0dw>-e+79hf^Qii6NhtDlD3_Z6lCr!A!ThVe6WLgFqX1`AfML`p!?9b*5#MfbjZ?Iz*> zP_)UOMaxJvCU-E5bDo+-zry6BoF(l%ao5zk{G=@`M$VG!W9?VtlO>OFo7q??C)BTC zV}uE@WHkiLkyCx=$J6FT&@#OHXDr{R9I~c}j>FGwOW8%q&}aJtcQE_2@x=L<5;)A0 z0=IJSlz$!BdrDbx8kc8Jx9fvDYuE1#tq^urO`4Fi@$JCDhgRF`;|~5b_rZ94;8T=E z&K=VQvfw+Dk>rp^CAFom--fdzV%SY$259`DHo46tH+JnxHvoSdjKz0X4#B4K1eJ`XzU&$qB&0?n26!0k@C~@X0}nzON8{W zfouyYWHNRo-ZR20)*LPyB8J64M;y8|+bj1#X2#nkn)FBvi5?O~%DLptXyNGh9lrxq zD>$2KT$Wqk;xHax-C&&Tq3v@a$K3J48-LT{hSn(xH>*WPA1=CjzL}d5SP)PFRV3er zc$iOxh7Vi~iMoU|s4geoHQbyYF+J&TI%dQsm7&F23`C$ zm`bF{arX*G_EYtbMgL2|x0g`FgRv0l)6KwVm#cQ_qlG1)hqil~oKrY|x`B~*AD6Yd z>ek0C-sX-gezRbGediJ6?a*xT{0KWAt4{W}g3}aLmUkP0Twt`raY0q8m-bg|2eme`S zWf!4^Xez8;3`9je64{_SU9}QKGXe$B{*-eOjOtWaL7EUO@TAjtg}o zN9x0NU@u~5%5Y>D$L0fnf%|-V3#<7TGC0Cyt2qTzm?rUK-DO(GoJsXmzo(&rAXD~0 zU?)=dcIAnC>q8wZ54$Ghqj%@|d0G^j-$R!bDehQUW%E%2)~<*&@~y7jXTlwZvrN=s z*=f8#l*3_jtSH~ya~;Dkt=vM(Y}$huDB>T!%{@KeM#k0z-cj;MJiRI@IRSdlIKWsl zUTv+aHXA~|85S`##18!Z?LS5+u~7RKQ-{W1f6a46X$vK{^*YBE`TmQov;HezAAEd3 znQ0N@!;+DmE&E*?1@sIHtlNE4H!-1w95Tc&-6oNMy*u5Zthv0y93iEr}~T}>q8w(R!wQ@2>q zn2iRLQ3>19!+hGvp!se*p^{U0clHb|bkWWz&gevHn?uzvAuI^YWg3-?wX@{^q})8h zLzm7fhhWJT7%t?wegu9p`8=$$5!wMm8ngE_^<&}>GkV)+lWzfLxE%n-)uE**pr*Sr zY9qhovQ5&?<*p+c<0FZQKG7=5?tfA5k1*}djcl>?4snLfccq9Ih^Q(T-|b7hI~__) zT#Gez+N|_%1;nvFs|ei9^q@&!uImkI$K}Uu!I(o_@oNbqTG*krI$$(i0Pt47et(gb zhx-aQSsZE}EsVHJe$g);SAs8|eQ-5esR?4)*zfMr(jnaq(jeU`-6$Yk(%sDx zN_Q(ABGS^`EZrsD-QC>d@16I~{o~HS%(6Rk_6)nv_lZwDo0Zj~vU|8t5%gc1CmDlp zgq=FtPlWNyL61w=zCMrS_K4ZF`<^X$San6HYkD1(naQ#-x^tNC!W|z>m+* zG=1=bWV7!RC|&g}t$!x1@BeWTGYBJ%y*><~!X=fzzr0!151z%9|oXKLJvDn~~3>?$EFZ7(__ojcsOjovr=!PC?-j0?;ON|2~p4C#^^p zyCN@}1Yn7pvXWAu<9giU7zbyL-XSBX_`ct4YD8N>il%;STUWjGzX3vey&o`oVNQAl zjI|^Z<>-8#FS1~O03Cx&5LkldZakRG+VA-42cNxCGzw5^PtzB+Jq{B-{QZISkM-H` zkJQZrkh(pe>1YVk^PSeNkg5n?Xkz^zCTc967Rde=yGk(WKh@5jq|%wdY37u5vpul( zV>^raz<~wIK!Hb7kgE@XBVKS!C9E(_5rn%dY$qX-W?~-?h!MvE#iO^xx5Z+>^Ka>$ zS~DuhU^u-G+GYOcKu@@-ejdMbue~0s@A+yHMt@o+gaIcBSJztW+esUf6db^guJJR# z0PR&lfc0Y}3i!L>*rywD3x0e!PLkhmjl}O02@TOZ$qbBTreP%Y6>rM;3Cews(&|q; zxmDP*j;pKN_1s0m?foB^J~ES>#;4#pURsbKVUl;q>pKybAc#JnA)QX7JQMQT3KEpg zKnAwN04n^=8hX1;-)l8+kf$-cewan9`Y3eF87x0vi6YJ}GXnp5uM58{DHrzJV?)L5W(OSENeg;F4t%zuZGB8jO^uD{NAP?Z;yC4jH+j$S_Jxp~Bsb#Cs7UxP z(K8S3?{gcSOO>yFFU4~xUWXlg@fadrnFq^u-13M*p1uM{6%PmA4$-Q{TKzE{nFrAV z)|yU~dWCuUg}%ez9s%7a>$_l6hXd(kN8m3T;gy;wEbQ$a*5$Jw@8Kxd~rKv{Hd9zLVst8ojq3H^1f=s^2^Vob8}|G4Hk#Ngww-&LrnPE9dAZja9INM z{CRm`(cHxK2`L6fDG9hRze|*x7xXLgyMX}w$OE|aY3zcU9YDO zm6_{W7_w@5@Pei{eQbrw$#XDVbk&5fc0E1S>D&E2%t=`t8Sc+ux0B3{&CMN^qGr;C+7|MS4LVT! z+u27z=hck=gV(nEu~~>743aD0=Hzvw-`;KwF}v^vLA8(Ufn_KR)6&o7-B-z1thk{Q z^STsKlp8MCeu|8DTmb>IH9+y*m=6G3+NHT_MTR~;q+3n`p0(aLcBG=`EHmXo2!LQC zO3JOhs{cymm5I3NEb7CWT|kdOi6NGB z4v_@8;N=j2s1QTrB1LHXj;(o}VzN_^Dc{4jczerC$GznHxEYK>f6a%5QcVObATleE z44@1hQBhiq(dIhjoljV=`oY7oTEYkMaD;zA%O(D`c4^aoB+aqvzzJVBec?cm#@G0V z9LmQwn7V6dbNG?xhrLwOQcsBJC8hqw_pJ8Y+n78p7vDRf70b2D$=PfzQVHPYNoAqD zgFYDy>lw7Q-SIDr{x5!@_PVww_~q+bWoD7?P}W8)!o&K5-f%R>3HN+h<&GH(%;c#>NFgAW3_ zXKy@9bgVhr4v%LqN|#aCy5Z?R^^Ie2onRI>d$q0c@{hc8 ziK|_6AE6EQP*Q4?Bpq#Zs{m6?by5&fyG92k)b>p}2U|8|1h&RXLB@iEcGlC{cept# z0eYD=C+8X7cf~v2^T(1Hl-%osIKNFWk%@1gfrzt`wunZ2waXi9g!=*mrm{@2_a4H7 z+{NpAoWlpWA}L&Bqn*}*VY5H2+r5k8y}^^Euc|JKV_wPV+?=%>KAY>Ax{Dt4ZU)i? zlVg~UY?$D^XDE6{0QA(rSB=ojtToK3Ay{$^Z)n7ipl7`Z$kD1}f=%u#0YydZc^|#7 z-HyB{%*>t zxZS~&-0z$W;MX6ErzMKd0#p9~%8QFP4gLN75(lyU7c3M{=W!^YByh1~=ioR)TNs1c zi`AIb|4_r6NR68Yp+r>ggkG#>ADo7T{D?vmGS-Ms$t7h#pk@gLWCR=GqM zaJh)%)fUu}V&j5?uG;m4_Mh1^_(&dF$Z>H$=sNWi0|6%~w@lnD12+y2vg?8yov&c^ zoh6#x*#Y{#X|b=|BZNKkHC>EJGyj5?_ICaLs*8|(gen{@x6jZhCkoU5*3V}R6?0?9 z@3?@Fs2{LrDqq)G@gh|gb|f@-m?xD~35+^FM1Kc2h?Xt$;6O%rdCahQy(mqqi;Uc? zuJRsjS6FJ&jgO0PK|sfh>X(`+FM)sn-pW`@iu&aN}UW>H#!L)!5p3LHXcN>i_YL{wG6_TUtcVu~<@FtZ-Vi>$Ojz#) z&A;Y&dKPfo3)pvM0sIgJcyX!5yf^N!so@@%Y;6}WrZKj!b%u_1ZZPJQg1e+yTJLKx z_T2{`S^X_9%IHmH>$v+zd{#mxo@1R@?|v3UOqF*ZP18JPI#KYVVA(T9PtK-%QHTb4 zGpSR+f@pnXL~FDB1n#$dQWXe#T~pmKT3mBa-2XTm43OkD)3zqUGS%{r&lSyl^Y{%E zNLMr^;oi<%DMJLr>+FAv*@2Tt`&VHJ4%ED=> zc4zGV63aG2S@MPwCNL+y!fzmdl(w7YepRE*_l&!Ax8(RTT9B_ET#>DO-ZZ)A1v9Hc z(RE)csy`o4KbtclOZVL7kSh?Dqnnl1VIA+v)p)Zia`HLE%a;g)TaKjIi}c`1zwHjZ zPt3d|=OpZTO~YQ2=s!On(+~MBo;_>w7ddZx)2NxN!jAwD ztWfP5_a;G5xi2(sC(qKles|uE^OgrHrTXEsEyvTpKI(rpc4T!syhSFC3c)UG$X7%- zO!53AgY;)R>FsARC-4m?l^(Js_|#gw)xdH%O%}+;#8HT?&sXJe;*uP|i2N@n3Pb3} z;!ncYb0+nBKY#q=k_ifiOXUR|lr>=h-|tz((q&Y&nan%p$js{rKwe2~ddz3g#^!wG z8y_Zm3XnqI4Zxz~`zts9{y&VBXw4FY#!*Ov`jRRN=+RCfn;=^mE|rK-Pj)VQ$WH3& z_?gb5tNIYKUM1SY%HYjy*p*3Y-7YmG++#$Ljm9r~hb@vK43GEv^pm(ni;jFJ-3gBf zzw%6w1To^v+rBr3rJFfX?Q!>taGFF@vT)3}KK{z5CjS!s>rwUgh81y1iBvgq`uy1Wl+C)~1!cAT3(;~=JD22` z(v7XCq@)YzDOx36SkF0=E0bWgB^I>i9eok)F07-~UJVw)yMbaDo}XRNY1*OH>Nqmk z#dIQrEKJ=`uok1c<|YH;GFr->NL5&l`w$MfW4R+rYuMN!7*RR=C?16}3iN@BiHHa}{c4q-%pXCBY zPZ=U^+p}1VeN2G4d4G5Z+FBgEX z&6NuAzKdD|z8y_7W1}E~v;D|mfAyOEY~-rC*|+I0+xiW|-TqQN&km7+-){U0W2`={ zEuTQdC4vajyQKrK-MbXmW4htbgDY6)HXujMQO~pHfiH5tgffb7lysSqG$c3Pl)@Sx zdSm>QHQpu+dA@u0JU_w=`@}m(HQJcwamd}EuDfpUwx63ong=N~zF5G{1Q8ZAVORgRR9koCUi-s)rV3sKE{IdFHGf0>gU6%?Pq zAl#6@w_5NK8rI~k?408g`y=omDuUCO@_T@ZZi|wnlcod=xmE5BX{N{+5kubs5yDHtz!h6$*Q~<&bOzXK2dKLy z*WbW?Nb^DU4;;b+)zaIo=sw!VRQ zC9;ANJ||}-IcUs+#dwlln)YwQ1(HS0{I8En9X}PV!Jvx^vX9I!;Zhr)gF$yVNwBqf z!X??VyuNi-d!jC&V-IL(z-MdNbXjy7{BXOM#b)Tj6Z7>e?@UR5-qP{Y ziW_Yb)Ioh5Iq?BL4G~Ar^~PlM_4`GgnNNL)6Z&W~&OTs|RMTwtf=Y{7SoVXkND3!n zy(9G(>C=1!%FEM^yUXdwy&O?Jc7HSP+`*3qIi_EH-D9GNmz6tAd zBb1potO<5p8QXin#+|rCk=T#g**U$%B@=#rKYy%BzCz5gt zqsT0GS=l@Z@ZKIUSBZ0tnPh-*aKy2Xj9#}|4_dypNb7co&jV>G$k6G{L4&bHQQOKL zDJt$Wn$909k#g1fG!kIK@h-eY#Z%JA=;4f5<#aaZ7{8w4ZFJgoD^MPA-W#gH*+CRj`$wneBjZ*jbJCDvw*@bblu>gBSkf%F1eATfK@ zVi91`%!kB5&%^moKvVpo;2e&Jc#sjFX6m5O$Y(KOV|!Z=aN`XxD*BrEk0BMd=YfJm z?Nzc@ImIrfs4qMC#@24q=mXimYQOt+$9|x>i+RwKIt_SkQOOQTBwt1UUzr18_$-xZ=4UV zglHUKL8$+fCU1N``&)CuslAgA6X( zw>@pBSjz#2^k~4??vN0v^hd%~cTPyo8v}ZJv~lOVFE{6qUHNAS=_`IK#;nkZx(%Lh zoz9mG_W={sN;LW4nXh0CFlVZ1$EqQ*%AjozTYdwp#NMrDNFh%)KZPvY+Z7xnnuKpjk1&BQFl&(JK&>>`1Mf=KpOT^GxXk5`Zq61#UgA3VbsR6EcA2aE}4j%9cpl1cYTt~ZlJ+#O*&S6&*s2D+8Z|trK z4$gZdBVT?2To*OBq2C@T9g_DdD<;UP714v_g9Y|RGt5`Jlk;l_ zt6iQ6_#xfz3m4?Ts+11roi@2Hr=p|`4Oy@!^6lte3BvNrL*aVHY-vX+h1+IK)3KxY z%;EBvNZY=(cmCBFZ4a$9a~CS}cXM6@TyO^1k8FOwYGnosDI6sV5xi_!cr**>WoZz0 zm!^5?u`Swl_ROvxPJZnZ{-(mFC}}(?G6^1&4;~$z<)bE(T`0=83yXu_+YCuUs#l^pdwUkRkZ>{c(p>aV%3sxHo^3Dv@Dd!x_HF>R3b7(1vYxXWKgl40XyapkYzp z&y{$JK>N!iS*2uMk3Ix7^TGpLMjx52aq3`IRT02B8ySUeNOYkRwM*mvpZgkUUMl=dgT?qICa+L=o#u*C;I!ijd=_%=>srSLVBhl}`EL$;J!LB=e;0a3UnZ!A zM%_R8Nj>e8jajb#l;PLZL03Y88bp_Uv4J_ut++JaQ_UTlSYWb1^2<+4<=TCz=<+vf zsKMecTOM}0!L>AJ)sz?BY;+VS*DHwn1i>YgMyGr!r}KQzR(@9NJpR%>gm!bmtYQp+jeiC3Cjypt(n z`?!j<==MfdjH|;rsk-v7vc~t7TTxcb7Q_v}D)=VdK)Y?5ccST9Ao9w{DL>%GsXe)wqV+kMmgfJyncjp-QLznYf-L%n2^3cgnx?4FuG~0*MKt-z$W`O zd+_Tc^FLM!euM?@4}e@Y(oA?6m!kJ9P$Kg17En>X?TZG0D{Ch}MS1?%Ux|S|VtOU} zW$aZ6qUZg1ImSPU$6Zc=7R!1E5=D2zP9_N!8jz*|RTqbVfB^p%z;L^ZHR|4kv{Qt& zuWsOcz}t9@i#*Ye%NfsEpBjXuNR+cKcF&~SGO7a4{ zSJv*vjH^xCYbe@jq2Y+m^(=^(HRDNo>2kUaGltY5+`ni#PeL}rPQCZdrvMNsdj)&| z6R+uByIqSOa=2mQ;I4uy{*W5Cavir|$}LS>w^DqlY6z9;!baC^ zc4bTfX5KEYKhk}Y_jBC$xPc^1PC)n(n`3eP7jgP zy8b*Z!K`NFhNW!^QVDmh4hy|utr6uUTE|HzIVAGXDSBbB(a+NK8A};aBRanV>S)qA z@4)6H?wUUGhXD;Tu7ETXe(Xm|^3D`~&=$W=H8MHGys$}hQwGUVAKXqjs)%AFG2fv^ z1SxX!RoA9HizMHW!~(!m4E+F8DQ&4?RM~kREk$fXulRCM?%wab8&SrfGO~W?#q4*_ z40Y63@&!C^z#(1?BBS2>dIh|p5n{DeonLk~&teR;VgSLHY$I(QO!k*fyb%HH3)VK08Q|V_W9hSQk01lrX^#PnH=1T=v)AOVAb}0A^SW32 zUUP*ti}VwG2;H0Zjnw>fCfeJWiuw`d({txd*IQ3cBpd>vZ5f=q7DSK7y{n?QPxqHk z(CpRoH+a-|sMz0~;b-XkulUAC3->ay>U|8@N%B+fB>hJfbIo&7yX5r+1KpeRLiw7F zShY(rz7M-S&Pr4@L~0+oOdX)k)gECnl^~<{Ylj?k`u=Eh{O$lvtf<~O|H12qP8`L{ zYfCHzG+DL_nIEbwRZF$;A`neXjx*l=(BmPtO_T#f#~)C}#k;pS|Fy=yr;T`iltlwV zX<%m;wcf-f_P9wHETt?j+MPvBvaP0YxBbhR_t<+-MszBg{?l@oy4oJA*Kz8+O zh=x=9hKA67Pwzu(yp0B{l#d6I5ygm$(6j>-G7b8X5gD=)kxJXGVrgO)`7B-o z*AS2e3=e9wdy-joP6sqwaV{<{{_)y?v<$c)0GIj)eFHRdH0^2N7{E+=9OJNI+fgtj zqg)*KVZq)=rGHg%mg#=PJ;sX25#(?qhIO2c{VwIuCixMeJ>`7s(8F^?nxq1p5Fo~x zd`I?Gzm5(1b{ApiZ+mY$8!me{GMk`W=DC8n`-n0Wtf(#XZVfLRCzPHj)G=NH58Xpn z*v&i340^67Aafi>;%JrP z^(G4Y^tPh#_B;%;S3uQ$-*)-hQ(3K+RHWUUz`UNgG(0H zIuz<_lTW}-8L^8HEy$cj7Yuq0#{qwhuq@8q z7riaKe>F7f$LC9`u}K$`b?6iyJu|Hy(=m<4KI6Sq^kytHX+lbMx3qnLw4K`0vlY3Y zQ)+~0>}WPf8Ks^OlFe&r4eAYa5ByPmmWgJrD5zqxa(S)RzMl2mK_+oA&&L9tB)NA7 z24maLY}-1Q73^h>KG2Y@~>p{!Rt3vm9}^ZY7^%XADgi}QdZiY^GSY; zyptfe_lI!<*&Bo6enTC%6AZH9XXt!}(`!Dv@_Y2VoN=u`TsPvmaX-D?(DSjG9mmuA zHHz>gGplpYeIub%+{WjZuH&*X6YrP`37*g4_+`%04N6TqNkm$*5&sRAl#E0?N!yhk zEls3SjMMNVtwgF;exMgRAyNXOUchG~i*I$*tx-utpS-jDasMXJN2I)ma@V9*c_nfO zkEA<=r}_F16oH<8#>j>x=6(qBTSut}ov#FTc!*PLRaMjF?1{BJYI9X{(6TRIMN&(1EYI$jnmixP^(8 z6?TCdhE83y;b5}S(6B3~n0*4xYask{_3iW2h&nUe8~wD3S+mCtN5xqh?ZZUhL{YGQ zM`kwCMI7B@dLK7cLv3*2m&SD*ctst;iEQ_Y-1araZfV;PLcEyTy5*_Q=N_XNghty` z@$49?F;nn0%UFSRQCIGO{6ww#`Q8LY0{Hd?uUX32;f07frRBX=QdSAY?JgVkxa^FF zB--kWj)TG2%gIFN0f(aa+sYBxO%yN=Q{eK<83b%m!+QWjm7g5$tKR&VQyW1VdkE~x zVqO&bJkPcNO~)s*U-xa^B^`zaC&>JxkYfY87XWN~(|_r@nE%{DimPw)D{I}78_D+e zHi)0^^OYAF@bhmM!|_rR;DN>|AQ1L01S3b6%>-bvr`-f9Xtcan4PM+8WT|7V=w^G{ zlK^In6d^=rWHzK>yqa>;Go4bj{M7 zz&*TLj(-0p$H%hQ4iVVYV!#s?Fxl{Ih<5s;tpPDcWTxZtvI^+50rI<-&0nWiX66Jy zjbL;z;|lcM-Ldw8JsM<1kVE8MF_(uiynIt@MRjWXRTaLVXHlAfiw z1>O!f^llf<(fp0=*oTw5R+}LLUk~B%HO*cv?eEnWZd+t>f2nO`lyJ$L9;55C!mxE= zWVzNvnvnZ`N4iD#kTqE{;h%HruVN7TVbrAll0OL@Z_F5F&AUPN9tx?qnK5r2y;5nF zM!+Zis_1I&8-i9G(Mz{3gjHpE#C1~VC;@^g$tc+IDWS1oetnsCWLZpMMA`UDmM6Dq z;@dpN)K}RXz#dk4HLXa4*siCWvW`;!%E)(TFP+z76aR?nY2JdzcOrSWOE)YV$!)sF z3G)80#M?rTWxo1dXv#(7%*rhho)&NgvP6H8<|j9d?T}agMl2@QIeVfXBjPQ@h>ymb zj=Og3y)fq?f${Z9Kd$M-7PydBdoSv_$BVbrS-_9zbvQnecXvPces$=Dr_`^+tgG_&q8+8%$x#;urgjU><4PAuU4F9V)=-9J5{ z%_RhVMJV}Dnfk6lI4~?sy~6cC8w4aU>hHt6;XTMYwIv;k=}l~S)Vj{Ym}54zs>QFt zfX%3K&R^ZVdd##@EgqH3YeiWdo%~@%Vp=|6={54hbp|2`upyN!{=&(*7LEP4#T$Ea zQXY6FydUlW4En)GA(b~SRU;VL->=TWi*Mvs3(VE!CKMHfozZ+<$N*&B!!m!=&oSn8 za_!HFqmiSZFhRzW;`LoWMn{`0F>HNhSwDrxwT+@VYbZUQ3)cRiHSgz((|LvR1GL3) z4P6S~LrD2weoRrhh%l7qkx6Ox(?;cJUaXd_dU$%Uj2Dy6OtOOZYp3GJ7kOla`(1cD zZt}w1;!rFUQ@yJE^+A5o-<|&~3>B1Yn3CiGEG=wy9?+tgRS9Sn=�e2zJ*6BD+0 zs}a$B9-uQ~g$78xGb#R6330j}PaVuqKqm&XiuG@}I+Q2|^kA?=KsYXR(u@lf35>{Y^li|I743zn{n%SnEm-pH?U>+?bR-zD5X>6 zSk1%PBs$?Wa~PX&=1t}b9eE$XCM?7LjjcZ+Lk^{$qG$*0-Z{-PoTkZ#b{Tm~(Y)3~ zW{b|K8dU)N@yZ#@`vob^g9?iaoPc@j8C)@PE(G6pp?oBH2-cPueamS1ku>_v=$*)( zUXf*!_|;o^v9ZXg37LjkW(6pb?J6P^gE{H#FAe1mbUr)|p{7uc!K*>9Cr0g30C^S) zS4_zWCnhA+BE2d#dWt1^FtH$1XW9 z;>RN;mXT_%%X(LqsmwlwBEqPNDnd0Od)9i5N;Gv2{_Cv*`I(kDaj}AgL*^4vvELez zcOXQ3hXE4X^dK`rNotPVce!l1e&^vTtFma{z}_^1Fq26O$zbkBk~~;tbw=bD;*f6} z!O#p@WE9en59h1yUBTq^ocU2}sT^yu9s^a%i`CiirZ;YPwM9Q$#d$-EyxhV4+0ima)Jz6!XFw{zvTaNNuLlaQuO>4(6o_M-QYl1;QCCJ zeRFL<(fh;y3o^I6d&S-aDX)HP7vPJA;=a@pdGpdi{LkMZYneZ0kd3JGs!b%Y68%_j z^yp-L$G{)H^bT;37%7Hcq9T?}x(FdMQS-~u$c5$YzlL73MTyW;N$jxSWQMMWD@+o| zrlPMiir8ukX7Ps2;KmFnoMXavU}A29y)bDGQBgcxbSDemrMm6;I+3sULxBVGGLZEg z@xAePJ{-@gDipE|&KSV_Y`u0t2^Pgy3yju)Ep#HaHjWqjBN@thYK~r3X+I7Ot@ar~ z5tzQaM8Z!l+9b}NmKW0Y3;8%gUNfYYAfNkGW_)y@zW-R<1sId@&$L8Ta%zr5la-aq z7a$j?1uOn|^m4WVBN$Szvlgl{~b zbL1UU9Vj=na4~t}{uEDeazY0;n?aZp)=>TR(>VA)8VA3_DIP>9>2oh$E+WY86Qt$m5?xU7hMOr zE@H`N^p&Kx!_tl!Z)veEc~=^@eaFMf3+?l64BNm(^mq>H6j`1;fo+<>VE63Tb<&AU zv_y-s`1-~O1%gsp!PU1%Q%mlR9!qf?`y=wi2#`dUwS}IaC%u6f;@>R{WtsNNQjVq} z^cqBxFyCNgBU zIG;zU5#BS|Lu^J#CmWv_i4$CGP`|RBwat%zj$hRRmw)U&3&+|UppxT$u>Bg;|}(9=-&*Mu!aQ9qQ;j@7&00? zKC5y^XNdp$Y+}ixZXe+=8xv);?a#CteM6u|jyB@g5)~DNLGJ%M=;mbwk5j$mkW?Mh)_~yyK(aL zWRC4^D>KnZj&(vS#%k?9%|D;=yUb-JHGOEUb^+Kja4D#u*t4alv#>wU{Vgrc(Z;5_ zNt)WFq5>=E$b3XMM!k?%wN%u6KYHC-tZO~(PyS(zrOo`3+a_|79C*u#94M6A@4ZOg zys;c*tkFiT(I(kxTj&&f?(<_|Ih4*@Q(=DVo+h0<=Vm?V$7G4L^pI&O@|W!RmHvWg z@rsT-26T7)E_q}L%9EoGwi9Br`Qa_}^2eD!qmJpe?4pTf9Rl{u&=j~^!WI#PP237* zsW~xa9W2J01bUU{YJ&Frz#b_5LMqfuJ38rnPSH}Bh$UhpuDo%XO-x}_l1?QASHF$~ z%h7RYWnw8MCb+I>BI=(r#5k?EuLIM)HoK#yRY|Znr{g+L86~b`KT6rQ>&H6qNXE7u ztFfh20&89R`(*)&4qimha+O(C7~p&!6@|{i%4!5`NrlBwz&bl6M_n~yDK&#!v={nz zUI#BkakMU>lx?Un#YlAl zTO{a6Z}I;eVWERiLpTfhV%vuj9HWq!y1r zphMJqscT68E3bB66=c;E&w>2A_=jF^;ey|`NOboR>jFW?o)TZ#yJm|ahuUFM9FV^I zh2z?1+x(^Z=Uei_IF!%1PhpLT4%y`Flv}EGPp{tFP=jCUVlOEmAeX;`J^smAO)oO9 z3|HXqQ7Ca`K;WkxvPl78wGFo-d`KnXkh|ymxiH(%;QUo6c^XYP3VgJn_i;a}o{DGT zk0Ef`5^EmT=Un8GGrd3Pjcj{R+kiVK7UQhL-mu(bC97WLn}bxJF<%1s81F{3Y!c44 z=);j2_ZfuVykDrn7@&d1Wz3(g44on`hLEhM6oJH_>lLFfFtYU98nTisTa!CygrQ~i z_LIjMQQ_7#hf(F%V;;*uxVMCMQIK@4{R`SBfydGtMKajm=DZsXstyZ-@bX4GxWLJ)Xg z!lCca9l|pdM}|I+)EI{`jVA_eO+JN!GuY{Fp)H2|;4zvol3DpW-li{8l_Nxyi`6yy z8Jn~Uy{hIL9lM4kbp0|}3>yv3O7{iZTM2XOVa`@RMqWF~AcGnX`FCB46?(hvl3_6h z?PnXXJ*hEboobK$DVKOG<2vjMj*SZw(*qe?~>|;^TYRKu5-1(ktXG zMWGqB_uClP4=3^mGzF*2vz25Tnz)p{U%nurq7sOl88_h*)K%2)UL0;%$8Z?6KKfpe zg~uH3Om5I%?Yd7F4yGAo-9RXqy3@qGBg5ixC>;gqGg}Fs>Dpf=CT@&eYXS-i3cW3N zwwHlBF(0#-J88o~K6FG*KEy)znBn!hTp`-uGn77d#tCVh8l1+MI7vOLZSqe);mq)* zh%CS0qO*vW7kuJ-wF40s^Ata-)UP+R@j#IXgh#=l?W1hC9pZzEbJUZnk=KAF^hHp} z(aNYBo=)#h|F8!MUwgk`MZx_1r_A6{){_z#l#Oj|(LoM}b3n!XwxqOltuKy7OJBct zf1f#;R3H$L#Macj9U2}+ut$(6a~jWhoCyl}c4iT58zvTQx+V{HMvXq;_M%f!`52=* zhG6X)pwtd+N^&JQ3C`b=T<{yO8ofvtOsn&v>!YE>b(_lcrn zEfK_kh(_JW=ve(njZ=ddtqP&zTiq~}skp5@5WTYAH*;baRMG;o`Y&{Dz76rfAUf{TT?Cmno7h?q9xHnjFL0#Dg8+4LEvEr1M5hB zFDBJK--I|u#i0_t#eC_Z>r9gZOdzo2gV{-jqi#Q$>l|_1{XYT zY^2|Huc~DwL9}Pwj&=@Q>;+;me>jIO$5!$OpCO{#&OP&!UZ! zq=G_ z;FvaXJryd$A7`seC%2dwB9FAzIWFC-)>rV z9)Rrx|CXs)aR%|#EngCH}DN}yd zQs>ALCs|6^iKEAjO&4F#QbM?`VUgpZjQtIdC~|M4ka@zrmBWT0$1?%F% zUaIEa3n+|g?QLxG^kdxVhlg}g2YPz}3Il^m`9Wtc4qB{ZX?E++acfk@Ybv`__C%e^ z>@>FKg&w=-`LDKeFx(VqB^&+1lJ$_hh%%$hC=cuC1^znk@K-Z7Dd!sj_s%_Ic7m3L z+;{y5XeQ)3ICV!28g*^=g|0mr4{?uH%QFc9Y-W=`kuCX}nP(=yg_CE1E`#)^N}sYu zST82+t#iE+Vq?vKO z@B1cm@KvZ+eZxp86cYEih4n!d(<933{z&Wh6E{O$YsMj`Dm4}7+~xcYYyF_1&{NJb6OVe&$~p_41TuV+=fj;cr74B8u1cA5@rB`fdx)UN1urT7=P5=@6ie zXzNghHa+&?{DbKNn`|Yr!lqHuHY(<)Rhz>lanJ@Hm3Rx0OIK5-D9(kg#1u`yuA`%f zK=0n)JZ7KwuWG3FCj0rg%-84b|8&JX@4}1Tb~us>NOn>WCQrw3A!9G^G({!6Hp}{g zjp1{|^JdttJB6+I2!q7=Pcs_YMCtW~p0wR$3&Mry^X7Q=#Ztv~=Ff_ar3S>Bk%|5*3lq~Tgmw!_1Z2dOMFGg95@5Kbv z!R~?g0u5#YSN!m$^79LvUM0`Ac_C+%duis&-R9}G`7foLSfk(?e>+(pN)bD7|2R(b z%ne+BOuV!YPgi|6<}&L4g3E(}4WdJ}77;f3tEzR5O5Sj=bmW$W{l)u@T%85zIRChOeXT<7}wqy>+l$7#n8$L%5c`iEnf3L8cH`uYvP zKOyG%!K$DbWnyQCgNizu+6bATg&=@zTC@#&*yy?SAZU8?k}a6f=lD2ce#y_~*%{B$l8d?`kd$e0(=;pR?7kk|kkt?lCNag(96ke;aY zugs{4tM;edgQH!pDCKJDy&_8!r-}=VIDs#MZt`R5)oYZK%^NUY^59DPA0~JiE(;5SWn|EVH?$t$Z4H-~+)tqS{xG3->>g>__aZGmAqbTF zE?|X8wmjbSYnqf;aq8N*J}Q9pzTh&8?mfF9;WGt!a9bqLlbLkM5=f4)4RD=7Fs2Um zzVUk43)tB`OCAj?qfD?9PY|sgL^gb&7(_>G_X6){`u~0%R%o2na`zpt;0Sl zYvNC*+wClapsOnkzs-}0f`;Tl$dzc5t_^?3w&+Oke5uv9fZWgVD)6Zz1&1}YKPB3q zX>U+bwEq3g4KP=C#O zLI&hP31$$aW0g4;C`Y~Wxvb!>1Dh{1>?7xcMVOqOowfAz(97=Gt610od61*yzmoKv z7z<*}{OWi<5Bp;zI`_~G@ zGJ>xNK-0c&+!+rf8Ndp9rV1yd?D!X2pBrj+O0)kic63UT6&Dkzu)$c)gieHk!-;8V zL_fx?>TA=9C?LE+G9PIsla5)2_Vk?Oj;n}&AP}!X)21(FN4@80Mc`v~Fw8p9IHYcY zRN!l6M_H8*$5@{4){Wy}qNS$(CeXXxdb^N&EWW|!HUpMrm_K%bF}gaYG`;%+r>J*o zm3fGy3!f$a2djm`5)*l<%gIVR*|j@Klw6vJB?aYHM^ki|kUo}3#R*KOJ zZFD5Vy6WvdP9j)}WYp4*UsFsyiNVD))MB_nNo6XWggMGCAB zvo_c_yw2o&>}~rFeIQyL({o(VeNtnHs<{RmqCn?1P%j6Fq#fD(5Q_`#Q<`Q{RHxK! z6lCe#Lt}oO21JU+L!6$D(r7nGHLdn zZ#z|2jYGpRhF^A;_!qEoE&3hrrRSRp@n%fQV;mkY7}yki*nTMT;ILa(zao5Yz%Xtj zsGuY@=K(A^@ItDoVjWuM4v6u&L?|h@eu#{;)O#99mfr90vD6z-LhY`Kab{U}rEUBg zIT3MCOe1^n^b?cX<#t{@Sw9QCm4l+atf@RC4%5f$@S*O+Cw0!rZ13uC8%d>?%W`bN zjatj=+uop(=GQiLp69dIxDUnT=oU?WKZy8H>kCEP>e{@(W0!(rRzQ=>VVzYi3_0df1j%}Id_(!uvZapRyP2~+VsBN@FN9NlX$VDK_B$w zyi9dPZ~|QG!t(VTFmg;SuJQ|N9qcScC@PNm?Tu1fF<;Llpqmr%x1s*uoVeAgZh!(G zG)M!aLM&k7^Z&%&=@dl_5PLKQYA66446w_9AY@FE)6&&_4^T*e$#LE|VNICCGqDWt zxKfL>hDf3eF^m@s`zm&&l5JOlV#ss~TWS|2cyikj0Q0gvI)d#;I75HuqCR_V|JJja z?cqZRcfG*^zsDiI6d+)IeW{Xi(KrV~P=rJ@?pnLQipPpOBrTr)o|sbpg zu)J~hIeYI<)92+C8u_5Rq(PhD0!UV6apaX*eTd__z7Ev+V!m)MMZofBt;Y&B@U|y> zNro<3J$VCb{-9f69iAoBMwxF~sz(Tl3psJ*Ln-hECRo}M``qcOX;!9ax61NzHMyNs(*owog0zPQUYrk z`5l)=o|tp6y_;N%gQ}lBI0gM0tkg^hzH0#Ew#8`WT$dQos-qrYIYiAhC8EB7YAN4i zlH2V(Pw2$2_Q@rk-jYxA)-Lbk`=dxAFn_L@#fr%$Yt0V4 zSpDY1_y%l`ryWUIi1ytQYz29bKViQ0PnrY$LbD06`f7L ztX0YmR2U>X+f`c@qC6?`@hNx7dZ*nYx}oD3AS)wdD$3J_{+lYT#2izPjvRP+j?`h@ zny3nspzENLe4MI-c&NshYs`eh^KTRDkEf&(aqanb{QV9j`M-q>H1ui%2Y*K8-$=*? z+EDm65|&9F*Hv6!QD+O8Yrp|2*YfgP3Ro#%QTFNy;IR)FmHC<8!2|t^pyExG^&mWa zLWI1)1$6lH@tCIf;)^dfV*|HK-!2&F?0tJPB%(95^Jhw_*&&oR`I-CO&icTE^ZG0F zpi@HV66^d|blGHLI%Mb>CDoD$Iahq?&jzP^;~#15Q3#)~w*nzQec<`zWyz-|7Mg}@C%JkgID_PQ~sn+ zx?+jI`bogvSLA;4Wm+zqDyANbu~+AD3~Y z5w}9px8J9RlNxGk`y^66ASBZhQ^%)MC@XI?iI_dF%=sh$G%^mnCvaZI_W3wcT2ok? z)MRq6&M-d!2P(AIcO6SRlY{lDEQH;fseC7VV+MQrz}dS;W}uJYm!k%9C*Q)r-yAW= z$pce)IKB)~42)g*K5HP!+aRc_+8R*djN6u|q}J#2>r#g!iJFU>OVjzM|G*u|gTC;B zlDhq667uM)I#<=ktvL2LhUyG=-zDSoz?hX|YAvyx*d8XYH?KSP;%)7nRYAdZss1f6=P9LHSx5VHsF`KB~KMY;#gZR_H>!taLr+} z?K+m1rvT+s_$S*Oxllx(?1n80o@lPPmn@9qK}GJ&o2&SQe_rTfLn#ILw+gAvgDUbt zX(Y35k2hj3c)!~J7FmWozNfPh6VrT#0ZqnwO^rKI{@P6=G~=#>fr&}))s^@g9UUO?B04@k-abbmhKrfHnS|F`w2{~|tw@b`t6)&axyIsmrWIW#g;3sV?$mjkvbKjj|D@_iMhlq|U zbL{x|Jxq+b@qQj&IKz{8;pJl>r3biwQeQaXOrRHG3F9C60IceU6jWaAObxt-y&+Op zcnJyLz6+8)%R|1Fr=oBi2!fMbfVYlYUsR^c@2XyLAK=itR?IgpK`Lpn6BB$vBy%)L zqw?lzMOMyPba0yB_&=sbQ|Qi`9z;LWm;e)Gui;nm31_=ToUhWLLgn)h&k=e`|`;1tq}z7&%_$ z*T=$oqFV_rYr^CskNuzq%bzMXaKi*0jwNLro^~EPlPmiC1?|;m`_|OZ2no#=*g2Pb z*9O#t7}VQSo=r>9^>*^9FAcUGJ(`>%z;UtC6rvhSl|{EMDoj)vxHYuj_Q#qr-`aNj zr|D(xgUGyQEOA!ZqrPlQ`pzr9&ul&3+dtMKI-%dMvf%P3u5GmH7VsKXPcGD)e!h96v z&>l9~CWEhgr-pN7Ngqv~eo$iK4xl3bK%iPb*rrR{71c%jKfut}!26J*;x-t=^lxh0 z^8vP(B-uibegTJHu5;oc&`OrmvNA;5yXF2DF#%Xo1BnxF-QDT()zbhe(SsT*X$96} zi;nHfy(S6(DeXEu1Pp?R)iWd`u~-*?rvN~Sk(1NR9s^-PMF?uW$ORxU~Kw+t$x@hX4bX>9^p-Wo>2 z)V(D8Ox;vi?jio4!38`}(l=3GcQ0zDoBgSZ#@X(f6i0tY;HA&tH{Ad8(~(MN+}zLq95186 z7y7Ved%^!$ztn-%rIGDo{HN6JyB6K@%z)!qB6mao-LV%=Wz4uS_+nv(I~apv zBpExRT4=6LK>c2M@>D$GcxHV}bR24XaHjaB%R%SfH?&e7y(pHeouMe8(vljoeVZho z1!JoaSNqY;pAVfGfx(Lj_{)E@LTVi_Ky^M@b0}r>_@k@8(9y}4Tu~M+ZPtgU{44Bq zS~2$jm7lXUR+)a_qs`xm0iaYpJ^=CEd&>~ z=rtWzbrbx?1lO0R+XQBDQBo9p zdA^U9U8aSzTAMZoOgAFn7fsVJ99Dx+EZ~ORPv=i6jx}#NsI$G?wmdd@AYC5(|_Q-|8aj% z{*A~TQr>6)r-#LG@pT0J?@=?66**nK*FR?B0n+f<9s93a%zfF>*$I9Rghn(sN6gIV z+1S`*z9|Bjy{A!1gpODxVC4xI;w2;|3J41mY%uHr0iIv`-!TAs01!Z@5Qbm?T(5jb zmhN~go6`5VGv2EQ+U8C!-h~woIewe8M~pw(`{+*07zFLL{=&unuWAeFrl2uK_++>X z2f^<9LE`T47)}gBO(v{nq008rI3U9kv`p_kJf!A~CtsefFaUx2`!&qot%>RChut2$ zd2;?a_|pa)Qo0g&(es>qMn6kQ`PO7G$E4cCQWtLt+Za`8E>+q`c*O+k4(@si1} zS00t(4>o1mDC7=!GPhf(aBLWwWL0Sk9^|uay$<1hX+S}MzJ}3;V?X1}SL7*jZI(6) zu=etS`ur;sLbjX$w!sDC*i2&u$$@JY{r4{yo{H>eh6e^_diP9qWMbW+A@&=ov1hl-^{7`kb(krP}chvV2<>zY2 zqt7qBUZANU)wgT0dq-NQaqiHU7nIa=hQh`9kHJfa^VP}a`7xB1q`x6N(Uj}nAC5iEOXcqoi6?j49d2yTEzHLI0 zDmK+|?9AA9tbyEDxjiPvu&S9UNotCcOP#a>9Rjkv)z)vw4EwilbjGvTxl22`@=&Rh zMdWJOtCR$B+r*zlqs2%&W*#k34IWP?p^(*)hen{ zV;nrnUJbLQKLKNC;6wTvl|#Xaf+bRx=|$=)`uFpEgw3+4E)h(udWesj;$lAI`}3bT zhs%qR2x)ig#B2OZi#vrdmvh%@C&^CNEGPCjaB)k5z3B$*W8L5beRi@g&Tq6E`mW?T zM+K>d)Si}S3F0iF2!rEIN-Z?c6OJLiM+b61$G}EcD_2(26m(`Vv;w&wVkIJ_xg0dn zA#z-siANuIm)YT!Gda;25v00{szZ`$HfwWNYC(n3gU<&K| z!r_tg1z^JfE>sJAU6>|J>w*@sw7=nlzYkVml?9gbsRs73ur_x}O@F_h6+T+nYpGD2 zx#uOm%zmPg1Vq`^hlG8xWbT2uNal@L$uK`(sGlrk^{a0C**B&}x47~p7KK%{3&3e{ zn_tRD@W+I(xnt#G)?`l)%^RJRf~h*-yDSL_=^a;B)NmTz-Q@l80r$~UbEB+n!KR|& z#P`E{@+7{b;PYcQnvQmGP^-Kfq-|!QK#{h{&w|nbnK!~~l$nKQ$}9J6g@bjBpbxsALb9;djqR>NcossrdtfY z`$6fSwSXsRo>j@=-aOGAs<0%uR{T;<>YggS&|UFvCS=v?@d!NhjxwHR9Bv=pAMMM> zeLC*N;U~`zUdBAhb}t+DwnYoL;DNVr=$NP!m1JJF!j;%1mkGMW=I`JryzFJ?bd%oA zb9OmN!Xw_(H|0%K{}MO7?aOpERRN+R*qj0Ys-OPxuFcBZfQ(msf2dbL0{S;E#j$>` zk&r@auA^j)FvFuDD1NA}qIO-(cvTr5<}h5t7ee6ujv-|4_sUr)Z(koy4OU1j zT;(g&^9VOxqm%nVP$k*RaW2qe2-Sdy&$1!UQ!9A;s%ON75?u3pE@O!Ao)en^I5a;i zs=?Bo<5WN6Vi5RkiBN&4L6QknJe884_oy7sHAcRLdo||M>&ovITJ8zjd}RMOKkdD{ zYQ%I<%w0}srBvvw*8Zy%`hT^O8puL*()u4oEEdLFe^m*v!vH=Q5Jj{$bZwx@D1PS` zM5h9HL_qCxa||F;z$+Q(0z0#0L&{rQqkzCq;75S58;qaOF-YF1db^ZBi4}6kv$VYk&6ULO?@h~Ak`ONR7}hPqoy|+r6k#&4V!&N3T5nGmkXfUT z>*VzOtMX!ZgOgOmiBurHh%`x5EIFZ4&LzsBExLzSZCXC0PTDZl zxb(fqpZA-_B-m$?TsmGllMxl?a_5i|CR2Cy!A|T08$tJONJhmU*02Jx3-UOq zgOJ_i%zdhTse|{iIcCNuzwqKr?<>wTatSE@BzRWQ{H;x5Lk9=MyNSwXAFnCfi!on3 zTAP3B;Oi_k#UfFSnND*fR^4o3;~Z>m7?$!2Y!>jtOU;C;%7O`d>CpK`sQpu%UlJ&_ zz}4dS>l#MIinR|J=QDc?J{VCBn=#brpe)sw;bIP~8r=?t8a`PhvtsRQl(}$r8x}29 zUVG?B*10Q@f!3(4Au;K1moat>Cwj}letx<_E-s_Ccdu%klAwBmfT~Ay`5N5nx(VdR zQ}np8dg8M^wunRq^h|pXSB`+_)Izqlz>MDY0b+Zf`Cn{l`uzE;TH-YG3*tH?ckww; z_x*d~=>nwYqCKbDn*ENS!yGmX{7o%Hf%@!c1{1I%Bv()SnCz=oSo*X1SGwer6{Pbcox`7{NUdDjF0pFCL=QG%ADB2IZE3ooM1Pw2lV z+g~}QdmsW@JxowBmB;aRcL?{!-i=Lr#G7qZI+Hz;IO~oJvsuu4>xT?JZ@-vFSHA7N zL;rpZ)mjG7tvs)#yDEE_lzRiY3d$U87B#7S(Id?zmLN#W#9+eQHWG(D5<8t^^;K6X zO&P9PMhrWgf7!`~cC-TXEAs00{I;mPR)J} zeTBj<(q9-2vry{lxNAK9agR+)_kgn1Z0G;TmAq=T89rbXZF=`vM_ttH*A~DK+|RT; zgzXOLN$Xd|f6Pi+aKlmwVGa&P66w(`Gn?ik`f$@hXAo>q#VB$2YIY=Y~sXG^T< zlU21oCA5e(^hifoEf*D;FW#&BN8PV8W%~%J-yS6dQi|V~okaygWpxuhdn5-%^VO)~ z)H0i{dZ9!SO+0Q957H*P!lSG&N~_hZn}!|2+{)F^dunLR`r{9R9aFEo6x`ZtD6tDI zq0}yZxr`5Ce)?>kAo0A82adj9=FA^SkK$*4t;6dXlVpcAyK~!r%#XInWqhQ1(-Om- z$!krDLVQY{IvCnnIh+eM9!q}H@3RoSW#FW1Y@20Fu-C#NQ?+G(B`B8E zf+UT;jt1{tuF|NNR0lD{)gpw4EAzva%Ct3-wI6g3rQgu(AJ;Wv7F_!0t!XbJAAF_# zsVHf`o?I3=iwVS_`Zi83v&^d|%sTAup%SV-E(TvN>)lCluUaQbd{nD$Bk7JHBG7v` z*vNG9XWhDA?DMmwDlH6;FNTHs3|(hFs@LRvv$<;A%f-?5Ls7{?nQpA1biqIdw=Ip7 zMVEp)@7$ua_73v4?nO zK`)pmf4%6ob_Chp$o^1^Xk@&wmuGk-mWN}*SNWp$Rvje=kSzY|!E~MgZ545;&xXc- zJs3{P+zM3`e0t^IzPkwYUcsiv+PJmlX8Y5jilQPyA%@xGm}yPieidzi`2e@{&Hd1OPT0b}H=LMWeAU+coX$X^@?d^^!+86^vU7Vi(~nXFpBu zcL8eyn{lI^LenQoZ725h0DOzV9%a~NzuC?l*;xW)Ap+0u{iV*BQvfE6B8ca%#_aS$ zo?}IS7uhCX8HdPaE&XN@3s*oo*?6nUK`ypM&|pv+VKaPrw1zBfx~e)h46}%Z8LPMI zxtuwUwi-U_Ea&$QsT9v?5)^0FlI(L+FC)w;oh-jY-EG7$dSJeq?|oE~z$@$8!~F`K2Tj!cI1uBivx4>51+Jnvt!v9*Q)x$ped>?!}uiH*w zcp#}f_!Ua8^53$Idhw%TObeTzq5T8aPyB>btG|^1McrNbfA$?hDFD(cVTXS@k7V+l zZj$~NIq~YrJ%Dfz<0W)lV;h}6YqXDNTS@=3oSaHFl#C)U^%)u=@HXul=s*|{$>?qcGJ!S1%0(KWQ2$+zrDW`OMS&b3wac`FSa4AE!fx z!@1lLg9pDSr%+UUR1#NMBa|oBcvq!##qr^Fh=`5Vi#;yDb}@Gi%FR<(UJ-j=ugIm` zTZqvF0}v&WmC47(+=^4fF1KT&dwV%NmvCQPoh|mKG-uybo?f%LjO$=uUSCuA9t+Es zy>>ln2^IHgx@V$qS?Waw)Z24m{>Yvbrrx&`HS|q<^3|$MYANTV15CRWE+1|^|2Fka z1zY~CFw;AF>ZShov;;BgD(>*5;)w_2=J0Lg=BK?~&x!Q`45-)nI*W24{ zZXp-f@JI#4Q_e#Hya?R$0q{fHDF3e6?dbekUV1shO+X;#;}#%=#|Zp z?0>jpn-oJVz+9l7QgBoSuf42Kc6Rw;nO3x^w>Q_)EidW+ZH|Y$JKVN$Gt|~|k8%A` z7Pw+^{*y&ID#(Y|`6+^R>ZCzZyQ!h-^TC7~+S|O%e`L<3#P#tDUy=pl?yhbfQ)AkZ z8b<637b}sY*BE@)zuNs}ur>;~1AOBz?vtJG60`&H%&>}d8tyH5?1W%HJ{##U| z6$R}fM+|rOk^XKD5C7U*#_^JLsIiR9FH@+o-110nz*$RX3J3CerDRWROrgl$2uT>5 zdijn4yzX5byjp6r0!sX$(&Qiwtwlka&kK3x5@E`~(Lp?ZXB3kcIi2AYr!clonR^^A z*K(`nQrwHRUG?+#7ri09pYmOu^uuYCvFZ6v{kvW|6Grf7(Y`XvJaiuz5fYi$dU!FK zQqL<>csI+vz!xCi<>fn_@!h&f0VBfC6){}{gt@CNsiLH0Fz~YkrjKSP3t(mK7uv(M*z$lw0j)m&th@KQFrX&XEy(hv%qmyyzY>?vmrH-#;h!MDqCZAnI4t{ge zyPP@Y4YD`Gl93#30mt3#+<7)O|mY z;qWXy(!7@wz?~!AdBLNL#P{7>%w;-%{t}1HW;9lFtA1Mx3t}Hrs9wmC1 zd(^v)xF_cD&v*WBoaRalUp&X3MbXAENr`;aKJovGGp>k`i{WAcW`jDmR0qcg7MGo0 zKG;b}eH8S^Yj|Su?i~cV=q0S4E*=VKIROwb?{w$p5(7xBIyWOo9Pbg+vbrQD7~LJ4 zf7WPn*LMKqa-OBHLN~=Ua*!!CdtRl{l%MFcX5^}&}R95 ztNAjkdC7KAfBjt-kfMZWX)Pr-meCO&&qDPGm*Eak!$X<41XCnmX>>$x8x5>>kv@2) zLVvL=FN9+*&aGIt-C_7tD72}82%wdn?JEjtm5DK&pNXum6DOrWWdRKF7_Seu)f5vUV^2eXiWeU>PG>}3Zk+8auu{sGSBnN`L#k_8#GQB;d_^d)sp`Ij`xr!bgFf&1wbA6;E?v;1(Ae~?^uDExAwnPQ4Go7Pl3$R#;+eI z_Wu(Q0TdQYK_Jt&!ez{Y-h&b|=~DGjS5U9hU_-rpjG&6A7^2=cajnnyuQJ21(L#h` z=AVssFzNRsqFW=xjlX&wH)WozY=VEx7v_>gZW%RM{at<}{cIAazsK5$m4_KeQ}0xn zRP!=91Dn+Tj1-Vuk(?BT;O9*kIT5>mTp;dw>`TU)SuHsP7P?zbK&7eOZ!W>AJFJZ( zK2h|P{coeWLD0LGorJ>_IfwHCWL@?3wy5t$uWB*vd%8Y_b-s z{8|NP^TTh8S9n zQREfT*ywgp09n1`*Gl93M=K4#J=##%tFBDWs3}dQ^gQC=ksF2j#fuj9W8+wrO7slZ z>+FMOxgc)``<5IHsonDO@_7$n10ED~SqGTrX%?<(J^6{LHyq3|jN10JDh$#u3D_`k zK0E8}DR*~g`Z1A|IV||cx-<6<(N#jeiy`m6O-y=XO0Vr0SrPT6QRdEj4xcym82Swo z`aDa`2O%vSCf=>$$g%e}qKk8#;3-Ke|7ho>s*a7c_AoCg*E#IKz_X~qvT<{YqYWn& zz`q)5;Ih|&;fY}!a}j^t^--%KLdidAzz~(bIH+Ni%5XhUk%swA^aBmfT zFF!M1SU$+34co0{&4GZzd9b)OcP z*7^T*Ck-`<8GLx~1BaD0m?yM(zkC00EI!!yboB9v zTz|Vz7D8JItWV45lJVsOOfx|AtIfM;t;_;p2$oR#B|eH^J8Xplw5mp$YRHI1s_TY;B} zjthbJBQ&V|zEr;y>T!`V_T5&{e(4{z5g^xhpV5K5Mi4qaSgn=Hpjh}-HrH{49xHX# zlpx%Ei;8`ojuB#f+DR~=i0?OdVj#jfWcHNPC!7c~^N z;$cZ=+u_XBin+0clLd5Q-Dq%RFI)Md>}=)w9!2Rp%DuUPI@ui!pW`2yH%AdonLsM4 zmIb5y(ZrnwFhj(va(yKis8SgtJ{-@~llfdd)>H9XnSY1*nyeZR|9b40c$4cd^V8F6 z6{XL2jA|D)`$C4Qnl(VzP8_r5L{6T2ELEGjKNj~1t)ewQW~B9=!2|#A_FemOpZcQv z-?aHu;v=rV;fv5zk}nl4oB+|u1Z;0R?z#gxKU%zD=Jnp7|4&y2ob3ozLiCmv&hh)q za8vgZ%TCN^aIw-uz9tR^*~V%ZZD zFZ#%x5$fg9=MJ&4TQ;ryZN=1iHBGx#wA+CP$-yvFR;v#I!Bwg>L+R`L7Y&ard2TL(SK9$uCS z5qLy8*RaN+*@L%9NKzGN%_e7L8CA;8^rotQO0->MM_lQ+cgti2SGXaBI{NfYqTp$* zxMamz%iTEN5(D}n%V@q`eyYyQ`owS%{?8HR^vsL3D($!PbokAdeYSmgUCS0V5EF5x z^A4S!L>2b^8B>>cv4;3twTs@$Gy)wxe={J?GYj}`9GdeqA8Ho}&sypj@wpHD8l5+q zb_piaB#FQPo(ga<5@a{%l`XO=@Aynq{-IH|1L?Y z)x+OSK6{1#rn}Wa04S;#{m9~P=nY(xC#C;;{ZCGUfIY@P47SKvANCbDl?rF4bB+HY zbG(bH|LO#4;^$A<0Vki+Zw}8SXi%zsng zJ8we%ojb#l08Y#zIn^j}i$?*M*}d66m8zLO6^0!jXLGPWc$1R}TDW68S7Y|*(LCK8 z&?8kGQ-d~E0$_hMD;-KvdkfkUHNSlz+Ze6E?4|0@IMsf5DK5xQ)+H=Yd*oJesR9c! zzk}Kcho9<5xci&Wz0oP#i+cSO(!m0?J|nM29DZ|9(yXumWhCOR6P#VX#)awBt_ z8)egid(&9%dbSMeS|kI26^qLoFTlRS^5?;TKyZtom|}k=5&V?W1H+=J`_ec1&JsOe zLI2=AFXjHDQWH6zuPq~QNH6WqZUE4dHV16#(k+D70Hz|u_t5D)AWW17zDOH~ z78e(rT3HcsadBk}u>myfvR4eW7*E@thkuVhw*M400#%E-J3EY`E0*qH8tUIi-_?wX zJ80;t3&In51w}tvU=%YgyI1}))0j52LHDDyazd;r9W9`&S1QB9BYn*wZ4+!IZnRVv zzORSpUo7u!q^qN;K|8Pu_NMt@-oePGJ-s1>NI*zp2#ARl;E4~P9*C~b&Ssjj9ld@U ziXQ4KYgHLAP`b;S$WJEiZ4hm!TPHUCl{r&veSAPd+PQ?o{oX@PRfFDDI(R_sH;&w( zZhGJKENrLfD`YQh7TX#}%1tP)TIpIG6;4iK$mu(90U9;O=~wmjg%SICkqmR5XnQ9G4^7uoPDse5-}UGH@eHX ztFz$1)&p&y$J`z?cM#G`#R7v=1b4;z!J9P;+`dIQ6qchM+V7d}+x7p&ZGGMf4XD}C z``dg<$;lmy(5x@Jp1F8Ea{8R`!_-NZL&@~v3_p6*#ABdZ57gX~)ev zbQH^qKZAcJt#j!)ochq3ytmo&+$yEq>2ccS2RbIo&M2PRXuX)UYfTrCqx@^F{&AtU z+6d^m_WYHC!M>pc$rdHxB>qezL2HBdqWE2@Rlp=iG~L_O)b2HL#kR$dVjGA0`Licq zk1Y{ks?n;+!UP;D^${feZH70klFgF15#sl^Ui;F#Ma6`no0RY)mF>uf|0DP}I6D3< zlp_ECBsag|KnrP97%}VH!ptW@-3*9N&mA|19~PIE0xV?ULNye6Se~01yZ0OG_Pm@G z_jh^K6!ryh@a~$@&Sogn!#c>r9ovD#Jskst0(v9UmqS zRnkQ3^~M~#U-|hbs0#9mzLHWE=cxi~5X%YN@H4m9)svrf+|B3(H_@jFoq@h_YxdBV znx+j|`+-A*(!6M&NOqE-;=!fk?^+CWEB*KKFiUE7bX{W_I_1q*c+7j_9k|t6tqxGe}HEedc zWNOcgs-K~i+iE0Hv+D~z^sh>b?V!6_V#h}4)1SYYHRtn&+zGKpUN<(T7opBU~5{q)|tAVu?l;+*{@HfD{uer zT3lNT%5U`-R`+rKr!yf+$vQ0ni13VG|06slG1fpmr2Pp3fNKzqy(mxvp6OrjsCjcD zllP^YVj4K}!tDZF=d0Dkd0DA4N3+SD^R>vgn(IN9$lJ{*Z^&**xGQA7_pb>dejG&A zXqXkWeRPu9^rIeD==)855TQIB1_9Mna!xnbV_B>34+or9B5v-<3hG$0hCvUo- z6jMbz0p9F<{2R|E9G+Mha!RIC^iXwd`V(xH%WvJPgUBVLY)w-KT|2nLi(zQRmhgC< zby*%P1=M{vUPNyh8eI#4GL7xN8%NKtB=%3ebvO_LG}dpuZ~EaG9%bQ|%I`BvVBk2e z`p)^#V{{hmbBQH*3?_pfnGbn_*4Nusq&+&HOBX9ir|wY`Dce2Zcv4HYH3%mW=Nj=} z#*MhE+ozIF923E^bz8f0Y>|16PEu@9ex?aBM4_TKU-^S^V%2hbLF=*9UJTLGlh_aU z5ZkP*<CGk zHc2rdiprU&zmvw$4724Q(Trz)Yu3kuUq7M>N;o`D87w@86mH zr_`S-f_6cKJirz0(^LO1+VboNJSmzP+3!{>qpYEQ8* zE+aGUG@AAiVyVX;aE*p7JbAy)R<-W>=j|z<@Z6xFxsB~bIk=G&3oemj}l`(2x%gp zX`Ok~P%tD!mV>-LXgP>B7I?&(DRlWblyKH{6K#S6MjYMonlt;wkGLiF-H~;?@^ycl zSqFmOAEuav{m#OC!N^EI07!ZiO8FqEpxq$z(BN%bcwV+GV#t#(fi-h$deAxICBN3< z3!Hra%`wqTGG);$s3!(SH+PCte{!FG{(9)yER$}CCqaVdS`h~uNr5_|=p*f|E^R`& zg_8UmivDalLK3+xkyv^7h+ut96sP1JgErjSNGp$hKlB^V69cgCY*8D{c->0nfD?bc zN#SZmBN|um_1AWbwiNfWwYo)G>wNU_OtHg*p~R5c@7Nz(W}P9F&|>Hln)cdNoQ!MI zelW_*;*Nn`*Jntr>ea&LStdqhgH&jdd)f3&z2wkGrn`$s!;J*efQG4xp}f}>h-BA7 z3D=ukb5X2*H2vMn>&ifhrf?IN-6S9c?sOtb?1u^we!^0I?O2nVO8Qm>5i8mBMIQ7b zZPeY&I8`tr)GOAl=c*8wN^v{XT?sahAqyp88IW$)EpA~cWm%ZFvHb5jr4k(TO*}Q{H0h86Lswxq;Lsm4_J^B+M zP^tjXu=DeCO1*z{@I(&s&&8LTi-S-u;%AN(5hU@FGYXa3Nj{|34~>7J28TN!udx>G zQoQ$H5+IeglB4U2r(|49C}AN~1Vv}Md@ zq#VN;UCYY@1ygptqoZQ{!l&>547EWv2CwhDw_FU=--XP1oo0XjF4cZ<5tM%O5v!r~ zMM-Be{bRnj7V3fYPfBCqb zl0bwMySvkOoerbc@ay?Aypi6R7&^z#q4=(}Z*i^}NnRy!bU+{vj&+b?mAB~nY>Th8 zZap_`Y(B?yVRXGTsF##KcWxFtmNWigm(_*Ps9Lwd@~BW*VU&9bHpiuK>p0P+(3~NLk!$z?~c6vL^&-O?TUT0ts-C8+gjk+nB*W3N1DJph5>WwZEHeni<%Ck#8b5(!eOUnG9 zY3JC>dCfne$c8I zt&%YcK6IYeu)#3sZ9PuTXf8)ZxJy9wk^%9ZOf>)9xrkIHzy`0QWHXT4w39`xQ>0(| z6K#lp6uun<1Vq2$zsASk`-kTi6%}zNcBS_)>tqCy6(p*4f+`8vKJibd016=-pa&sI zW$wx`E?WU|NaO%J7C^fIn4NzcV1M)Gjb_orKO>~#vNCgEa{FI~LFd+3zQffSU=MW< z@GS-irBtiWA0xUmnaZl!*M z-YONz_+Ut4Sg@a5V<{{qt*3KU^BpF%BGxcvWS{W4!}+5Qfz|hjy`_n?2+xF_>XZy0 zz`12Zix;CD{ z4@m z6-p7t4@S01=T;;ww$tX1b~;}mb${eTsP5`h5x`wJ-&1PY7)%K$p#o>+m>pt>)*sSQ>RDUxGg{h{S$)GY`M=VZK0Ze1l^IXTyZe`o$KzVijVqaP^zTK z$$X&RArOf0t9?2C1s?_K6=Tc(Fn{Os$bouGUA3C%WD4|j$Kftsb^+?)b!)ZHv?Oj0 z;;nuZj(drf3#s4NfyDeMT2UGSQh1$}n2;5)R&ueFdfGXTe`zbaS;o~vFe=19muw$$ zetw;lmIkXq+wU0?Y;W@brX1n=C6Pd|rF%2amE< z3WgYIt}I0?G*K>k92;5AWZ|_HixUiNdAj_3HtXurn$>wy>SpcDK{*|B5w4)gpMV6#q| z>gk1KKXiKax3_%do}$N*A2+_z#zv%FETGs`aZU&ingg+U=T%XF4TG^O!xS?A2zk9O zdKBRzD--N(7yl~@YufUtFrSIXn*KUa>AG$-Q}O|DpXK>zdaL*D$i?fq9a(!6bQgS#h8&eFzQ|2TAibB*!cc1~{|(nVk2 z6buj^P8rhB(AXbuYJq@DSM1lzV!3kTz#d$dN+*p0|;&Aer>%$o^*`NM68PRpU;{2BlH2E5fU{L*T zE!~s&ZOuZ}?}n{;$X7B|Go8PG1Gp4Z_wlhb;FSc}Lxd`@ETkE6N3HydZ6gBd8cT-c z=HB`_p1Vxf0hE76k?>taLU^fH!;waZ-h5wSPKMg!6yDmZIXvvWa`w-$vdh19h@i@> znxM`}o($Z+M-td73B)6ZHVU^^gTEdR%{s%t3&e-RUV_nirXt%fqn)&9Z(HkUDR?x= z&U1O$UhlVjxSe!RQ<6Z(`@4-fK~@f;y9J+Jf3dACmQTbD93Al8{h{JjUCE zhJVVv=3KXvet40>=D}M%eNn)lm2d(rl8{(8{6XZ;fZEdW7Ie;S<30_IF~AqVdG$nX z{G+4{tz7>9L)Ui)!x^se?k=mhtQutzH9A2=Z&4$N-WL(Q_uh#_iynzCdhfl2Acz_z z1gneHdv`zQ%$YlLXYS1Y!fEc zcXpj;KfO0NBbb-F{7Eq{*SdDVPy80g*w)+6qGm>1G9cb)cyz`x;t}+>c8t0E9|jo7 z7Hv{i$Tc<91!tY4zjnaQo&Lhj^xR=jLLA8nCM^E1JRH&N-q<-}*}w=N$~k7u;66-! z%k2ZF3s(K7W54%2VE=r1yNzi-Ho@Mz5TN4-J0#}-@mejlTxiTSOAZ`qYboD zIs6iQH zwVk+R!mUwT$wg4kQRwlCg~!iFzXdPYrp`koQXGi zR4i_i(VaBK($GONTzBY~tw+YQLX5lirbdz(ddeTeEdeP^vFZ{w>+tg=<9L%TG}5T; zi~Z{zRbryICR=6yw#|(g2N|wd2pH&>wg++^c*OjP5)+}CrGaRtSIVFupIfG~a(~Qc z&z@($@n+aQCHL{}T%~dB%8L{K7?w7XaDxqq&YKcEn~n{!8T1{_o=qn=JZt!bov(;X zlRy6%GNt5J1?SgI-5!_xDLCig=IIagn~XP@1=ENP1`9%>KAJ-qB&GS)5?(SM3W)V% z&3QhuCPc^CV82l23CRbAkTNnn)$R6_iVr`{-TmY&lv#x@uh1u{Oo4c@Gva!N+d&(0 zqJ;dZDBhx+yp0z|iI zUDquf-xhmf{xay7`JiIkF9%>ISGw|7_R+(xyZasIW}aEk+EL-7zXX87p&Wf0AR89g zI>leT?(;EUk$T0YXOz)9F#${_4OK1M3>X%{=lZk_u{8?dv+FeIj;)ccZ-ERgjW>DDd56#WJ%KZ8gjIX87WV|_i7Nd{h+K}PegVj;(qQ%j*g-U z3EGGlqiXz@75)4#Bjo@E`AiUCFn^_@vJ5E4A8MpQ2q4oI2si@vD&VgH#;UGrbLU1w z6BBvBkpY-t_d2c}0EQrX;syX?+h9*$fjC<}hErlV@ z+XWdS{!`arsV9A3B-?@%_94Te9>k0-a+$m)bNO)mzV*2|*~jOzIX;)ICP%X@qgWCD z9-nHX)P;cY2fKRPR30)6z3(%7UBFm^uDoJIlkhu$bc0UQkU4kL% zdLZ=Un#(tp+mk1Ht#Hz>h*mqrE1>rTC>mV~%9D3|Wvy%A3$LGp{ze(3Wp!4|3j$vg zJbPA&2IAnB2oDbj(6K;pX=xx8aFmh1iwo7u1DZ=;j(V|pWuKFYE_qc6G3w_tAb^@EFoP#{(--y1Y%PJNVz2KP;sUfGEIxQ>*Lkr9 z(W5nN&Piy|GIud-H*+!s# zqEpaTH||;Ko-3&C=bd{df4ZY};%4vT>`d*e-eTHPOnQ)QJa#fp{=7HICP)yzI=7E1kdI8bv8oK%oPtkP z%2R=`t11uegv$+ltd2gJD25=bmF(h_yfh#&m8u5&SknOk*Zj0|JI89E6Jp$>_fL>> zwyuD)F_blRsA)ZAzrS_q)}d_~-?29s4HHN+y-EG3Ho&sf;ZYca^@s>eOuQO|=F&_J zynsWxV&OQ0>$_9k?{v7r%*?{#y!;(%CweCY7i*1W$@GFO-E5d3KU-#Y|M*A_rX#}t zPmU%Q2)XNd&sE_+2y{)K2wfDUMz(9qCm z&jTWM?*h*jIpr!)qU1Nz9h&YMxwF52q%i%lqj}M=GyCqDi`fh3?{B_Ri#QY2KQiG1 zQ`g6vqYvoP(~KhE8&c(|QbD27MdRq011~5Vj*`Fxa=V2;n-LSkiX8LUn7(5sO!7HU(0}aSjg*ujsPx- z1)8mOmRtP%KP`aeC{}a!*r$jX>Y=$$AjPPxLvH>nH~w@nN}MAylL~)K9~sC>gkvxm_5x4 z2fZfKC(V)2dumV=18*6!{-bPOQwN&N*;I(|G86wZnukD|-27-gunasS@ViA7IxYE2 z0O2UOo(t~yuQPBm@yW<%fC!t2KYwhi9GB2zX$)ivCx4urpcBw`JaTn?j;v^P=-u8H zKHL4$TdV=y*vyioU>6;jzLX8>ft28_3ay*A8l!c!6k}rA`zEmP;StX1iG$5|6LDld z`a4cka~H)y7yr=O&;#|8kZ+YUiQVC{rz?h2&ObVsd1Yqkl!esPqFfgez_YKnX}Wy` ztGWt|xN)O5$kFsjgqG*}&NRAEP={pgyH_x=h2x_WeU@EL=%2DRr@MryxLaET16-AqU=k> zXWlX0nH%S9@p;2l8@*~D2WXk4B@3@u#`3uQ^=vD-7c$rt@a_`sb@&3?b?d=FkIwQe zZ;Nfm=j?p(5l zU7l)W{+SllCot*bGT})OOG<;r#}KkGDqi-lU3RP-hBSJirx-LX1%q-&ylRDWsUl*JfE@kshOe+Ila zDO{n6+4nKIU!XKWNXf4%yR|&)RI7Uilifj;sgp9@MIk{a6by78|Iu1`B$&{xdR|8&Z0)ORs7F5o1u zXb=W?uDn*FSgLLoxU@5kx?M-bB5Ch07$3}90TOZ%*7=|0D6Q9a=`1q?^XVxJDgW6u zLShW{f%7Gzn$8a63NGuMFpL`;_+bISoIt8k9XjaYItDw&aS0J=M101YO;L^=7JHPWXE9olVMGwy<>vR_EUdy41kndB9F{j9gxOj0U^!PAPR^5(JwH?!Th*b66JL+pOIj5*#Rh$yN zt_ZVv#i+;e`#01nhxL`WSSHtVAIF?|CGMZRv-C9g@Zct(X@P^Bwl!Z2*aqCa8y+?U zMBRA4XJO7l0;G~V;o-Dq_P-jkrs=y6($Vks7<5a|d2#S2SH5;}^7{11V+!1%}?(QmO-wWy+u27-x=+3o?)$m|Bi8AZ+rX2 z%AYj4YV~sza>@1)iCD1sQql$EYwK3t z*oK&pu(DK$jZ#={g>VI_m5#Dbgux27d;M(%qJ2bff$;Zy=tgBensV<%bERZb!c!rF z-E?&&zim)d&;E_3ld&R;65hDr+uOPdoRzplifkKf;u3?9A3u(D4e@50Ua4-TeR+8D zFcHwqg(oNDcrLX^1iC8&xb{L?mW26siG`KOtTQOO0pP9eRsH4Fx|U$PX6V9D4Rdr5 zt|m%oyiI=I>g02I<5^|MuD<05$XAco{b!}lYhb34S?9Osei3@ve-fAxD_c!*pAh_< z*J{Uw##iDN{RJ>rj$ql-Hlkv+<2qCTDRynXiU@OBoIiIBlK)tT-J4VOC-a=6umi4Q zA=ia^;dpy+rxv%k&Pv?&;O%q*=}uez>k`$daZgKsT6ITsxWT+`w-?Qqzma{X86np# zWV0`R@$HHnG~H==DUN%^E-A!-(B}m zTb!@1X=zx223{sPtUX#-w*j<^Xx8Zvt){u`GPb%S>W-s>D0wa6w|Wtb*rzVoHV|oO z6S_CMeCd>QCoAL;{g4_7w9U2Yc9ph&I2di~{94F&gX2iFhat`nEzX1XhlZ+n_>8eH zX`yPCoH|LpLjaO9=iy-Hf691jnRSm5Br)$G;1RO3afKwY00Bzgx2gBqgH7|Mtsna|0^psr+G%s8{ zMbNNLu<3jtBaBrq+%~q|A^h~+<=4Ozgz1kKJq)>a_F0L?0)IoO$|51#jIxp|YWoyj zqty<<9tfdE(%MkKPGetduj5O_RtO`m;!AzXI?TKz= zcB?{l$g+_87CDq~*>0|FO31y(-L_XlS588PCT(k+-hmNnSX|>kd9s?DdjP1fqXSa5X0By}tT)jw_&fjdGq-%>ZfZm1jcv95eFpe0dB01UD7vs5BG-c6UEUX7OVU>2#VU;ZaT1jl#~)0frJl@$o01L@8|(j4N%h0(IYQkM+W- z^2Ih6IS^)0o*O%jb!CzI+Zxhg;%nEQ9&FuY$r=@BjkSXkz`g2_$|z61EAZofMQPv| zF=-B7(xQ-Gy4HQ3Qr`Jlu%REV=aA}}Dtz>XT-+d{+n9^F=SQfOF44 zs(tTs6|bf1K!WE>e$Ntm@hcb)7707fKSGLeXQ+UjB!sIuv5t{DY1{e01j)BjH4-MD zTk#2gsqINgM#*3f-2F%0t6-!d%%g`fT>c;kiA2_tl#BMfRk3P1`e4NR5$1cgBh@+6 z-!E}DwB@$f)wh8mIQ{%!LYaHzu%EVnQdJ_RFe?CuyYq%`dS>PeJL$ubl=CR!U##HH zcsPL>tAvYHbqhZHF4nyQ+!7-44y~KvFF^8*26011gNu(j?x)J<%jFnSgNH{)3EN0} z*K#7^(uI@V9sbUXgzc2T5_^-xZwI{TBJ8Ipv^LFnXY7}8ayB{$PF66BL&BC_NcQro z7&#IaWnhLSeN?4IxLMos3S~wO%Y1L#{4~|V;`CXFP2B-Aq9BOuSdIPuRp!%2LI1pw zS;~G9ObOcazs-Nwe2%R0*%u}(5D0__;~=b!=r2u&U7@Zd1INtbj2+NLb5KW!v7>fh zFw^vRweI$`Z~3=%bg^P?ao~HO>kXsc#a%7Z6^)TV#ET%m|7+i!4uszB`RK;XJ^0(;Jd&R|0K( z-WYmOhLXdhSl2J`W`^m^Fn#b5%--?=Ymjfl7&>_}d^pEXy2e(+B6w9d_L*pU+~B3g z9P%?3t%7eLSlP5UOUWG=Bs}8WR)=Uz;4GVU_oDtO z`IB}|)g!L@G-k@=`cT@sJQcgOqR4@AG*+yjHlKd}b&_rq)05t5#)Zv``4sEbe}=B+ z-**-*Pk*;@22}(#?Gpb|?KV7xy+!Gnmcsu^*wGpo*$Kzwp;Ic;J(kB&Th2`XAkI5c zz%*-Pyb5yNuJC=~UO$7c7qW%XkRVhBZ<#r+O>h&7dOk79{8=&V*{X=S0y zgqXhaOtD_lx`2_VfotjNWiW>dc++MgNJdMGUR3$hx2F^Q zX9wNe7{&V>JJ>@Y3b$8 z?9;2jL@(D8y|#-B4>R_u`=f|ioQ~EMzl!^}Gy|6taGkxy{D~QG--$SyBXnq_6p`8! zxkKU~&zH+Gq{>keVu&bH2BK0Wr%k-=TD7d!EOmj~Y<$pSvAW9ARXMgFBMK!@P6^%@=?BQ-c{wW}s zAYP+(zbGpU*5r5Ai(Jg3ll*acx($+q2<^RX$}AseYKQmYdbeNfCF7|4qhrmdjKnDG zc!W0;B`20}GPiV@tSYrrg(LrD5x@84AG1{>VQoMqK>u;5JsYVF_JJZy#$?d0B{{W| zi4dHEpIL@hfKrN+7M#ds%Hr%KqeOF1c0)K5YnAx)JX*IE6I;8;*T7>$HJ7vrn`9U(&bbW76-1CZhQ3WdEprW&jd6X`pLAPUy&M&V?a2LA!E&3m zFp3?KY^E=NZVi7rrZiEa&2g&PMPUjv_pe)EQz#8;MAg@p6CSq`AxGQnL=J2o|6-Ag zt$N#}Vpr}ORlXlS9fnDnldypZ0bOe6!(rC#QQj2rJjd zg_BalNM0TYAwfc^*+)>=X8bqnCO$BQANNqnnK&rPBAihXQcYL9+A@~iC@^qm|FFHkBhvEq*DhcMWcVuVZnLHj-85W1%>K`+$CvPIG%)Y~u6n`` ztDds(e0kUF_`Y=&2J!@e%X~=d0EWhg5RZuo*xBwp!1Q_p0ia;4O#C2ZPS7Im^z<~w z@`UNB}t+@>L})StTxGtR?6S&I(}DJB)rooI;}DsovI+;- zWs)Igs(%Q)!N%mpwY_yHXL@lqn?fMNhcz@&s+BaGYoD`-!)E6m{)=~jw-5!%s(sxM zD1@nCGw%KB*4rN6-Td+PhcD-S+86;VoQ6ZJ|%n?gv+KEa%1wi%jj$DdE5 z^U$HnB;$ua8zuxxho7}>SnFpz$BAYumK;Kto58ooggWn17WgJZ69tAtF7;W`8YaX> z_G%Ya@F!nm@LafGU~yirW+8ZpSfT7g;sMM(Va!i+g0mu9u=en*Olx+6ho%ZOg$eZXg1gdD?YuMzxTK6+A zO;M>*GB$BK>3bKa%YvP8pHC>ss<9%F)#7gU`6F zwG>{D3Gm6y(IMjoj-A&H-qa=tapZ)VYptSuTYee5j7mxIl3$)u=fyV0Eht=y;r3g0 z-TLcHIil2nY^>aF6>4)BEc1UY!IXO8g(vfIt(eZfg z^S58OHtCNs|ycN=IEa~thWoP_0d8@4G9ySxWh(6bkZwf&)!7C)8EaOe1UFJ z5FULM1{;7QXNU=zGa-5@@4NQNs;W$RtFz^XaY&DfyFx=8$+jBb;(UPQk%iSv$6Oh5 z;wNk7$`U|B%tk+RyKCA?7tHv^PvwD6ca_sS)^obVValtM!{k@23X} z%aq?PQB!P&44R#6umX2FD+&XVq%xR6rMp-z7YUQ~Q)}r>t{J6ijUnxYdQP|dDpXhn zN~sAUtZefpBp#Ba#Dnm%KFalq$_uL6)tMTHv2!^8gc0i&RJ04ny7^BYmK<_iRPJ^; z8BLmB+WIi*>xRU_NXlkUY2RkT!HWjf`!n47s*n|csdFY8A@v+YIk zYj1maOJs3M4e*fDJj$=5z;`YEY~CEarX;wr8aku}Qv%c!r^7NCN$5lj2~VqrT{tgP zj5u;6&$W~|?w#{NM(5`Ll65EIdM%n@jY(^W^FWp*&hZcn_7`2I3S4=t&XPYL{iQ8V zyqi7;rJX3TX7A}|`nVunuSfDx^z+K7>}!myAEM>|sNpk<=sZw+B^*{$RLM(`{Ogz6>%~Dd#q1IcI)DAp zTkCXsmC37Zs7`9IRDdF^jh4hBs-|e0Uvak>#QFhdp#>4|1qX=^*+|O_JXaxRZe!d{c1I$^VrM|IWo@RGw!H6zV z1>GuS+w>RD7|Vo8803T!6Ow`c)$BaflEPkOO69a+lwUl!ltRtQ=>4-8ed$;RO4cAm za8$2fW3Dx46){?;o_qYyDpA?@R)S#bPdZ#3=pwg7OfAhN(T4yBGY4_)*V$srtICAwz zg-p5wwXSMN%$d2}?(f@?h-%|GZjYD=fls^n(^t`XSO0|bSLLFDd3hH0&`6jhb=&Jk zc&ia-KPLLR0+ch~e~WoU!)6Dp37vDQWPX-ur*t`oX8AGB?qh8N8K=VCHv+F;5klqM zMgO$SyCm}zcObHT?9)~fw4N7uUjc5Wzvl!D{9AJx|-?UYu3o2qo4ktRf- z&?fa^!6_E=e`7UbY5lXRF1JpF8sKax2Sf&hKFlLlO|D%PMu`_|EP*sx*EbyEPN-}3 z6se_>l5JaDYC{!tBukro0>Xo72MUuUi@qn<&=0wi3FuECYKgdmH5K*p>Y56P=!yw+qtEj74g%sC zE6yrF7wPYjrO2n?k?w08>y%tJ_I$k}6D_SGHp0!IfX=R;v{}82?Y@Uc%G?Z!Fwx^- zY`0b;-~~9A?3%Ud6=9mm{+^Ei1^der2p3K{>pYg~7HoFVo3AfIpL5tX!eZLIAFiku z6Mr0_9wB8}et!QsS4lu3H8A;^-rwDZRyj0&{P*u4xEqP=4n=bTSISvEz#%1?SeV5& z#k93|^zRGFB+x4_zF>Z{`9>>}twsO-dygb!+XrbEtVlv&B34fJtik-5mK{sG6=IM0(mFsGl`EfA9J!*-ka8AXzZt zZ5XwTlM-jzJcWClO8X42QZFLV2YYqy*WtgasZex9td^0gK#ElJ;MHjRTv_V&l+e{U z^SPGcM%OpkARBf2ZuJez84;s-4rj?39hOda&NaU&XS-|mhP|r$c0ZjrLA$;Soxfc% z*F@&0%MTUI^|ZSq(I5_*PRrw0_|F_gYU;twp(1Sb zG0DwpC@$tPRi9WP%P0_K4`@>=d&EpGiEoZ7|HhV9%*B-8!7;3E2|*TmPgI_1YJrx; z+Cjg=Ae#^`+Mo;Z!5Tb}m?$-Mji`*4HtP_~8-6D4L*OKEux~4wRid-lqXYNO%qjW) zELBJdolmBd){S+DjR;mlasVt-d}GBN%8XGm>(pPBd#3Odn@Yfoc_!#$wH$3!%v@3l z;U`+_)g2vCbsckHK+|?b*~Hi#^L+7rNr}_#>C9?sz&~@~SGF%QXZjr}a&U96_C^tV zZG0y7I{ZNnDA_I>PwR0qUSlpekOR2^Asq=OohB|hVqv7p34_QQ^djZBg89)y zGZ->pEoz{RrFUy;2gG-YLF#~hCbhV2Xs z%;&>bHNDUK{F@{-7V{Vh8jaa^Gzowei$Tvz(_RQW2Bl8F^ypD!AY<>gD#RLNW zju47zm*}fMN9I9^^*mFeh!vZ!X#$0P7GHHmio~_KWP`?fJjz+-=`m6a-hi%Ck7YT( zTpC`#7amh-Z>OTBfDo;Mo^Su-#p!z%$i&POjRl%(ADvOT7YU4)=+)WCm&)pRkWRF&@H!{*;2+b_J0%y zFKgcGpP_u@{HKIdb|q(K4YP{kD!i4DV*$D1EynDu!_MWlS<~`TJWMsL*_Fpn6WewT z-_!&{fRF+{!qP@2a$v<^jvY~E;$a={9r0g?)3w~Q5SCBo$XU|sh@}~!o%)h{szXRP zth4#iDD~nmtgucD3+cRQ+x#le9zO5NSv~Y+iGuhYHkeYiKbVw>VyndhTb)A&n^8${ z%snZ8vJ<>tZ!OQoadQnM4X~j%Gz{pvrZgN?6-X`~>gQt76{KX; zjh(^et13NZTn#3dUyNPMQ0CEYh|~Aq&>DOs5NT&JWv~5-CA4W#){#E?Z;~sry0$Ks z^(%INUCoL`p+x%y&nf$AXK-2n#hLz{Y@XS=BDOW(wq5Gxd_0(dCbVg0Z#&ulzLBy0 zk7pEIuAQK}7k38Z?^QP;GVpGW-q3SFz)H1l9CfOu1z+@C^A>L^L73%=9oQgCam1Zj zKOBez?Gr5eCRs$~a(p7dLW7rU!#OU|wh8yeCirm~q0bq~z4mS2NRd|X5xqfc$4a_| z!AX7E@4ASk58lOp2PzV2YWQU`Etj_;n`%i+AI!Xd$)qz6)Z$s_<#OQUTkA5^aNxJ^ zh#^BQ!+@g};7`-)Y4YeKtP&Lw{5*_f2w2mCZDtt752I9(UBPGqQfLnj9Kd+!xSVx= zndQ9Fiw*c0j_f_lAK>=e^CgLCCrbwhpzeYFSF^#xA=LQvY*Z{n?0KL~>(ngv!?j1* z%>Tfx#qy^%n?PP%-!ROVOEaVv1EuPw0Q>z=in6lu1UQfd1qC2PS4GG9qHiMrX#)Ub zIVn^sXgQ}u>}#zxhgIHmWfvTYH5-GD;O4>KaN07rZdO%rPInS9tYgwsbC z*q+>3R8a;~pCVgqR4h4LlPI!5#HUuue{u36f7xFyrt*jpX`6*WKk;n%;@!mQCF(md zV+_nU2@Z#hDd{5}#aIh^yBNP{2lFW7RY_9v%#oipGQDHXkvw%`F0YSmoF3yHvdiFB zvQt+}kPK()zz??ruHPb z;>R4faK&{(Tm@#-4IES2_L{9&bw*@YgXS9N?4RM(soo5&f{4Cq2U_ddEH9IGJp6NdO6pH+1XO+(}ht?OImUyJ*VN6V3Wc0d`bI3?~`#LuOR- z0oAtg70beXbXiFhl9l_iJI|H15&G9$2(fduO59}YrM$j>P`ssotY;a)&SsYeG)Ze3 zPhKOcGD&7fTP&U1DyZ7sUiDSbjjHZuVa}Day=Em!)Dw6 z)P&AusyscKz!;By1qEOcQRx?qVvHl-3f0sKP_l`x8}N<2x=O&icpP++1vj_Cs6OgOF5TpOT*9VN@+E zdl)NcTRpjjGe*vy{s9)j9bM~a4erl7t-G1z1+fxdGOMv0eB|dI9;I~}YYo1}Y2bq` z4^%brT6Jd!P5Y$8Uk3roW;_evm;*8~8dMIQy-E1$(v>f$Yxq?UrcM5*#yCch2R$`% zd{7=t3wL?;ic|e`tcqzA>(xK{<`4^XkKg)3Aw|PIi=`Q6Bz2a?=r@l|#GbKU21QnF z?-^!EiDRD`@O-=^CPB<^wXdff#LExFvS7A5P0($Hz4`S^%^h=ooYm2`@e%CHGV>#`5*4k&5_P*t6o_+~ zU!yUKrM7t~#pWttWBX?rR7!Ibr+pzO(Y8?pWYq8G=c+AMdAW|&)aEuE`!VKI%%t8S zteh)hXt(B|g8H4A+aG=7er0=IMdxUUBrNG1atZ}%)NasqTc5g1ScS9U8n6lTb`fDlHN?+RyflApqMeF1Kuq`|30qLn>r5I9|NGQUdY# zHlRpDPwT+}k%IAERzDDeB@6aC@wr9XcfSzYtg5b#dS*GAvqj#t^1(=S``gnzfN_Nb)Nyik$|75l4rZn%dZVopjBcV3WGzdSQQMT)s1u_6CV5@A$kAJg083R zlzx?+Le>_c07s`xLT2w;OHr_sA=I3i|Mt~t7pLz5#Kb#_f?UK$XaZJQ0E=*i$8sxw~hDb zvqE{fuCkm;!OOGEkCeJ~r!!LSx`;##`^TPSdK;Af)0|*MRDf)$OzpXN4Y?oBK=j$D z6Wf&D5u4%_op!ap#O^Ggv*J~bIQ6-Qp;d;v$}mq0 zvydGP`!)@I@+QvC8+ps`0vYj}8N(049e65ufT{;Z77-|}Fe zzK>H`_Llu$?agTjTgZE{oCP~nFadz)>JG{4H(Eni>91;b*An2;;e&S$F8#tuNWsLV zTP23EfojcIh%1)IBWb*LiM|h%iN!Or}!qr?%WNo~oTGt(CW(1*mm11YN!C zlw1b}SsKuNw{mc3s7xno{5R~ul8|H2SDAzsaBxnEQj*0%Nzm0C#wMtXUNHm{Y~tO- zA6&`Sl%&H28kuT&63+}Mysj?s0aaL3R8A^rx_H5X-WhwaCMZ-UysP7HC0Z{PMMUsv1#QUNs^N}vRn*p9i+@{IS2_-A~7=jsH zNtS)Krwx7UMN}I3cQMRbc)Li_JVG58Vf&{7#J>MxW4Q{x!?u-AmO@f5$yj76<=5cM z#~cg!Vl1x39|Ki|9lw&&#r@vD9mrcP8C8!{kB(jX+WEjIYW6hP-`UjOMd4F3D1p?ZLt>>M*yvu^j76jZ*Gc&#Oj$&~>m@@9&Nn*6 zH@`ADsSwS>@PFehhEPuHrq zof`s5Nx35gQX?1$Xzzx2*QHO^^}oRtXA8Em`&t$)X+K#>8kN7~<)J3_SbTKBU@e8M zn%=;u$$rAmNn9Y&l~@Q;sj_A{*vkTu{YQ#w=IQ1IJ$$7MSZoP_6knn zhPrZ6{zg=t(SFg#4+|QhJa`pMHNFM%jB{mvvVos=vvbh9@AAdLZkhl z@w0ki0~p#%)bctI^(-~xu2SgxI4UxwtJ}{$0J}kd7uEU^nz<|TxIeUAzbio?EwzJt zwiK@ppeSfeQmS&T>zB+uJNp0b7$5_v$Cst;yM+Yr)8x_n80d$#%NI#@0OJ?oX?l(H z-TYD0*+F9f#FSHvyYsYN=4WYgnBEF>Mx4Fj?l0yg+~y~ERg}!Byv{zCanna-RO9Vz z*LA=i8MW|@mf`&fYJAY(Kr0+LTYB1C=aFv}Th2YPW{A+~=DT&^FZJjYf!kMJFJw2~@d zj!exk|9*?R>9kw#yNqHgT;h)3)HC8n=abcX;*2dSiUgb8k1(B1!GZ_WyJtGZkRh8` zUWon0_TXOil%}igQs=Y3dVWWVS+bQgJ(tIu2P+@BmjOSeV5av5I#76fxJr9Zu{j#a zdsXXG4rzbnCQJiJ0B}G~`|amu-rkSpW2w7=XcoBti8_D{KYTJ%oGuPbA5@}%ev;#% ztpm899nJ9`t$`q;B5Liy9l>oj>T_0E7zQS`-raWdyxReJrO!K1zxZGE7PTG)|UO))Jo# z^<0lSLTVC%h%X(a6d=YNk)2a)pA#5BDd->T+EOkngtK3#rnxZ+zfGtxNtJ0YMynJ@ zN^$hi9kP#`WF5zg^&iB4_Bl8Zm^Q9sW44mdmPfst6vozYk}i)-exGB%GaN`YvX9R9 zD9XGXpA&FKfx|vVJh@TcTS@oaLvyl)`oq=*5}_Cu2Q6B9qv!(QH4o zpd$r6H*!pDc=(38pr8UUAm*i|&&4pv-^mY;+~I(-=f#3UF+YjuNHdu_udBj1CpY^=|0}AV!|#`WzE=hQ zX8&mH-X%I^5L}^}GK}~sP#h&gXVUExqRG+t!H-36C;3yTy(G#*-G!jXj3ty@FLs3ZEGkx{KA^$graKTZ zd)^YM%O1eQ%Sz`syX|TzqugaYx%=n!3W$!*?H&7`Vh#~NVu29ZaavAiEK6zz9Sfq9)gCh0dAmMwguK2frB!|r;yp+^%_XVBevj14WZ(J@b z0BKD>7es;#z1NcgPzw+(u;SJklm~kTF*M@V=CuGSK54Ozo#^7#0c>+{2VECWZvbHgs0++h)`Q8tJ5XBsgr4fk;#Uun; zJ(QwmPdS%OXQQi=DriFDAldpXedZlF=(bDj-EvauzvRn#IeBzH-v~7*rjK7v zBwTzJtvwdR_+FCS1Zk4tIXs&Wgf}kT1yH{@A_ck0GkQX9iR-WV1Bd% zw1?sbUN_!HH#e)Ao8^WBop`n&`2F6JKR)n}>U-XKDI_T9Ljm>Y>+S!BGanixaEwfs z>-rsHZwI(Tnj&;dHGe7hXTtl~iSo54(PvL=$W`Qn3KN>PO(nbKQj7*XIU601s@A?r zPi)sePOsdPm|N18-}{+doN-)|b*4^#`N&C|kgVFJE(<%p zCXmkhO>ch~q`)|UUAN4_)}JJPs^#QcZ1v`_4hqFHmom~@+!yx8$0}ek$#PzIa@)A* za_e0B$h3(jRX9SRjmK0tRaEYDoNwpiw{wx}kAiVNGy8n|iT>%Mx>3Z@gbS%%gMA<0 z)h9o*V-MmyS5<7AhD>1{^ZVV}4(!n12KNRF?lj{*j_GGBl;3P)@1~pe5KXVoc;+^S z0~uf=FS1d&Qzqx=2?sdDosLK5236EFA}ym^LiMX(oPB16H|(hWN2|>BR{#A)diva% zQY@YCiljz(H`Re|FqoP3FNQ4xFz+{({2os}U&8YWv&F8#gD($)OG@_Se3@}> zr?bD_!1P}%rek`Ztdo5-m0d+IMMuO0ievl*;OxnSI#g{Q+ax1dCjH5+9`xm?AzK*6 zS_r?47WAkq+cTkx{5bu64F{?L^i>&S7uPGvV(h8Po33W31?lu04y8I4W~ZsW1*`fw zKnMKg;A7{7@tSb_S_ET*`=O4-Lw9q3Nx}dO|$aT9oz#_8pkk;UM zJMFkUdVe!|_-8bL%=51^CZNZCh_(V)VAa5@$p_gjP!bOJ*`j}Vjx;U>h`_y&V1O)M z{y}ci<|QS;P*YtU{9sxIKJI}ZQI(zWeV>_D9x<^PMqAT=`*#v{cDjzdF=_yw?u06D zG}gXd7#M9xYM*SnYpApX6vEPX+xKFwJ8^-&=Yt-o@d2vTzR+$9uEvGq?;Jsq|F6jY zKf{J2t|D*U8OxTb82OfCy=?txQ27jGj8Y5yrvCp>^_EdlH&DCx6b#MK&5)8RC`w3! zq_ol{AteG5(#+7^AR-MSf^_!~($XbJr-YProj><;o_C%13m<0IV!_OsJ$qmKx_;ZX zpKq&;sjUFtVSP6F%-f{O81InZ3Fjp#fu<(bn2N$D-WX7{C$p(B@8^*E@rNHp$HS97 z%Y72PF((@P9~-RG)ABTojz4({s$(?3FYKeVq$SY>MsTUN5#AgwU7SI&36s0O<~o=+-QZRP$l)b=4UDz? zcK;1Zng&QQ)=VTjE0=ezpeP z{TIzwx)l*d#7T>B3ci+X4i2OHjabvDrL>8s=ANzzLjtK*K}*!m@!FS4Xusph+-u8@ zw=@@@kC7i$gBmzr4^IXinVj;f03k2)Zc;~qj1%@FGhiUu1%@72W?WwGd1ceI@7K$W zXrPm@JLV>hF*jCJszFjPX&brtjh0O}6dvoeWATZ!zT8OZ#)8aUJgBf)o^DPS*%Yd} zWay6!I~K^2jc__I->de<+UMd&{Dl0&OdijB>I{DX5o*O45k%lBnvmOT%?`p&lBnC< zYvy*nU_bs=7E*1b856b%H9b-|)@CrDXZ+_7D#`0aRChA7z5nH*4=%Ft+HI%aRt?mW z0BiO|4%X8Se^9WExMssO^#f23l>|hLit#Lp(wQfhKQOG|p?rg4%0ph%*5_tM&ud6Q zDW^iEfbKFCyFQscum_thswnKme}I6|t0ytHiW2K!C%y`+C{(AM09~n(hD7~T$x{r! z(+|FIUVy)=jXDNFN=-qKa+GG$@dU2;zlD-sMWE5Zc-5s6NUGsH*E4ml4ACwM>Z}*} z{o1@T#8<-oiGrbjm>Yh{$HUyAJAPo4VWzC2{EwsgSch@;-T$O^Xgy|e?pNu@S)G){eE5m9(O56Z8UK+ z1f9iothpZ-Ql{^RMXZ}~KjC=H*Mb(`m#gRJqhj4M0Xg-oNLE~3P|RzJnsuwAvg`ci z^6E@8OhWP329eqZn+1Ku#0mS@!3+Vz_SR&^N|=bFak<|_ar5L)^G!G7Zo2NOF4o~J zCeYmOScRSxFIK$E?y%S1C%=0hy4QCD`=2mI%GJCwV|KYIm^d^Tm8H+cA>_8x2xRG5 z0V|w*?IrYuS}WP*>B1w0x!nvv$Yp+Ox%S+pamdu^fbMQOxxQQgd_5mtdtP{gFjrR^ zToF0j@%|PkN)QH#??p8XV_b@oQi`q%Lk-+zeXdHgs#31U5RA~4oY9ooR+so{!&mJq z{*UWE1d8|+a?Lu9^jl{W=UeP)7wgodj#b8Nf}5hlEE7h1jPF#y2#{! zE|cuo(7MX9ObXUunP~8{k157e5AdTa?Gq(Cj{_|?Q-O3r_2j39LLJgw6Rh6!z#oTG zV$x-0+yCnY(C(GfH%VF8$!$4jWOYa+?T-IWt{$^%-azC$U*>mTLmC%P5)^;TAia@_ zHRY-{{6uP_aq#t^SYw7WqwXm7kH6dFQrjhKJYeagsRK;4)WXuV+xObPAp|SalUIu5 zV|=?IDe};8cH%Mux~}&xc@?fbaj^=aQ+#x97Q~zhdL2_gvg=RRpt&+vI!>T$X-BC` zZgZNN==iefb&=a*I6T>d*);k5+Z0ZcE*&&?>i!=G(`_$n{MQoYejgK2vmo!XM8Ad0 zg&2wJF&X#M#)SYjMPS1>D$qn6xQ)}E1hYxaDzxqQ*ob{|KTi>|$MY|oRBt`*!m(H? zV*~8&P^(VKzNik}SW*h`)qqJdVmf7`eOo14Il+4xlxv_DYL(6kLo&^ zhuVdH9+J20<7|2`G1RdEYUNI98ofIX5HX)4+6#E~YU%3S)v(--3I(dGHSqAc2B|kx zoV-y7Hu7w)9&9S^d*$WzVLWasISa%vC1THaoCGd<$fvBN zs@U2`7B+b9FilCZH;{S|NOTc&r;ySho{kEjPfJcB5nG$!mzH{Dtn`b)8I(<>{vQHn zDm$OepR4BCgy$f;=A#7X0#93Swe$4CMf=N|nj*UyFBvmDFKoV-d|zDcO%U?A5V-JZ zOulll1cn@7Ub#cZpd=qK#Wqz{1y)x-0hElD!DoA&l|$kYK(QGZ7}&vaym>!$`;{F4 zU;zD#T6c?DL7mv?bmK;^Wtc+*JnKiiDOM;`%&BOBlJ)@|FV zzCWhrx^+c<;U;2NJNJKLy0u9N*n6B1PrRpvPk3>$`5(eXMXTY>cz;1oc0T&4`gZ!^ z^9-tX>di5R63$_2`x+~x<1dv5YgUVr!?$`-=e4VXu0H|G+t$P-aP=v;xV8ps`)9|S zN+=0B8?6d5Fj|Fp-}z7Q2bDvQ!U$+xj$J$RDgPY+9eOTGFG z{8(96V^MlmZtl@zW3?6oR0N7$>OQ`DL4-YfnDsAODr$QN{A2=j>s+J3S+2x|ii^ml z(?)tN6r`Fi67u7RgX!xf3G+AW%|Ogp0vq)E!-9$VyT4k~wR`FAo7uOK?@nO=A5pEW z;es^(>n&4G2OWj-j;TR>T8`=0l777W_dXHmm@S{6On%hMUOBe>0xaP$zDfK5|7;h# zVzVhB(^uxQrMfr# zb5#rWbnkB~&%0efHJ*`mx(1zF1S4T=IG2pt%tU7<1Lok3nstB|Uf76NDpLmYcghPO zUt(Yy7gQu27@)^|Z21>*wg{Kd1>B-DP)P_epf*T3oZG}_efMU%XF=npqRLc+_JypV z>0>eML^kn(pO)>^MR6MdqiJE`_g*~qnO$wp$3NARk5f(=={}3?v>f8qb!Kw{rkmg< z>>WkPo};&mT-m(+XsRI7bCc}veQifPB{+fpIh-96IC`Ly1U9LWy$*JC=;G3nPjiJZ zRf*xgB#^KPhYS+V;(}B&g(Hj-$a)Nf!*gUCZ(fY5`_*W~vjv>I*s7@DWr(Fb<5j7g zxdh2I!DC(2U->RpXDvLmEya;>z)B+C&Mj?!MXL9d9{OqxJ|!E-Ljv(=^D?QmocqiO zY+8Y}MjPN9U!>oUxjiFvX^ipox~&nXa-D7(tUCXyn?{=YgWfb87|7PkL! zr2w?do&EtNnE+Arx7S`X2n9?sje9MP;7=d2fVjmSwiH-xrhNL;2Bedl}HkXBY1`Qmoq(;Pu*?^y`+GuEgQS$m1@pQNX=kcWTPtc zbw+m=+3XA{`O6Kb*GeLo6vsK}gFn7bzh?qy+py^Ah;<~`lpx!I!Jarox_N9 zA*?ce+}+}7S2np*7?NLoS$O;iOrU7wSq+y!kDTZ1_P)R0i*gbYyf0a5fj75ejym6F zCf^i)!5lW2->5FW(q|a6id42z1Z^!rsr?VNk@oVYJS3xkvv;0(O$4sni`naG>_L)U zY>z8#x~>_iunAmibl6g=Nfvl}C6U_9RrD*xiI#Q8VpXEm58N zN74RaTORZvp#tt87DOh)($Qvrak0p8LMk=b4JR_dQ4HK9--?`{g3z!&2WAO1;*xu| zc{ci9v^Y~-K={gEvIWTWhr-zm0K3vEAgCxQ#7oUKb`pjnn0Yrv_wRvCpqCG>ih3!S zGcP>xg_6)X5f8om z+ei#3q7ts@v>w|QK)8`u;)?ICcmU(e-KqrWHGmW{()}sme-~seE}D-bzFrcnHHb=Q zf#2DbI!+p1d;v0+U3Yme7tqz*ok_{!e8CU2w*Ke;sR}}X-|vI*Cj={P6C)|4l}GoD z6tCD0Tn>z^Ufn=f>K_~6n?STgtKKQrRWH8U_DhzjodfZ4S#rCVO3uQ9Lk`}O`Qrfn zLsqcoBhKxHyu(b_H=hQS(GRyiD*!n>f9Pa~)Xt}xuxjpCl5G4#)NjJD`G>H}JIs<& zsw=PG-8b|jtw#U_LI8zpe*OKKZIqgN_)>YRB{@L_D%@Wkrb}+I{NblT7+9ZijFYJp z^(@o5iRA6lEkQ1ZPYT=hdZ0*(8&^v`bTRUH8AP!6jS(J?$YS5OP^8g+=pSf&2$sVo z;D7x&ro<_IFogfvr4zk~3rF%tKU8(KGqC)K0P4o~?@j)dg!HDFJgxX{HlE{ySfS?0;Jg!Z)YGi)3OMHbpti5C`O$RU8>zpVunz_Vl%PHtmcVQLWJM|ZS!I*`4)<0aW?B^^t z(j4W%<)KGxH|*@r9oM8@T7RVxEe|vC0183r)SU(5_#*r2!ZUd0O2SZ49eV7+g9QC$ zlLYMfsg}p#E9K=Q0HvVkh(IqnyTCOyZ8d|TiMvh&=zuiH*(-SQEusXZQrS?@z6$9K ztoXZMnQSHH7y1zj7ZL(gcwn@;c#gD*XHn4-f(?=AC7ZpUVyn3D#3EHlkuRN+dF9ar zY*?qO?MS!j=*~uBj4`K3FM=5H3(gGR3!A&=9D1wqTtXxS1#5#8?sUv=-@bJvv=Jo$ zO$8uj+?gzHZ?ac5fTn`(&VlHD^k0EMHf$SM@3z?7`HbJ69>5)Rr{A&DdYA)d;|J#T zfVXiS{JU|^)9`PF@1fIGKY;jiD;fdpkAS^@R`cG^J?bz?Dc2~n%G9r$+0WRc0uR)c zisvX`mn(QD(legZ=uFmJ+ z&{BB=YZma0{2u#h54gatgHNEB6|?ko;L|N%W-5o&11v-Go`|q@DGydZ9zJ3fx_)^y z7yfVEes$j&Z(et@W!J{Nwi*2}RV#{I(@8|+o{L-VtWoz2?R{DbdS;;&l^I=8JKVyo z(B>RTT-*Vz<60Q#I0y6=>j?^!p{`c_-BKS*)I1BPV|-?ml>NKwL$GEEE*{$tP+W0x z+T+K2UAZwg?BX{ErAwa|uBc4$`F_;AV)Fg%eq}>Kh<7v_{&)!Y!B)c;ri5m5hG|a* zd_Kb|+^y&%7ZAa0w|-P50sDQuQ83%jAcYtFYT(q&Xurmqwm^z_?KUf;TJw1-ms`Ni zd);B~p5$+|N1oV%AVIT1j!7kb3M%ISrxL~Qw_!w+TK*;Mkwwl?2WA%sjaXx@yj#;+ z?;(7JcHB+^>5%K05H=u1!@XIwT^~(@KjJ4Lk%GT4SnK6~#N_to+9nYd2zn;q+vPg$`|dnTdd z&8iHye{nF7y$L!da%Sy+)U@Zb*O7VihZ*22dw~I49q72v>+M@uyIg#p^_pHCQC3a< zS1dnG6BTujnBK6b`o-D`CRh>YfP7#k6;D*6zj^F=x8+C;-p21kyZZR^4%s4}xnn6* zl0TO~Al#$Cio|-!*lM68c@0Wy%eG}koDA&vRC>w&+Z>!JR*diq)hf7-B-;~eVx%Z2 z_B$v`RfpgozAMf=1TZW0KZ@ntdN5c?Kq2~6&AX9x%+VC&Gq)Zi`mo`4Fx>k3&^;5yun zKeImqft+EUiRkF_q8@yjVEy# zDj8ySvIS*aujRuVI0B`346i^JOePZ0`e}!Pt(8PGsvfHeaE!hc{xlax7Srx&r@kn^ z^7wZ!|3fO=O3#kY4{>K0N5cXGD=&A6!Q8fOVOVRdA!jp0$yQ3)$7~T^Hu19x>!M?0 zJh5YEhax4tne@ZF2bQ+ZrLG>0KOPT{m`fwwriO}Ao}{7U8oUp^*cORr8icQt7`cbK8fPEG79fha=Ta(?cv`6 zB-dRvrYy1IT_v6kn;?q;4+vzK7cw!Z%Kk+hp>X+@OS z`g&L7yFEb|Jko#b)72n}iB|WucC3D{JU=GGt~vTX*2iuVEMAiE_xyXXaR;(onC9nb zOJf{`Dfg$*Dpag0orjtg;laPER+@08eN?-*uxo0tx|fBFlK9|c@7B!B1I=(@N^&i_ z`bxwK297Oo6D)O~H|rn(u$JTlCuN_tJvnHx~5TMQ@X zZ`-v^Dy&hq=NidSWe@%3F&VJbLDccFV>-$Z2@xl_ z7gsl!Y6RObIdv3a^;JOVW538$$mj*TIV(Q8`1mpv<3%9(p(wYsRB_*x4n%GE2T`Jn zb8OXkC<5IpqFp?NK9WkkC!>Zd>4PN$Iv8VfXXUhO4|XmnmBz6M>+?FZ)fMk{TJvFY z95<#;2`RnG@+p$aSW*f_talt!6w?lUP(x-Kx41qk-_BNdYV8Un& z$}yQ7Qm&e{Z@N0{ulvg|we*F`r1Qy?VZcgv%*xrpiu=hgtAlYZwWZZw9ml&Y-l~3( z+yg)6I2Z^3n3UDkg?jA~THOH29)MZ-1NcA#Dx>JWE%4pz@N&NVw!iL=&c~R(DLrFVs5V4jvhx*q*rv==y@%zI=R~|wP(B=C*+1d@MwOct%1_ab)l1c-8ueKSX zT3umVzU4yN$ZFbG4ECAWdWPN{4Regi$&&yyqW$U$0Cu*w+jt)rl`h^~mUhhO2i4b8 z@jppg?1}pT0B7?-p#FZkl#F*!p@?E8in0mMY5n^=DP%|1QYaZTL)Vy-^x_z6tO5CO zH6!Uu;^<=Bu|af3E}uw$||E>vj=~<_ILg;u(W5;i^x3E#$;)uU(WRG)FlBTe$$zFoczef z7L$QlFdv(1rviLn;k8hWkQ-sdF#i6D2DN3sU?B3T*rNx za6{~P`zu#u#Izj=iVS>9_O@`*UKZiQ4sV?sOL&-ySDEpqutGFY$@WrWiLg$e7uy(- z4bq|boT}zT?_ojD_uqf?AO}0|v$oR2ti8NPbi^u*OS%yKyqL~)%qP<>GQK7;ExYrf zy%jqTr*4S_p>joN9Q>?_k@mt=Pd~Z z`9}}sD2Gp_?Y@*Y%!tjCvL>bN?Y& z$WVJ?aRzK+&}H>4L$+7sl z@_Q9Xi+mA5uS-(P{D60p*=g1u&J@^2Jn!}J?%deMsiXp$%Ge#;?7XqxNv5{==WDA! zKGlQ8!?k|DH5&@0M*iZd?QG-H+!1TQrIlk`YA!^72a*BMQy|Cnflu+e>N7=VA2YAd z-ZeT_PA`iQi|Jeru)?t$cNJ_(e=GU75!#-L{xgJP+TUF|J)T~(k|>{jkf^P1^CjtI z&bkZq8k^dQP_#b=wF+XtRzao;tFL_~E*O*dzBLz4Kgw+_FkUkvehVKu<0razhTOVt zxFVi{S(CWyTW)N6a?7Cbd;-7vl45$nv#|`h;^gS#zGw2M=#mX&fv`|N1>8FeCExd+ z4_(_kq_{^9_o&hdmKWHQRp(@RKHS>$?w0keRz`rcAtREE+uiT_61?Xiu8rN_Po+^B zVqLus90FkkVP^FGJ;mBhvz$(LD2b36QeT~)fdYQ~z_GJ4uhL(@jE+K7Gg}z?`)jj) ziN>^{l&zd4!y_jd;1p->2v8f?;^HS5)ZpMPe#mLm5aXZ3YGR!cmsqo3vXlp5!5XO} zU0hBOBDd@KsJvkpf7*d5k@uD8O3{Wfw}Ux2hM!bfIkgIpU>5eyd=_N`SoSM%UU;%= z3!Dn8>syF3Jr}f(1Ia19JT-1zo6%r1>^lQENTGm7bai{MPJ| z8hUrzoj{pw|C9rA{LLY4c>VPA$-9#Iw(fww;V0hj-oAeCV0}HDwvqLi184Yg8;8|? z&lP`TbeF&Pzi!FO+k+Z(uk(0W1L}`!KkM&nFG;&-jJX74K6ATjvMVJ+#+x_jD51|W zQ-~ybz$79Jc%^TTHjo^)Bh{p1AkKx^%?9$Z)laAinVXTiNIkJDdX8bo3aV-0TOsfP zz4gXv&;SPvb)31iYAGBRu+E^vwjV~dir;Ew+IrsVJ(uus#ozqKIK}KzTz;h;7x~<0 z;m`GG>Cgh1388e`M4!_#z8cnQf=Gm>`q`yfTI4pL;QWgcDiawc)rLLC#pkXeUz`JLTpuOujWZUJ!?Lu~qx=eh&y1uzkQ{bmh+=UeQL~x?Ig_)Ul z-~^xC3jeZ@oMhaIrY@6se{4R@vXF}nlnq8;O3==U(uM#j2e&DH%3-1ogg%!f=;+9q znkbkkZ*o{^BiANUjy#wWM*Nn%1;tLu#x1j|Nr(u|eDe)!3H+HG^X;CbZV<{T|8Vn~ ziD@lxxR6w+9rld^;e>ukoWm*mMH4;At)s>#$LhQV7PzNjG1d4=r0n`LVr3VkZFp%)UJeP|-9Kn+0du zqkswvxOr?|Z{nzQ>Khz0T$(yJthd*E=jTmLh@RhKbR4)48X@Tr_NQz%TR2GOiWkBZ z_}j#Ru*f#_Eb%HV?z~=D_H}6M@!tMmhrh#Ce&7e~ z{ZhJDL-!@=u0;5JOjXCVa3vn6yiLJ>AwNO&oafxKr;b1nO+(Mdys{_;PZv_4a-UKc zpGjwF=%ot#Q-yOA@;(3;@eQv}gF#dunSw1Lw5c>T7UGjJkBSUX`X|^Ly!Exg1150% z%A9t5MUo#KBr1~Vy@>jXZ0kmo`P!2(qmf6fF2bmR;>|NvOY7z`E6-tCf?UaN8#xlHa-w(n{?+j zvWt(Q*z^hqVc3|HV=ldVmLTA$GiDD?B3zOrf(}5tq^rSL{M@ev?ujpUMqM4VM%oxt zpu=2R3q;`=HqFClPSrT7|CVJ*iSiFl+!Mt)k{$i2_?n5V=baprpuuT;?R!t)@xqEs z7Ogz5wdL!=}YQd_#`k zLq@PXfwVHJ-YkndJ7#vF6iBO1-!E+Xeoe`69@kk2X9+Cj*lNYeJKg4Hq27_@-0!Do zPB^>d^vgIn)`jg~ZpTc$s+#=vATvvHi1x3uhLl-|tD!*Ir_ZHV>4Fg`RyBd>Wg_6-Zu?LanKgrx&cN zB>w=VrCqi{62x3JiPH{pqMt4B0pl=}*b>_BG~;)0#uUP3Gw|B-AH>$PNRiK2d1sh` z9hG1Yl0c?o1VUIa$ngELD8m~Gg57H}O(9os)G!GQNPSTUDobR$p_3FHG@Yxn zyo!rz+TGe7fd%QK<`i_p#!OmA+OlUvey;Iin8T-r(qQ9s@TqN^no^Jkl83T>_D7RH zR?q-`nQizFn@~WWEbWEH z%!jYXmp*sqE+A$C+OKvHjrs8VdSRzR=gZvNnu8q?r$jgKKn~s6c;OVnIMOJt+qzw7$+XYfR(~!$buF^F$6~tB8UkB(LIrKDo&JI!dKif>Nt#}| zE0sn%{C1dEjiUgA#hEl^Ze5-6!wvO|Ll2SlaQYSpmV2C~Ckz?D1+8b{tChx@ zRs20mgXgzBNxh{V!-EJQ>$qWj_s3LF`=Q6(F(MllxI`=$;iS)H@n)c$GqW6#XBZ(t zh-p17J|8$0UBpATU!EoI48e)X+OTwcB+)P@XgdY33ZE4DM10Tb30^9XOU$|Z`IP$Q zZ#c^n#IJz8FvA}|S~oCmv5{L`kis+C7(NvoR+ECk&ddA!Dx=F@qDk5H(y~zQ?mZ+p z_DYaXOh-%m;q6Z;6aB~LFZLuLV;Y09l#6VHEWVD<@wVvTKim5D#n7c(0lm%{r@t1= zeWWQlzB}o8(e}qqNL{AhdaoAJh?B%-4)N_i_KQB>BX99;KJ0ToBtMt$LtF_Nb;mgO zdS&?ME8s1du-;I=XCd4rse&K4%5BF+JHMyVQC{@n$URoDA9ePxmD!VNp+!s7j0;M< zBA?KaJ)|x-PotM!JHJ}A^v-P#i&56dyQx*?+|PW-$+=P6JN0%-!g|E@`J+GF%7TV_{^IHkQf0}Rgxrl{?zx24VAgL8>hOGtm$0V*F11$N*xNig+ zO)6WpgK7Dvt|ZFh{<1kpRzqV`V^W+6(Ybmyr7lN&n!&g`tmU`~J*6pfw+3 zG5qygmOLnQg<3IHS}9EI$SW%`X>4j30De7wtlj%U3C-4v2(J0dhXbaHDy^172&t!i zAz?ZO&3awlcBS-gz0iW8U0j(tqycZIK)-sJxpfjV4zwth2?l|q>~a~@9md2!H4Xw# zhofT=(?0SF;9SBgO+NGh1^MP69fp)7%?}$}bDErda*9{YCYH-S328cpv@T{g(hsZu zMHAT-_DUh^9~=a+$)uR6{#M=G>csArhYu|#To&?2w8u*XqR>*Q7NILWBuoMoFPQsD zBNNKgC8QQ#Qhwjlpq8eK>LKCzZWh3>;AFO8m1-GkcM(1x)VSySED%vAK)>9#eoy?gerRb(;u_ZCc~eA9giTEpQr{#obh^91dY1s&78a=?pE=^9--5|7OZ(HoDUI&^(U|exX{6q3z;ZT}2 zQkK&}bRNaBNH)0sVE7V)`sZ|DOQOinOWgq$ybWL*qT8l}Ckrhy|8j!xo`tB~lqaI7 zh~}LjklV#RpCx4AdG`t^fp|sqeI#@f_Z}CSH#=;eDja*I6MW$~z}hYBuI95of}!7B zmnE3bAnx1u^k$lBjYi=}XwGvya%4rJ#O2@bhrhiDI22%J-Y;2Om*+idIfH?H8Fzk9 zd=Fh+gj#zO_&_@IGBU4vg}wI!jzFkND|w;!7L*;?T^+=J_(eq@%bS|0x?}c$IFG%V zr6uai7cn8K;XJi=cMI(;lahJ68p`axSjeCR@mwh$< z?<-j1v>pCY2Kpd z2mv`PaA2Jcy*>QJ@oaxXcZ7c_9iA^`=Nm2Y`0Oa-FIi?p)nxs`ZwaExX%Z$EDxE=*jXLd2&wXNuwoYBKR<7Jc@-B>vuh%WU6;zYBRf z16d;aM}Z(GH^@DDKq8 z1?YXsG)j*Kta)`+nKW)Gqo`{O>1g#%&HAmS&$^X zmc~)QVbeJ@cxJuT|#%zOfq%L)tx(V%8YN$7#YB&ih?YT2MRS{l|e zc~FB7@o%W3$UZ(b4^(0gj)mBy>PZC2=0Bo_DoFVn_~V#{;p^Kp&KS~laSX@#Am)rm{ZXrylqBH4h#sz7H=a#bj;nCCL z_AkmEkBZw>-T^=v)6GX>(l(_v_M(?gAmnd*!FSltnr4X-Pj)|XA~OUt=8lG)pMa=7 z%*K3fyIEeiRrqG6ekX)z&y*M-ULl75{+M*cfuT>E6UFl`zmW>{h;eBZ{mdS5hd0c{ zl-q?%%3Z{6%NLTCOL|zIIT%x^iDAH!^V$?+!c~7nAUy7QPmjaA!(L1151G=&GH1f_ z$5_<;*oq=BS`cgDU#Ni2m&E7tx0(iMo%v)N0ozTN`5@10*6-IR%wWh~P}3-tzw2Lk6}}hiEn0b;TLRl1tQ*cfT@ohD z_3v+K#0~E!5VVgUsHtLTV){2!z+q#%2!tkpN6hNLZy?+{q z5f9oG{!w4rcS)CWPeQ>hgA7_Q$Dco;=KYB96rO_3dVPWVb1c(!sk9yt(PG5YzWeZU zVVHg#``+T2Dy63-ZscknqV;>%KjSU3pJz?E3x2h}18Hfb?%hDfOJ##Ce0$X{ zBQoLZS$PkS{5DfNOdzU^A&)heeVHx?%!6MVowMntdglLOPSv!5my^z{VgrFj_mN~r%m)dzjh=oaOZIlm7~(OBLPcKi zx4W^tB2gUnBRYri{OCJ$O*Xsq%=1Y;31vCN93$|04*c$Ajdm=KT3Y-xX}EPi%u$U`BmVSqwlwoPvJuZD@|fcsqs$nI_9 zQ%|D_b5TZC0vP}@5f#M~nuFs+zSOs#kM%7`mi#%6KPb1H9si}(y}iN8$B)(Z z^(a7J5m`}E)tcph;PEgen<9UvT@fk>j{orU8aj9yM>Mr*j1{+YRy`*Z%fVQuF2$nA7%gz^z&Csur;PLxiy z^zez(dOLk5&%B^;`jH>bHxp0!mOG3|jRGM;0bc?6DG^Irz*w+iA=1f~$!trA8w?3d zAsY;eXM4V`DGHdzal+VCG{SZb<20oe`l)d{_#FHMXj#KqWu-tg3Pm`JiO@u4_SaQX z`Q+`AEI2!r{X*?1gqx^*E`N<2t3f7RsqMtPRnoUBaYe4TN$E)TL2XD+kX_w1f9~=2ojr53 zx#9dYCga@0@M^M_Pf#!-isx>jaiFg$pDaj~{0CgkxR z3E01%6JW!9X4_BUFQl7Ujd=@%KZEajiFdUtBZL4@l zu96sM-V#ZhH;*;KPbc=MqNp-Eo*jR+COUW;frIsY=$2(xk!#7;4?4E8RTOlv^2})E zQvGTmRufnO{sngWelap3w4po{RLmLe)+;D?CKWQn`iehnC-$;+jwDBvtJRVx)&hfT zM?4dF5H9{_&jJpnFKkU&uXB3_PnmG|n_O@oPjD{_xiK}Wm>`}x3Txr<-Gd*k2+7g^ z;Ny$FT08-+YbQP35-)kl6co|1-2Iz(vBKGhi=|`-paQU8ldl3gJq@Ubb)QRVfjR*5@v45W+?9<1^F{cBI<;hP?Ffu-%Z27d8tfHhX(^=kAGRN) z>2tGQB)3*i;%vv9A-;5xCun*ckFP8cX1>wm=!grnP6gUKe%&L#2_c_n%mh^5iV)C9 zDga{Af0YDy?INh)XPw;=(bYr8`~Sw&R=#{RZtv>C9u-J$*<+8^1X>V}ljO|vhbg~q zC+})W8Cj;ss-#zKI_GYZ-Y1r&uB!i;hPo;(Jp=zMA$!_IQ`>hmOkl@7{I2%HECUGR zzKv&r$PsxQV_}D{4(mEY()6A=;in4HI&_SVLIEfIX-qkQ|5|bk^}XHRJZ%mB@+Grv zYs-(bpop_Q(r-1NxS!r|Un1{f#Q(}%U`Rtna~~G0InLz}5}-vt4Y~(nm7Lh$|!1wpVi8gd9F7@$tt1tfFI@YeCo1G)$XY{Cbzsv3jj2DuV z6XF-1h}B}01BQS0DeL4g-miF$`BDvtGnadQxamZSa-W-CyjNUK$o$>TA<=upm~hZg zw<^N0a=jr=e%`&|68z`5Q;`)G7_0G;H|8Zr*1+J>o1-Vz0w>wCKH%dEUTy8aQpJ?n zW9K5NKc`-MoWJ9J=!bXrxXwbrkLRCNmzP3r2@({{k&@U)31rdXm^hZ#}C>?(zAMLsrVmjfH?B5r>v$mvTp;t)+)n56;g%GLxTK zbg(>vm-!%nDK0JQZ(JSyu*@U37MMrF8PD{Z&VM>!2L`%5y3waAQd$g!N>7tRf%ZS; z(>JDAN=eF5|DSXp1>a-b1!%#ch(CzO6L@*7G?8+wk#fM6Sf*P4XD`&b^6_vNs2#mS zv`Ja^hdiWyes{93>s-O}f8st)3 zmTe!X#7Z9#lIZ>bg;$imNs;*dBBG(wn}e1%v9VzlsS-Y045ATr6%p%m@;`07N~ zA*?!_Uzol$8)LXhWL48yIEWO$#V)>ToarzU$oFNCX;rXe9=w~bY!y^oRxkWM9LuR> zKP$}yrJ|QrjpnEQL_TbTZEoRv)0f19V&wz+nDVj@#QwHFN+iEp#4QLi-z$1$momPp z1lOM(XB7A_#s+x32$nhJsP%r})6`v-5I!w^E3L4k@JRarLmf5yu95IH^!*#e8VyMa{*!H5?25IEvL|d``}ka^TGB;fMYqs_cbZ5tt;0-crMRuk8)(ckOt>vPD_Ho%zjfj}-Iwn42RB{?=E@o zRszYt@p9vbGNn4O$TQ@UFlP^1&M#W?7YhWZ+C-Kq>s*cPGo~nJh6xp3!YoY?v;4I_ zHD^H$WC)NM3>^P$vVctOcUdm3c{bflI!AK-pt~o`|1Rlt4b!?mJvNd0Iws$E?W1e# z3)e3u&Ykk2oDGv=zK3Dppp8{~9tb5ujOtRNuYX$;e=~!GkJdS9Vu7U$bJB)19-OQC z#;ZNIzYL^1#Nv#GtYvZO3LAek*--5abm$%+YCT^Nulo@O3%*ua(|XbM$rn0C^4q1j zRRZUQ0;}P2W}>V0cP=CF!l`hmyzhwU(b|#^=Ck~|-HTCdi}~Z{o!pSjKSIa-9Mph{ z^;daB{3SWV5H5r0j}SG|#jLW-?ev+Wjb?5kIoW3|+FFL`J(AtRX!wrF?YV`n@D|-J zmLV4!^yXHqLoKs?gXpKA?T1L4WjK88Plj_l$tNV2+VT0Grf)+ai{oeSb-6w1E2E$x zDwc`^a?-Sa((6S!!xxK}qM4WDA8vLYdOpohVf0$CMy{=>xSlyrmrikD4n(e^({j!lAq>WyL@kXM*^N8OR{iWv zy!1DM6(|2+pY&ky=tXI!NR|Pdu<#l#f*ek1dikD5K>{iy!o9wn_?&jRM>xJ;66gL9 z0=li-3JJFpR_+L;EOm}%Se!7z$S#1B;Qb#U|1IE^JX3SO$02uK%bs;*Nz&~L#j+9( z7(E^Mz!pg)P}4~ORmO|e{69Q>by$;c*!DICj2_+HB`G0YQcB4W5tT+j8Wf~Qhjfa7 zG>AwkDUCGJAPCZ3(jEJ5zV~}S5C3o;198uGKG%I-XBbvIw}YEOl5Kwd(sx*CcIki? zA)ppIID8|__<=q?+yucLmR}+A_4-89+$?bUG79Dwk_9`S2)wGNyeZdac!tB7@;-U@ z0|kSl@=FCO+)V7EMb(KVCZHCg!O*B}k*EMN5-eO?tgZrH2pnIuiWp#KTH0$ZQyrcl zJ(`El4+DE@Re}VgnDYM%&OWBp)8OOVsqVuxTK;`g`)E`hd7unY3`Rk_mf@qtM3y}L zVFM(1u+-D`Y@<>pT&4V&&n&^p)kXjlZ4=Bg*oM303vi3C9IlvilGp>~5n!<;m83V- zf~J5gpg^K|O>Gl_0uym4@!j0C{VXI1q$$x1$)Tkm=EY}X-!VZRrOBJMCim_B)nF7f zx$=TFRw4b|-EMs5-RW|}uHqeC1b8d^Fe1jeLet^xli^)=Au9Yk?{Xri_7Z5x2J-58 z;w=3Xh0naH#zw9?y=eZ!)2W0|8tZ(TlC|=uC&&85*`qA_9-nr*mf|t9|Psd;5 z*;M<%0K!3lkw%b?(B*goyQ1nC`nBv+<_jpVICZ8nNrfPruo>Z~&e)u5%%`Nig7G_}J2YLVATaYe+?gj<| zu7+*+vgiE;C@9RO&le=WmiZB^56*_IuBuecn6$yAvp<{2>BY13;?x~L83}jd{kc<8 zPV*+F-?OToLLf18X`s9pxO-^xjAJV*Ot-;qYH&xjV@Zz&EYTOWX&UP9XW@YoGt0|J4FKmT>L(Vt4EXltRx}17979jcF2wHe<28X^W8 z$a0(tj<>`#7_c6nRoFjPX!aWuoDX@Q^$07*WR`50f)NvxNHiC9C=+wI=F*vbDeAnGRbQOe8;ectd z>)ev_Kkaap^p6Ig#o-T8ZU-?*Fj~{b-t{2AQRQL%`9|2Ir;+EgG*_M zD=V&Ytby|7_r%>Ky*60&)hYi%)838Q^|3bkC3rgnYRaONpTQA7f$cl-zk4?Uqqxbh z@r5YrzSZL}!|yr0XnRz>CGX4>V-7x>yidi1@9uR%jAoHsnlaj7DMkP2V%}RC_R5}p&UPhCP0Qjmn0MuAZdNbU@>zB z-C#C#K?crn^CB-MLFjRa@<*!_y4HWbDOOrJZ8D?|;!MGhS(ysh`KTPSqaV{V<)hw2 zl4{s0n<1#-T5WCd1W}==o^qlWU*N6sY7qxEJO5O}x$y1%LrN(tj+AYq1>=y}qBvMs zEG;I#wRgwK`JnA{&oQ{+?Gk+o{(7lEo*7y2D!V>Aa~f`n42GI_)XZbWJ$%59#ni7C z9RHs~c&?x}eNK|{#{!+6ipuyLqnxYVa6&b+#3H00fF_|?bs`{@A1 zKhKT&E^7wK{mhGVBcLwK_34>4bRSY0x(}6Zp7HyOUvug-2fN=~HRJgIgoO0pyqaQG zSFNgy_<@ze`1`f91RMe$ylI$iG2e@P3>U)ZK^@9bV4<-L$huBt9@odY=yIl(!JS zfA7>2`}To<;FF?T_N^1~rQ^-{t~3!eLrF;sHe|ycjX%SR-|N%+`oTj}GN@!=W{?yk z`3vkv{&D3${5O^Ou$ggwg+HS{3|q&{>gkyIrXPxmkIN+85kHGKOKiOd`^Yo6P6bbz z*uDZ}9`^924}tZNY;2zDeDFgH#?YT2yj6Sg{Gb5}X_`Yucfoqp1{T_|vpTl6zJEZ~ zh-yt=&0zPir=&P`j*fy+um)`XA#sM!BvGB6RNLF!1_t-CXJ(ZfZj9(8zhMJGqG-BF zx2fr{{b2T(WLzQvWTCRVEPIwAcXIi#-;$1vbwA?j4gXt=mU|4*#$>CtiPU@Ioc#Oq zDolY+$BXl^509_96@;>w7K23nW~492ol3%^l;lY`V}~yf6<&S`YF&t;C;dF3_@-g6 zy)6jO&}3d2oL?ttO$F6}gMC+$84HqpFXo{Ew{R*S(-d-{+IMR=d-M%th{#1 zCf$I?;zWPME5A#)|15d@Ko2Eh*T{9j10Uh{PPcOg%KJPlUI$GL8(z(Gk~%|^bwq+= zB5^~WriU3zD3PZR_w!aHp-!g zwJ58bRks8wxLwG{)C*bEfHi8#dR(u=8CzHmQH%kDIQK0x3>DonO}f|Zx9A1*$QR(j zx!aLF(7#0U97o@0Z!wRr=E24GKkgfrIVwLY{XD<|@r~M)`MfdBl67+Q*5$@#XnWNrf4S?sHzdg*wy2s!YGku=F?R~L#rwgt0a-Oom}ndgpV8g{z|Oo{x~;xS4Zc9m@> zoeBcmqOAvJ-4|X}l%}>ACgAPZ|k~ zLsbV{P2R2W_{N>FUq~A6Vg%DwtaH;LR#xPT+SqW@QT~kQRl5`0pcq@k`jcXlY^?7U zhv{@YD>eim8-!C!8b=S|oqd;3Qw$5Mj}M3I)cRE+BYP{Vo}loO~nU;Ye7d zMNrx310`*Je^o_F+tQ zzV)MC?Zky3_iH-ryc?n$I*FB$*H!Ka#CrTO-NM>U;e1A`#kwb*=9>q5%0)+Dh8?u< zydZ?6YzR~3gCtY;uVtUW*_O?~fCj__8E426;D_O)q@w8(B?SbZmBaUSp2LyO{ypz_ zLXe4{t(ymX_1t4f1AE}S>#6~+OL){zpAUaPl}aB@X9@VU2!Du+KnSkr9?{hG^-=fr_diG`-l#K4AtmuyqN2W7pU2j~lXnXne+1SY zJDb!hlVdUqH^;FDO}g)_HmC~h4)RXkm&F=Bo4e;<<`%;6BSzje@^rm8Mj|b8jXByk zcvH&qi=qc7s8zHqsx-r1BR^7H%TU%U~-Id=ASP+`B!yg#Eto{ z`O4ugLI}s>udXUx_r1sR;Y|2(g$C73>Q4X^Y0z1SGR*j#3ClBK=r7?0Bkw87rLk}* z>spc%wIlONiGeo!Rd8!EZ}Iz4>?N+?(dpi4UOb5~{HfXmEI}iTW7<<|rXcC|m%P|> zL3)^mkOz?#fHRcuk;YUi6sEk;V!F?yg3>`mjlsKYEQ`N!=)>- zuVLBI0l`42=}y2?N*oFuE-72c-KfUsjId;S zaRp0pMq(O}qq;tJjlh=eO>&b6rwgkEUnx2>k+cS1o4SsMB4K^;Jo(7sl>dOr^(zg= z*N?Dbdz%8{r%TtpQFs>5mt<1y(;;Xw!mxaG6BA(v!s)fX;jN>f0fD<+=C@V2~#;L7PwtV9er z=~mR#gx;kO-`sk>sB?y<3YgSvirztGdRL9{t)jZ%ySHC)Oy8#Za_y2EsteW~e65@z z{EP2i|0wqV$}HT+o;4YF_a<@*(Gda(7&tY9)djG42tisw;1Bro$le*yg%#=JzpkFH z`35X5;1@^*{5-kcFv4#4@Fz!4RBK+QgwWDTuYZieHYdbzsRJ0wr6BUOV^J9zPubs&;9_&s2bbAU|#v}|$9{(AMgL(8b0&LFm&i6ht5)&Hs4h%-r{epe#gQcX><K-b`@I0Rvt)X)=MLH`j2<}2Dc0fHh%s;El+)&AD*21Vi-+e zkgugO(QT&Tw(>FPH9u!2KTehoExY8P5tX%~v}|kmfE{7vp=8${?<}oUVav&Le@1}K z!#39}SV6@0&ECx^!lLP6!{Flip{)!UOSuWLM!yH~ItK2+E?CvM zbOvOO6RKshwI64!W)ntBa`w24!k|kTYN`%b-6W5KzKc>^QxVgB9uoC?BWEiRY3Q5r zF4_Fspd=KPi2bffRPNmROT0J-T>5C7{Mt8U>qz~ceoA6ka7oL?C-NrBi#_;pdd!oC z>t||L#Db66{zM?+$gfXtSXpBIqxMvkl^2Q~!;NQ#pcREw|wIBTD0>n0G(~ zfeft47#f0i-?DdQ^DVf5<*F^{9m1P~n^nt)57yGlhxL?|>lg}xGh=q)3wu?yBi z_v&d}0_8~S%B6_cBFm0S4R4t6F+h-jT;N@Aa&7ZJ13>@rE413!lp;f!*VbO~ZSa-q zqkr23KYG?GPC(M}Ab5PVKp3fG)Rs@-!)XPJ^doAADDVJidu4rQ`l=8YwyK_M@*w*! zm8OJ_k<_6AWR+#yEDF zfNp03KbPWMD-%KyJ`Hj7;aB57wDBoT8hQxkk=|cmD3)KV# zwdUpn4~j9?qkpT3U{H70F9p6KK36u6i<5lkl(DD4#H<+4tBT}iiXF%1P{ycrPZkzy z3aw!aJCJz03SZ(1M6kiQU-*s|>NrPYPz=}Z;$Q_1F44^;_T9NAb=@NVvd2P+C1ro2g(AIj(_$!5zbS z7wrn{MIb~CNOyPLrJjn^EyqZK`0JLjmxqra3gkL>qi@wrOXSb6`RGMwkpJrcUTaWz2IK8Z@A`u`uxnO1 z?Pv0k_om(4xZ~Pst=nJCrxEWsQLzw4!iOXk3Ra>h>NW9HBPp=hw|Ijc8Flz2BBGgSP9lsr(tU$S%WW{!iF5^d2S-^7qJ@v*Hp5s!+H zoPxrB{`VyLV5TOpGExC|LH7LQq>e=0Z=nhou1lxXT#Lyg-LlV7MD|xBBX8(c3|viv zv(9{1SI=DtKT`ylOZ6&UF*&c%XQ9NSyZ8n(rSO?=dw9DQH0K_+#^|Ou;ye8u8XCmG ziA>HD#jz-V(c^d2^MWC|-xsS8>UNl_is819!J8iUEl{rOy0-1qQvt#uK1cCVwb`ZN zqfhPpq&hX;!rkt^2~5|UukSBn{r>&wVZ)6S z;IX3tlM*IkEgMx(VA9R|on-&V2t684XM6cN7)W%ZL#LYYoGH(CQTYszaEqO zcZU5{T2AW=mJcI8%^r&)bHLGG0lnBma-nOldKh*K+J}B*4$B~PdcoqM#YXB$FI**9 ziv@XJL%RR?%4XyNJ4x!UN6A~pj{_dLV;ALM>YZ08KO+MTz2YOA8HzG0 zqZQKLLh8jW!7?sU^!%`K^;;7}1YbW#KE(EkhK~QkWj0P%2t{_8KF{wxc||IDH3daj zqCRE}m05tjH)E9Dc-;ZFS0~3eSi!>{;pD{oOA@YUoITwi!tpeo-4C$LSb_WqsN`mR z(NYi>zJ#oASNwF_HaGu>+or(Hy!%}S(*RkZJPWQ;aL!}moTM6CXm1X7pkLo6TmEblA|95Mb>Zr(_Tw;6vnlL}VqSA#Ls1E9! z7h$i~*PQ?TwRZXUecid)pTWd$s~;rCPzusS_a)&LB)en$`E^^n$S-%4$5i@w|PdTvG0AR@p26>Q4wAhC2j}z2Z`{J>5?qI6_J&k1KJ2Y_ibiNsE z>B4q?_eK!vsf@K?6)iQ`3!yt-=B7j}fi-oXdu}$wX z0;Bcw$~v0~2-qL#lym}c1t@m3ae`%N^nwAB zKQYtlAfd0dXo^v4K!8nTaI~xp0Vd6G_bb@t4cYFgAD~h2LY1P8c1!H(>IB9N?iS~N z!tzwt3%5WSHZvsKn8g5Kh|Dnsc`kj*%DnPS_OvGR+3 zb&giieO2G}E4Jk2&8KyN(Ah9^=h8p+3kTiWi&X&pHFqmhCS^@i1Nec%dMnJFCyMP zNTC|p^&_mFrUR;p$dePwif@N#u(u;DDM8ahfZILvZiIe-hKCWgVEkMJ-)L(qY{U_L z4+|r5ibKx#B$P!Ma~@sy1)nqLVo3XAY=%yE!Hpz};52=D-C~K?dRRiY$!E}|HF-#m z!E7LlRi#^JILnTHruY0KSoXrpv-zCT_o7W(HvJBo;#I4z+!FqY6w~dK(Y~PX@02j4v0%{4p{IRrfdYS}^4ony(mIO2GaH8Qa5AbCYA8U>ptEGxD+Nqqr6kQf#yHjNa-nAVaVGD{&6jmpjcDY#ma50F#B`IRD<;#kNiqAoT6%S`X7TLlPfm`*DfkLg)-&q z!Z<-NS&uMgfxebjoSspuOyuDe29;&nw+_TZ`-Jyo`{Uj+Fmc#{Y(ruuTem>w%Xv`WB;@^)U5V;&^Dqi zcatn!3ij!RB z7%#7E#OC)96vy!&WnWxsV39#LR8KL+vV#w9@AVBm`T{$yoO&v}kloK`7j{J{$ta0Z zls!5vc0BY5&15y19#hAnHUX$>Nhjh&e2|KL+4ez9j@ z2PlhwK=33M(%z>*@cuoqRtA;1)vBwO7?{zS0sr7~c`RFH^xvBY&+GP@c_=90pfWBn zRT27?e%?LOXN~Da{D{vqHP;`)p5eFcyxX;lqy*PC3%Q>?j8il-!7KA1w&Ifk;|Bxi z0`V|i>)~p_g`^zkgUq5sSsZ4o)%tQ})B-At=p5PFr=X;jvCo?Rs? z&$xwvm)9Q!K=)@D=g`-alXcya-M02X_N$BsCt={s5eYa;kn~7v_}m*rjG)CKfJ|WJ zq`jV?F$to(#&k~+;Y|N}VB|oQk}?;T$muUB*HCjR3WhsfP-_!LBrZs2+-6!4(Ahb; zxbx?Jl@S`;vopb!{BQjAk&T#KxbYq}Sz^Sw%>D#TU6wN0g6?g`qo2KIRmSy)c=J~` z8~!j($%C-LM4}8)C5!&aBDtgEdQ*0iwp?Xo?-lGSM}Br4&CdpZy6OTYpO*@ zHvw|nwl7^#lbp64I}#VLM@3N!-dvp7=WdiA=3*m%^Ve=O6G3JsgZ=3XKr0UYh1OLy zk-l~j1vl28^3#kJF<*yTZ!m-J+SD?F4E#NXl9Qj{m4LNoPk8O=|5@B8@oEwP`d0zN zXE{TL$Ac<+7|m!L-lIOB^rYpXFDwnlx!BHc6CnN!6!9!Rnq@AxUj2{y)Tx*LHOz;i z4=DYiAUv)J^S==J0um+M0MW-nG|@TL3e`q!pJdz!*=pCn@de@MMc#?6yh>+V9WcoC))4phK3;_Pul3f+Lr-DyPnIhY-eNwE%F6SZ7^Z1o@;d%Gl zx!wq$QRr(WlIdwE>u%)EU`Exzg9Y)Kn2??EtZ>VFUN0W$;kO1h=N%xBFrZ6s7i_i3 zkhj8}p1LAY6{`9K>CeIVSN)p`Kg@8d0UOz_k}eejE4r2M2nBXBObxUkO)L`Yw-a*# zW*bJD>dCs(e_HjXqTja66p*H(3>GF1P?2OFZ<#y~YK#J)qRjZrhFIyq%t9z=kf!yS zg4PsVAfHr3EGF@B#2=r|8Tv;^n5ol}3L_Tb`PuT8_)xs&BHOjrQ}s7~358n3Ov(#g zt4pTgOo$3=KL*>BXI6+QP++a0nmw#W(r{~Ox*iCLv+67Opc9^l5D`iC(Ry|mz>fU< zNWpHVd|-fI9->QS?&vo-Sn_Cn!M~8~-pe2O-0W-X*2JOAUt&lE=nJo+E_uAbQ~_SXdDam(Cq8&T(f z8RS>>d(Bs_t~z-m@u zmzV$LTgsb;Wj&?AwBr4WFQ^{I)aa)21xmM{vt6G6t?t}jYkn$J3Xz|5DZmKWUBT?V z?S8_qHoko|vVDV36Fslg($c$?OLPS{IOoA6GwYMfbz=la()B>jRmR~ZfcAj6_F{bo?! z4Pr~)zxp2dGmPH_Jh!v259`OQP)f=gn1LDa!*GKF+Lp}2MXbdttKJX~yuyr?Yi4XR zj#LWc;(YMO{cUjXLCY`yycfGhbF#6hzc}^>3ifC^?0yN!)(Q)$i;lc>$qlXM3*9=p zq~%fcwSOxcJ(QD%?Slbrb`9`DGh}WDiN6>?1+50Y+z$HJ{0+j$IA^Uzvfo`9uCLHy z+kB{x+n6zrHLvu}&y!I8iU*5^v=gI3Xd#=8IN|!L$KP!gMrcD>fD#05%@)d*Q#+z; z5Yyd_b2g{lg-Zfzp6X@WA0>+<b(})v$RV7!tcoGR{e%`{A+{V8EmRjMGGS4c!ge$;n}bWOOvq;>$hp zjC}S3h1%!1kbqdfHw5T&Ml@kfP^BfEA?JSmXFg7f13#NnxldS zcN>%NZQj)CJ%TWaCftXQMQ!A}s@X^BR&{xm$-rdx1G$$#0v@Vl++)wcc1IC9%09@9;ot@NMzY_V&Dd$%!V=!$*!4p^0{8JhaQc z>gk)fq&L2Zhv~*gc2{pT{FcJ>FEiHm^_!8s$mSwwFVPePN~=B3A#mW!@<(2sHeu;f ztsEXGYQXi@aN)qo&+7oyV@9eF*F4Ol+tAkl>og^eh_(fic6oDmM+$&(j_wo`$G@pS z=n!{28;&IsXe(FX0fGqn4_|;BO6znUc6@50DHu+-&)>nOK@Ssag2t5)a!sacu-A;- zRAjp$v2?UZ6s84h84K`;nx z!4t(Z>t%N2Gc_I4uc*RSjKt|>dV*qAv($2cwzA1!!UJ2I8UN$aC9KdaT8kSS%b$H3 z!6pd(MX*3dP$gAV%}PC`4lL1PwKcB)0j)d&GsBU-scBYCgLSQDv zRTxF^Jn{4jm6i#qjKq34vwWvpxRaWHM^n+MAC_>By5O4@`zx$ujbM4KcZ(sE$cMyLdf>|5WjfuFy&WP$KA0xAhp8@$ z?U?qCjwx(Gqd*DhA&tM6&NR8>Z$+^9-0Jzs6#fjXq3x%m?*!l?9j&4!0^B)P0C9Gy*d!2Lu>kgV~u^D>5Z0`*itL?G?JR1*dhs z{f(A&#TdFKGP7s>sQde`fY2ZR&M*zAhQpO+?pSP$=+4fbmx(#EbLm%qZIo?l!7zyf zVqie~4c=EdDHWc}__9g6#;*r4*j!jN*Wn&ow_GqY3CRG}9X-z>sRSsAY`HHOpsl?V~OM(;G)Ia^J>WjNn$8j?JNZFCnXZz)8+)^VDN zpcSQ$-sPIm`Lk>oPa62GRK4)^sAvp-t6XdRO4Y7J<>29Ti-RekYFR|byi;LOTRvNBL}|XiQ)6BU1dH%*KJZg zSiGfYm%ZFTgCTt$3(|OdxrYIHWsT-8;~;%(^Y~Q!Iqg(tn0%aa@n5Vd9G^WcuAZ^dQeX1^{#d}+_3o|yO1o2}r2@HPOIu$b z`u)IwI8fWQEL~s7K_S0>`H+>AnEX0?y{-L6E4^T#*Vi-4Fv?`i`;TJ>?85ilsP~y< zy{X)9ionI!Pc#6%xcJ0>{mFR*BRc)V#|N-r2(8sAPCf?{1#|Y6{;-C{Mi|xas+!XM ze;($=1Yt^C1aE$@D(;#}pd1iM{1#Ioxm?**5648g`bh>oxmFjOf~pCb-<_ij1yUQo zD{F0_W{{b=)@a?a>eQ_b<59RpsyMo4xRhX zwyEt)ZlfX39LgJ>-Jr)2kNp9^ZSIUGL{}&NU3P+3E8<#U;cJjE7T?KyhcgWsN4vSJ zYoI=SN%{M|1hH%#aj}8ub~1!Zqq-T4O9La1VC#p%lS$EX{&+e*u+~7_>+rHAQ>j<_ zudUNh^s6!m9r-=|Ib%^bi6a3b5fxORjbT?@W|Wu^!jc;}N~5704ll5wv;F${<-ISs z=g0+2Q2nl4x8WY~CR=({VFjidOnZM?mrMoP@ql0(i!?Fu!-iI?cbM7BWpMazi@lkO zwGf-PqLpn z_ZR&S>EE^X7>TS1$j({q@E(znlsEir zZszCp^%3wag#S>FtL(bIrno(j^ONlJSj)crT;}FR)@AN@TRyxe{vkcR-6B>O5qh`H`Y`oyo2rX@X} z5(eKm`nGauZ5oFo>8hoX5c~E0j>)s;9qeX3DPV$IE@^K%M=&QL(wujp2mIO z4u?wq8s;c}q1?ZJp=HL>QD-OHuNh(Ic`+)*xb%@Pb*$&=`pH_qFU#a7c+TpTMw!T; zSkKSIlL?`FE>bJr&kGaxUP-pNjVe9o!nl}QSYKV&Cfv|`OLmdTK~%!bkKXBN!RWnQ zOKDN{;3NYIOYQl9v^2&J-?JO>4`~-v6co42TA!||eovaT&U*OcA04$|F)bW#X1yQU zKg((KTW&m>L1=n=p7ihOIMk$z@A*mlcCYrooh1^=e!R%!q?ugM^dMTVwPD_u7gQyu z9w_m&o`B`y?C?hgoH6rIBh@rezVf@Yb%L*byt1+?t%-R3w~+!hCaQ7wOJ&I)iaVsI7*KO3Vl3_yig%sY-7zHWi@}K zi!5%HlzaVL|CK2_KJB_A{eLV;EV+@R2cAkRlpzw7$Kf6A!O(TSjHAyy7<;gc?-hfE zlI=OlNqR2)@vq@0v5%E8A$iBR`85zAzI0}M!_GE}MJx?j-vM!I`IZVD6pRpZ8~U(T zD+*AVGq|a|f52>N?ur{CB;kI{#lgXGa3qJud$*dLnv>M!HY5|q`RSb0XV=c;F(H-k z*Fd&zy6I@ACSxKI5s}R(yH~H)1Ru4Z{kaDiW5OS};?c85t(xDp{ccYug37vcb{)c) zN&W|q*C5jF!zXprJH_*j%h@H)Hj~9CUNWFjo87$a`da$ct5<@cLl>xv@8rfE5u|r( zNPwzkyu$~>guA=;V`F0}nSB zC|0@dw?hHddMnGFd&raZQ?)%8tfE7o{4WX&UWy3>Q~IZL6Gu}*^4lb-0^Y;V^pF=T zLpiGt=JPOmCnnB-;7eWlcvvOl!To^xdhV(}mtH|>X-_LF7lp*d1G*U+fHmzUcxkX6 zntp*B7xdmv3Dngv_Mb^hMwn(??0D2uOt&`ug3)ZVw0b}ZMDP!tHHYk*YU&>?y>E@9$ zflu`MbJnt6zj)s%EVytzV(L$~B)4t&2+hhqo@=yAGd{!Wa?cit@O4P6*9QtrurEgAzxRBqz)vv4?TG!|oxijrISJF@%D*x9m-Kl}t_|Sz;m5H_}?q?Uo zC3%*%_MT<^^}W?I#oM&F+Go=ee{LH8x*R#l1qVu#DLub!m?(0%x8u`1ncn{QueOEz zX}9y`@sOFr?vO=KWlJmY`uZ^*p(mQopJ&z4dd%N&SNZ#`pV)e5MQ!t%9;Z#LNmb7e zy$dRd;L;1Q{(EI#F6xP1wVl57@S(8~mA$MaT1@r7NOfN7z#%I{y`?DNhG6RJ63%%Z zBKMU4_`{0SWp4pH%=Mn7w=+E#bw=Dnq&BysqKnj_4;W?%+DQILS z$QJ9er`|rR66=zZx?X|(B9sW4NrjsoX&HzF6*P5kE^rGuI1%~ogflZi#8b4NjWfT% z^z|79KPHi}pqxrobd#Kk--u%p->c(8CDCma1~`QCEl9^RM7HlR8IS=MBE$@zAU>Sn zBLdp>L778vS|?Mn)!9%r5PO%|C+W~y`{v6Rq_q03_g?n>fMpfi>}-;AZH628!WD9O zT-jL^GbAHhhcu}MAhOYz*O6{~4%Z_#d*n!A>qP>Xx zCFyw0zHe%l(Yw3MKQehV&__P5fbDzoyf63B3NHPB5H-x7?Cr3V7Fd#^eCz3N)a9q- zd*%-qr8S=9Cp(s^JR6?ELQa_|L$V@>Roe2AA&`)7g6gv@9jCUX3qGh3*26#|=v;`Q zSUm5SFOQZtg0NYLO}zy>I+Rm?qY6&l-r=ykg@lYm#O2jDlB?y*0*5OQV zrGHLEXg40s9)hp5sQV>Skz4Q};A-=Z5(b^R+12f1+H%pLi1#jn`mPOp;;BjJ>FFtR z?*i8MJGod{S)toK_oPH?GyC-PbVDPf_R&$j2QwctGgZnbrSvy%82%7l-=I+u&;9qa zOF%-s(j96R1eJB%p(Y5B?fB=pP{0l$Vt6Ct_@?1{iE&YY@#-R|tSjebcTHnsMsrf8 zq#G81;k%jk@X!^;EbyWZ_26bSuh2RECWnI9aP2B{fQ5baRc4v8?Zfh0usy)pguEv zUgEO$3veRyP{@Z*ewehh-<*^T{0O&tx0ib$lZs*s?!L9yHY7<-Peg4riK4ddLCr6s z8dHMwg^8$*gJ)Q_*`Z$HRTq1s%US%K1Q4kRtj1SXKdwKLZ(eZre`USum6x6j>rZC* z%qNtE@$N$8@2BerliW}7k!PXmBqbUAp>SU;hM%fYB6L*DC@=b|od+ zP{^bE0W)(#5r6(Lwt-l*r$Bs7_hiL1`&c41EAc{l`tf=Ed_9R;>aub8{6!I5cV^DF zA-?3)%|T$nUv8yT43ahTG3;4g%4KxPvg72DM|mSw6lZ@GH-3+Yrg7+X)Y|&$6{QXK z_wIP?6}JY@opt~3!lRCxht~lm>q5_I&u?ZycLy&InW6FR9?%X0-=FG8nNeJ7TZhQ4 z-~F<|Wd!_1S6%a}wTB49yvsbn%9YR_-m`xaB<;qw(_5cXt%f&~>efF|Unlw>YS!(( z+zYHuu^bEgsm#IECmi?}KJ3vz5BnX>Y!&bkqFzeAWrpD(>N(NX)-lOHvr9&~mX!!`coj+6l(L+gv>LrG*As#S=m`q#D2y3$b!PjA zw~Fa}U7|9R(lZU9uPm75+A&@VUN~$|B61ww}NU zHI0uvYKXrYG)g7oqS`mm)it&ArUkkyt2Ft&Z+tjalRTjg+3v1WxOOt7aP1TB5}wdU zHmzo2HiUJEs_uH^PiYBIQOe$!w@*3!dF3smbO`xEjc}_h6(MU{p1he2y`denK<7X9 z)jV~xb}_M#`ikg~QR3s+;P@YoI!Vek;HGg(k6e;gmVa%xWnGYMQLh1g`?!x5d4&2Y zFIb-&5s5Ra#Tk>vk{crwf4yLuNony#kZwFet(Aw;^`9Pf{4d5{VY--hDhxXZmOv(^ z;^>M)EYfgu<#?(>Xz_q6;ibgW%bT~2%PG$*nwp}cqY3V&z|KT%nGowNPptXd)6Sn2 zxZ-ya+3cL@cV%J#Z@_69ve9@sUi<_Y(3D%|?_3X1Cho(*U%$Y<=R436c0YMHqU3G2 z+o8?Bn8|n*0sw8mG*<57Vupxwlfd-F^tp6L|NtYv}XFs=TWg+dz-7D^J%S3<#r-w7rh=VB}P=isi?vp1|gTjb{MF_Ze1O7s&&Ki`#%E)AfBeu7bH3!ypW~WOh-kGk$)y-K6_|5k*vl^G_(4hltpHpe}=iuo3I`!sP_f{A_r_`@=gDJ z)D#a_SkI#tR~-E`HF!iE<-P@q*4IEr7W2KQlXArUvS z@8A71R@EIoq)CSQ`Qy>jN|zXalw`^$(slvm)yV19s?+Hk3lRWW#EOWPkX43=z z2%dM!Qk%i2t@$p(lKaa%9cd9<^)*bYXQ(*5tGemRIJhdlwsuL_Pr8SFZ^PVgtTEub zuKDBu5r`FHlC>Aa_TYlCcbP;eF3v+NJ*E7Mx>SlOuiT`1&pTOGeC@u1wDCtU4kq}R zS*+Vs9u*i;H|j0*^YY*TZR!7K1@LhcIdWPr+ewBn9RL0?c{;o@a};G!`#356Q~5S} zVO2c^TwPT~yk+I%3doO$O{a z{QXHcMzy!9r1l2ut)w9?xLach-m?N*F?wucY?~fN2(9 zU+Mby@TgNLq3XF0Xv+)uu@I_umzcW`czV~`b4svZ&!^7g9%i6i11liHk?5$Tu%qadm zW6tN+xM<~zEygQod>b_GSF%L`3VaBqV(FKYW1Ctq;h2C%6Ocl3W({&uE~37~o*19z zrzPwWOAe=va)VIoQbdRmshuDgcdMerr~;Rm%9`V0J9E8UCGqLiOXwVFK*lbLtO8TU z{}+amoSmVT!eD5-OSm8=i{B6v5(gKgXOCA+Tk{ytRnEEUkbN~#U-t=g&;4fX(OasC z0g*>JE*ude>t|FB6N7n`I7y4u_PmIfVied{riPEaBBAQzd+wTr$hS8UAZN`xdfmFP zpER9O#Kn;XR?;(~N^%sNmt{kXR0;CdK|%CDKpWfKZ-){J4fG76*O9)0bzh{_tOFIK z?B*f&SHST-|6xa45Oj9Em1qs@GXc^kbNDuuC@_eZl$0n6fsiVUK@`B+biT@DFW%+! z4mG(ss3YSs^}Uta>2h>(ZB=q#oo;dUjVgbu+)*yJxddHVOKs_DRi>;|@ zYkcPQX%$8#;4b)I5hY^?9dL*P`i0O$ws;tDt4Ljpu>OlL`@O_SYFT+hYioNlM1LB< z*y-suF*DtO=8Pq?iCbZi&o>GpovJxxj^je4v!#j@5t1h%eOD0@rvNi%2205I?aLR2 z^c3!%dzDIXt{5Ui>w*zgY)mQ8fjTC9TaV_jL|9;RbPV9K->zlvPsg+CkkyFo1 z>68uv{3ph6I`8XdK;oUJz6obW62-}rL#b*AwZI^ohV$&$$!w7pfBc+!2pd_6dJ{@md1bdB+AOF;RprST{v`m7pf4@ z8vyY#^0U6#kHRiSIi(onduDV|WG1rWH(m~(@EQ-8Z!y%+~ zHAQQu)=we>6UWjCtP)sh@Yonexq!Vf>btdLJ-0CP?L#{+j$p$T!i31{Gj8 zy^p5-<&O#2(;{X|9ki-yM8(_-2P5#8_R&v)djpsO`gcDL3`Gtf)&wm3tSSAv)f>tK zYhooW!k_+N$1Og651j1P8t>o%S!#S2ot<5|7}Z!OOVJn?67#zLn0xD~ntAVtU>Orb zK|_OJ22<@dEEWJHfw{Z47XRaisoQB+%g2tatVfQH@25^(|0!#(z+#35unh7;Ld9O; zI<=stQtW$!ct%MSrWWa~gjA>l-v?!{S&wgd@4*XU3=2FtFqGUIv?IdvW*zoFZ_%Ls%m!RFs<@~PRjkwFH%o3lCV=ihksM12)Ud>|+OeS4JE zl%0eTx0_1i8NU}(4J-5uC>BLR?(^fXr$-o9b_*nf(%9j_+WH>nPbOezUdigvE!|z0sfvb+-=vxh1 zT|qgwMg^1JoD$<|MbWs&rqkd{6@?ohZ0 zMfVMR#v|8JLn2d|sq~ssDsB_X7MXBUtY2U~T&5pEFe^-OhmbiqdOZMcoa&{lo1xh5 zGp9EaUiOA0&`Ud-;V{}xkT>O`+*S2^uVQKF@dgRAuU7?8WfQ3)?^OBbhcK_V2yXC| zOz5oU5#qda7<+Z?lcKFD zFmvt)<_YZF7R_rolhx~K<#ffsF{J2b_{B7>>~+OZ-L%SV(@*1h=u%bD}3A`;O^){CfeoY-Hhew6$4U^WFknwV2um~vE9r3n2k?Zrfgy);c%^gn z=VSVx8zeGAg-_nTU0nP|u{F65J(1i~bpSD|?dcMzr(|rm#_Aa(t<)sM4iVnmLR#-A z2tbe}hXGkgy!_cgZ=^`zBOp7dPOV8VE`NWDL1Q`~NxbJ2r&b0ux2vfPEd+B9b$IEH z&4}mWP!I0%>COws3G91yaB9%lJr+ISQqD&MzpjmOpGj7yfILo_1U&@JDxkoH$vDp1 zuLP&h^PVfHRF^38Ae#H()mrPlgIDRi$(-8vjiSlWQS09I>D&6aIwF-VCN)08QVf~S z;vmmnx7zr%`<1oNjx}A)HBG%g|B=2uJv{^J8;!5v+$_r(>?JoS(&%@L+4D~ih9fjv zpNE3Oa17rhg5|<=?ZH@57bMs;FT!5G+w_wewB>s+vy|hecB2wLc6C#tC*Q> zzYe(a1b+F`eEQ^SVY$&I7TnpZKpcbtoby29L}4EQ`{x8f@bPB>gSbOw4YAv%;^V!E zuJDKmSyx?wb#a&+7q0dW+@Drg{(*NESj0tfCXGQbrrJ~dgj)U0s1TdpOtTs(X`Sf- zjh;(vYVy_MxF>tJE(Zl2uL{8}hWJG3={*{rRu1JTg%B$h(R#Zelj>^4nxh-LXoag<0{##vSj zQ9uN7(qUPZO!fa}92_EZIx>@UlKsphm&KDuVIt8Zmd;K@nIQ9Zj5mtoZ!jaxD=j-y`78@BosuY25gP+GD zNZo8%P?l*LOz|8UNBKrS+!XWkYb4*gpDM0SslU63pp5`qL}2aF{j?->Ccp}l`_;-Q zu0GWU;-{PAHz|^wmLr{%hD5{GSN5epeNzQ!GkiHEZH{qrFZF#1WMZe2kswYZJKaZ0 zEQU_5g1U*#zG9HU{6_vow5e)QK_t4x=}aAk_$TzHy%qGx{U`xTV$M$D8J^AXTb ztrXRx4`Xqmm5&e6abVU`!_NL0)w@H~taCjl}%;C@!1ulXp3{7oKD}K5uW|d{JOOz7u z@NSVL6*a5mg#+AN9u#tL*UlnHjINl<>&t&N6-15GWfi=c{y2MF!Fj|)@80RFrPnxQ zQY4^=%{aAT&LhU)&_(GASL!XAdJY*=kaI;Mo%q}Ka)E`_LM^kSj>hR&Yz~>o*JV)( zLb^9_75T`w7l}pjHsDiS1I}?lGO04c3CUDlQs%nZ@f0hDMfMcIiehiuMwFZJp=SLC&uP z#-u#`0mCp(Wh01MM20pHuIPgSZyLUl-_hS?Px@c}(%G^h3_dH~k3W`{u0@i$Q4TTM z?^#5{s788r`i{-jv1Vuu)chkkj*G&Obb%l;Jv5OcAO1T3S!FD6$y$vpejb8Tf6F>t3&_l$$Pzg~1MszRMu zt$utzU|Y{#8<#t3{^dNWCKw7MaWi+`#*A(xnMADd@a6R$%(iTt5BG%q_+h=UkS~!V z)^`|{O0c{4mkzjIW@c1CAWu)neRRuu*RW_$Tl||s6bztu5nhi6uVbiV^->!Vun<2u z2>8pYmOBx3<=5~1SfXU1pLAxYI@9@}4Jqs7{crkt@CyO~7Q)743bA7Ou$-;TMB(`s zX9AmG=Zg~$7xz3NmUx3F8^4Y)`3z~d0~vj6nU*Gx)3}Led{?#|IZg+c(McnmSPD)~-6)@B4?1LjtqZ^S52e|KR-MZI zS>6*Rt>xGTm5>!7MG8(FPI`h!&L5UcQ2V0Uhc2EcdXM41potcIr-=$wT(o8TxY_~t zEPhqwesU_pn2!ywE2tI)BAKV~mQ0uS-*l*TcSmm!XZTJXdm-UW9=$kIhE#qf4II+% zaN-K4h&%1_cAIFM748n%1l1 zS5RWV%nY5Lx}{hptH3}3kIIJFg6Y~YKW(K892z!_HehF(qPo6r>Hlp3_hd>?fUEX) ztO)pk^{EVOP<{FAX@n6J>F>Z^de6_wXle6ALFku(YjOSjOx*0gLh166VyDU*-1&%9 znx!QLv+h7lfIX#8g|jzx;KeDWVD=0Tj%fUyq1d}867P*8lVk#w%C`1E>O3(9$JF+# zQ_d}Z<2|HndK#_>*+8VzvA-K4q#`H}$*=%{aBCr(N5>&ih-sBRFz>Av&^J3G~3aCd!hsdwA{?4UpY%mxItN zMnI)*7kahB@ehDB&tE&;0(Sd=Hn;2@kRH^qfGvB!Bo;isCbRz^;K@D#_CzuvQ)yz2 zE6%cObHvB%&cE}Y03CO8pKIv7D1qmG^XJb>pyJnn@zW2`5G-9>h=8;jC&24;`+Z~# zgc-NCN8kOQP}%5JOSw7#%q3%misUGps*xf&M+`>Qlf1s5?&`+3S)Pz4HLN@l3!a!$ zGmJeNs+XWl5ta#Yf~ci^ZB6BxFwo@cfdB&|Xv0QlgOsF;Uo0CrM-xpeb7+=2ShNrh zxbABS41cIG+=HUSd+Q_L$}`pu2N@eWkUKQWaY_X`>&`2r+N6oNdsx5k#~u6%^j|}M zo^z^9H@}CGdB3&Zv*wYjTF46P#Cuz)IQtD}f+d{AUl&mpiAYydV=kB5Z`J)?Y|*=w z3Oj?4tRsk}8=31>b)TPIG1U!y!r5K&HPRb2`T#1+gL6Yf$l%vW$Q^+j{yt-TXM(Z% zaA%rty0$eA|D_so_@lh?4V;S33^>Qg#ze}--V%kqg>=7B%;nS|z!r(mNl1wgR4!>^ z)XdWf^?4mkijP5Ck z5_`|OG%%@JGu1o=7Su9bQy)i7(cPtkKK-&H+;qiaW}D)k9eJQFR{?}u;4l3MINoh; z)cB*u!$w}DfQO8iy6%0I#%1VKh(?^va<`)K{QmB4&3)`lN_=$^^rTPz$DZ>xl=p@C zy!DJ)zZywT$ETB;YV$tebhmVN#((l;t*^g70AK)6h=|gsr<)HB5ce<+Cq6bZy90@c z(EPf^$d>Yh#>O%N7Goa}Cl9X-M&@2U!_0sT_UDTv$VE`E=To%*Zqu9vtYhMo=0~2U z)VfasW|h0R`B4eqtb3cLdD74+b@h9g+z1*{AE0S5v*~&gfQ-hy>rUCm;OcmKTNOR2 z3O7y(_0VyuevvC$x+SpHzO$n~12>I+Byu9!hGo;W*m>TuAg;0)&2cBQ_Ov+EEbHQ> zfrV?$hNz>5dE&dDlM1eJPPV(&favPY!}pg#M1=Prb?|}g{$YF{{R)uzYpiW{AOP$y zNaKg|sSrby2txJ+=7`*Kvm4~5b!0M9#KXX4Yt_^*7ltbsl((ZX{V?Z*&5GhH? zc|d@yI_cJ`QcCMwI{S;JeDpiL-lr{^>*RnIaJR{qJLKH5@<=*UVXWOnf}p^sU5|5Hr{;YBlf_c2VEFhj8v zqXST&Hzz^i z?)tX1<>|ObasB(w9m@6OAsUS+We>QzQ z(;_48!@800z@yGSHrUpu&4s|@CNlxOGkAK~j*3a(FFHRvGd~A?KF2H%!Rqx(1a#FL z9FR-M=`rURgz>Hy`)ok=ZeTQdSLdHM@TQz^>t?S9^$(F()9FF=e50!I;K1P@NeRfh z3jyai&?*Kn)@`z7g4%`e@6l_Czz_f4n$iJ}0N}{l8eR|K@eF>5mny%nqth;MIoJmP zg5vs6?T@hP-mez#U)||ozl>1m06PH-YV=x2$XgxEsrRCw|EUN$l0GZ%@Ii}T1XYPZ zV@Fb*?sH@y2GQ-dO1fuvYAJaoga?QmQ85Wc*EiPd)<+7qt4~T)g^@PrEUFWVkVIq! z_q34)Hmk0FVkc!8mKHtukcu_M2Ag(?WT3sgph?XpRSB0-8atFr`QiaJ3c|}}BeA}d z#Acy1V5__OF~9&%8Ea@(<0imE#{VQVIV>*Yr*kRQqK>kxo%=XNa70}Q;!JloplNoP z5kt`REd-b3r>VI!izhH$Ifj82?b8c1E4_jF-tF81IfAE1X1@uJgk(p&%?difrY9DP z45NBBTc;PA_#akoC#My|oC#jX^qCkUP@Napyb4XMOeki*h!nX=PBl!&Pht0qHNxj1TsGjK3EFm*~ypHj@Itt2JY=x}E4$CqN zc}~85ND$}(et~jePj?lNAekH`XnV{N=0SEna;q9zL;!N96?-oEjsY*3xFu-$`Z7p{ zX*&=|@Qc*d*K_@m``tDcJQnym>vd)}UDBkm@!sJw3ti%d2L= z#m@LkiHo(AMkX+++NS*zQyC6mXjqifen4FRDowQZ&z$=P9QVWkab{TwFkX}6hsu=K7*cMEZ+RtZCAfSshQCe zp_UdY@2UAsbe2UXO36>%{js)ga{4c`hZE8yJlcYvGbU{p)0yoEk6zimyZVCKm8xzZ zQhgecS2cJUSj8H=_wZ$&fSiLnIT0Fr!$AHtZiF@3gE@Cc@B^Z+7+=kH1eYD}co2i# zxGC8KRxU^O3`trLKD!6Xoy>jbcQKhw*ALW+EV$&AZ=L9_?Cpg-qNRNgWMC)&ceczf z@MG61X=Swx3V?U<)wcOjYiRTUmQi8=z4Ac$vg&id|MLQXEQ0QBc%I&yPK)I2EPW(M zCSSfb(e50panIYyE58fWPWTU_+Y^((BBX$HTk5}C%`uz1r9aG~YU(MI9uFzkEm=)n zH5VSg>rXKYkj}D$kPklEzkeJ*tBr^D7MHs-1)2t3pjU&{u(tX&w;kG!Ry5OvU1XUl ztFAj%Tid=rV!&Lu$?-Fz$-RUkyZ5A9Ha+tKK&Js~^kV+Mj4nv_l91|kq4eVupP<*e zIMT$Al^M{TlM2v%Ez8Yrt*w1UQME1d{bSNh(iqhCj&Qasn;LGk+hcvx+gw*(m+QLBX}f zvvG}HNJLQMFkA3b<%Gc7D0us7=mCspeW8fk*y#eD#F>@Q$jtwZ5z8l+4daRiX+!~yjLu5a&y(S{H zIZ~VnvKgzy*~h7>Hl!l@5hh^W71aEbybuSHSA&Xas&B4q=L)$soQVJPl6;wJ6T?1% zIzDzzHTA(f{5KPTcyF+t%Es-h-QitGjA z5x>U1sSo(mDsU$Ke5*(CJbm%xyhY}`mn zUmzq&3}vNiewuP=A)!5~@#Pm_U7GlsE=X$wtVv1<1Ll^P-T-V9S^})4m<$1Lpb_n| z?2uWFM1)XYYW-rOfRif~Zs?5=RiG+jA(c}(=tNdj@K;8iN?>Dx)$Cj)Sv2wJ z|Biv;c-GQxW!EBt{U4-}V*$kFK2J4}5_ec-3aO02~-^b{3!*t^&dYgRNa+i2*Gw zz@l=s@NbU=ENHTz^@GwH3-7CxGTF(#W&AE@>C1(da>ge@lQS#`k=h~^=cBA zWn^YN`2E!wW#F5Jd*A1;oE;rQ03#_iP^sgXEv06u%nc$zG5GI`0%4}lH^&gDHKw|K9V{edLEYr+>!*hcoq=Ck~l>tF(AQNkw!BO<|dmp|^?gH!7;cOSR#M zz{=O+2k#mhDpE?bbTkx)SgRQ#<_wO z8N%4a_V@*+Kc`h4;{+$tK{A%j4cP)=wURops0yB#Wf%H&`_sd&So3`%B{@8BrM-O| zD(2Ri$v;tLYBmEx{!-!-4s$-kT+I4ur2;j|q=e$;(k2$h z{fFW*Lnc7+f7$_~4Je9byUxa~g|eVqv>?#9b~*DDE@ng!&$_i+-QCv6*ZJF;F__Yp%5O;p8FROjn(^OS~6^p zOmcFnjUbr_uSoaN3PnZe3`;VkqC$NG7CAs;quYyZ;*+CI`JHdy>{GR)rndIcg0`;? z9u_mgDCW42Dfb|LE-5z-wy*dTx*Rg<;?Cohg;A^@SAleGJ*dC>y59ng> z?=t^$`)@-91T}fhTF>sQH<#v!1j<^z*@7$S{t42ZKy0)+Bujc9Z<%2Cr$*V@_1r%d z!i5CzwaNkaO(g|P8NC_^C4GVGgbmWC;2h_M9AZE^Fr-hr6wZ#MPX*{)RPu9w z&K!85_S?WEDKEO^>lA+GSsfdDRp5Q(RADCV)KO8(Ie|vlMAJS+E*z^1Aa!Vu>tTXQ z(bzI{!Mzy}K&x12_lU@Kps~tT;Y+RfSxoiDM1LO#bO0JNNpXb23m8))i4~a&9{8!8 zTnlD%qH_r)hSYw=Af|INm_#I=$Q!WYDjt&(L+!)N(<$0nNLAn)bnQ93)lNUAZ4uy! zB~=`*LW2#E)=IHLiFOMu8)poa^;1&)&fmJ5$s!GX*uZL_^k+WLlGQ1LiA$ddvK*nM znP1H}+%R$P8=`iGOGQfT!G_`BT$g%dd=m$yE2H2 z^B?K^Ba)vj_sCfGhYEYZa|V+JAK6z=n2ap zzrW&Q&ZMelkrT?lsfs^JMjOj0!#hHe6T#|*c;$9ZF72um2*8c>=#hDEe?L$wA(Z~U z6bz!J1wyk7mzR@;Yc=Op?;QjGxH1lWc;*A-GV;d9Hi9=UJf!}pHH?Cl|bA|DSZ2tEj^TW?Q&5h2*W6Re$OtM*v zGpd*w&E4A)o|4@5E9{btZVgQb z%7Fu6=oe+gsvq%^Q9gfTX~G!xL_itrE78SRWRz{bL@wYvG0^j(7(>BdE$$^6+|p^v z-I@^Mo%a5W6p5t%RhI{#004PJE5PJAKa6)zld}!8P-M2 z3a~Gt_iI>5`;<K?^=Bbd%!(dq@m;JNZ#fKPyeGZtc_ z#w;w~>~+JVK%0~6o!gBpI*ci`rCOGP&D%*fb~va$)N|5^fJF8l4} zaN>ob*ZerNJO4rx=p`co!YrU=lj(%~^D-SZ{9_25|NK;A6%ZgP{+EtMy!Y#uFBX9G z04i7JZ?gc*vp~ibFjo!VT<*<21HAJf)uweI)^PA=agpX96&$z%th3$MkZ*22%l0Qr z2H*WJ#6>`ai#6X=u5k0=aOq!u%LY_R+|D4{?kw{+%J&5QF#W%4g=w7aNUo8q=l3>C4_@?>OGU4B&%-$GD znk;@hx3HU6^TKMAV5T3v$!}3UMC#-uF1|$!PblCFR}^akilZZ(FH42~>Dm*VNAk;+ zl*v;Tw6X2f@=sVuY8C0Z6b1(vi;5J@Qj24`NkJA_>1Q%p)#&NZp4&w1vyiAgF6Nm&c=HYo z%?Dl^`qvoGOWkus?ly{^@mklj={%G-*tI#64JPeiKr`#m`~f#(3a>5fq&%>e-tsVFJu|*S-ZJTA zg%#BEZG*+hpS`B8?-6r#>8NBye;AwLZ{-}{@w)LnJnDw&Zs)Tztw~BAX8+}_X##WH zWSs1dW?+QhG>K{mEgas6@Ox$NpsAeFceY`V)Otsx-};P;>day>T?8feJj`=g5CGx4 zcv6x{Zwvmc!zW$m&STc4FFFWN>q-pS&&d$5ecm-zGJ~(*HDBMefn!k2-9zwC&`Gvl zzRQtYgSi(mUS^`@E-d5NZ+?e;(Ql5T)I*Z0eiwOjAx?e5)-&wMvHtT0R#R62s@1<| z%G;`65mq+;B7P&6QU^O%jAS3Fa+X$ue1PFJes`tYDE%s=oL@%pA*pmjBJPr6t%^>q zo%+YGUjcQ^zk4jKw*-+$a*owl{KvV2zkVHyxo>uHt^D~j4(Ke5b#?BziPFDmfs_wE zz(H7MIR3BU-hbs4K1t8}rms077Y0kWHzr3_zuW>F;E{nkuVQy{(XP9G&7#j%HF40QPp4aF=mV_x#Biu7&Q+V?Yy7C))|jPD#qaa%?Cf5kHC<<; zA@81G^*+}}3HbpjZC#ixixYVjOp%aO{3|99Fxj|Is+*r3VNO`^miJGi%e7lrguzKK z1jz{&vf3)RFCHS*Z<2gG2v)FJC|ap#be~}AQ>7}Yt$X~UA!c451B8b?eqnJ^HA1|l zFgbz-cu0e2faM5os5}iBld&ivyTr?DIKwT#>ifv=kVs$1(cDB-0*W!V%;!|SNzAkB z&0c!nt6RcPMMS>;GM$1KP8;8c{5?shjzTXUkPATpMR-WhSAJlO)Itz^>?)bVo%1wf z!4{e{pr}~d_Hw|IzRv*9aCECgk!H_~pd5a$UBIKf$Lv2WPT1wDV6lS{@h=I6=|pFZ zRrY}bMKYzBf~$`s50Ws9sOQ$rAVq#rf2@2+v1_>7Mdn0A zWs@Qjajwt8t&>y%E*G9!zH;M5P-!q#;X>J8CG{&BXKowGy(P@Qq3!e5Tc28=A_lFj ztNH`Ipkt|(JhgN6y6oFB4B1;D04gdQ9Fv5-1e zYC&nYltLnP62LA{~3RtEjKH8J8F}9$>eH+2t6p!3*EfkJ>E>JmQ zf1-y&m|sy*<|eKuu3EvW&dT}P(?{{Y|7c>hVR3HPkInN;905Z;V1@wzJ&*a!2OswU zg8(>o{DIn&#O8}r>z#t6`4d1gqY#%Al z|3L#HYJdEnJVEoA*9;CM6_%Ijp1*iOZn-hFY7%fd971_|e_aE3Q(dq+&VUtDp7g)i zgRi6kf9r$uKfU7FLdj#I5(lE=MIMgFaUE~EX#Dbhl(WwEE#bars*rfmwAAQ~Z%W3> z0DHj4j~^wX#ynQxhkaDIwvy>KrWsj}-q|2Yq_@x`eY-lGXkJm5$CK&X@`W5*36%;BXJ} z6XHb@KiM3b6e0ZFMc~eAnqF3cXKMNaq=e14NK!T_=x?LjPrG==PYv!>aHdvC z2pN-T>>9ZEqjuo?LD^sDLah0_M*6r#E%d}YT{-=;V`lE{tSr5)U)rW|M9vtKAfxuM zcgm&F*wwg{S$giC_@usChAvg|n~ZIQMX^cm4N-l4n{%alFE=g$#bpq#4C~>rdg_`; zi0@PWy6C0BNkJf2Mycn=!f`+HkbY{+n>U_*wcR}0Lmjx)z3wM8Xz!vXs894$Z4>3B z&+#w;wvAxABnV$;IJ%CaflvG}zEA{B?_`Pn9=zSeCe@7yXlm z(PGc;8r=qM2Y#OQ2w-#$?P zxqn~RdB+DBHdsVN`8ewPzS|rRU!aH4Grwt9Eo9Na_kya6a_qTlL=+5t?xR4GlxN++ zg?qH;XPnnHWU79rv6IMs`(a)sW$C(uI^+#MsllR41)~SU-sC8nz9;N*Qd#`ruC4#H zb9qtTJx*WLo^?cZYm(08{T)MkROv>ea4KZ=s@iA$eeeO}MlNF)?QkMJYiJ-|7_v;0 z3_bd`_?()jM4AdbMDVKuXE_mIPu_&p<1%LvOj~I~r zWO+u_+If2nL#m901Y7$egKq8K1_6m=$`l0!o>_aX-1}VkKG5V;b?i(hEf~S7uaB4- z9eBls_o@IyRa8_jhkL3ZH4f4=W*Th3z{up*Okg5*XK}eMdjk)!l~}WYfFODy5QA49 z5I9Wv8fNXmG+q zhCHxKiDgyP9O{ph`tj{POn0ao0ms8$-(2m9MvDP$VF`H5Wx(2Nw|Wk1LNpovOb?E* zdTL;pOhHK%V9SC1d|dOJO1$E03wfLpG~AlYK;F0*L9Cd{-$>+}pyI8($E6s$N0Jz? zBub`9rD}&wlh#cO&5$2{_GEA>`;pexI{j4#v5a^RtWe1Uf^DO(NQS!f(r#>Oihp7X z7>15Gxx@!=HC5~9*y?fKkw`_gLR0)vb2RML3J<2JZ_3v^$?}d86$;sjfpgE(Y+$6* zl9fCMIm$$uMZzNm8i|@(%$nL@95MfG&VTM$ori6me|DFa)i<=cft$F22Rhy1k6-zM zU;X_vf4=BgW64j|>8y$+cqI4#XVU<7f>*r4AAqA*^pB|k7@T5nZu}}MEA!_M*;x8E zH#ZCZ>qGYelEd-;B!_Z9oh~?biNeF0ulvWnkp|T;0%e*WaV}4>a`T@&yz%g{j;4KZMKs?&sU@&s! zbz!Pv{R~PFFrrGiD%EO<;!^d4569!)UkdP`J`ND2)x+L2G$9s2$*8phFP4!tIcr*9 z6=*ogApmB6dlZCs1z)`zyki`6~E}h+Q4&r7&a7NT~7C}%NvgT{a2qGF%|!IlQ=XXmwBo3CCDj*VHnUe&ji zJ8zB%P~_m6E&7J>Hs%&-IGoH}RK|>F{4-AkHI?#BoGNu`_ENND{?-vgf`{rp?jk{Xxb2 z5kJI8Uc+B}5B5R%w_$ZL(`6dm|LIRYT;)4W87$4SWN&+YfuwbNZ8NKPa9;*NWR3en z%Im(Xv0I%Kj*H;r`PW&k^aOXK;yI-+m(= zqf`kEAwL9-W?5`3Z`dA!MX&sEkzKZ%*V`<>PTHUV zU5;nwd-Jqc=CR?8eEvNH_|J->6k6>oF)lRc=#3hd49G@z%5*-lbG0BkbN=?YKd*)5w96|et#S^(T0A5CJ<-!*Yt=a!!%*B`E3tU!dHGIGDsX ziAmK;mFd`yb~Ba~&d-GBKbj?m%*&1A(LT6YHeyUmRGhMyFQHg^=lAg$sDX6D*5!bIpB9Fz%!?ndXUbm!mi9Y4qrTR<; zj^^qM-~b8JFjeKZ)m1pj2`a|nMmh91HRuy4SiFQ=1Z3K37AA}Y`A`aneK7th$j}NY zEAyicQy2N+EV6JUa?G$NE&^W*n8(2@d0zfbfrKS$h>Kzwn<*Wumme#ipD4+Y5cDxw zV94DfD2EcFp62A6BE?-cmu%H9q%!0b*Vjr-n`ExhXPLQ?{rLgDdCiXiTRltA63`va zOORuOelu}*ZyOdPSa4EKdG0D5wfZw?B+Xi7vUD$VH`<+mv+!q<2TJaMW?+Zxa2>Zw)@bwulFR%O7pQbs!xgRb^?aFkz zrZb<(N*Y@?Tw0vpvRBX*sAmc!8*JAM_N0EXrg5lgRdLo+nS8hKUA z1s;SK3XbepKU}FZA!xC#?6-#o`jJ@#Y|wtR-efDD4kl2a4Zo7<84Zb zl0|{ngGfRou%I6grh4xUGOk|P%$6O$g*d5%=FBbHauxK^I@((%M-PIum&82Z4{6u5kkKRW+^AWZD)W(+}RsgLeAQw6Z-j(uzq^*ZX@v zG(Bq4utW*LzAt0?iMjIhav=zf?!kI{ zd)WD?wib)`_K*>ScYf_KdY^IaD+T^~;@76Tp0>l- z)v>=;PZa9gSxE;y@t}WRdsTvUohz;qs(MnE_FWHdYddOxsPco>sV5<5z5D*?NfZ`$ zkE>&<2mSXFu3B3FcM~1@_lu5)HNdRz$i5wWLKgs3y!hg8;l&qU0suVw?2q8tXa7g6 z0nuOh$Nw{K+}PpPt;jzNOb(a5l~;x*=K?4_|a#e zbU(k*(jTjRd#`Nu@3!<==l{N?pC5abj5kUWSSx@4cPncQ-OtC$dL7iSmGoSFxi=tw z^=Ey?d*bHnDUqz#Nd36&>v3#-sdYbQNo7~Z=sEg#QLp6EuTk|H>v^cZ7d;u9zk_$b`&|GCBzo_gGTk)IR2y&(@p2Dq2a%dDl(7epv+RXx zfgeHxF987x0U`7|xJuG~${B;mpp$?=5BZc*=krdm-3&pj4nVR%t3MS7jU_k>4DcfD zPND+O9aCzA2_+m*0kJkhf)zW3g33&Ik$6{7*~<5gU5E-y0I*;tG-DJ-6bBRlExDlN z+N!PD`P}P9@3P!7&mn3F9%pAK4TM(t|58LX zvMvBL<0Dj9Fc3=!%ipUEDcT%VAxA87@v7jb*P%o`GtR3jCCE6mVyV!B^e+4u9b$?%5U$Y+LIJBgMTnP3$w^$0;uAd2<4_qx~T4>~qb|0Gf(fZEGSS*z` zn?ekL#665Ls21(|2Brh+8UI<7FFD4>A#f~pY8{3b719c=K#W0CA>i?RW@1c@Fi|Ai z-^m!#O#GH~(H*b-q$C389ZY3R#yc-W7mHj9ykkO&5@=KsBF4BVHITK!*~}QEOae*> z19DDCDT$>A+eIx97{8M-11e%BB_yG?v3qi|6FW_kG}QhhmjWYkJXj@#R5-WTFgO{T zYK2LX37^|yma(hqBD5DREm6dI2NW>TN#a}@BN843=clT%F%ou4E=ZB{%wvx|E^TA+ zLqGIGc}<1@ei8GQb8pT#%6@eQ1xpErw%2gz39)~#F3 z;^4XGp1Yz>08ruJg%@7HbI(18mtJ}a*RNm4@BQBIHI;*h< zc*i^7Jw3WM+imloW2Q1!ja8)JtYn5~Vc0wG;VgrHZIO?Q%xEFa*{+R(+3AlI369!WqUii9Ukj zXkKT|`F4L?RGW4`Hy*ixv(qyG6|cN<3wO?MLw(cwqQ9^Iz1Ppi7(DaLGXQ|y?xbZl zFuOf8?>&H<|Ns4ypMaDj;ka7*a36 z<^d-i9OoHf7#hQRI_!~hYK&^@JVFTQGwXT01SBMrzm|eIP6$DQJ3?k~ooaw?=&}IL zo9(t`66Bomoo|1e8xUb%H}<=zsITte5cRLhe zYo|D0xnIcWXtH<4G?IgJ4)Z*>@nNDwK-#Rj7k48wqN+%y@(lrx-l7{`&%x2RAUV=zsV1OjX$iRk!Wo>2xia#^mc zoBos{P??D^3Q3|L*Ghf>fc@oV3lOC^Gn>SR*3WUC;GDy_*~<8)8pV(Q_>Z;B3GbZ* ziENv%bQ7r=BaN)fyDjfC{}L)#d~3Iyz>kyx`g#)6ab> zH(15{)QZ2M`eIsZTDDEj1u!D{D8Uv66beEJP3;0QmLStg?hgoofmUNwon#62@qGiyI79RM%(*u2(Oj|wDsA_Svwt|wCCFG!3$W#~tj|?d zhU3z;;FX>$&J1i82?kqdN%G>i`QC$BGD2#FF-ssPXTDoYmCO^v=bpqS26FY>`kv8o zowLe4c;Gy3faWpU0=W{r%@P>XEFfzP*BnED`XX!KJ?9MT z3=G6xC+WL{8GysE$iS)`tF;`HS?p%C4UMd;`s}}o+GRzJxD+=@0S8f2_|5ukpka z7LPu}OZ4~0d))2b zjz@01Q)Hw`zFT~HGt{=K7QlHY^QyKo>oLs}thER&=xT&CSh{1i%?OV3J+hFF^nRv! zMsS|CR?f-_mj4@AQBh*QTwEUTZ~o1{!xz4A3;*`tzJht~vxRkD>Lts2g1}m(Vy#G_ zK;as^ZIA}8W+(UAX8~80G4$F!3299@=m`luc==lKk9(;e93vUsOZ8x#wcdZf2VK{o z^ExZr;NF?y>uap#*!yd(RTz4rQV%>=ygo?32FWY#4HzFQuSZ-|f`k%SzT48v)4yJ} z`Wr1up#1++)+CNKq2u4TXuaNuqQGmFH4&vBJHTt#u^&%59@gJqlc-)#^>!&XSNH5i5ggZGVqpL6EAsxFfDL-1{_Nku`^ zVmrDHw~{T-I1k@T+bz}c3@k1#FEI{7TW=|-sFMArL`)geG`D@Z+6`E1TSh@%l0H|vEM6P#x(AjZgboPg+2_M4k=kiIaoZxLWt;yT*qnsq;_ z9Y85fDZ?7Io*+Slz;>2#FN6;1`;-z=E*K;Zn8Xqz_yF$(5SM*<%9(2-ki5|L`c>C! zX!}7bFfN1&1-$`a7y{#56*x=>jKe5tP!aWBJq$?3cROU$Q%~yh+PL1%o$tdG>x+;6W%4 z)eG)j&d$#8!_Pc}C!Tmhr1x9{m$+eY3*aswoNnft_m?aThmo5c1s4|pt_q;WtmMP~ zlEHRM`T6a3+ZLlmSg_XFCa3SLLrmPzD-g}aDw+QK{bjpuzjzK|Xc^xnGpMj+X{&cx zZDa;6av2O!c5}b!(T$oD$@n5!=PG+|`UQAkcEPo4*Rk7e+d0?&zTRiOB%1#J_~YM$ zcfRvU=|KhMWD1u8)QW7_rrrl6$;xjMd5%8!2w)bx4_E49y+h4Q zFqkZT`r0XLJEe%tW`}7y$Yy#0;MC)hHUT1YUn*cKE-uemkIcOhk&J}6j;AVR`T8@uwX5w!ye9i)Z!YDpHc=uV7pXGT5dKQY=#ljJTs_M z1x%d}C?&M#qm+Wfevh0PEK(Z=N?R`McO65Nu-pI!n4x#RKW9czsF`AWfQ3c4JEKx9Hy!DnU{c@{!KGPQW1bik-MCNQ>xdVwn7toLDzVP=Z?Y<{*QVs*n;btgYg^>JVcQ zn-zMC&U3`IGb`_HpwG_@9y1l9gxAQZJ=P6#y1Q(P*qQnO!UT9$dpZ?QtBgS&&I`_IKz~H?<_#XV|fAsy> z3qeVVE~w1bq$KPTly77c0OLSQBqh)RkaiJyXjv=k`y!^?)>)J!Ui^l29dI~I*lsrs zw8@#Eg>_4SSm$15aQ+zPIpGtZ_?P%6|KzuEc^R<)m;izMJ}9eUdj%SMaJW}XsNMIE zSu6D5xMmyccU0k^SK3jvi9W-*%K7`B72NE9K1MgQfvM2q&3JMvwFs~~y*-JbNI_kJ%x{g~=O?_s}gyY;ch!cXga zR6w{_a~FVV|};&TR#TW%IWpU0&5b*y6 z=<}rQI&?n+SAqB5u4Qd0b8K9!RSVYN*HW?cX+Ms7MVWi`k*b*7t^9GdooaXdv44-L zDy-{sFBOYk-N0fY9Q5_++mUrKrsAz{y^g>C_n*g4{KStjb6CioB>r>E>O0+wqmT9)d?o8K)<^iOSZWY+r`pI z)68-waoWl|UDX2!VkX3tu-$ArP&l-9(|xwCyF>7c1)wn`#@32!XQx;8eOY2FgCuvP zln}gcwh{)R5uN=Dj=YdUnmEZ_4sNX#uIuA3(U*jeH^?1SZgHNI6!K@zZ; z>(kJP-3k;}A=C~bAjOP3=jX_&;Kq$>ZGV|^fpr;G*1_KSw*J)pLCFPK_Sm`(Nr`I* zwX!hAU=(0oiSQ(~XE;|;BG;-_Gs;onumI7U?mPhH_UCy<$qqqCx>?8*wGBbtwlw=NPh%RB8d{W ztud(b9F<&9WxelY{VhY4nxmy~A0WgYU8ARzQEf$@X?ZZqzN!jw#|x>p%KV^vFI6Ye zH7Wo}F6(289w|<^b?a4FXR#Tt!&!@2?oCNU)*9Tn@d&IncEPv;U&hBj{&D=mFZ=?&@|CaP z$tRy|WCH;0vyXoCqYudi_o1AB{kI+x4E}7&v-i6K56ivFLxRDZyZp!Zy8;hF*?;Tz z?{^j6l;wTzdmrBW-XFrFk3Nb!cV5M2yTfjGircT!&$AY89yCi?2?4db#wZ6ExJ)t1 z=EW||@>~$cAZ&2Sy2=T|IARzTfK^E|F5;AhZh+=FpHjpyY~X#s`T6Zu|Cpi#Sq%Ym z0f3Dcc7Fx^;{@blV7d$nD`XzEAutezy3|jVL^MM( zmke7C=4oO`O+XOMz*TZVj8Xb|xv6P75b!sassqCa=NzWPp#k!_Bp3nyHISDx``mIj z4`uu(DB;7kwyUU;-9T19v+#4ff9ru5XOx^UO$Qhl4C6*JVisi+^%5lb$T=s@Gg6Eg z#|@mfP_+~#Q0Qhb#zfMA_e~vT7y^TH(7C5Bpu6^uu{g{Vwqg%rYHpeE91jt*WY;Wp zWZMSGU>O3hsaZt|;_4h1hM@t53MA*0S|*I12L?E3@C#TJIRv|j^91jlI4?oRij0gjXINL;b*v=-I*udG&o8mrj0@N% z&uOi|;cy^;41)jGxprRXY*U({G6SD;RX5Q2b{GPtX>RY2X__%^M)=^czl_*yM#Qe| z7T})2E(P?`UTjW0Nl{QG0+|OYNHc-$x4h*M27Q&(lo^oCQ|`zmuBoFi zNCIp&BZ(2)4NNv2@gcWtpE<^sy|mqqn5NhQR|Y_F%X@&|CAgTA1YSx-OcBn7M!X`q zL5LC}*GjodnLkZNFuti~XaKwcxFAq%jA=n96T~xC&Y#ONu{djC2a9Q%nHA$b1Djco zRnXX=3h^M#GiG^bRRDJ2oK$Txsq?yZ79}(2$m}dtCdoik)wp`jyRIYPJ>-4K`B?~= zLK1bdCNOo8c+TjQ76feSiI+#O)!kE{eMKOKL0mv&szt)sdyoD8&`3Ahc3cO0Di3(i zc?BY?T-3vs0sbKG8+~sA79j-j;8pO1V2HD-=2B%oTU1GmSu*OXjQ^kh=^w|PI}?8K z7ymU%Q4n7V1PcE3)(mUXfdefldJs-65_*dR1t)vSd|)9E^yGp5T8m=G)${4U4tLw@ z^wtY{A9`+;o?ipvN}NFVSznH2;P>_H>)HeR!|L}wGrA`T^x4}Au=c>S{!IbUdgQoc z-_v)%ntY%{gZ}>34JFMWMq zi(qg}IRdy!)X?+y-#KQ%p!L@|zi-=qEE!w{)q8Todh^-WOM!pAzK)yTI-tMbW9K|p zZ+*U1J>_2H6zw~Gj`d#F{nD!*tO+#wxgM+Sye1y>$Llqfyz*LgTi&-<@1wu({`uAV zs6s;jcLV2u_q^vR{DXh+KVWyV!^z1G)>`cMd&HQq+iiqQYcP%mlaLGz1h^EB^(^o5 zQY(frpkzsmFa)DjJ)o9lPhD$mDs^hPphQw7M$&@7U^{Fio}z0(?o*SjXVmLm(OM%Q zq_YmiRgB|+7!&rF2aKDsk?(6=_As>+RAbtnJ7%siEv%?OIe2GeeM6FOwTu&4u|ceA zmtZYS0jk79bpKO|CXaBY~WVwG|ra z!vKvuLxr!}5>S*7RD}Qn2ie0evBATE@d#(E?8T}mn`KeeD<~B(mhWX_(VktkB+=(q zRV3z_dxsbki68=`4?}2iC{?)B=P3-fks*TdsABt3sRznv001BWNkl6`%a%C-K?OehwN( z_={9-+_-_~pMM@Nyzl~^fBt#gxN!qFZ{7p|y!6sb07ydk$VWcXet%g0!q))p+2=u#GfVEZ#(O_r*GZ)AVJU7s>G50AeoFWw$G$UIx#k}+IeptNe z0eByfQ$orKAq?=2@_|Kw)*^rl0c-+GJ`5<8K)EsWO#^^11W`p`TPb*}o17)HS|GM7 zQslKQ@LTCXV(%$c*oQf%X>Kyj8q_w%(qB(x468`$Z#FwgL?E#O5ZP^08sj?*19Bor z>jZ?;jMc`pH$lK_0vg1I&flXkB`5(%04Gs>V6)x9hXE zV7u8eBf?tLLUn>LjL0dXR4OYdVMV1lhjGi$qq7*y*g$03v*e|pC9BiJG}&{tsGwZA zNRB7Ts;>nH0d;8k!gkzkcMTu|L>j#mOos_EWd;JRZIXmmt}{(D2~)MeN+3_~BWL(Kinn1x!rE)ooEcE!;I6@UE82XRb)|66o5TD0SqvRXC~W= zfs}DG;Le>3$u4rNQ_9$GMtFbH#^o>s%(F^?7Su+HP}PvsKqGj`jp1h5uz+&o7rsyK%z>IhN5{x;{LHviQIoL01RC|N**G0yRN<2bfH41s+- zgn*b5ro+^pM`og-%~3HfKAK8Ku!ezFCF}5+V}i3wHn{@M%_;zBSvE1LpX!qRrOFv9Rq3p2;HWVM5Q)_oNuEfl05Y%A zf~7Y9;bJSMX=>oQ%6g{6OuC#aPEK}>Kvhb`I0gx@XH+mye13i*Qotjes9AVV&(-~5 z#vCu0)n*8w&nb#Z!;&RaB#@c1*f$x|W%m^f!`KvZvSgYiQS{O0BF+h$Eqz{#kie{2 z0?8`l*{dWdNnyJs(MhFHIp<}PezqxX*QVYD1`B>iytLyaF zTda}fx&X#;gIX&t_It^ATryL0PHk=v&PryeZ)+5tU)0)$b{>#+aaZn56&R?{A@3F; z!|C$@A&d~bV8+{=BF158>n5G!sT5OSoW+0p-~1H**+2UtzV@~Ar5{@efrN&;Z3<%7 zxvF-c-&JrQxJn4n<861Io)n-cDp}XInba5|<`FnxhJ^4U?J|?lR^*WXXuWhj=BOE(!O+EmQDAK3DRKTYYw{^mSX4 z4{+r7wT;NStSvWs^1-qDURzNd8-Hu^L4W-oo@8_v#7 zdG?fWI7|)n?@4OCFS{z3scIzTP85U%2v)km%WSbT1`&<&xY+JXZ9Zw?h zFsOn?U5L@P${x}JMJ)&9|3bo?v0Q6}ZwIAI3ox-)Jioyjw{7(x^th zr?pBm%fBQ`lCN;ee`B8H*em=lTSX0kA3W80DxP!Ze1Y~xbYf3{_&6FmwxG& z?o$o_a+mq`SCQvCaKqXCuF8W@o(1sn`&@^Ikp8p+pmA% zU!wA!_q+!;pZ;N3^$Q1?$0=!_CnhrQUy~d2SS_FXMLVKPk1Rp4$2LhWZPnc)% zP8=a|Gxu)_HOWC9#8 zls=s22{FzX$BkqNO2z?9^Iz9pwlx;ktIY)M14!1$0v<9*qm~mYDd$~)wbOFXDjzJH zSMNO8`I6B<5{i}0!Mvyllmb7{IzY#hljBO)ehPZRFk4i!Ba&nhkDHBTV-Qe=Zh8fU zvvrZwM_D8f0f=m4ZDU#M)<_v@H=w|zUPCsc##sbW9cahNcTHws#+n7ptX8Gy9DyxJ zh)x1TDw&D8WN7LbRdCCToPP)dB?pCwlUk5Rf;*m@blr5Smt`p=3hgg1+VOn=EQ!pv z1_KNXiZK24`r~HX>RL)_U}mXBR1+*9W6w9+j;WC&N@ma`$ovF235*e-9EJg>Cnu-? zg11O9VKa`%r69$Olw|WeP_nYriaY1$xOVNdWnsWD!++cii079;t(az7M5sDKmB3x8 z8Mp5oaB^}YqzKnCTL@@#e4dDH3MIN7;uP`9E3YC1k8v|HE2$K0w_6lZ_ed#WP7&A6 z&RRyRwalc^Am!O92?9QB+I0;K+?GL`Qt9hD4g)r$K^QnkZ#F{%*o=Y90W;%J_8nYa?kPztDg|11szxw4rxLXQ)gY#MMy(Szn-TMz zFbtkvmO{9Rb41A%=NA_^Jv+f1XAD7tr~;T4G6+yAFa*yaqJWDjrv{D=5*$8E6TEYc zkfOoZU_B1g3`*n1W=Bz>cJVk7`B(vPUeFqi5qmSMo=sP9Al%`nXtc4M9 zSl>C*bin2Q5+^4+d1fv6`m76KvQ!-Q;#n*2>zFc9ns9o$Yt|ypyGH1kW0ZGQZ638s zI;&u?eonKij4fS`e~K4W+PJ94Gv{Uke%@0dgaieHx4-=q zU;Ekt1kqHHVAZ#5Ir(>k1;kSe5mggV&`*K+h^rvK@4mYRhkF@yJ;yOXRtW_P3ie?C zG1Y_NNIgw=oc^n-2Wtfc;Hpf#{thgb3cXrF-!8r7!n*Vp482{%y4*_%q0fldI%&3h zPvm&5^Jp8RJ4a8r(4zJ12@E}W+_!_02OvN9+3afz278a+`|SGuTv`?-uBEKW1MA;k zOC2G~J-psI*6nw%qFL{HziV5AdzE9V568#}_fmj3R+LD$kkSmb`?9vQwKHF-k|l0jBc>_{r|(1( zIaTVMdqE{{SNZ-DUvWZ|Hf{aW)CvSYbL|~xt;Be$t{c$y zjGFl!yoV7`lz*3Xty)=1l7udp_1$a0*ai|w7NvV%C$SLIZ1xz1RB8E+cGiiaBFWt? zks=ptMk;8!&B&OGTZoU-G`GDx46i%SGh#|&nPriaWZutIyQ-#2+-z=fB~82mROWwC z^CXyD2}fR+RD4%hunsj}t}H3=`7?V1Lq< zE#-`0d7bm~3p{dzHd~PO&B<=pNY>UmSjT%&1uceAcs?tN6Z+=rtqYv9ZGTy6mOVvj z@dQl_S}dZ92-JgJR_u3M8RH7cRW7^)2djB~J0_`Eq;CKZXb%qg}#i~*Xpr;-|SuHASLn-Xx} z$FWFd4<$@<4%Bv)_8&r1yi@{_vs5gpxxzR;bKX1bFAq39*`dnX-&lj13r10i9LEjz zhY5#i!u4?>nQ`8wjcUrNB@yWQ_^Efj3-5U6JMlw*{jcLc`Kh16r~l=r@%68N9skEC zKZ!4X@r!SIqQOfqy@aQqei|>o{PNMi=jk>+_OXvWR4=%X<^1cvh3oJ7&+d0M9)$8N z9uf@Rl;t78;LTf}z26mh5X$8PZjW&5)-Bw)apMgie{yny_rCXi1dcPMi8W(YNds9t z>b>{aY_<$Ghk%@`fYJsrP68Mfl&GF?Xo>*}0^^dB;KdZl6kb^3s+3S6jB1C*OxJTD z1JhJ6jw2VVg_+aF+Q#PIYzD+Ri5z$qmaO^;7V%!QLLdN&$SxOQw_E4n!@!L7d4kEZ z_(yG0V;b~V8Eyl>bV1u(GNuEq0fu2f7`RZsvH`-?OuE-92Bv+d{~rIX1dFj)CiuY6 zf@c42HY3|849FrsXpF%yjMBfRfp%WNA!c!#1`4A>ysqgZsDT0)Z4ccTb2E^Wg5yq@ z&cF~hJTC-GuOcyC3SwbENBytq5ALqqGa%U!!nil!cv2#Tk-nKF1EFe`p^yv!H1>U# z%zh(d-8u_vJaRs?V0}&rMN|!nY~nm4{tS;PsX+Rj=dD=${c4lZb`mI3c6XI}0pJE7 zfEQv#3*z&};eDVS`7|{UM6*Y7DF~ANykrF|{_PdZ23Y0e*>?`(xZ%A>-`A2cNA{K8 zCo>io(14r70#mDG>DspORgZVgV9?-+29k2lh%@^+XA%fhbs~7pbY7$~bIpkH&^;$q zS5S)qKKBE>_lWb%U{PV)4C6q6(i-e`J8ZYxrV>Cx1BoS*WT~e_??-QV?qLWRhJej5 zwy~(2-HY=}7-O*8ZZOA4;9oYuA*ft9!Qmkc*dGpj4)cg2a`)C+*g>8dm8GwI*5?@U zt#5xDk34b%C#NSs;q!fYxhLQ!$BkiZsuVHOThx1xlbsc!7qd@;yBdT8z&6gz0^%>AAc)@YDNfHRedo_BOCx!k0J46#ym$%(?lQG9UADX z#ScLUH%79ZIPQ(1y#YNMW$p|?u9utjf^!aGsJQ0NBr}A7xsl8>V*zIesJHF;`6bTI zPMU>+W?BtnXwNpiPOX6Jr3GQFqxDa!Xe5S|lLU7e)O+>S3o06HMtOE=rBHnpPu$dk zP$_5FTHCxa3TAq7lYJs~ScUW9Fow1U zGe$Gdd?P?88ItdRju}^NTX*OjR0`MAs-&dnX?={^R8T*f z2Zh(F2PzwH{xlDV1NI+ex`OF_v*{_&+F2U$F;S>vHGmb zF*1VorT*L>*N>Z?Y@}mC$C&=SCQqy_LSD;SLF>MLMzrtNV>rT?g2x_v6hHg3AHw_J z|32hWaC&;eWC#HJ%Y&?q3g&6XFbvp^8)hh*#j?hUsu$!PrDSzoQ;=ZBHHYrqRqd%I ziRUdi6Fg zE-qxo2l9EOpWW!!E$A=rCSY!kJJ7@O*kb50Z-*miM_D54^z1j^t^fOO7b>wP2S z8>@O=*K^yhB7m34@yLsZu?(V2BmnSSrQ5LOJPDKi5H1X?y}EbHDK|SkDpN4d5~m1kH`t844<%5lx?rB8kbH%( zp@|@QNf@DWoJA2W%AQQBYtO@BV*H{b%j>gpad9c*VU#^S03n`c$>Oh-V>hQP{o^pr zGj5-sBhF0t8Ha(^9s=s4R&G&ctviH(lxYW%Q${LD5_f1p;DxlH3t$rbC3(cuwkPM> zQ=eDJSmbq#K})1C#xy$@CyIfP{w(qw#;Wlkwv%`E3Mt66z$oKTz9|gI*sV$!S%?Zc z$5powcb(-Py~VIgfi-Tiov3_v_J_l=cP|yw9BFw`sl+*MXcMaI;Ur0SUQ{6-fBbR$ z^oKr#FMa9DcjA?cq_dQDO*s+F)?ljlO{zVXB$Ch$xp0wNOA#6OEScAUvP+Es zK@9x*7C_~eo0*!6BtF@{8nm4nD4QuO>l|F5dO{e6CEMB&)H%C;1Bd-3H{2<~NcLor zg|f+HTLWBZLzv}05D-v+-TQEbKw*r%i|MKh>^@N42gLiI@3KjdV`EIsH<2D0%>_NQyd8e=ew8!8kG1Lo-f=R@ne z5Gbpu&rb7r7D9q^^gq-fNt`3I1w`^$gHqh6iNv9d|C|#xn;j(|WrIwQQO$r^>d4LM z5=_gPb^?$fSqKBBX%FW-#&Kw*pCs7_1pS4yl1L&VP)B*i;GFcQZ`rH07HqZ~dQ=97 zJY`JtB$*}_*RP*po@4XrR3gPJBnJgw)o0yV3nxl198(LqO05C*hY4PSRseA0#&tOF zaO>4q8E6#gOalVxN(!1LN+Rlp-#Z681d*Fx2qrC?!Wz_En<9g%dypW*Oj*rJa1ylB ztOO$g9wp1baXf6d^zEFc2|!&kaw@ZgoPbgu^n1)QZ#W64>hYKRJq$RfF-XL~qxPx3 zV}@a9-sDCCm2EDCST(4(WhDqs2}jER*SfU3l5Pfh7eJq3AwMJ`WNAioBX&tfi*xis zpQgEG62VZm(tC?s3vAX*AOieeR0K{>cTn$B-V7QkYzPB`$`XW)DWm4x0$;W=(^)f> zja4sOz?dq}27`5n!;E1N^&iVI;0@b;=-yFEjDf)-Q7TfODHk|vG!`u2s0Ps(GjfiE zkeD;V5HJpd#+BOmt3pgV$ovq3Cs{(W?o&#Vp$!bfAQ?Lq!#FhM4)rs2&SIW9F4SLi zo@d&Nq=eW7?RMKOf&WtAEM?~hLtw2|%I-P|fLdE&%+Rv9`**apw5KqcWHnWOa;m!I zEk>xCN5$p-(B|nBvjnKoWO;MWaK^zo)5iHY1QKhcVMFlknYg&zBjwZxP{Tk=1=hiE z9`O#B`wMJ@q~o1MF)d$*p30Rn`_7T@H*8Lk=BW{lNW`dcUf-*;1RDWZ1!;7>Qd{6x z1BRvw&>`bmt%?jZP~1+@N>eZ}2F?vAIl=i6#&{UhzsqXN#OG&4&PQT{g7mt^xl37~ zyNRw*hP>=eTxu3g=`^W-Z*{+WU*doGclaYztL}T2z%xTi@ioWKF6HSQPaO^^7*g zz>0r!$po2VN=T8O-hjcaTdyL70SlnJtSR|#zyeZg_P+ws+CO90D@q9HflmGV8c^*? z1HH9E?T&Y=@0RYnwfh-ZGMSI59%!A8sUGy1>uUl9uqYtt_)}oBKbO|EcIQx{LI1C| zkAnH=zNgvQT9&cTl2(7y@>=ABzO2awW%bzx3&7f|H{1)jMR!d9U9IaH&kC%9V42opJ^Q@s-$rY#9v=qkHwMSwN2JGEjnKM zzS1`D$Jko^K+livn0~yhi9R~VQElx#?|BFQ;XnNE@mJse1kO%Rn#z-|DaSFO7T~a- zT72O!PdtO+zABf35V%IjqJl=imRD@=EvRaag)z()SG61x3PS@LmCUV{d4Or_4h4(7 zb4_VME%j6ljcNoWNfg;9IwyO0QFElC*|Kj4&NcF^0)iwEE-D5}euMND?TcKK{Z|zx zV=a5Oa_#EuqB^Pjz!)R;`w7m|NvZQ9001BWNklC(Q4OKub zwJeH%5P)9DUb^4OnS_3QRVh)oFVo*sRf-X4Aeq^8KA|0?m0?kys?&oEQAdw=c%gB~=h@}aamwP;N<9h3-rYu=O3oKEp%CZmi-pkkxk_fWQ5&A6Z zbAn3J4l3KN*`?|ldtvsH@S*B!LJG0QAnUQEikhT@DMr?%qL3ov(OOGRa_y`S++sTc zU{URqxQE6hlq8cI$w>RgHPTJ3-6}}h3kG=0BabwKy0aEV_IxSMZER>vz*^g^CN=TS zfF$83pLz=Kde^(~lRx>B_&@)}zre5k`mf>TmtV%k#l>CY_+fciUa#!G^_lx!g$Jd) z|Cyiv#*N?ol_$PCFzjLZb1$z&g??D>Q+ej+zws1+>-W1J4??;8=7XbP@R5&v1OSNz zAN$zH@X9N%;K?VSM6DGszW5@Zdg>|MxN!p?{pd%Je*fCFYk0>y-XV+V1Rnx3rDc=g zyl3{_W-FP(BdlAbtrXOu%$REd&;qV`1SSG&oui~0oPhd zD#)VT;H+(6n)(nbDWvt00NF+UrbH4wKDNbo){bax!uH865TgG%@h2R@ApedsZYbkl z1T5Cff1}`lWK;8cY_D7vB?>1Q0?ei)0IDE%tyL5#!WA$u<&0^Xfo^;RA6k$g$%aCu z{fse~=7}3`0Y9ybp(KG5g6{OMQ%1Ly&AlVNo&hAoAb?69Iys;7By*&kTJ|>Y$+hf5 z11#zS9mzz2To^v5N<2scOk}ZqSZ72m9_I`wr5IaZsIr7waj5-4&IKt(2{@1dM3pPP!{uS4q@8 z=9y|U8pCj&(yArP^CI^Ze83=qK1lFQl}c0@M9*QJT_oJ)*g-&VC7jGL;_`CeNLuVW zX4)`g0gY6n1cU|*iVB0Z%oN{lH?VHW%27#qjxb7|)8E##ai%_z&O3y`x4um&w=8*Q zWqy}u!$~ktEmF`%uL852%cqH;g7=iU*XNX(FU#>9n?cAazP;D=v8dvu3)GgyY%N+F zsVad6OM_>2{WuQt3|hrw5#us1czK@3acpg=>MU7;dRE?Dn{m@#h?+^Jfz1%;9ei=Q zZ+)k8fj(nSyi>Fz^g1dWh*A{no2u^^~LUD>a!HX3NMG6JJJnvfn zqwj3ifb*C^I4@|;K8^*-|!IO z6Nd)dsHI#&Pdc}Eveu7GN0L4AqzDRumUn!_OuDRlCVU+YEOn+F&~~xe3`;!~X>|s+ z13vVCKTaiD@qn>qK@(J)XiFr?Bg=1~|}wVh#KXiqeeEZ5}q=i`rc+h6p% zT#$3|3oyO4&*yTwiTAC^90aGUW_23vi^h%F-r}vyUk?i8wu>~uWJAcF;?_2AmUi#CmZzXPx z>dat$H@C2s3uygd{bDa-(OHA{faG)jNt0pk*~72?K$=OT82RC)mzT%ar4Ll~J1ejE zL*B1JVYnF3rg5CJyUPuXZYPftALcEOXP-Y_RG6~&g+;Wb7gcrS7>`at55J(q?#n^b z-A~(>OC;jVjkhPdM1R~+^v5`RFCB_+FE;FF?_J!_UyD}f39%nNDrXbLJO;F zg-DO!+Q6~vBxCT^OaA3398(&WeEIrv`EBh)iQYVD&3g7`bGfCi$_|T|)?PC>3L%m~ zow+u%6_uWBBG}hhuccwjyKuNyOdn90dZu^h=0ZFTmKi;h7g;PE8dSz` zU9z1v?!j#cEd~>{Z74QaEVNYC72^5)E>ox7j(RoZnOqpbY{GJVsVh~WPmv2f$zI8c z?zoe{D36jn3M^~N5iY*AK1L@K5SI3dEQKG*6U$wrW^`VH4TxSoIq?9bXRStGQlnMZ ziG86qO$_OfAFy;ZCusIc+{3*0-Z!;Tdk_&O_b{60lfFdTY=I7ZtoztbK#X;$sUu zs&10An)U+5%6=bZOoaaC%g8l505f9CC)!WVeYXIaOf(qfc6*i4M^iLgm_9xPv_FmM zp`ygvn;W!o-;W)3Zy$>C`jh6_`rqd4Gv)U06hE_8ln?{z96_yL!Osi#eHge}{|jnb z_VkGr5bqQmu05GXpq3u|#ks>xlmCJ$`5-O!`tJrF^r-%C#qjT%^OZ;9-!AU{|KTC* zi$h5Mi-cA;&%>RVxNoukfE4rw{ZZNSw?{MhQRuibTa>zVc`8)&hCHMS>=8#t_uNBkEXT({kzYR5zY*!E3#Z zdj4*hn+=J?(j}R2O?(jprT?Mmrn4t0{$|%s_{tH*Y+=uW{Ot&Zy|N%p`-=q%(U#4` z(Xh;r1^^GHa5&iWx6OrnGgo4y@zr@;rn}C)r1CWw&+v}ju%J9VnHb_Cr_2#|lVlWe zkup5M<($4?6_KVA(TGe!%z_`Rj_7(?HT@K!^_cOaF#&ZnfuX1^GlEf2a220LUg%QZ z?zs)0&^!H7ocG8xBe}IBN_(`I>lfH^OJHLwTdk(;Nu}#I1F3THX{EUheG({W1AzTC zDq1hAr(tcA3%Sw={SRlzvVc1|FkOTNP*dcg6p57;I`x)+3Ko`bUy`nNV93r3YWGsc z9J1wT^GdFfa&!7s(?LZ<**P=f-R8+P6};@L0mhqdtAXIHzPXlG#+u53Q%BjP=@d0s zrt#sZiPl{o+2kw>S(rZ|fy@lCN6|-{Hn9&tC@v+9Ya$(1a(D$TQ9O@&1#M4HYWn<1 z?1_}4w&NW4w-ByfvPJSf_yyLGJ@jU z0jNzX&i-oKm#1@Z;h?uy^YvnQ#QjiQI&FjBcgMB4`;ap0#IL0EYn4)sol0NtEplg~ zWE)LK`Nv={TuPl$V3*1SlxqVn(RGf{9pyG5Rm$p7a%aJf%0i9-Wfjw-dy_>%?k+4R z6eHVn@(82$(;F*>IQ>>KdDaDX zn+RGPa^&Ek>kNL9C8H9OEGv9%=h+v_yw*OQS{2o4C`R+fxtLyH+Tl{3F+7gq+Y>p zs5w)nIM?S!k69y5wTmAGjACk>fc6ag=`64x` zZ-McRHD&HiRxNljtmxdMM>h$qHcEX!s>aq&URgs7x|)hrSIOSm1&D)`Ojug*a&K#P ztrV-|A9`4cCe0liLRgf%rY*!*;g$1gxD<}5Z%d+OYs2MW`bG?!3=Xzz25lH=uac;Ar=wv)atu;Qc|A1TQo!=FfIuiD_{vG%Tf7zX2WL zXQ+AVf)C9fA2UMBl*0BwJ+W&;b92})`wC7lINI!X?^ADdXi>|b56w0uvr-?Z=VmdR zB#NI+DsF#{C6eei{Y1w!c;5OF6b1LkyX{^+58&yyux{D8-0iPE&G90AKN`qyTe|aboR8kACrdM>9z7HWketQzy zIvCYDjbYih1@n~Dy!hoiTILJOBiKGXghQ!l71q~I*_4}6b!NOPhsb{=W@nXq{J^Mt zI$4M43(r*`E0#_1q&#-p5(jDMy89#!lzMH7qOUp7DY4t&uh(d?$k^*5MLFp-M$Ycg z#*-@J=vg&(b`h-qyp^Tug?vK#CxN8ge|LQsZZ*2H) zgm^y~78p2zoCPcZ6KiUtcLrXj13yuGp&bH7ypo6!M>g|}j-}@xowUUI0B5@um(;kq zu*%t0IpE^;B~mbHUT`3Osv&aV(*Eb9b@pwyst7)EhvFk7Rt3@#HCoyH;DQxCUQU4vDIKJ>_1)DKd3+O=o-=`E=E|(j{#rWYC*W zwAVjotVr-0mwMpoBCZcpMsk(jAsob&cB>Z1HtH^3I!P^`!LH6H({`x)mEuy7;Sd~_ z87>TVK%-kN&aj8|H*L-Y^6(NEmA{G6c7p4XuFUnT_2q??%j67ODR3@LaFTJ&p#`dU-(eNp?p5%}fmD#Uum4PHsN7TMu?ax|lL zQq(@XerEsDC_Kmwsd%$2lft64*p>#|b3qvxArnw1x$gWR-vggcX}LgkIyz6d+D!8ZW5i=M?})m8knD!g|1D6is<__qi^0}(Cd@l|U#1>6@*b>=W>yjM_u9T{)A`(g zS$8=!WIMxejtfn?lpS+a)4BRnts$lctpGZNq=Mfv&Q!*XN9{&9En7ufmv&d{$hTeq zfY$9Wf|lbyr0Nyf*?GYMn+R$J6z}|-4pj(G9ctlSX%8<$YFU}p^Ln>kjU4dVQ9Uh5 z54C@mBTjv8*)DJ-_*K9$fCT>2PdB84+L@tCdv6%g&jSSGHw=42AD8|HwM$whQ2^ulraCLfRGHz&^J7c&&Ah@|2lUc+7~T^ zLUnz*lNYbL+r(E~?(HXC7^q=)otP?DNxod zRrbQq>qCgLnSP=6)0L}O$u5yMWM)YNW9U)eD9QCh)S6?Q>$CQ%GF`^{?|(<77f&B9c?B z(D}VV4)RU^_wC&hC90Wn9Y`aP&ts%`TCkqgZZUx*3Qd{=(MRnfD;%5YYmrvMAItV; z^Bl;^OE_u=I8aWRKab3q}hq~>!mEz zSu~U|lfy%%5crMqL$YC5p`lsuyx} z6MtulBMg8pQh9F=N=Z`4cn%J0$dXu3$D&c|JKhY$b#ap?$Rf zUK(+GqOI`Q5J50ii@=F0Z?V&VoRzd}Z4aXJFic+`J&AUA#9Ghg;=H7g@i{(nm@Whh$hX`Ny`gy{#~P4+1&>eJ7pHq zFX4FduGBSg9z!Fs_XubjX*w~%I&FyndMAFo^1vUC13@c@TxL%=QKwOl6Udk%tQx{N z^qz(~MgETAaj1MFrFG5&0I`p!$mFzE3Ql@U(LSc!N!Hdr`WN;PA|VKUZTwKFqTzh1 zMg`tyI;y1+@p^23Ed)J*e2~ns+;?ZNv9@RJ++* z)cfHJC(->=q>C|fZL$jJiU)7=1(Ev?+84hQ5_BsmuIn3BwJW45epNi1FN(FeEm>wN&_SSd&G_cVs_LxjK2x-O*OsmS0xYB9j1`ZK}ihZB_g5 z=aS+W5imNEeVii%vw^y=fhffCGf*oG`lEn!UtENnHY-Cr%DX2L1L5g*{|TBqg1D<8 zz7#YG+H7^0$Mk*MTOgC6g78R>G$I>ovrtMD9vtnKgyGh1lkM&yW<`pky0AJVs*D_X z$*oq3+~xU>^gW_)q0S*$O+DgrLZpm~;r3*2T;mw2lr7PMp-B9DO&`};1o1OMO9FB_Z7N+)C zz4W-;Hr*WXs*dQ%^3z8SK(O$VHq#|v(eBNR?$~VeP`v7aLPrk|iM3d-tQ{)8J%`TU zWdfeWn!BOU9}PDzO+~($HO3Ed4VNYXqZLKf1P`|}^pD{@e_nc-J>p#`v-(-er0a5` zB5jpU5816Xf-SH=*N~k1S~YXwXvRftmofyb2!5VZK(TnBxH99g;!7@$*eR2k6rM(t z-d=I+iMYY{5OJV2ToJK9qil+pYZ|_%Kv%^PSN!?;GcvlXD3hFq5T^~&v3%&TX~sPIcu*sF(mm6gRf18D@)vq!+zN{XA_X#0+Qx%7^U(an9`n}oX-kW zucoi^khz!3xlQn^3_-!R`;eK&&ir{=SpL^A|A~1@eC)~!X_-L`S_>#jc2UtLDcyo` z$D=XzDErg~2#&y+ziB5HXZuuA0s%A06UFxYt*am&jyA8KNM?5F_1jYW>S@P$uy9+7sFK4rgM*gwwYbOwBceCMTARHvo z1)`UdY-d13d7lYW@GfJwpLfwQVs^S^0}KZHIgOpo+khX(@ClsP>_&`b zzT~*KI!m-;5H80=tyC4fSj}h(jCrcMQ?81@cHlz?0cTC#(5%6m&LZb6z;QIOF=s=& z`sOFe|MLQHaL254g^=glhlbFDXY%-e)VlBr9!9&(U zW(EYVXI*qta0>k(ndCLSWZdQ7BHWIK^DLk@4U^-Ut>G1Hm;W6nPFph-^6L5pqlRWR z+iWR*e9teEw}Tl-g}h)*kXO~B)Uj(%=6WAXrS5%qVaL>cqqeam_`*i_DaR+_wmWfyh6{ zAi9B0#Dmfv3}XDIv#8K<{9yUaoiY~GdDhSXUayH({bgHEV4<&8R|nY}9sy?+{4Tl| zYre3!cq^wQwXBAhjaS1FeuvDex2VOf9@S7-R)a;da?w%X_r12cG7kgADN)p)^K9Bj zsT(TX>A@jaEPak}OWm!PEGsvoB{=s9bxfL4PSa)1A7>@9gEl)b%?q=J(}kJ)t7$$W zo6V&FR%_;GQj9}?=3wd*v5rA{bTsu$ZVd?TnTW~jtq81EY8bPz?%_Mb8=;jYyj!!{ zsn()Kx5`1yZ>jNka{-rpobdTXkwuVVP&AWaGA`lMsJku)oj>29x>2Tk;q=!8qmSVQ zo}*o1PsLy0e~^}@WAxGO;+N;cW|yBW*P3uMY=)t~#nV>a=yJfzfsC;D_MLzblP{XsPD zBb5EI#lCHZGLf-?{9|z)O=_Lu(X{!}QsD(!MxCx|N)4P|+K7)Nqz=cpk3#WG#m z{3wrJCzot5t@%W^jOm$iVfE_rj_PI0vS5ku3ay8Za0lAt^I!&tW-_EdUv0uaR$$-N z`w;J`fY9pHa#TitzSn6)MFB7#*$+j^l!c0hFl3*0M9VtQwE2XElhwzH zm6DG&9~v;+5#PMgFEl`)OKX^nv@J58tH?^o--p;a$K(u97LK@fjZIHOIwO?Nh3%#k zH5?0oQn-1CO5is%h|K4|3dY(Pu%Z?`wh`=p*KO|Z-eRj)lRZ7d*`7F#(-Tvuk*GLN zrl>!NTaFnwh52B4KC?+Uk2qQaTd26XAVQJK3K*(xPQWD z-Ax|Os-%N63TCc$?+Z_}-Wa}!m=KiAb(^0v854{x+)7>|xuL(3x$pDsqBCBs@y zStE-;In&O*xK@`zyb!UrtVyGz*wdA8PgR*G47st{D8gY#jEobxK31B-zE|KWLhYpmSMady^d#Yr~}3 zkO_Dm^u}>ih-G{X6j$b}A@>a5d zLURP=^3!v71DnFMK`QydyCzgU+kwnoaq-+AZHz1nlefq!N|@KZB^4EQBCO{9Ga|V1 zle%!WOD&JZ8?p053AwEPF9DAG=R^!%z(ZTgQA-&P^d{Sf!sc4ie*2&+a!9X2mE}?1 z)QWD@-m%Y@^B(FJoh4LRo))PH4i3WEfN_ZhznCcwhCHcRQM9FlQh;1(cl zo{tz;BB^M!-nZy#b|=I3rgvDwkwoZ*32gmUR|}$c+T}1(n4Xdt-e1`V!K0hT@|e^k z++!kbK0P3YRqmW#PQMd5o*WJbF~FSQe5B87_saK<}uV|P!F z<5R4W{4EytIZ4as=-w(R*Z^~xZoItER`IYj@2-lrLu6$9jPQ9CI&O3G#>*GsfJc;~ zGGnY!Jnm$fCipk*(;GV1%R5o_$w>IwXdp64xY7>4YX`ISsYK#5saQynB=lY3&)EYq zbTYJ0A!5^{R?bd1X-*D+Ai5SKRugxZQ<(bhc}lI9X3TYvt8dLe5eWN)IVd^0^aUwr+$%h_nB6zh05I zmxn|){8pVBI}r~M4qFOMV_U+Fz=$R7Tc=*>)`92L_*O~>aKdq%$4JSg0|eEaw2!&e zMB%Ndt?Zb-qDm!7ER&=KjBA_@6dsK;{*2+i)IzAoHqBk{(3gm_CZbWBf#D0aa#KV>;CThF>2l+;&qT{a0TwyZtVyw}Wrg{(EZyuFl{%>i>-w){=MD z{(ld1e=i%m?QRbQb%pK(q}oc*$^GWb;dhwF_Hd$|Xu|-IT7MPtNO1q|=whftC)ZAz z%$R6Ci~*5F>lK<5PLvBIc|tUFP|*{m#0%D;-6=;(75{0Z)B7n073jiJ`!3=bpIZ?R z6rQm`z`S#Lk9c$xoe{;kMaTi#Q0B{Zcv1IlskbeIb=gq2 zIvnrhQ zv3hZTy_BH?fj3-K%1u>MTtvb@xd>-GBf7CdYJuiacZ9Q(U7;fl2L(I?fiZR3L!5^Y z$nbA}`iLj*UkEI1fnd}RbP~72v0kH{D;Bf83CQ8vcM$4KzNfqdjI7D29*ZVSN(L^7 zjNmY1eyFM5bcF_)|CZ@wX#F4OT$40@JUIXIHjlW;f;OU+6jei<4y@q8LG{&?Bt4r! zx^y{VA^3|}v4+zy-$g~SEy4n6@HlzLwHct?*DU)h%_4oEDG4%&EyhF6nL^Y8jd}+6 z>Yc^s)Z{<#lVv5bFzENxBs!r27B`=xrfU|}TtDtg78f?*vaNh1;1Q~$`b32xXZN^0 zAPOg$T>eM+woE+>jtao<@zgx5kz)B&g+I2xIdsO~Xpq7LXW&`JF@uM9-5t!bS!|~z zd^vby+8(!qk`|bsyA|#J*7-cZUXb7#=j5ac<(;V9G`nHe9PcbIJuQXt%hrAG69cr`|&#D{9aUb0VpUkB-*`~*9^9?NZqcHk91Jt6#~F| z{01>OWJjkOWfUS5r|O(Aju%PG)(x|&6m|<(XS>(8>A0~JLG*#>U#D)^4Gme#No9sS zjkwgNTsg5D2BE@MhWeX5ywdvgPG=a$k$AjqiXmDVVWd{= zc2bRq8Msk)XP7_iOb=GG2wYR%!vTaQCg=FU4j2f6f=ni6)Od&yGN12jc{H=qP?>-c z1uEJdX+y5K>Nn5XI*0p@{$EDUz?*$R`YV_Sg#{p5Mt;=as!p|v{JTewar>I* z`M8a1B(1-Ou3K)tH)Im(7z(+9XN_f*w*qAmi&Wsu zvZc!JyQrz6e(!!??P3FB;mmi=fxnCZhqM*8T?MHFTYTNDER1Cz_&?yQYu5s_uw_Hd zAU8=!kxT8I_|d@AeUAeppbK)V#1AIa$y#3$V7U6ZD+3rX1Ob>Xfulk}T*QsribHft zDPe9-7=W5Qn36`Ve3r8^+>{mC6q3HO7WupZ$qsq9P9n^tC(==6a3rs5=1G6?Fqdrz zoriRMStoxVmoLLk_dD@+c!x$pEPg(siL4E}U`pb-%!lp&aHW7$CBFl1x;^xu%*)ef zL7w9WV;-CZrPt{Tdrg<*2&}&!z-8_s3=tXESsvVZ68HOk)tI#NBI$aS8X6|eLL!7b zGwg_oNFa37n@{$O-~!AgiXCOK&q z8+RTDQH{#LvkXb&x5F+zszEs|fBk|?VFms}R>U~$YjI)wLYX3oKmJ>?oBjJZc*O|| zxqQmW;b+IN<<%%;PDE()6F*;HPiW2P`XxEUhZQIL^`%8yWr)?+*({4X5z(?E&U-3D zV2Ik9G~B>_T-0g~JT4M_$x0WaT;(-^4p#p3q0GYLct*EfgryP zQSYT_l;5WJ96|r~+#P5+#&;$Bhw$3vT|P8&vGKiIQaWxMyX*Ek#<&rq2L?!LJ{EzM zFU4`5sA8C(vZ}UQn&2A2+ppmsq;Ng(&@hz=0hOPGD;eq6Rv*1ZO@^BMo|$uITV%)f z&6Z>PcKxqD9@b#(9Ja@o8JE{wxmJzCtb8@TRG@C}>4IM4%AgdwTq!3`X^i6E`*ds9~iHgG_UrR}~sZ_uXE^7krVx zQ1KiBSW?5MAU=#FtxZ$6J})}TZs6^>DnlU2Dt`!lgiwuBal?P9zL2s;9fnRHSZe+ z=uzum2h)rRhEhBozy4(kVf!E(fIrkMd6Mt17Z{+x<$s)=Tl@!G4Eu0bTkhRMZSiBR zUA+7KFVlbXoX-SiVb4Cnr`p9|m?Zxy0fxpT?zrJCm6OR18sKlJ5?2WQckAE_vAs+v zt4hGP7xxH}Hw}(U*mXb$<*Mocneiwa0k)F&L;Z-|!e)~SyhK>)m3w^c6f>5jOp8Wo zi5aBIqj>KdbSpB;Y2-6lLAFDa7@S(8CW7;mV)Y+<_yF1p-bf`_%KZ>p37+&dV?4O?NdNLO$bRz65!y!8ffKk#609iL&QB@=6f#i=v|?x z{vPkL6#fn(<0d;U-KmVo{>yW0OzTcN*Jyg%0PByc&x8ZGcEP_V-S$qe5my8SyL8+vT1?l_^4sXPxD8kKudNo}nCUkB0rf%_B>KyTqEz}br_rIz2x69x$-U#A^ z!tnUxJScS~xJeoN6rrLkyqzb%R|K=nKtI`FHiR=%haTjh@?}3ZloO!Vdlpdoi#{OU zA{SuOW@(nW>9=Sh%agG#@7v8-qOoCcjdye}#wk?$)moEaR7i2l3+W7?TY*kn!TToG$;P&lipSw>$JZX7`NyR(#@Wf`*lVQe7cQ3JB_%;BM zk#*=I1kb!*^Ski!b@WA!=V&hU!M1_La&Vu~;|rHufx4IW58B_AdJ`W`tMsJ#G@bB2 z40w>HX^(!hY<`v@A|3S@vK(A-#;D!T&)3d323FAIaWXt{wYMcc`p3{d*B>Ma+rr@) zn_*XTcp|`u`bv0%cKF#D1>A8}|OQ?JWhK>pbLEk}`*^ycqA2Jcftd z<)l-#;4En0&Ltncay88gIvs;kqY|;TOzyS#jMoiT)#k;Jl&Xi*dv1%sU#4~IKL&mc zyjfF4Ve^_1qWYlN15-ZK-wi}jt0i_U;_n9S3yErO8Rj70|JokD9iiy=d6jT#^aoS! zMvd*d5B>JnGRCLtrYl{eWPr4L;3S&}rO;P7e)%m#|3+6)OUqRAke*HU1JC4toGr@5 zL4zab=Fi;R6WwI|Ba$_`2|&Zl3}h#5!|Rv|KMx^VVDqqd>!(%6Q7z3hk;BbJml#q! z*)AWt&y@#Q{+bhXbP>rWUOyb_!C>^`0)!`}e+2m~>x)Ay5%b|%kh(<|j_;1b#y6`z zsSDu+3neZ{C#JfSNEexNupp(p=Qo-sx99%2yXpLd%}B6w-ls0S{s}W7v#EV{Nz!8JyJ*sW0xO2uxMM$@5zsu}S2->=Mmn{*c|2`f%GY3$ z5ZZ>-mY~WHI=$eDQw@Ys^=lh? zZBQM3Z$YH*-oW;3BCAD*gSF$V zK-(j5zGQZT=+?sSsQ@p^z#`j-BAu+})2H}%#?ouetS8}ee~nbMn`J((BgD%TS5ra> zK;7?4m5sEw{!nKcIiGZD@6qR1y#NOUdhQ9{&^>eT4 zRGFiFG?xw}jE7Wz1}zQ~^L>Hm%B)OlNf;oDL{X7Q*;86dk2t9qT8T#TAg)Uh(#cRg z@bY7v{nI-((M#{)QJ-orPty#Yf-`}Xwk}=|7MCEyY7d6*9#31;i`JxXFKBvMzX;VV z>8C+2G5FfIAdn87c<>qfFInMaPZ|J79A(SxBP~M|x5C3Sbm6vp8w-b+0Wt9lp;Kxr zK>Y$ooBm8sidYPA8KfHP6n#aIUr}d?v0);j)Wf$2VK;S>GHE8*He__ z>+v8iOXI^g^MCUFFOSE+AMXFPUo#DC_Ww5i&m1ClXbWhT`2WX}BbMvVfZHYg->3D> zd;f)5{_8j0g5PkAcq_)2%Vd8%!4xJo2)z5DHQRx2lb$RoD65)!0jFzmLb@X?o6|FQBnG|jYI zv`unnePh1C_z^P@fy&gn%G`_+PiAOKRNsYHtKRh;M20yww~gy|0QX8a4wUhk$;VSq zP`!w|GP*tyb4d8MrGCQuC`NV&Nx58i%U~|EU_P5$&Yx)*J0;52kk4z7ZwbdP^!+q& z^YYuQt0{pDQOr{t+DSS0ZQ&ncJI98zy8Qk*zziK0EBc2g^yb+M@p4#eKZSra z`3&NH=%_#>jc~9pVFswsU1XZPKcUf8eT;t81F=0HuCaD^50x1f6FW#G1GqS$$jiX* zaqhZO(i4rDt)U)57J5VAqBkaHW@uMTgd{&xYmv~(@8jrTzqZ&4)XUm<)ab2}J{?yo zIR+9k>~+6=$aO3)wPq%r^{i9DTirbdT6hw;DQ9H%V{%|_i6WSwqi9{o3$zN+m#|MJ zzzWhtye~g{k|_Dy=Bu(m0@#76`zO(OGPwQHqpL>k%miGk*OGeOB>^?G|nv}0Zi zFA$>}L*KZ4(tn|+c3hAo9kN+_poJxp$wRf~F(Jl?^mNyY`u3?5@Z>0Vw$Gy-aK{IDU7wCM*AIwM?Y z@mbqAz>c_l*Fr*SJA9DNl-ib55{Da96lRzT)UC>SuudsV+P*L4TR1cl!(WpG2TSBP zso4ML1rYvds2M&Y#wjDm_NNY4jVJSz6mB_tQsv-P1biOV3~@p3Fx4kZ6`u4$euEbq z7j*xtGaze?OFmm&2vw+$F=BH}Xo9p_jOEacpQzgK!+h#56H~fcez`_S?WX?@ua9T8 zUr1a*P#^%elCM6?gVKn^OrJ(7>{Xi>KrD}RBB8PCh{D??Bv`W5Y?l%s+>9(_({JFz zcok{qjHn)8Hf6%9ghnM(m1t0JWGNlhL$buRB0^8$;66t(v1=D1s7;<*A(nE8Zm67kZvA6~)4G%HaZ9Rn(X>CbN;j*u;4UCiTE;?CN_s_bfe%h8 z%|GY>;PvY1UsH{FO_DYe^V=V6#$$mn$y_Lrv&Jg{!U%oh?jpNLVUNY%P+xlP5o0m` zxxG$a?r9HR_dT5N1cY~O8~qp#(>4T%peec+!>S;x22-uX;)w-h-+a{unGIK-`!>9PWH!rOsYIe!lTnAz!Vdzv^Yswz=^O4P#rFJ-_vm=**o$sLpnf65rGfVB_{M@V>^-N`3KF{ScyN?9svR9>+R@d9W`%y@m6gcQT>s% zp1`G@kmRWISJR6=Lpyw2Ad}ayQZ@zn1Q;5S`cM>J!o-Y`f-z2>{E0Ove$ENUJy~dA zLoHmk_{m2Si2Q_5(8v};*UA5@mr-XctXXw^F7#cr%Jhq^FSl|KX95P!x*4WaI}pHU zre!OR=ksb3fR%IrCD7I^{SA^}l3px%Dl0iqti^14>NmvoOO%ck)z9Tnik!gU@*pFi z-gu0a>OWhyR2_o#MuIs;B^x~LJI9H&5H5rZ?`yte$lMPQwZD>S6M|4>^jI~?)u@MDk7k*dSKwsGU9@oeg!4x4wIaH^8FbNU4OWmuTxg z&^sf-^pUHGF{llCX+>iRQjx*PL=Yj{5+=ix@PB~Qt-3pzj8+zxfB#Ei?o}``Ro*## z3{vZvhGwMij8kSmtKK(FW~8O#$IfNxGQ=nxs&1*U?Z#fvSa`mez#c1x-yVeY)jFoRBf+zftX9<8AnN!FK^{ zN%>OXCohehjo@ry|Ht6SP%vxnhEj$o2nC`Cdn@d;{I7S4S$N;hlq;FgQ!DjBs6-F_ zk;cu{dtYMQ3Xgc7&r+iBv1&{hdo=LR6bBtHkR~rFq?TCaSAJ1|giq>U*0oS9@LU}N z#DeszZ+McMvTiObAYMN_-z;{D3v#`kBLygN5z0%Be5W_Q?UtY2=^>vvO}NSE2b*%v z03kIYQA`C|xc4EbW+P-^=&*v^dF8uhNnU_k1zyvHLNS_xCE{KM00QY@t>`qFHOu-8 zDHQHvO@?UjO~^rt+(EGH4WGBsP8#s9%yS1P3uJ@$p=}TS9EC|bbU9r=5gjpm zv*He{xCLaQ7|~&XUHVwhgmxA)>fFwG0Z68Q_V)-|QKDc2Zn-C*sv0+2vy!oOou~{9 zXyHsb0Qd>*(&OjFPs)Bfl5@rrTp-Jsmd53Io-c+@>B(MbrTD^ab{dzy*7WTi z`(PKR{|8(_qrMM-Y-(MB89VI%(zem}I%1H7fukV?m62v7GCg4EfF@1P4LxebG>N*1-|x=* zuyZX)#f)0-B~!rrF2gF83>t{ZBKywZt|JLRr!odEp@9h!yavr2CrBPNdy3y@&}G$t zM4!7gb46rv8rU5|z%V!yYzb$9pOUi@;GowZde)Zqxj4{TM7>uvIO)8D*X)!S2c7#| zQ*sc=MhO(p^Qr;uq*e@}jUx+|7JYxyn^c~b)-YW)N1nL=E}RAP==<3qF$bh1{jsTD z*g%e~6x#LEni0H1pdy5G$k{bQ)$urEub%VFZUKXzPRGGG;(4_Kp&Twjd!>fNUZ6rbrI(I~otj{vGGF6m9ZAvt(Q$YGa)L^oY4$C6%Gs=<1Ap%b2 zJ5`kl3YJ#}u$sRsnqq=?=3Qjuf!9@SoJv6$JK=}wHPQzqgRp8lmXgg}>9{yVsRV%J z-5KK8-uEE@^K#Um8En=*qsk@DM^RBIvL33npjMJ0&mx(vv|zTb>Dbqt_c|8D+NET^ z2dp)L1IZAm&QAS(ePsf^9H-C#^`e#?O@U?+!dzEDafs1(>w)dLwaq!6`L{-ZfmW|J zW+^fUFw;_i4~JSifkxCmI_OY}_`ME8Y-%CPvYg$&WDXhW`$coe_O81aocOz%>Jzf1Mkz45r9r;u%v=5q2O`k1Ab45~0YW}y!d-HeOhHP(w=eH>) z@H)00-p+1;$C0eSw%+zBhqn*Iku-A~5yDJ%XXm%ywb!xjyKQT0?_i%7=KFE;Jv*K( zDaYD1Y{>{#sRHPA@60hI8f>4>_TMeh#1a(jb8S^G?0jHJ1&^~+i0xnRE57@?zZF0F zqd$o6`mXQ5Zt8%%?2B?!J>t8!-J{}d@;)S3TbrzZ@P>3*D@y4J1l((vEDC4CC}cmz z8=OOvuy5-!eRmaor*yDbm4>(`bA8?KoLE>5n!vCu3x;9P7)({*lZh4XjOaxsm&2y&s}SEg7};aZq%9)kq6^ z-zAl%cvO8=J3^}2b&I-A(w108RHZGhr`YDwzxv)mVi>8ZHFB-glSG6BlaOQ$h1zWm zbT7-;h$sj6X7MH84}DLGZezguWYW(#4mh4pZNJsjo7M$I_igK%THi^Dc8<{fXSW}) zajl?a{Juw4;)4EO^gAtn)UxmUzS2;WvNzy{|v%8+lfwJR=yqgUSa#{)HEx^gTQ+<-s5P-6wqu|3u2q{_M{JKqDEn ztSE?@!KXj{>BoN8vf>-4T}58Y!8LV(S_(>#Y`{45OyGH$vD@vD(#qX3V(go^w5~1d zYMORf(~5On6f6??->gAm@qKrVaF9~M!-x0by~p8jfi3J3IyFPc?dQIxD8ncp?UCUYke$`dG$R#HZo zq5@wTWNx?3LI`b<3!wcCI1i_=U4R~-J|iHw{yV?OO-#~F05|U~GeHBx02=r{#Hey` z8O)08jC$=0`kYSX>tw$#&&BhF7?DzGOz$BMx{;R+Q_=-GGjVfM90)BCL-0iE$`C2g zy&}C68F&H#B9Grm7|h^k#1eGCy;il^sHI6EL+iYh0yjh;3jh^@N6Ah=ANGY>F$^ko zXxb#Z(l**nHAAffnpHs-wmySD(9P?pzUk8UbCbU3GcU`ES|#AU+f6D}{!1ZC5mbI2w; zre%OANK8OE<%A)`22gS{$e@(S@q0bDZ^5JrN^^Ew1Tx--7$w_01_XqD%~INCw$$2y zowgBmB-cowk>ios*R>R!RFQ#zZ;S&u8Z8@nS(63=qXr05BSnz(5Y4>6;0Loys*XVm zkV)TVmI45eCQnGa)gYjAP2QjPRBJ(HwzYG}+CMmv zG2q;SY`H5!uwo_PLt;e_^0Kb@j$~VM9QojYENU`7h`;5aiX~x`_c4h&1P}RqF^03? zH%UCq`YEMgUKZq(HP{%GI3|H0P`SW+$^nN@LYR_ipxj8OiNJ>S=PGt~( z5i1>+i>O2?@xXCR>dGc~A$ai}ZxT zUFRBJ$Aa#bw8CQNp5Bi-=|-x}A*U5y=Wsip_2;Rb$nZ9W_c9KHsu>7rECi2vSrJEh zr*r*4fTaa1b;7FvP+beg-u6sXnIL%p5Q1ovo^?>Ni3HY3PT}=)F72Jext!xy=5gP= zo&mrW4cgbWWylH<3COiJ(oA*GHLz6PXsn@xOjugxAm6jzRbYss!y6-zGY|)0U4anr z4bNZUKmCR8!%zSC|BZkDQ~xJE`(GcCk|h#kbTE*hC4qjcD6j=4wQbuu2oN*NntzM9 z-EM&Zhs|J~^d9VIZu4DU*Mi&jO~P|n!UO-c=NR>~*?eZz0POXxnghRUEer_qTKWIm zEE~2;4ED3f5f5NKv!MT0^?>AqfO83aOGe;*SdszE-)x3D|Fvog$^5ONt0Ry&UrtUr|*sF*;Y+Y%IPzp?FVpUZ;iTLAtxLW(V0#e~NZ0JemLt*wJCyf@o+ zZ>P+_Qqf5U4(HDXoD(j9^U&dTtXjgw4xMmd)eW}oh0V{leK@&uTvl@&+u5F<*9hi& z_Fmafx5f5v+ZPjJtoZPU|13WG(I3Xwe(m!De(L%)spVkNHD4pEs{DN}1yF!)RV%yg znyjrWs_ZqRu49^2pssaejPfq8v_K$Wi?;XS47DtC1Fi4BbswWzWsSoiR!ItGI|Uk3 zN(#h#IMilCH4G6|V;SQ(;&?pio?rG5afrB#5$n2Qo)-kQ_Ytz~ph*~gpWoKyW{p1T zaj4xE&%2&%Kx;CwhH`q|()VbE;IhnvDXpy?N+}JvrIMWwzV!<3Uj;k{Qqm0N5M`ZT z3UW#q4LLilsqGh!rx__{TwEM5FW0({)_1)=cTt4_k~x45gmZ20okMj_)|s_nSr^^U zNxz^v8GY(Yt|&DtNUJ1ec%(Vwuot34DJ0O!zNw&`?Q3Lx2cSCL*T~p%j%p1Vbeog? zhK{EO%Gxm}>qdFTPMqFN6Ovj{p0EEH53Ajd3fwytq&&-hRRvI4GmNU%An_N;f{%fHH|n~xGy-ucMG_>ODrY#~5^B)a z{@S)CYzK6}+{OsH;(+d%bPp|R2C_dOF&Mm_S`2t6N^*l6biC<)Ulp)~oKrMT7f@?x zYA8a0&-l`p-^AtRLH69bk0L3&Y9FEH1^a0urvohp!#L!!p5UFRcdls_Qbj={E7j`S zv0PUtO%6y!#`{jm;!;(@*#wo)s<62nO%0^750ufv2G?5B@LY`RRR;zwp8f z_{1kZf!AJpt$p^Fe)val@7}$){ob_OV}Cdxr-bA28h~z!lQP;vKurqnv`ov2VHkCz znlYbF4QO!+WKv$PNseidm>Hjxoa=#SXz*Mz$;+DC0?;{!o9l-HnC2t|1tl^7kid3Y zG3my694Cwow05W{C@L)u&}&w}mZ3@@+$$jIyfexQl7&kjGqUrYbC`Df=DW4bbK4xy z`ymgj zKE(~g!SxJ)ey^?r1n2>MZbI7m-DWp+%YEB>wCv*T`79s-pl2u8`?Akqp0}S*E@ZP8 zx6j<}>+FX6IqbQsJ(s=iW1iWPMr@t(SxFn=bGOgUxzC6v+iT+dK5e`3CMiX}J*TrL z*_Q1yZTiw9^)tN?DS&rLt6 zU;w3`&l0S*&&~RjKij^0-cM|?V|IH?pF<4TWZHe(hqk}lXXUxh+G$%~_SUvdwfURv zr>sl?o6955y`AUyyzTk*Pdj23txutycRP;k>Aq4wt+nDV?)0%+Y@PHmV4wSJuCCj< z{{Plb+w*Sfp@Gz!`I*mlTYH_?tsdF#xmDigJ)*%&xE9E+cUZ@_zdz5)BmI5z{@B(> zf9&(qY|g!X?_OM7oR7QB-28U$%(Gx`4gLJQPyVm>*n-LW-Cex%=nb3aw|$29!}eH;F8c{W!&xTYp09>uEg<8bSB_^P>c=jy!89`oMY_9>ADcI_bc zEBkErnWkyPVSl*w{mC=fcDileCn?je^X}fcdhENIbI4cyt~d890sQIq`(z!&h?-_m zF`$~kvH&5-l838?a#{I0_}8N!*rRS1x3RTI+Y zd@Or&uUjPnTebv+$7NVs@&TX0%J^FVoYoZ)X%x?|yR}&t)^;v-#PAPg{}$ z+m#vXKqnN~XSJE+TXlr3jRM>B9P|P%&*tEph z5+k-l zxkkn$*(~QyvaPk^G@o$T@6i`XKvJ^kV2JD%oNZarI?Ylktk#Nk5ny>3g+RNmtNcAU zCB=mnUqP*ns5^}la>L!ng1bp&9d(x@{%R?G{guMnL;TQ z^St!6Ru#ftN(o>3(w9*ya5(IRcs~r7l<-??#j-ANNz?+VE?JuDgj^taFZbpg?%#g^ zz~SoZ0uOI)FpZtyn380y3-R4y93~+kXrB_xQc(!RDwd$7R`I{*9fH)Afth; z+!xahGDIP~G-5ON=*FUyecF2<=PJa4Az~N@QTJSvkU?DS_MKXf1lOIDO#O9D%^vZs zx9;OK&$zn0XbK07+^^(>`wt%qfo2p%MXzd1Oze<)8pSSEiSa?L{%&rL%?ftEyAqOw zu6ar+NV<+_WPQjQE0^5jSX7k&*Q5a8O0xz5B=M!Mt)S#(*ZR}43h6WiQB$RrnUGHa z=R_gJr4>2Jn2)23v!bMPT8OZptxE1#Q&xfwrzTmS9*-v+k29QexH!l&#xY`41(2f2 z4ni=M#2*r0yA6dTNla>|b^pObgcuNaQIb(cRWd zpz?zzZFs$PC-W6_PbXyjZpX)^eM?BvSSyuOohNxCnEKEkojZ$HOJaa*3K=6H`GI8l z;DlV@y@RV#HDlY_O&NJJv){1-gp2N+}HRky!*;{eIvdof= z?VN7zJ=S%>I89jAqy!4h0w?LgdBmvM-m0n);(%!!5#xaChxc2?Y|0t=<{Cp3#xJVa zHRPP(s`&H`b;K}GI^O^_4Gd5e1AVg%oCle=0DTJ>x5E__t@c>`E(7Z5=Qsnu&F5$5 zu;7$AUyG@3$|FJX1_Jc}bwyPl#q&V=831emF9&C2mtDKJMjogekjMtqB}#D?T<-u} zf4(z7oPZ0#1O1(B^|R-8_JbLU*m5t9_t}*Mwsl}h z1ooa}&gdD}XXKsDShw}Ceb#nMwk@0?SDE?Kjw_Cpy1BPA5)9kgWQO8?8PqIBDzR{9WMs*km2?G~U+l<~^mLmaWG#atSK>l+YCm_`I!+%y@O} zG0#a__TFwI7x3@fanr6zKKzn)jleNA(hI&7$@TEs*X!ZYz&_H@ESzndjTB znRVWlq~OpqwpxF--K3(mQJcf-wjZ2-$JRIN*RFkR>GPb<-17oVlUO7i_P}Wt##2hb zPAn4;g8ZBkaCr$FkN7wK^*@8}_||`jkN(v+@W21|gG~+D40j7Y1LweNf1CDWrp<8` z654R+U?FfWwa?=%5KaKzp1-04lNIL#fwDOc=+*}Wvw5BRm~%UG{o8C5iaE|cvn>;1 zEcm*wyMs60xW?(Uq64+gd}nLHVEZr$7?yBgt0P!K3fqZm21~B6Y8O`apIQ7s2c0X99b_4`VaInve&Cjg9MSNQ3l{uti>{`cWSpkf(7}TeFJOX;$LG(6W_9^-bm5 za}i*7o-qysF7|uu_xq+~K;^8{ytLX9YXINWbVPv4wHkLOId1>}AOJ~3K~(b2i9H0+ z_7=`L91i=Y48?5w-VCCiuXPYRx3ng)`2@tKFL|~0 zp(Ubkptf^P)fPn&K;H8Lnujqcxnh*>L$ar*$z#8tuqILObI|+oBLBbJO?dcF)E^G} zoh06vbyLn6tEyaZVL?SJAGjN0Z-Och23%fTsA8vp>8*hvp!u>UFb=X7v35#1V;Y8Y zOEM!9Prw+?s$9ykQEd!c+(lz&!G~UNy3b*3jcr_krXVN;h}2Z&D!NL;G!06~saR)8 zO!6Th=yXvx;HwV-H^&p4b9nCFJy9|M8gavWk7Z484lQ$^u_IA*C^w|>4YH#ZN3{j2`n%>Ek33Cn!KvaW68 zu|FKz#`Q~Id;?i66og&6s)U>@4r{4!v2P0FFknq<^HQtmY*CT^%g9+4j^j9qQUPRf zcQ{-~7*Hh$gBKs~d7dSB31Gk5BMu{KO1OXjP2`-g%(HGZWsz5M0b&5EEOIGf%}r2I z=~;p=yf+{<3A}NfP)fn^c#T}L`Vkg5U2Mh}k#oZFbi}eQsHNcI;;J3D%rg#q-HhWr zz`(ka>pmKwe}r^kW0dAJ41%AZOF=9Pm>Phl0f`3WvH%-5X?<~i4)So(O@Qd^8mJwh z*#P}KM+<=S?+kLg4!)fOH0S|$$IM8AC*{13Y`m<(*i$fo-UIe}S_!N;k)m_v92Q_b zix2DhEqGX62P-`~IpDm_AI-RL*D?LTw#ONW*^YcPi`N23vN1ac)NDJnfYEKBo3^*j ztZ4N?Fr$s5a{kQR4C{F;up-~@_vrMVEtqdN=|wYHoaz!`|uu4nr6*#J5N zTk84m=724zXUP~_0)RU|)YP|YbIcjh1vqO<0)`z#L+{V6>z-fxk$J+5+ula?kveJP z){ZZ|p-1|RJ%&H)xZ~Kh*V>XKEMO+pZ7%3~5V4a5YX98zXYAvqo?$K)(6rZ>(J)x?Yt({U(MW#Gm?OyFJ_bvET~#saU|+N`ZB02p$}841SB5x0Wn<~-Za`JFSOg{i~#``NgukJR5+ zdmVejXZLzm7d*8Y!`cUIV0n8j=bSzLSwE5{I$tx{uG~-BkKN9l9Fu&0j_>~GbCoJP zbvKfogLaTUM|M>PTUmfO(@2Fl*2gpg%Zxed?J zznJRs6e1%kDHa~#1@XP(!}wr`(-_riZ!FQxr^d3lAu{kQ)u zy!P53;M1S}dwBEB`*`iOKRi4Ci!Xj7UU}sMc=gr)4sX7Bt>?2HZ!*`|k`H)~1ZyWe z3hcwwgFT-mbhu3&*z*&7w^{7Gm(_e`?HQ;T!D1CC?7xWNvf(EMP38F5)(Vml?o`ga zqSl0Q9N@ge;6<|gaFA;UP3{N^Aa^@LndkSr9XzwU`9~EGi*f4Dq9p-sf3#3kNrg{_CNM19| zxn^LpPbpa~?rN(S-|82Qj3AaAa*mW}^HzZZ%*%>ll#KVL$dTI$U#uCFR8p(R?*owQ zqBi1!WW!6ps7trJV;f&y9>hXQtvIXpg%G^jQA!+6>{ewVE;f%2&Pg5GwJd>Xz#-=( ziUxYu(aZ5}1;R8oRR(6)w>6Y>K3$BN#F_Sf=<9QmeYWJ&7C!|VA%gantCA)F>4(T& zK`fWtY!jRl5I<{zR|pa-wXqc1T&;_e*EAL;Di{MMwTXx!;509ohKM*wKRvCB*dT<8 zVI0hTI*FBfoP+*ORAGl9VqFquoim%VhLT&Bb!~)}tl#HYc8)P7w7Jab9*Xk>*V?T2 zpks)0ulM@gdc3s1Z+pCyL|MbPZ^dk--HmS0-3j4h-)kye>Z=J|m$&g{35n?1IC$hwuXJFSv3wwR^sI#3%SLBZ|x~m+SvN;8EdOMAYH&U^`h^jU*b-( zFujJFzr)X{p&$%0hBCI<2214$f%n=3tm}b45h;Wnek@PUoF5`OnaJ^7Fpvs zc>(_(Hn6fZ{Z@66<=K+TESbZr z?5xf-^Gw%w563{$H)Px~SMT{o`{@y|TIQ3|)lc8EGKQ4Hj9uCswvKkrY1c!oeo-A7 zG5}veVO z^iRefS8O|*zM|^Y5)BRrJ94cn5F=b#QKpH$PZQj_B5yVnCSiy`8p)HvDaH83J@)`9 z;q71hF8uO;^&tMnM_<7I@C!mR04l(20qFn&DQ8pyLGOCs-V=bopar|_$#O}zfWTb= zu%#SwI$eNl0cR~(Dy9?ro`Bv!B_qfQ`+^oQw;*XT?@QVREr4&mBvcpj7cWk@di7gy z<;pkW@y8#<voi2_bYyyNUb?DiAN}%3qO(oYt2-E%89w5ok~F_g)tyPYYyAS*<&K zAsqm%_XGKE>uax`+#+?hGB_4KK)`UIg5pv~sS{9Tq)@MQp#)>CpL6})Yp<~aOAVq0nr2Ckia4BYGq}KL^f=N)I-|5CmYBm zL=X>Pj~E@k@B6+5SFc{dSG?^31n)T{0L2mq2(+U3+;nQ5<`Ku>Y+`b%5F}}yOqpEG z)8UGQJ$ol8pcCPx(41Nljs0>$d|nppc6*$joamkvu6h~(z+oTRD}wXLX+;46=9|q1 z^E~6+`EwW|5g^FJfHN+_32D<5oXj&7tyB&e&1voj`Agy$e zW53^HawDJa<@uC>U+1CT1cZd2xy-sH$#Re8@!*4!8N@D;Szaj-i9t>di~WW|C9Dd{ z&dbc8HMu-@Ab>ZqmxyUI^67p$4K8VUZ|6WJhkyWJ?=r?=z&tPTfkGaPWAzFV0_j_f z5%auYWx@$OyKV;%Vt^cWNaD^Nz>dRq60lC8ANIRFoTso4fH&a~sLzz*;0xKy05EYO zV_6qoJF<5K5Gf+Dz0bi_4@jtPNTCf%4X5e`4>&qZl-V{{O5y(G zRCm;)K_PFbyLraVo3G-+h4YxE5ru7&D|_AuVI*Pzd)N?NCa{|H6@|h)5U5|*;3+3~ zUxEI*ROA(G5#XHdCkmGH$h0IT00ounx~_T{j0iE*&g;4=aYNRFfx||WLWG@M=pa?( zumse;P~8pVh;fKY;1Rh4z%Y(TD~)F;GR9?;;;T|{on&n~&kJG<@WCT8NoHmb9^){; zJK3^QdC8-Q^wR}H8~|Um9l>^yz@A}*uta;~dU(KjPqKF&!cQu!&qQh}Z09!K5na)6 z8HKAOx;f8upl%vRpcG{8Kh6O@Mzc4Cjz_t$9ocyx()cn>19_sz1>f-X@5Yb)jUU5P zPd}yMFV3#B>&@;Ntn7s# ztqD0(%(0vj)Spa>j0Z2lKqwP0en*#k}9chXC&!Z4TEJF%CFAcMi)uYq^|rNI5CfIOl|d zg57QlVfTt#F&_e%c0$0($vJHA+~UnXEyBkzA#qp)&zq}tT@X<>P&p@ciCDxX;W8t} zL0Qx>M&5WOq?DV@v0Pv3lpSC&fzEKQ@4z*`$x9Z{mA`s2`bho)h>KAhVr=hhVx^SM zUA8gqS7f4svx2BF5aLP&qhI0jBD#B4gbt$4bCEv+U z?o~Nfl8%rGB$R>xtm;;}w1QONrc~KEHK3KIehtuJs$7fJJ!@i90|IK0QNRKTvN7wy zd)e(vI|(>fLmDvHq+rkMod`As1zH_N1%~RTynSAuWxY`l$W*?RT3;jG3X*Vrty~%b zc9*n+YxgFD*zSQ+zRXftK<)KzmbCfRa>J38Q(Rsw_JfgZT204>Y1EQBYe;k{)?RZklZFIo3b#7d?%3Ruy zFOp2r#I&91zL`56Aa3y+y=eM=*QVX2E=y$`a?pO%fZ-x9BU{U9a8@3Yr^wgUzI)Kl zT=YgwWsc-N1~WbulLnlVA*+t9fbocQc;(WL%XQoJJ6ESaLSNH2ezl|e#IT%N{ zS6@LqIl+JTw;sfZ&*GV1m}|ifKvJLriVhWgFXlM`bj9s@!j&suiEG!s1D7v9iyJpS zhZ-J$fY`?#yMT)qPx&{=SAbCgeZ{MSX@G{%V8Ll2HVBw%L1Y0qMH%F?fZ+oC+K>i7 zdvcxfyL9PcJp1f_fajn8BCcQmLtMT3KD_H)_u=P$?vr@piT@gxE4Dq@VJ=tr0s2f(x#SlU{CVPCFByRkF>1~6(P^{?^^PK^+u4o z`_?;xq-lvX0{BavUJqOs!a+n!&;Tk(E;16rfshZxJHl!{3t>ar{PnyaNFVDxAy~qU z)tBC^D7qkWwj`B5jd;-OsO>YohXTo4^edX@9jdpI*rh`g)@n8p#yva%ceRL6A( z_KcWNK(74d00e=NB2%ZQb7hVqo5u?8z$e$Kj3Gqil#!f=bE&$}=eZJP;{*$r>DtPJAtTc$^`x=nOie*A=m!kLoGu5cFr?#A|d6B{Y-~;Hp8U) zRY0C4BHPtO|9l~`f&l+gk9A!z`4Kr4c=k5xV_locT%U46PD1){D22QUlw7blB4!Lj z#Ime3@|U_MQJWl>FIi%U7Xp4khGRgMbWaEX;ytyXU|lPjKtS9|hTt?Ed2JAHsEO@# zX{GQ2$r0&c)qOg!+mkHsx#t4u{Yv$VY||4xaIS*WQZH#ES+kQjiGYHPoa{cQaDAa` zdAna+w4P8~k$PD54!$rsWFhYg;CA)iW62!a0>Cg1d=lU3dR6jqsC!3Qv(j^(^)ewS ziJ`!`jL04_G|Y#0Sc{N(gzyIi>7{K7hdWub?0KL>p>-vj>@*CV4(W=7MDWfdBde@a zT2V^%{80*xnQjP3h8*A-$j>E%&)JY{)2cIw*y`3bsn><5o;3pYGufg`N*F>U(E zJVY-3-$_WFul?Gu#)S*#@$pZ593TJqo7>a!+4cYJy7l5G zaQ@M6yW7QhGhCN(Mlg6oTxSG>H^`Nj+u!Pkb9cKK|HfZ$_V5V*zb+^6r_)ndzy~AL+=M9QIflXJ*1uItgQo)&=$n(LvEM$oH1ainG2hL%8hg@?G+X_HKUIuX@iE+C0K(*Yk+L`lrb^8ipqeMZwRvWcmr4B2ohIf4xbrAt!) zjhZfuEJ`h*1pzF0Y2~V5L(TsfxTAop>I1ct=Z&Ynr(!S!2L>~w?d&sFM}0%KsHgFy z&J7@H@)AQzt-HBg-=5I&G{BMpP83A%`jrKSv>t3MIRN#f4GodT%D>UCBf6tP=3)p5 zLR`mJKv_=nx+aaLubDP(z_n7}5U{BMP>tMbe{S>9F4i#*8t~od{z0F$gTC$JhF;n^#8lAAuTiH|+ z4yAMmGTH_;eNf`rx3$#r9V0|EC!3vzgp5$HG&0Cpy|HyhE37(R*1n7aG;={$4k20@ zG*e~L>JU}E8P`jdr?x?^ZK2~5V+#s~H`7Wv=r2Mt6Md5M$k=?$Yme2BmY`7khE}l$ zu2E%R31>~ZW?pE<6f?#(W3ZWQ zGksMqE2EMNTp*XS2mvK!AVeT#U>Jy05C;mA5C_1|fDiCPL=FLN8d01>yl@Wx?SJ~` z@F%amh+q1Z1@+XwLwoYQpLFD^gaVz6kZ|?t*W=2SuLJ=6_HX|+yzCst zIb6B&m3ZQbe~ueB{sa|RmifY=#<73lK*IIw{}JBxuKV!Zb1&n=AO2=szWi_D`RB>??&FU?j4yuiXEfCx z{n7ss*RFjMPdxGMc zzYF1@59uJ6=s;gix$n(=k2XAmkP#MC!hw{{dP0ygNP7tBp$~`PyU#*Y5Sh&8x85Uy zB~ywX{J$X{)IQLb!4g00-_+fcHne&vBqkykJoM0rzx}uWI=z8cdsBIQJ2G`r7M zq8w;EOniEo+{2S=@5F?G5CgI!K-uS_Kwr*D<97SN?)Q1j523pG1{{SQ;QROAcTPby zIp83dOh@7hei#O<>#B!86hJqo80D$%a87Sv_q`0Buqd!RhG96$~uZWxNIJz4J&YK&mIyODVN`qprV8sq#vEdL5;} zWvYjGOo&W4Ab01y7IhB$c}6lW;>nYP*~=^73k?~uEGuI0NSV9`h#PwWN`oPuCnpnyyx^z3 z^SV}{{eXDz5cm7kUTaw)1ej6^5k@kB+|x9woGE{YoGIV5CibEl$vZ(IFCzqyJ8Y&A zYg#EpgLia_pTm}n)5v5Yr~O@JB70i1{u_q@QW@`{0Jso%?0R0(kaeB3*IKeZA7em- zL-7TrcpYm>%IYyKk3Yp@07BznEAU@sb!uaI}7{}CC9bVJA-vaj)u2uE-X?&s2Y=x`2L zmxXjU7q~$ESqK~66VP9HT@EHLP`~z=rpV+O09yIqDi!*v!O;q@$AP#h@#5sp?oH*7W8I=Qv9a!cWyX}@h{17lr8^jpt z`C-tI4C6qCyJ@r0XM_zejACJGJLeH%z~J|M)1{ca2A9matSQ7I+t zc3Z5=jCGkY&wCBwK;#5^Z{Sc4xzHwm7zb=NCkP>8oThFghYCO#!@K=^KptSDwgo_X zFr)$j=9Y81p^)D#z}m^%Z%lu)Ww$bLzR?vp<1NDUzXn{Fu~N#23c^-^nvEM`2s7hy(`Kd*InGPmQp%Vj zu}`J^7O=D9q3y@cd49&VmrfwY6lVo)B=$P8~_eSnIei@}`|J3|T z)j^TZ0WkpeG?L`0jcdwtY%H=m*@DEa5wHP!O&Z!)o2knfwar*vMhw7afD`nh}(@r`r9MSzoZ>1e2J?$@<4RNJy zJ6i=_zv&PuvUIioH-g~uI&&+RtVC8DlE~Iq^0Do!W2+gbR8-D>l(DWTNFsS1BY@g+ z$avC^MSVL8Y3JzL&)GSkod;NCjefUtTH7CJe5AH%MBC}AlvU;jO4~foUIZ{1Bdb<^uqLOP78bzw}H0H}1W6#1l_^0#~p8GhDj#0IpvBIsgt&KmC_* z<;qucg(84c5CAJc`((aLdF*$4Dt|D)MXrmjkDT0hAi{zC9?b8qyJzbyV9vzPoZ#7K z{}lk>+O^+;bN@N6UHffZy7UMD;Dr}%;wOLdm+`_26pHkjXZ}5u@(=LTQ$GLzc>M84 zaO1{L;rjKT!1e1tf%m@mF;i}l?}Q4n2q#t0hKQ0*BOJJaU}yJ^3u<3^?>KA?aFDL+_zMfBoN=hf!ta}`KmTX@&WJPB0 zmL#{J<-5=_GU7n4|JTGP%nNypAkPzp!!tN-BQJXm6b+Rc0_(1}Z4Jvc4g-QG*~bv+uMY@J zj->Tk(sdFMF6zjTxc|sL(mC*{aa!f%OynJhsxRV(Ue;$6rUZO)-Dx?8X}~y+x<@=c z-KZ`Nk-Rem2J`hFL^oug!fQgj^lk_q;}BWK^se>#8rY^9q9@NI3a~rX z?*b-%@ETRZWDps|VVXv2f6iOR&Qc1GS<-(&o;sLtA;hT2At;u0Mb3pnWfW7+OyO$e zu$Qj0J;_7LTE{WZ2k3&fl@J|*a~MQlLx3xVbv&vbt%=Ivyfe0Er{k^cgX-E`+MaZ> z0Qh%4_(8n?{ohvYH)q#d{%<~?*-4@GIPwUX8c7t)MWQ3e3W?V`uE%ugKH-4VuoTZeotP7T9 z<_$M*0+?vvnHekpQd+SrGr5uqo;?OcHL@jjH06XC2NVcv+N0!*c_!n*x-3|hh1lP`7MBo7HAFDViR-bv*cguU%T zu!e1O@w2iqZpjigZDHiw7j2#EU0IU5S`TCJ?t!UBZj@PF(hI<0jqIfbavB>Q-&58( zr2JBj9)vLfs^kJxV+bm+SVduEsP!~u zGJT^TcjQuV+jVvB#wANYX!Oa{#S#;&?oj>oK_jdq_vDrZ@Ffj?z+1g4=6U%~z(O52 zVZdh+k|jv=`X=Si?BlW42@r1&Kxx}rWKz0*D25H&$4njJYDkZ!9jwe7oo&a^hEz12 zWmH>hl!lYw?(SCH-6>GKKq+2ain|644#mAV6mM~NDHL~icXyY`omumb1%w63;e6Tq zm50W(>~XvyVKyj~(DbGdR9Unx|LPiL*$<22t{|pKkVGpv1kNRCI7=ux5CTMJm5p09 zFN?6|b#Y)?>*}vpnX2;h%um1<&Ndb~^wfL#7R1W8)@^55@iPjisw{tYErqE(6`35P zw_7Xl{xt1C&h3V^T1VArtCP_iO@33rCfvbSNk|6xU9s#lQsv^R7w;{E@Ajl?$an5& z;PwK}s@8g&Z=~_JmlKY=Y$T&+tuCrCWuVGh_j%54%iZ1b?hhxwt0nuE`Nv=1(TEn2 zZqkscYTKXuf?SLqIU^1yL~h|cAQ8uC4Q7A5$KjkZ7KdC!d}GOf@8V(^?gUp=cWdgK z>U>}?Ru`l==M4rr)scAKEv8;RY~Mqp0UhCy1oSVH6t9$Q`d$FQ#RxaWf2F9RP4{b9 z(4)?O>u7ep>w0{>5Bf>1i(Z`nMl+ACjLt_Y0e%U*`Ndw2Mqu=DmCJ2CiMLJ(XFYdFhoO)v1G zeXwnR)I*UaZr}DNP*Em))nZvk8eY-}6BI~C5hasCqVBkwHh!f)fT;P#caHX(ZJ~`0 zEk3y}@iv_DT<#k|of)p;MBGa)SeA{snEjI&rVib8=FI1*>NWTii}*@eI&#!K(aS2M z9!|N(*!tL8LdwIxGxhiBK=n$HuNO5?2Hi`G{fOTs zUJR0nZ-+nCZ~JpB#2D!!oh~P6DzCv-v(R8ppyDOXP`+Jy@Y8cwA)-xeAYJS4hpvEj zG+4OZknpWVsSuZ)!mbMXh+v-I1bU3B3Pk&3SxoT?atZ|w}!mh-%{F|m0= zq)KVuHU^oM;xB)g3!}qS=rspEpLbGN%rC+LDzl8W3>%JpDZqzQt86`sZur!j(au?J zq3qMQOGGFqZtNx_vdBo#mn%Y>t|Q0g=e=;Raj!tk&r~A&!U@d`%4>GSJ7*|p4s&bC3og~LLye| zqwOULsjn35Yq1%!vj(`wi3Go+Lem;k@GgY#h~F9rT%O}_Jz@h$>T77L@^UiXsE>9C65%Ko^q$`Gj$j+2K7K+ zB{fn1u9bc!MXP1Li886KS^(j);2kHHRU9DfrZ+ue1LwBE6rG7aV7}M5v~FW@c?T7Q@bEPmhHzcf`5g?wwI z(+kuCAr9$!eMD)RLK-FE?+Dj2&~d!p`(ZQxhRE;0_7Fhfi2&GuDts7Dhf}`L`Ro~b zAg)8DL;fbe*ILh$Y82?Yv=d@8@0TY--dOmo+Q(K()EwtXIb?)-Lu6S-E(9K z6wKw8B}dTM0ImBt(gw@pj}iLo$A#H2+$wVr6YwM3GCm(qXwqj%Qrv65!!?&xi$VUp zP(sH&7rvZAzcru6Y;L1$0#WR%fLEWB8Y*#G@ozGd>+|08b2@C3?qGnuMJ{+KFTW2a52Q?f116^)at3AAyX_WQy&s4bK z8m5O2#qnPih-5TVkqYz)kbnVUmMum!{PXohC0~{efO}PZ2$O4S~*)7b0Z@XLG6o)^l46vD3{z% zj7n+X>abaEQdB^DrWylG^>X}v2q@vQD_a73f$jvt>YBplCXj0T4{!r!62lMDR!Jhz zy1hS~c!l-$B2&rB$weONc2dGh*>lyT7ayrSsmz@QFz%!kThM1mdFgB$zuEE?v<^#}t_#GZuho2jwwIdgaK`Ll z^^iEwk0lkZ4&$%>2@4SEK{U<{Eub35a5QP92F1^C6O_=y>({!Fph=mfeU-yXP`QoK zbmlbGpfkkNQk5QW>uK~E=HG@!Ia)6wJ0DQ$$)V%nox-ygXXl+&6v3KPW8~HMCN`KR zr$&@Z&CW4Icn8SwoMPwW_CCeqT&sSR|8^xe0k`4P(z(Zi{rQBuIIM0Qw0YbaNX_cE z2c8=>QrOuw(kJ|BQ6r%fQJ*u1*ZrwCz(gZiokN+_9m1bVr(tBJ&rp$jzx5-!hkeA` zbFIqiq!o8Ypu;g!>dKRYN~Y2*^l#+oU$*%z4kJ>TAKtqIa+GU0D-tN*ooE`_Pyknd z9Rb*Z_%%?B->?FSEvGI{7bRO8b!xQ9+T%ub1+#O?&A01JJ?l3i5D3Z0gr6ZL!jM0& zhO7+Un9&eU`3Onarb=^<&qp6Hi~?eCg&2LOi3SOS%DRpvI}i+$+j1{H)e=~C2hsqd z_9_WK!-vhxljoFLQMb8iS1adU!P077FfYf<+A+POwV2NK0e-rHSq{4|)cz)Hm zbL{?ht8>FDuZOhJ5%CyR!ufyMEq3ODCz2lyd{$#eIhgd$YKyYQ!8AN4gYgdtv_)k@ zfYi@2UpL~=d?&n;t^r|+_3o%HC(6Z9R^kBZIfn5<7eN-eIx z@`oyRj<#A6R-QR?scr@c%_E3p&Qi=AInX^P@i>JR>g3+LiPe0bjjD`Kxk ze|x`(G%j-{#Nq!=Y$VfSD7O}|`Deg`HjmRiLW5RfyT_a*+|oSkH}9OrHT|HbBpAJs zH8>pwcS>hEzWK73?kYq!!3pa~R-B`^rxF0G}*cwPK}U3ux(fk>jWT9)NaE+nd=kodP7 z3(u=`RLB%OD2YIdBhkkUHSVs8Hi`Ic`DR>KbST!TH`FN4_uA9o%KPJ-A2>?SymMJF z?-1hd$@f}GMKoCJe%jU8%fKe{wY8vrJ4TPMH^{eWj91g&)8INj9L6a)!-K&IkOCKu z^^<@aS9PmP0I#pZcCf&VExFz02SeKY_4 zhFM~x1rW|>-wH{C!xOpj+=)kno>i#)4r9>c?<@33dWLQ?8!yS$FFQA;3L~L<-u+gp z-{B{{&Nm(Cp{3E}dgurJxZiWWb!^kZ|IXubC-EJjn6YBhPRR@Cw;K$Gdt&ag@79X2 za)7^=iTU$rFNHyS-5Txf&}}kwpHJ~h@Ngh2UJ4ey?5+GyxP;Dz=Us^^27RWn`cM(` zsnT#(58Ahd2Nf`h+OC!Y`#TSrp&}>$_F=LAbkZYXX-{5D^0`X)u=f-`66>YZ(OS+P zbd72x=z1^BrpD)OxYL<_zJ$_Z@vJyiV`n5xsj6}~T%UWZNd+4Wg#EpIcRGlO6xIu? z*h?rV`g1?4v=tRIVa!CVlbnN!93=gwred{?W#>&n({!`${b&(a98~YUhK*sHq0LUn zw-b1fsz>5-PWS~-;yZ58VCaUzzs=d*EK2TW8T7srfw5`E4K>=Z=i&+tibcVUWeLmL zHwp59n%V9z*kB4v5J14Lp!<`GcDmAib%9`DR#{Gwe76JOC&7pZp9?{sqQ11#B0l~T4Es#!z@Z+N z9Iz6&fm9YP_WKNePUA9ZBZ@Ra^>4+Apuh9+dA#$-s9W`imNLg431eIzI~SdDR4Mg9 za?we_892)p{+#yg|x0n1xOJ}LBLdi%_A03PtUNY{TlF9A; zm80c&P)7Tf&@Gb{jF%zt>ihPdFq%}oOuD~P&1 zDX5m259{NM1({%>mf7sX=a!IDPszd1Ue+r~M!6usTZYC6aTWHqH)x{an zg|LSCdoz`KZsJeFj8u%tnS>VoQ$5;BN1 zc14o8ad3iG;edTTm#a+t+-#{2s!Af4U8>F?g>C_5%)N^HI>vlV3?wJQs%5(fy{Zai zxgmJBwezZ+`;!msRz!1dpLU`xi7dY$%hDp@E@4Wq-4xaR4MSQ3G7?0;!qpzmDDojC zO#*RqjXu1a5Y2*$4s>(S`td0R0q`>w>)9{C^7+6gr8Ts0NY6UmB{`%DoSuF;)-_Yx z8XR$&3H&h{ni*0g^SY(*P17Q~(QT^+(a2tfhwn;lV*~TR37Ocv*b?rc>O5Qz1Hi{) z6j9zts5!F`Yl3k+AE=NG&rlK!0G&NpakmrIYRx=^=t z_``=Mn=l5OR#m){oKia~>i3Mov!9j!m)z0%&Uqhwlm_9h%ZQMoHF(RNU;K9Js_0AQ zjKy%pO3lQOp(Mos-#HQi^-AgkM6_}VVzBncctRjCW;KlLva@b{t+e;W^1#8*GL4Gw znUgFd+$N~yT^UVj4&1fD%))C6)gapfOJ(N#yPl30&2?8&ESO*M)kEbD+cLaaDa}MU zMpM>(#_EfCr#QMf2DcbtTFK3Xk~4%wc1$j&!fW@ZGb6(NSI%}haZkLooEKI+X9e^zuOS)#;-dVz2*~EgSE4J%3 zF2Q8acG+$}g$UV6{$@nE6b{WUPPcHKE#29hne-!7UX>n_e-W@k5Ed5#{L>Io9@0}< zR!k0F*dC~jj8eR-xwY>5Mqjh%yu&2SD9cGi4tS?tQiG$iTiAC~dVl&u1s|a|;z{fK zWq3J?BB3@O%=lU7^hiQ{k*Akw_*&Y|ojK9Iot{xp)+`Vc@|ryW_bkdGZ6uB}Xw+I5 zhiG;h5{vbCXSeYpxDm-8;LQ&5f9dan!I)V0J_~qXv50413#0en!0o(z?s~slhGUgu zFK%MJ1jOO2vv;;_r20R)cwP;z!vUZNARBc3is<(`--!cdAR_}dw*F!9JA8oBf$V%X zU>tf174M<55kAyfswm(}$6kXY831{Ko2B#l;!D}3IR^yIp%=Y?{tBskoDPbxv#naF zb1Y?-IV{(Lb|S^DPip-k7CEn-05j+hzyL8cIqwpDQAvO?xoY<0+?pzEO!FFua4l6) zVPIGlRm85MA1haSide?R^s0n!DEF2OY7e71za5wNwe6T{xT`EMAI=$R%?E2CBIG@1 zw~jmiFqDJg6K6~v=o=aeHN1GKIQZd{;_)vdXkcKdFjT|(`nZQ0V7CC{eS1o)wVu5- zD=`)FxEktFb*{i5vuxkM$`X-(Z_kl2jvls?V0q@2Nac@i90tW`P;|+PUG;cA_h1;U zjsM&y>fynHH0CEBW>^(`y$Y#4e>jAzYmDXmTN?%xS~TePgY>PQx`$a2 zSATHMW8Z|v+JEkUniqqEdj`*OiUv!tH9Y3_rDH4eB`yIE>Y5^e+1TI5zA3xFz&`Xz zc(>JkM+*SRTJ2?Wex?cf4J+427^jwnlI~XHAxD}5%*C0DI?Rjye=oq*3L!j;;?}|y zEN;$4>25+KknC6_++-kK#DDJVtwB3Z0aRc3c`x0et%WSkQR{v0L~5x5?|vCm1`9c= z$T2%@4-1>uzJe{AN_PHeygDvuIvQ-S=a%=Hl+RU^sfrI;*$ls7xm*sZ`(n#aFvH zxSilHEDm2UdPIwR@@=(;E0=*;O;K{YvV>^vPQss5ECY77VNg}HYZ`$y{|8p{yI(1a zdGXQnsZ-L&!`&@^4faUEBDpYL zL=o*2(*0iJ1|q?pHC3rAgg(hqNS@=~YeE0PS^kZ`zl>{ryIj0YX}52GxP*4!r0xq{ zBfrBp{ogRT)9oSd*f@Ogy=hE@@P&~82d>w<>u`_}s`Aa%fg<<}k86x}wB2ufwnoud z$>;0-(oth$9t%0YaQ{j?lKgppo9&OnY4RDRfAda(X+RJf{b#QmjQpsKQd6ZQHB$vY zCWyLSQZ@-*vsn^@EpYp{w}U&(WtwJTtE|j{O0x%EC+u|5owXzA;+uA(>Z`jRpd$F@RQNdG?)*6H)z@#y*vxnBr{BG zJu`j#vr=fL_E}VaUpR|VpxYn)(_=iNG6+Lwf9?<`WxAogL=23o%8+&omr!wrVX-sk zMszv-h{w#;S1=kPfE1JIN3w&5&V)=3BZx%^U{A@_@`DbA7S>;N|JszC?-iakV6whv{n5#!cmI=Sfg7US<& z^okZ`-W@#a@h2aYAA^LN%VP~vjD;zu5*?==rGNOnCgXI=P_qa_k0MN{cxEr>tk&z& zW-hDtG=RoDzHwrSA2pt{h&oH!%ZFbY#8OM9dueWek!1k|@P z+k;UH3_=vX@VDq1rhySHxWX}Nb|l~Wy~dZ$YA6F& z5SukbAmPT@i309UH&#{+umY~aJ*2eNHnXqcjF_O4i@$AmhJI`Oj!9+u5#<4Yr7g|z z^=ViDHZ>3qRA)pa+!z+B}o{dH#M342K|+9TUJ zTS@WGr#F1p##A2y%GJ62mXG!y-Kj`#q_HkVC?QS9Q>nu)#HG(Hb+y+@*ar@j+YjQoL+c6lz1Klfb}Gkc-CkT(J1|s?3w~c?R%*?H zqMVfeyEjEpJZG%OhEe#%Wouj6$NE@OUmJ&?+Q*Lal+wfOlk$;(ex$hl6Nql<%o8kz zrmaR3<@29C^VoK`6 zl#$8+#;kndXblKJlu{Q>ZpVDe%F4J0`UFhg8;-~q=oOflO*uMeoQ{4xIbj=6)9Idh zo_8S!K#tNA75CUjA4kCeGc?yG2`tWB@@Gc}9cv><>w4H3Fi8XlVA;d}3YyzmQ%h~iC z`UEgU1OfEsKFt*-9Lt|2g-b|OALo&yNQ-Y{ayod>Cc6D=D?2&t*}O56GQ%^Y#tfg= zFfiR!GWejtMkq7I2)$f7sPc{(uQDSBPMG3lT>%?>n+*$Vi^il-f>dvd+Q97h*K>eC zY$nd$Yj(I$K=^+5@E|yru6zeb<3%ZT%K;T_Ll70vB?v*4gUHcyEA}-nIKD}*g$EVe z6Cd340*A-}Va9_DN}BRE)Ug%0b}1e+6snL_zrG}tP$!A8kp2)rYS!Jox$&x7%xSHL zY^i90t@QVSi8WRaU33JpZj3?3q_=n*H2}Qs4O7?pcZaYP$~V)hJQ{a%hL-Mh)URsP9GFHO6EVCH0nFT!1sPwZjdjSjEvJSHG2iUE;$GEd`-O6)cHBg)U5e z)SqHKhITpp9_CuT_;{SE*qtTZxS1u38ZXHQ>zvr=93H%bt)?5F*jsP<_|2#R8198~ z7C#KJx@#?%h3NG$tU%zdvWe5lmJ5$tKd%Vzo$+_oZA-%rUPsi6alTb?4dVR2_@d(nPz7JL;VJ77Cx0POr89hn;+s7HA6;`rDtj6>5w z<-#*+0)Pd2v#6Q_Fb9tT3uYI;hDPEfZH4B@Ew3Am6f3z)Bz{1Mbvr`M)U3aC15~zz zh(n>onJCi@bwz9r$~JH%f~EQxluM2MRjC6W)B0#QW0#4aG&w7!6yZ?FPf?gJe$uO2x+L_6`>K`atam{zIpo<)McJB1xc37&TFS@nUUXD0kJWOO=1_mf6aBb6ip5*(j#-l`u z@$PU9D)s^QXY$8^&B_$F3E#Ny=AMYQB4hIVNjwPY_V?^)~kOkAHzt`w0BKJMel>|B#+H%Hz~NiF)U?axpBJHMdL zT$ds{jHgn%u!T#VJ^eaqUNAd}FGx2n1Gyf&a21F^UpijnED%hzU>mN-5&hx;YVg?T z!=jU>CeE~lEH?%`pGkFqaXb%BcbYdQJwWX3uGH&;~N;iDZD zE}*>C`_f)@5aUK4U@7R!mI@8Ev7!8B+cUsuLy=?6+5OcfcAZ9KXBko-FVDJ-#AL*5 zwTSbkrl}ZOMNWKD>X!>Tg07pBmO;lLSK;e#XH)U(WnnPKpFg^Gw=80;IXM>z{+f;sdfm>4l0++6GSPVl&93YwbB5_&hp|o z7+Y`*7Dh}wt1V)D$C;*>@2b-d|D?;L2GnrIdV3^FsLhVxe6GC)+BtK){MFy+cRar( zC4Qstc@y8r*o9--3k{Y5Co%~aKZ$s@jYptUBq^=I1>P^%4%C`Pee5CgJdf`>dtFR^ z_3PySS|PPYa3>VUd2WHa4FT)KV`q8Y2b{1sW9k^|XvV;d75^pLF__1DevNV>b$q^y z!i2&365vE!&4RKAHYPZxBsj0Rmm>-{lVWV1i0~KK$-L>UNYc_(AAqa#`?%U#TLR-< zoP?w#!7m^5*PhL1Dr@x};p&aS#!B9W6ke>`04NBwVq^#Pb05?>n=HpK&<)s20d6u= zyoQ#N3UP%FmFc6obGGP-9PUxFe#Zu^E^t%j;==c!%t_P#Qmi;8r}iy_f_bl-2_|?g z%8o~Jg?3d=QPBt}^EL_4qp7a+xo;z_ndMLH0wpGm30?JBq~XZ^Art!O^N#dRLk_P{x<)ssS{Y5t;;Fqf13;3#boJ!v<{B`NxfL z%_Z@^1jW&ZLan#aN*j3%ZZRuc`+5RCa+~d_SfvQ)v++6zv>0fQKuQ+|)T?k+QSDs7 zU9T@An#N zr_P~67+V+I5rtr*w9_j6wNNAAXVDkYBHN;f;o)pv(z<3Af!i#mfQm-R4yBxAu2eI?%`amDMw8% z#ECHZAkMjOV2wdl!MiJef|RmFO`)5=?RoVf`~1=1CDH$C-R21@PF^qhy?Mm#&13eV zc(gJ=SE^hP8;@pGhr{EAqxX|1?lwKb_wD};bMQhX%#ljJBYT2vH1DkJY!l+*qXtxH zE>U$rG$}}mROUN$FJu!16KbsPehY0|6%`FjO#GT@tBfVN%Yaovu^CjXiZsT}ki*z3 zS@d9y>WFz9Su=0Q*!%~2Nos%Dmmv_GiJq$_x{11# z`CQxa(R#YyR}R)Nh`y+{&9xvr*R4dWWGyIxpw6v6H|*1WW;uJhSH#K_G@AyO=q1>a z-k9{sud?kzH(PT?v?SmuCXm8%s_Jy&;8UqH=is3S+*?+D$CeTq!$-Ix^r7!Vw#Og5 zCPczCRY*35#AZtUeEGF5l%G|sa`?fzka4TES#2ixkBXs(TxGrC6&2BM%VK8XxYV&Q z;GyxhP4=nc&m@zk@IH-8j5-Sbn|Jv0vGpvnzs;VcRoEuW6xWsCa@pnd>r*P;68SJ` zN*ZDhZKf3LEMeQl(Vx@z{RXibN}BdU7bK5)ff-Ef z`Kh9m{!y0n(Z#;%eX+_KS+lHK*Vv88V?zeNP5Y=6e^dh+$@Vi)72D^>`=7#zOix>v z#tT~ z7|SR3d@OH-yK4Q*zUL{g5$R^ zU8WLfg8jo)Emz%bW|Wdyj-@$OXGB@K&!@9|um#V!yw??&$4WtPm*3${{&~5@-f^Mf zsmja%1R%z+*=db(_IbAZebQ zLQ>7~U5E2($+tVRVD~KT>4VQP|C0Q9%(00SU*{{>7TczSxZLe^FDIl(UT#$05yh_J z{Rz%}_Ln(PgIanh!hljy0{(BAAS)DaT*Lt7+5IG^=P|O8>!^`j5#U$X^z@a5=_jFH z00pR_l`MtVxN+H32meG6S89j|rayN5^lstI9bl;k4N`>f7(jVTp;TLDwN$FH0UXZ7 z=xi_{Dwq?FYp2z#XI1N8#fED(X6Ft5)l}eS8+{JvH0sQW#~CGD^L8F37uh)S3fYT0 z@;#nAU5@r)Jb}ztC1>wa!bWe12GTgX5X+)UnN_JuBH_AwvjhB%pQlRb6JaREs*XjO zn8}P7(OZgi=aSKVdm#aXK)6p*a02Hys)~p^n&N%XCTE)kz=ZsTF)hF!O0XKsVg=z~ zxj&P6mlwD?tT*S^+^-pPf36d|b@lQy(m~W_tKQU_i+pWEAgx+GoiPn5OYWtyR0f^l zM@j8meWic~K1ks+vxT9}U%xvgZ852PPldlB$8U)AQCVjQuBue=1J5x{Caxw*&qI)~ znPEnt7FQE-_Jwh7)o@fym_uJw;F>TR%2v>Jd;E0bs&k+(^m)((EzX<&^Hb^lsWxEu zR{pIKO+fEwQWdcpd?VvK+|j`oN*l5;aCY?PPlz9tMJp8+61xzJLJ4PS!jjzdwRY6h z!_+Fsi=;hh#F-81%qsO%F$3vU2-;+dFbO{mqO2i|D%ug2HP%(QJFd|<3z|m#EQ)wS zXJ0e3WhyjkTsGdj)A{<>zLTCEk<`nibv1z=OSU)8inK}3(U6HwWHtf^SA_oy!u`OquT8a(h-zMo8r?EZAi2bw`U^eSroYgFFxN!W`YR^cxLc9#+}@X6y=~Bs!*6 zLbt8@9b0=H_p7H|&`iht*k2l-!DF&>PXxXUH1>plpYWO)l0JV{*s6$JIYshrZE0%`*?v$Ml6fZKBL zh(9=GB87)~p#KUh&AudXaK{RlqaxnC0)m1F5h@?pmNQ+nQ$G=GTIr`jHY~q%unf?B zZ3=NKWh>8wcIBEnL-t=Z^)ruU!lIjNB=Cq72Vj9ONg|HH(04ituOFweHwB)v(9UNO z4N)&>KO9(F?!OWYc9`L!d|$MfxiBQS#lvQ3$+KjG@f7^XRsgHUr`4VF#NqmNDz(sl z>32X!%|K*nEikgBhF?Mrfnh-AM>#WElQ(LdfWRz6S10F+w~QhS;v~$~=rbsZL0}Tt zL5;%rK^Mp;0jc(AJp5tcdixR1lZ><<#1cKiVw^uTqgOE}wTw=75QvZZWpY0~)xtS} z&Ol%Wt^Fw6X4>J%?g~dIg0pJ~lS6`yWR8WwbXi`xg2A2r)NCgoHVXYG9;Uhx^jbB( z#hUv1C%a^13Esx6^f84gQHFfUu*H@36}|23xa`zsXyN#a9SO6?q2{dPFRKVtC2z)D zhoOQ`ZguVh^9dw=&gsK}w zeEMaWvSM=Vh&#f6WU>yk#8*xED<(}drXEa8MA~LJaS++&D&fwxT>{5lJ|g|a+P}u@ z%kXbgMsa$2!!i+K#BVd}QLX%ygU6&{F;AIA0>EPM8iqlKPUj)>Mj7aIj@$;K_Me&&Zdtoc z`M6vJL~b2+&3pK@xkB44Zoird<{5N6 vUU`Ee2JhX5H1P?3bEoGuLZU2k7rTuM~!~p!bCLK z&QTn>QDg8EA^hn|P6+QT<)A{1vuKp(h|FkADl1BNE()yL7BC@}4c@@Z#F+wS_V7#v zL`D*v{~P=sB)m+PA`PhmbUuUovRDIlhFgqC5qbrTTxv>t!_^*O1x~?y({g9y^C2s~ z`%%KJWc#uOg@gwMtz{^p{nn{4q_72Ex2TMpFunNHHVv5}uoAw!wPEtW0C^ZhBUT1d zYsh|!t%QCINzMX_)Lyf)rc5{7PSWff&4vM*DHN72X-C%9!ar5zkXU~ zDUJf`+~9g$;CexiEx0c(jC$lu$A^azEeq_nE-fw=!wrpP?p%QMSkfg%y2QwPIa*vK znoW_ctCYlrLO|;(`EmM8>}<$&@y>3yuv?yC-6*&mws;K>nrlBN|2PfXc<$F})R+@d z@Yjs!oG}MeBvh{Dx$BkSQ5egUfwkByDUsE4{_%=&SX~ zY8T}x9O9f2(5xt*HO^tk{u2KRb;WcJkD_8?mffMFIz=p%wX+myc-S};t#}uhc&N^? z@RZG#x_cH)B>qX;<&I8=@GrL@GU@l~JVLCKiCT&agWlY0+k6%M8knwQgnLnOo5OLH z;U#Fl8v4Efkux_J(-?V!gEe_#OLXvgr5VSTk7ha8YE&uPa#SpInQgxemH?@m+MVX= zL6w7@c@M0S0RI35r4sf7_s4U7d!#SnE6HtEAHF<(Ey%3SAz+DUd)ZSGs&23C88I*` zP~zlzlBEDmy>|amDZ-*i}!uJtY7P&AAV11bri@vGII&g}CmwT6HUe z7SM0x$)YSrQ6AUtI$f@eZ{@}DP~5RYo5xpD-D_EcfF!I9lI!%~JaD1T#sEYonu>8N zqJ!+dqk3;DlyJ~f2Q%JI@_z4Xm6Y4&nz~8=iu}05=06CvorDov_VhgoU>HC@s|aI9 zm^^v1^6`;X!f}GWt4ooy&kKcE4vb2u5xF!p9|&ub)Ch3v$FaO(WXUIIskfh*ov7Rm zY3St6!8q1dvfXR2KV|jm%kOJ)IAQ=Rg6r4F65vq6b0?if8(T9^)*fq&33<>aG2FcE zuXwGH8ytXAB|Z=L6%FZ?Bi(BAJ!>xm}T-W{%OJA0s~6=DKWK%}Qm9{}jfOpi$`C(tQZ6 z(ehGE>XZlRyley}yg;p$)qCwdT3jfoe7yQHX$Z2!b_cd1p_ft8>Pc`l4N2)fQsb9l z7?g0;lqVcx2(psEieyHxTjb>#9tzDpM5J{u<9QtL1kwcc{e)-s&K8fnVJ= z>?hi_7CVm|H59&oH{Q;`}AcAO;i`2n_^a>MtLGNo8i~^!lAC2ciCz^O|I3S z>=nmcijXHQHX`zDxYP8SMKvqk)h3g$At^yQJ#+Zev@-hFrIgZm{*yBMIhyZfmQNLJ z#`~A{ulX$q(`Q9(pInI_DQ|*Ci(@QgQniZ&=j-E9;~O&FMUpa?n`_7LbnOj-EJ>~? z=SPAxR%Swrvgj~$dU&@>U`7XD2?Lj|Mzt-?zNtp-N8ORVo-H{m=t!R*H4Q0fA$QRl zoP4MBywU?8oOr+zmVZM|!vr}#<2yQoR@&sL@H#HwHnP1TD!#~XD~uOg#c}-fT~MvD z^W;mzH`L0Gz?_Fhht2u7e}+aL&7eJ9iFOQrRYk)>JC!jDb;sG3RoVO1Q2w~YHIP?@ z0IbV%Knp}d1<3+RD6DO^P%%KUWX^3XpnC-31t-U$@@2QXJ+d34rm(%+PQCjtc()oZ z*OZB!@bBwUc;`IpH2!`P9|D=8Hh0tZBd5^Snoe*Xr^!mOO$LBrp&ioU`pbFR%bGfl6XsV1oH#Rwy{`u_q z{>oU86eZ^eW%K#Nbg>nUp=Vg^WCzZ}L2CX};GOMs%dvPrl@T+H zVTDRH=E}KPVZeKP(|CztNA%(=y6rCEO6Rf~&4b1L(~ngP@3eDqQzFv!lkDO#o*M!i zCv#4HP>$l6hkGUwYC~_@b&J;sa-f*JYh96E)2MZXIW~#*yflVM0d(q?k`u?Shnz@m56` z5P4Bev=sUmvOa?;$sVFWQuI5wZDmv6I@bPhVpn@P?N-K2HKx z31L(Np?si{Pkl+Wxbd>s7C)(|>cR;Fs6MgSsO+j{rSjxcwB2l>@F~ja8MVWP0)hJd zPQ3~EWyHU8;-%n{Qm*=qyIQ`#Rxmh8K&~0NtgY&~9aTP2US$_qnn&8BX{X}#_jC^+ zVB2>X4eEpoS$osSOJ(L@OGf<+?N+mj`nn>(oTMA)TK-}4pRL{JUq9nG6jX`RTa5I% zB@qR(#s$U@a^ZrzTr{|`(I%?ch;5hW^pQ*+!1jaRskKjm#w~QZo zI~T=mwCf=#*lDN0eZ~H3G`2`x|AQ4I5hMd)B&3f(q}pCT#bf*sj5~v$F_CmJBTtT2 zt=@L=5P$f&^jGVO34#tOCQO7*{-nXH(#0@5-kT6u)J70ia6$SMjP&1fV75026-Sj}kre0azMtt5Nq_ zzPGlAnIgP;#w~l%A^2XvI~8@CS>=wby`A-K^Qn3!Hm(LdE)45D4>}zJetXZ|t_Oif zQ_I)wmd^JEQgSEwwm0Cx)8t=`NKn?MrHFM~`Am0RM-M6Yr_dlc?Q0}j*G2D+QtXc- zDODR^8yVz56$ZNa`o8sUh3kpfe8*A};}q)+zK7Bf^aa~Nl8RWpj3allTbB;`Jo^e5 z`zC(p-SVX7fFWgv7IJ}hOEf>mQ*7G|w_b==SdtglCr9MZst%n7i!Z%*kFS{rRV~)d zIRwgkWQcB^fApd}H;JpM9v+^v65!~k#k3?1Da;2CotG*@Vgx4C$J1$uFMZo}@-^T; z=&sA$HyYBnXg^jg56133Kc23O`z)3Jd#+x>NpfeOBB@zPV5p)xd;nX!L7tRA@`hp5 zTWDJ$?NSW>_iMK;G4Qtv*1pPKIzp>WKu_=ejH+2JD+j}K27hsxjPbxRWHO4*@3sT> zX#8{kK8q%u`X!w0QSC177v2Z%c{}~de>q$a@ctWDX~T{F=FsXdjPd%<_j@JHTGOCr z$DIFq!kSO#bL;oo54pp&2iHI-zahT#BJhpZ5ngx!bvfg2|L|kH_Q{O@@CWqv_5dUY zlwdm0^VNIc(Sy{%-G9^LxepWp;pXn)a|HDXl(Jp70kOf|%kn%ZejD+?lM8?j=(Fv- zho3WyKFg@?z9Twl9MC~|{~1Hf@4@YWEl})<8myaTH22SYpYtCtg5qAu13F>Cj}y!C z05qc>uzr@~$tS>8SBBkpUOx2LXF1-p--G;oj&*sRBFTU{!t@lL6u|!ZaQ-BJu)SU{ zydH84sI$IJY{OozqkD#JZM%OgpZD#bUD0)p7u!ai-g{f#_L(Pya12*;S$kdQ^OTV% zi!9iZ41hkq0Lcm=1U!7$@aa!~AO69A`;++42VazQ2S{$u2S7o>5SoJRKpF(_M*!|W zxM%wX0$Qy$4I6*PI7z7aX#y$&V(Y+Dj0vR{eOFb92v8)#&Nz-JxnQ1WOp`cCph-yZ zLF*S#E1+o^+$Y2oF~mWETNy{@YoA7qOaNeAS6p6R3!oSio}I6-=7M_{N3q?M0w}=D z_X8t008&><`d%vqvx4*T&XGPrflWqb1LSppCO}#P5YZz>mQs!2!5r$`ABwF;L2PyY z5F!HYH3fs_niso}mYJ)`9DtD-T9Zhbr}NpymLNEqoG(-CXT}u8))Z9+0dl6PP1Ntv zqlcDC;c%EGZ91gg;zQ(#rN`Z^xQNeVXBLvkGBV(!prWAoT27xph|`T+So>iI=6+7BMVSZbWYXU?T_3KNp^#Ps)vGMkTxIY z*&`0BUK-EhCpAsUadKLDHqhA0%_ujIa-eM*5-yo>S4areSk%%NF`DoY z!2`MwD@tdSx(EhjS_^Z%3fonqAuueS&*j&e^u;#Yp&zOMVfN;d0Tlb(gR}tNbt6e5 zz6Z@W#_SD1;5-ZWHci|FLA;k>FUM`Ton4T2We=u!0FFj+h8x@fQH{Ur;o1Qxn*#xj z<{M+A>tEP{277QpjQ_3Q*PLAU;&nDH0{+$>j)@;5_k2V5u4=`5Pm{X0DlLv-!|6}BIGo`9go|{8(Tup?NLw&$ZqC`BL+~9 z_Tz04BJ{b!vH)lcjoFVeRx$JLH)@Hz=UYJ+Ob(9yzI0NhAH-YgxlJ~$-p)8#yYWkr|kDoJ{7|Lo*Q+sKI$ZOUDpD?uL$nF z!p|A1b>HtB_4u{kHP^^-uCM;x%@#>{(on9Go3>NRZp~?s+bk5clcVj|bWk_z7uykf zKaJD{2%$h_j4A*ba+Y_@Da&`)C#n4UO1`_k0@fAC8TI;F6zP1{d#(XA)XQgxrJ%m~ zP2jv>$Zz5&KmIoU!ykN78|TRce((tTa?NP&GasdZL;w$5Pv{rRUeQ6>y~jE~XIVbF zfCrcPIl=AXp69i?-}eABf6lJ`E4HApU$hxUp6@7v=suD{Ko3j5x;j`U`^{@cSFXi< zPF?h%{q6-~W6*HZ(?0Be?g4TF^6VGu*n|9j-jjI1x;;^1??q2p_&G}A0ln(?(FF*O z`|;�^WC>hxO?#H0H=e;}t(PI*5JduRo4+!Ce4}NgK=Rf~*_|&I9Y2L(zA-B~o zKmuK@RYHbWnKK~-teRe690!RuV0Mat>yzZNKQCt-@{Egn7x>n2G#@YwJ%y$1pWXg}@=fZME_M^K50%1*j?$*ABniIS znu5qt9Z=AEvjC~*SH_=VOa(f zYT7@9gi@6p)C>fN$ye?dB9Lf)Z562{ZC|iDfKE>KJ6fo0TP?V}x<;uIJz!E9rWDi; z+Mt{hBL>)cBLoa%LSEG-sgXGXpk$1Knv#*Ld3IqmSBbLUfEX}DMkSE`9uKnt|1kut ztrJXuCZwHIQF6f&B&|Y>0kr`!_HiVbj{u97kYcom8EeiuR}(_$dR|J^xgmOzlB{K+ zK*=fWla$fWaB*>==@j~TWm#5SpH4WP&Uop?Cn#0Yg^c5Xru~qpB$5JQT{E6OeTo-e zcx-E2tr7u_x=Y(MiA%KLVq6$$wv0vvfPLsjKg5Ia2`rd=Q9pr#tDy+_5Qt{ef4*7|GR$lc{k&|aD4`M z1cT>x-4P6)<8|)?um08N-G=wVb^VP$c-~F;OL6hgA}CummM|Id1U!IdAUeb6*{0S) z(TfqbZXb@U&`&gG%7B8Y`L%Rbf|?B*DIr zoh&SI4}kO8y#bnr=}LoxvUjDw5h1#RjP`}$=n#6u2Ieyy20gI0p7)N2Ie)Of&FI~M z&i?(zQ%*(H!JOEQ&JMiUfJ4}O`R)KH8qLk{>>hL=P*4SE4Q6!T1JG7Jk)O@qszBKF z(baY9Pjmx|2Vq6V{XQ#RFY)NqF>S%MwcpplBXo~RD}`C}e;TOcK68!U{vL2+9K45T*KL?#aZga;GaK?wYw!^sHXxSP*+Wl2_aUWE012(VKZQq zMGrG*eeuyY+`OcBk{>4;KUsethG6YrR2^Bj9Z2ii$u;#haMbjOYp1_=KQBEvhhE2q z{D9pW>YlYRu{q)g<(6^r;3(&qwMq1p^=#(aZcbWr+6UhndKnsATU_6$17S-*@gxYo6Y56pUGyyHcA{I@w8?<{cYBXo zr`xULa&uh?8(s2!>iXo~Rp6S_Nojrlw~c&zv8_isa{A=;bgSdK_WSpxtIv}lHe=#0 zG3wSE{kcg*sA#)19M&IfBL{8B3r=UNCj?-pdu~2)&*s~`x%PF0o8Q^EJ7YO-?7DDE zpU~F^zvlHdRLf(YV3ufeY5NZH^Ty95>w{~PC&AfgHoxtqC3}H9h!a-6 zND(Lv7zUtZiEMB>0T&10>KeG1CQ2{_~704NF98lL4;lX``XHS7g5Aly) z`9JX+|N5`vou>r!y~)CZlpd7yUfcdYKtNXlrk-d3_cuugd(VCk95b3h+dU854BPJO zXs&JE6Fa%@JjuWV-5rRL=mb9H00D3x&4FcjVuWw2Ctvue4wQihu?KXbgm2U0+6?ru zfctD8O<>r4&xPH4uHUvn+V|Jjm$99!tb;Nkfq?b%UJ@6g`w90w+ue5M?IStxJO8&Q zmF&Iq13D>!ZSdatj3D4;$jhf0@VZUiY`c3s>429f9Z>du>^w1s@>+5G9Bl4h>MZN@ zI=qjP!QXxRn|qFA7*D!r*v@Q2hUjw(9ubpI}1-s)Z5#B+R}C)L`3(kiBDaCV4*(@ApL55piJ zBsBU#kTCB6Ecz$E&!wO!2rTv{3FlAU4l!CT`15kcvuBrh{P>YM>8xv3atjI1(%xYh zLE_`#FpEyNK3*{f3`ypA(lilF=U`->oB{Rv=N^J&k*cXFL=UTNVrpx6^1@@eHwi&w zR7a#?95EzD6^UR(4XC#AC?4Eg;{K)9zUQLMWzX2{eK{B8P|O*smLlYr21_YnTW!T%y1S}8XF=V|Q3pO6tl5&}Vx^|94}7<3P+`|nZTe2tF|VjtRRkCHTN_Ptu^FD))Sf24cDh@sec@0Op=lZVz)eu zS`FJmRB4+=!Wx3VBN%*VuFpL02E3oIJA%P; zx{vHK<-!nuo!wqr#ee|;vY91= zzO}pobR@i*q&ldzAcTnP>l5Z#JYtfDh2thuHt8@nDFCDpQFYVLz4e+`%O3|M3!f)p zsRj!dxC!?cn&jZxf%Ja!CSk++rnWl6aZ_8W&nLH>7L4Ph2eHn2&3UzFjbW}E(~Z&E z)$hpzxBY%ApbXr|lTI_T2OK0vwQEoD7PRfOWcfw9*Vr|1YFVf(>PBM*BKO~dBFjQ zH^)ra=Olu3!|5LIzHzz!m<)INV`H=nJuhYJA-n+uy?S{!0eOyB@a<{#=~k{zzdFgm zrIOILQ62=USQ=&R0ab#Qo-|?KdHvNfs&M0B1KYOpboKkc`Mi~_?*4t%ewBDCZ z-Rz^v>$V)|w*k+lyKyH62XJpdQ_dCYpy_w_R^7LUV!82oz~+9yd5EiCOIsq~=jQG* z4D3eVTqFcI(gzKGp?jflP1^vj4&=5nu?5l%U}RfBYZE{KjdQ`b$B&C23qOZ8?Y-@L zEn=@jn=dK0O9vLStFEqw%-GE<8IshZE_A=FL&vmoScjt=4G|6fQHFN zZ4$)*K_V3Zz_QAHwE$OFKwg1MjbyMa{a?wzc|pxt(kLJxp04HdWdYuL3*Yl7;75Pp z8o&L!_t61a%9x(y^bCKO1^q^tcc25Hw|STIJ`bn|Y(Y+fyKbShivT&JCHRyEEIZ() z*F7)x#e=}?uO}<`bOC$t-^-|>1HA;N_k;%DAAUDL2m}G0B)~FQ7s(hNDCY0`2nRm0 zgC8e9Zl1ircKiNPP9Esy*m)WH=X{^oU$&oP?sW**%9^qxiNU9;*!O);Jn#e$Pcqo+ zizgZc^r#L@DX?#+C!%;#fG3&2eYcm%J{1DxbQ@U%==wmC2kY8LY4DLa*xz;c-Md9I zU>o*CoqezJIbih3?fqyxFIN&fL<2xU;C8ROFpH9Aq`kp8IyY#M^v>_Y*H|UF2}6V z9+O6^EVZJlO-5`fvhK$ifEFa8LTRX(A@BpB_MV)xdiZDah|W0!LH2kt={v{XL-Id@ zh4=5@6Rl9sVDWs8HsnboIuOKd>R=*vqM-dxD6J{LEfG3}fKimdA!H0TBYJRA!OL}7 zI*^#NtVFdS4M`(n=<@+~hKgwrx#?L+#Nuorx(|@Fp+ZVYIu}w6+@wG^>23IT?DY44B)J!h~FAxH#TZ&zr$a}DPs zTC+KWCPb=Io1~Ksz`97909nC{z1mw7vO+`b(acotNl7&log<>I@_mIwlQ|xbI3AA( z0eJoOH!w{T9zJ}4`{9UTp3wIX;@IWaUD^i5X+%_fzc`t=%cH?mv@gqO-Blw-)`5nCR#v8c1 z-k;aAul_DR@ajK)-pzO~TtD`_8}NRCKE^+DORAqL4KRpcNho9CYDAcko7HyXri*=|gm9H1)5LQlv!OQeKaHXHNS zB$OB#`~ecCjSO2ds&g(DnSh&TVb1o{1EnxG8vxzJ6Yvj#Y+6`8FX@{cNN5Ky_8t4y zHu(;vOxc_=OrOXh+M(YLGk~RQ;MK_**nGDC&XWsnW3hUVGy-;Zn>WOZl^o4&@OxeT zUJvN)jovJC4~+0R*5AwZA?kWtd>v+tceYtOboB?eGIED>mbbq;Ai6cc`+w54w&|aJ zw~_I-o(|rH4xsa_r_V+Yw1?i84cKHL*slHh+^s;B2M2baxrTO`?>k|75M`ss&HdbnKiHV; z$HfC&e%xT!MJwR=1 zfNNqW@NDPmP4Y``v$et9=j&yke4F;yjWy8O!#8Uc=YXwuRhNTib$MgY4c+i-i;bJp zCD)$~c)Zi4%?EBhwlOfnTXnZ}8TIK#d2ie3?~(f5+Uj*?zgFzt4f36Dw(3fB0Hu2$ zn6B*J2hGXt26^E&S@`!(2pbvOoY=2DZk+5HTT(rk+~?J{jSbl8*`AA#gx`y30Z=e9=c`iIch7HcPVee~~K^s%;faGY%^ z@Q}HCe*zY!)z3c@>AUTF8Z0z5jk?@3Y})PDx!qi)j9P0(p4q=c5PCh#P3za_&H4zx zw)Zh>=wsQ?`+ZxVN-ghN*G3ne{Q7$A?(^?Hr=y#-)9Ws_?@{ZA%EM0|zs|CceBQs) zx}1X;Mk!x@ui?0%UTqjBsV7NzUyOtNUaNeE02~g$x+31cCy@&tJOIuMa6BTS0r&37 zStAX=;eZ+wa6DqjXZ+AdzlIL}G7o)ppN;4f%75oQ^pm@1yybg-*3dntc@NxY{G4S@ z?!LAw*MsH!+qWO??}TmJBLrk-eS@}fcKwFd@4fZe*5sZGJ6ZXAygWwN4yH#KUAg;b zefuXT-^sPh%c1O^cZ;3L*1g=(TtD1oG7ot_c7rR6z&7jfz_cF+U;lW^=ahYP_3U-a z>!gn!ur-){DkZB&(yH>sn zQNn0@?{y%!y)xf*3h35qU_Mg_48tI{5%tQahr4)4t2eVt9V7t0MjZ=n^ZslKvIqai`x8I&8Y=093 zJT<~ak+A+D1jLjyrGboTE*T-ffO@7nD79HCP1|IvO$%(NMzLg6v}IY*0F5A#O@C5K z`U;HV#qDf3ly|9O$I7`_zV=*-?SaN&aQhKyg~r5EGw2}k*F5KU^XwFl>pI8dYVU#R+LM@JWUq$R6M_XsCj@92YNX9sP@Bv zZbRf)Q8qC~O)nDF9vRGQyyTv4weKsvU9EKwbhX!UjLyr7Kq9L}3n)g0$ZLU-RMZa1 zb)gioX|6e&3?lU)z}6O~p#Xq1449_LJo{5(L_OFN%9IwZ!Mxw;{m<00;`yHJek;TE zpL@+xx~&mlY6K~t5fadZ7$Iw+*k6l_B5MR8oyXkk#t<#_2hSI5@3LlH6SV)W$r_^| zImstH1C=W4Y2U-b#x6Rkt#iOxQ+h1Rs`pDDA3V5^X_EI^k5MXEj1zlwOvbEhEi*H@CX6psF591mjZ;m1~jvwn-cJh z>TF6p69xb!7p$e=Cw}6;#3w%Si5oV_yX*aPJ-x%UzGK&?e&uVgJ?}QWU$46e2G8kw z_&tB?r=E8k-YeH#1cPtyB4b`QpmIRqK@Lz)e%=YTgva#>st%hNcjc(~oeBK8L zkWZF(8j^S&hR*JlO=CYO$mUcwtTAb#MqYYHu{P#R%0K>RNC$}!YTASt{qami*K|(7BfE$}d56W!-Xm_z4H^4A=b)e1} zq7?{`FxNcacyB~S5}Z-mn9;7H4S?<1>_KprOTc3f$oancwh@i+0G1ZGsek*7mgmAY z`zQ?7J=YBnHuE>{6}ageZjQnJ>d_0f^^jx|VzBVy)(`EUAA=jle9F^-D(v4)Kr3vA z$^lfK96+@R?j8?h+I-}VyvKRnGd#HmybZuW2TBac#8zk6Z}-Oy57q9`+{cSX1%@2t z{Wm8b4@K&8xYN(`BV@2H}7Y^woyWM)mtBK>Qe~LgWAtQ7Xe@cQtxHBSHc5dc7NY~URs~s zlI8W<$SV#Y-~4ouM*QC#ul-u!K~I}&oR1J4WfTl~ZMeRB>$5tVFxtq0*>&ecL#^<`6 zn@&s0)dn5`^hVpQL18No8xJo}KOS70tl8VOhcb)UrzL5&hWRyvI=4?t08n1rHufc? zM@6|!UvIRZUIv3aj|YS|-$cE45Apg6HAcjBL4EoR7-#&Q2mcYj9zN;X z>D%i=)(3PD)qn3nPY(inz|{k#!QCI+-vr1QYAo$b@0bB2WUxyF5&+q&M<@0QR z##V`Z$a{LZQx3O*y!%uL1m}H32Jd<9>+$XK_p!`<`UzhK+vCTH-*duxx$KDu9wcWQ zJh8;f%eRMpYpzXu88UT1*_E;1Uy|TZcb~KUe$nx1DSR3Z_Q{v+z4E=cKgY~RIbgY7 z20oGjqYwml|2~z4Z*z0?@5h@m^l1p1yKmp0QR`=YjB-H2%DxUS%Y7sR&d(KFy}J2q z2rFKGx!`~JAO9|XoX-NhPvaN z)_|nMkV(^hBA`3rsEp{$!f{9nj$8UnG%QQDsVSk}Wo#wwr@oJCMGYO8C1~6lj4UER z`HE>84MY}O+k&^>ev13|?_(SXJiEL^3;_=x+?U7zXzKM}g?ymE^SaU#z2PuVn(JN( z7-$B(rXgXTChd2$NR1)%Jqh<61o(Yg1$wd9Dg=aeT{XRkfXp!j91asw5)X7sbr>RQ zD~Jf{sMK{QF~Wp}y%zz~PIo-awp=ozYOO$9SHxkI=q0(J2W05yS2>GRthvZIM4f1| z3A4S}phOq$J!6QXuYrV%ssx5$V+{z2C#tTNTwS__W+Z}Ii>1I|yEWFzSc#Fko> zlmrB{S`d@8h3OT5v!DDgyL}+tWF>477!BDe3<(Fyk?*_1QH5@*lR87 zLK@JNydVUxLC8=Vapu|8HO|Y5i{k;~IO6*Hgb;uS_eFQdaj^3hquaLDOtvXS%$fou z1dY6_#4_n?L{$ACDX2Cj3n)28)<;cefM#h+xVH2&9mxy>YH28W(G(vOpmWx?{vn|0 zvy39lGtfKlyn~2$i~J$QG$*ROJZ2g}nx#q{92pLbK<3)g1=eCc^N z;{ABtMKE{{R|w%__dfhXFFx;fyce$PH~x?3-Gsk1SB$9}Nfn4;iUJ-+w%^IdFQ#Z9 zJJ1hJ+?-D1C}F}Z7oF^)a>=rJEIqedZJjaAg9R+wpO7@+$1^ZLaOsUMprhA4A*$ z+cv%&x2^txW46D7>;I;WJDuNy*qdqC?``Pg+dpqQo&N0Cuz;KL?ds^}nqP1C>$fvp`E|AzM@evf@9z!+$6K$MUfMRE{^#z!(U<06 z`=%nW7taZ4LCrxp})^s5k4qmkr;i`a$EY zcKZ&~54Ya>{f%E6fUbu?U&H&l=*r%VU)#vOH`B?LeROSTPJa7wzd<^3^Uo7=_^j#f z?!CE@7hwIczPtC_ZDsiP_oghC)0|A5&iL01$7r+Of$!8_$9CVgo97`)6oPRSQi1&( zBt1e(lIB3e!eTiC$0P90J7^CdBEI!a;Kdh#*S`+D_yqCox6mHHfcWewa6BTkirOIM zUOvUEuYC_*cnsY1sNP2i0JdK1K9ay~Q3jH`haT4Z2noJU|M%X5eE%KW*4%fjpZDy) zqh~s!0buu?w5zqB#jpL^CwFbbuI=>l-$zF9GVzfg0=8rag1~+r-6qq$CqCToUIy$p z%VU%S$^zJ?2)Hf6f%k&nw}th7xwcueei!5NQwhb zSm5~IHm?Du@<{27Pk!f5kLIHpTwhw52VLQKtTjx)jaP!YY^BBN-E%cqPaSf zI$KQh*uk(Mp{xlOUtga9G(5O}ACDeBz@tYGdPsEz3Fm1tkUl`X#$$*WhrvADliC|X z5FnAZ6eyX2pcB1<5ny2CIEwfAx@4^Diju{feq}@f^|+>Id?^LPC}|*sIFKv?qqpDW zTyQ=uxV*f=)%9r;k%6`#0XM68q)WY7fIE#iIgaAZJq!tlc~Z}8I%E_D`h;AtoEI$1 zqJZ|Q{{(Q)rQrH>M$W||I3@E$4uFnLuEo+8lw6V5Y~kb?_FO!a#Y=iwSD-a4>tcFg zUe9V@lKrCCZ~`JqsW_cZ))oS`e0LHM2J{_Tx!;Kfde&NTURQ~JpkDISyAVYt4J2qp ziylfnNGXAi)%NPwy?9ionPD8XUC?$45PflRz`8D|wc*jj2YB(x3qp)hdD0fhR0PYi zU|p3^qkV`eSh@fKr8{WMeGqMX-9DzoPzC;{X|Q>k*Q~l*uq;B7k})2-olX0lmGr?q zd{hDh!QN5|&gTW!rv>Nb+;^c`2FIBZFKCC%S;m33yp$x`#xNv|(|~!N%y!g_kO{20 zATQE>k};Nb#j0tdI5$XS;T$Hx2Y^Kb;F+sxL=Bz|n(8f|DMd&P94nstxlVDOCAHTU zO=$jrvh?(Rz9m6t1ncN*b1wB36AT8DSqHA4ae#MfCr? zN_3HzUV0gy{`9Bu>Z^B-*YD@+&T;lTc75h~H{ktx-4P6)&-IxH-}R%n@bc zw||k*DVu#7=sn3G%fSfU*w539q$ZI2$@m2%uT_k~Buz0{$TEh-W7sQho_Sy(i(AU= z8+WpMhfxmsDJ9JF!Iq)jPrjdSC3Ij-a9U$o@_S+A{nb`x3}n)y;d+ zs0ebn&f0DH<_BZ(y31++x-B4|P@Ib5H&oXaqU!wtD$~A!A)!&?9K41$hnN3g+|2#PQ zXZ>Y>7@xB;yP@8S^>XoGgc@nAFCNt04r`ZrwZd)ys{XtFJb{-j$N|7WzrCzX_MtbV z>HT}a!vjmE1MC}mgb=T%p3K2V@?p7LN8ED+!FPphbt3e8sUIXV+%|50e%+=6 zem>az@BlQM(5mUXfvs-6*~-TC-x*$R10_u#Osu_M{vLMe*7po<>gM*@rk-KjHPEN? z@Z^aN!3GYL^y?Iwu8VHox_80;y6yc30-kOy@kEGCAKV-ucwpn!Tp92H{%-wnpS50i z*Gt@d=Wa+)oVT2lUe?XY)UPLgO=Fd|X5*H14!gC#k59mMP4WHYeKY`bZ1#k~eOuu6 zA-BHU&<)930uIwq$tMlX!sPA=TI^ffu823=#W8a0t2VLM(_A>{-MrWnBn(`4>-?r| zb^C6Sx`NX~H883yf}5LOwwwdjJFk2E+rJ9*{nev^__ZIKGB*8j^5H&6aTA;W{=LgW znog+gyzX^uo>3qR*VmFR;qsZ10WRg|vu8pw$OTw6-1*a|60zXTH&Gux2EO)H-~%57 zzWPubQHN5EU(lKuU9M$9Y1;eh!YU&9BV&?DUc^MF48_CPFl_wGpv!|pQ= zF7JW#;69^_{O3NU0)c3MKS5d#zV68kzP&!||F&Ph`I}$Cum0*Q_}IrTTp9je2}%FU zzx=)U;uk-QkA3W(>+{}A-naRnWgH;jyzhfgApmq`^+W~V7p8Jxe@9m)>*3gu46rAC z+$M7m(l>17yC;qmY{zmh*Zn^asPD($kBv`B5wMLIv2P2<+((h{<5hRh`}&*v4DP#q zWB?z*fkc3PaMC?7fc@E*&3~S7LtO!Sv<`nYY)KLYodf|$L;~uZk619d-~FoZ``F;q zHN?2!2Y>Ko{CEH8zrtVp&pwKW5AGr7PW~6bbW|We;PUbkmseLBp->|coX(Pm-2iwA z?=L`{L>!=VLu+!jS(ZhC+9MA0Y+&B?^$9U1TwPt?aMFlLQWqQ!vycK5*n$FTO})R5 z7YEGq+@mWHoU28Ed)0H=FeJyffY$4paXz1MIxkq3)$BMS1RO7pR%XeP;SI1#lFAtOKMnPYeK6!UNx3r4*S-W&;}08Z0#e$)Kea ztjnrkezB;O)d1{j(ILd6Un2;{fOTCRnM2YSFh%Fp)wOu%r@``|OL;{BO6Hi?bOw2~ z$OR-I%+n;q47GQ4#}go{H$C;29@MO|Tp2BrpW4VtDRVVWjP(_nygR&e}uK5zOUDN+N5G^is_Gg;(Z?EDjB z#9^M5OfuMVLVaQTIE_<`3hau^gjgU1ld7Tas{+om&9PwK^h__Y)U+Un zdA0}-lx^79KAECG{+&;YrVwEyPC3hwcp-DG&l5nr-P4eeG!n=(jppHx2IO2jNr>lZ zw>On?1%Mug)c31Fh$bmTOyh{8`p6U~S6A04xkx$;f9}<1jm!~*WW_bXQo#fv6wT8l zWuhsl-Yj|q0JVQYB4@a?E8>waea^MmIxvibq$W{f&$G)bT{A>(S;+~liR?u-MRm7s z((Lkl5D+wVM8e^4z&P{>xss}uj$Z(R>aWTnrKC|n5@HftZYKc9o_?A}q?k0COS8UO zL?yy+5zJ)ZgE+>yD}OoUXeR3D4*H`Qyt!@Vwjbp17XfvAn+ROIXl@F)RTwK$Ep9 zfI34=_Ry=sknYCK5SZ^vLb-9%2o3+e1;(SKWkBnP!8Bl9tA;F;@Kww|mP^(&4)pj} zQ*{iexgXkUjpii~W79TNJ;)01-)ceAO?_{_hE~&*3`Ra^4QZroxY>vP4BeQnhkQmn zNGW1ntA&#jF9YeP7(VK@oZV%hfj9I*&kZ{R^`=oAQ-*L4=;58!_SQj4df{$Exf|fJ zvFP`4ztL8E&H*k2dK`FUDGb;yt4%_IQ!jw6!Jh_sdMg;H=D>vRbq70Cuu(lsH2_8v z2msm^5FpqX94OM|z3VWI>P?yZ44ure3BBEc00`w1R6cNH-++c4_~H6!_(SYtKqFTr z80)_CK+^_XM*oaDzei^G-pQ@Gb_O?|l$U#U53qXAU7*Wp3+Qk@hu-FPTlrofH$gD# ztC#65b7eCxtYofBPDl51rolqiTe(iZt))&MHg&pgSlv$lOcd_^t!{@+U$`PzXm;0r zUlu>#l<)rbfVtPLz79}(eBFK4Z${GTzn`a@IqN{f?c8G@B89pgQ#T$PK+Z3LUX}Sb z=VIFu02o$1s-EerxVauTH%_~<_dw0yA4?rg|CZXWMbe)zf#lJ{#`Z%{9bx*oO>AAD*6FZWG5ZB5t?;+_Zqba31g8*ChW zn^a!W!n5}1M(}eOy{t_t1Wzgn`_KD$^)YPj?uzn?lU4Th?Ar-+{o?zQ#8<0O@9lfE-TTj_ZnCcG1}V6@{G8}}r2eeW@wySM zn;U*SY|L~m_0QQm-fs(b_vnPT#md^|RC@C+2tm>$#3UqxaRRQcgj8_(O#Z$;$vs1o z6bg?X1Aq24;Dsl^pMC}S;D>-e`C}m!d`-v&_0Rqc2nq4>DeAH!E(_W>-$eZINASH5 z-oPK>yRc1p;3tCzDTm!XZt>cLWhVgYQxa5n&uwV~Sax&w`?A>vo}>2Z6ymOJaQAyJ za;J3GM@et+%fI~lc=gps_~I8ojW2xRPw?uikMR4y{|k0(-;Tk2vTe4hdY2=<@(R1hpqk1y}z=YISuy2&l?+U(m+xqAXl##Y|^ zuI)a{?sxWyW%0VLPL{F1sKYC^GGO0;?KrSqY%j?YoKOB4FSps1QQhw>tKo1smumR8;8s=$6&e?$MQZkC3 z{TpE3;j4nE;#Do4?vm1Rz~L|nkQSo=MymqP0G4Gz2(#E!LPSJB9Fp2OWX^D1Ct#n~ zjCmT(F@vC|fV!P1#~k(Iom}17Ry<>eA>n*l)Oi9%C>zEB`8uP;hSTXJf9Hb3K_Ws9 z$%Sx_;uSs)35UZBZXfB{JER1(W>FnlYxa{M|C%!f1=rSG)cd%A(UK4$(cjEe4cT(qxFYdVepcG+@oE+sgz4{!^{?-uJob`_&^motM>sZxS*| z5GbW$90$z9fV^gm!w9s7RY{Ga<2?s`sYPv4LULeq3n6kO1L1Sd=GEWeQY&a^`qG*Z zQ%bQEr%j`o=A0$kLTxx6XVe)AzDC4E3NhDCM6UM zZ9vmhwS7OQ(HffATbHsrl0(BV%&KRyPH^8yqHI9G+Op}h-yhpYp`Q=(DrA%pq4HNk zi|TGl2}2Uy9g>3XYX&q0MPO>#*3g2CAybBAM`}tb*g9Kl!gSLsJuwd(w z?6G+ulOI*dT|Me(FnyGF0q1(`y4oal0|G4FL`(s-G<{AMOh%E&r6LAk&3p%UJ&K{* z7&-|!SU;XTevH5R@xO*wUU>yy`qEu=_xIy<^^HG#-c5L~Tz}lZt!Sim$d*Zr!<8BfDcCPE|YhjF*esCX#h+2io4D{3 z(njB?-v(^Cl)qr3&8+6`4{0U=1{+5KMkswLV#io`Ti)Imm9U>*KT{J_F&lgFL5HgCz zP!Q};&jb26ju=Kcd>#%5G(Bk4R-N%d4-u&w)+9e#vIEjEBs_b1iQ~ml81E|ab$0M?s(Bz~ zE>81=6r(WJ)j$=ac*7+1qNufW=Cod9?IQq50nY|#csM!G(8DA~8Bc;LKBr>`#hT{n z>t1Wj-MOwASJx+;PAANhgb^Hu0q13rLt$jjP|4X>YsEazxV*Z?G!AIBVaXY#6!Qp@ z5Rjs?l9DBuS4>KBP;3D>pU$Ee>PaJp6fwRGW74Q7&Gf0%io-k^13jgl*He1g3}nl> zdm*KiZ zbr68%*rb7?>G)e%MxBp27fjQDWswl3DMlO)2kEyXFH{Yu+1E;0TO>CvY<_m*A8buv zp2-mUJw_l3!FkhETa#jp5~4I~sL?=!OV4XKPa|3gn1->JWd_b-2Bc+KMdx*nnD@Y1 zEG$*x`V?bV4TwEM=eahzLur4c-dY90HjUf=JBQ#bo%Yx(KU~359sni+q zt{XPvI#>#xuB-R%T^P_O2BoeGG4Op8a5~F8o5oSRM?#Mr6r=WNloQ6^FyT@#5zCG7h5|Nobs^G^*OXf*PCU_gsqp9n33@5rq7^ zkvhP%Onm*(aL@PtIF6{L;&eXa`gBGu72`AjEg%gMr_)(I#**r3)cnh0yu7-+#>K@^ z!olVOw1)XGo5xa0!Sa{xb9+*+mvy!N4&$KSYfU{C2eoI(e&BQxPqAqlZErOs@o3~; zit7=>;xhG8iVu+Ap$m^o=ia?Ag>nfgw zX%KKDN?U5pAlado6%rJJIwX}eCC^d;y&?7MufKs|NSMY^J&UqSRnl;nX8~?f!g*P6 zUKTS#d!S%L=n5U$<8?kSxVjQ=uB$7_r%Hn0q~MEgn|1#fFioS)zhzlB?}=&Z;m9x5 zYjzw49FGTtpy9YvGTG82H>Ie#WyJ%HUT6(HZ#VUa`HQo9A)Xh>H$Dsl9xMy+@Bt7a zPzx~4!1)Bs2jJ=wxVQk`dJA~)0Jus*LYQYDuR=1ozLv-Z@4O9s_#=ql_&V^R52Akk zb>O9!5x)ATz{Ne_=`&y&5g$DUuCDOpp%0zzNd|kMl7q1aunBesbimUC*J<~hQ&fz& z8BTv+zXz1r#{KZ@sl*>k-bg5rJHP^4QDL1H$|7_W(S>^oC9r@Ss1}Zk9vJ(y1)572@3l%e4Xs;zD!;u8SL)^I(dL|iu%mU6Mk-+JGZr^{~kiY%P&{_ z!+-c${Ll}*g2Qpv{aHpDqMbcjlknYg#)~+g7fdtBFmje1$I-lOO9>ch^g<3 zcqScE_dc&h&KpI+@)$`XlJPs8&ImC`3JpfijNOCXK>jMW53wHw1L$YfsahLq>GqSH zGx92PuK}1RjjRxWVN7^1-qZb;==!3dduy_P1%Ots04G7%zQv|f8^&Ro2~ zwh;5RhpbOSGP{P@xr)hGo(0Z2cLt5tky6;6)75siu6<7gNLDB#=r$5jwcRlo!IX1@ zx)NGLJInjg?23@H-7q8>rW;w%j;xFwV5*b4XA3^ONBs!g!#q1oMQ`Cvt8bVcqfv%6!G?^>|0;Y+&TTv@; zI1G|%Ky7L~@5WK;D79dML|Q1C=7Z5vDDzU7Hlrz7AtDALPt>6H2p+0vH`cyNnuvfH z8LgzJ*=uU=lrw{@Wt`hp)|8fE0}`hS0Y?sK2RilJ8|4y{~ulJuctvaI^dN7quq#WGj0Lo2!2od8r>S0EV9ZB=>5ga26m^s%-plG$Kk)HK3EHJ8!>(Z@lpa&dXT=k{*I=nkUecpjO$G zGyfx6Gj@GaPY~0K5H#nVjPW#$$`Xfxi>wa=|c;JxpM$SeCpA&sR099}PLfm=wH` zf4LO%d2_>uSYVDrKIcJodB@A!n z8bw27H>}YrLNBoZSZLd<9#!)+3E3(pGeDEbLh_BQ8^OZ1K74TBKvyACh%qs`cQXlT z!=UdBH8vUvhWi3^QWZ&1wHB=BMRc<@Mot>E0boANIGu!C@WvZ&;_Y{yN{(f1E9a@~ zHM(a?Yb2qGx8INkM26!{(F|}edEWlV~#BR0;Bk)&i% zsjY+f)M;5Wg5=V*u$|fFVh9n_e1Tz{(OS_yj^cqClMo8hfH+KuaZnG@s{0jm{Hwuq zZx|-iJHMaVhaI(rwlQ*$yt_h7XnH?_lt*$8&~(2s*nU&y`|W9t%z&yZBfn#`sq?bf z9--$FjyNe%E-ESIFdx*g?mYQ{P5(&9;QGYx&u7W?%uv}wikRooa=>zq$o@$T<9tR) zH9_@HJm|Pr;6CD;-+Bvge)C%z@>t$;d`BMDQ?)hmg1fr9#`%1Gkz|(gmb;7salGF%qy(MIVXHS85-jOH^)>K~*MWE5LVf)ks9*mx)OEqjS6{X@v4hIV{m#GlA?-b=?SWhW zya$o_%!Ce<25iIJ??F`7=TijueD`o=_odd69B*; z|FM8&zxkVgiV*%6eDC-EulSjt`QPzx|LvQ2^hgZ)|KeYKKR)-l?{TuRNvFS$?mI7+ z3F1{Aux(?1H}y9AzEBQfcke!xgC9rAW&h91!?&NHadV$lch5dGLE7Ed-0!~6zEAr! z1HS)$jG5Yjmyck;^bvf1Kkn4cJ?UbfCSqSVZuvDK3Oeb6YZu8Z`)fZ({58JI zeE~NkA^2xKx#rKSBW-?9>5NZ&;)wtG*Z&**tsi?0hvTHAJlMHp)kuNfE+JvHXV8ng zd$!B@mB6a(Dde1ZILi7wPm_|X80|@OgolWW;{iiTI35p5_*U?edp6xSolc9TBN#Q^ zBgx5n)WtXsLg-(!?0wHG)+M9r`Bm%~&1@1O1O;cy)@#}J0ZreB1>-Q9Y{pRl_-PU{ z>^O`@Qs7znbUNF9B!(zyCEU3L{5=TKa~LE)eJyF^rPJCJhpHe^v*EsF6HLUgw_w>iQZ*i2x~f5;XTi zlKxcEM6iD)SDlX}hZN*>mA!_ux$*2sn}f_j&3n&1X%uIUTB?ojFi6;WrukUbPQJ`* zwq-3K=-z3Yu7vwdu?L7vA?w+!DEXUbX4-kUM{lj4SDBVoQi*V1rp^y=!~>U#0lL?s zO{zAr&+t51GVN7#q|i6pFkn?Z0)zxk;`OR2U9vjpFlxb?vz1$It?6ego=+$jN==A6 zBI~>sb@D1gddRvrRWcTVeMX0%b52vz$Ed_vnGdivW?feu%cM3(k;6C+;`kAJ$`GEJ zhp|W9n8raIMRYB!ts$unF_Oo!W+PtHQKfK9_{NEnCZekSfoFE;{UmYs&#IljI!Q`w zVYM;RNRPIVi;$y+QKCz9o0yy&*1XDG(Yp0OgcPHuL{V}|ZTRV*{%L&R10T4tCf;3t z@$2#9$N1RCKK8tu@oimqX%fC;*Ik-~=WyK-4F3PWe)9Oz_uml=z600OyYvYEkFFT? z{1af|rfBCSQgIdI;ow6MqhgKj^kj5PoHb7HDDa44$!r3 z0A|zzfM9JgRy{%wEfxZ!6*TLc2jc}S?weoPaEoDw2RdmdH;XVr0{{c5d4L`qyPKz) z4o-DI+zw=+FR|t|?Z^ZB%X><12nc$SiB6BlS~}~#>L!(Pkw^nsJtzXs=d&HoD6gb4 zp(pUOXII9C_TG9;J;|@GuJP>ICDJh9coc6&1Gn^^^LfGXa5Q3v9CXEiFsgUnG);2& z3Sxjbofpm1R_u^nDm{lK?_){=CKqn_s~lTwD&Xv9H)j&T|dL?nSCpy#o?cRV7dh&2n5frr^;S+TAePoG}m z>9b2jJ*=C-p;e1ek@ISRZ^;E`H7bZVq!2BZWwFC^(Rp${FSx!s;qvMl=ko%3qYO#% zaRxBDh!{xd(NQu}eaNA%6dr)9hQM4Egw9G>k!TJC@s@SP>2xyCa2iKDpb0h|IYsHI?KZb#0y(_-TnL)QsLhgnxS(DK0j?AfIf9x|F5*Ul=l z5P}-777XK{ISwm2VW@75debzS!9vJBoy3up^b|wDk~5Z7NGd{J5n%sxKAS-%rcUy> zx<29Z^4jvPw%QE@^dLH&PAca~h)Mb#!Acr5?p++sD8MyAh&!Wr^NyqG=CWopUR7O- zrg6lo#+JizMr#%GJZ?gJ<}4mG^la}T5M|xtyN0Botl=m<;C(zC#Gq*U%zT)##ttco zM@Px(m7MHd&1e~7fL#rwk3sr;JRBg=GZ98bR%50wP;mflb+(;n<%S6EUG6_YtA@WNvY(@U=u8tWIG_d>`iW|$HJ z*MOLU5y+?uoPR=sIqQ35!ZZ$+19h^LuX~;*gIGs*r2<1B0pk#-^ zkvJnG2t`~Rj{>YLItMismEAnmoE zjgf>JYTkQb_q|Qu%y6Hi{SP!c3#cvnD{BLRo)D7|AkrXhNrUYL-}TxMAPB@rF6L!f zEi#dXC9c)dZ(UtqTOL~iRA?-e>rpq>l0-=YFOBM1=cT+0JGqJ^wq;p$-Cptb+i%-C zF*x8~jGxigKkC{%&yr7?#%7BcBOaj=87UhO)|z;w()*F5Oxb(~Gfvl9aeX?0>AtS7 zuhDV=bf1NkfMJkG28V;ZRPS8?B?I^F$@do*z&Iez6Y%gMFeJn$Pvo5N(gy?z{m=)2 zR)G(F7;zZTp1g!`I3T|GM4p)sm=F7K^B%n3gWY=&+>-C>)AN;|8hu2>FUA+Bv z#xMQScjNP)|2V$<|0$Be z{`Y-43m>t=6B4`}c~!)?;I-FY!aw;ZKY_pUQHjtI^=wCAraKrAM3lNqmHp~8jugmD-o3WC}J2920NfS+~*oEP( zsEm64X&S+aIoAmU%RY`ocsWlm%c>3?K_iwWBM(B~q4PZB;^HWg51SC(bCL6gyyH#^ z@X3wFnJjTavL3F&cqn90p9|WID~h zbSIsjXP#%b)`T#>sx4(42Q15id7dz&LGr_gh-sQEl|WT8Fu~x%LBi-y;|R2BL>@-d z8dOJXqvb{R?b9fPY})&{A32{_TwkAXeJ$k1l8XYi0*XgH?~))}a>c0UXaJa}2?L|g z1sE7D(X5Ku7Xs&Z?L+}1iKg^_v-d8|mR#v|*xIkmJm*%SF3Pd;|;{e9nB-&)-=E@NSU^G+4c zq`n6p-l3t0A;OJQVl7iaYI4Hh4EpHW&4J9&Q?@6_&uU|)pYlYL3|B!QB= zOQrRp@EjobR+{YO1V!bGl)|8OF?qi!*91RfsT);pfT*qhnX)$SphDHiq&7o!H>(6} ziL)hNuBGZaWQ@TJFT8+X{ncN+prr9+`-^YK$HzE6KGuJ~`R1Frefu_U-n@yo-+o(( z27g&e2TyDger(%~$9)1niQ5y4gin8a{pwHut;c;1pNVb%Wb*xyw*T{w{|_7=A2SP+ zi)WP*)XGVZbRS#pNcG-xP|rXfcdUZJNGgc8&Tkk3Pb`cQ0ZJ9$G|P!k(xNaWq@e?b zTG1H>OfrxF8OnP0ESoI>xg=_+#QLT#L1C`8#IJCBpmYN}mfm&N@;w1EcW_ctD4)AX zCa9%JQo07W4O$j^IH!Qs!F{5XSG{4*HtDsWCc35~IE z-f(TH0V^Q{Oyj`v`pn2RR2++ufYV_J%Gj6hj43IYwBOGd#{pN4j#$3kXa|RNj-(#B z8*=3i4(A-!7)jEbWg~^8(&P;bocBBqNLrt|qQM@3z>*_N_&H@=@6LDXi|IWx&xHkC zfiMgT8hOv1!#u#|c~L2A>9me)->|F^o6SV_91t(cs`duTn&YMb3#5 zd+P|Cu2d+JBF{W8oQQa&l=L3Om@te1j^#c9XktAK0f~tX(=EG#3`uC`CE@9( zuVJ^Fu`G*9ET^Rv_||pCb~}-Mg|(XeT5DlBVHPR!3*F`HsaFbtqg3c2>G_;923DBJ zD|ejaig_V$?B4wcIKK82rp-k65<(Or;BOcP7-N~tMDNWIf&wkxO9EN7>)U%)J>YqZ zh(OTut)+Q3>b2I!vM1S4>Y!NH%!RVdwhC4|F{qf<>^2q#Acx>JVNW?@;$oQh1VRdF z0F?@fmO-Y0We0VRfdMQS2yOEgJrk1jCj|0Y0ExlZvzdx)+s&3bXEU+x%Tln}&}TBw4+4I+bE_%=D|3~|(o^S-19^2)v#N9o zTshj(*eFyOMI|rWoHDuomO|2`LOx+Dn$xp$5oqo5y2 z=2GWE%~WI^gxHg_b_-W723WlwDiolKx(IhHB(`8NQZNP1&dw16NtE{EMhZ~lIFht4 z*9$}mL4f{g9Mxu|a)*bzf3#Kr03ZNKL_t*H&aN^Evq3Kga*E7*h(v{+I~MFkawMt*N&2g(}@q&XsZ z>Z;!DX3X=7t5>&bG2mHRw{YP;bN5mbs|Rb~OnaX5exV|7A^G^G-~c9sa3^3YTJ&3E zf~lnHv#t^IG9$)>v$HcCUwaDM%?8eqjg9zkrj%I;0Vug5#*E+{$<;DpY#atG>#D(m zcNP^EDG^aFcv4r9n4{E6P!q59D-%0}#6@a6tIolhtvV_{PkFDk0GNo#Su05(drz@e zW|`nz3S6MV+b|KChU8~GtP2cG7&t#Dtma&RcCi~Gn@N?i6jB;MVI?eMU|b;Ofl9y2 zDeC&z$2gb8IkH*nVH|hb$~y&`FLTX&-Uby0#yD71wP85?9*RrlUEtr-PLLwuFpQ*( zkrEg7>3Ml3#pax`pWB+(lY!_k99x>I_rKqStUC;WtqaJu1IA$HqO}y^<(_!&aCCHp zWnQ%#OyZ#m_V#9Ssk0Uc9$^R&k{yvV1KFB5qa*?;(2DBK8Y8B0P{NSBKSIKie~bLI zwcHVWc1FqsxezHJCAt~&LN*BJ=RjP6`}gVZ>jIpf(mHhS9$6|pxCb0vp?#b~IeiF( zK&l7x9%kMH_wS)BE6m3~0G0*MpRY0i(E!RG{Jad{?8yQB&joN50znTnACe3D{ri0c zghsbNx_?W@c)w2%Fdu%Vw*jDiUVH6%yz%8&C9|OpE=bh_#{q-;LXa9Hpj{e%^oO;0evhH^I z{o&_ilb^}w1#s{0U4N|p7}8~*aq(UaxG2FdmIeZh_kcXQ{d!A)o&X~IiY)@r!0iE_ z1ilZ6DGtDbMtqQaacGnAsCy}P1#*r3_4d{Y=&oPRaJY~xm#}&W+>pzEI`}Mzp7hn8>67FM42t3aU zsc%_V2F6(8n~9exXN+b*V4&H0qjosf82Av_Vu5lZwQpk(t>g-ric$>c1y|Rs=_Rwj3*SokoCOd0Paq z6!j@-FaW^v?kztPpiv00Wal<2(N<*NYX!u{Eajx@+dMCr(2-9C{I6p5WHc|)x<{oP zO3s5i^qtzjY2C>hAhSY|9Mf2o!URwztr7@swHBt`$V_G+Tdxf3sqVC}N>w&=FNz_l zcdVO1>PvfZd7$H@g&f2W0W>{8Es6YX$NOAscgv=yO7DcV-L`hSQMfbPr zcqf%RQg;;9!lncPt*I%w#~S2P;VQ+f$rx2mtW3bLoie0I`Ik~C&-WfFRwmJN_kGSf zo>R^`MxArWtTrdPXW{yasIxiWH4N}|Hp@RE2EdTjqqT;K7^LbZ?@b7-6jFg|rAezI zacu_x98X{|CayQqLzB9Js&_HT!C7fmqoy!t2PVZ+jXK5zYuScS2|)(ndbbdZ0k)B? zr0_}hq-f7a$wNFhvsH* z*}EkCIi+^rxTv2?#t;S#W<^447)DH+E&Z%qw4y-wy|VQM=DzrTxSxEF6bERZ0&CbS zo`YTj>?r}auqdDoIb(p`e$POy(WDpvGvPPbZYPLbJ|!td6Eaa}n8p#gP*LUTl_R=` zoJg;0#L>})0bJ@D&xObg0tC@LCuwvlqBx*Z0$2-?420kz@{Y9v1Ix#qpYJhE1LlPi zc9IihDf!4itg)PwIQ5W}Vu+|?I8Mlbio}4J^$ruu-&rPtG^u$}hoG@3Ag*-J%0m(2 z2(jV;V?B2@SMHRlR8DmcmOn2Z-~gC0PT#TL&sdgK@A+n$NHURu@RG@kRK{1SMcMnC zX+%m{)c|rSI6L2A7zQOM1n;q|D|@XMl9S_3NhuZyfk(Pi;~F8}=<7;JrEzqxhG8II z>vdKCO-ghfD@>5b-t*5ti}Ujx%5Kkzcv6`=@h}&b{bobYw=$4Tet?*KdX0j(>0BO6~=)GT-h?9pWxO(LZ9CtN&@4>fMi%e8Zp)N4SA9b#>)*z;+ zfR~V9B*9+RmFEPOUQIL~c^@#2BaKOZmtt%kz1CVBZ8uof74sbQ_nYme>%OJ2G!6qI zlQ@cR^KdZ-)&!M0L<&Uimd2Zq3=7Tx=H4(+Y6$!3D4D!NOxbu8~M0(%H;&J}JEfz=Gdb0-fc72&s(-6*TvGekVxI z(ZLu}3!wRq)`c+8AkR4?&sn=fmSw@wc1so$OfDF!T(ZAvGCM?pe8zo=d^HtXg=MaYScsFir!GxZuC6D-)iiJI=za zG#5Sh+_TgTl*x8yURJnd^_asrsHg0f{hw=hz5oHXQ|x7o zfvI98V%YDwlOire=$zLDn`zSLxStnTV=+wwE4egshEo*-S=;FO8Dp^7j9LIyqL?8P z5d}o1jeRbVNjzbUL1h2{0E~3$fXF(gk_wQqj>vwzu3gv|i>ep8hcEtK!3nnIGKPqs zjc6sHzN`o3!sq24DY=vj{TE^>Q`yg$2tXkOBF~j3HJe#sB>1LCl}#h>$QN3B$#wAl z0@?`q3ILpIG0@7M%hEa50GEQzhAbIG6-Crx$dA~v1;U`}Nzy$iWF2daT9D9vD;K&+ zL+}c?fa4eK^5u>@TM9Nj-UTdh-UH)EgaYSDr66a(I$&RkK=AMcxOx@X?SQLK0s9%) z9>Fd%5C)Wb3>!RPo<`a2foGow_UEuyuL9ruF7Wg-K#Z_YKaG0&5cTR)2*=_>+Jo2! z51#J)!OsuL0rIm)`Of2D-$Ni?fYF|q&;!st_#($F-RI50=libnUdF!S#*IG$0Nl87 zjJMwUiXQQw{j-;G_wFg)fBy`3?%c=8Ny4>j9&f$%*L9z7ed~v~d-ov#;MG_E0C(^H zUA+GKmvHy)L%jX=|HFF?Xuz(3(1-W8m)l3Tzg%a3|KxK5unTzIgY)&^81i%99j6DM z1+ea|5)RL=|E%mI3Jky}i5+sz{rB~R5m9pJ$BpkkKjI>g-k(qZy!(4{2-4Ss{dzJ$ zPhvR)?=L$paFLuKe=q#^o@CGi|Nmb|269Y!R&w5#kqk=r89CpcEYgl|%z|g1EqML) zzl&F2{STD*OaPbUSK!z(XTcAK>$0L)OEn{_}pg?P?l0Hkt5QuO_dF+D1YuPl88Y^0Fkzyic zu~LzdHRd#yEDj7m4~dB={&Acet{~ebQuOn_#TSwX2v9D$Wi8Utof=385HZ0yil^1i zO~|PZ=jS_k=Wzf22{zkJN4l*F@Ck@1>R_t8wyvlZ2$}M0%3E0-tXRFi%nEfqIGZxn z7z*1kj)T}aQLal}=wh89@fcatElX5Me3+u~g5gF9xleKry!WuRKW))>;`?7p63QY6f!cCjV-@Rw$=1X<(!G;Nr^?J?$h53ve_bK26;DEt~DA1 zs?QjUv-6$WXaP+nBk(*%b06ip^6nDBisHz?xdD;FD--#f^@PauqxLmMwu#A!Ra30q zKe6f*I}ueUD-~om8Fm$XID}DN>Jjuz%hs%cV`#| zV)@VWUJLFL%wnNpD+~}U$+k%m6SX2{lIHe)K#T;QP)DeT_`!?4fmOyX$-P}l00>k?!qpqk|KXj6+R65 z^V0dG_e6t7b@lbKZavYU-&dcf08$;`M4e^rc>+*Ldnu+%fHGnQo^#X+SMSk)pVWg)6CCI#-8}yiPZ3R zI}zc4i|W$JuB>NHL=_A$0t%2^pZH}11Q@StWN^g7fDEG(04 z3<%S#$Sk2|jltQx!t;0p7azuPz;3r^5`$GaM0xgOG0$?F{1 zQ<8x4X&R}B#w40`T^T^GEF)T2PT4^$O^PiLpLy{a1Q(G8&z%m|qBx6nP2^8!8=ITh z=rkC-YhBacd-fn*Fb)HbjtKk}@4H$no_U(2%l7laeyN#(6R!YqO3gBZfRhR{4(Mg* zh4>=LW0j&(7(c;LdyjW=hF` zwfam&#??E|K82Kw2j_`+VGW$?=Kv}N61ZBKoW#VLTu|8Gm%iI#S;a>-k*Bw{Kq-is zKUwc^T^Ba%nt&IB1pH0sg3VrxMN4o^RQtVM#v^4$P14guZ`;3gbW_z>Wc z3%brbCXG3Wq`%0@lYc#TDy0nZUKNi?XQ)#p#t37r`ZXFDn9Zn#9B&=2UOl4Z9t?Ld zz$SJhF(oW(L~#z|L}R}dffANAv23EzZr+AP(!9GaE2JA)?wNF+jMIoxE5<==ekw#I zqtpTmtKCGR++qy0b2;ath0b9J+HpK>CiV`df=-MC%)^jmsB~A=Qn8k(&rakSYsoM) z93Zl~QaA+wFfl8oww_Y`rKn|*5Vb0ZgcI4`!+VEyEjZupX#hZgw!I4&@+aC3!~el47~4Dk;X8>RU5ezF5z}>isx~%wEqIP2dEK9_|fJ@-@kYcEUTBuMMW72iYJ5O^I$1J_22`T|j zRVE|8f2Oijun;e68|Nh_=t#v4KemG!f5!CX|msEdpMQRf`TuB#GsDg=m12sWtN26)|T z_Z%=Bg9ylEts(LZuSL@3M#L{JTw1Y1qc}joJi|m4n-g$yLi-9qYh8(GFwcNFr$5&f zSZ3e{KLB>;z`COB&gndNI}}2oNcA8_K!BLt8SJ{CK0HC)ox_};!NwKtTsp>kz`Ium zkgW%7&B4$5F7HDSyWi@;zK0}%{+RMz0;nFU8vqwc3H`o6>)P+HLqKABSMJ<-h;M%L z9>ONEGP-{>#omh=~HS_vg}&7dd7>KIIx^Kl!|zuN+f|0hf^s z`s2#E_Memedh)>`c|k}9z{O|zD3U=xo&(xgZ@@ooheQRj%8~Dv?+YL$i1s<>X8iom zPq=mKKgA0#Jc}z=Hnb*lr>wIB#(~x|V=YW!buQc1dhaZ$B2|NwNIHB71B{WJgkq{6 z{O~?%HF)m1&!H9|=EzEmlzWt#2y6$8Ha(amzLP(VQqNZTdkpx6u!|XlXJ$=c1tyr zS})|AAq0*mTSs;UsV@WueNibs6_Ak>4d{JQVk|g^1QB5at3d!&$>AxHSdI4q zTK8|xnLCReinXfBFmy3#N(9au&fUZ=ESG|5GqLpq4N>PE#nL$=7U~q1YnOOZ;`1%9 z_nzx7mSc7TfQ?!KN`7Ow?n3d7h3VI0j(I95&XGJhCL(N<+&87LJ%p$@s3HV3mlr(T z8jIb$Ln#?ouUyfXwbY_{PpxDHAs{a0+-yt61ObUnEt46nrIX;9K(8yZ;-l8NV2OAGqpEI1zNZ{0gn_L;NL5Y9_mocq6$Z zq|ykSTsH$XB3ULOfQc^#2GvwmSrm0SsS(ATXf@7>mGGn{N$*U~Y!Bfas;vsd8yHk3 zYUW(ER#Z5*3xP=ROOB|8>M4u^kqJ_7-O2RE%m znX9POS!USxuhznH^rM!Z`VP9w$ORWV@pzxsWhez-fD(G%2UJv#g#kMTH{lIZ<|Ki^ zce<|x9z`y2^rQeO5X{R$;3^1ALzf77mRZ(7xK{Py-fSiXB1uBs!*iE}bj8VaP2-63 z^F79~v4RPlp@e3?-!mh)kq@L8W4J&99tT1&aC(nO);<=J$adq%#hRi;b;}HR=PdU7 z88Fn*-gg?NOobxypl{ECI$(@Sc(0kdeG?~>J*zpU#M0_q%y4ub%bYZ6NioB-)OY{f zJtz9&|Ckf>os@m1X;ctm90rwjmtvMEL<}Kd&I`7i4axm6DW~^ZK0Q6h;63J*ox8MfMv5U@G4S%U~!Pz+&jRtugVq=Pn25sJF^^m8KIJa$`g?l}H?s zi=;$;8Wpe=$wZZPsU2SelRd8!+Oi!r@bd)1L#u9h&Ae5C*3l_ zim%*lBjgzwf25p1@0w@eSHLEPWjJZCj^zXm_+BzWAQ$y;lr_K)B)cx}xD*xunJc7A zyDAw$3WNJKBDlc&6&(}EfXL+=V-W(40T?Rs#8ff(0oD@`kYd95`R+m?l1K{{Avm?@ zxj46y6znn+;YmDP1yHmw*zNY*NnxZD5<&RbO82Zjg(Qfwoo6e+|SmDr_jDU03tjtZqg{7ac6$b~F`=ebG+NFlGq zlmS+k5kQ>A4v_RIf@vCHt-G-9Hd_Xb?)3K;iJ)vF#Oss9PR>~@5QmvlmD=B3HbhXN<#u;)-_NrIfKIA~FO&Q5UFyAsp*Sj5tlBlB572%6yc? zCV>bAMX!gtg$YP9z%&twV7n!|gmEM$6DzaWxS~uGaDE0{xdNP>(x1C?*r%=n%Zz$- z1@^%`l(2=dGphGQZCUof)oU=Pr!dFIDEIFJPk#<4srQo?2<#B#ew63?;qy8KedXAP zfb+%i)IZnu{T0pL;Ia;H*}qp$=)eCE4417xro-L4XL_vP{LMcGVDQ>&&*Jshzkt_X zdkz3_{rdj~0JwYiZ{Wojw|M>apZdg^U%Te<(o0A9<~P3wpy2M^(}Q#BJNFN}_z%ej zJrFGfke)1Ycul=kf$Ss4mU|#zbpL06%*(6|E>jPXeSwRFh5j>rw|#%j;A8ZJ2$A*| zbsxDmk5V1zNg99N&*bxRj+ZGJ^xLCI20h6_elPb`?!jdwgQnti`FHfBm&+6w`ty+e z`mI+>=*cv(+c&}5gzML@;UE9wzm1>$*)OUhm;n?x)!eES)SNZ{kq+G$DPOXp++-|w zo)dx6iZ6Gm*laeitZpZs@s8tn0|KTgrf65Y-;;&dFb=$qTU~p_o={>q0dAdjsH`|A zwh0vkN{P}OEvTf1L~%h<&|EryNdlf8f(8!#Cs^OGU$*v6C8Eu*sf&go!6wVPW6H=Y7V=z?#bASk;A}yaw zvz#l12*2<>=fc_a;Rj$)yRPqx@vQpXt~zs5PTHdbVO0wAoH1XU?E9 z^qR~kx|3t3Jkzp`61dJJ`H*zWlazi@0)x~bgedLVlAtj8R_r6C7GyX-Fu}lpm7`2m z(t7YgRr-uIFx9d00L2NCAItH`3QsINjmB^i8;IAul&K_cj4?tK8YQ+7tJA_DDF6oT zDb5jS?VZAm_x27nIM(Rfx($BsQ8;i}0r(Lsprd z>y!qy8kVdFe=n(Oh;o6kG>(lIwFb&J`fKiq#dHsx*58DD4m1KTYK7(IgEn?q1*)rC zNz;zw`eMmUUg6K|=NZP>3pFAod>UxJD}(|=gHLm8$8#Rp6jTInRh1#73^=1?f?6sH zzoTN|Lh5qRrVwcaa4Pj*Skj+Jy0unVP`AEuYzJp5=XXSk5fuo-b`J9XTVoI$D_z#A zp#3tAra;yJ03ZNKL_t(9T0e9AnNo}9XsA#%08#alT&UKn%9(QSnw4mwcZwA$`ZdN` zQb`oD0lhZ`m8~vHrn*-Jou??Gh>|Y&=UGLEDnzZLCv#P}R7O23h+&Nay}tx} zv||PCcC7q;q3fKeH8aRySi;PyzdCi{%QN7=8#IvDS}fi8sg;T(n+!jR(6qxv1It4cKvfjTDSz7NB|?D;*9bFT#j0#;}&iM*b8F^+!J zA_G0+qQ#nN9N71cz*&)c3nE1yi2W{B5KH8uJ2;60XQ(JrH= zFd}m^sRLLcN0bJt>pRb5pNcn0e_yz0R{_`%l%ynE;cM}Rzyv8cl~UV#!slrW0q#-^ zA=%UhyrnE2ue3J!KnZ!V(%EB_C^HNJ`+3%NMXWT&PC=#AW`!c(S*vtrad%WEX=MS1 z={&L$rGykvOJTAEz1JgKju>MAOWiBdHKcy2rb(`^>#FnS%=QY2rSxTQ^){n& znT`u&fk|8dFpTVN>1Yi#eD2~gI}QQM8tL7yO~z9@Ok|GkNM&bd=djKx;4Sll_a5sS zsgv4t>J2;}lTtzRahHu$l&I?{ri9Hj>DV+(c9HQYN)2hrTri|nOvf9)8#GsVQV@Zq zbvMvGvBqKu9%&qqV#2a4orI}jKW2w%GpbU70LVEP%*%@HII#yR6_S>fNC6>uz0UwE z9mLG!1ataCBhAleXyGATb67SO!Y`Le=76$qAOpn{-8XJkPG~!oX7N8a)6zunO zq5D0N4o**jaYT7|N*6!R^!s@R9y|a_LHYg#7_JAOZ-DiC@7=@6NyLjUPPlpV1-$$2_wm68GhTXW(!KBA{ad(m=RRJ1 zaSH%AIZ1f!wLb&^Rx0>8{F8t36@2i)4!3XrYyMP5yOzUyBfmRTZ;Sco-#3E>db{q={+^lcyDTo=%f9$7*VC&a$hpchxy+8CCyu0UKlxegjwd7m z>C`_Q8~wQHbHU5VD3_584##?bKje7w_kJv0MhH1PuKf8Zq7EK$Ex<+cg**6}5IK4> zNUvnkf3Cp$h+q4)7xAC}qyGqB`1~^jSaG+!l42{_`;FtEs*APIS_oDSh^#(XYk{*K znTfVT@NnKE37~EaHk*yckeU72#g@q!$}@nL>y})wtSf4*IAZV;Fl?vL2=t_eR}?rT zdG4Y>pMbBDJJd>Y=`x>twtIpxN_I|}z*uh_s&RS^krmnivSK4}o9^!#BPPx9D}wVa z_u=kXS1Gq@Bv`s$7-)`Ti9rDX9P>8iEFWA0C;6NK0`W?Ls=MV(mH?771Gr#AR#7>x zmUo%*t(ZvdY&PD>#;{GzORy z;z3}xlDDnFG_`Jjpw+*G;MvL{kDkgImRsjJj z(%OhKlFJ&7$!o1hS>_$CUqI?PnU(iOOia2KKsctPq-7a{6-Iw%z~g~!&6fEb<2dTf zvY95We_4sys*vaDxk#Nx&sp+49>b07(m?%MX}oyv^!dpB4~A_GIF2o%3}8jIRfszl z#x&at`7XyfdW;E!9hls_knLmeC{lYxg)sEfx_>xmHmtcKaCs{k*0O zDa}g0B}$b>$8&2ESTu(x^0K@yr4oQ{N~=#=OSJ>J{zfvV*m}d{Rvmt|%^k)XwY#HV z)4aMyB3x?@UJBd$ft5MY6gg2@S+vzUWWK3|Z3h5tnz3S6XQe($4GFareZG`)mJ7AL zQZfd%0haf^)XHi*jgTZ`SO{B&!vm@5k%eNbhbVDch!LDCh7j-%|KV5hFaPELjPHEs z+jz45XxmFKy@Z!udInt}LZUT>~j<@*+uZVo;Pw1|lb& zAQEEIi6xu()mrNb*bf5$0vSXmnk(Zl#$Z`y*yu2f6UK2uDH%B>q(r{$IVV*(h%sWb z30!bs$>CD4+npoDh+!PDt_#L-0xGcI?Er|xxMgW`0!##C0dOIyknNGbtNmZPB#1%g zS}KYZ<||7RGI&NEZlmN%8UTwluX>~bOqOWOUH!SS$h8%kBzYBpSiq=pBzp|X5h(c; z8StL*opUCT8&$zefRmdLFwZl~fHT1%C)Ct~QyGn{Q8g(lJdQGh))t0{1kRIeTgq^z z`EZsJ8Ne&bTo+ck;RM%EroqXi(ZoysBX7b<8Qub#_Q0tU4;*tSxoMfk#2xm z;6Ys#>#`yxlC-4mbZECrX8$-a@JdX3@q}d1mb)4RfRF;(%yRHrfZ#zkPU0&LkVm1z zx<>9WknVB?Mtbzc+h(8iMLzyv(#TTnGUq6Zuvl|ei% z1!_2i;6=b8)_j!ezrSjOi36Ls@A~{mwsO>UI{ua4qV+;c6XGd&AeD?OT4146YC)4< zfu4qDhGDrU)KYe`PJV*+nAd*y6fK+n^^tB^iI^0gpto| zZ9uq$1r7Dpl}N+9SPQobWSPWE5E*g7397*tjc8o-*T&tGHMSU@FI6ftD@7%!L@k{Z z5#fx*EhyzmW=Zy&XbyuhbbVBGCa2)pWtp%u=#Ww%9uw)s3jFk8at+U1&Pt)o)h^2j zH2Qan5TqRq6vI*MHUt5lYznefON!#UYfu|WS0f#)hOE@moHI*}bgL7JP(SV>Pq?LR1f*i+ZzX!ZJm zZ6=Fw0(;Uq9dkmL^6!Td3AgB%T$YfOC{#7pi+)o=`1W!+ZcDN%=sg{WnGu22v+meS z{Hc95_p-|xBYkbc;A;vV(GGjHrECAfT|9)>M zhM*jGYB!aI{vpZR1Fuy+)Qdz2`WVHgtYm{8es##4v*xPFUg32<9YAuSxrFuJ%8_&6tj4_C1N#U}GnfQ5Y~XwRx3kw7|Wh zf4sGH4*_z_1K)nc*{gGj0zlf0R^n8aIAx)6!a$dvh?RrK+^wuJ26w^Yiz*iY4hJv&Zb3 z%VbOfV5_+FmwD1-VQmE<=DEkamQWTscLdi03mI^x5To8~69IDnGu7||sg z(4v6rwle5fvhZ&VkRU%Sm60I~3rNVP8)xe>i9Zt9x7Rwbs2)d3#fh9zm0& zlG#!-M~dYHb5A&73Fl>RGHL`{-cbHKnKP7}50CKGPs zY9a6Ntqr!5F6(?9Gj*(V%@G-!Qh!|&Mr}4?v=2LaF1I4kGH$OpNwoAB_S$xK)>|pb zuG(ltn54V*R?Yq6tU3y**}Oh!kVDINplox1axI^1wHbvpvflUKAaHm4^>_^YTLc=!y@vykRdaH4zl*g+rWfv z46`~-QVsl^&sCo4BFj>fC6!h3awveMUsT+kn_88DS&uNqZwjS^_0;-_HM;Gd!5Wd) zjzEo1CH&^=bN2z+QRlT0=4ewXW$OwPKU=NjXyuPzaK>)CsizR__^tZty^Nb`)ptc) z*)_)r4__OYYR{{#gzeaCjEue=BUh^%`3I@9F+r(7EGU~bgx+SG!zFr1Ay_`{ZfPbUmrGou6iF`ArBYh?tO_H zDurgo673h6L6FVW{~^5FrtPNxEQTCR5=v+T$MVjk8}mMjv;4eJoyjQRiHSDY_9g3 z$D)oAfr2gs7>TpE)bm*kF7KX^KGn^bd(OYsZ8T_yx-9(ll5DzX)y#*4QKd^Xl8Y)F zCPCy`Ge+;2IJ><4ON-G$N3Z)Uc|1~AvZ+p;mi-)rzi)j8nCVGWzNx$mPQ0P%JrGVz(U`T1w_g^ z4rLr`UhyRNirmsMI9m4&c`vD}J1+gJZuA4&%_&4ZmNfw8Joqa;sV^8HXGNDmI7ls09L*nJtIKGAMtDM!R-y)sxMSIkfTKmDNDK z7<83YLDLPG7(3-IZ2=9gUkYIjgG);4g35Iias(FTc6RF5;q+7rR=k!iGEQ7Dh4Um8 za3HU7=^|b9RgBSIzspMp8UEn7b0WBEfzl+ESWXF)*(#Fp@$$U0G7+F08UkM&w~vos zq%XtVvKtUzCjTS?%>$i{@zyd8wos1Jr5uMEKCkeK`S}7IFnyp3I9{5>S@1Z4S4o-D zNU}JTl2sq@lHip4_0c@;k`tlcAU6j<;DJa^lpf;6%*Qv-+iKM)P-LsGBQ8-gH?)Bn ze&j7(EA_8)2$;-YX9SOdia*)?t9I1o6ZwaF%UMJ7TSv(e*GF%4HARr1W!x7*`EeC? z_#MBKBnyp3rCvDSAf__A8*og*MZtXp-|wtssl>+_7Tf;9CN|b!tm(aa6lMnYAbrHl zhygnBLfD~6pC1vI@_U!B{3%%F>Gjx-e<7neqs?hG*luZ0R0tFdOjTQSm1@R=xZOLy zwywtIs`hwe?3Q4|`j+2zF7gY%^>|_+=EquXgSquG(|4X_wjbStcvh$X z{)Di~&?PXZRHDcaCLtpWS^sSchY>Kk_L|)f=otRtfKwdMvU$-|i&iIc5S0SmXeSwi zl6*mAx6NKVV%an%GsQhCeG`Khcd}pP2(Y(U?%nu;q${}OPp2(I>O^pWZxY8s8k7S117w6`%A)fEeC50q zjK(IO8%eUwMQT{)x<*->+aE?GgiQU2qSl!6J6^jA9W^=BP;P!AFmca ziiuM9TglHWs-hyU4DCR&Cg6781YA84j{JA&9V4y+NUeeDDwl9=&M{ION4%oZXpj|v9Ocd01NH2PZUt{nt0!RLN{bmDF7v#Y7i+JF8 z&wl@-#98oa7{qhSd-oNy?{6KRQ8#q?#&z9iv4NU~oza_{_n|LH1JDVL&p~|fC@SLI zK^T?^bfm3%FcxnK7(k-@f%GW(mUeY@6?^dp#{umxouO{`3cVNyD`Ub3J+5xxvH1b| zBqWe%DDF>ueJ)>ZNs|I^09HPb)b0Hix}z8r|}) zb4=rLLM{vF7I%lk3+&u)cwha!d@wSP8k-=-4SDnL;=hU)LPQ_Y9f_bY3DV1I#~WV2 z-rw&r^oy%=M0~H&(6-owf-SX+Jb&Pjj%IG-t z02n;wTM!Kz^|*X?`E=ISWWdRd?=*NVtS;%x7t&rz!#EP=h79!@-kH#tlIR4L7~1&8 z<1N<=p$0%+DYCl_)k%dG{VSTB>&zB%pk9(%4(l{*M-cay=^BzE2IjBesxh_KNUfrY zw+2Q#G@(rr#S9#-S_&wtr#ilRb=)$yCz~m@2Ge zaqN1AWz2Q(N?+34&u94BzMDF*8XXv}5azahFXvxF-ZyqvpL;Gz5(md*;nCo6tXhxq za7LXeD9gk8SXH*!3LTHO6)Q|{_P;~9_g15#NTMlUMXUDq>zh0f#25NG>I ze0dvF%6ksXuU}?spZ2k?EG6cm9M8u>EO{_I`=F_hItEPnQ5+yK8*Hub>h7+vlD8wd z#00yUqfmQE78r!gx1tt8%}0Q*?!$$6J^Nu(J_8oJ+n72!%&|fy?zod$U^HesjBg#F^7Udk#MmtRJPAPxn`4X*)2+alZPQbE6OSAQnM3G4W90tpsJ!O zQ?+F`^9ds4k;KssjXi7U`v_j8ZL`{U`)T2~As5g8JI{c1U83hk2_QgYyuH66dkeS>MZYQ(k{~;u=kGtbxNLbJzXv6-0pCMQMi63?Y@St&t&sN22 zG&?6&Q^DK%f90Yn=*DDdMzZiAGq|_7?IQZWj0BSSPH=mB4b4zYJ1=5Q{cz^Q6@&6= z`03?)CKAy00ZBvsjGQ|Px2-FG-@M=zqDph&)tZxE$eY~izJV6H5O8HN#t}?ip&~C6S&8)m>CMCL@614z~IJZjwgaWnzESWBeJj5R6M{{ zZq%%B%)`SCX zX(x1BWJdH1n3G&n(h{uXGhQi;PpW;qYr#WleW=yj9t5=IBrGdM4@FMm@!0TqZ)&6* zH`Z^(>+>)^=v;l8lnEuSz|nrW5|$4Fci{?bd{j4FjjiyW@lVXMaT3Ut{k1o;VxUN# zvOw;P&K!5$^a4!6!!f8N?J_e)Novek!iJZF15lDBB(xu=ibVU8x zvKdq}TxB@T@N$La@*>7%cADW438+`_X-94vIUUvb=pUO(BtDG?Gd9Qm{MX&4Lm+S} z@la!xv?ly#<>)_qWuPR?2d zI4(I@p>djjvtkdEJYWO!F?Qu8T1!U@mA4$-w39cIfW5~9dAtr=jlEzwp5>|be7|xrR2FXL_nkDd)2tDB8*h65Ygi;oG8da z<&FgO{}nS63x;HfjIILJ@fx?4tVkQP%|HsM8Iplu)I%vNY+?gyP@5Mz=mM<8(I?mB zms2UNhfJwe`_0P}D7qqtFk`JRU$D~tOKy_56F=?%oHhZcAM=fXVC?7jZ*D)eD71F+ z#nSQc@(s9UK@PVv6rT(XBcZ_>+Fbe}xx$&!em`R^_pSf+y3ehW$`XH=R<+4-XEY=rfGG8n`Zo)ipGlU$ z)@p{@*NCQ5fAM(PfVJmt?aF&X|M1q@x!g@06Hez6gcV}Jt1gw)iC<1|tLcC$Ly$2T z55I)2S;fTMH{Jdvzng%`Ua}2=gKO;*oU&z@2AaE(*(=~1FPQ<|y;^M#)~!bLcJjHo znwMzoFM>8@{lIaFCNEHb?c%@Je?dT}4m_gU=K4AqNdqO2QaplW~mo*6OU{a!Jtrl?-4PoD?JO61rmPV*Oml1zUk_ZHq@(n z)5a}r$uQ$?Vf?aw9baK`XXGAOcWPiWSvYarKfe2_J|NA)Vo|0v4?YV)M?Y8q4ZbLx zHK&lTSn35qBu}SvVB12tK1Ec-r~UDP<(h%W8&i%{J(dcdk3%D6nK4N zduX)3)p_0o*E$&C?t>|U>c2pyf_n2oSay#qD6gICVSxy7V(=LdkBi{dfql{s_4~&& zC(yq0>OCGKBhFPHByg+q4genh(C>@2+F&{g?E`gR1tCFic5qvLuPspMH1_Fr_Z{o6 z2lTt-eAEm3GFEULMf<_VZp# zZ_41l8)U9z^NNQ)>`fF>_nw`^`D-w!Hzfoc4pW=%@MU4J3DX&u!i!uCrihVZ=`!o} zYNUR@QS_;@ev(2d+44RHvmN3e(uM;4bHl;UrY3RAZvV#uyo$a2$SfGPp$&)W+eN%y zDaNPP@->05wWEVv1X2yyldDt1xFhg&lr&pX{%Tn8$3WI`V{qx6K9G*2@gwfI2q>80 z8_I(J5Emp`*X_@mt0zpNIz8^@$F9-ywN+_lz05rqt!>vS$zXH!Hdd3)Y%3@9rp2)8 zCIG-}fbGBgktK4VH4T|GNK5p@X?1szR~u+(MbpqfE1yOj!5K6?qG) zd6sD6uo>3Mo+~&wyAU)PDNBRP0*~^ZEYnrsrrug}*WTLE%nEUQOKBBowgz@hudCdi zL|(E+hrX3mI-Vl^4Ay{lQZ014xlriQdN0TF2K8DDcFcU~M4u=AN&^)=>=pitNLwtv zT3QrNJHHZ;#9!tK3*B?!E=Bkox7D+*B!nbuRsdAnw}zU2vZ%q*e}#Xh&nS?A{)ePQ zAnUeIj;vzJW(>BTDXAfYY?fMbiIiktr`)~9vSj(*hcg9o@>Wa1dUwzU(|-l3 zn^wK3tiabH0qeyuYD?7xIT(-7{dN}6Wmpn)cA2Zu=zXd_y7sF72`dGvt+(sCqrz!c z)zgOq>5pJ@I8k|Jqo{B5!qLnBejx9t6Nj7ivi@Pf7(;7!5PE`>&8p0Au!~!!F%Iu% z34?^hqE1>@5dZ~9f{HD!iMDq9ufzb*reJVIlH*ign%D|CUJcXdgh>P72rw+G4y(ZT=4=>Dv4Y z)x-P;l34xd-+bVexWg?7e)Gk+muc1o&IvKH8%#6o^?>bhMNv)>K>9nq6>-g>2%4sDTYY`cC^SC5KagNm^ml`$wA7kk5w6)z zoE5^z`{?d(hNXBS7gI31EU?FKU7FV_I1e0{FAaU$0jN91!*)lYQQ^VKH7_fiU<;jA zNXgOwdIeBA{wth@j=S`akDxzRqY#8lFU1$)({YpysHW+~z6;Bf>ZY{U!_%-$$G8F2 z(DBcCR|Z-NeHBo|eICSG0Yq2541-E)`^Cvmf}|?2r$NAN#&UQxVosXEae0m~q8)!S za*V8#kFnC2plkRg2E-U>CPE`;=>sS9N!trsBf@hbLkc&s4A+%vdlZ08%*Ao;%?|ns ze!6S6n30ha65eQJBZq0z$V$R={_PHfKJDUnkpev*?TF+R)7=;VTdOH(j;g_ani#)m4?G8UsfcKE$}69Q8nmTEaNpQMobh()6hfJK~$qP z*rGgP>)qQFqs>dz9R{vEk#gvC{CbU>7j0|ID1I@-vp?5p_vAfkzvb^~1Sq1AgAEBv zFT2H77M94v(Pd?lS7zAe_>f&kn=|g32mBLTT0Ghv?GfazLjP%nN-8nCqwYCoz0k98 zA}s0m)+dX!=GD_vt7V4a+q*Ml52oSiaO40j&7V8 z^Dyrcipn9^BBjy>%wjXo3G5Ls9EnJqLikP3-oxRWCUqB?WFxQ`Zmkb>B?v4=y(%4& zU6Hx}*cz3+J7}(D0uUuTi`dLYErg6aW-$TT&_a$mIxfxNYW5zwWZQU>g}&nJaBR>B zDni-RKQgq<00M3?qV@2o48_Q*i|u;>E+N?%7d};TXQcBl{+DswL|T&WWidZ_8nAD( z6CJhweIL$?oFN7^=!LvC3ptT>gS0DMCDCp2I&)~H&$@8Ym!l#(&COtX$(jiB)Q4l z4Hla<{1~QJJnPwkHwKlBX*ER&zsly{MNGiKU8GI-JXj|o#EyI)1pa5a;fj=O9&x-| z19Ncb;el=B1_%79ychmJYs)TjlY3Lzdv9WUohM*_-l^7*8R96`#%whxmcpuQM!5x7 z@J2TE*pCER;!nE@BzovP2?@RnhBNhniDLb+Tmyo-z2>g>RZ8Cxt}jEhe>Y0dq2Gf# zd`C{K&rsmp^ZFcn8PV?x#m;vGkP7<+DK>A8@-!c>Jg=X>%yzi+{s+7wnnE`E2RAUqjaCx@d3PyFdPHH4%F7QH2AjsNi1i zh@H(oUz0!}KfO;LA9ci6Ye*(++=Q^%9ROnTB@$n-S|6=qrFn+;eJMiU#Hv6+-adV= ze1<0b~i&CSum0k(pO0)1d zQW7S6j6X(A&4(RcY`j;sDK~18R1aK@3R#-X1a;jy*45Ut31>rYioJ~wc+s(7|0*}1 z`q+srv|(_X$AF;gtQGdh=cER0wt0XnV<1u*_xA>f0TT?zm|QrbbB-C;2lW7wH5U!7 zh&(q`VN@>XYV#WTFbgKe)xT2$u!RTc9|yXr;bZzg&S05kKbB`P8INR4-nxsaXkq&u z@os9Jj_hb8B)eZidu@N?ehhRcN!jT)IJIS6FKOydO2KVKT#*ZW8Mcy8UyCCv{A^}q zIGkAT#J_qB{)!*;ecz1aQx_7K!yO|Fbiaz8YX0f{&D0I1S?@=cVunvQyWo(CMgAHd z!XqiZDD?5LY)fZ@R16k9dGM9@tPFB3*<*4S13r~DZrB}HWi61oIzU$BW?%R>wl7zBlTn zf9xbLEJlGAOQ~%PuQ`^x2+~03yL-OKv>!gQuaY(1F!J^8PYl0=uE;31(fl{uzhox{Z)3+s{nsEX!XjaC<0%S<*WCezXrslwD_Ky=gZ8r0P<>lz<$ z_Pa7-`32@ImHr4-63p_El2Fgk`{^#LJic{xO!xxQoH;PoI9w2T~?g5O`3+HOqFwk`Xo%ZZa_cgo}@WTq8%MfNP?zteE8PV%(RKrH83RKVRY4 zskfDJ1pwUmWYT3{8sAw|1jZ0bNA;qy)5JD(KY9kMV;*|Ve0(>5etS6ka-qO;>Yy75 zbDYL2T9~^-i&(YAWrwt5lfyJ&J&JtRIo+f&Uh26?V#%dUD`iiPM^8|i!-Wnfg-pk3 zCr22MqjfRwx&n3Va-mNMd2P=wC2MrMg#R$ps+u{d*V(h{F5`e(Jsd*0<7(WhO5*jc zK>JSEQ=wv@Le|Smw$#EWzIq{>q4ue6DP$l#yl;Yj`+^3A4FQE5k`s<+xT){`?VdTe zjS%MWE3|Ngj|z>16Rl02eFgZ#CmsmsvWc`f#CVtymBx~!z;f?3rGaH0_1w%iGCOeU zoIt@rt=MQSE@dmX6kdWbSntpNSB;x9YfiEXE6&y_Fy7^*aiP_>cQQO?qzMWm*f$ZIb(hn1)ZfJ#MBXtd<|NT0G)0igyE9y~unX#1ED7zTIiDQV zO{LK?{+Q|_tejYXdxW8TW}Gt?HMNWbA~hvW0>W6AlAGpxc}pu@JzLA*Tk*B^k{(r4 zjA_}vz)`TCD;lu$*fNjSH!@!}g6nwt6lNRIUjQ;(p|r4Z+>z;wr|bFog$K}S#<)b! zS6>s?iw$k34nqKe?a2wS6QrX#IPizDcu8HYsZjoP!2j|Tv!K_FJ@l^8vIRA{_!kLn zviD&CnU@<72;~yozO-w)>czOQlsObNH*T;y%AtP9to2}5>ud>}&#WUL%gL+7*Dbw^ zIIhrHOYvsp?qv2D%+zvQBTaoBv7ACK&@%V}5%Y2?3+IrrZw+9o)w?p%|&p$dJ z#X3kN7l}B$)4S%xAho?KMjo^LC%^;9*oS}JNUYD!XG!pqP798<0(KWFXqQ8-BecP3qW8 za$qIl@%o0(d1g`Nj>b9s*t%+s+fJ^6wOJ>JWm29h2F%gEVay+wQ1hJIKV`?1;X55i zZ?d^_^ijgPPOA4EfYbS!z$T67zPL)oGDwPcwo5BLPKa=}{0)`byU~0zQT9Ai-@r%p zu<(NqU^9qM7>mWlXO5=zg7pHXR}<-Sg2ZG1s5uQZ7<-(RA;|n~+2m6jVI2&`LG9H) zHN4e+=6}X3W%S&i3v3%=H+i!w-|$5NEU=~$Oazk}-TD|%nzA^gq(KBylpi2~*Z5o0_~|2KKm zTUFsdF;6v;ry-)9L5a8Vt9_#2o9^p7iFfXoTh8Ey_lvgG%l%l>7e1&ykL>YE_3c^W z<*Vr!qeLfE*!9L0bVKyc4ux&P8h%>$xvc7fn@0g$9JYWf=59WF z#(AVa3J0o)FB(4z<)eXgqXb{YA!nXHvgLdBHv4;jwG_Tmyg*^euTLY4ecMw;2#>Gy zQIM?Z=Aw-^*+v%9ZwcWuCIyPl-=H?BO5~zyudW8QAB z6f`*WQL?CIw8<;mYJSSOV{;HUDlWr8nK?U+lX_eorJv=SA8PE$tJ>e zFib+0IgFgrW!YmG*31g-je07K=Yue>K-e63#(q}89nr`n<&?rbUcl~WDdebPZqk1@ zun22;cFDLoA=_ZsyNwU2soy==D?5czdIhx2X(SWc)~ddMepTCi*!1Kr1g^YKH&ZF2 z5G{6YsKv|Ru#?Wu|7To>Jeo??08{957(?R#+>?0fL+U8sjG^v&q&7xYR3m$~4~3u4 z-y_9!)5EJlVv_)BMD0+%+(LP7$&nDhnHNmt)^vl>os@8a-1X_dFasAsS9hv1^D=>2 zb&vH2iv2%R;ldvXFo5yDl@~qJ?(r;uQ#&Zf%wEfqv6%$1B2_G8mTc{~1lmA39jOFM zMQfBX0|jOka0N+b(hGpL8S!5hs76U^0f=}I{AW?G82y#uF0*rpAohbSZKQ5XXEXiw z2sAI&xg3e&Q|hAmow;gP=MyJKYBSay4-?JTdGG!iB&{@ftfQMgBXscZ-%8*YZQ-KC zYHqF*msZ3HGsklHrbl0WLV9vyebF)XWi)VGN9}03a<-mUb+vyyH;eISK9wAc@Wuc% zzwBh2Cd#pbF_|U}Af?9Nfvl9wPW7^6$(wlb>h+zNV?+Inf!oA!Yjk2(#B~1WJ`xz? zKwUEWHLmAUlH_-$@Z5o+onT{0_o^*L@rZa}Oy&!ga+rjCW+bc_4z%FaGpqetz zsUp^z|NBkF zHB;|-ZTsw#tOZdP5x>cv>%W@}zQO9dtFzrs>PH?&3mxn@efn{->x(h)`q}4K>;Wl7 z=I8g77MG#IxnbD4vNVpc!dPCvkAB$fL@N%L=vGKnR0bc`fWwYw&6W-ym_g+ONjADW zJD18+{b8vvv|7>!P6#|iR|wRn|v#a5jpKaaPTe}z~~eOl~X^ludRLApo`t`4Bw z*g>+h zRcPS*b-DD+)|)Pif4?oX1~JEA*)QJjwVqEBNq__>KG*V|@9xp*F!q+CJpB)=?dMx@^AMJUXG0yKpy+p1qG z5Kxen#)?v=+O)%`HcCTnaF0k%@h;|o>V{N5V((%->O2Z~p)b6qZ5M3#@15I@0xxN< zb96KZ_}qrFp(|y4^PfUPL3K0+AalAVCZHBNnKM(J-NOst`irjo+|N#qvLb}k(F{9l z%O!oRpQT40gKw_$zL_+o_&;(d*B(ZHX(3WnAj?TR8~br?Y{~EtpuY4Js)hPnldl@ zPkkkX0Gt|DX6k>!gtXIicFf2MXfZS{6!@5JIUCB?PyCSPwT)d~VPKYm^k@4DyQ=6t z5cSATKLcV>>>N%V5(?Xw3vBkNpYXXC=kSz$tLQvr8J52l{`*ZZe7cXAgoFn@BCI!^ zdM)9IRiKB>n?GP`V9sks;jPilc0J8rL6D4)>UROLby5^jYAyQmgG%}cC&iBe^$gT# zHs(J$7RjUo$U>X(8H=4=ePb>iZCk+bP{aIkJuQ={zF;RJA}U93 z{8g5DDTE9))E(OoiO%&MS1_CN&b5D76Hev(-oqCA*GPJ1`ElO>O^yAa20y&=Dl5a> zJYG%j)l8DZ!B&mnD@_0Jeo><@y4}3^q)ve>ykIPh&<9O87Bh0aK-Kiq=#{h|YG~!z zDWwLu(Cv;%hmKN?1ir>igJ_PDdEh%Z~yK;O<4mf&W-`9Hnpu5DgD-8Dzv&5Zy(Pt3)) zZD(z6M*8gzhdMo-?bYSuMYozViz+n0;7Vy4x$D$uw8!8?q0?D&?F2okIkpSlhDFWU zvirO{BCJ_3pj||p8M+u!{0XrCqP^q=GdqiI;1z0QtQ#JSwv@{nj>K6KbWwxM*&q6E zxq+tVAIrx3Bl7omz{O9(LS?N{6WE^rpjJ3u_> zN{f3R-xKN5W!0x&v*;lW>}sI0|9xr5@bkru_uK5%{@>MicIbj7-J9$EKq#}~7`Q_T zX+nD13nO?xFBBUh>VNw0Su3#P=a~2%<%#kQa`j(}^YLIXEDE~c?ok!GyUuOn4Mz>C z!ipQWuL|dRi5qU&Mp&`Ek9%EoEQH;q^N0834_(AXF7X3}DLfTsC;=gc=fakRZ+a?w zX?t8OG;so3YYpC2AD2Y>Bp${W6DpEFj6KBPxzn*<@0@qIT_&uGk$(;n$Y>VS{*9gY zppVSj2kB;fsq6n6_H=G*I{b_f-HA|1uz4}|$_%^ugUcq;i|ZD6@u?`gt5~q|_@N4> zASY@bC92hbWa*1mor9$Uplg?(Rgr53?-zp~&oC6%7V}}UU*R1Ns~eWRXEEBaA(7A=%QO?ZI=bvhw)`y zT!vKh8V{g%gjwbC9a117}r70GvbEu1AMA|MBS>+eW(}gELI%TP=nkC z??TCQ5w?#!C4d5tr40H)%XAfFQ<&hoPP3ZBhAZczF8Ab%%?{jhQpKRjQi^W?+I1e+ zwtxHE6!vZ9ip&Fc$Dzb~*N}Ujf{00WLG4*Bp9}>GnOFZDx`W{ja*4!Ga%+O%J6K804$qp5oVZ8(sLDOpNa`EX znMzRO@f4=Bj@MVY>m~nawxCOObaZuD>BfT=pH128p`5T|=t9i+<>hXFMd=qxU51Rx zE{8Z*0vVjw%flnoy(VS`9AEh^YMju!NXwCvd$(q9?b?}_*}N`Piz)(vBhmW#qHtaM zN_bjytwOv!58SZKPBishRqX;hCjM^HqN~nyvnan^PzqR9TI?8Ik;T%}n(Y9$?jC5# z!q%qFuKsCR#tXBY`JZ63svIukB)eMM*s&Ga3e<%!kU4TW(_519#~+vEG0JV`Qd}ez zWD;}@_)onXZ~7i@I{sf}xks??=H@>jrmkaW2)bkTvT%m;mHt1X23pBmeLH6b2E4vY z>T}?n_|J7Q&kf&@fIAAjXy0haIFS)|yAC4w#y{-qal8Yj4>-lnY+gD=9cl_Bm+8;^ z9x&i;X*)Jak2B(jlb4P(GDpZNxwB7uV~}h`L3qowz1qFy!SK>VEqNbR!}_k^p&Vh~0( zX$AS|r?c~=yRA=0z)ir{qd{Mvz=|+LV?yv{EJ5so}9j8W0# zXbHX5wVjtd08K>;;md>nOcD+)X*iH;(}#09#%prT>4V)jMWR2xzwT@&|B&gz32qNo z#EkLj%SJqi(O<1p2Y94I1`mCE*HSo>DD~GXmI%fLS#QMicJTt5kLw5+2C8M%vtY9C$BFMwHIe?B=kZHPGF7^b61|3Ib*s(2$`CF{xu3t+^?PpoX zx>9^+>~QSbe%<~-6|xoeaot7!K%%y00B~s09)(59bHtGVbY&JeuZ1WS63Wvwo+qeG?48^g!ONi3R{Uzlx3j8iH4ED z%>g*+< zAzy9$^%p8q}=8Q^vGb2s0Na(qd4B9_3R+3r~eRvbrZ6&E3XV zx};5`5yPNq)Kt%vqBh8<3Qk8_b4t6`Zk`&Tz(hONUsiKC1My3SY;N{WS4goa*xSMA zG$WLYw%nXGZs*RR;|yM0z;L-!@rGfd$qRRln;M%Q{CYv>ra#9*Vr1u-4%KNppUr8> zRuQwTLQ>OqHt#n@CyQG9K_{JUfjJnO*GA}CrGic;U%3=xuXB6S#RM}5w_j(z<22w- zM(1{hrs@PS@Wz-|$}E=AWF3vNnnUQ`AFE{Cr)e&xz$EC;z|2mq5# zvR5bsgMBTKVgzW3*Xxp-G^|N>u_66@<1Zx0s7&vV1o})zlHeFrhe0~6)8l;w>u4fI z71X^;I}$Zhs{qTY7|p$gnQrUS{^s6WPZ*#Dl06|(MCBIj|6cmVv)dF#DAWPrt~A>x zcczv&T|lC$OXeEos=uPw-#-i$1{2Awf3@&ySPC{&D!$i9)$>mAX9gn)?az^AxUcN% z9*$M_$JdQjzUlLej^)UIuO0IlaEGj>vfX_$hD3+slzZ=Kg)RELum$9mf^WvIwXl07 z&hO#~YTN-=_mADksNSy^_<0gDb`l6?&(HQcugvQE_XU&nTo<~~({!-p z6LBGAtLEvDF__c`_8MvG8&t;QPNXi)G#SG^$g;C>zcg?JSNKrF7&K#v|X^3RSCw_$*G^it+#+bLQA zdjiaXcWK2TA_lV!{63vvE!p~I^b|&7iY{ji0YVIg5N%oOO}S30ByxPARu`K`Of) z%U?`0MqgD~7JnA1aDM{@YS4oTJE&!Z?UXdc0CV%79Fwp`)Q2S7Ol~y>?f&8{*_cft zn57)@YK$AJ#ePRMMOL3&`4*PT4WCGp47d=@4U){y7g#9n}m*@o5z3 z-9WF#&YwGEa{hWtC&qfFtCHuHRaz8eDj>t+x!eJ9WRg;FR!EIF3iP)$HFm?DE43|g zH8mF8CyA9u<`#ir+cg64zv10Ch=dVZ!?W?kdJF4h%Hd0)vFNV9zx(W(DdqL;^kdz< z9@2H{Xkld|z6E2W2L{zCs(FUb^=&xdLKv5-IqV?Wx~w(ia+kHqKT@W}`R7(e9JSB7 z%viwF8|(~9xq*Uv;z}CV!P}~63DB*lweK?*PWhZ;ekng?W>FE3Zj+uln0Z0+|{;p!OT2-7TL0PQdT&s%YezES*TO4#I~{4aK5t>~c;u+1J-0rwbiF1v ztM=fBn4svQrDG3zTY9I@^OIV^&)x4lK`-OMWYB&QrxyAf(>PT9AN>`Jk|MBO^bHq! z!k-h%MSSH>*lc*+{r>bAbg2K~z*mq0_Nj%_@P_RFpG)>zTn6r3dzcch$0f9&T4zfT zAR66m>K-Q?C1m~PXNX_WF%^gYM4Qh5;b{UNAbqr+&6x_ZmgAEG94ZO1$Jzi&+X7pS z2^d=dlaQ+totGk4PgYusxVI-klCVy>&Mu87Y|=`%A}QqkfDOqncX?xH9*z(*#xSF8 z`i%H`xP3HDP3hm29UJ0F?{2CBtTf>kcGi`wo8Z)jnSNBkjlP&`(W~`fcG0=9a5ac` z;j6XrMlX}DDgTfgU-=@RuQQ)8;ZGhm$4LQ-UoK27LCm9MGe2#&%@I_)59Hk?V{+If z^lc<-mJ2lp-3IAUAg_aCmR9k@yv~-VZHd`OQ@0p-v2^qRF|@X{bK>$DNjeO8?0fo> zT%NCS%r+bIw2x}I3h-T9RgiMX! zH(it-G}5W6xu+C=p2N;=V)LQ-qcf@dQV%sdD-606B!n`QX^~~XfjQjBHQm7iat$5| zAorXU#Avpp$^O`oZ;;oW&C>Nb6!oR(R5evtyq{r0>pXQ;F+W2*#F`OYHzZp=i;+(3 zSf-d9`~K0#02Ct#FnJ+WI`sl5oGix@8?cHMD1Q`ZYc$4LnCi@*Ro}h}0P=7BJEwD2 zs`<@Px`uZeEap1dSY2FPnl@dy%c8cYAKd~2(W-0Z)P8G)=BD+8qK;d_#HY4odrngv!W`8 z0QgUAom8`f&E$L&>%6(XStOE6-W?eZ{I*pqu%@OOrx1ck4snKbNd;qD&80oxT~nYB zW;t@J&t8o!<{&RD@pnd{_%d5PiSGtx87#E_DD3@<*YWyLd3@MlY`g353cl-l+}4m= zgs@Y~gH}m)RT0FYJXxYr<1t02q6ZKeoRPQ$R%x(OSB@@&P#0dx%#B?R;Ql>ZpqGAKg=Wh6CX%=IwmU+Ki;UZenQByd;6EGUSymx zZEbx`TeFav3__;0{?~R~FgBMaTR1p9h7_7Btcs&UY7|?`qt@_UL(+R$+GiaLQ8v0@ zPlyJN=>I&6?L8o7F;LOB5p;;`JrMpagCMW28ldj~!QJ19U?DsI0-Cksrs{d&arJ=f z@r(R-iZj#^jCB2w3H}UWI($I9{qt%5!T-h7^q*usL!XO*>H#o|e9#_!mpV!~bn0Nx zW6VFUaM$bdD>?0{|3<>%S==0zU{Jx$XWBIpldGqb|BeJtBbZnebfSKqEVjGQN>44b06iml)-4l~W`0}^^&G@Oa&_60M5K?0Uhrr0XV$dYPmQ~>*oqD+S>U3uwOU3Yy zlfjr`RNL0#JQ@iMvnr^Qt0`gnxISz?XtTm&)+!IsTX9&>uxk|iroCkl=^T$iBRi3^ zPk-N~%4f4j1k$Tk?}n;`jbdTz0Z-PUGp*#vMa}{(a4sxIb!T@ryfx&4|JonWV{uF~ zBj&QUf>5Qp*P)3C%jttK$}IsoIweXPOGkrvUWRd8rA=y8uTIiJxc!D556m>y8U?}0 zrN7|s4*oPRZfwe|6c%}e4rX+@c73DRYEd(dB(X}j$^&E8a{Dhlp$T#ScI(t`dnb=N>z8|8%h9NgCPhwz#-B2ebNP3J!iVzDC)8|E{Stm0XMv*+Fc_=R;ouYb{`D ztXwkYY3?x$BS*B>?H-nAr5^$Fr?QpXU_3B{;3Ye_zXTD85jRJ|dM*X!_7=4@+}zw? zv)N#`+d_nWqWhl{wX53x<9xA2K;Ms;Ja)ot`Fj@^3SNWCaHc?MV++o$6g63<=@_@r zOMBA(UDnlA4+?tXn8$l1pb2ecQ{=GtPD~^Usec_()Z8K%SwB?o(`E{{lO^Y@xp>?a zV&y+T->=VI#;>XfO0Eb~Cvd4cW>UqO(4UDVKS|sI;Aloq99ABLNz_)|fnr5R6?l_uaYv zx{ATeui$f^`zid!Z~O+n@|CaP#qsVz$tCAt!ER<&tp?E4ssMjiHE7Ost%KSC z0q@q(9Zw;k(yvV?i?z2mo2@(X3;^?Q&Dzc^b9UCPD>o!6E|en&Fq$-%25Y5f z5Eu~D23l6_)U2-<8M57N&y$=n!zs~bTBhnf&rvzq;(Om&!lCMbCYnu3MG@vme&M}(A+(ggs)gZuZ*nK9r4 zU6xGeM)mnb#SJQ8cwd?-$Km!$Wq<`pX{Qo&K}$z$Cc$#Jg&-r>jAc1MV!+vEhqOJ@ z>;fAnW+f}xq`DJ1KC@<4M+MvrysO6U_6!5*fdh{JI44e}-MoIL1psO-$op$`uI8Q3 zNxt7o(n#i@aZ!OgeIuBp0mIIW?|qq3SCs)z^VYN9*#^Gn9t;4`N`btp0130?4L$Ms z!anfemt`icc~!u;su~9x>tbi*yr8jmqusld1|WH@KL)}?1hds8*L6)ZX*QFRW?1iX zN*m2+C?5H*um1Rr_j6@TVz z#27&E%F7+dWA*|AG3>JS_5(=VAZ>R2{W7qL>jc3}m$Ym>)2Y^qGuipOmzO;b`x})- z4T5RjAwz>dzx-NwqyU|0 zbg}V$Bc(H~GfHxtbaf#H#PxZCzuygm{I0!gUbhv;`)w;=R1cbZP_Ag{fodRj zwQ@8Kg0t-z7-wTgdxiZEz)77vT=AzYIP8@mG^Y*1bY{Ut1-zEq zYnvAfT3eBCuQ6}7nC1(_Y3KVr_sx6vF1#Hgg0u58CDz5{>!X$?YM7=CVw#+MLV)_1 z03o)9h`x*dj`rtpGU#2HrOl@Dv=(j8$Vi(B zZJu%OYyw1ZzD>yIlY$$iKtjOT_5v)|q?uy{^Q>#u92&#`8nl4z6g{9$QsUWm+k>^W zLZo`oJ4W4GLNM}~1W1T(SLA`HlVa+9`d9u6@N2)S@6!kG12F-&x4=9Bmsd(OxVZ+_ z74`ZGVSfu;U7@Wj+VvH}qxXU9YhapC4+qF{K+72@1?}-8)XT@fevf+j7_zMRH(#&# zo&R^NEO-hm-vu<|0i={W?|2~ga1?)V-4etPdyRe;m%^5f%+ zUwn**4?n(KP4qB!@W;I{xJp!E@f{lvKd>j?Z-0yg9utzfY3J*cSF7`PsdU>HkMjNj976FK0)gB5?{Z~h1P)c1b^AOHBrOnHFP@k)}r z-S07rmg7?}-jvsPSzGT}G5~-Bf9sMl&CvI0~cq6$)4`mE(%3J-!# zBojd}a%M_N0iddO&ax~>F=Dsd7{S4w$L?1wV_1FPYI5v-zX*0s5hW>3srytUdxjV> zTd6n_yR=M}+Mx)5G}>zldXD~MYZWO5+!{ElB_FGo{Hf4AiT;yk^A0wTg3#Fkxe(Nb zVRj$Yx68~b2U8i zL0_omWL~|m+JVfoVLX&ELM^qXNfpWBpV4BTx~{B#{k&G6n>yC8cx+dnsMTUJO>NS) zDhVSRIilOl7QbvHkp|>7LxK*bg4AN`6G^CyrFFu6E?TB04Zu0qF($Q)eo ztef#X96$K18}Jw9ctJ4u795}X{5uZ-eBxQR<9RqP-~P>K-Go24hcf-i8t(y)T&&i* zsT%;@fFqbbIyzmxS!>5LI~4$`)FHqcT#8&BU8`|x&PPg~sDElT8PR|y{w#pi2`8}72rye_X6({ldVX=^y-9Uv zSefncdshZAp6FA8Y(p?d+#@*GN;?63MlgWjz{vj9UJ;X{R{+7C zGY}vPL$<1Tf73=M(-(ke$HM~D5;TynAZG_(yo3Z81TPMnj(|rUzSGbF^-LuKf;DTl zKGfQ2>{BW_2$V!o^8pef8iLjzwCof*1Wx|2`y;^WR$Eqs^?3{tA!+u&G;h%MHvk$A zhdt7?#b%=t@_ALypxBtlX#$#-HJB_*aGGazsxu+m{b+rt( zC4_{qO-c%}?`p7YsBLXheY}T^eG+>1b!!!3Y;ew(FsP7dP$XJ_)0}SNrcDDXYsn74 zVSHC>gP4OqzLOF<&@7<`8|O*ov^N$2tEC`VhHt1qoCJ&*wPrvvDA zfM)AlUJi(9#=JXM;L!*sWb*TOs)jVcWZX@CVw%7pxY*dx3D@-^_DpFDRPehp>>=Y? z%ZrgjqjRf27c){p=DuY>8Rp-z#O14H0nHnMbdl-Zu@<>j?(0^U2hD0|f zKiE-A_JEKFQY@gyK%8i_5Bkb=K- z>jcJVL)f2%!Ao@cWX;G^at=!-1nFuQULV>sWc1!{)1gboa*rJ| z`S}@T{=qrI32yI~6WbsjfE?GKX6sTL)-U$64DB5Q)}^wxv_Jw74Ag2+l@OBF?jmsV zbGMtSDIcKki4e`^^l}0X*2i5@!e6>m+|8ee(Bef55$siz;46tInQlP+3DcS9?)*7ZXD0bL; zjr;e3$B%(~_ksN_aPJ;atEv-B6Hu~#c5?+hcz}A?1NR>&+2Gd zD9Ip3U^yT>ctr_$4_?Oq{Qh5qVv8f7O<)u!Pk`YZ3_oQ!Zv;b6uRDG&Cx1IV=dQnv z=kUB!asf`Rf#F#MPXgftjAi)w^!9x5iyz?O!+$kgcOA~*XCn|l{;m5e{dd}1cc~rl zeAm^cIL}YZdyIX^&k{P(VN^gcJH}N9#!hjS?V@sh>O`{ zR7dFc9s#vVUnpm6W-S>e5TqCeKLfo^xsXiVv-+obGJ8OuTOfm9py1q;5>n`XsrE~7 z5QzJN1VLyl_ZnqnMi>P`v zmQYiWu9^MSN#Ta*!5hkqd1+Xe6)8=g8P8`$V>Z1E%2K8PWj0pibBJ`{UpH9P1}pif z;O1o4y1KdXa$X(O?r{^wmV#x$tDh8HC9CiI)-JPEso)qx(9)7qa@!JS8=ak<8EDzG zl!7Thwo-MUC)f&jjDhwZ`%<7brP>+29Gdo1vv)^r1I|^n<|=OxK?>2|Xa$5jv6EnZ znv#`h)3RI$1fF%QRk1F+&nyYnuITZikt{l@O0?RQ0!uAk=8EMzLySkyJgk<<=-_x}`uf^Li#&7BSYdf`EAjkJ8u5J4d2@@LUR0TwxL%Q~Ij)@3<Mfm_B3~<0c7=+~O#C5f`ov> zaxij)*5-7@fSj#wn>ox%(op3B3ustINC-Or2wJIMPEe1T10CcIQL}7fnv8g$|8cCF z1wR~O5oU66(&}d*w&JDL60S8Dw5lX4F~x*2TfXlneAkWvi`D>g21o!S zsgOh@f2RgA!3e-MXqk){OlFtl2ipV2prl^M?rp>Yy_W^8L_vZ!1Z*kK*=+1tssl3K zOS~M9W~Vo6YgcSR>+cHJeh-vVUKuQnWQ451wwv-!nk+j_WkAPwMWQ$k=1L%_-lrrP z1lu!6D(iB_stj;*a}6M1dln5ewm$TFpafDPmNlb&@IE%Xa}--+HJIH4>!lW71G^fL z`1=6B-#hk&l4rV74cB^3r7?iYx#J2%Cw2?%5#L)Id<=q!+k^z}MJz*gSl7As>b{L5 zAZKiYw}oTur~;1cKN5a=MpMroZPv*e5DmjSbjQ7DGo#81H)*aD57vk8J~j>!z7ZQcSqH-D8@lUKj>{ zwkw(CytuDT#j7BKv)#_Y#75iG>_MIRMob>|{~!X`*kre%b#GkOrQ4TiXy$j!PWbI} zx0gEvy!@2=>jf>tflc z+s#y@^ti`ht7;;Yc$|~t0hl62O1Rx0oLInE1eFq~)YzI5=tBsm5};!?Z)PvaS4{1M zwwXZCiO;s?h;P zx3lc}Ud}^I{X$zfl3j|a>%q#sHS{E|u82}K&T9U_npZbPJ)yt|(xY!eqPnW>#=aha zJEN_`swAz|O7_&Imf)fpcK~krGtaP z=;^`N&f-1zXJn~%W7S-M(NGuhI$#8W+yQ9KGZYx4rHo-Vhmt@(gZ>i8NM$fd1E?{I zKMO!-mMO|`fXcxV5o09x=VK6?!C@M>#7`7>>epppfvnVQpd_WqR1qOSK&Pe$i%vn^ zZ^%Av3_B0s8Twcl3}#6Kb7YtS?ao21CzmzwqgB)a_yJ%BwcTSVr(mscG)ln%xZ_)E zaYv5e59l2f) z4*NT^xnThef-O34I5~i2&8STJWBB%KGTHi`<*mS}&YR$%TtM)4 z@cW~xL9p^71lGoEPd-<*OdEpB4(xHxw_f*-^Ak2EwH9~$#(6%zqneT2vwQnIu^N;(K? zn>1-_9Bhl92l=#&4ehv1J z^z0(od}Z{DYB*z-z1G*P_VF_|!EPl38FF~{__rg{6VRU(S`rI@tzot&mo6Q9L|VA(Uebg2d0qWcW3;th z)Mh+8JNIC5kbo9+UloA`%%hJxGfYWRT35^Nb@E}))^b${kc^Rz_D+acE$Cj7O5cNs z6vXF+MX>?Pw1og|-T?bOaB&Z~zCyS-M_mi#>_Yo#yVX(&DFM54;PMi3b_Th=LVNHs z@Q3f9-G2bQ_b%k+SCoiw?796)#(6j3Y!|RA_5r^-OfPXzX zXC1zK+D`d&&53D%Dp^t=w+%DKLx_vfev5%8p< zz|)@Nt`Z9Ca1S1yOMG(P)9xiWRus7F9N_qQM@5P8I#ezg4~{Fz9J~)n3gb0q`~LV` zlYMU_ahxhOGyn&rl<|{4`5pL~pZPI-+qXUFEiVN%1k7jY2uv5T5{s*<1;nW9*kOM# zTP6DXInT4NtEH&Kc3!iWAgJa$EX#^{BcAPA(R{50EDO3+>~9Y?Wg51-4O*+%Y-cQo z1#2#@Di?wh4z%w4>?H#r=$Y6j{wK*?d{$LJXr@S~_B1nO2~K*6gW3s?1hR{f38=o1 zJX^eCSr@cgvDTT+f>o~GlHGjh#A|>Rsl{}$*!ih z5Y-I;Q*1P4ypaq#+B)+zA?Jeq;ef+o!Dcff#e`*DO`)(E$w0bYGQ2}6Mr8U`wINJu z+r$`=*Nnq*F#iOA2o7co&qi2|bN6`(iZ%oPN>zm)Cb_781TcG^-=Uo$(C60@2HE|) zS}Sh%2L$OpCjci-Pz_5UrY0~AB`|uTfR^5fzSpK0T@_Tpb(ULb*lspmiar;ti7Vo<$C9JEJV}L4YOoP3q?_BjV20;QeuR&uK zBPnBD7pSSQu{jAR6_9KSiy3sq25s{^srm?7C$VV10A?VGNKIadG+A~a<*8DtMI8h#PQSf#fw81Eab#*wC}rRA#Pqz}m8L-7^D@WOM24tScG3YKT!bmbL!~SOYXzn|+`4 z`Rs3^ndEf%axU(qQ!)+c(%*mrEiq0mAzX&cg4Vjx$Y47e>;(DTIJMtZ#!s_ba%M2_ zIKch1;}nGYMn`KvZ5G&2CN%{A2Ovd(Lvy^OXA@|j!dUb}#-|LD z>aEMtYw#sNB3b=(jyVas9HqC3JxTOQS`WQ84Q|s}q~k|}Kj*~*FaQu5CE*OaBe>rn zn0MzcWygS@vreRs86iPtrnjPPZ~(FDee;?vn<0A4w*!=2N|V6@X6+M@=fhHMqt)zS zeh9s$rGk3m9YYDqu_kJls3#Gkfh9r+=<{8m!`s(2PG{D-R6w~}Hc2KxA2k?D5*M1y zIlhzVV3*78+jkrS8|FeM%!p^7YS5@>*8oGmbN(1{;0Qbg5a%6Yn!I0`1;osSH5=KY zn&QQzbGOzEuus!`RI_~~hUoh(KE}F!YYqEWGg_@EWyLgaQS;*Keyz-)2z`7_8j|Z- zYZa{&RTMD!d(UR!8fB914ET)LO)x@wzHA861LJ}r zyO_`2v)Kdzahf0vDC?^0qyd;^S^PRw{m6N>DHjpbgj!Y&I!znfmy2hz*Hy=d66%f8 zw$(l_6_ZWJ{^2rCE2HzKCi}kHm;?7H(LWD zrT=RW{Ht_m>%py7adY(;yNd^U&Xhnk5Qq{hYAMLef?QU!0jiZn5lq{y)?sZGF(|E( zq?Ds^6kV~!$Wf!6cd9(#V{7fC)bALe=AOiL8fa+cIAGU7d^~ZCM1?LF>|L+pMdGNf zD^xi_?d1rL@AIVHb^3fHy!l?=nwRTor65kT@5f=7AH2u7pWbyZ*!IIx3`fD|revGE zu1*lBR?5Kl1+#0Y{6s>eW`OogJStO+HW|rEItD{s+dwrTBYOGx4dqYJ&350LELhrV z18%Mn4trpKqxX`qv;S zqW%2aphv4+s2DAN=i;nPLWmAE&AUoH5_%=xfcBpZThO^7m8V z{VpYd@#qBTzUhoVpVpSsXR1#*zv1c6%I~(5c4GK^ycYrIcE>s6^-hnjc6SU|kK^<- z;=%Dbuf6svfPy#Qe0R9!2;iRr>Z2+G`+~qX)d?8h;`2QX#2<+RBbd&6B`EODF&+Dl zeRG=S-|TxNH9T!B*d7A+Y|ClshSTv5IKJ-KC%n&!UZ!GHJ~$c}7HA`Ln z%suv==s^Euv?oQx?PRXABuWFC$iY6=_(U9Rv*sDPu=SpM21_!=L2ewjuS_YK8d2;% z5}IYl8d0`V(NO`+dDhZxYA@2))BQHDDyKfrv+j2x^yC1DuGN)(z5uQ7K_wRlET<_U zB_lL9O&C#|+yH+|Vwk4M>}4azB^w8eS8!ZOJS^t-$H4~>05L^uWJV{mTKvh{#xc~4 zZky`@ELn+1N?2xWESNo|vo)ARuSE~B?1R%BK z0!thBIr+YOD{QL@0kR*H2}@*>c5tM|!81TWpy?P?_v)KDFO4}ObHlNAkj593~NI#KOn-=8?E~nwiXL|B9bO= zbdbKsbH(G%x%HA9I+y5ESUe({t&C%PI;5luySBcI%{`G`c2@l(9gt)t57*qsOaM>l z;5)`RJK#I6#}b!yg$VGYKl-Eifgkt*{Pu7EHeMXh_i^?1Z{edq_zTav8PCJ<0+am~ z9N`mx*Q=Zuc<5nxk?ti#qFG#YTN!DZ@PMz}RI z`j{C;)_!%cn$F~yHOPBT(`1Zz3qH4Q{B^YjxFmNq$7Phlr&M8o76yEKU2L`;W~c&` zs%F+S%<;PGS&H`yrOtUD3_!m%YXm3knlOOPT)o`D_5Z-&-U2+5;YZPD;&#&QIt}W3fQH4?2S_`ZOB!H(#>UqF{n~ zMgqohj)74=Pst0`{ViIxdTkci5R)daC8Lzp82Zeh?lsUoYjwzM^f4MF*_@>>2Gq8K z>q`xW>vK0%PnV#w+176*FKDe{o+fNI8*H~bOw){cvxS6+Xmz{Gy13H>k*+iV%|5KH zKQjT5E-%*{_;6ru1nJ;z1>KN+Z(t98|~9HNob|kp0NPWc&HPco5FU zi}Q{^H(A>Jj?c~3e2gR<%W02b7;43OxJAj!5unWmX&}vHFkMny=OhC^T5me~z4TTC zC?@c^12I`r26s62cE4I1YRMLu8poqE-)n2g)+Pale$woQlqPGB2H!&9dIfis0R?$U zz-Y|?)RQ%YL=CjQj#m#F=+89o5aQJ5yN#;{EG;{t>4X48upag(>#C{+^Hzgz#7?Yl z_)a%_znvJ-_#n*6*UXJ&e``TO3ra9tCBgbb11rJE1i_RwN-au|7(hK8@XQbf(!vnTWWbjDISF2;VA;5bYk=3*Yl5J*7PFn4>pgQ!$4Y~<#okA~Piw^k zfP7E&Pfg``ZB5b7^}XUdR%=1dtEzbrXaGDbjDRdjUIZORMTBTUcTQEcWh(a9kNsUl z>xvcZr&=p&UeKCmz-{Ik+szKsw86aD0?=|Q5+c_1;GhWSdvB|jBx%Ec%$Vaa=z0Qw z2KFWUySC$UG$LBcNBmuD{wDT!s2aS72R$m{9k7NQ%Ji4KUBB zhl6GyE{g(ZK~N71kS0|>*qxzWUIM#wwCgL#*$(yk8kjd|%O3wE{{VjL-+T-{;66FW z-$yXE+m$B+U_ZkhpC66L$=`U7v6t?;F3%;1`?TZqJL7dvzbAO|7>Ng`iU=R(JDi4i zPW$py-Qcv1r)@pG7C#%?_cU?=0dcm!Kj+{7`=7$U{Fi?Nuf6sPj4OYlg~$OP`&hx>`+GlupZPBz;^QCx zHUR4DaNXH$w=U}r^!*X&{{7)_(EYA91G%+E_>`in04hjp{wtdQTjL74<)i^@b6ePK z@KL>qp1!At0HbHrX?zlrV2LZWj{-_3p8~sIRfXo=%*U-)h4&O&uVIJZVF< zX11p(HPwp8kFT(hb5dqe9^|js0JD|DB zQwP;_ZyL`d`JvS6B``>$W9)}z>|906?DpMG=R-V0J!ze)mH}$sN6nrS`?LuGk;cMo+d@vR`NiGTy>&$RL zK<60L2NUsyVw1zGideC?yWy$UuevkmL4R z7Hi3C&x|mGd&~xHXjqrEgOlb=2ML~iA<#hi`|rPpS023d#8`|$>AM2d?u?xr<7Yus z>dcwnB8YMvG-vi7We*7~GRuT@ni){0V+AN%JD1ggGJrq|y_Mc3k~J740v+YnGvmB` z1?xeZY&StS%Inbyr6a;@O|<3?v^s+YwX7zi9)PCVE!UUtxs-a&87W3=&tGyNnL!dd zvy?L%LGLkmga!{vkhz_2t}&mzgg8w-^SETx+Az(NIS3VbJ?NawMJ3LfW*3%H5tE)5 zQbJi50IVaYpePyJ0`WK{onB{OgQ3^<#+>^!10p`3S&G23 z*zG(9n_4R#I3WP2wbXTN)^$OM$pd*36Xtn_0LW$4Yt;ggHjIUVfu$l^Nd#RZd-jz( z!_c;b5HJ~mz@1bE1U%T%GZ?)+(ldKg99t9Oz>(55%PLAPNj)Ts=Wc$TgK9+3BiO)R^YTElE&FX&YIOM!)8!9~WBbahTE*U8@h-RR@ttC|K005Hs zqA=JQZH|v*f#ZxD5RzbU)7FPm;JKK}l7bHc7^#uha=WE9)Viunr3J3Fer*P7K`jev z5zLz%S_5vcA0ya$qGSbN+U$%BG$@4(`&~3JhWiQM0j_6bIVK1YYDG*lByBuE*=p4+ zqco}9DS#y}CV?ynW}_(yi$o-yW3?2`!nd^%cHclU4LK&wf^pWjYP>z)Sam_uf+lgU6S^{Qz8DYJ>6$eDJ>Z)7QQNY`4hozl(5o zf%X0OkzRU$_2wG5cOU=b?SF$&0p_%)`*8}+KkYkrohQS;dEE8cUDqFf5P!Wti#)701UMwJ@z%xnO?45S3lb}mJ2)HPG( zu34sWj|mXmru|+muEBkedtWaHrsW=TDF)&zFLxswG#H5?M6kRdlOGzIXZsc-q@JJe zj0mS$@m#~%w&aR!6|K?7X5xW@gDkfv=G&ZKoa1mfpqh#$v&GSrAfHS2eJ94?l#(_8 z$i?iYWm(0?VUb+m~`CB0HBLhFiU?BmuN&d$!XpO*!@?N-l)*`6Y* zsu6;L?SR&b7xz(Fhn;;u<*xJOt;Icy^8&N+s&-;6C;W-F2{rxjb8vQ*m#*rg_Hbi!!jrmD&a%F zSZl*8ue^fq`@ZkT_kQp9;CFxbck$wQevjqxm#|#^0p@!jf7VTT9*&0q-h9@Lc%F|J z1cN{Qqc$E;KBm)M}RT?oJDGe;kf?5mC&MvU~|Ji%DSj)2OI&93f)_$CO zZ#}x353y;fJ5MT-1+~N^KqLq(L`*CNl0tz9BOo7a`X@jFf}-^q1SX)b1TZYZ$X}u^ z1JX|dhyA4=!BR1CpxBPVMl4aW0!2lW-QuIkuB!VuXYcjO$9$}HcHNSUxQRvzwTb4v z_tZXnuf6tq%sI!HW1gJgaM&{&KXY)^OU*=YHRu9jT#<8P30Vp94kOp@JFZE^M_gAi z+8v@uOcMz6ZpT1oim0gYE{LP!T2Ng;`m>w2P-{V4S6rMwLa7C3XE!;Z-^sHt>mr~% zv!Zi~2*YTAgWeYaQe1&+2nK)Ap^S4iA~-L5ghflyLL4UVM>bu5Uyn)hCa77Z*w zg~&%{t2?S+)IQbo41{#vfMl-(91ApX*r!qhFv$8zKr`yp5Q;k71vw@7Fq#ur1Z*WR z@NdDV&T%qwfp3{dD#ff$n5r}MV3dwq=LU>B)#qzKm8oY4DAEEh3fe>i{sxg?g^pzi zQAjch#(4)o1EX1jjTyNXl-K~n5cs+vRmbSck5B{I6{OTG7XXMxkOANt$)MKC0g-O) zsnq6RsRiS}vYTAHT>7@lEVh7^jB$r9gWbl8W|5EuXf=bS;+?l&`3$)i-JNqQoZ#@b(uEG0Z0*5S+-pI?9$I4ph{bkyC`Dic~7*v*-A} zfyoFOFKZbNvgWxqk94olHICQqRpjTL%rPZfc$=S^sa=W5a#VQUgmGxWM+-(NiAMo) zt+~5GGl+GaO>yOH^A7a4_aQNV0#I_snxua36aeDjLr)m8gP5?vSvwKKFj)}I`kflN zr4%7OL9_fUoDAMl94u-?#C;{f^nw;twEcu+MWeQE5eaB1`))0qB^QKj#qZe}5COnS z$?&^$vR)`btr|G0_v5ulz+nq27L0DNc~lCk6KL&F&OlN!VM0j>DJ}8}cqZ*HAMrj# zyv8oe!dZyUgK9=85#&ajACULb6AAb|^1fy&0!MqE2Wmks3FCYMkV8z7Rd;H^IF7vc zmIRqzvTqWWWyLs7yk=RZ7h#P_fP)11055@i=bdHaXrP(F4C=rDXMwQbgN;ijixhhX z4OE)Ci3I+7BA5mvEhyL>M#|{cbqzT37>ID5fg>XTbaC?cRd9na% zBQC%|ASM0`(|Ft#TMwHwZAm{z>Ae%)c;macbLV&P zm9PBAxOea8aqr%rfB-~V%5|DLu) zkN&>bl^)PT`=BQjD9GQJgFtuQ_8o4CAAK7l+WWmubz|FaZqs%p7U)sC&--U`I95YY zKl!@$_Ty>oKHHK&TDb@BBR>A|AHb(R^)vY32cP3BOALWQ)j?{R!}e+)90Q0|GI*tC zdWs2$h1J`J5U?yOVoI1rb{?Wo;2md&rNtB!sa}xg+rbx$G+XAi=VcyNQPy2y=mm>bcx@y@$ zZd(X}0o1HYWQ5huXPbGRCwu;7S%Gl`X}_tT;25OOr2x6rn$NkI-K3;4O;|8Op#c8H zRphluSpkVXsJdclrIHv}Z<*w3X9n-Et`Y01_DhR7gb*atyf&W=h0B{#27KpGXwMT?uJ2Xwd=U53`py<@v{`v+_yJd3?hVJ{iJcP8pSUL$2yc; zQED+lsJ=h%o%t!KY{yxNLP)%*H1#+2QP(x{dnE|bhpfFt)VvfBC$rPriqcALwwRFG z-nx|P`_ne`F)E%aOom-!l|Wyt`U4!Di9F+y{(&EPS*)xM3ZZ>l+=K%k0W%yF@Fv%e!-+2B_Y@{15H%WHI>9> zHX?!Axf0jXbwx{-fcP0;HnrG+#LunC7ywy09)iYH^m&WL$kZNJ(t`RwSz;f~IV09M z1dGe$!u^0>q&JBSGB0 zS5PQ;k6|3Kt_!AV#_8D&TwPrvuL)OImy#JaU|kjrZtc2Pgej3fFWCVUT`H z*0I9JE zLB;{sP3L#z&5>89%8MkSIsq2Ua4Jz&tZh^)jO-y!M6u_pAmZRk0k9kn2*bb*Q)Q6I zNjtp{Aj%SWFDOLPfVC7;TJVlDWH?*inGyn%U;=VHa5jA4@iWlS04jOs&TGbuL#gb9DA>Rb?O>pb zK8F%rVv0yH!G{KD+gKCl-#ORn(L+fsI+~gzuJc$&GNeupJZFB|36f}*ICDfI~1HkHO*HSP|lg&+?$J*v1^HT#TK(#=H%7JT^ zktrWYznDC1x0YndxK_5jzF+NgT~92aYR<9ac{q$bw`)BDxU|+huTc(RoFyAUu2c$Y z%_8r8KuoIyIT;L7rIi>L94;P8nE;Z23J1f25Y=*&{c1Yl^F*N`XCXt#JGHe^Mv@W@ z`aS^ws+#px8wl40iiU9qmBd|_h2Lcupi=t^SZkJD5pdp0S=538LKt_5%O159M9JhL zBINyrNZFG~*K&s6h*}Gl!=+?zsL~1nRHYn?1aPP+PI&K4nsFFrlpIkDS)FvL+L zT<57~PKJCBA#?>@tgDlm)_ij)$_r64#N$JH~5Hb<0POx9URHCmoVv)EcN zRZH18#5H0N5{eR9l$0?BmNhOSvD-)k49vh4R3Ql(=%v@F8XPCvyG(s%7*QU44>&mm z)|E*H(*!(v1iELtpn>c?IDK6PJ+ArtFFW-7emr&q?b`GE4EEanxBYy3Tt_k>G{E{g zGC&W)>$%rGbN?LL76$CEKl*lV)e+P(>xmKD@21Un^xVE3`n~*wa}~5cRt0$Fm0S3Y z-}rX{03Z9<58z`T`vLj=xD{Xf+67*E=?nnyna}($Xc_%_J#AwT&Tmx|T1F`!J@CJM zmr;JIEw?3eXy5naRPWo9AGT!_^s`>6A>)`p(_f=Mwkiqz_i6L*eOs^lyT499#Vz--(09^|c2(%=GZf7Ah&{e;mrG~hY9kh%T@0G28P??0C zOR@c{*{=%9bt@So{9=bdvfyO|%lPu51gP&z36ZLXR|*qzD*@9qF?fuMX`0|uVv>X; zXM~`>lalMjUM|2ABim%sUl99W)wxu)jGto^kduLZR$o(PGafN!U)C1K(l~;i!}Fku zz220QTDdKlYG;)}qzMD!b_;m!yEqR}O_sf>MOK>&Fhz+Ff)ONYsVG#W+8LGRU;o*{mgj+L@BD)ikOnw z^19@;5{gWOLX{F^QkFv%8#qqIvC1lIwR0TDDH6M>La0!pzIRRarzh3wSjsY1w5(y2 z>!?Zt+uZDrYgvtynorB;RDiVnjB679vYsi4wTiF9NmU8UvLNR{`pJoJ?L;+lKt+Lb zGG9aqw$zHz9Vcv%*ulE;Rhb`6L8~b@uxf+sM8dWr2w6d54Mj=<@LCA-(|o4@>%FtF zRz&TTph__kb*e?SWbt32$_mxWPSiqho(U5KYJ?t{e?`a+jvU~nJON4B2WnnY1)9n( z8eu=>WNWi3r5I_tlvZv{)@>3}7SD6`wRl~urUVhJWCegqqFUGDU$yAE+4}xdpZZVn zd%yR4`1;qsj%UZyd+fjSN5C_J!MkzXd9NGrv>(q12H*eV&U@W}r{UN?E06H59Q&&) z%K*^2WGvMcIa_K-tRw(fydi`jnSR+=(Km11MotmQ>d3Oe6$S=kQep{WcGQ6|j8;M* z#>mEbY=K$M?2ZPc0n8$X_c-JOVvGjpG1Hubr<|$I;cHX|08dU&`5w**2o0cCt6`T) z17|h#?VQIrO*rhY@L+$%fqjuNg9}VFa2yckOnJ^0)tcQou)*Gkhm@cJG{8@f{_mqq zJ2mR5$%=0e{Y0}-`LiA{BLN8c8FTFc%N9gYM@v6-q#3cCNl|MCYGE=3c{ne%#=CZ# zL#yqmRb24RS6y2Z&<{>av78prI6Y1UYbC%z0uEx7ZkA)eIphm^@kQD`lOR zxB$*03?rao-~t341KKSsMcZP(SIH0v6P%aKUx;MAjA7J@R99|eC3EPg0}V(Vwwfbq z$%t{~XB$S&E(k5#R{;+LtXzAq`cvhk$q|D=@?4zR?l8?02*h={i9lY|4p5KekNf^t zhszW$#7nd+_u7$P1SssU)5@OEQCSCNuIqg)Ls`dW=h&hG1^pb55)TU8i`Uo7Wapfl zglUBZQvlAK)?iB`z3Ba%0Fq>C02*K^!cs4#FxVG@0kAe!sDbXNRg?uFj-iuahX<+j ze=VpaK?w<>8C)j89&U3Md2~WXQ?oE)5Gs_slS}J+i!w?38JOb?9xIK}jdPPD@8$vr zsU#@by%VVOjpj510=Dr4=fGO=a1N-UU>Ii0X5l{NV8xINlWb~%A13R}su{-84}KUC zhDqj}1R*__q);M)24q|I0FK6}UayjjZ$D^sm&aNyAPFSWxZ}Av5(XWsB@6K+SUY&F zZJAw6-0|>^YoCUZ>ms^ZP$dAS!LYI%5Q#8OC$hIh_%LD^5^71hl=B{@V^O7F1pu^t zjP&uU1njecgBsA$V2Vs=n*#)A@~YR3i7jx8s>A@Yai(Q&^a5InMFCx_(J5`qYk~8F z)w9&T>jUX}|vYkg}F4fyQn><(Dae_+o1V&`JU5x%ziX37%l3W$_86|>PfbiDaF*LzR@+N?I+rfZhz7H zJZ8HQj;|xvQWA-xEk|{*1q@ghQ9e@T0+KmO5LF;vqgc61YB$@ncuaGX=GAMn{U(IA zs&dY-Oj0J>w7Ft3vuJ@+iRvOl2ro*!1W>;FHsC$*oo@rfC?taj9QLRwaoL1--eHxG zx4+E#}~i&M*u4B-1!0g_>aGU zPkiDf`}Z$=;V1BgFZ>^P@IdcZ(fYq{+m`ImKYLFCDBZbwEhT_lWAI%&4!5L${(bg+ zq=XAC_vgFsZWqe!JKUbz6F2mCbf0NE(0yL;IC-K!FM&%U@V^r+_}~W%{>HEU9RA9O z--i!;;CU>|is}f7_#Q!gn_79V&V|(hN-0=lWTk;H0AQJL^&1S(b!4`!%WUIt5`g$A zzDhQ0Q_V5L7zq3QUVz$0!VRK0=D|Lik~zn55Iasrbd5qpC>VUOc4>(jE%CtiB?CjX zRO>n=5A^-a#BEqsux1aF*(2zD?na6(r3eAH)ewgOYFyeOi*Hns*JPlj0$PChsYS?; zIU}hbLDcPq+<30P&LnE8OqO+7%S}l?knV}q+NwagjvGhpqo|^#f~~dIM$nTE(Ceyy zuYE^V2qn@tsBBl{nwd~6`zb3fF=*;Y0J_@BpjoE8jExM=rq=Rbr4-E5gp`w%HXF_U z(*3naY#^nCSQEx^0Oj@`6$n-3PUjrF!x3<7q+>KP0mlG%d}jgtla%*z@-CPpA>{>p z^IV+qv)BnxXSal{<`>BH!)jZHx)I6j5H}QVP1ZU0z-y41*Del-SfOO*C?PBeWmI zpTH^v`i}KnNBp@ee;TPkh_QLIEfK-`T|Y1%ueaxQjLIAbX|ez(K=HI*l9 zqW4LW^ts#k27p_)Z{x51wV%Ulul;6I41IPyb;q-0+js4F>7$>0>*as)cV4{zUN_`v zJ=|Y@%CqDD>+#XgzV!-#Tkmx{o`&Q6%|CdroACep!yE;PjW8hQ#K;`PP-W+B2!jz1 zIIDBQjhnYIPrH__pCZO-MhMJMp62<;C{=@Vns*?ul-n9tcp(U!o}FPFCydhsQiETD z0+8=<=>d_hBW1_(zo(dh%0T|f$tlK>%M{cKzMeQWTKa+Op(i6AaIm8}Oo#m*M1+%* zQ=FWfVVZY9>T&U2Xra+1ZIkDM(%dLZNooRdR?6&hIR4|R$x zE4RCb8oeav9XkX~-na$yVZm_?bQripgqo9qbl#EJ+r^w1y|yC`lGR#{#+cI#I5e=D zK&D8cSqVLZo}a(ia}j?a*KY}kr6%J;&%X^dnl^$N|8!8~3GG}R) ztP+;0^58&T96@_`0s=~Zj?)YZBgh3N)<{_o62Q;N`^Y(3288p@$TbQW8=zZZ@1`FI z1TDXCEXl3oLf^Lrhn&+a`g#mVqDucrHc>5>ZEa&kug^0EN`NR*kJ9R_SJ*u@z@+U^ zNj?Q`G|)n5wcNFB$`aRiq}TIZMg{<>KQ7>1ZSzR8c#_mw)Ig-lFscejwvr#>tkp(1 zvOtOgwl2U6351`UOGB{YOO!Fyvg&JP_PX;L6ybh|)+SLfP-nerAeuW;Gcr=jmRaH@ zfU8V-4MNn+WFW2ASh9>^ElmKlx_}aZD!Cj<>>p+M*4Ae^chZ%P<=8ne$I3R@fb%w9 zZ9RfG_{5~A3Id2pTP}+5;FsQ7~o~zI3HNXzgEO`fsH`NKr^)g+MdHH zF{avDdPHK8y-Dkp_aLDL4E1}CJd+M6z=sKbm_WoCBNpr;CJ;f^ChbGMAD8}dzLP}E zNeEG3wE>yGMxYyKkbt(sFoAr4_aoM2k?eoYtUp>COOYV!@jKOZOXr^>XTUcHmc7XS zx93qJp?=>;E816f-v&Bb9|{n!C1|uCxNqB9%5$OGoH@Fe^rg1Lq>hCwp>sromRiqN zi8Ka0)Z=S2>97SJt34xZKPpNh5g@uJBxt}f%iKaw8Ud`IZ4LB|0K!t3+1A;j?};Ed zI%Jsu03ZNKL_t*V+G&^C_*Ftq7$$^aLM4w7MtDCkI3Vkxz2}@zO0ocDkUFgB#(+$p zBhr_yqx$}i@Hq`2%evuRUsDz~-mSf|7S|0q(%#4B&^1PnzK*JqMrsQf_ea*iIgahC z?a>EB^=~EQnVs4J=z5N}Pi>Umo;tez#z@mKuj_fv8Dxqv;QlWeAjc(mki7>DBWPsVWtw-Wju7S@N(KJ=@*m>wedWi{z}M@5 z+Q-MxbxrP{ufKnT~P!0o*_Od+pBImOD^jzgK+d$6)^+a`&GSJo+)Y9S;foo_lggl4q^mxqAP; zU3$$0ja<-w-rq-w6&c=N;75OSz_0)MC-D=n{Ofr6%5!=_$s6Yf@wRNhLO>6Vri@jUKKe0Vh7H!KScG~{X;yLonwQ@flmc{&6&JOoS zd$@CiY2>&I8Sn-1H+i4*!DAQ(BZnqYU+}?Wo<@0AB`|pNBQ&0%`(sK8DQCnO5!c8w zR7zo~-2|~a^xYos&HQ`t-c$ok0$t{v0drswH^p@HZl-B85@GKTXDQQovfBwjTP!)n zd`gKmD43bWA68X|oY{8Ok|9J~LPSeTDeHV9jNn0 z2@#yV-^PooPNkG^I4tIW6On-9&V24ZwxsbBA}4c3RL5lewv~lUk{%UELYh#rM6X1k z{OBy%@)b-L=oLn|f7tfbl2NrXIKIXex(2J=uBAsDakA7rO`<9QtV?Wmr1Yi6?KpM- zvxP$Nd~fe%PC%68ik0kCU)0n}68rwk8ryiKV{qI#haq_Br)pzc$AivKpsjPIG@_Z3 zRFnik-P$q?gZ73c*r=4g_a3|54g|7iv|X-N^I>C**zfnaxV*sr>I!jPc}-oTtp_^C zf+VL{EJ=LaBXWVP5y5n(n`7L3?>GL22np~66)TR1sKRvFwZGN7c57t#?vs2#!P4D zB!Or!U`7=brfFx-39y`T7AAhm9PII31{~03FvgW-_nc!XV(&3cOiEbRr2#a~VH{^x zZ;X;~zpp`&qf&0=K>l%IzjgUA3>Zne)ZQt4lk z;Dcq37On+dw7$7h@U&%z_GA{SO>sgU%H}9F=|#;h*Rjg;yc$WtKoX4t@<6qWA~_S z?#$L}2iGY|ux6pYCk^uG?8|8+j-T5trkN$@~xv}@2+gDqMDBV|#KkZ~#s z=REH!K;9#*2l#P5dbd1&Wqj6xk{v>rcuYF27fvjLD1iiH?~@>UwH}RA1+g^~OrMFs za;_{pn~p&Bmi0rM3~fTS@ykCn;AQhr*JLPY%pqbT4(dCn61?(`oX0SXxLo!a!;E1V zQHd~2&iYV;P8v|v_n4$6EIEgg6P$nsBtdek@1D5)kk+6rm4nz?o}%j9t8Glmjct9m zXCxdcrnDfKDqTQGIlRW``bONjE!gXvfe$=i_<6!0K`mWll$=vEs9AyPp~M9(3*vof z>j)9%Y2r3gQyKul>J`^oK~)21Lc*z%g(>TM?w(;?4sd=z#meLms9Go2+Ej9nm9r_e zD{sLHUKgrH<&aXrG>*I`yAE)cpm~!g<%bD=Ky?~COK|?A?bVz8&E~p{UnOa& zEzz$HQ2P$8KS2cVwRAw+cQ_;NSf;%P<*y?H=$@i$4uGS5-%F`1-BT10Xo14VNe0*6 zr!-=P5~}p*fe0lyaNA`3cEp|j&~c{$;r?J-mFKkcf$goFq0k69F7p)Q!P@6+UGw&A z{5;hNv(CG2Y-@&9yT9%s%_b9jPwWdFFGj%9V0hPOB`3IAkJn~$iMkw6-uwnAu1Mc}6IfTQ-+D{t{{@q5q)&Ce|HJe$e*ORX>!`Mv z+LLU1Ti)(V1vb*m0?ftK7_jT>4IF{Jo5(@qz3H$AR zH49#U_EP+M{fc8Xfvvp1{vPmTa2=a=)$Y9O+S>#B?Xw3DK7~K~vrGKlzx$`Sckf&H z)nEMxZrvII0H68HKfv9)|2F{Oi(mXIKKHpF!E3Mm4BmL-yLjV`Z{zOWJ9eedeCGFY z=gy1x^rt_9-~atz#%DhB_i^{`|FyYy!137V`=_6;+OOAT^sjh)Uf1qFJy*Z0=LQ@T z0s7JnRj%9LtKzt=dL%sl3;>e^bUf;Hl~ABZ|E~MPZ9doW9XIC@#_@oUe)Ktf`qTeD ze)xx9!sX=^zW2@pjN^zX02HbKLm;dv!MTd7^Gn>gaRZ#`o?x}Rsj2gUfN=~+i7<=G z8WCZCxWYWo$fd}7CH9&q2eHlDfa6*iz)dmR^k@67pinh{Q;FuoFfKd$v{IT zr8;t4S`Xs)hJdIgiE2TX@*XDI?e=KPUJ`>W1ygJqGiIXeV7zPLp49sd)HJQ zyywJ@xFW`A1dC-|jm$p|Ljx0Q1vyb2kbPbK5hg@4;C@)Rq+gaj+x$C6AUN>>)Q9CP zVK0gjPL%9QVxKDv;fS=Rs#&W5u+unUe>j+3r~sZ1ffbrk!Z2`>Na+X{tWpRmSI6%^ z_#h>tnm?i>3zfe|Wzs{=1(*8+P`O0KVOcOpsVmJ)S5nM=zsKp>srW4d@;O4uV&4>v z2?#-99L?5P))nJ8NXELC3~r#6RVm8Jq1hqgb*c3*H)_@Xm(gXhgESwNxexE6vVO_$Kl8~RFcsC zZ~#z+48m(e@J^CL8lYQceCXN&G&%m16H4SUTh`2Kff6GqNy~td)VBBBHYxc^5C9hq z$ktMA`AtQUW#q_?N!WmjW=vrDU5OWj-%2onIOElPC zW$&#^ju79w`RwAy$hBlJ!eWYQTbGI`Dj8~L4?{3zJm)p8SgQ#sCsX1`t~@sbu?nV^JSiF%1+0vO?qRv|I9AeHa9l2=_g!?4`_P9zgrEDl zpT}?h=Kt_a#o#GE_TTwKoPGG;d#{`EG#qyTy#8J{;%Pme5e&Y+$DQ}O0Z+qm@k|ot zT{&3(ON=_t0BTAJjtI}c@P1sJKQaIW;NYl9*H<8l0}({ZOa70^0C8o*SF+~VpaNXr zfT|A+GKDaRye|hAol_&zW10fX#RJGOHGpauL6%XT0IfCWm=&&d8B0#0q9D$>b10!@ zjn-U1qL2`!#vs?q8xZ3PBFAj{#H?p8PRAe&aVJ^sIdS=f3c{`1&tci`EjZ7BLNdq8 zq-Zz5aC0u&-~XaVpRJ~)B9v{eN7gb9&Y=>610j%E;>xpCHf$}*;AQY8t_#a0I+dT# za8x-==>xn5=POXD8tCgFSq7*QBw#=$#l&^c6pIzZTV;DSc%o%CymOMZt&)&coNtFJ zwa|5(k!x812FyqnfcH)MoZ1y3UoB$L{FkoIc?`uKDpJ) zWR^8&LDIl|rr;Pmu{_sx%rtq=2EelOP6jsSnmgc{i5N*Z;J87x0E5nF29?M%DJ(;#6eKBoLC(o|9LyrM2al8^k7K!JsR^uXpyz3TgR^0r=Q^9~;gZ2R*(dqES0l+OfSO~%yt@I8 z-;2VBNNk$Agk)5C?+q*BaRm@KfYGlTR2v|zgb`KAaL!|i3&NnPKCrP%#M#SM7nfRK zRKZXy&jPkHtR}InbUCdki6wPi@W>Lx*MrwsfTXTwa2&+ZK&}Q?w7zZ8;JgfK%?{Ck zG-vzhx-ash02m*yHYT+{WdPeAs@a76%q++2rCw`FEIF*TPq{QsL9IOILeLCKUi*R% zma*d^0|vSV``|?#iQB>DJ`&cI%jOKjAOXY%?8h})kWGX6nrW_Cm^^*~?}F^#yiYo* z^{nUi>#wehX8%d>UF)T`@-;0utLrMHjVUK1t>}8OwSA1hbj`mz*W_@OtWv?CkCGuB zIok^WSZRj8=sx|S*+M)nGl~IMgq*7FC(d)gU1h1M(zR`7Fr|?z`+p|@jv!?zxE?Q* z+#t^zi>fLqkngM%mC39YDXW0mh(A>g4Os9LVs{boT5Bo|)gy~-SF)~wN@x&;BiW}? zT;co(A4Zh4qGm#oKF+0po_`*A@Bs9__XCd}0jD=00}_}<)OCfs^&HZ7zJ=lW7jXFI zTbOP?hr@$+FrA*^>iiMrVMJV4cmV%A-Na}A{J+72hZ=0h=4X4hHvBkx_^Jtb!&I75*4m%?{(7lTjE9EmY&R`fb+J!Iw#}i@9p(y^Rp*5 zxXs^s^pgGBRt59((f40{^?%2wKm9U(^;iEb{O!N}Z`&0fK3wqN!Gf1xKE?g}5AlUB z{9}CL6F-EPUOL0Qd;byc-u-9z*vCEu0QlP19^vlYuj20AKgPX#U&m{&eH^d7_Ok$h zyLbQ3Yx<&We(LYqHU;emG*ZC!ole|z%{YOR>3iL+(J{`3MWnkrJMM(R{TfRpvwOHFGf zDYLy#MoIvh&F_6+GH&;Itw0ijVkrfgiuv*^TQ4=+Q)G}z?9%11wsHm_sa4Ounu6wD z?93#jbU=Yjk9A#{xZoY)8j+Eavcu`_#FqI|3J!+_4<0_kD9VmT`+@v%gxlGIynxD-fg1)VCBMbVO~nDlGfnfXGG!>Mj52P9IN@C!?)Y5G=WlQc*bqe(xa}_&P>~QT*CD&-iydxg#8gtaSz-y4IQK_1Q ztUFLr4HFzxJuOLGlvU0+-i8Vs_6MYtu*8UQ7?CCR;Fw`#!-LDIv5mVH9w7>Db232d zvszmz*~8&r>t>O6n^TeaXaJEj``peuB7?z{OLbl7*Wy|s{vgNhNMe?inkr4nMPhku zyXe}l@#w~{ZTI)V%b#tH*QBPt%p=fLDTtULQ|&rTkh5Y!)6VzK&|ZT~GeJw3%Q{n9VucYf!0@aCJ} zz_a7&JkH)wOFHV(5iYtTtU{Iz9bI3Ui<7D>=o|Ow&NszFv3%qlP>%tC) ze0O)k*(+>-uNL(7!2=oQ0I57S0YHjUmSKfv+Huyd6Niog2(4#N0)!+XJ!t6!HE#D; zmjHly-kF?STvwc&oHm28&&KuxrZ8YR9B}^d0dip$^)QS`>w;kzxz<_EM*(|&&SQ{v z8?3%A6R$sr2#1)lrXqxhmSwMw)Vi+1G%y52K6rQmN?Go0#lwe> zaO3O@^E{#Cf@NLt=+Qam-HemnV&I_<48CYN2z{O`Z0S;zMeUJO=1djmaB+TaQgu0J zEbD@lGEPrUQ0s!ja=<)I3@ESc5QiaP2m#|bVqG(KyB!`~T)=x`r>YdJ>xy~D?>uHz zlxP_%=jWG*F<}@v(_&pE6T~$YgOrQOyQxzMH1Mw0#-;~Ez7h^8bs&%PEaz7l;B<}w z-*i|cqf`_HC?Lj)oPn~xg!B6*{aIU`X$7SEEK~&o34|_orEKRwf)C3Y@!-KjIPY+Ja$?ym=Z`M1Kk&Of zyTQT7i;GJP!+={iZvX(U_IvE+*@BQnEKjQUpQcgj_+B4C<(iHviV7lEUQV!*)R^c++W(drvWwRR8kvAmk+Vq%|eXI zO-5bFE~;4K$YEJH<3^<*ORZL35(q}^mSYyI&p7G9u z2bkvxAp`-T6DE0|3gi(ys1Rybx`Q*eICEv5C+?qGkyZ{~ddKpLDP{|V>Ce6ehLNoK0yOJ> z=7_WFYASFP5VHiLL5O8B+0+!dzqf%Y9+s z;iw)l%h6`+4-0CoI6c{6jjILlHK;U5si@s)Z%io*`6FA#YHu@cpQ*Rm`e!<<8Sk7&c%P9T?QuBp zIFD<@yqi%A2WyK2O99|yHv`~tezo88oz#1d(;bISii06|dB(d41 zaqP%9x{ei@M;yF8EGye1-eU+}fQ$nxhY?}f@A2TlH}Txs#P_3+^6`z$biu9XVxt-jfIqJ*eE5MCd_#>i$!JXsd*vZR@W? z-MM`~m21AQpZA1?o($0Y89iv;KTqFxJ%ONh-_b+wLpaXZ*Yj4q{`#Nd_1FItfX6GZ zJdf93{}^6+=>~4yn((DBF-hQSU%SA)dvD?X{d2tZ(iv{u8u7W${g~b5_1FK*+I9Et zR{>PK_S%1d*IxTsyz$0&@Wvb8+&q&$S3gd+eSuAzdo=*DJKG_}Y~{C{XJF=V zScHVn$qJ~z)zuX)FRyTVdcq_w0ab@-uyS)GHa*+$oJGro09FeM6ig8?#so=NYaNQewN}d+$7C zyK)?%^H537so6RD>0x*2D$o{7ITq3aU2FFKAQSB{fTl0zkJC zmIPIga-v|VgjmA5tU&N^(jMm=uCDfoF=Dsd+0xAR5c}9wfKMGqrDQIhP^-LmPJqyU z$|=JKXa2PU)PSf0Xy&pJQWz!WWQ~F~M+_7sV;&%CWkNI?U6m1vDK-{3SptIhaKnHY zRV6LMRVl?)E3yzr56fanG~RoR-TOmlKLMI$&2grRVnpI5>klhgqVK;}Cel23_z0-L z$;nO#)xDBbws#(aGbO~78Bk{1RtN-Dm8)8OP{)ium-bQafMq8(P*Sx>iAfPPl`&O4 zP_Vd^B4jBZpE_1_jj5%y;y)EAB?$=3DixY6z+@tBbEb@x8!;>Af^pD_nq)a#X!diTkSbNuj9=c+X^?b&b$6F>7q( zBPFaJt`1mJ3W|HdP?i^S)aXYY8-70^W9ldA{)_*=TWu(M@|@O0Aujpf{$1{S#_v!fPXWzPwXM^`$IreY=;d|YLr{ahy zBE<-;&!-u_Yg{cGZ<@Kxz;d}qiYvxxMox*D=YRqEUg~ivU|EeXt*p?BFpM1d7elIm zFpLv}|EQQIu6vkLG~-qsg;GDxe&m7cVqA`-qsSu-%6&twL-Y|~vKHzZJ zi+tgP>?Cs;EzqsUHskI|#DeQG09z(Ok&K1r1S)V`B~WM*%Fwp7jN)mY4HU?QgZOKV zn5Pj}Ltwc>VJL@z`)l6KK+)QP2_;sp@2G(rB5_U!mOQN0WY#(RQ_EfqCiTZb42KZN zjORhX<&q>zQIsT{^i|FU=jWFq6YY;!^Qc@uZkk4{F>zLlfKUX&?queGfFq1!W3OvG zm(UpSmPI20kPsRJ-GEv&)_2L8F`Om1mZa7@J6o0&;60qmS9W6}K^YzZ03ZNKL_t(S z-F&W9GXSh+9>DKz9J#E3^Mg3|1(`G(SJ?Y}8fYd&)1#*rmDS#DD1 zV3B~CB5J~5Z&}dCfL0GaIVWQdkcAb~h$+jEA50-D;5DK`QHk!Fza+{~q5nnnhPrwKy{aK7LM zok~z({UJtASJcz#oFEj9 zHRAGej~h46EZD{C*npi#CFhcHc6w?-KJOhWJg5`_ERv8lD+USLTg`fTe+<4b0Wswy zcw4prlI}I$dt6-XF$^B#$UsT0;7p-Xu`XPu2^GkNP-@FY(*3Is@@gGam8?ZA+>f%4 zn*6PkjIQ1mDf)(ilG!HWQdbGJFrks02kEutfpzba5TEQb*V{kabrQ83cSXk=um6?- z8Ui9JtL=boO;wIkQk-2^+V%)-~ev^u)+DM8x^bog}i6?`l&# z(&xGEnbdw#07Gqr-EL;7Vz8{S4@_1Xr_p4tiD31WhcSp$uXIf%jH2{141?7@jwykL zrdpw;g$RU`9hWyt@c=J%vVkt(n+vKCumFes;UION2Ym4T?`w)8H*Nsu=b)Rnf&Cug z>;@<&gxx7XgfP!=;|RAd2qXIs2(&F4=d4_x>C>!kj#JNHT7*S04-P6+7F-)7mnF7A`0cebj{6;(->NR?z4g$nc_tma@y2&>|NaGDdg+Fd3hvx_5ih-T zhEIR`-$Z|W`O9zNl~>*;WP=~aE3drJJxgoXSHAKq`0|&(j+bA)jh9}!fiHjg8@O}l ze?-gv*XJ!bE``v)kF@#xI#r0CaH0RURg$<);h;ZX|J%01ZQ9$vFa11iKG*N+K{!?^ z(C;d#qJJL!=@G&eKJt-MeE##lh!1?=Io!T|LqN8KHAcy%axFw(;hRmwm(=c$PE!4%0O0qQ<1hBQh6>4V1(O;k{mM6(((xkz$7-a4AT~DI;eqf+g32+r`M=WbZTvvp^Bz6TAO)8#XB^E*mraUx^Orp4T>n7V9hXttYUyvgM z32S9?0nmJUwWXJ35d}ugOeO<|`I-q%falw{ZsM@0t;waWa?T(r{h&Tqj8X0-clDQr7FU>Xr6S&Y3}M^uAY9XCgpA;bOLXBO3y{6Nx=ZJc}G*nnoey zRUt&IQc8;bDV2OLxgeIv<6Qwq8E?bjq2-ctDadO!LaC}OGT19NT5Yz2bE3omo@3KA zSt$wjXIMw%+0%VNOGM1$$m73g!WGAPIOd=V5^bMkzfyc`@o#lL5>$ai$9b~Eqtlal zLkeq(0!&EZ^{|oN+j&apQWX*}s(*c4k=MFv?IPMF7YWfxO@<1N=L8`(0PX$lc02sS zFZ?2Y_ji96Z@u*vo*hr$asKABq}zAv_~>Wfy7N!|&Wrcn>vlYi$1{S#_wTs#UN_)r zIi4-1@6J(6W(Qd^Th%epn$c|hau&EUAG4GUP-C&=j96C-?kiwZYpaJlgrOOD0&a6@ z1U95g$sjna%OcLc!)|xd0pS%fu9$Zm>`h%JBLI^Ij4@(a4hFoU0*IXPhsp#8eij7+ zSngcwS0Blgk;p3xUW47Xnk9O!(lJ|3LzjwOyhJdNnm>z5nvOv z-U65W3`)BtfLOhOXkbIVHrX$A4%M(_P?_1uyB%lBk{G)>7RHf*|M$J{g568OpJ^J| zK@f*ejeT`OG+Q8-fE?ENUT$f&1{-qWR4tUSZ=v=B~Cs&-F zvcp1-ERdwntKezqz_^k#igOsG245ATi6d`8_R1&)R2sR@T2v;sF|x%$OKTQV3)f4G z%HS7Zle2?ctxwG)Y$Ssqjz~o*EFDfz_B99oLGm`c`Q^JHl!h6jNOl`JKpYc2`b-_b zNzkjx_-9$pQEExD!*X2SL;INPV2iWqJWw-+aX=}R$s8hQ?nA(>n>VnmD-)3TN3bee1aBO5vV)BZYb%epcATp$DO1Qk* zW_`qJjO5A0y)nvI~LH9ut_8R*UZUL_j~&=;xVqZ+VLfRQA7 zVjm-d1V?nWcb0R4#!A}hi=2|d#R`-aa zYN6|VPnzI*lTOB~ILwumX@+3{X#`5%8_7Ksc-BB|luQ>T;Am|`ehvoR-uJ@ud?_LX z@~ELX`noTL5Rf#Oi?+7Mm=VHc89Azip|XSCIfNltn@9pIM1&|3`(6P3S+db;tvKut zoZ&x?EbU6b6sA@RL;}bF2gP`NaG-M-SUsriolTau5%gsJCW3dmPLR!gl~V&;eDUiA+1Z?WN?ekGX+(3UuLYjnwpB$HPrwec_G*h7HHGpSRYu` zV2uF@7QCsJ`DbJha6gn%OcIy(2_A3j8jWm0#0owfcyt&iwnc8=x@nm%DY8`R3(wyM z5#jRciq|D@5Z6gC(#srCGDl9uB$x^4>K#k)S%N>BEkuq)jYb3MO?vjQtjHQ#_Y@zyB{v2zXM)*L6Vg_A|X#pONmm^PY4KZ3k^W?|%}G$qG+u^L5W#(SYi@ zIlu3F1-G|K2)%kjuXM1z25rvOL)8EjIM?q~+`IQpD}C_ltM>p@yzJ$ELJH9HKDnWnFb!3n&N#(lh;hO7RcU`@=v(Kk#!C(EWxADnO{uEyR zS3YDVT1qK691gM`2T^T`VDP`-;^KDg~-|z~?}Sdt`QYEfvtpRs!xo34*d_vz=ee-tx`?Vgnrx2Tpc?07e8v zQIjIE4Ja3cFqo`=trZy%1u8Akz++tZgCy&<+Mhr*J4Q(ngr-iHOGd@OeyL;9^e_gH z+hJW-TwYx<2<=$ejQ#6sdyB?Cn8d3--hdTkBue$6opbQx*zD2L$|RH+S+ZMzNPUNF zt4Mh_@y)pWCHE7T(uhXPZ}u>gQFNB1$OJ-_geNfhmlfYgd~kj46Ou~3P^cNA)$Z(GC|G0ZAK;Vd*|WFqf*5r zB}9@a4Qf0{ZR9EhfFTS>DI&(z0N@x`Ow$BaFf@61Aq22(=a7ro#aae37eEr1N-Y+L zP#c>hj^#W1n#7J`KZ4(zDK)6wO|5j6CvQMKLDf`-<{QcQbzaE(DPbI1naC_^cOdpD z*mvZyaCLPhB@xNU+K_8rUS450Po{dHv7ZzZ#?i4tMNyT6EWV^S+f@nk&hz>qL0cmt zscM9-r}H%0`l%%*G`6CId?k}mr>LTFK7Q8{#{l~-gY+$z)hwbeP_2B6Dswn$F-rB( zbsl)MxQP0wOyGC+oH|BSd87hh;<}W811CD^`=h{fN=qcVkq}cOwwn*`sFf^3mARg< ztjXs88dpoS7(zgjaw3{wMdWRL;iQumztA<8$3!DT)Y2!_kj*84lSY2@M}7n!|MJR=vpYlpJ9 zWRiV7lRE^DOhC}g zc~u;+8p;Ch$0qTn*%a&mH(5G>!EWyx`9J|cK(j2{I8*RYos}bkj`uQGB%E59Q7$79 z>b4kwFW-wXv9m36Rs%;B4Y1Szi~^U_IAUERQqCBH7a|E~NCY(vw(ftPVGy327$D7EoC*40AD$?x6jyx0CNzs1;Bw*y_OQc$T5hXrJkU+QL~!8 z_o5!7BqJq1z?29yhOSvTOwe&Ha3BF&Rc%-$n5k=omTSmCaSHZ}s!q{B4GB;we^XWU2?=lt2B8^3T4KV1 z;71)}-C9&-?I$?6<khQRgl29q4VpH3=EV3p9QAtt4 zU9COo3pR%=$e$YlvXSWeOnLwkY^Sb&44`2Ioa-EW2RM=}m};HHL;@uU==X~g3jPQ764=5 zQV!EN;rFgSj9>lkuj6ZP4tQK%z6ZP&$lYdUx0(JpNni`G_ZjF<$|k=q0J{a~dliN2 zj(!E&wyy`?x9zB#bGQF~9cZr-{`$LSrT5oRFuHHcw!J+uK(DpUZtubL>kj?5D(&!c z@BSG)7}S59ka73!pWtu)&7Z(aFP-7lSN{#%z5CDb#v9+p>#uvf`szn;>(+=@UU@&h z^rc_Gm%se=qicNei(kPTZ+si~??1x*`w#J@FZ~i;dF2E6@|VAkFMQ#D-8^%acIdm@ z_C?>;zf4_X`yAW8?(f-OM+p`^d4SORZ2SFs&1VV6iU+{4N`c3*TE%u;4%m_xhzf4r zJm9B)`eppeuY3$IzW6@&)x}-`fN`8a)UL&ZM7B9^+&HtcQbG3HX&m9ezA8E1<5K2q zVz$o)_~5$ryREHi&!~KKN=dwu%1T90zYUn?8KDLvLNqcgj0^|@s`y@204L{M2V#{Y zKWv=1yqc0xQ7SI4t`I`NJWXcDyOP0fK8f8-AhEMR1S-6iW>F(zN$-M^ge2DaK5BQM zg8eum)L8A!aU8~*eKb!q7Frsap~!lllYynvG+|j*q?EAVFBk_d=M{Xw;jl2sFE%^L z-UKko*UGBNUKdmAUoU_n08Ar;j(V-&JjgTX4DenPPxAr!Z-#SpPb#xZP@L0M?^!lryLP(oSk7^S0hNMeW$*2E(NY~ z9D!@2YqiDX5uWBR&Rs71C z-<$T4`ceQ4h$bV6aBM^qLey3cgW42*ECgaR34vkL)*vJl^=p)9;E2^3O0A}lSj8rw zK<0C3Sp)X-qxrexIItalSP)Y(|Blr~gs>*@fKoIGLy|Al9xXr?Dg3Ja>b=Fy#&KvX zV+Ri z5(h%S1_U@x076vY1jqvr{gamlAmS}Ad!JstslpPVyR^yQWVHh3)UlsA8JY> zrAV~c-BoqZ*?Yb6G3S_Tozu5T1!$t6LT#W>_nv#sK5MVN*4k^1ImVb;-k}chgsfGt zJ@0nf#raCdNU0T3_wU|&_yNlRVB{Z`2MvnHkf_i7BU;1NHHBC52XP-O@V;VQ7h9v8 zCZgw|+zf^_wFzi~$T*eGvmDz>L}*T87w4S1Ocv{BidY2Wnc!DvbAcXMeeIS zZ^lxbfW!*(G9y>Hmy;1enqB|R@q}fbWb8U1*MiAMo4*u}g<;+0^MifBbxhh&OkBYE zb%wpU?kZYagKK?n&#_hNKvHRPjdbyGTH=SU7fl5##Z`;{I_bLgu?v_h17jzag=rc? zk!&zx8-`bqe6DkEUKV`pV;{#)|MXAecYpVH@#J{?j{Beg`6mQ}cjkEhQ8(amJuV}y zC&xQ?JpZU0@HiY#+zZ~hLxPlQ8^V&4ZSraP#l$$(oKu`N8R#rA$c;_TN!7Q58WWv) zDgb5Z8(ilQ;w0q*bb~uZv24ycq2!E`GxmMM{Wssh>3E|_|7Jmma}KBD4Yqy5Jk1s$ zY}-k|XYYk=-#Tm8Sh1~HBBAQ{Z`+1_6P1e(LG6{3IT_HcfVSnb@z&bdAt4^g-|AO`xlZ-+%sS4akVwV9jzl#>fj=w7yU#pN6n8a;O z0`gT=3r4bFyU7yQc2bq=eGk5J&T5G-#0fxM0hrcfA{MZuzBI1~YdjAb{v_FK+ipo3 z0&Pb0(4dDk)zDxyLG{!Z_g#Y1lBMox)_!Z1QhnEzu6iAdsxIm5K=KX)c?Lm^0lzZY zosLBk1ybrD0_O@r7hacFP$*7OYo*h6&l^A}^GT8uSuNnA+6y{WFj);i1q7K0tgYIb z1UR#yq}3r4D@+#e`);)pizfGs^rOG?oH0hN4=eYfYJ!$v3d>)}+SL`W<5(jw2~8ST zZFd{S16n7D$XJK(1PPibi*uPU;!m3`&uNGs!jV zo4z*68kKX>#GfeXgd8GkInXp2h5-O*rnaFStb@b8Cj-c-)GE0c!Gu<&AxK#Vj&rVa z>mqBR0Jt(|q#b?EPgAsV70Wy;(EkRDg zit3(>4c=qhlbm1I#Ysy$5D;_(rt}$ZAgRs)j$BhxesEl=C?z4M6LRXxSLYp|wVm}98P{P#g@+3f({hav7dRiKWP%THE&$CL z31WPHk89QC!LdH>iR2k5HMjG2MB0yVu3r!8FqXJVT>O0bcNvonZ{B|(BthTpb)~OJ zAl0!7l1iew;=J{H*taA>@HKvyrH%DH%QEBY`byPb5l`K{gJqtOQZkj&)z!h06a?^H zNBb2d=K2+JI2;gE1kbBW2^@gDK@+brVS#oz6&4(F;D?=2Uvjo;aZ*D?GJ7k|G@I`h0tB9jPF zht~S4GWb<&1@fC z4-(Fk*9GT&F_ICaEw8=yI{wz*`o{o(7hn7yyzhN?@#2gB27dNuKZbkvX8YEUe)RqL z@gM&_+`G5hYtKIW6kdM$pW&5Pe%nX}0Px&%??ESC7<@nc%n z9G2nz?B{XpWIcBtUgP(ZT)_8m%#Zh&pBu|#Y!~ex&wDwic+C=J@;8Y1Wa+V&oZ7H zpG~E900{6_cyH6<_DUF9$i+Q>{O~~Q(l}{*0I_%wy~s~?lIuHQxx}3j8lPrzgVJfOacepM=>!QqF3iWr)~ABP#0{) zlBky46vh43;b0`-DMlfgL-$ps@1MNxU6RI0mW*p^p&tBMtU;nI<7!c-OYA_bBhxWL z`*_%6isb}KVSFNF=@DlT#eOGq)Y{JW%uIH6?4r+? zQY5(?f<8+f1qxnWNu8;(X^r2B$t2rki&t36qGXAg#roYF;dosab?qEtPA4&R)tHv? z)TFLTjBz?{r3A@oLJZMLwTWwGpJU$Em+mZ3mAK9QpCo%_9vdk>cqP6!+v6}c7R*lj zXNq=y`JA}r5$7Obf109}B9yW26#M8HM-Z2^;r+9g_tfQ1`@LTW740Nk0PJgL`^BQ= zBS~InOiR&@IALhHxLS<-k#+rb&Z&!M7ha%sLI(*=w$tI-ZgF0L5Yel}7IeCh`PIt< z@bjhCjw8b9ezB9d*hdr@2)5M)L&PS6VRn7~HjV#?3Xt$R001BWNkljw2ZOKP@u5fEfXCrDe(~2HbrT+&gFzVUI+MM6IvpjzHU*Oe1tA96l*fq4cY8BH zm6V$BX^^rALP(f&^IBDHCIJx13AqS?ptXic6^NE_a$X0I{ULqG_tB@U0r8#FX* zdLB`n&laFflLrQ(0HQYqBUa{e$6;Nt?+M$!8_^)8q{Maacedt_xVQAi($unKq)1dw1YGzP%E9-3HU zHx1C)=dFoF8vBEcY6i$sn@yoot#f!hZIY1HzRhZ>4J9K$>mv&>MZghJp+o1C03HMt zpvf6Y+-7qIU|=t(T~BV%0-b9 zBpX;n;FjxMZEE@0Yi&|>Kt+dh+P}47E4u&_lc=qP#37CwS7AknK}iKw`<>-l1h_n@ z^*ifH)>4tOICQMbjFdCBeaBOG?<&Y5sNysQ1w6%VXI>VYy6mqI+F8jGd$u(JQ#q#z z9QC!xDR>40Gy8L)lVIRD-eJU*2M-=1#E5wk2ObiSs0Nbu22(-^;L|#Ji1xTjD3JT! z32o~-Yl1-6M@P_RaNhyvIWE?qUW%bBwp0P9&j=mzx-N>{XHhVEOqe_8;a#zHq&TWk z0!m3Zof4LH#5U za^KPbLW^SwZJwtXk@V*f0=9iuw;)+ZSd)|h=a?urz(_jQlw)Y7gS554OKD|Y0|CJ^ z_3r5Bd9GR&gboo->mWHDhw}LXI$ud*LV;LK##bGaPV;X@*84JhnX{kA*C1o6mV}ab zEqgS>`3bEFK@@0krYt`v;Bc`X_gZ6n2yXY9vQEb~?};QtN%ZpG8<_fKuj%620okvm z)X6#1G@-eQunN$=u8TSRaD8f!wPjgmJb3WX&N)xA&rW-SI5hQIt*tgR-xZi7+tgMu zPZPZNIG#3La~kHk1E~agOY2Tm?6+AhdSeXYXq2;5ch4Cf0+P3s;C(>ecT6Fo=7bo8 zlofrzgW~aDwjag+{OWh3lo8ry(wRx|QJu~A>=&<71>Ti%a_~HD_#1zB!)M0?F@|$o zk`2a#$>iIP+g=|N_G6nb4>!DTBvM=w8hBhf42ON$v>4&+^$%fBKj3p$~lno_p?H_|4z^p|e(f<}<&JmtX!DcM=TKl&%|;Sc{XKKjv@@yaW|g=d~whfiMi>186GZMeL5<(Ajp?%v_z zy_W#Hk?QC-vIXXwdx*U4pR zlhQEr+)MF=0Rw2QyRXqbiy{J;D_JKk1~2u~jCW4!NPU^ciP4tW6UF@pW6|6S+ z>Tv(TL)^cAUxXCsNptQ^or4hyypknJ{5$0h(;V%6Xg!uVZJW52X>yhOZHo(BP-nKD zu$RQChxZlHN32oHZ@Iy}uT*T?2JgMpe)kfSGWjRhUvaovrQDq=jFx}CjT9U*Q(w>a( z(;5J^K9}p>jX>ud&dM86sa|VED;d|Uu!@0Z;)^7SYk9m}e!v1jrgW zkXxmci^P#KcC#e;8;nq9Fl>5kMy64+k#`=gC?=z842fqVijwC7OOn_+rg1md48gv<&S`ZL^opx% z`Jd{A+>{kNNW+>)Oob&3o37<_Y74&OuBC`Goo_0vA-)rX#eF0(jJUS6RdB}UTze((2w4^NKA>$rK68+)gYdmsGd7oPh^fBPF=ebfzk+>R&Irmw>B!B2kS z`A6M`$K|;H`JaE(O?YgMX`W?+JI`iGY(aSyLco~xV`5DK@A5hCv91S@oz28Zj2axEX`M%5)r!s71UQFjUNA4K z*=LLLQ-YYRjN!gP4Hi@ZOsGpah*G=VH*_;k#%eSYL$O2{6@{%<>0b>FN5#QyK>MW% z^z!cv@JFE9*t8lvQEi)cv55|rG%FUol~Sz^qSNHd-MiNyn>YpmVL}MFIUYLzqKf%t zo^d!FG&v#)-ddziUTwmdPATKfH}6ZLZ{P9o;f(|cd%~8artvh3l0#~3_F$0XDGcmy zGPB8a=lJnnEcPGX+^|RBG|0F)9~1hqmCTgW{nA!L-^?$=$M#zJ?h+E&HLw(WR$bL{U^#5$jP1e73x?r+&--Wy(ffsN(Z4!(^z_>jnoKBnARfA3p z5^!B#Um>e)A<15zIBimf#Oy~E#EK!{!NZ3Z?592Hy@V+%9D1@+Trx7Y zJ!!uND_b#X0uc(fz`>jp?%uhU?z^F z!yAMcaC1DNlyU}CP;nvzxo8d$QZLh6c><0(Cg~&*EP zy{fI6rfwWU){*DRzVB9hlh5p;$?BA)K0Fj0lf=1@9hP~9_W_5)YUCj2 z98Skg)oAK8Q-z>%Jf3iKb27l9>NAYaG(z$y+Aq4E4oOv0ia4H+ZZO6MH)-W63)lPJSRw3xpVjq)Dohd$dK;-!tKzz(C7F!CqI)|ZMCs(cxG{;UU(zgGzbZ>* z`5?qoB?-y^mUYBZAWBZ?S$2#j;1w!RlKHz7^%2X-1+yt<(f>fMOCG&_uIZ1(Ua~{BwEh%gjLCP z+rA62a@&mncsQ)4Qp&1?6+&fqpV3JNIxf&Diu?AY&+kBmp_0yOE$~j0CApkkm+WUI zO)RSVZr_n>!%=Oe_fl}$ca$cMBh5M7Y$wzP9QPBPclf*cIeh;Y|9kvTuYT7+E}-)M z(oUbRwc#JF`|I#o41cFep5v|!?{(d|Q#DdHBV|e{G5(8hmRO1)C{`v!a z<}<%>cEvyUbH9!EzyC9M;e~&ImtX$pc=_djVSoGRM}HC@{_y{TS6}@D+`G5pXMgsu z;H8)T5cTugCTEs>7nIBCX7t zt_f7A($T17B?x+PQJJR+^Q`VHn&i5^xtCA4!D*pq|eBml^IOLv3TU~UM#rgtY#kklZh4}!XiMSF%xDG2G$ zkpR4HyY0CgTo(&8Cajxb7a|@>7AsQWKFt%BWfmeTM-WSiDaJy~z!@P#+Ruk2i3R;{ z&0_Fg&hFe%&3kXLCLNoqj=_|(mV|^RJhhD2pzw}yvby$t-0Hv59U)>6w}co3TUgh{ z;?-qYluR<6Imhw2-JPnMISiamCykpGdr-HCuEv-D_ie}VxS=RnfaFqn&N_1vtUA9L zFL94w)pbd_zu8`yP87%E$zuHDNqz<-eqg^kT|QW%u7M6BeOoX4TW`rCMJ*N5OJFoWgh#>K17S<)}(A|(rpmJrZ3 z38_>`BSEm;)3$fqMdNXC?~}1W*A>oXN8HbOEc2v&EX1Ldle!-Ey~4Ihyn8&JaN5;v zwc*@FQpYZxCU{Y!+n-n58tBA#@3qF2r!}XGF#4|aD`TK}LNgH6;^>=*7ci{QwKYZTK zC&y!P>~H=y_WQr{sGIS)9M3=M20V_(69(9w7f~J!R7_?BsS1FXS7npmN+M*yd$TCd0COO zCJkG~&BF%(fWy_bCgX}hLBfufjbqkee&2Ud4eKV-90FP|*RU=J1#uGqQMF5;JZp2C z1=LB&4ow{ka!wXxl+1dJt621wtmPpboCX2YyogPm4@hZ8-Zu@ZCFrJQUOU?a_Je8* zT)f_ISO?t4&uHw5qDh;1o(;TCrI)c_A|I-j79d8{;SAhEP({hUW0@yYGfS`@tZzq0 z3GY2hqb;5UJ5SxYgAfDmKX`~`7S-LI>udPH(gnQ+orA-Jhc|fY?j8NT+d*$>H^3le zVRCy-o-=4U9M+zgt<4fS&N)krQ~kiBRB?1zmKk|Z0+=Y%*AjkS15Plh*uT>`3B)A` zt5#>b)QZxYGUuCZ?#230nc78aZckHJfB=%j7mIHR;;C{DN}{29kjdPf3R=r*NvY?q z8D13@jY$OnR1eqM5GPR#O(P(nfq3wu!Z@Bbtjlb6nk0U(9_BnvXhBH>kg+HIBJWub zQt$JyuGa5W!Ijf#)1>i+JJ;7kf-EDn0PjUze&^1$l{p|;C#8&ejyi{>wq4V)O*KYQ zz$b*&*!Ro2z`+?YBC4f+R}2xP5fJroxH9X?hc`EPabv3N?LpcsaW_x12ExTu0Zb&7T7fFA65W0un#hMG*a0BU9;egEY$vHmBWOjSk%6)S zPI}*^Y|AdH4SncHtx0kG;Q3@N%6%PCdtTbqZ>L>L5y%+2IcCh$g!}g&;O^Z!0)|Hc z^Tub(gNHYG`rcE>N!EjI`CC;nBMIR3u)=vEf0SHR85UHH08Ep7c3Bp49r0eilO;Ne zmRX3Z2BQVO1LrSa(-I!qe*%b5u}n9YW{&Q3i|rX6-rS&+ zf^}U{inuAE_WHwgiy>gjnz|&IP3lC!b*L2~eag@fr>UBygpqRrA&P5&^8tWIEeXC+ z*%;7DM#H4wtX`}0QXYXlJ-8-Z9=xvcpi0O{3`E<|FwF<}5N%Ed1HgMy0dQ|Q=a)NL zYqm}?`2p9Rhn#cR_FbR(&^_P(zwdCaU#lgV^xV8Wd#-9XaWCbZ!yJQ+qZlKO>h?qu z9oHt>=2ifcl4nv9qL(}$JyLGwu2WR~$9eCV41y#HJb~rVlNeHdDB2$Lbn_6wIh;;M zOuEN!YSWw2jt1anJK>)mukknWU*Yfn<3FKeVN5uWeaU36rLb_Gd>!9ACbO9=uNS|M zB!lt$+{J5`ZD~0Ft}(gmF5Y{a%Kb7yJYL`B>pbUes&seDXV`xv)v%8)i2xYdaY-_` zbS-eWUD=?=bn2H zUU=c#@ZyWF;`P^$c;%JP;S-!@3|ZY<7;%mVE>K84!#!A2?3Ya_txvV-RXd22Y&Zh`rx*EciTbYz-_OO2irK_ z+w=KzIPCa~fAL?zU;fMAjc@suuTv+Tp!*3SRa>kV=z1dc%bVK1Gj|+RXQ{i|DuVNv=1J>O%d;X*LU4;Apv7j%XmS3D zNSY{@I2T4<2Vmu4==`$pyOFtB3NWcKBBzY|rw3Tq6?gC6G2$&iqI|IReOVS;b?B() zsxu3ENvv0-RN#7Y;zyrMk6>pk$GhGNP6|Xu8)w>DYD7n=;?~*7qS!##C)u zS3Y=qHkVQ{FXLX#*?kD=q`;V@Rv~J8*BuK0d5(@TARQG$3}~uyu1Y=)!7HIuN_haH zu;(70bGcS^m#YO?muALiRA;|=|AFjbW5Cyb?Ynh9Ai|*-yg4H{O~lh#f#oG@#jrPL z=?86rCSyICVl=bvr+{6B2GcZK*+Kw{J4#|yNENbvl&WPOd{8@kC>H6ITmZ!>luYBh zKqZ8LVCN1Jvnr{i)(Q_9YfZnC{U+n7A*vf1AC+9w09XmoPACCvr>bih_hvbFA&T99 zCWJL^2XO8VNY#1_h=5(IGDZ-mh+SPPq4SHFmo%k23JU(p_el&T&Q#I%`4q3vJ(BAd zi8qrH6-ZiQ?AKb~70EiQV?yIl62`gbs;yzyl9@t^9ZTeL4QVEVa?azlZHUvPd(DCe z4{xx{Gp?=z`U~u+1_TEthRRhE*7-3pr*|#%OoPha>}kh5FX|SM zBnVf9I|I)U#j4r+V9MU=1QejMpg4zpJ4rhm+0GK&QKea1#XK))sF1C~|D21cZc_%L zkWivoR7&8xu0r-`F`81l0H%fp&K1{Fm@HW)-&4?Qxr0X*huG7y0T6z3hnz&J;f@#QO(-U2d8 zE%=N{+f8*zcfH71mPynwDOvj&WC|cw)%IOnK1hf$o4?v{$_euvb^cO4r8e762q46> zd0q!+>W$oTFF#T$LiB)l*iIX+uMU>5YOUe0u6Dl!ywZSOgL1jQG9L}FDFVvOla$J# zedE5%e5VSos$F2M0>~6q3$ctx$r&jpv-c-~=9#DO0Zx+PT$7!HkrZmv(gq4p@)~n4 z2A)$97ekOWEzr)fUn`#p&N~DIn-?TKnX84DF;e#`1U*{U7D)&+*O2zq$7B=70D&~1 zs&Qy3ifDiYK}tz_S4)&G^K2y~q~~Ql3Emq>;Q({IAZWq)R7*i|1M$SM+=s`yNZ%V^ z(>mBgpo%0md5&~j&a1;g)cU$M1t;w zd?YYKg2fc0Bov&(y?akd8x#!pKEMs2Gc7IY^23rVF+?ewz}mXbA=hlK1T3B7XPHZr zTG8^EM$i`ys`?S|oo*w%2fUu^>nqe+adUGcWtVikanDd&ll560ha}I}03{c6(u9nn z+5mVR58k8Yf|578Zp~R3sNBkqJvGGnVD3-7Y>Fgij0CCRs5}SGom+T}dziBXJV8D{ z9SRim4pPp>R9;$JSim}F7u*JS^BKYy^iviyQa6h zwyUcHYNGe(R7^E9cdE$f;i<8YdS);gBHRUJ=)H=2J z4W4c+eSg4qk+^YlI^n=N*sbr&SU;N2xLga?Wx@TM2e@9ZaNJH^$p|^;FCE{7|Mlrl z;_v>>pTx~g!&}Q4jLGjYVNaF+n9RQ|0nhi3qynCk=NP{W=!x4fyoTX3Bf)`*+3`GM zQoRj-zb&DBxud`BIz}?Z+m%kZbauedj?44CT{}i{1Ydi*h~u_oJcifu#cQ|q<829e zjsc+esSqaK_r7a9`|MqO<}<&J7hd=*0N~S~{;1FyXD zIXmOiPtW@Qgx6m`;`P@z+`G39f7h7ctQ^5@*LLX)aQQc0-{=M~Ub9EPf0yI4;rt%+ zvzMl!jMXZ-W5IZ@$MapD7m)G^`z`0iTiWDY#(UnA@WVg+efZOV`djf$-}D}o+DT4A zpqn)DBlcd>T<;-CY8t2Br5%!3qossPgg4#949()={j0+ zL2*?{2?6V}D2YK_4kc&pG_f{;BwN;S7gxS&CB}GOr>UV*=<*}v*3cSGN|;2{y+35`WELeL_88miL}GkR001BWNklv0V-4M>0kC}ppI4KTCQB*UPMeVnn(j4Xq`Mj| z_Pdi=@E*k%q|7o-zAJk*xm-&%k}Pqb@fzf|>3#NeK>&_QsIdC-PD`~_Nz}#Y42J?J zED7oYsQba-5p}Oxl@v~~gzW2`mQ5@0`n^uic{*-J)Dt``iGp}=Qxq4hX!lrRY=>M# z$U=82aehcPTi0blsTEU*N;GDf#ejM4PFExH;2v~^Wc(JKM^S9Vh3NeW_Ar)Jl4wNr}i9j3_`1O5$I21#7wQP0`6@rBpPiGl9lSR`ONv z8Oz_G1tSA7z7v5(vywWxO6eY2h$A4Tr*lZeGr;M1QsGd>&CLx`N+JpTL7b=>S>LAHO#)z=1 zoP)KEj%LJQ>mbx3?$m-hMksy;ji|hL2qh6dtVkdl>8kOZnGVWPu!I>IY! z*(s|zrCk~AJ&^FKs1PQ9G0;^M?ZLo!x($$tE=~lRkfo(|QOm_31PfYEHFTiWhk#S9 z2u^BrH;CWUh681RPH%vuCHpYA!`B^E+_Hgjmky?4IvQ$|Ph32&QSW z1fN&i{F~zuVUpydCCyyFhk#gm(gxFO{Ya^~F1C)rdz=(pW5COVs%tWj_mouWBE%-z z!XBa74}MrjsCuT-+}n9DtVy-Du2$E+zH@yg!FA~h z^x%Ue`GdDL-8+Y@z(}jI=9E&bKCGRtmKZ&mv$Ye|a+7{Q9_wQip%sVXSi@MLNieJ!gQzBFa zzz8OI=W%s?P>?KW4M|z6r1rbqD_&EjOF=CNE~wi{cex;_UW(YOv+PS$P%XM%BQz_i zCMwuR6qJCFgRIM?6f2Lydn0S5fLlzkJ5BOy>RO-Y=Oj8llSycDTAqb!7%Ho2SKPFG z(&4b6H6cmxUJ#7snA>tO)z`9!b4Bn1+QJh|jW!nv>P0071s|}kGftZjEK8GXD5`AX zSemDZUEfa?`L^wdQxKgWEl5q-BITyO+%Xag#OTpwFTyy5$H0v5k5S%LGI8A5ZINxb8H@jCaX z?&3Y;dHFxzf0^hW&pDo(*7COz8`|*m`1)<{<#GA9w^O=bCY9fg5a96EWd2AfxNO^H z83W+F^aCK*9WL6&jOJ}F0ONIx{h2R*AKQC=o|j(w4ZQTyub*AZr$7A*cIm{d;)!*{_$qcJ5dJ_a9V(*U}ZuwN^AIiP!D4Vbzi?L5a_$N;#^?+Tu>? zvy)VQ_s$*M+#C^tI0n!ah3jKfVt*-8rmj>Wk4hW@DP^Sl+^7jpDpa9_N_%#AuW_s- zUSkMGyo5VXUf)wGf!jNHfWX+r{f7v-Mwp;`4aypC4g5eV*`CY zq$K+jIzXYp5?*i)Sw9QNdV4$`CGOQ{?L3J)TTU7Kw#j}U>Mm0owv=#ClEZ1+#2G-J z$>z+Xd%weBMQhOVQB6sX&f=GOp0KI&U)?*oyjCfmrGN-)psV z?=9ns1aOuM@LC?vo0Gw^E~YTQx;of*14Z}31uZnJ%M8FNxwDURCZU}Na_-|w;te6H z>}uK%2?D@8Mcf=uSeMzH0y(Z2pG!WwA?;beW6?NIu#eir z>7iqf8q+~sUrFu(fa7VmSazN!ltPyi!PG0luCDRsn_tomWv_=f zS{ky>Ad}GEdsF^P(pA+DIU}ws=C}xBv`O-JURGh@LIZtGlA}p&Kn7FOEOve=B^<7< z5#xk6-uRO2yu3%+cV*9e5OkBujxa4FYd~;P?7^V)a<|KA+1cFNuw+83E zSPQEq_dL&-^nKg5VO>`|_0-dN{Y(GSg4ls@)0h=)&H5GWhY_^KpmpLV(sf{- z_WN)!dowsyI<$trC?2np&UrBpwqWIcF@>gj{G#CP@?~&;^)qYB4E&ysN!6R6$Tw zK}pu}tO;I%@3o3WT~)Q8Q!+v>#e!E+4!{(zmOyYl5htqKVxWn0QwOjh_1@TLUKJ>k z%*bN%tt64-cCwq!B<#b7M_gSUkaAL&k7~g-RVZUJt7$aiG{CC0qA-}z?<9!OngEI^ zNsyD(i9rY`eazmZlLhResur*)XCb&WUrj-nh0R7 ztE`jWbyYss$*iRlj0mQQ2wJCmFV^wb@yg2II47u91Dy`K!-^!=)U7}PFA{aY@l;@{ zU+_8kKAVzwy8=bX+t0#|(BtVAfP z72B{@Fd^e04hD;sOCpd|YC(fPn_mK=b^@K(X9-##D@-(aF9~FpNP&Z?(}G{n(6CIi zJfjtus!Cvy=YBJ?ng`U~z!~wgwu06w!X)5nS7UbP3~|75wr6tQA*UT7PJr|MPCEy4 zET}SG1a#}F80aQ^JAno%FM}ovV|O+AtT+lgZn#hX`jNV^x4Ln^kIvQ7p698D7aQ zq9O}e<^?%r#B~|=0s(YiVIqf#2r77+j=$Da(FR$^b4j+Q$>#t!LCC)JnsgqJ`LiZ+S1z{dUd_m&a|%U!LR35fesYz-{*V zmx*ze#hAE@%xzU9{ct-mx7VFaakgP$E7R8@F0hSKv5@q_iL|x2`{|x zzu{A#`UiO7h3~|NKJ?A_@Q0tpy?e_UvEYq2HoW}u|AUua`W3wL%5P$R>JDCd>6h{H z%YOx*_{5*V```cLcF+jTi!_KV*y zNexNAYrO9j-e-L9gU{fF7ydl{)j#(~J9G zgAWs8m?Y*xGXg0f>*LMwq|aMf>x_8Ib+d{9App8h)csZP7AHafCg-g7942v`1m$i| zFY~}TDd$#8vt&M1%54*i*wZHwh$sn_y=f5-jluSBF=mzXH*qKv?eZVbTI>99df<%LGAllsv!DkaTN)RBzAb$%T7pwQOF9lQqkUB;`rS3&Rc?%_yEbW zEX&8_S24qBzevTY|Ax zA@)h^I3A0yqbt{D3CfUO-O3pc~t6(EuVkGaOPIkKPL~#wQt?w0y*GT-;%Mx%sK!cSs5qwYx z;Uv<~!H>yNAJiEFeU1`4JZVCDR#8A}4XsG23EAT{v>+JEuFk03ThTR(`y20_i3&=V zd%;qZoI|}dowN9t;}*IvxBcp{f|3~HhnR|SIM)I128XrU;G#SWypA2`sCf4Xs+cb- z#sKyTZABDox{2!-jjQjQZm;S zbFr|PUU9A_&J|o6;D%Oc{6TlWqR+KB#B$PFB|>;F4w|hYs6dGB3`xtXYS&}ilDf%x zTXT5-BzBSC#BF30PAP^+5d(3KQViFdv}$|fG+{pq48?Q6x6Wc)gFaA6-f=kZP7 z^iBBQ@BLo<)KC4Cts75{KmNz@i@%1l-$$75KI*1C4##rYm0 z;Bh$0ejodrzx}A2@pv6h)ZcJ)0dNMW9}ZV2IpcIXB809eV9>{nV5KD$y8V=cLtMqu z4UkRQPGu_-1)!RA0i0~8nkIOKR8Tc26@X?|;2>wU!fwF6Z;uP`U{>}f!V6WP`^`e7Vvc))A zoi*0OE+wlvJxD1EjX0eKoH-}G&DvIF9@kpLQqXy|i*`63Pev>u8HN8#AT2>g@XnI( z>|-gl5iQ^%S%M0JS!?`>ZDtR~;hfe4X6;~F1J@q-I;R_N2CFd3HW2*JMFB2R7|@p5 zJEx3e57tf;rNT*oDBlwZ7I5n4c+Ydrc-On$t$}OMx{?xjhy~!TwrFzxXLIRZ?@g0mjvQ$68BK*=&!YUTKi8syEWrC3nSdqgq=@0-)$uBffN zST&wdYY`$-lu{+5+k%4xKtTyJbXg$~#QRNqZnUnd3^C$`PkcfYF11-Qu6k#E!u!d4 zO~(YWl6GjNpn8u74{uDl(i7bRutlwB?Mdu#QG;2S{k)ZfA#kd|LyWzyCY%6|J~B{t zM!KN|xKj|6>J*-qZW7^RkE za0(1morea>HCxkpeaZx~awHtHRPQt={dawRI7|4|)=4u=2JTv0*ejVs)-+X1w2Ia^ zw-uXS!F~JQ5K_F{o2QVDGrRumCgF2+4!$wsbe5% zzdxNE!ZHgHK}$1rry7noCOT`aQmfdDPXrDaL@ms+u>gmn!@ zK5A&@!ZF3DpzYvPq2s%?hFzb%qg8R$G3UKQN<~wAvUWQkWDgN!jOY<)24t~S5MX2kn@JBu2w>r z%C=5j9+%%UlAHED(3&`4ZToKbN%ph4 zFLZr;1LWRUmx8HNCaTQbxdCK=gS25Xj?y?n~B}ar2pHMASk!Im+iYvO@0aPvW;&? z9vII}cLAmZ*;luHesp-a?c8nn#~R9)Z5~MpWB>5~%l3_Ze;Wzm%Q;nCmR}G;#p|yh z@#2fWgco1@zwq31UxQ!%<^K>bzx+?|H~z*y#H+7<;o^M2{^otW^2+OY?z#UC&p-cu zy#D&l#d$C9$w+1?U*WxPcTX?JhQH;t@z`#8?KZN*B}rs#$8F>ST)cnBy6*UaANWrE z;17NuzU5oqYkLV1$5z{)>^liu>fTe)$%oFVjkFMrcXi!rB`b~~iA&+oHCy+&Zg1Nr z_Sc1uGgZqNG)(iP?opC>YLK;enMFw(r^&4Gh48q`h*c*gTeH>ro9lDZz2P*^ral%- zK#0jvWAp5@VI52|LEFgK=Adq4{4OB$J%&04GOlF2%6Ul_C4QC``KC%I5e!<2%}QoL zletw0tA*{6`NlOpD=8vsB8zqGTk9@`@@&bb(w!$!M>8SI@2pzRzz45Fi!Op7NxM3z zGoCl1G2>xP)yck~k=RQmH)PL=o`}s^=6?wNUUKhF=gBw`qSn1(^Qe&P0Z0H(aLsk{ zup@z>X&4}GP}4j~39Z^tn#RJdDfy%Fo6R-C2akQ*F)s_Uy0S2_=bXpY)j`N5!yKOH z$($GI9_jQspRzbbGEQ<%NzbLCq9C?t7>D3)5*vmAx8OXO<_Mpi#lFmG`oOqe_S@^a z*k>;BrJyAcG6|**b|0FSHsGE;WnEu1X3*iU;~1EgOkoLDeuwu)kQfOxbWR$DC>TB) ze2^H;dz4Uh?<{j`-*>&oLIldXhY~kFas4A+C3Bf103m{~B!#Sl#;7>!UzXfpd~Y!T z;~8~-VT{PbIdKycw=luipo#9;3xOvStB5SUCRh^3GaAkW1(S*zx*&wY7-;#nY;CJm z6!r~5Hk#+f`kMC~Pytmgh9NX3>jLA;sN@r3CAnmCeHDi^I>XYTQb}J)h%O|%)&@w3 z<7~Xd7|h8A#ky9X9nHqqq{1kYjeFef&9RMTBY^IrcE0adH!yYFICnIY`7mkel5yO! z9A)F$qt1B}lv{Juj_gYQ3Y4>+^fVo(65tQA&QgYG})RQ znht`_>#%Vzn5N7}?;PIy-uL2rzUO=K+0T9!H#ax8V#-gBKc2_&4}KMQzVW*rbu%7^ z<9PrtKk7z2PRA31!8?CE|EL@AI2=#PBfRrRQ-(d+?*LGXs3o2EC@EQTmdTWq6Q)@d zOw|`*=aVg-#j@5b5L!ysda^xW&l;F`S}SXo|LPq z$dUjj*yfQIVGih)@XljTn+EWrw4fTGHL3GBFRM5rc&};<0VAAO6@`)|Oqra^5VQfi z5*WNP=2J?D)7%rW!-j7Bc??cWv5DIuOCGd9zQjhynqM)f-7*29T9I}Eq-$-M+9biW zCP^7gIOkFGj@%##QSa5JUjh-Rg)oD?QktoKv)V6~QZO$wO3tc$m*6m^)B{uxv}-+9&k)lB@_irN(QEB7BH_?z{&WCht0L6xE1Ol#a&Uv`jmCt@i8jU23I8A0R?Eu`lzOwHcmGo4kfbStV*n}Q(P7?uEbSy?+=g4G8P z9;o`lo2!egnUWl?jVfelGPKz}p-Tj9D*;&fh;%V%v4+47aDOqWYX&Q-DLXPwB3Z@Gf9B2dSgup_JWKTDl&`YF<8;d#+k;|d;&1qs8 z4yZ*yAp(pYWa;~hS{tSi0N=-s%)|b<7y_1MLGTI|=^mr10 z5(0nDIb2^|=~^#)6DD0qyfJb_tw8ANGX7m$Q#xT!&f^Vm7kk;HYeqmVxt{|8VOr2? zLGwE28WRM-yj~eOOV+-QZh0TzLPX6;2m&}?6YSnHAwPh6oorA*;vvTqiAt>jRb8l@ z2lBp2JKqK@yPdSzT`2BcUt`;L8%HEQ9*-v_kxWJ;oLH&`BoGY1=v%I{*%;@(h6E4p z73dm4q8aNu-yDx(Nu6YWJJuHWo{lC}lYCXjxhl;Z;DXjTFV)nA>|ZHQbCPGZ5)vda z*vz&VMfaz=?nij!QY61)SO5SZ07*naRN;KZ^_^?{AHVta_E z!M+>&^}LT>ef1Bl?XSN2`Qa~bE%or)Yp>&_mwp*vnJ931ug3Ak>$?2>+c^^4MjV)i z&tKm2%RT_kNd@Emcst_9}o zwRIAH+7s5p3JMB}D%{hav1z=_Br!|2g%D730-Uol4BXc4U&k2#*Q>pKU{f|cj)&7!1Dkx_$1e45A?82#9*8vg>4)K5x z6eXERw>7$-*-AA z5r2cXXD9oCWDjYF*Z90xqM1Yos^1kgfCOE-r_qGsGA}|L4<4=Pd~up!RbnvR7a0HT zIZM%?CXQFfV?qp3i4EDty7ye)oZ%cy_;M_28dLUH>aNI`zMzO*a*iHi!Yl=xrW4I4dmx zosZ(EP!WAk9?Skn)(WnBoZoVf0Pg|bQSSk#jtFove@K#$c&fX3jE)L`;8DFq)j;lW zbfO5FM4x0FsaT5ymXs6bdA4$WB0{Lhsi@#daV;+no|6(=hc8R0Iwr^*6 zAc?p-ML^L7$w(~s&^V^``NZcH-2=J!c#SJ#2v*jIH~|GX5?{#LQ`H&FIfv2;oR$jV zJ!ff(tb~ymx}c%t+Mh|jyLvbWc*r~q-XT{Kz`fy~PI1}hVC#g;KY5mrxYJ!v)TzU3 zET!ve&c){IM?Ufq{GGq^6Zpkn{KZ@L4Ns0guE+h)|H2c3!8>z2|EL@AxE)Uj2Jigw z+@o&5<8a*nohRiH-s$5H|L_m-?svai5(-0NhKOlx6?NYwz;YgOidfgf8F(rQ`i9b2 zBf3ansKJTU7!w6(RX~%qx`6Hg(3(SxP|K&F!~+GD6_~B9!PSC&J7HN@B`_4T#t&+l zc(}So-go4Z&j=01^b7&ZvSQyivG@%V#E_L6Lcn3YLJSe7;|)rdy2$`7t)#vm)d|9$ zZp?!RQ4a%*+nD4$E}77m2b0*1->n-`yLYwOhMIt~)G6*3eRL<7 z<^}7z;&ePpFs=OxCP`J<4FJtGseNgnjwUH`LP`l#@rD>t>W*oiG0!U=;-TIP*?`k= zK-jfali0qKJv8X*CTBW4(XAiN!cLQ6xnu+k7JfyQtExP8AYkq+0AYE7I8A_#GbVc2 zHgCai7B>V2s4~&&LZ>>xR|nt%bU8BcWxG)N1}tVwXG*SV)1Xky#QaWZLu>6$1;e_-=p!p`}!u zw03Py384x|D#Ng=M7C|W+Ph46TB35>k(wxOIq#^Xl6kEzIJ8J~om^0;vQS48CP*Wq zCWr;37xxF%ALo9-24hAKSm?Eht`6iqz_GuxUQbNkv zl=@UU?Yj`K2>$K+Zc33-9BRu53T(3cjPnYzD3O7Q+FBc`8vrH+Vx;tkI@KVn8;vA< zMQtV^j3g7XsVz932;{PEy*{bTkz}6b22pJ!#0FK2Q3dC^b?xzZv~nRG6qRuww6CbP zak~DLrfYi)2KshYAVKed*0QP0*as1!7<0P*jq{obj_N&p>q(JTo7Gj7oQO~*LkKvY zHXK%QY^trIG;tEi`b8Dm*yQ{jp0Lr<)< z2D?X8F!3>e+jpH2M2G)tsVH!rbXHkbOca`|i9OA-zN9_jaJ7m%lj{UINs{zLxB$GJ z)RuC=JbQZ%2}42MHFRA3!59A!&ph)qoIh9_d0ko8DJH8(tgu9i6GtAgYA1BS1o)^< zXB+8AFe>E7Brb^wV`_1QSpDN%J=A`go<;* zL>*qc{JuYmZ9b3N64h>a|Cof&!_RH_|C}iE<20nJ z0WvQBsA~SNR7zny`ndYs=U&H0Kl<&rT*r8PrTa3T_p+SF<>xsz($Eg}+4$Mpj(~F) zk8n#HF5AU%_IB5B8*${k4Iym!Q-A6n{`z14L44ykzQ;<I}Pk@ce}0krg3 z6%OlRF{0fvEjVo_9B)p#K9D4(r1E*T=dh4H8Gm~mPa76Zf<=u1rx>wZ&3Je`BBzW! zWz2Kba&r#L>}-F{M7e`A(zH2_IdK_Cx`*Iil}<-Yv@>bhnz$;A^~!T8!!yI#9#s-P z66>wY0=i_k$T!XJ($&n3vl6_{>{Xa_sSn_gs zhBEFHcf9T@&>D%lLfW^zwmM1@TUJLkl$qEsPfbH5nFB(8ssagRK|g&-`? zEODEVXL4%U5~~yputWhg9xk+{_p)bSm-%9);J!ik<1JhH0J^E2ttp-*J0L_8kf=0S z!v1*NMEH@i?sb&NGT6>H07YZhFT5Wjd>8E7wqUqjOt@U+3SCr(=7(ePh zMZRY!JExe7a}G{P$6UubcAXoZ_O-#GX-N)=H=s#p!9B%sfO8j6M~@&R3yB-(&bR3L zs=^L!`?@Ta6t*>~wzJsuuYQVQ+i@rdK`q;szmLaN3G4T5pxlyNw$*wm3`-;>@? zaR-Cqlj|a-Do>}q&;3$Rpw1UdFtQ2BJwe4ZQOBBd&dR`e@36+j_LRGp?2{OxyEU}x zRN$s~WviX61L>!vr8GEqz2a)(-r_B0vG&m!PS?whuQnrKIY+XA!xZJ-&C_h92Dg-y zL|=`_ON@p0-oc?tp+9R&Yt_iPr)@{@9@p0gas4tfgOGH4sWn(TC7!KzPx+s`C#sl9 zOUul?M1wxgtsjg`&a!qIn+6ppIE{6F=!bp?zw#@;g43y&qk3}u@jgV1`=31OW;_nZ zpLx^`c-)RB1cP_*_~0kM@HCzb(s$%Ie(_fybrT-D!dX*03BTLa86WXR2xeG zD~nbmdldkhB&wjveyJS}``#ELLiBKHhf`$(G~jpM;pwN}h2!xCr_)hO00^75wu&$$ zpGD0Z;7XQ6Q;e`$TCNEL-ghM;%TXBEi-F;M3&~&v+%JJ~GUe@X00VqcJLpT^!9!Gk zAqMO>nyyWLe?Ro^*#@AWem@B6%KeW%XX4M{-_mD;UV zRh{pA=j@-g*Iw`Y{1sFKZRDKirXV+Rfo7a_#f;;10=jFW|0a?NSbiY^LIMp0%ECCH zrgDziFU=GIQHB_?u8Z7vE+AEjC}3kP#z8Y6wHQ~m`&wm;2PZ(+X0t_FS5*`^oNP}3 zI0L)A_bB@N!#FCzg9W%WY_d8a)LOCIiH%wu23$J5EFhWQyKqtrPMeJsncD0jI1NCZ zOhnOyC?o|Q$DsG~y4#6jNypouc7HsE5TdG(yjl0>BsO&<3!EtkDS)iQexEJ7kM@&{ z5XdFt?%jK+0IpoVq~NjS(I+KG#29hs&RxWK$r@=?S9vAbkR7i-v_`AARY-3AI8aI2 zRNo{!44UC;bD?Wd3HR>b$E8cBl0~~FQ+JHxfHfuT_IqqMlVoV8tk&7GBLvi;fHJCB zcFt;t&1Q`>$VRNos?8s1cCZVQ$`ML7fP%gxi?D$r*HG@4 zufOpoE}fnz!DgfRm;!`32U8GPj=XQ=1%kV!7NjNF{K}kF&Nso)ioU6*P+K$Edyn0I zFO7D+??Vi@_l^6Qh7mrfi$HAmc1p>bVltNX8Bp6CGEI|^5wzhmPNOzrXs_C3$m;dV zDcgN2t}pG}mD0c^UcXu$oTDnMVqI2I`9x_@jl*D#?VPjapL*w!O2)iojKcsIq{&D{ z29@^SQJLRzcT1_NgjAKCI!Ul83IlW{8#tvTYJ5klQW$W-=M9Nhi@NJ#|xi zSX7D?(ZQ};Es`rM-y>kd$;sA;AaCBjjqyEC%jd04Eecez=)W)IzDuVkfRk%xY9YP$ zXJQ`->Z-W*JU-A2a*pf0H=VuSa`D0Cyl?FSNJfZYW#px zmxEFZf@hOU6{l4_PW6MSIGQ%6@Gii)^FUd@t~n$hgeZ2{W{K@1Q2B59y>WBNny_*p zPS;_*vg!QyJotUpNGl{s!O1+4QyVi}4-=#zvFM`jIy@e0j3b>Rqw%bWFryG&wLFWR3riY4fk^~6il7K)UonSS(*SWcgxgY&8a_fl( z7ZEKENdo+A{{8UW9ug7`NgT&W2K{&O{PYnP6+$YwXzRyCPu}RabmTkx{q3C(R@}V# zf8fTAXK?=b56|D>clX;d(#1t_1{WRMMc4aSoIy{R=#S+v{@|khJw~`VJcc$ty`S;j z-~Dd<^iTgVzV%zb#Xvf#pM%wSHP_B2yg(m?N~&!N&60s(p!-#G1ar>e^z;<96fA3P zl#5krQLiA>cDn%`kHk5L5qE>FuLq658b{jp%kzlDJ-P$IIgHb&b8|KEfLC`tDp%>M zKr&}hBDB=XMaivgJ}2-^A~n|yb_JFdqk@72N$E0>I^sFkr0XKUy>kwU@r}cv`zOb{ zXzktV*<|Zw6tui=;M^LvWQknhzJ}n>t&cXF4QeUaZYS*bv)IWi={PEZ-=0@sU#893 zR>J}o(^o?iYY3o>bE&RL#3BTE1vt;xXhiR+4P4Eb8MW@__DN(qC;Yw3|_ z&!W{~L3`bX}|LHkS4?<%zjIiSd#695y)h{(wy ztuhYj#iJRWK@??S>w&iBKIK9lN9JIRV!oM#O05- zzmO!nL~3|Cn#p)fNr)Y+fhE?Voqx_HLjHjCp>)kIu?BKP=EB9bWf8!78b?%5A~?*I zZ5U(@&Rm1aiMObWWY@Kk0(j=ejSy;$m=eAIdNJTTt9xNT0Sy{e5|n^%(GXfpm{V&h zDzuXGOlO&tlDgx0M359MTZ`=}HU{HX96tOIWsR>yX?Z5e^QwiC!RmVHJxWcj34KOR zs7{?!c+bFwsjYE`s3Ie+RY`aXI!;g=syg-xd0xr!-Xl&y$5mFb0!2XKoSTIa52CIC zc`s|fvTBcgDXrJwqZhY8KzrxqlOW3=7< z$`di}!`hzznb&WA{ukc=@}u65$7Op$FnGAz%}2chkIVLC(tP;a*S_{OJoEk!n1wqP z+Xe~^BT%a;o~cykf<r4WnCHb+`jsTnO7&q0e=*Hq2SY+ll88M=IrQ-C&9SzPCm z5fK#}764Cd;HB{1r4`e-fia7ri_>*g8$-4FSCwUqLVg&=2_=(lJ_taP3cmK$KS3Nu z%Zq0|Bb6CBC&XIe2Zx;2b4vH>1h5YkYRkVE6Wp56eFNITVhn)uq=LR-eXNnqjSG7c zGb)5(o>H?qmV(S-7)GpV0nC*_T?h>HZ|r*7G5R0`lc?8}8seg$K8YbA1i*`{1?_h? zn-jgZQlNycVZp_;)50`sv&uV<>ZL$f)Jn~q4HT>wf`>COqiS)F4y1+dBXjk9Xye>D zrwZi8`1Rhymx2r`AE1#KqK>VAH34!dKu(zAWX=gBM}!#Qomwk`xQA1aHrq8d^?a4W z-v^InX*S=P;EEG+ihOR1{g5%^jKo7GcZdN2Lh{KuV_g?ijF=|L7SEc$ImC#>^Q1QE zlEuey15}8;XB%rCv}+%fM6}E^yplhLafE|Im?C_P9XMSTG#eH07ea+7Bx%1sA{Qa` zIPZbbwTUY%$|b9XH$i%;f^sg{sugId1+L2Hi?yIbb`HCF5zAG*zT1-%CBifXNQ@C< zXmJ^*CtGWTkt`BIH49iOsi<-#kXy3Mi+&Va&bRK~MU2u&4XRKcLNr1S?Llj;>R3^6 z>GTxa&Bk0{s6@VdZ?WzDbqRUk{#f{cp8}p#-TabY3@9^36k*#Fw-BQby^3A2w>0F&y6{eCvv%-)5CZWCxyNOM)(v*#NhP$ z1H1i<0GPUh-MJPHGPO{Vd8P9Ru5wjg5PH5pm4d zS`h#}wrt~@gfRf{)oXK7$#weNb2|U>UIiTP-@hlWDb67d5qVA4h>ODnw#qH?GIR`{_lUStb zOLvt)*Nn@$AO-?mr2%bO&Mn7w)okyak~M$j{S`5g^db96M~3Uyu3^8Qaq09#$8ACk z&1yGzk5qw-0_Q5`c{T7!h)qoycpd~MpwI*GeKbPFc~w4D-F*|gSM2x7@LoxI2t0GO zbx3ZI?|AXW|Ad=2Ka3Y&`~Y5l`8KXyi@1Gz#jRWS?Dt=O`G3F{zHlEO``GVXa0QPk z_W7N?I=z1#2d~xcoNzk^YQG(!;FvA{MFa*MyqB&MJrRR{uHAdMe}_&J{dcT5e=d%F zZ%>fu_km=TdgSNFhzDGgMc>rEEdJ3Sn|_di23ZNrziR>O~}sSWV=!2_aX$fB6EMM84}_c;e#_bg=rMh zoB*j1C3lP{UXGun$WcLB0#da~yb#@!8aAVr`L4~)Qr|ftohzVA!sjwCrkW*?o~nST z%eqQU6WJf(`Y;&Km2}-_YJMjG&OA#rUCIfgmpUZXq|Qjr&M%(_bVFo4(SY_=`xAVe z=S89$w12TKtHt>RA2CF6w2EN@Bdq|5zuRsmtNB9=D7l(*8Do3kfTA&!B!4m=p2UQ- zCU`#>C?<8D%=vxYUrIISFRpV5*zsD(v1Hwkj9N+DcSiQERfx%1$Dq7_(B22{H2s?* z(DSlbU7B--ivg&zF1vK;w2j@IvE6QjOuDY91y(y$2vAOPigQ3zFq!0zsw8d-cA(dA z(fT=<3#Rs?813dgs`f!RRgko9?i*dSLDp+R!o;$!R!1xgBTJK#O@uV=qescIh8SwK zbuRl5vQB7($*2wwQd}X!{+xmV+wxooh~IvywmA$C3M9*3yzq1thKCIS0!1 z5$Dv+W&^rYI5_R^aNgDZc1^@mOFR>ZBua;@uPYiDu4D_G_Qn~gI<9BMVfN6~(b zkOTC-3UUlDi) z3ekDqAp|M3lM)}C_t@{xz-F#<(v)518Jq1ExmJV_v97Z6rhez&(ul z+pPa2yLUp)0_Y#w{S!1iY`pXQ_OJK$%=|YF8xOjXx$d-Z6*lmy#gP^>N^syV<(w37 zajJe5FoNzDvM5)(IIm6Yw3>x@g@8%4f0X!vq@UA{iN*IYNJED<+gz+m#(PBG?G&si z1{l>+P*?=3sv{$vQ?)cVj+Wa^@R(p3?djQsXMG!tblhx zVk%M+2acll-w^BatdS^LuNm(Tjt%EMmU(ZDpcp0ZlWra|X4INaBTZ6D+9+DVJa3*? z8NVKz?N;x383#NUxk#ZbM2Tbs7Fwv5oQ-6}BC?c%dEKk~h#c2eofIl6wwtX2{_;7S z&1A%tL7cT0cZO?90bHoIU_oWwBeXx)AZiinX37vZ|v3iBy{$u zyZzjn6xz&j5Typ3D6L!!Sl8TuTQ5pJX>5CI?B-IW86E;^0QU1NWED?klYA%LBP<4^ zNTw^QG}5H-Z_ylsHt@ueWs%qvlJRu>#ahwo_>D>D(Dxemt4fKBSdk$R&_&p>u&C4Rqa|jVf z=GkIuUvX$!+Ipq?ocw?s5hiGB>c zt=<3J2$T{~c4!U=+z4DBMgtsPTY|#Ju6a*l0B+p41OWK?pZ}W=yz|zryLk20J+57g z_~a-52oDk?j)D0kOhEVj5R~WZhwcLXu^$7qk8N*vjK|LT;d^`X0RPR;J@%b*w}1Wn zk3}l*^~3$Rh#+y%dym=uH?`%1q>evp{KBzu*^^(;{rOHV1%H;;kC6&4ig0+RxQKq6 zFL?d@^>!}d>8C6H`9J?5+`RcbPETdME$ZNE_c`EXeWR{HR3a1f3_&fg0dWy1#q82^ zE=FeKx;Mmtb)WF{+qZG$@?|*Z1wvh;!Yi&mAK5>5P$)}vpU;M(*)Ea zAUuGytV&+25_6zLHh#XX*+x;Q8(;@{{t;jl;YP8z9zN#=wNvMFEd*Mu>xj*Cs%&C~ zrpVVQ#M)wpO3g|%R)TnyJ^)F3-U|`4kCEeXIG}-zV5Em~=t{rF9SkgI%pnP&sI}Wy zxt{y|9=Gqjg)3Js0nTAR?BY>F-{}A7h*eI34-%>|C$4w zt{WKvHU|u zNE@==IoWOiG);Q5^hdYGg*ugROa|?(2*H>22qPN=fR_1k)471L-?8Z(P#q&FoD#U9 zv7yBPen8#cd?R~M%+toJ3V$5nYEOQs%_&OXXe1~PtBs-a6=S<(z9E4F_Ib;?;@=9loJERO*Ia4j z*yQI@6T{{L*1a|^s`SRhjZ%7*Pp_7e8+d-eeZi8 zUU}seJlP(P?e158{RzR~;cPb_^$t8v+Y^Gp!`*H^>K%9-wkPfde=*zr`}gtMYp>z@ z_3NN2+bif2giwvT*jA*Uqh1yIs_*?%&)0 z{qVgcXRJAiT4E4zW?mNLIcsjZMhwvA&r88Mj-u#Z=Dih-rR1-^5rUI3I{1t97Lk`$z2Q)oe1#e&~E30!}Vn1}ZSmdkk^FnpVJTBan_2)nOPWEX%A>B3_*i z#CmfW2P~?jVRIrYiD4MThI*Jb9f8HGYk}tKO%ojNO(lB-&CQdhp@Sbstjmn;r4x{t zL!7=Medz5J9R2VbQkUYysl#DE@Tlp zDR5jnEncTdNDr|ivH)t2r!fl7Ic%m$tR0oG6qTspc)vjA@HHi4uqU(77H~>Hcg^PZ z;utUlwfJcpy(&!O#R16uNiD2_fJ72`Bu-Y@FY9z6ITg$Y=&(#G6DcreLgzpO#N=nUpSncZ0)%x4U=LD zhoJA-&kJgqvE6QrI7I~&o2yQ(L|0W)aXgC3tTnUu`@InfI8PGbHETyNjxF9xlkeXB z`xwU&LyXwZ3wFCbfTlj1_Y0nS>N?(f>n(9N7zc6MaC%;f5G95owwMzIM*3&4DF4LS zCFrw}L=wh`&`!COirsE+*2TNMfIr@~W+R_dRL0=kb4S2mI3*L6iWu5G9EZV3ao$NJ ziU1HwR49jb`>`(mGZtP* z075>?aKR&lL7IYtxF5Mr(bune_?`TBzYcN$e9#D%n&84<_j7wszkXs~s<-bscYV(R z{p~gF@oUzr%rU#&UKD_7l{wTqppx7bP!te3T!&rsU46rOO>M3-a)r+EaR|s+#%&A% zsa9371$*{{7$p-rpCPRYYY4U`6IKK)e&`O-|9!b&zmNU> z*s&a5(|-Ss?Z>h0qOp36m~fG!#6_RYW95By(Y{@@e+3~d_}~Yx;$QrWe}boQs@7V}cAdZ)BZe4};j{-q@INT8 zgO_?u*TMuFYpsYw(6~5g?ia?W zp;oE2#KBBvKq2~PBZlWvP!dTX(pR*&4)zPQek+BwM-!9m_cKmTwn9>%(+J5&T3-yo zwMZBJPv$*YOGF))6>@$#AFu0*T44?+RVPcY?jgYo0Viu*iEQj$Qa}}vA!FA8=M?aI z*}zytK>B%u3Z;Z(AbnAD@vJac5)m;Cww@oy0dZ(oE*UPIfw`OO^33jOwnX z^VPB};*u3p7b&4fSfTwgiYxRr`Owzufn5I>ivjC7&vu+B%@vpP0Ey;s4z2=cyE6>K z705yvfC}EyPp97pXU~XSvJrDhx` z!mnu+`}>Wb%FGO(pJc z${9Ilv&0neP{sh%9$3IP$uY~$VVP%95o&W>Y}S$~kaKpR_4-nqqO_n|(JbJLw=v_K z+LJr6&QGZ+hz+#W;@9gjK(9YE@g-)tnPN$qDm}TEtp!oF+uI4G#eJdud*bO6sXqih3!`&zYkg5XTdyFxng03sDd5{_LwN@irrIeA8trC!1`t=P{3R71ycRF{M1-|Fn(JY3ECnO+->3-+@B15_cfA?Tf2-_~S5<0Fp*81I`y z!eS(nK^sj2Xx|CYtphd|ovY^FV@ein05QjQ8pU-XYJ)Fnyi4>!T{xVL$yAfMLYNCe zEzMm*!EylysimF#~O6bUzWv=i~Gaos_aKGTS%TKg3z3|h3HX{ z*VP)S&Uq~BA}XpFFnY1%Po-d47cBFFS=}Qx(};U_?_qngF|t4$B0?00r6EQPK@?jg zHCm>y_gGf}#^`b+&yNDGS*W;UgLfEWcYN(RMrRFiMNo2Lh=87FW-;?#^WItWk;IUy z_kXEkYbs!m&I@Bx#T08&2C=v5_eiN?A*9qK`aL|(z z7Mxd__wE9RDs=hWn>U}rty}kS`*z09{oLQe$3OlI?%YXu;e{{Y=FNBEU;fL#jvxE6 zr}43m{Wh*$^Z3Lk-VXqH?X^8V^O+CfmwxHX_{1l^*nPI^zOz@I_auiyHTogZf`31Z zQaC&(hucLi1-09!{xc50-yOVOj=cBqGy40+ci+Qv+!IEQ5e<3*!lB(iaNbR!Cl$DZ z*Za>tw%`5FE*fKpE(L$t(Fey!1w4m`+eHov7ZDrUIq^Q@`RAX;PyXZ&;BWkmZx#?+ zK}bOA5N^Q-xJY%StY@3Gw?hohvZVR@oYRZ|$^{Vtz#_!CplhgM8f?xaIBWBax&OhQ zxg_$7TbQhGv&K9*0GrJQ(>Pd66Q7GijH0-Y;-cu?XrC{~(`sb)0!nG15RtL{JcA;L zp^Lv^4m$~;UO^=3VH6{$a_x=&*-)XRX!)vK_`E8uhH#De!PqkAJaSrWoyqkr!QMs5 zaNae0?-2Q{5yiMg3dlirYkXMLUeH`{uViC_bR@BI-Q_1rb^UiJ|LEsj-v@K*fKlf@rEcULzvte){GPU@VzhQHu~?NCxJ!)kw!qNDEcL zW|9n?{{Aooq+Bpgqt#obyZ#gzc(31AokkZG&;>)zx`246CtDGl5Mb2r4KWy4S#r@> zj$n59hieJ%fUHDEjtNw8g#d&YXzSgognR(V)$V^IubE{^>~ zj?1dYor?4YD99lphKhEeDgZ8ZrA}{pe+3g4NGw-{8-ys|3#w|ZC@5CLb8Xf;dN}V9 zbj%aDmg_5|R^HdpbIesd2|c`KbOhvBV@*|x^!5x)F1)vzyO#7DW0!r63Yas6a}F_dju};>1PQ{| z7K_UJ(Q5=RNx-sFa$w9DoP+0@-R?16-*-J~jy=W(mfE63*b61;oX=ak&p?M2nU;z= zL9A)j`$+2L?1~b0J%YI+w0Z-T^M#DXT#Ci@@L9yIRPB@Key{5){YQsVap;;3ToQYMzLmuSe9{5Yb}_j4X9{K>#Dhd zqR`;tJmqRdrWN<@-Z2mc z3gQmKfMJ~A18p)z{b3{sA57t3;JluHr;Pz-k@LDb1vprIItU4YO$Y}dC~)4}(-$@w z4uDZph8O(+4jQ7mqyp5Q3SOX`+nYQY&>zk$SJpfN4-B$5jt>}{fb&E{_|JA2Jao7x_<2e zhB(1X12+|T;yBH@U>XJ+=LT9khp0s&vj}UgnvJdd?j1J6q^kaalvf?+LaHjIBI|48 zIBK&-iue6~#=M_#dU~SshJzDXn;p9~#{huVh^n9_Qf^L2oRH-h{mW*8a{AlqzMW2ssu%w)A zdg7Sm9M}{XqCmE|6rDFm8|PKed_8w;LLA6;>})pE8G_%#W-GrtYqNwTDPH3@Z@-0; z?H0}zdsfv_Ac9EFImON&73A{Bl_u(TyTR={Z{gCZsOz43>Kdp@q4E&5;^btD5Q123 z&O%6I&a3wh`~A{@V5e>_dVV;b*QMpm_s8e;ekrBk{(YIxYz|lo4Fx29}`^AXMk)S8WmQA2=!PcrB?v9lJpnRS(B@i0UK#ANLt zjs4Kw)BUk@B=^aE&#wMKJhzv`Q>lm)~&bj z;)~yc7hZT8FTVIJUU=a>xOz3>bD#SLUU=cR@zP5l#>YSYO}KqK;l&sKUo>!-qzT|b zu-oA{2;4_FwEO8iN#YQwekYd#?gx+gB9{W5r~dPgS@Lr;NT>UZ{x!b7q5Dv5b)z}0>?8(B1GiIYk>8!#S* zVCxu*Ir1Kx&1mXct_O%04{`F0L z1MeMT(0Ih04alRyo+M44HyIOLr)DG9Ip+X%G+UQdBiV$Yw=(Xt3h{#b*Z6@5U~Yg?*h+5=6IEw@{nb4s_a;WezK;%q05Yf<+z zDe1)7`&B9K<(#Za@LiTw$8M_$ga|8t-_NV`lbiyRgHs2)qCF7CY&7eBaY#^-Pq9v- z9fNaCzyqz@tZ#s-@m)pT#n z_ENO})7<8Q)4o?NHt#gD#*AqivCIpc5~b*nSl#&^RS1mmZ2cBbvTkkej&kKIT(?g2 z&NmWw2v}3bx+HTDq3c@F{bxU-uus{MWuzxmG0%&vA9YR)K3Hu#jzU7JrD|k^x*-7Y zvDKHXbsOQJ+ML!Cy?AWBP~>d4!|CaX^-@z>5vIxRb=FwRGRtw={8Hc!#1Vl6vMf%H z<1iQj+&Ljd@xFlzHdhGo#32L+K*mTZ1yw(@#F~s?=)B;zX-7l?{bT;l&&Uo*8--{pq z;U9Y9V(^%3%Ugepy(^Eyb`!u8g26-Bo)8Qk-uA>=;~{Lz-7h20Z$0YW zc&xWqUU>!HdwlrA-;J$ic-69619x2(EbAPe4T)j*y=gdR7^?DhP(VcBCU%8 z$_2>4I8EoX zAOJ~3K~$}(vXf$+w!vJ~Q^8OabPZ;0rsq?8u%$@BVFU*)irDZ%t?J$(#1QD%rFtgl zwc|ZO@Q1nc&U>|I6h$Wh``oJ6$qLeXUR6?c`~$#RiWQ|*uS4QksnE!cgn8cM(&Z~Q z9wZYxOMYT0NJT)k=m#)M+&hnTnFUl>7Rd&!v@6x?>l*+u&wDF;q`(t$Lk$(FEM_A& z4B~!~))me>$&8;SQ%4k4nbWFU8cxYbNy4^A+fTg)UYlIvDgptNS5bJ0(?Qe*N5wqP zMw(ex$$bqmU|AMSv;)@y*8}iFb2lLf&g<&X?8gbZvROg4I&{thU`1_=N+#)=9RTpm zGw-$gzTNXx6(r}CuR^Y`fD#X;iHfk)^=Rl)(TYadR~geol*YplBR1pMWvic8QsheO z>qfu~}Pq+ug+o)@)kcNqL2kq=9PD4>o|5qB{bIp8(#$Fv#1V571Kd$UBg0@@MF8is#fP%a!#@>vy%SI<);=S^{~0p z=2&1^64o_gvze@M%W2a&AtF&F)U0TEx#@Btz^~=x`f5#dj*l3F%!}t5qijMtYsmJ` zw00kA{7Q^?_q(1FkV4NjuXoAC#t?I!mqo~hW92PVQS`bkvov`9>T$B&$T*4)%PLL% zwMdq+5SY3~CTKe>4H>V`CAx5=oB>yni_V8igjxZ!*G#L}4g2Wr*#*EHO-OPJUgwWO z5-m6=B%u*h>g;lsO})0!^=hGZmIiVdw6Jb88(Z&l@<1t4kcrjiNdr zEqi!b9LjyP&hSyjhWWR4Uv~IC{r%O>ft=e?E4JG$Vvt;05^jb;ENDrRV+;?;K>hh7 zSl1uZInsgS@5l)9WyZGGa-oUL}Z{hpD|0(?Z z&wsmJmQQ`^k8u0;iWgq^EqwN~e-}Udv(MqBmtM!qFMmV7k4_4;``#Yl_ub#mkB9c> zAs~G$W`f%>fEkczfkOv`w{t%@wp~OB=-nc?9lAF3pUr(Pkl2f3$Ke3%FW8UXdEn4} z;TX7n_}P5#UzAIMyWsU>zyD6r2mL<$`JxXldY^L%ANat4fA9~!2S53fA2p&H$&3QV z3TZEwthw}@o9F@{(MlwF=dSh>AW&Y9gRE0L0X!%us3hKL9L-f=x8Ljj$+1hechLDq zY}_kEu}=bU2rZT?=YU}xFpUGwG>VANxex_#j_O>n*LWfV;{@od;KNpDunv|?aE-Wu z)R`d!Y&YtfhN|DC4qFZu6^Po1s+>p1am2c2Op`nhSm%0mb&wiWz;+v@t~uqkcn1hU z+>x{@^-qXF#T3wWlYA}-szIIqN+}k3QA&~HsdPeHrT!(km~~^xLSXZX0OB=Ta+bRs}CXRMzJu%Xri0>Y5Ug#`2hg*@trxJ?A6))DFLUJ~Qr8NFk8ycDkn-FrV)s!T@IKUj4q~9Zi*ii`}0dg+6WlJM?%W#D z#;=~o%|=`hxt7V@nt=`x^RfWdSzRW?W2ey$vOetBb5fT!a)_46kTZ1V`T&4buE+FfiRY{o1Mf+MZlTsYR zNCvL&yvAn9nsFm@;6@!IHA+xizhLtT=fso~Or*uRSkHZ_>{aP{$H_Pp!mtN)e+irq zqY4|UKN!0jT|(ep?_uX$i>=k4`DxPgrG29?V&A!-WhZ?B&JQ_dAtAWtrVvVVdE_&O z<5>C<(ds=qX*%a{vfWxeIgSx-ZIL5%j^ub;met&4qSlr1+&xomj4*Z(tRt21;=MR` zRb6M7THyohEBXDbLK6e&ofE=-C1JYtP2ix{s@gnZq5_VsD$XD*6AIl0y@%6hFndaV zX!T&x??;ifWB-h%Q)4yqfR0@qb5;8y!E0osy6^~5#xb&Y_=z9?3H1kHfb6`tLp=7(ATq36}eiwkHIGhqv8))I0DvYrd$-l$KvzGuqQeI$5hn$(&+kUot`s!obu;q!0?kE*(x{6mre*st(IJqd*I{ z+HBXjcn#XD7F+d#dB0cU!C=hhoD<@->1@45DNg2WS?#qHxDd~&xIl)f_lO9X)7~2D z+pVa`nKjMAf0?CuB7oP7laoup3bC-)h7QmQsaAM3mTLd=e!Gx#@HX$`bqSDyZ{E)c zQ&g6)vo>#2rxk=SpyXuW@w(0cRAmCHJNCBk;!ZJGb3o3WS~6=U^pd6VHiW1Rhhji| z(S?46+R4!(Pmj@iZ<(IV?Jjzpw3`fCNR%S35C}o9^MX=^Xwsi!f^pJVYmJQxDdwGT zneSO$6Vke3(D(+bVdPo}Q{H=zni8mLA62b7a2(TKIH*#iX5^HR6?A6fr0R8`UAEpr z$SEo7zZK-`vUFDK!N@cX2yn<5c7H9)Ucn}{yu|tAFvWlt-~0U@IcH4M25A+t&ayPX zl4^11oE5(sQT=T<%>!z`SJ5A2Q=<>)(@#oZcURFz~(Crhu2`jr75UEl-PnX{0&3E~46z z*b5e&&{HSbgEGG6RIr&GPESs34yv`7%LeZ&YaT#t-V0Cz5Y!@ZGmR(}rU2%3B7i-_ zh;O`k4=E*FzI@4=p)oc)SvGsP|Km7{!mSiku%Q?9`Q*&LpO*VTYdEv{FizsWu`U86 zlXzk|qk!JO(x{UBU}@Sfs!(DR0ZzuFIGaerNF5qEE8}b@@ieCTf?Vfe8nN5YhCLWb zPv>vjw?WA)W;-^R=qo^$dg7%YsL*jRCRXIri?UPXytDJK=3HJ zqPj+!a(e8}IjHS|%mUNZKxS-Dj1w%DT=o&ZHw0@Ox}NYkxmCo{G3|$ZgszN-J6> zGL=K)G#FS1pnHbPGqr-v?bc{*BnMa|6ZeDryx;G{fya5opwHY)h4Fdk0sbx^^Zv4| zxO95bnzP!-HNu{6+0AmF1*|pW{@G64sfK|4yqMkhW-}RRvMe)dg*9_asrcXi_gnbt zS2w%@IIi?R1mXEJg4P7sNl54ifb0HEP`0;~C*a(>2yk0*>((3i^rsy@{_zjswbyod z`Q@+Ug%{q78#kV_cYW@2Z{WG-PVnrrTYTzM-+>oj+yMZtUzfS$v!DIDxOM9`Zrr$r zmtOi)eC%Vt*&Sz3lsMcs9;3&_fb^lO0dO2(?#UNG1JN%6{g0gwe)eHaarhcPd%j?w zkNpnUf&Fpz5x=#QM|yP2h2ZoZ2%g{g&VKMiU%DN3h+>)4=#Fd zK?n;z_`z%Vsh|4$`0$56s4-N<2-mW%4Dg}CDQQ#|C*FWpF(PT|a3Qh^7?YL;K#rgfifI}x_GP!* z8(|=;N?2+cpv-$*xqR8y3Ct=7q&62OeRE`qK}Zo)bF)ULTM+;wn-5y!macxEIihfr3Tlvyv3$LYJp}?F3-f~rdiL`Othybu%6WI(m9W$ zQE4#-eV$f$FUPkQAl1NZWal4peN{gZg2SL<9QMgvw`Q@p0>@}B0kCr^C`qFqyt8{4AR$-; zD(usUOGAKjwK-onj~HPNSt)5v4^e{i0|s@tlG7zaImA+CrsnCRV0 zsaRDAA@i=(ndb1IeJ9q_t%tzquNMEB6W5{cTwkofp`-+_eaILi>Y7mDjd%i7>tB&{ zTD9L2yvH~Qfw`7qHKI7HDLF;OV|40^F=&KjwjK)ahol612jKMd)b7`kRUFgx&*U@Z zUJ~a>647;iTq>$-WLtnlmSWduSr#nIig&&1dPihv;s*Ynxhj;RUIbO=3XZi_I;2$W z@0pPfU2Vkuu|9zla*9)e3!GEO3=yEQPNiUj&onq7F=_}xw&EC~i=~mAwI(Kcfn;Fs z99E4j^3EeI$?lWB{$r1-kJyMISl@;xAw;2O6+O=9p8IR~$VYw<|K{KP(i0bhKjZf4 zPk$QMu3f_mFTC)mcjbZY?w5Z9SO41o^r&~^aoBD?>K%AowkHIGhqpapy*z~N-jjHQ zzqIX@S6;zuuf2v3edt4Y`aSQ#d*Ay$0m^d5IE)xHt37L$6tuW8n>t;X`4Eha3#YcW zp&D=>ya2;oOy!ch971P6@1@IEyXL0ky^iCAToQr{Sl0zy710k_NB6d}l#PqGHd=vNnZZmBM7|z&vJil96pIe*L>wl>^^b^mQs$ zoF4nSu0nR`zYlWFrg1a?m@Mwl0}|Tc$~j{|12;nu6?|5*3>3N$P)><73Mi0tUwMRf+r{VFHjM zw0(n;WbJ_H+qNyZuu^dc*=S$}pwP2-!s{wgx z^Qv}>UW@TulY-Vk_si@3(dW8~l4=@8RL!BbxDL8Jl!75nD5YXlXPuML z2#mCVj$dcTwciWSiYhks(xevx#}MN=)i~z~=Y^;;3=wr*1+)nsPC}Ed$>zN%0a0D2 zo{_m|-irn6G&$5%ZBFJ`2ZTh?XHQd|ny9kz!J=2>`qI|6Xhx?)2m{uf3^pyLx$Cf@ zAC&k77lcqoB1M+ zf__fo))ZE9zT~@Pjz8P&%s$mSxqi|(7B>NszT2-;00zkN-ZNfBu8mY^JtPRmh;b-Hd6H z=T5lNPF9!C6M*0lqogRE1cL?05&rJc3ZB=Y&*d3aUyaxUU? zygd`7hMF_*IXA~G=5n+4^7g!Igw@^!i_T=@Fc^u7 zt`0?&xkA(?_$4;tBxVpGA~BsLFNvC{7>D*;3nAEfrm{H%k2+IsnjmD@iinZZ@_?LD0Ggw4~4NIZCiD2CWIIJ+n=4-~%F9 zpG(HLb3jUH#0=*#PVIWPbrP-Bs}bV%`@OC0dHxZq-E{L!YCG$IFJbEtNNbS{t>jByZ0 z468wdkg6@-z|Cg6pVrbow^r?iYP>_K<{T;H1#wYjA41N*v;Hed7FE}Ba6+>1j;?9y z2B7E4IU%YL>_1P0b=EJGN3z4Ju9vK-WGn`oM_6|>_W^Iu6SQ&kP=KoSU)4G)mtsUNuVaYM4$iqGC`eB-n{x`k6FLuR;RsZ^EJCA+tKEl5 z=Z~EAx!<|Q_;Z92sjq(YM}HLm;XnK`UVr^{JlWoPd-c^ zLcr5cKW({m!cgs-6I|S|m}&$9Dii@OQpFOT*fD>O4d{eA%YfXZDC3f zQZj3$zpTYTPPSn08{OOpGJ7rPxR~SHSe)>^%sl3?TYLb-4xJ5nYlNeHrw<-aU4IIf zRmr*A?eHJ}<8M9GYxc@3ui$H6``SCc?;ri6{~0Hzr)KRJLc}uf#r{zn)UCLb;};u7 zb%V$PM9A?8QG}5S&cUqV`FjHBM~D^rqQ#dGJLY9IU@+Gzt^m#<4x<1SRnDh}!+y7y zeB_i(2|i7eGV48tVZx|DZK;x3oYqwfO0u#AtR2SDie=evxsFv|%2}EOs8T@h=NUsB zOqseYGvGwwKtQr;nR)rjH6gtW3VzoD=L5#EHBdYoG7gBtfH;f-`lyPgsMCjl`2&_^ zMu-7vT`^7*zyjWrz|fjBMH^KpQ0qVi%axb|52R&<#EZzinrgwc*+_|83bLwUVyqUS zz_Cs;gf!~d7$K>oDU1n91szXpCM1oZK$hZ&_Iq#+9$pA9LB`X5cLq4kiiE~jL@Ai1 z@jykoM1J@f@Z~Rm1%LZ*KmT8ID?QnsY=3Fn|MI`Si0}D3|KmA;8ECey?YY#H)}rbu z=hX<>kYU5TmTC$>X3lbB!t z9bUhvB;vUzm~`y(nK92}Job70`y-mtwFfTW?)`_a)297U-P^yX2L}b1`a9qA?f6^Y z`V0WbIroD$SEYduG@DYVO*128Y16I3pI;BEiZ4cS*2($ZFi|VeeMY}E;P_X5ijCkp#ui!yIm>c)G zcKZ{%fA_~q^1$KTbPSm9-`mGB@cqXLG{*t@i(Cqh0sj|~0oDuN`!HMzj_vcG*QFq# zku~~xk+oXC-xm=f{;Wg;;J7OVw`2SGPSFQ_JjmPaTS1HoKl-EJiGTV}e*{lIeO(mQ zT4yKbPUnoxMwOq8K~VrUbTx4)Vh279gOb1iKrQkoCHWO0xs4jTBcS=(0d!u7nM!W; z3J?-d*=z^R??$tjSMa7*u@^^$DDg`p$T{awbs{CXQ%F*pi5|AdDQix6w73PJf}FUd zs_k=xv`UAv<__jPUn>{}RgI&O2M8j|yeNS4Za)LH>Un8vG_(Cz=OKcH>)OX0I3o?L z>xxpU#8r8RQuez4jqKbzEKw}5rX->WI0k0e{7?4+uYe}WiUitx2VTV(ECz_rZRb5| zrrTkVh>FnG9?pwp_^NJx5@n_2R)+?Rc>&bu)|Pb*$zF|Qp0|yT0~}lPGGiD9okw*-OddibKoz^6fLdhj*G`U-O`+g=J%7zYXvYv^yC=D|8mQX6;DWch zr;xx}y@@R3{;2jO=_67=5>)_7^>9uA?xLhley)vsRCp(Zr5K{QWvuIJb9gDm2omGa z;vxuev#xVah|MkTK;~RJ$Smuk=U#e5jCqVPDv6!n+va^ZArhlXKMWOi53>iud6DFH zC}7WHO=-2dudOjFas@ovyuwJ6QYwZR&XK<91mhsYjOso1%Z$7C?&0#~O9<*uK;f8h z15{jO>sc9-@~m-2vg1AF0E-n$N+{vn15}LxaYhgUV0}>59~J86VgCXgJiMzYPClpV z*tPY#lQ~p~WUHi=KNE!-Ph{iZRM}u`YMAkJYId z3i7=Ewr~43{NN9M6#w?${+~}=4Blb8dGjW2-n?mlfBEH?AL;%aZo98P!OkAyb`!u$ zk9sHms&7vS1`lVu`KWi`aoF;5_sJyrh_;+F{`61(^il7|lkFjH^D<+z-5?haR~?*N zr7<%Ms-RvCwD$p^8ltKNPEJmdbHe@m_uvq$ahF!j{$`PliXjfB$gj29 zbx1rXwa9VSinx^m!H0-AL@U(I+Fc9poLf`LnmwvuWo~xe3n~BrAOJ~3K~yLA17NHI zlmLQOc%Wjx+gaW!i4g$w-z~$K9HR##y zwyz;r4)r|mRb?P-^=OT;i<<6FwkO;FKetTR69;TI!IXjCHLFHuJw|m*2vk2*HWQp$ z*H)dwwTa?tBLmc?N{d0rWb-`RJYd$iAjn$m9;Jma(9{+o2DloUTB25)8*8bkU1L-1 z<$F8O2AIa!0L>7B*{)WNb*ZJm#Rw3@t`2bRK5w8YL7h?m>~q=Ao$>B{$CRcQy$+l& zkGKzqK-w|ob^mj!hvVD4{}7z)$p&wyisgPsG+?p^$OuyP`*Q{$;5UEk|Hg0r))%|q zLAQ^GWg)>*zJB<*8#Hxt?Doe&6u*Z6Ge56(pECmZ&j+tjwH)*_dth?tK8xSA(fc0Lz`Z|@sQQymB9MP@`&-LNCS#&>meS3hM`?mw|Wwh(a@!`Aotor+W zo%@RJclh1Ml;orC%OOdHq=1X=5rQ23we5jk-~CQ&1h;F_1J3*o9uLQ6e?QQ@AfbWs z{r4TacMtE2dgOfpJpla4PyP-*^O^6(%P)T)u3nY>`rPNfhFiDZ#Lxchw*mlOd+k1+ zefAVDzx;i8@x?FTrI)^p8#k`v&K;`LInFp{Yxh5|6OW(wLqKzJ=z;DYhM`|_}go7VqgDr_O4qVzHim8v-|W=7Mp3# z@YG=NpFU@wy{l?h)!Fr}^{o{#j#S=pm5gtl#dfn5Qnl}tFqkW#n^k%|RLUgMy!7JBmbfnWep_ zDPWr9IpfU9F-|udvH#KMg%G1;wR?GX>77`@B+PYYwz-f1qz#gtFKRH}xeDT0XMu*m z>Al1K2V1OHgLJSDbju{2sL`lIWixOhB1dv-=FiuldZHU^BD5%-}0*GZ* ziYOHnwbo*@eTemHg|6=qLx8bHfiP1ugbNCgGlD+Xb-q(oIJLvFR!QOpQwY_+8vq_| zHaI_sLS#%b7N)R4--%)y0WYp^UEcu(v*f!fLjVe#8dNFvpd|HVX3*bLfdNKUac1kH z_PLWW0U^KweLqy9VwFqRaSH&wmpB6Vy7D?nyg@gw@a^O!B*za;n!WrOZSVqrUW&WRs8}s)OFq z5>f2KLJT#L!s@!g1QY1JWjv!2Pql69VFm9+v7z4ANHtI;H&J0g2`aP;q_tpHf>O1G z(|a3Y#A+Deyi+Bzg3Wd-U@WXE2ih8+nD-Sjo(XEVgdBpdIWakc)_b(alH*2Ih2pX; zDw?I9yChmqiVa}S8Cm0Ka$l4HfL0ctmJgyHW~@c;J)G8a3KO=Q5xFGXy>}m9_tv+d z>pD?gu}~X|Injsh<-DdURl#g=MIuoMQTx}S?>lTZTddZrs+fl)O0K={W+Ft47{gSp zP+U!R(L^!KWUDIopYskOgydUm4aO;AaCS!}1Qx0+LEC2@sw z(Ro+re^uBakgwluALk5!kP`Z?+ZjKA*j7+=$57#})U#C8FH=yhVN=csF;oj0u9sB2 zi~9RB1yRs-n5_XbxF@$Y&Npac9Pc%+Uv#|XoRPr9yxH!M_d&*;6j>AJJ&3hp{os9v z4}9PQ__?3^S$zKUpU0s9moHz&ojZ4Ml&WcrxW+kMIP_ z!5-mI4&}*}q@HY*WgLWMEY=O3s1&H2eG54CorO~dtYiuEV(9*3ECq5k`T3W*?^@8yQ>FFJ6N@F@&mIz(UDH>l{*+?@3mG z1P&}DD3w#hI7)DM7}nw$NwR_VVGMCTpK%C5`g<5wb8zoa4&@C{QkMBdr59$elmgIY zeHter;HXLf$pgTgonV~RfH;FzbJmk&x2R9C2CPV2U^WCv3|%MlM>6VWdkGQ^sE`1l z62(%A73YyarmX?mtN|2>Jz2GhnPqE@(F`fu5EYC;4C1X^N`_VG%wjB{fmLH0FsF$1 z&5iDaaT|m*D4;Kw-5`rg@)zF=7T=+kS09U$&e7w{?NGe@PN(`*+{9NFE@_OVRSSZ}M@fpnHV4unW``9ktW8L=kZTo$;CohiO2Z*=xcnPlm+o}}o zm)?K$ysxKH@HnEtz6}0<8{k@nHm_S^%pa6!um3 z`}&mc?`z+Z7$R-6HsYJU=^Q@z!M}*-pZ^y0y%*)Tkg-~kjHEK^S>~c-<98Jxo3kBD z1xQ3zf8GxOGii_eECE9&1@y$)iJ(nX-zi4b2bU!3}E-K3CvrUW``d&bG=c;WCug~X^ z3 zkU&xr0JZA{i1M9Ri@&UvQ&NY{cZf;mgm(@(r-ocUt5osXk6FIf8k`&-2|+^lV9q;~ zhzeqpWQqb9H(OOyn>_`zm>F-4LDV)e89|;iP0ifqv!R3_GD-q$XR58FjLTB{VYM3I zy+z3c8I`cWaZ0Nuoh2x0eP$dwDB&gLY9U9(t%nb{==;8sYxo>ZrJ=s_buPse>zL^J z4uc=m#!BoT*vF+5wU8`0IXV)65kOYks$n(MeswYk>a#cZ@uCQjIg=|f-ziW}8#>C) z6QIsHW4#(+3@}X*#z0jJ04gd4wKt*4q;*cM@>E*B+R~}zns*gQ&p8QsNi(h;W!QD^ zQgW$4XemWh8Jx6&iWD-3W;E9t84EEbcq_oK(_;&=S|#Q=BVAWf?;N0ZmnO>I!K!*C z?IfV>Fi`s}t*_0wjx(ymaX(cRQk6`_y;MuU=AMN_AlE3h%qxP-3sD@I5;N%_ztrHpC4omB@3+ zJZ@$E%LFdD3tlTjL&s?U&WdLNU6YTTY%YCgw`7(UmbMV}nW)rHFbC$vTXk$+$x$;7hDl-Y7bD zv#wPDleGBzXW$K_t$^AUmHHbvw^tK)9O@hdj3x!ip8IWYdmFy{yT2Ph@*_V|=iXOy zxp3hEUViyyeCR_T!sW}C@!WII;qKkL_~=JJS``d#-n@xRmoDMumtV%EOP6r{`gOeW z$}9NDM?UgY>wf=0FnChsfayMgav&HynR4-ISK!T14)zF#awt!(Si9@$X3`sDgalD&Nib9^4!M@CpqgZjNS_bG05bGrj0&=e*LIjjpzAdt zD0Q^e4#X-8I>BXEH=%A2@P519=>2jqh?>=rR1sp9k50^Xp!z`F^xDb_Z>0sPDiGDH z(-?#G`be1Ay73Ov2=BWZ6q8L@LW%*a^^sUqXyA$g3o@;RKq24RY$Vfz8~L2AO1$>< z`XNjr3kdq67YzMs&Z4#}#4u@);2`OCC~vf4#1h5Yn&D#%>N+7oDb4b+Gw?t%f`I=S z-rJf*REkJ%)~p>`o46T7U?!i}IX?#oXIXea0!k=NV9CrG8xp`!X-uu9_=?&}WCLuK z>~y*gF!;=190PFHN^qno>8Qj2)33C>w%XY6JG0DX3*ZnGB_Per>w?*WVCi+eR6n4H z{PKOCm*o#jGywJkcP&tjrk+ax^>OdF=LTLMkZZ5Ge6Kx!d!5!Nyv>AP9@k#iH~;1} zS|Hf$`Fy=N?s2l{t%^Vk5-x$kC0NV*L;rLJ>Xra5&&%w30>|xmShlsz=5PC~C2Kec zFi)}xue%(Zt^Ef3fORFP+7cC@*J%k3BwO&j?eVPZrum#8WP454r6o^LaiPsJU)qi2 z=6!yL0QZPpAa#QDD}h(`1;4XYYG6BAS{000E#S_b@5i}w9X|Zwe~I(wd%X10x8VBq zZ^PBAN4S3dlel{~;M}|xOVMVv3rlXHn9JIxsR8Gns3|f2riLu(RE%t*GpD^aj{Gsx08}0EeyosfD-To zd!=ugJ=$R$w-qp&W#S1`#tL*!%m_9{RP;PEXgPy!#GW_&I+mCpaRblW8e&z=Zu(BRk<_z6v(lgQ^v#17FH$U$8o~hGbbo0 zI5|10<6B}PEjicJ@xk$PwC*biDM}t$#*-294Q)SS&alOb?>Yp?BPoEk0+b_n-eT>k zt|Tp}RtP|S9xkq6J5KP<)@)=HAm+G}S9{b> zyi<#f5KLWVRFe<9-bRNs2-2|8NS8Fy-6`EI-7r!Sq`O19TacD+P+AFzAt4=-_w|3z zJ?DOSKXS&0ZO?vBvd)I;M#U6)0Y5D|IBmNN2kS%<~L z-%l-wC#IA3QaxnFFPd&&gDs}GO|%;#k>QGvnIMkTxAL;(W7x9SCwN7XOB>s-T5Y7l zh8{Rq6-EqMEH~L*{jh-HUz2}q%=Eu3AVv4eIB*rY-Ca3%-tJd{;PD~%Tc16D69BhU zc(#D+ugK>ny#Q3XJ>L8M`0R!R*o7efn%w{z^KnBF%pq3yy2jS^u}%-t0mO zbW~FdziHf{KO%5Mp10^4_D+G>Tc&qs+aElB84RJvwvaGC2bXC@=sg`x`4DeJhMj-= zEQ1dI>QIv1GKBOagJpd1+|UvV=NTK){6w1ho2o_31ojBkTK|Hx5a(r?kYsfcgPp^P zfcerbKXj7tJd*W}$a0%U2vH|`XsQW@b4GVaXp-?DD5A_IrWAN6L^LtS7Ft=@84%X^ zZz<9HdMj*ccSvQ1*7d%iNI=&Ctb=H{PYz8BRiu=>o_%)B>!Oo4>%c#x9_nH9=*nL< zKSnDJ2H#NX*JXDVf!|S;5XIUfNq}TdjnEWH29azj3|-aMFEbb#lsP-hy(S-WohjXQ z)an=L$YY4;`Lnf1NpEVCd(#prQ_5N7z43TlGYZXWZhGo;9d&vW%+j3s6ST)RqLjWf zZ~v$@LHxU;G>K*eGP<}{Cqz(D%I~G(^+!1qK@rHWKTg?0ewXvJDy$3KcJa?Bu_Y$O zr4*H{ml7daBAluW*0guKk8MU(z{E^+)-Y163b~M*sf2(Tsq;f!h+Nm7oBG_ojso$TACd-9UfcZE?D(#4yfaY zYv1p!&2=9MB8+YBdQ3LGu8iA`Si`oE(<^N1k(>W^g~_o)uJG}EMZ>OZ_In#oKDTx` zhqRJlAe;G#8&(8|^#|q;UrhR?ZACe+@((v($86ZM2B`H07|5BS3K^X=p}hUF``~?; zfGi;sx^v227^(2LE1-dH#g^qn!|VJ0pQm1zZ9#7wbZVf%mK0uT;IqPlhz0#o8`3VCfwj zh`_FcY0@x2C;L@TVq$>u)jyf7&24wE7RS19cPTF_l1GLhq(T{7?RG-^6%$5py>>Gb zR?_cWlf%1d(_y~(YDj(J+FuM!-f0;3I7T|Z#-}wTkT;U&wNv1~TY2=42-8ip^qai8 z>wQ^KKuH~cK+hI8c@o?YY;V`xRE1nV_#PNd$CTtIuXp0nMM>`N@S?AwE)spdBv6QDJd!EMWxC%%)#}`E?gH~f5tUiq~u4n z2`oeJuatg5SD!9C>CMuUnk#Sw_Pf8b%&5U%RXzWlP*)N>WSHv3(XpsRjF%nC9d55E zDEiav3ndW8MIgh!SF7~V?6kAQf~UAWNFWkb1V4FIbW~~%oOLt{2*}}zDR~TjLj-gq z*d%RhD`dSkUnEC+XJ-w!J41z5m;6u?zq=HrC{k2VoncN~v$P+jNGA|JjA+3s-SgR` z&qa`yvpf?nm*WS%=h%3m|6YgE_;Ab}R>xEYEJKR1K~?;y?L>kcR@h2a&vY_J$o7N{ zeI|4Xv@;SA9kCIy6xyO#s9dNhrmz4Jo(8byJM%rhY*D6+3>I`__4*gOsS-d9(yi)y z?2E4BfMuknAlX^*;~yPzZiGO>j*kga?o+v7$LzwHc4ZW40n7$psuI(#q@YqleYU#NY{r|1XVjWu{;dHN98UJw z9B4L&%==g7N`;IIvbNfBCEenTC-bbl1ueg#Jj2W^HDxDvRpYW=HwD_nkPakgL}Uvb zomeVr{e-NI%NQwR@Z3Wy-)`GH5f$SJyEAjkL7P80@VXmAu8kMX$G}1BdX0YtRTae= zd1fVujY{na<{+?#XQRL7P>Y9+9PwVT(+KUQYv~-i(^p2ry zR?MWdpp+CH6zS<)8!1J_lB75L158CGw9b;odasTzujPg`G%T=_2|9Jca)u}YMcro; zSXklMkPEpuo^RQzYX8w4^rbua@h_rEu@8%5;`8}n%=6Rxb5n!pKV@h!r;NI5=dbg> z+>D1Hjs)@n^cexDyqmdky#>s3)R))dchh;^#5grS%?Z!L-8+mzqEGn~cb74g>r=a?i20>&4s!TYuJ2g5~Q5{`~K27@wIme5WMTqn@ zJapmbU6wg^P4R3mXq~)`{8_gGrxY7{#Qp3gQjW`q{Vp|(3|Z1}huq$R^ow{I1u_`{ z$sgKL?7Lz`kLTiWoOY5qM9F`DOZHqUyxkg04xe~~sL)PmEQe|vs3J{(U?;vsz;8U{Vc#FzfaeVtY!CU;@HZA=FRAWQ z$P}Q)X^)`@%MlO3S#>UV;N{u-?DU$Ia6Rnj9X!bFd9zbA>fQI}R~1b4k4kjNSfSmq z#%F`w$~KTc_c+sEyEpIH_ZGrpDR;$Q;t5Au8>}!kuUoFC?s|NC(+0C^&KwpAw%h*} zm)vN_+P7XBG!^5(opAOX)5}sXbx5LD=bi^%2rypzg)W(UQaP2h;m6 zu(IamGj@!^T=GsEqjVB|m!^545JRa6F=FH^4`Cdm0L+DUm|%wgVU1DGYV$l$<23!N zKav_??~cDet%E^;)55jy=NEdHA2&q7`(-9yFAsX69uF}d|2&%+xCKUhkdBd>czc5m9_Jo3+loz1fi9g|3iT&G*0>ZeO(g_`vu0thuDL$Bnk&sSMW zn&9K}t^L_bujZg{!3bQ7pc#_dNVaCDWgiiQQ^4VtJj$Imkrg&6ApiwbK#aX@>*w)f z@jrmV+WTXBVm-B{EwL6rB%y<%{P6InTF=0`lAM%+np&V|=Zu2OSr#P-+4tZM$96hL z`v77Y|MvET$Oq`22JQ%m%YGADcDl#V*Kg0_;uncW(A1-ok-a~r=A2JqW{U1$yKeif zXTgI>iOf7xp`u95$Q9PEj01My!kt;`DHfQ#AE3}ACvR1L_w?`3Ab+P_bBWr;Kr?NW z6vTF(w0L}1%YyYOXX9hF_?F;r9^HZ2S;c+b#ssO!!)0e-uw-tFpxCS00M@X+vTXK1 zML{94+FmnV(7I4OvvN|jq4bAtmR}{viwQXLw^UJuN%Zc8nyFS9F_C#;9SWe3q^@u= zq`Cc~1CiD(UL%9lBDjAhF~$oznOKd+(WbhBf^Tjz+~68IJ3<=wLt`FqjeIVTvG>e{ z=TrytFSrKx4_@y3L9VV#kSJ2wtvHq;b+}Yw1GD}x{$LqrZr)lv3+eaxatD&psPOBi zM!5xkav1n#ihk%5iR~+0B6Kz8LVXrVOhW z4=_=m!+M;CF}lKjfz0e{G^}1m;?3fUVq@L{Fa8EmtlRmUVZbI)=kU0C?vGIRx0XT8Kva}PbSCa z6$g;TaJQV4Hx_1HDt{`B{?7}bSJYRHr=b|-kz1K2h|LN^VcIN7!ehIOb=Es0vKdUu zNz(7sXXPhRM70oMDt%w5cS(M{e_um(ThIjteUzCObxv!T_$zNs+G^R_i-4f%h$U^H7;gJTtjz@l13qDYh#Q>qou*2El(P{j;sWP6pYAxz37}hEz=anm3&@jda=MvYY z+8my^1;@bS>tK%HUEAOnJ;3r^3u1Yvs_IRxbJrfM3Jbp? zO~T8wQP>i73cl8B2tJ?=sJ!$|PKg1zi0!=UEF2FtJ1I$zQTqaMjXK+qcqy3j+OM&M z2>UCXv)kf`P`ePd@}7c;Xk1J5+Yw~11u$y zUs}5q{k%GnNYfi1Z!L#t`h*<$mXeA%cXB!1!8CR@j&g$_0=%S(O`GKn11Pk5;TI1= zI9?Mu!nRc8;S$|ODXrR2Yyf@hW3bEMocR}-b=-`h8ju%@(Vxz`0rab9;kZK2J%dca z{KeTE$DJ-V5q*C)9XmVEgDzcJ6|AJRR3%CeOD`f5I0sg9;h&IMl)Dg9%gc=43cLE6`}YNzLLfjEYR|E#AV^ z@M26PurkZ*ks;;obS2rvYtrFKdg=7nLMe6I7T7b_;a2F(7!|chL)v6UmgLJrsNbhk zu%b}m+L|fub?078Wvm6IR-fElCM%I4o6iTYFa7=h_&=N6U=b>&Mm3h>J&>v!#U9D3 z(LfyM7`%TG+ram=Hnnzwc~Kb$)z7T!c2RLdM$G$J!+Yn_?Yn=nROa%X_A~VN28T)b zhQ#4JcgPbNurE;1gyZ+gZ1K?5Ht~;+i;pkStABP}a=2~w3j>9`A(2YykKbe-F!4On?iR7%{ln)5}Xh;*Y8GisqC*m(1> zSnZ*frQKclmer!H*-LhFTLlwy`^DX1W`@HmGzC%T2Wq*_jnku7i*b6D`t`w+ZOZ+t z>)k`|#4dt-7r%5jj42^q+7k92I!`0kg7=7t67%1TWh3!yX!N~78AaEgdpWJ27+01% z>tKDrBLkLPV9KmeByGl{I~Bz616O_!xIi+4bE0Thco6v_I7w)tw80v6pc=mOGAKU73ekx82$KYVh2Lh-W(RLNeU(aZGwpOO;$-(N8Y4$?SC=|XY1aoe?Sq4t< zz^No`Y|-^(UIi)SqHoULxc@_R^Rl1g<;{j#V`&F0=%}@=SZ2mS*TfAq|&2Pd=CH6pi|EEUKm zvvz^(4ldvBYOW~z6&1XjW5t1>Q^ZT|(QAdSp`5Lt0tIqMPTAxt_1qN@sN@A{Q6-7*@=Ky(H0J)-tw6q!Zs zDh$a=&rBtqy3P9r)m`*dIxA*vgOFUTM)8yg@&jx|Wpuax*?sx%4A_<)H9=HnUR@SZ z-8{7n{F7-7Khlea7_A?^N3gaj6;&#tpn5s~deony}-`fVx1 z)-yUD!KEg`&uMjb-l$JFwTD4;h7#RUEg+qhbZ>JqC#WfC*))Pmt$d3WOi|`vY%TkA z6F%oK8Hj&ais$1BtD8Fe6~pn1F#iU*)}-r$QJafskxB1jv&?7TQ#v3>GgzkcGuQp8 zspsu~Dw90b6T$yS8}|fnApmU7V1rPytEqlcMtGOY%Vd?L+1X2iqy;uKMRspvJ!{xA z%p{160TNWT$rQPmdmcB5j4?>yJ53+&$5h|mXRXBSe{$a~f66||Np4&r?nHA)h+^AJ z;`xC8JJ2SA6kUt5gqP$QndOT_3u*Cc&Pa?Pae1@C#!r;W*l^SuOo5Q8eN!@gHgQ7y6p6CP6oT+*l*8P``FXRl~ zv5gwCoEz=ZxX-cWv;58^OYt7*U{EKEl%^~WmHazZ&2VbWD*-11h#)93L z{^GXa-YFL2VTrXJRH#q5h&|;y`cWgi_~C!LrDiQSTukeJtB$ z3;QKcV)`VLkb`Xfr;OYyTb7}D1U$G*|zS{fll$hr|&z`^RBouIc z)Oyo?Ch+#}nQ7nAYW`3p)^RUjlOY6@#z(z>#})PchBz`P@S^yMd@5f&M%d>M-=bq5 zPuNsSs%ul#{!{ttiemg+&)?J|IInDSWcS*TGk7_T-zW&< zpXkwPxEIgyl5Hn0w?B8X@=W=eM`?d}-(ylizzk_`zcMwM% z=2@2M$ER6$`<-vr<&#$Ag8ko!uK2ZApEt6NzN}vD_INo@v3<9o3dGUG!+IVUd(e*k z7g1u9;p?=rpPYEL)>-8RY{h&qIlTje7ZJZ8iLp`OSRSt@m>t8u>nX2-P3Jk!h@Dvi z=Dvs6PVdJCOkP%IiTrbcReT|&gUc7R$eta~%}D|^@CJRTUa!X(Yke109z6jpM8YuP zJ=dT_e)8dJjc_-L$fbe-r9UktGfnAo^XiueI;fK$ zwwx5^y{KM3&oI$mD8*wb*v^SOe&tEYBB-m3f7Yh;OGI=eyCE?J{Wu3S!faa|MZ8dz zdYGRgjZvUzm<~BrJXTIMmSavWpamIeocZTmH_5)oXl|o1mx-#ve{yr=6{8sznik`) z*CoWg$mD$vj(L}wAYX2=$RdYF6vIXPt{}kd&riPO=jAkSQGTB*$JNX7%+`dmdy7S7 zE-up;edihx+wx$At;sZsSItXnFQ3v?QkR&K%L%e#Vrrr9-KtuU=GIwiXhW?Ik>zze z-Q4A1mL}-+S{c0j>iZ78POdg@^p3rpr*mfWSk*Z`JmZdYPM$xkeyu3kRH3oTJAQM} z)VX<|r$blWkV-MoC8c!lTqC3C27H>l`E~<}mcL6>L}YSC`kUJR4T6z_I z-?5A{Kw9CW+Wv=Q_(q(ZDFdmESqs3SiBAe2DmG;t#rsoQ0sLOEiG>q*+yZD>+G~Ofb*zfV};>d z?DsvlY&W%*w5rTJxedy6+M!Lh7hl!BN@&GVYDdvj5K<+}h;hS$w!7r4klnb`Vy~YD zM)bnwJrCkEX#JXc6A|)=I2GtH(2sTxG@m~|`r17ZCxy5{=%AB-L9LcW zldpia4|K@#Lgc7X$jn}?@=f3hv2SrYQs0IWhbdXr7$L7`Hp&<1@^_G46<;z+sMAxu) zK&6CdWpCQCf5GAHernF9Udl)Wva7qKGPr6UpOh&XZ5ta(Ge2okyJ3J1Hfg#VHRK;M zd(oEK{^PnUcxW>0CdlY=H3HRH3Vp8wXLVBc5V!fsY=B=<9=n1Cb;8|;L_y#hfDuji z$t%XcH1>GRtmo@Ob?(XdTmxB?Y>$Xs0%BPVk2390F^TOxX+w>$KxSLduLUGzQoN+& z`lIBH(b#((Cht*bX(}fpk^3o_4yNF*GZ?U|_+G7Jg&T(p$zU)`>R>R@k}(iKtwaWi zBHnVx{i1I-EIzn1l)Iu8{Wr-UNJfWH^wIXqQevs%(Hd2}&n(zA|K2a)C#)h|5nPiCsmJPQ z+i<@#FyiQ5CwRWXe=dw6^iDnq7VKi5=FkloGGqoon#Z(8qPS@Zy#z^=G*0W3=gTaReUk z;*uPd9b!Q9ESS0i{wZ0PJq#JAwIU$b(!ekbODQxKZR#V8tB^9_-icbH0EPxWf1^M4 zbl!R7wbHWT_9<+~mOZqz2I-&;Sgk_Q@3CGMuw8vsI(T=74vweSN=W#gG!B2*XM@(T zrHb4bgkEEW{N@mir@jfj-paI{vdAgLTtLD+ds}DIf%ySHFoTDx;q@*(Na{qVa}-6S zke3HcEtI~3E7|xmR5PejO%-U=Pju$a-b8WAmP$bQ9&mmvvQr05Cgt~8A}He)Se=d{ z>?t(8ShgtIY)m5^red#N zRZjb*#4&EJ3gOlj1c9SB?d5*<5nZP0Y09o&6AOND5XiVW#sgFGG_RaZ>D&$2f6%Xq zQna#tdNsLijEm$C!&1ixg>%#BFK}Myuxqd(S-JKYK1=P~tkwzJ4-Bcfl*b(Kph!A_ z6!&&RERh}ChieD0CkA|m*rxJC`vg@m2Uan6{f=k-{xn6tCnyza`f|`I<}=Rst`JQJ zZP<-SXC!0hnt(?Vzjwh%AI z7MumxLwB%~;DjOLeu;Aq)P8QN!sI*XQRy_=| z5@R%vAqP_R+s4=a9K}kWUXDM#wZqQBt+x?R8A%(+Zl4 zZ)=-Mz8~8yekBS|-nxvVg!ABVR(cod!n8LF{1v1~yrOJG_g|T&{;H&lz@Hx_qK}JL zZFaDbB)MN*14JFmZh9jw>?B9lHG#Nyed~mEbWjwJd{&trGx{5_3an^IjKxzX zhPOH+HMmt~)7}%j$2-gMIA3Zx_h0mjS6NcTerc`2WF|2 zZ%IccPCvqo>q69FP9yV(4Wt#q=rL9w{HXF!>Uzs?-!6WQIJFeNx_*B77s#_t=c9q% zbow?BVClbn^I6?g{O+*nW;CA&*1TvEP!pW~DZESvM|VrDIw#Z`CNYa)rSDnhk`J+^<%f*;|<+{ zj&smHSj`BdTsJ9h`O#-r;6Xo=m0~d3P8AT*L{!+|`8?2sf)EL107pDeLRS*8wMDo+ z_L(Gq*hB$sZZ>HLuKa7rg|nd_#QfDae9|UnIp$mRyo}t2R=P0jNOmP8a%vn+!^omzhvtRV-4;nCW84G4?VIvOGinT6{oady_AF=s(^@g6=XMz=rH{J(|q;qx(St zc$fjIEB>S(Ydv&4{fXhFvA;O*P=hwEj?{qWhbKWG-nG)HHr_k-Ud)C~9*FilR|MKFw9caBAi+!t(_(De|4v+>7}slczxRr#<_GqLj;powKCdf@P zk0Z!vfCvITiKT{Flc#yDqs_b<^eKmO^FIZ5c^qmn_gbz6biHc5j=Vl~Tfn%lX1_Zm z(vMHeflTyBo(sjg`RI*mZEC{ZB?KukVOjydoR9 zbQS?>i(ZG8{?SuRn-^8{k$6l=zAr$RV&wF#Aal$j)EU1ET{4bR8 z_B!?IlLv@Vl$vagU+0-BWTDgczX%UlX_J$4T=q!kHe#^bb&tj1Vt}zuC$wRxtsO+gd!Qu3M)=pBo$>Im znd|yB3({LfyD8>kCJaT8w?gkpZj}{Ug0!`=bMnX@7VSG^>VrTStI9X+YbPiaFQv35 ze6gK=lzq~$(vfPBW<|DN{%20U^}aQwd74&E&kVbYhbY%-Y1!u`^fw(aw&dN?L`O1b@-i*~z zl3Q}MNywEBc~d&J&)ggQ#jPL51GA!q`YE~iru3uHL7fDaP+8K3pK*d>V*R{hCb`ja zK^)F}c&UWz@cS`hA|vc1EcN{#)grjLM#=^5Qw92rZcUo|u31o}$xnnUuk;Nc6P(aC z081+{=`L2lg4*-3uGIba9PFR=G%e0izt%J@76ZW8GvERPR)^Y7=9D=8Rryv9hg=j> z5B^I^ZT6#xT>tO@!8rmqv2JdL#p4_oYd42JlB<miu$f7 z3tay%wuMnsq{pQw3iiWMK}sZ-AjsB&Py;PUAhQ$|ZCOnUp5c(DGNmAZEUK8wk^D@d zEH4vg+dF0AF!NE+U{lv8u({Q&Rntl2NHg}t7!4sRh0TrA`K|?L>vJgb@5YN5)FEZt zsvhPCDKN%cr#7S5Z%oi|qIo2BD4xfZJ9}GY>_d*_Pa5mg5QJzp*~-L7!ugxH^J*#RMjnX6hhfAjJw zyWO~yCJ0F&d)F(T4CtZ8HB9J4sWq$*P~a_??0q?NIk|o>2UtJJK)t}W)B4w+Ux2O4 zm8Vz$$^IGYjPAdyJ@CGKy<6^H_7t79_Jk3uR#dcXf!q@iPp(_*U*{NM`IS1lcfcJ z5NKg3b=%Ys?{M7RCL75{N)k(|$++3nu7=R}2i&+Ht*&7R+r1V3>dAj%A6*I0Q(@08 znhc6wU&EfDrm1K`@gxXONBp`|n&}vJYU}NHn^}9kc%LmDrHc|uLflCeZ%e)um*zPO zxnWb{gTzceXx&dz-;M9Z>)w1cy(cOSAiqz2`oq!tIgI)*hl|;@SR?f^Dhp2YL;vIU zJ@XRE*!9nEX-j>tT9LC_>sA`I3GAYUO_jSovEOkYrC-tCnQ#z;(iWKD&0RIZ!;4~^ zdDkI+&Qz-e(o|)iPyC(VEQEWRrg>8uRLZa^3GeEc2Y)^0ICx-c|C$lo*5w=t%n3Xp zuiw_J$Id%QVB`NXV=s^x++usE{5UqoBi#LceG)S%w0EIew-*5>Ac&}z&$Kp8jcnaQ zSJ{j7!MT`><0@~-(%@WKsD8W+$n!w)TR12TYoZ$$3ooYKqnc0;>NBT6!JCvJLXFUN z0m@_mnVN`5I@t!#pk%rXPn&9;H*-;n1_b>Ylm)ppseJ|t;*dBOg!yjS%tP9l-5yW@Zww@D%B1^}W3-VZ3qr)HPM^dF9IrtDUE* zR{d;u8FbZa!zqMp(qIYg%F+&8@-l@!Rjeur%?}uyN$kR^^!%&rRAM570Js3C172&o zvHCwRfNQapXPsV^A~G}P!u+guG^pryqgqD$OC%oMo|2df;m{E}X=43#?jPzJe9mVx zcb@{rEcVYdu=5Q*65v|(7)<1hnx0jE7(P|a_a`2g>M7QLk2zv^aPT?VQIN9-c>1M!K`^%XQvAElyJ6jlB*gubvFM9d8swUU5A%OeWcY2hLzs` z5LyEYDO*VWMpVT;;*_01bVGcGq=WXkr@$-gkeFLhm-tyrh}n9-`pdNi573NYJmd$9 zM!tsGrNHtFEd9#plfP?{g3}7bDmK61KLl*%iV4UCb^;BHyTnCKZ$3n*35YCrvN5z>~HFd?DdCKfO#AR+!(dufE&a7|AU=-g6Dtw*v@(WlZeYhjM2Yc5G=&2 zZHk6vb)5FzJ1W@N5N{MGn&z#E zZpF?E<|ZC0F<*5gfhnxeUO!W3LibU{q!T_RWOaFEo|NQDtQ5A#NM=;+2eF^Xh#YbS zl|(%v)`<7r2LRW@Jh+1UE5>EEss+NUMQaBSm24-XA37pwcBL^G(ASE_mgt*3C95zZ z!29YW+7IQf(9UHl0lHFYbG*EYQ#_*BQK~Lqlx4r;%gA!?w`uAVe;gKnw|*z;52GF{ z4BScQ|5Ag3+G%r7`fYwAy``PXm6z2rE38`WYb8N``Ci{)l>ZtxTKYTl8Na(77%8Yc z^veEAO{jZP6)AEAYE!O{Jj;X943f-({rcs}&kl@Up&J(o^kUTLw6ptO?DAHFb~g6J z0v$em8~5`Z_Do9*B2iUJ+M~|LOVg)k_u(OLk@V^wo!@*uQTHZx^MG~i8dnFPEc%}#pJ8e^$={p!VH2hAhRk^SHNxRZ!##(1MEnE>a7+z%Kjy|zJy#NfOh7!q4F)Y+6o#4v%Q+m z&zkT7`0{YP%?orgT8yC_2rTpxyg5yI`dC>%aYzJxD6e8SU~ z7NU*Pk4DR#PWoG8*>)@(!AvJPl+?h}4xfBJW7PYKNq?-`xOfXgrcWBCA;_3HeN8RW zdwPn0Yf>%3^bUuUJ~zN)w3ET^xmFlEoohZzF9(7Tk9(Yy!55J&Wa-eO&j?*BJU)#S z_Ayga#iP#a&l4)X3$8lnq_4`O=Me(sKoJ>R6gHV5B}gwIWvE=y z?v{m-=3vd2q}3wH?}+epi06ciBt03Fd|})(ET|}zx4y{7?X?N|g$~sIxc27>^GUP_ zY%C)}NyBUm`ziu=&B_B8ba2;-#f7oJYM%axVc~V`Cv2O8Hkwx;n%Bb(M7GAMZ9WUX zJevjuRrG66DQa|y4`FtHs)>a|>72PyQhD)(Of<}5auxKKwTr;f4CfgwD=r!glU$n< znS}R`&;OVm$Wqk6y7jOJlE96%mqGF0CS|qvViOD~FbN1_D!brIE0cG+;Pyex*NS5( zQ&X7C%+@*#Tzocmp0zQN@jrhbQ$)^K+D@wIXhXSWL@T`% zZ_-^dR!zXREJAbRLxmT~oIzHIfagcm%sbm~JWH6NSEWtTg^4x_S!)}t#;ny2XgIm~ z2DGeg*#_^H0o#Ke!lmm2JG+zFpMn0Vf27qaP{#8dsKoFBP{1))^d0s_OSyF7`tDFVNfRb?Xh z!+qMEy=z^+MOjl%E_X}@>93);7CI0A$~i}+Tl~1*34UV|K=qs*{Z%|U^B1bHrss$_ zf>2tX5Y!0orUry}BehSq?e48(wnZ$Ew&|k?{P({jk)ZMx(%MXMBq2-l&mNZtZ0GQ5 zA;0j=MBqHw9&{o*^oB_$a`+VV8e&Y%I<^^b?c5T7FPM|mh}Jo^y9&1|PS2_Ly8(3{ z$Ye$aXDobOIeB%YKjy%r6`;VcU-{y~_d5>AS6j#oqm@g^%E_dOYOWS212jdVNkiAG zyokyl)!_=NIlq`R-SfracQecBV{Ubh)!+2AI5ytzSW{EilQ$b1}r}J^NnP_1}j^ z!~==4i}jvCJfHWlhS4=#?ugFUWR-%ND;e9cH=PA7Fy9IioNs0y5EQ=LSPWyst2bQ{ zIq|>ybL{SPtR>9kt4$k0!=?asrcSn+ZB1P?3&OZ+h5G?)AT5Z83!DKCY>l*R67AM0 z(O-*?z03r!-&(vWH|m5Nsg%ShGX|8de2klmyBqXPBp-=Qe`o_5N-A} zCtCnxZQh0~)aA0?$+L4eLqoHHx8Y%DZKljs)!uiJaskyEfdrsLSGC?6-s4!p7%kYXfTEI zBKOc#dv}d=!>&uSAX%c8>FbUN?NCGxqo<4%EHITKj@|U&fZE z@<4O&T9xdZV4?4CMzJp!LGgqmk7lH(DBXi{D*<(66Wr^1Rgwo{cN2@E(o;;O(zVyVQBPH_uw-g!doSep(TjoooF#B}bU17E?p zao3YEW5K=6mzp4%9dR+aq$Twaht7;aX;#$E!}wcJ_&O1!b?f~+Crw${FK+j=Z6rr* zY;aS@bza}FpKINn=1)0B9kIQZTA&jtYpa-V;Xo&d#o!+tdxne!G?;|6th0ZfnnDu@|lrxZC1Tm^PYpF{` z)*RsW#@=X3?rCBI8ejOl1KuU%BU=4WTr~j)a`Vcf_eU5jX_)onPa0Q5suG88Ie2!j zA)^we&$_DfOKFPtM6Wr=44R}rWLx*>yyM~2=@+-o3~$~qXu$*l+2U$lBu^$Re1@@% z_?0KAEEZx4RB85z^N0bC;sBNvTcXb$BxNa^)d>XE2c8`0H&f<;f}1~H2bBgIg+N3j~GqO}I5Wm?ug9Oo(9C8punV zMg>B#S_xk13Nm%pg^)8btbljw8Nx{_q)IBI@$|&y~!;1`qtND_?$S#9FJXmF)Cmpaf)NwR?%9k ziQX@RY{pY_EVw62BpD7(sp)4MHU5%cJ{nfivw@9)ONPH3hi*H@a8#Bt)V~%6;y4lAa$MB!069Fr0^i<#S0G<;@ zgFA8Vz8)By6V|uY`?PacS5{OXuRTMx8dtY-dbd#7I(?OhxpFOdd}Y81ioXiD^It!< zbNtI$mpaK0U059{oACI4D4~;haJxdBCu99ik_Dj+rfg1OK z?eatNmL)|#g^p45CkJp!)iE!54%vMQf)Q_x1tUSeDbt`6|&46epodc7XvNTXQAZG>1A43!2>+n?H7*r^yt_@ zdZRVph$=Osehbg6z$3`lt~KfWzhNX~+N2JtTHk&F>TNA!fz}KMtSa;JN@V9bNgYO| zrs<#vtE^#~%luM|uMXuNbB0)2RxX6_Tz1@u6rPF>RGtBi@_VzHZN3rx3yW}jYz!%x zc@j9#&}!cG;;pA=MB(#a(q$|$6IZ3Yff_SeNB_grTSqnh$8Fr(r~v~;kM6D!Qj((^ z0g;Z;C5<#gT5_axh$zx6p$zE|P^6U*5Gg58O4M;inVG~_GKEad^P2B&nk`5kkH*pM zad})%K#F7uU~NBA9tm=GuS|I)IiJ@6mGLY;_#eIN!N#2ghgGUokBfBL-fminnt~s! zTrKTbwN!dP-`}=#UxhimtBYq5GOvGO=S3MaP?x@FG2M0PQeG--y1Qeq+do{k&_N ze-XL>WW1rtPZQlGVK0qGTS-uk6fGD&Mch_N7xLYw7ms~PDpRe9ep2zXZBC35#+NT^ zrDU%D>S14 zq~36r;m1fq!oiM@StC3B)ie0;`O-8+%WR8TUmsm1)rArF8G-J8lsNn&C&<0OL#oF7 zlM@>0#Qjm6Nlf8P9rurMB6}sze);al{7^e7=G9vMu&`#2pclUQEFrj{9rG;J(Owbt zyJ@d?<>`ZS>pa|8Q?+uu!sWeknWt`N({nSz3OwM+f4VQPU*T=!qix}jN`;mJa`{!{uMMrgUX>4i9OV&p-a{OTWugOl!Dz@a`wO zzhxO{xVLSvzxhP7dKa5s zZjMZ*ypvYum+s0&j0dtGX$wscX?_yuc$ZuT(ujYwsbORsMPI4-2?(O%HFSxu-mCmg zM)C#pbib0_xV4$Qwc`0ubm0=SDL2=$pN#nVq`b@F2ZgJRh}E{0mTjvsDoqlX02^fR zp*$9%I)A?6B0qI4N0_bYl};0z284LIkK1vvFSntV%9rO;bH#-Pl2gmP8eC7$2+)P<>o zp)Dklyu^!cGbBMwLCA>JPZ@}{zL1ybre^5~g|fiU%HXK0!*qjqV$J z0huN=)2mFxY@{ry4An!`iZnkw6n^O95HlPr_huMIys#Z?MRcrQD^GuDU$j22W!?vW zxl^l>!cm*5ipv{|&u(KHb#69B0b+Y2s*bPAcHs`36G+tD(;h*C8TtCFti~XY17==k zV9f@UO#i0Y#CFbmc5OiZsE9TbDiN>Av6+FAm@n33mOfUr%xk%sR5NNQ+b(1UvN2K< zTx<(!O)F9s8FL*n&1{a2Hswnc^?lg(+6%W(vPW1e14P8I+E5PMZ)s>&F+ zHj~bn-;}8zUbZk?#{YOMLhsLmqyy)aS9ev{dcT^ociR@bW&to9zF%|#Gz#A)nJD9o z^yPYY{Z*ZfQXU}8o?C?N+#(`3f@1wg)PGqCYZD`aUxcTRh*IO>00y-+|9HvFn6*I1 z6HKxlHhX;`PS(7eL?tnZARNl>E6pkTmFtRHHZQkgwVB|%@W&)vApQDE5<^=Lv6wa* zY>k0p8kRk`Ar-kXfBb=dO70XwN=n+;(UCw*E4;Szrd0Uw!_CP!R)?5dPP1b5y%~Gb zc)gKA_N!8*|9}--}%PKd?8#^MJg)Db>rwPry!E{d!QMK*R5tf<o7lTPAT*(C(0?V#!fQN=V{)ShVN_^jOz1frt2hue$8>-FB#*;ONE`HvFO zh;%8eRNCNym!L<3+Z7dC2|Ba5{VvdZ$)9EuLDGBLdn*aB+rD9JxcMdZIO6Qs*eJ2c zTbnuKnCF&FsjY;^xMG@{3!>*Z^7d3^Np0R%z|zxV=7Fy&drj2L%cVTeQ0w$pdX>-h zUI4E`uf!YPR8^%H@_UDOd$?14k&vvmbsZ;Ovl)!tc_4*;=%`y;(;!WI)US90tGBxJ zSXh3j!#s`W+U!xX>a{F(B!O%)%f9Y#+{m&DY!jgDeCD93P&ndVG+WBYP|$40fs}Zs zTMvK_L4%tu&W`kOJOuS~RV7@PX}o3(7YpJ!?-S4_XnHc7$$&G`emD|_zyD{y%)`>@ zmec&~@s-@`M0+p*M_LAlu#(+Q#v#81$iKE*tb#ksSA~0+6syG7-6x+`f(MD~0r!esVi{?E- z%xnKISD7J`P|dwsHNW=O1}L>3KBHicxN0-de$7~{v$zd56kRKuQYT6B0>iOg85liO za$dsutBy|<2b46p6s=_YDp6CE!mbecJaJh^en^x`=LIfk+c=}0Yc_4bONfRzx6USG zv|Z1H`~6v>BdZg?HXd#)aUTX2;|kz3*0f(c79qm%O&pYTVpPX+X|}6AFvY|>U*GCLv+zecoN%Unr%u-J}+fg1R)rs-Hj8Lfy(A6S%sX6Vvjb+oaH0WbK=6}`CCQyx z=r|?GeaskbuJE!ZceP(2F7avsKB^k5uS;Xq+ZGBSkg7@q?;n#%b_8*;$l_M5@F?M-rneW%sW zFwuYK=e}5LR?lI?VLx_Lo$UADzWO-r**(L>oYcK7BO~M5P-+LuU3e=OtjD}*FtoRS zfdcaJbfI?@FBpdONN@bVsVm9+i?t1ekB>ym1V0x=*d?ujiJyo`?5Z2_XQK0aZ?>&k z$adpDW)OKEiwc#grtB3~Ve3(++2*rJsDQeys;?ZaB-1#b7(;#=`~k3jiuRCQ;uq}+ zp;aG%L+SdKW?mc(Lr9JYkFW}KOf@@(I|oOPW*W2pS6+8zW}6)KSZqFSqHL5DNa8hVw`!wyvv(!9}!oML<>Y{dv{{d zVuG&8!X=~KE`76$gsB^Yi#pqTCICLm-IE5Sbva^8+S<0#tIFStXww7K7cdEWJgb_; zt&g+czbRjxz)hx{^EhpO^EDqzID#wx{3>!yl2PQ0u~8vPEyuwy%0P=ww#uV|o0c#e ze*3+ZB>FR;w7xYa9>=-o|d# z&F|N~s{ya;{9P|fteh4JQEoj?2BLQ@$;zN)zq9jSuk1v+!!{|`qW57adoXMWb?Ip; zhIGNUi78zr!m6z{1HFkB_y%Izy@=imqV{X|rrSuIThcI^Gs-5ycUW~_eid~=0%d0YkQ`n|OaL43$GN{0iE}gJv)*85D;9y0LasFJ#a|?ck z_#B+KQ$44Nd^9qiFcnFvc+50=OYtLc6`r)S0N$g~7ort~fv|YlgkPuTO{A_~I+9d# znF&&q;=GjaooRLE+8ldz79UQM=DG9~h!!n=6v(~pSF&_mG(5apoF4 zL)PU`#6#^=ILU%b$gGz$E0n-sHdeJvhdhOrId)h~l~?1lKa54&O%nj&l;{J&iCUH6 zO5A+fIZJMkZ?0&}boQ4&nwcwbd(?rhBdM%Qh@ea}$4C*mry!{2S(6Q5C{lGi7iVta zCm|WE!~-N*g$O3kf7Z+?DmTwNt{{%ybPeekY3N40gD0{zoy(Eq8ckNJVjK*_-lmpc zHo5+S#gmIZVMrbMdJ6y^tsRP;6uD(5ql`}kozDm$c2&oOMB zAzd^c1ntn%VRfZX`a9rGo8#J6|CL*tPRvHlE7}wI?aEDwhWIT%pOL!HvNrzvgDenYqd!H}h4h1w*D}4w=XYg9Q@@Yw(7Ayl-tRtqWQVO=qMHO8~l#RH!CuBN`cSqVID@fkTE&1I>e?Y;0o6UTqfT zUY1vPMdH>m)Q@9L>{FBlJormF@~%0jG>D~j+GFO-1Du$AJ?XMu-jt5r!s2^R=^w?u zb%Fo^HN(LMm9GI^8mgx7=J+IuuiH1_%BSC1xpp^TTPx0AB-)~C+g?5sZ+^Mn^e}~k zaaE zKkcf*z&(WPeB(Z)+ zYuhs2fNekxWgAQpc|yJ83pSV7CLSZa`5Io@qpHzDN+NI|paNhon-y3v`);FE5DS2a z<1OoRLvPNn{V^f3t$!^(`(~?zf?blF1QjNJ`(_);-Y*doNmP+!{ro9TF@niReMi z&j>~VO#?6El*+kw-k?5&>(}$(f)*>Yk2w$Ec&}dfzB%~yO(tF|A}}iC%m%^5;)+P% zw%45!ugm(|AbkDzY_?Lqs=Vdu%{*?b+>vGP-F^0X?^XK!YuVm**#%Y7>C@n>;%F-o zgEZP{oAcGbrza(j|2&BEW`-hUw<0dXb_)d@e2h&$at{OANC*N`vct4##&#`24`lQ@ zRZ9)-Kf3)PK6WwAkN*6EX2xM}NWQJ%sfZr`*YYHeH)tYG_ij1|pS$qnbZmd&(Tw6P zpWM~LIXQ9^@S#YEfhyg3EVwRnjE@Wdg7AX9qD-@WTxO(8Y1P4h5@wFHLP56&!}6OO z3ai$)A-N7x*}$iDLKuxnUM1-^sMD!bs^dZ!>yuu8eyOkwTA8Pr>2q`~laJbc*o@#8 zf{x=b4yVZePrmVDb{Xigmb5l}KEr=4=gh(n1H7K}3{^AjNLPCRS?N$x6;Cml2jf{> zT1!$S^Fa8%9y3C9`B9Keo3|Zdz}UCq4llQ7M&Uj_lLCqtMDE1q9O7VSm{q1E)zKWC zZArAnj>zQOTv0=%&zzD(Ccmc1aF_7@#cc~(d5~o4c?6N;1^;vr4yj7Hk<(i2X;0D8 zBMlUCV%KOdNc=u2<07q43YbH@;4|NAPqT-$XM@S38-#`}{zSbjKo=UTBltH-MK;r` z)+e4>-i`LS7Us6hJeo8>)$`fW`#Cp?G&t>zAFqTB*zF-&-`t#g|IimC+*%(JtDrKgC^6Vq*mj8#~d-2g*grv<8h3C+Q)8kO)`!M*QBn|UL0P|2mE=C zHK)2in=;=kA*rGM{G3d{0g`(m_uy8jSul6yNO;b%2Z_o|z98qX(~ze6>D4XQA3i-M zTNR$HvAiC;&z7N}Ka5Np)`#JhDQ=wvP5^t(=Py!zjI@LJcouZu(aX5hUI9~|Nq2@l z7k8PO{tirnfb&-?G7+(6s(V})*G}qU`Gh{Ij1)SsU5_)z;ekxQ2JuQU3YE&_6Ii(~ ze-bW|Hj`-0;536Y`-+kc!|FmXPY$#QkYkKG%)3^~6dhNkD!i1Bso+)lVRmhFE5DN@c0__P@UbG6{Oe>Nsb5nkH4+&tx=ou9NUCg7tPJP@A8L zh5DC|;=>kUK}k`YA3zAu3x|Wp(Xr>Oq^(G^ztz)r$KP zlvdzc1`M{I)N>?|=>?R(i9?kaR*pVEs|dhd9|QDErSr2N*Km$tZ}90v+@XO*Z$)&0 zUS$+yt;qP4JUuVAVGpqc?r_0J*N-XbTX#`^6Yythtm$Nw=`TiE=PVeO^%vU|Qzz7VoQIfO36 z1X_lK2yh>t;(T~IE^n!1pV`ITNU?S;?AHW=#iNzz6%s}YDI4`11Y;AkvbYcs>D~?k z6ow0gBrGFzU|l2DZ0<1iV1uh!I4eGB+@3BXyrRd5%kT4y@u>mMIMY9qBaW-~49ke-5r_6iPga}pDZ6~t?(Lex| z&obr{9G)i@ZNDK+1B!(TVQ^`a-Ot!?K|s8%OB29@9lN@xTr_5DE<;d`rK-5oTuAUGY;}YRpIQJ@qjt8UW}vIFcH<@o!Sr} zp*2f$IgFdg$#PVoIa2zPbZ~wW{fAgo?XP@wGq{u6`(0o=wvA z!@$4u&N2^pH<#%0b0A&FPP<}(y{GE@5$p%ftfnfYRc~9s=r~N|e5ei2yW(g_8S*|a z`lYy4Rnt1j$j>3lkiL)v*ocMZc@wYVNJ|>8tu&82_(o{RuGnrQ79>v!NvEaraLnO! z$Qu(RV#2S2`s>m>MB}>DjA?c%(j~XJO#Kuuy@W(=J&DA#y}z1oN+sYyMiGpA-*W#t zyvaK6<|R|v#|d6n$Xkz2uBKU&ybErM>Losc51d%`hV&+5Z|SvzSa7ZF`R#a~NN=5a zGFB)3Z(w%VChk`O$GD$sn$wip9*#M)d0EXkTg*uOzK(8ja>V&jr&abM713ED%2lYn zPq{LdLDJst1#eb$e#8Y>iwnREzb=ygBG)fVHq4;YyjcFvKf@mZ!SPE|t2on3F0%VX zsR`6+z_PRXQjPGXxGf#i}>u&vdeG|PW`MEZC3fCkg)S7gM;8OS3eD1rC zex#RH4J(v(PtIeqBjUoGHeWLhL?R|RwsV^u1H*rMxHrnZosZ?sRK~PgJ;}4SVVK>U z+1vHy^lCvcF=%~IcspMycv4d2VxjRWjYY|;Hi_lrig0fGHgT!Lk2&IwdhXirO1tA# z21%=0^f#3yZi6xYVT0}1q9|=DbX1oY!T0X89nrVjmw(OVSF83C!=0CY8M){c*) zWc@9-GS-wa7R&vJWfi7y$>&v_8Z8CLu1Kzu)#_n`bsx#1uDxyhN^e{8j{Y2mxd55f zBzxCu_p*^_Ra(@nMZeKfCYQ}qvtMpl+F&3KzaI)3VS=AV8Rhk~Mr|F`+6QW!C=y*3z{_G3#QrgNjF+9P%nJ^z1d0b(=B*@R=-9Jx*RD}RH z;9|h%X@sIk#?eXk0nIgXMPkx^vn6#w995y@D;Oj+`8<38Hj=zdkMGxcuU23Su$yW( z!ESgCf){+v6MQ$%6Ajmjw{^pT=~~4~OWksL^z`GCXqT|@c7oLNBmEMfPzH%rCcMf_dWzkQl4c#ED}Y z{#ROUW=liEQ#3UI185WVNgIBRw^TJ}JZ3ERITZ?g`w`CT&NwFqNKJXQ(f#@`m7P1p zz)30|{NWZ}TP?Jit>YY!Qr=nz1!?M)DcFv1JX?F9naI;sYV6ny%wl$|1Bnem;c38{ zET_xb4Bx9rUL{`>01wA8r0VN?N)SP{bfYZ5EHF9=AK!%R$xuf1ZSmffxhC}|n{^h` zWvNCap-9VCOMvjZUWZTFlw5$4?dG6#HhA!757l~re4R>LuiBW6&8sHM97u|&DmX(@ zETA`0G-rzY5hdWAPy%Y25IX{fWNLB}ovgiJ5AE#NbC3qGHU#dFjyt_ z7e2Kas`shMr1uA0bo+93nt9CC*@(1&{Q^Bl&sn%t_F@sFeI zpvHnNi09zAfZFx2Hirl3qQ;=~9A!_t_k!+B#yqcG;>|3SCj}hLuaX5F!XGUj-%J3@ zGCoGGeNqcQ$x`f8cm6&UL#|;NcO)esym|p6{GP3k4dYY0pW=7aIGKe*NjP!w5fpxWE&M;59or67iq zVPo7;5D$tDZzscISDZRG`dCb1Mv=ApE)MTWzRIctgmcf6NlRiF>)-qCm~qeTHTD{| zNI8?Imm?+ahjsR?pQ08kVmvI_>7)r--^A!pTRnR()qi=Gh_6$N^ZhEAj9p|zeev(v zd=^XIzV)ct{H?IvPYE5%dhyS?tJyNbs2V_kpB_n&_ZTmYoo#8ullhXddJm|1Z@uy( z>mh8ni^-PtMwe4<+Ly&kzY=P&phAh2$F8r))*NeFWQ0tJb<7{~Ck>IL*x*Sme=@%N z>(szoi6g#P5U}9ErD`HB_OMDwJg#-EJ4*Id-><~phz#g{s6Q4+OD#7a@#b0saXw#W zQ%E5YaQVPq>3r+O_$w{)&^x!XV3X}>e}lAA3dY#YSHmLTn!2W|*BTz{rzs|~%fc~-R-tI*qbWg*ISr%TPDZ|QRB$-QoHTg`&8l@F(2xxn-$)feWZ z*o_th7FBDb;v5W#@gye9F-=xVsDY1*Ny`50O!Y2ZxvSA2&A=AA=szW%I9DG<=z93@ z|K6g?S+FMEtB=F*l=orHn_|IuekQDXV`$jEz6>pNHf-wr3ZrDW<}jFv`UV<`ZoVHD zUHdaiF$CKeq}j?>lEVOvkN~l;T83bJC$5^jl4MAYBGA5ULoKNsWch6*`^z%z5qM+TVL*w}Z;Ifv^5&eAf;lDzI-wDwr(Y07AE|?9Ok{zeJxJ%cs>BXor;5jF@ zK0s69z9H|Yji*b)=abKJBFG2J=XKigv}YRzn}N&T+QTNZ^~^Uf+&m?{j8P+Ec5HTC zd}Tfx*vp287tKLDR=5|FeXQX)4bESsURM%Vx;8H!#(9O%2r z`!&ytVQwoV9BpTCsEkY7u6^+!(&bTU4IQ|Bl0162j5okcYLfqk|mD? z-?A*XZ*`_4hadf=dReXKHMo(jY@a`a;27nj^|2Ii%XWZi(g+ZmcLUiCvc;*t<*MzI z)TyOuIm*03?W-Oo21abQ`NPyxqW|bsAXo<|*> z=^uVBJXx~XSL;EXptmz`;9f`fKE=mgr~ylE15h}|8>1syttVc+=ZRuWXav`LcxL9O#^d1zzIaMH6k-w zD&<~^Q&8@x$*5rM+eGAnDao=G(R_})Q>Gjej;Hb-I=aaGmPq~PW8b*nziJ1w2nhZw zyNdCWGi&<3#EIPo{ddA-9m=&kDjv-Je8N3&JjZO$;2ndFZSa$lkztLtLUL!{jQuahy;kX^fU%+rrJ zs{x$ig%smL{*pPbNeO5Hiv)s+m zZ&`Jf1Kw_^nHq~#Nfm3<(CUgWi1#Xd)+CU;Zo;9aDvk$?&NQUZ$Ij5rfS_qv8=GBS zBzT_R=8JP3jGh0slFAB%6r9yZJ7L=h4)|ENTCI%mt6LmPbQE=`>Spn(&I;PyKFt^? zCVluo_XqFuYesoevh(BDBDZ=bjp3of5j{6`!^Nm-gvCn=3HOk>Q9uEvoRF8gr}}^u z)BcuVL@@{XfxK}RH+JXZ+ZecDfo+}&lyKJr_=4d7;-E??)v6u+jnCmjL>1tiXfJ}* zDcko|-(jUqO@6>0CxzZ7^a0Kf9t1wr4@LSz7%770xvxA3T>jn3yPb3XKvXHulJbTA z-kX`B+W`I2DjU|od0fJ}uVth1g(kFRlTyX~Ml5ucS8aN#Z}l9$A&c!m0OnJTUl*eW zw{$lyQ5%Y%O7DNC_rYT9Vc3ueg0*;TWFCbQX`amn%BOIc)X)usS}Z}BE5d_=@XpO-AZReb%KLy^oV_m3f%hYdGYl$U`J z&el(nF|PEgRYMn@^GfqTS*#*1Bjdf|mAz8$?mS>kEJ%457i6ktst==!O+y2wiykeB z3?-JcXftFtC0p(C=P#Ue0bfugw0-;2-ThF40q1kvtb5#+UtE!xzUlZ^eKuT({F%M8 zT?P*WAW}VkEJzBUPW5ZXKij%c?t$jOI3Pxql)jXXPd&g3`+!KCHs)OP`kbBCl(G)v zFxCBSuUoX#;#*sfu2EGqG~uhfO%?sEaTV5CDcWi_K`x^rD|XCPrE2$nG;U-K27785 z%G|Ix!RzqkE;ld+qs>h#y13@p$-fEMQOvJFw^S!10f~?d7&W19|*G?g8(V zVO>k+F$*=U4j9PVqNhG{RPf6hSkcz?0yVuB=m}{GpK1*!JGDu*?p6pI_N|qKe6PY1 zMDdMkUQW3rik5pV`}Ndnz;jf86{#!-w=$WZCFZD4P^;2<6wJC0?j;$?*c&}k{Cb;1 z}rqMFm?ceX>qE1AZM^CItuSp zzS@qUT}?=j`bp_=+mqT6+A4jHp6cxyj99hve3C2$lN*`*ap)%p@ojc`;r+xxKF^8Nohp>SB(9}y>h=L`1dq^{OkgbEdY z6RhSfBv6a^lHtic+F@#^EjGm~!0oS|=Oi=Ik!ue{sKSOp+K%6JUU;_vD3T(iR8q2M z+4Jot^P(ohBz}N$BT~?mAv#i@cjAI6v3#zr9}j~M$a;Y(0u%J@0!2#L{lVFMmYZr#5jITkIGZX^Ki2S%1=rJ z3zm-pX6Ddr>GJK&6c#Y61=#`BwO3AX>A}P;_qfN3RD&QmVJ3hKBvKRz z7R~n5@$f|7iEQ&Lfk&0eu*;Bsv*sHhJh8c?n%TtJ8$zy=yWqXtj(P*f|54lTDT$Mj zTzl=;iDZ37h`x}7d<#4Dxx4ACuwrEmUY7iA#)Ua)$=@_!aDb2aqaR?4iAN%z5c)LR z9HlNe5l*Y+fo9!U^gC4Gjn~R3z^EOn1M`AiqF^|+Sf@Y**Ga}co*F8nU-1H z7abwm=xr;(T&r)ADGTaQYhzdC&sy*V@Ur&QceJ7x$}3gR*!&V49utC&m)i$x_lOp`MPITY zRaev1NCq4IES4o+PCabTEIVY$oyXs1q<>Vg)}9B`$h;bp+dN3|TE{b&RjJ^!Ob%Ppre4e?vDh{#~G>fI4yle;~A{W{%oaQr>R8EyfN zqZZ3~SZMW@D%#d5@N0hrCc;XLoy&-BNiIle^j`pFM| zRGkxhbXi>~Xlz35xH2ZMtSLO38GV?36^@_+rWQku9)ZWgeSR>!9b-IUBu74G`Qjn_ zERgLz@bP2irH{uSGdKWi#!)-Q|3l~Sl9LwwekmLOYPEZHFxU*K0}qZ_@4aPPemQV= zD~#!f_J29Fe}8&*ZJpxf`9CNQ|0(%|{(co~Gx++^5p+ua+=`8ok(v1?RwXb{xOBYK zousq9UYh@p-eL72lp0I4;y)bS{_F9-^6KG_qdD4~Xd+fvYzC_6!mUX1{g5cD^FPrX zl7*M>G+g0UFJsBYqEn~-=tNv#KRi1%y`b}WF5WXZ(VGi8?re-6-qOo>iCnZ|#>c}y z!OuSRT6Algbog=oSEzx=mdF0L0sJoy0I=Hna>^O@Ji3XLO>o^==%+TOc}9-^fpQrh zFsT3qsHG%ST~tEE1nGYeLA?x*oavP0W7ZrAkptV!NRrX7egFHwm$DCO@n`tF;)j(& zO9wV3EkFQ3y(zgO#2)(%?C3>4{9S$@aV-ppiHW&q+*@lv)q#RkJ}7=x%Ig|E^y_(C zT1cVZs@qc}Ub7K+JrellfTO`6`VZf4MWLvez%v{+%AMn~ak30~74Z=HcN>A0;AljY z!Yh6;&EMy*LT#6v-x;#bmrhEJ7SXOTy!AKxRg{L=&W!xB4Vzt^*@L`;P>3n)Z?;vd zy_hJSp)r-8tR~Sc3hMp3OD5JKSxv6H_qL%^tJBGtj=)ZofYU=n zDEb)u@PO$4*f@%W<^E#BY=55$&J%C)$JR?H0%kJw3NRrvH*tbhTNy+ixa50*fT}sX zqO9^5m=W1g>h{Dk_z7kf)y~GimT6DmqNDx~|4m4nS;j!veBf(&JUQRoW{c}cUb>fh z744EkenFiaad9v0={)(B*l|>GZPc)EkLRahVO%u|+bN>>5-TmW&s6{T0cjH=G18e` zK;Ri~8M2g;KDVEiH4{^7Sa~)&qcAII=rIkOVr}^LfWrkCs>Ov2X+|u!Nz4qP29f%X zdbvVUb88bnb%AGZg$CveZohIY@?j$f+)iZ{&8CUj`3FoPy_6#bUwpWGoMzv7icyrd z9e;HE{jY{de`;GiR`loZ3t@{#C_DC{FUQs($q&P$?_5X|>e}$CKKEH#F%)0|^ouxHhvMEb0SPg8b>f~k$v-g} z!LN`;!x(cR|DYsG?QG4OGuiD)qHHmMI|!)JpZ#b`rb`_xF`uFNxGy-}j-62eR~6rx zDN9w;LSbzp{|6{r+qz)L!STp%ZK$$IkzEic=-IOuIk=c0su9=hP^}k9^Qqu%p&<+_ zTL)V6TMJ+Rjg^0_ z=j+jkrK&!^*;iijSr(3@$#{4Tg_G0*aqQ_+9+tn_sQ8Y%RQA|@aGT9OUsl2VDngBz zK8O~wk5xh%ait{fS}kWFV$VyGRs!!d3tRPKpp-a2slO*A4gTW52X>G!%3<6g@q3TJ z04Oyyruwx?B6%YDDP3K8ZjKZ#oI8#TSkY%E#g{T6d-aFwfDP5zQvZCBb?apli+%Cd znM7WfyJe1jWm923ERS5X{1ZS$5s3j$nKG?}1hnK{57Pvqs?G*i%6RXNm!1}@Y+lOz zmB)GvI%#(Tb*Y~H4s(C3Av#2*Lwp&zTNLAqs2B&U7^re0wtW4X2Wmac20zgR7A)3s zY*E1Z2Fzn;HBZr_9N!e=Bx|`oQCVVn6R23IT`VKV+zYQg;z#W5wf>Q}eLJ%NvOo{9X<;4^!C(6P!?25z%?eSSx)hD;7Bvn*X)2Hfcn^cheG8f+^ z_>l~yYkJL<60H-?B3#)S5Pdoz5l?u0C&8scJ_4s3**VL`S?L0A_@v9LSTU9QwE|}7 zc|CX(-(c#YI23>In7JG*>R0tw@;2gn%7Es{fj%aslyCF9WM{(Z3o(9|)-kIy{vKcZ zs0QZN-Y^#$H_BCecm(1C)!&rPY!ci?s^f*U-Nuqym+&doDBHfVnc2>Z%=||I&${|~ zvPFh9`1WF{Ld=%kyR^N*B&rGvgTo3zgxK;VC;&bRFq`7c^9T(T+ELjdb7Md^63q2o zp=9SIXMyiK4sofx8%cL}|9x4jd%Qi@P&yZcH3e-;s6xzms9o)BvuGp;hs&N{Sahx0 zF~#QThQ`P~!NaUbCIl08&!%f(+s2wG;@IvguAD79HG|rz=-CVon zip@ZxZaei#^D~M5?#+bsBxRSS6Sy;N^$?!dd(5;KL%lZSDPgnCiw=v} zag*{$<_w(77s`ZXukFd0%0ck};?+!An=Xv2@@#7*${|x2tP4oc$v7TL2(V|>Kp6mI zw7EsI2r&bnKJv7oF0mOe#-L|GW;Ee~O8>(3|AC%8Wx+0e+r1Y3lmJ$sGA{>h{19!z zC?8^*`es+XLhDH|oZ2lj~xZZiHCG9yvsWblsw znWt1{qCWp%keK=V)4y3)HZV5pc~d7MLl*P{lgiMOz@oOJRE-(Uc;OhUxiU9~3)QKo zUwhfqC%V!E0n(N%;Fp0yF)^x*P_lpZ9=-wLv=OTt`}x+8Ak_`|f_A=voB_X`et2`J ziu!W9+@IfFXs7j5pl(0*D91*m#a3h|mzlG{i!%d!h*B<6J|xqN4w zE1o5o{UWY~bOpVn?u-#17>M|kznFPBHDFpmnbW%VAtn|7>AC>iOR$y;UVj({3a#TC zBjo5vUwDX>$P-0>P8K@^w9vFXRj%GT0fHP^rhr_(xUo%M&MOGDs86;6Q-F!oh3Pqh29AwcI<*AozBPLrElO=%)E z@sBJ7*b%4Ci%pV|v%!GVja};k!J2XHKS@VUZmpvVGTK=4?e|DaDaM$BSHiGQ-Pml3 zpdgyYA!yPN<(Gw%ZOFWak^|6!MAw`LXp$6C&;M_3g>F^l|wV**)UR$VF|jDxN`+3t{n5UIZ`Oi-ASjCEM%0D zi3;4Kb_)0oWHN$SNXAqeNPcu7%>~;wCJb>#yEo&NIWixN7s78)~Ma zEnhNB&X+jg*LymNglT|Uytu=1itI?LRVqa*jsquT_A>lFEu_~P8jWh?d~+K6j!=K} z$Bq686=i{Gt+U}A?NqEZdz8u70y#Ge4?CrI;E_sFprbp-xQ6H=nE4h zUrzBMb#wuG7KdBR>&5*r_N8`vYT70tt0?EA@3eHSws%;&xniHx$72%DjlRTJtJg%6 z9}cnZ1+2?;|G%xAYg3zM@W%f+7sxvPftTOk|7VZ=kDm8G=WOizo|7?wg&#i#u_$Bg zFCAOC#)hrvWw5>ZNqhW1y@puG9$;;z^iD$IdU5LKR-P@EVz_4gvesvQJ!I>e>TmtVLZw4}{xfbD>Un-LDFt zu^-$GvjysE;THl#*#yCS_DNyNO2r=<#J_Ka8zWSPx&mYHVQ&;RPmD_qT;g5M&a+*8 z=wVoXXS>!k-G%uF?$R%kL{~Q!lD2tn{4OG8otmo#%g+2e^;`E3-qs(G;oi_fgO`L& zevRj?rqkM7H2AE4a=?-W?-|k+??S$R)Wgjwl!_w5#_LwGe5D$!z4*Sf75j}myx4tm z@4?7?hc~Nkq|gMK_TuysZ_|dtBQT+bZp6gaPrdZYmP51D;cLGOX*#~Z~Y-Vn& zuC>P;xVOzt9{iPNXj&0j^Ghb_&lcp!1&7{&mF?XXS-q-;b6V4_9J01PnH(#p8Du$d zpd3s*a0#t>od$&4x zQDe7q*?OvV@$|HCsPf3M@>h9Jv+$!liWny)3b!_rLHbTHdiD^o!2$@uAe%5# zHxpB9JPMau6Tif-YL(GSlJVKZwJl>(ozD&C%qIUD3<_6=exfv+Zx{N31$h)?qx^t2 zIzg{rCxANB+PU~6Pr|2W2NXQ2<*;LV>h^<=^Ne82ytBigH5<0%j9LLx~$r9X zgcIoH5SpsUs7lv*=QnZ?))u1l|c7!oNcDFS8rU9z?`%1P%e^uDL*}Qk<`tE zme)@o=V!Fyf4p}(vbLIwbbe*Dq_yPiS*%KYMEz0AiCs<`bJgk26zS^mCa1I%Yy2GT zD9{geb5$tpdpP#~-%7tM$RTdI0(geF0J7fg$s`qZr&tovbx%J2nNsT{X1at8WyKNd zWjonA9sA>3^*at1ne+AK9x@_5?CR9!gLJKuxVj_ScG1{!i8f>f3GfF=jaN!ED!3n; zq9zI7xV%EoOW2NJdG)H#S^poV&N?XSuzUNvOG`IM!_u9C)Y7RmNaqp)(nzy(N~ffh z(j_3>jevl3NeD`VbiH4m=lRXNGyJja&d$INocr9@`JC$_fKa6meW5Opr{A)ta~Qh9 zb5$QN{ipLRz>CUmP@inN_?tk1-dBMl)Nj{aPw%7Ujk1PzCLgV(;iKa*3;m9uK4VdyFS zrUyJ;9mnD-hlR)^Sr#_yZ-`|SpMCr~g=<+0!k;2b7;R7N7#;mK0_U7m_Df6Ew|XUC z;(Ncc$sl$yUw9RSDTz>^@h6HGzaRs)4OZrtmU>sO#j{1~V{%rg_74xuIx+xrkj+ho zyN4HnG(gnN^SHP;9xQQbGNqNl8P8JE9lkaQXFw=I$llqgs@k9iu*hy65x=%*$3vTp6+bnAInL9l+ds<;cQe zb1C%SkMq5`ll}UMjeb(oKHs%llQC=lyLH?L+9!XW`}=#}o734!LmRZWJ+Q?oI%Ij#B-!s-2 z2^Dng!54xWRY|zInDC1F&BC_{_@<_>tefS`&B;!`3~7EvY>FJo%&Y^w^Rsy*d@PQZ zg+Id$_GxG@8B9a`ILlhPXLNrFfJ~R5s%v=`h6pUb>6uro^@K}b+1Z$h{Bj#Jh@-O7b5ybK9^R$&Ne)F^%w2w>5=tHhhC_Z;mvt&Y}l(%lG>R`L@R2yN4tl}SHZ}4G^!&Z z!#h~BOETk$&Q421zM4$=;|GzxoHzo!@*7{hg>kp_7tBcZljU|7TM1>^-Qt0h!xvawb3sFHt@buiGZY1YOqNH)lb7GBN~}0u#T&LWVZaJrZh>Kh&YYEKrbiE?7#1zHO+zLh!;fQ~(#~A0C|6 z_2fv#0=X7Yi~!9tpxIEhKK>yxpPiUf=o73>Kv4b~(fzOFq+eP&5|!2F4JuV7vA$bf z%IT^WQ_H#Bp=2!nrm#gv#wYvXRl0#l-q>AhstN|i2p3A;tOk@W6Dav~Fe zSKOHNAMxlHXWdXGlCgwkRzwu|mQO1NN62UKgq7eV$LWl1n7?L-0xwhefN^SDd47@A zV+0v%$Ql{sB2!xw)u30moH(Joh=^@kIM%i`Z8QZ>nx*Kuoz~lD&n=5If23e-;6Z?Q zer)WnU@)W1EZVAk1^hTbiE!Dwpb~R^pp5;*5!n1n$xtMX`9+!o8mOy>egQcvO3~_r zjASfN+-zc%Jr9m0-GTx3;csLoWBq&dHpk2&Ss2TL3*H+xfA%sK2#8{n=p^#SU6iG@Ecq@=c!_K-^1kTcd!BsYg3(>mKA^ZKKkb#BT~UL~>Pn`SDhui& zH=Jdq+ej#m*yadm(EzrTE7DYARpY>jD*Hbsy|Or#KVN>@2SqxsC%7R^^r34=CHTlu z%h1VoQ4~@B5Jt14td=abx@_Vs<+jqF{vb!A@O%xjw zi(+8S_gU#GyH}2~NG}A?e+8U;=zFJH^p)tM9PR${`{@t`@qY7lkA3gI)(Qdzx^Dr= zcWYe>vHWMDZZW`D>^QULXu`uO&XL!kDB}IP2gBzlpZ#?!Z-~9oufN&wndaj(<$>8l3Q+lI>MZX|+HC&y&(wZ3^Y=gk1p4XG$#HRD77EcLHf zk;0VXGcl_V4-!vY9p~g7qJJ}9GLF>53mkZPbnox?OY)urv<_Uk{)3C);5Y-g2#|Q> za=@=wWu(8i)85Y6?f72=ua>%Q7_=o#lK;ID%U--Cu8zL40oZ5+*nu4`M})xJvlO8n z%@cKENi|OPQl)3C)xM$~g6I6iZ$2%a#8+$u*o9Drzp%=N!@`7Wx+n}1`S1B`7New* zl!_!2O%3@E2_xtO-hHbN- z&wUta01{vlLkt`OXWu*zGF{Vl@&du6+!EpGCNFz_mUqT}&U+aB=KM^IDn zzImRZd3wV5Hivzex^{J9+H<MP_uK_X{b=CS`tIQ(#uVOn+dLZ0jaWFq@vN(iS%tJs<&Fse7 z!>++xTQYALD3lvJvnBgr2uoES+I%ZYg$i920NQ7%`2Z{0cEwn` zqVIg?&j_&|e?xLwlt5omXxY-p=$zQC4;E8PQ+c}Lw*zkL7yJ5v)q8r^GC=wJY-tBw zc1^szFB@E4)kj_Zv!KBDqkk&@oEqSiQIN4!H;9g0z&gI;L+{!Kf%C(~5#8(EkM-pR zrNth(|6>8_i=74(L%%0)V}Jln+87Z<0r^;skCK2-CR~v@+zir5lUgP##o^h?dM&a4 z)pN=+g$3#r%bQZCjCwM833d6dKekdKvxW-{OmN1t7y2zELIhFYtEHv%vzK8fRtR^2 zB*gVHrvg*E-qJmz_}4tPjTEnc^JmLw$cRP@G~z<3AGZvIVhP0&_!I{sCBA?ruN=Eo z3(_xfK0}g~kL3MvM%Q#+Ml*Sd1UNsWcth{`u#n*KFQ^BK%6tHYg_syKJkLBw3f0C` zG=|?H#Nt~WFH_%F=`~#7stu%L+B}K7u0MMtpOX{%Vy6d^p~ljgy|1NJ^F$4AKM9kq zGpL-bQSehH_r{`qyi$bOMh|8Fc2mY@U?&kqwOVR~*NAnulnl)h(uMyMrL1YaN*||GS;{GQHm284kXXY!Gk0Dh}U0F9l;%#B47B6BU0G>FN2jRlO-p-#eW#tnR2{PXIZu z7f7i^jbP%BrgFL8|GEY(;mnGwSdo_x1HPBo0Ai`C8mN=Z{jAzaR5Z&AP!RS;# zmxr3UdU-{%>s39q{m7uF03cyu;VwYAuj%Xrv<-k&PD=jf(W;uROnZXr_^J|^R zAg^CxfpN+ulV-R7obrQ5eF()>A5dq(e#UwsivtEIW`uvFO#svOa#BUrZl9Go&44eK zuNjyWSH23OGgYg!f0Y~1eq}x_yo@|#4>Fnq5HMax;CaK{$q{@P*E^=-L@au`Y}7A% zH$z4%0!KaJbDz`LZ{E<6Tn+DO>KYGBzZ3ZU-FW2!b};yAd!dL2Fk#GH17n&@Oc5vs zf+`L{e|A$`mnjCw?&jm~$$_kIn*PJXsyfy>ly6_^HgpWg$vOPsjL~8U5=I+|d~D(3dd@^pp;XKbyjX z-hqKxlTJSh7@L1|Xs}KoVX(RT@bER*J;zPh&HD3D=BQUxSSX!Ypw29Tw*vx$5NlkI z5!)2TY`-T=Gl;;0yd1tlQv}n=`;1%Cs)H24B!s@Hot}F_dk-zL6a~jb5Yt-73pvmXkpDw9>&MqG-x5h4O%Y+w-TsM@p!zlGcb_ix78N)4 zY$Wqbl^?kGU1@|x%1oiOBY)8>s*uUZ19=DNm(=FJ&a;qh5zRsGDvNKF(gG6eY)<*$ z;Yf)(WL6(WhU5-<^))0nMf%8p@!7CaVhyyH( zFsSj++!8FX^RI>SG!vNF9uA$Cw#UWCxd7FAXkneE&5Pvm&a`RotdL9Z4G!Q(d=+AN zvC7P)6@MUxk59eu%4B|bY4?WggL(F!|* z;jDW-4w@SEx?bS9-pO~T0Kz4&+rb|IvTfZjG<=8M2Rs`1U$rjO>u~LiIWFl3R2$6s zHlXAJY#}M$O}Xhkn@PYm9Pk1HFMqN_?ag*Moscw0C0E%Oxylj!{sq7;hPbP;MM8P_Y0~U&Q(4I zBTSOlGB1mWM5aru5m8080APFfkDu84waA0(wEupM$TA!y!0%1^U;UW?QSN}>tw=` zXr$@OAm3C%`Rv?&vGxa|8PV_Z;BRvQX3uujs*9_EnI@A{-MfrMlHCkQ#_7jKBc8iU z3^txBskJe<=a-}lS4Z&GXOHrQvnHoCFbIgK3q&L3?jVhbKm%HMUO?p`18H&qpGF=4 z4RLQQH}eA$PF`>Q#KW?-tUTNNc)TTXC91$(E zgu0`4Qi@X1+&C4QWF_I1AR~JlBhHE*at#2*h5I}!i4yhvqmliyStm`c$)jQK?awJn z$@FQtER@^0jj|CXkFANIM^D8>QV4l%YFxN&-XDp-VGWto72f>c8 z?b}bl=Aoj<=JGbWKo8TQL#@4&w~@nFg*VE6@98)h^o19m1!zy?}(} zyr4Rl>>AzEJv>}?B_8AOP+ybB~svMfZ8U<+hfL?r}bN4u2XRc^XfMN(EaipGu=Cm){`MLO_GC* z_6rEg35z~1V1pgM;6}K}E(!2d1sg$6s8#MQp2;;U!(414wS z_hnYB6#0sSnCA3aB~6I^SDV+(se=L>1Bram!#?b!+~*z4r(--gaz6^i3i)g~@0rY4 z5Rk|`$xb~Yf$Xz=43i}R29otRmxfD?RusQj>kT-XyF&Bu=1HmFWbs4PwK{)15gi{Aer}YPO+}p>z_9pDQE#=X^+_S{Y%hj?fHvewL=j!$AFoaD@ zD5`a)xdJ0@?>iWxg)Z2*ex5C?m+8(@`g=9Dg0O`Fe&b~XgZdyrEvC?(-9qOq-lv{b zbTpn`?K4YI{Tohxeh!oR>F>6Eprn$r^1rKD-W_*32LZtj558B)l2+{OCU!;^2FDs0KdNU2L z0y*+XM{D=v5CJeSEu|4Y$~<1@r-QPyvee|r<>_!EGyIVeFj3U^O;S>2HAQ0usV@<3SS=X88Qp!Ht1WezJ0s9ig;e<0+wbqN)ISsW*I^PL0U@%X zW7@Y&tG@5lYMWHe>To}Vx#JSrW`ha!gIWIZGy@Au%EFnTPp+*(@;3HuN$dF1eP8S* zYgUGXzS(^6F~bg5r~9W7Ckcl9Rz=5*1WVWizghzB>;K!^eE z-T9{h(>2N@8CL4$$g9D?BeJ!7#h9nTfK$gc(|ASR@Fo|2Vi655Irg*oz=_LsOPX7< zfP=XJ&dW=k8Sh@Y%^89$j2SZ#72iR9Fy~@5+!2|80@iNwg_5AD;Q+5DmZ;M;Jy*Q6x~y zzf!p=7A9MX{v&cQ@JVV?Ka0Kx9>z@P!d{^&ccaC6SVNa<%hrx^C;Kat_>cUPnzb4D zmS(Jz0a9by#IA?0r7z~&d>Oz$7(BH?7wA%OXjOjThz}jrP#&kVM1kQ$yaXh}$aR6E zdAHpU1(CG*w{@1I50DmMe>ynxGu%Xl#667KiV_l4di5d}K1h{YkF23$=7t`LX(u%j zy7AtavYbP!uM(cn839kTY-sY^xjCP6IoSw|udIyU=m`txwsAUo?+iQ<0%Uky8de<- ze3)}NSnM3_l)V2J7zC(5-eMS6q_g58+z4~t{43aOLW{#blh`~k++n7+d~q46%=AO2{5T`ZY8 zbqCK%ID5;riSd{Wkiug9^t`Yk$l1nK(hn{+%;INJv6!Qa+3XL)9>dShov~P#WELKF z`X`cRXt&u0k(&V-3fuIKJzgu#ZJ~p}{8()x1?|lWDA~iz2_fs8-hjFj&&)^6jvsM&HheaBc6b15;o8Vi95|JM#>%>p(jzL~|?bPpP zf}red)n>;Z;%8XjypMim54Jffed>wG7I(_9N<#js!kTQc*D`Qp6?|gbH-fhe{0VQw z`qz^GP&Fgwi*dsl_hpeg*U}L}YLmDBHvVa_+lM}Kqh-V~D(Hqx3w3tOp59cFF(-L*~3WN0VA((`5VGAUtg#>CnX(!M{HoUZm%lIOZLe zJ0zYpfiEq6EMR@zbwrie<*p%}c)@X`t|>B=#%JrqF*~rS`cYold6i!yd=FD|Fr0rO zaY-7zNZb4?lL{)6AchE2NoXH!^D;$I%CP(t^|p^CRuP|8Y$tEOLp}4YmgzJ)uhpsi zW3J-)w5jOkRc&WLbNG3Kpcl>LxG3=H1M?PD3(M0eU7qk8#5dys@zngty+-+8Q%R z?TZDx#2(yjOyo*4ktdl)%mS*Df0`CI*v~m1E{ixgIc)+wWVvtaf9tZaAe4~ZWtI|t zJ1HF`m`04=huO}I5eX00L{v=tu&Cl7`m?{slF38#wFQQG4qiL0#I5u%YS2w=;JBSo|dKCp_p<)m^ zYkzjB7FSYHu)7PlZ1m@#9RliqWxAZ#6=Ta>U|8688Ok>M8lIP-b+S6?VA_O=w>KSE zwly)&SEDy1uKw`s#-7G~vLtgZgk!TY2fp&KkNCVzrj5Th*MdnJDq%z>8O5wHGqXK5*Zv-Gn>N|XQK`#a$(Q)Y~*m6g1%&yr6x z(Id*mx%w;KA(&xFP$5VG@=5 zN&6?|pgWFkSCN3Q4*%54{GLij9bMy5d(PVr^SCLpNPpf#hS>i(N}DI5C;TA)CmW>6 z+H0QprADGH)y3Kw zc)`8v-wJun*l8)j57j}}_zSdc3P7iEauOd13A~Ju2wqnb{NjdFSTdY6nB;+h=Nyxb zQeG#Guo`5dO+IMD)u%Iabi__9&PNJqfEshwEzG1XRmo`0k-JB;_8?$HC-Nje>5nX# zj>rqmQ->#4{!h9F8sRimnYmIsg_M)GQDqlA5RLp|Fi z9QxK}5d}9e=2u5FOYEQAEPE{zTWT3iRKs5N9}tMc_Mb#S{VCh8w<$izee`JTZ0W*U5KWc6!GeiWqtRH7CT}%%F?o#C>jnwhy$X(F&z)8;&NNB}3gK z4DoSQW7RPb8$wYfrsehhJQzA0>L8r$M!x$s_4|dMg+6{^ua^M5-Hq%8E;%hRCiZwV z$(lzYHok_(kvEs4F{~x`PU>toyPcBZrGn#&x{6EN8TCEx#VSoi)jkAF8;(AK97D#y zX8(o`)-9S>z2+j{REhZG7dP^}@oJZN5PA2qdzzEG?vSxwasXz9s(YvivOXiRnVmEL zz(j$nzSO{5P?d!>H9Bt@D?f$5frdNjD{aP3P%N-ZpnW(oO91m3Wtl*x)2NPAtXY1& z>mRn*_~ZHbC6uVwQ6!{ccY8Z*nc-dmdc&BUcUT?dR;5Q6$&2~CKV@=8@cdOjh&SQ( zi*hN=i)(}77O5c+hDA9@oq|G;0kOx@zgoaBAnTYixPu3I%S5G-wWqY2c%ag?nQP;! zq%3fum&WO=IkxVNVYP#UgHl|&!bI+LP0fP1eQ`-1z%Gbs$+WQC#7ZErJ`?#{#zYZ* z*CrtMnD45s(|^=ba0QdaKY~=$Vmg*V?S{#sWw)yFq}7DiH+|e3~S z8sRSEVq}#Yz$hdt<%3#De@NZI&09OGH>5zJ85$`rV++ktH%zv9Q2?V?#sC%?3=Iu| z&RQ?f2I=wggEBQ$raH4@4h_Zbk@{n%ADZg2X0Kjq6CJrb^_8TFes8^Kgx9VibSbR0H6XaZD(JBu6{pj{!O6D2|oFB9@J+ii?ptL)E=Gk%<1Xwlt^?UBl`dbA3%lB}-)4#|ESH>n zutmgIBqGW5b8oXmZ61!!Uf0xQcu{Z?2dlGqEl}&jSrs<)F$3`<#q;XXu@;^nHf>FXN1ZgTimgGok{N3<+u9VpC7#s zihQ~=iwTPx$|fwWkujblcP2ij#M){dM~Xg(h#g<}mE^+VdW8%{;)Uv}o9%(*%z|-0 zp-BsZ8+44j`MQo?MwFF;iuP4FVFh?>ZOov=w!h#x4=hM=KlNv@DV;!GO_K$ zqz8_&mT4-Mj-h@L)FU&W%!sf?9U)YSoxMj==hr~T7^E@HLzd$;j?eExCl5((!(G^* z-BNX6Lde20sjre9_NdADn^%VJ)Iy|;cndfpX#x9wWCoZ02 zExMY1{Qg_@bf%&ahA6uFiPU~4P5>?%zxFc%tDuMh21JgnSbPg3);~Ew`co^U#85cbD>jBEwxB;wT{5C{q3rG~FRVfD})6Og556p-Ulr^h4m)c+zKo z0yg^^Z|j^ct-?}MXG8A#(QT?vosy7;XLuBukrr-LmwoiK#jC+%w!O*};$3A#OA6W+ zKj>*CN)gahGXZ>X+oeDcMGF_h2*KSdzJ(dPz>TpKTnCrsIkN@&v8vD1M@N(^YJ>5s zIaO$)OJcOLWn5e9mOUTxoz{hzKJSn)1f+pNdyXjGc&KOyRu-SEf{k!Jdlo$^B@6yN zgir*n^7As#&zX;F+Ta=3q4d9^tMjK~twz?g0}U;P)UOdfa$brv-iS)_Vw8_xpt7Ed zYBDuJ51C8#{F9MRPAdOR%l6@t#}j7UF*v4oGDj0h!y@kj(h?>GuxIC(WV!glbG00Z zH5QA902iuLvguAjHm{=$N`*88>-k^eDXu>G;Hr={)=UBXHU+C5jVd(M$3M;FnRtZF zrim>mi4g*Rku@wsA#^Z`Ffwq?F7+VGgxiFrzSSv}II#mG2GWf6R`Ze?HNoO__7IB3 zFFlF+DDFFNHQEWUcD4Ylk{{C0-8?%KusOyjTH;%r&G?6kfiN0@`3z*>_9##o&MCT^ zAB`a^4T?%^e4J6c7pO8>8GMR5<&->TJIu)FIO!+uUT=>|l|65bO_l3ujn7#!M)=aj z9n$$CM*-E-sMQlYo!fK(D8J6YI5OSD2Lt51J(8Ne(gDdm8k=8S>{(r<27L2RfOR4y z+6@p4h)}II*}*z6`#%-{pf>ctpr=F=iTgilI}-rnSA4hd`!|q#`^38h+`k0gUhm(- zru$TrH?m$>;cJkz^tEbjp))2&kc?r}M6+&(5$ID+DsQ7qN)RH4^iP1yNHYE(>I z5SE%G{!2k|>E-)c3=gU-lL!Idcen=RPben#)9)CKTOm*SCXp=A=`hA9el?TLdj%$3U}Nyc!{d>iX{b1&0=^hpF;KOiDXt)0h{x)XbCt9nJ&E!j0yQ z@d$I~`S$&8_g;JZ1h7{$SJT{_IE(^#O3~#8_>kI6JSbdK`1ElN?WKdKz|f!Erx&jNknkAQ4x_9$xG4uEP#mnFK=2qb zNfbRKbg%o8kVU04Wjy^RrST{6l8RyQr|%JOSW@QxUR}xb^x7>Ii@~!}8=-^gE!2zB zDd)dYZwtN+kl);D64<{U-A_Lne*ap_nbi>|e8(|{Z`h^y9%~S<{}yLL>mouEo)5K1 zfhQg?YQRP`33RL;r*!EcBOpsO0R_bUbDmp5vm2EBcJS4UNBJQXP)%)Z5U`=9aI#w% zUr@y+;DJ41W^9Hh#FPY&FKvP*?R*q_EF0mo?M1V$DJ*jsk7HCXotWIBazk}V<3RIQ z+b8z{MfKEe1PML&FrMa5A4MY4?@sUzAJ<&p7=BkNXN-@*>6=3lQc|U%L*gMf0jd;C zg0wMAa@Dv?f>8aDLXymeFIkOtCL5_1t3s@TEsq)b_?^6rE z`}h$Zmv!U#H-22a+M6`7PgVA@^4LgU(|)3oCD{B#l)S5v&>w{+?i){7VVxWZ8KEiT zXQWGwkok&+kdYoL*$v})1;|WYi|5OmSyUej< ztVIPFh8Kqjrs!})qpYHZt|unc5$okv^NQ&F&Y(Z2JoO0A{+@GCmBAC!$G0KoMChz; z4;d<^in&LHf$X%Syw++kA^=XF`GH6jRBt`Mz=EIAqzAjJl=p~XO?h{cI*4mR>skz!7$Fj}C%G9OhEpvAMj^hIp|!43J7{qN|9{6mH0Lt$N@3ee4fBoVeK3oIRh`mrNeE zOfj}P3FFFGnS0vO4itW7qe#^0StZsy=|_g29;`8g6E)Xsk(=YubzmtcTdUqo+JMpL zP#$5>xULX;zsL^13!8j1sVYR7H;~(6fLfDr{w@CRMIi7x~rqzbFRq zjo0fZDg%n8gl}hM(+HNpmBgKeZ^;_1H4M088`{NRsj;Y6yk@w)f(c5>mN+PI1I(emrVd@FnJXV|=WR8nD*DDtMqjx|Ig0@LC9EnY-B&(y`tBwRsU~ zq^=5fB~?K%MfP2h##`VZ5Y5y`Qvut)-O;NbkVOdo`(<3 zvd_#>`yGRU^-LP$njQWA9P-N~!E493r%K(*_@926eRjkbZ}2ifyk~Zn#M9IB3Fs0# z8{_xdPSxY%;j{_{_&Vz9w$o>zC*W*psodKAbN@oU&6ABO&r=BSa2;i$#05xQE(769Uh1$;z4Gw!gK2sQmal*tXEj5Dq zTt|mAW*Lj_tro`sf)wigi}=~bHn}thG}`ykytpr~aU`Y#TC7^0G%&f5=k`uYUaQC$ z!{`scLn=M)T1y$7#D{_@+RS$;#6>av`M@g5*85EKpcGPjnd8V+{A-xT03$cb&dclH zF`*^3FnCbQK!JFVXpm#Ej+7E5%P@F_^%g0H)-6J=`Ck(4WV#3Ms43s5TD>w$(BgH{ zM0!v)V`MY>WR3|_;&3|4s5a!3u{K}K)2@lO%Z=PM$KSiDsS^!=619M>f!njj_V%@b z@$o>wJ7rBlpXRA#a~a>*0R6KuK&!t@#)_QuIatiI2zihg(W7PY3QCYPzq3T@6>7k)@uM|Z!z7c=nI$FR>p)oPUsKLE$2mRW_Pa-{Neg>_?BtaRFQRv``IcfgpafVTJGOn-l1n1Jr z_d|;7x@+Q!_u*8EhDjGQ#J3|CHCAhNhbqCUKLTbbzr=&jUM6%Pk3EP_cHmse&~ny$ zdpXJ2f9O1W-$6)oy{o`7{o}bnA*y|{Qrasu4BH*f#m105ql-*5BBgl4k$h6vsIS_3 z^Vv0}0sH(&k9T~do2_A8=@*Aouco2Vx(|-J1+8(jwti{Gvw88<5Kovf85g?Ni|g+ zSUrtW@5y8% zyn`NpjAfuKlYXwubbK$V~445G;Jo&*UzJy^?w*MKY77 zP;IpI8oukVfy^A`w$L-D*_i^1`jAbBcVAby7u0dIgL(~;r=ri=%if^R1R{SSp3E9A zKZtRRwRH(AU2GIF6jqQmUax{CDJc zU08zc*q&e7UHTVUD9l;1GLlT~Vv%e=+jO(ovCul%|=e55GBW1t$1n|Xy) zgMyOIPnTRw#I7_`p-QL!x86HThq^6Yf_saXjwAyjhStRUVZmYiQrD7?+D4Ns4?mT$ zm|~##k2o(Am;Fd6ibikp-h^ZNQk|fXDz3-{6l_(Bf=>-Q)sy`M_P`M-cMVCuk7Hy*y}LXLunW!7>h=H5{WXup z5?&w@^!sGJ)+rE+=HWPk_xXot&)R5F-a|(F(nz z`QP;C5CUecy}%hTo+laqw7?H!s(=u{gKd82JDj zj-E@(?`R@RlnR1c9cdx7QLTRIL&X~oiLq(d1NQX;}e27mp+2flwo27ynRJKqT0 z=6MhUf&e-;9biE&zABF$_N&FT)v2_D4gSTPZ_fXDE+#d_GuXO@Bq*V8!NKQ{z7W8AvgA(s=s zjTv!p$#p8+x z7VYvT5-j@K9C@8~Y(JvPPkS$p!^=@dD&jLXUw7*5KiP*_g7JkOIq;N!8&%l6> zZVD(v)y{|2x5U0jB;wDoKuCuU9KUUhxVOhY^~h88G~@ekZ9T{I?wKLlikal0JuUGo ztf}!GPK($t3!2h(^ObSTlO5LAcs$Kr;vQ;GUc%^{h5aWy`NwLR!#h;13-6w+=#s!|u`J z9+S%EV&t{{Xz-+TD|}6g{AT-&Tgja9H&MZhscyMM&xyXTiS7(>p~#XrtCoGLg{Q6I zwpl`8U_`P%a%$^dq!;urodt>%EsM?j&$3V=CJ79TJ_BG=_2mwRl^O;wcpT;1xQ(PY zU9jvSE-#Z8%{3MMZj9%mVd7qSAP7%}$v@_2_CKm4CH&84)LdTfRfSlth$XJ_NkouKBR;-T zfCkI%B95a<5m}+&-;xn4lFD15F|=?+TUpfE*2WOG_Fz@zB2U^1W;$v`>rOWu=4sZ% zoeXse>JMl9Jbf9&0#;&t1NrdO=lM-Z_^vH&G9zcY6@p)xEFv{wOP>EY+*Jj@3vVVR z58toC5n`c{jrM091yc!{7VHtxDG<(1Eg40n7|Z7w|CsM<%Q(6&jrn<{BPpc|oX5>) z$NwzMdqnb@xw#RJv)`RMIc|JRz#J*H_-pePRO8>+i`L;EN8`JJylH)1@sNi7XBKzB zqvwVt=aezuqpS0wa~1@`mAIk>bmuev4~mMV4nq3iO@)9h!mHJz`&A2LGvfCa?k_rn zC#hBrEtc79-JSrGzG$=KLyH|x(sh%_!(Bn(b=TIIliVjBv9`TECunzN#rSC^2}m;l zX7_X^JazMDI}@9Kf0jQv0s#HJlYOS%$@tUh@#NC=q_zNVE{#o1z^0`LNLJvfpKnBW zosj#r4oo%yy8N55oaukt`{f`yzVy0;@++reL4i^HX^Yn1{bCd3%KtW24KXL_!#Q3m zrxD8KIi_eD9Ul@8Yl`G@JZG{Nv5Fdl>SAt`a>$0{&Zt`pZ0}dI$VQrIy8L*rMH=Ht z7eYYa&W0a6v91!E>(9m5i&7qjH7R~_fc4`$_ytNz2#K?i+yI%H)-#X~UR}ydQr9j% zX~e#$wlrQaEOVG+4R;sgS>0nD3+MB24M@GwTc7Iv;{#kYTkFB`h)hlX#>31ikGJgvKd8eGS8)yh7yjy zrAF4oW+QQw8JX3z$C4wOKxcv=Q`BQYT0g4DQEin6PoT30a<&+*jw2r5J6HBSNOZmpS_N?$j@KvF0vUGx%49cRt!~ zs2RScED&S#DV_h4eo$?fm@1@rxwukiw!rSKW;ovr6Vy=qw+&sAs<5_`9L(`MI2zQ_ z_ZDm18>*X3KuZGpSR${ZQ)Jd93mMF}Tk^z$mWbsgi?B2>rrlfw)zx6LN(=9}%GbT8 zRt5{Mt>Midg4sf1AYNPsD(a1%$8_b4cs!~Be^$d(zv0!8!XzTxBy7B6&XI#s6Zi7| zGS-$wTJ71V88eT9!b)I4Tm8{4Xt0XyRW%Zg^wP#7CJ7WYIWve9SmLJJ z66+zIR=W2QgRFuK!W4;49=s&KabnbEud#eAVO96F0acwX-oEyWWv}ZovR@%H3~q>1 z+HJ9{Q|2W}n2Ne}%Pd4v@UcLfTZB7503F|e*9)7T9De>n;uYSlXvd47&hm^JsqLSc z8SfmO_UOwvrQZ;gx3ttbP{6j&lTPv!$qTjZUBz8q!hl6V8v z1gL!@;PqQNX`O;b)-qmk4LKXl=C-3GWz?SuHcRwJNWTv#qwoxB0Nm}W>nRO}(64n-C9+h%zHpJK`t%#$@e)*Xd1cvHb6=o&%q~5>sJDFhbcuNFl zzoKb7_-^SPsP=}YzwQsbKkETB8rb=$+E<)+{qkWi@8M+y^}b%;(Y;-Wj4m&TnObp) zF)V!*BA4s^YI>dKp*K)=^Ecb!?wbW@o6Y}UqKoYxsr%a5e$)Ys_)e}b&Xdv&YCnRD3L=a@u$RLtB6|=!)+Z;3$lg`UXD-AwSDpObItB{FIMMpWgp)?(SN5!65@Mpos?Nr z5tx)%eD*gR9~zVTHBtsnhdYm0-P7If-|UO2NNP?lR@WL?fM>%};eOaQf+aKD-~Po6 z^Kv_Y+qcR%u4ccJ@uDy(lF`Z)DPjsT{<0vJD+=8upHa&Ni{ct1@kH_dnT8IiY#{C& zVe4>=o3y&i?T796;X4UOLk|$h=M6VA5rlp?3!UupGa+0V*z9!O*Yrf}5iCzLd|C-? z?GL;41HALAH1>gymoCo79_ZKWH|KkR*d2fJZ(1@2kjV3m4ty^bFogpj2jSWSeCA0 zNhR1aRl*Yf?kc5?M)?k9S`Ne9ww)IKyo_P!0WR7ASZU40I+^)mET>z=CWRKp9KiMA zkI%*bA5U)?*7O6me{Z8h7%2^-yFpOE0i!{>rCYiiMt8T;(kb03jigAolz?oan(|aNcn?JPD#@{)1WZSS+plV93Pt%7~^Wur~?xWB+cHr2r^ta(m z3eUMqL8}t62a&$uC1vh|`K_EM`(iGV1+$~puig8b!GAluq@00>GT68Lj|`6tT`GK* zRbOY$J+7%qfKeh;;*;Ud3_-T%Qf2p5s$h7pST)SU&|+E>08>*xNW-Pcrx=%yVTHSj z-RcQ@qIa!@TG9-Y(3%0TFX~&m;G*+n{O(~R6#!GSw9GX*-A<~X_u0H&`f9}h9|>!D zaIw{pAR(=S(LnU94eUW83N zS+$r^;ed~jb>xdLZ^$mw|0O4qnMNOcjHq$fwfNyn_O5YW$4LLXIj`lC^Nx3$m2cQ{ zF5YHtkps!M1V}P#zeLGflGZn?;Yy58LnQg$Rq-E<3N-*!DXNk zN%&HVS2eWJSXod?P_I84%6Z@GPbd;ve;y(`9m^CmCy{X&6=c`Ox-<_$D|uqyoAc`G;HBl0@6u$}1W?RR?wsww!sIO;gj zW$)Q-z2I+I&p63KTRb6EV{88rp<*)#|8vQt2UejaEexJ3o6Dv7^9tuJVwZ3k?!B<<>bsvPG2nl@fksUjaNY35Yj<3<%~*DVa64fj&ws-5C^$|I zrW$gO#cRm9y8`msLn{&D!^*%vM+TgAM{Gn)y06|GzzaVe@CJpXhKl|B z{yr8r;4Gw+%9F@bnxf0Y(bTC0qLq2pf&MVrQ3Yaa9`nU-=;`)6#tVmJA#CG2{)>@4 zf4rR9pF;Gy4RQUfC-I9L8^egufw-fy{>SSE6@SO=ggyOIa{wM~+PTX`SM=TJ7f(7XQ1F6~vRdMF`T-8MKOZPv8F1r_Ho*5k%^(D3TiefFikWTYf%6e#=oUkP2q=BZEb!$LfQ_(}i9T8|`d+NigWmh!8aw)e@$r}TGe>T~KkDDx zgZoZT|1xGm9xd(_5)CHRySFoL?RAvLmqUN|C?s|~8kWOV9Jo%qDAdtke;3pS{bUYk z-?oyoPMX@K8aZY7lTR<43hg;IdcBbn2ud9X*=Zj;PFLcL_{-GU%aWAE@M2@oSO^yz z=&&d2OQ=$*QhghIzVKf%GS3ThbNP%f>+QemoL-)ldTZWVczvOBFw_{)1_Tzy@*xOA8pUz5E)>ieW1#)01FYY|7;5#3IA1Bi48_ZPZ5 zczewyg}5z95~Y!#&C8a8PTjzKWLwOq-tsP(Ht| zIl`1Cn^si*Mi_2TXK;tx-tdXo_E6lf8(H>CS0&sGM@KSu1kCrC~E z{XWcNDye_n{)cxFszo-24^Q)|fdT3hW&9==wGkE@bqJs5^QP$3TQ|XwU3LeMvAb4w zqN2~)>bPD?R3T|&Jg=wx(k&Gxb~=x)MpAN!y!i&tmx)as97-ta58eVvUN>PnU;a-3 zdLiXQf}s?U^rXt`;^3;1VxZI|R5;!IoFHo;<+MxCKfU|5>=Psx47G3j>my^Y09UT& zFvTuoRm+p*vADoq3erThzd&XzgS~z|TLhb4p)c%tR%VA%jSj`eZZDNZRxmqQjXJHn zh5Z0yVFP0&>1p(w*Hmi`|9@Wqh|3f2roOg-DLu_Qlr+&*VA$xQsi1wE5iC}kjy5D3cbi?h2VzNAxtxoaU=KRdwv?XbFiy-E|fQM*OP*LWrtU^1Xzh z2;nu)AdF%GudT3xwV5pvot+ zJ0Twsr>~CybIS_ES%dXh_}$}r{W-i6=%H8GEAqz#&j6tV|6^!%R5#4sz8-|YNa$H=Jj-2# zn($rCvD~@`^Y^GwrNfVX%FiVwz9||tY!I3#vT$bc5xx%^c4~+V!eD6Q)0 z-*C5Q^f1-MT|;f1yj0!G>>skg=d&j~<$z%d7M91#sl1?sPeFd%u^Ugb=+rO0gybo3 zhxNj@>Kw6>edn~(J}7KH83N}IaQB9`*Lz}vUeRmzj_=uy0=2~jE}4h zPn@xcmKx#d^`FlnDgd$E=G13Mh1|UU-=eO`j+NX`->W!>0hlz60kYsHPFLbyVXY^d zNb4pvs|aikmMMabm96Ng8hlKW5{S3dCL@!NyTp7ebl7o{bwQ!9EGl_6=4Qv~WoUWo zYkvzMle15nnt!@}Bt##^jOtMJrX!Ad91^)+SyYEO zltxfCAWgEcms|b}Z}8Lt^~%OPWXn@oT@9=fh^~^sdtEFgN%Hvj{uF{IF4l4YT*r)o z(45%hR{;7Mz}?uXTz!__U7SH?z)BR666}}iYNg}Tm)gaRm##j6YeZX3j5t#=um|r+ z01o&@{#|5z!ZjIvmh8Zek?Q?8W|S;${sQUc3TzoXmrpc`XBuW1#bp2%uqPZdS>S~H z9`VpTHZnAmLx$E(B{tHmjGyXX?ZCH0xyDt)tClD4t>mW9L!OE`ShH)aH>2$>y3#EI zIugYos+ae$CW***_=Rwln~)0ky}OGDEiCoBUrPYM++WZOyHfoPe!`?mX9|jsgM0irVVcvwBXpfsw;lgePB-+G*cVL|!OVy*nInt`BuPEccw>#=JM zsqCz-oH$z-K-Oa|Hj0i6@zk(?H|LI`U1nG$3-DQR|E8I?;(#sH%pX#zRo~NA8%c{| zfW)Gwk?m}t`$dzjs>zOp7GQzvMVpK%X~RPUZzv;|UAdn8y*EL(IA$tBhPbWP6uU5~ z_#*Ib(gRJ+-AgZO747tu7RzhYg!b~ppse<@Z^WPL}>0Mh&3jO?N z6r0oQ4qWGLNjXG9D}Am*mrgxr@(}9>fwM7OD?CkjC!DuR8>|F3!kP&o(&n#Fsg$#= zVyMl)rlw7~a8-3P-mJ~N3CVhKStegQqe{0J?; zLz>YYT{)Ccg;20XaI16Znzo02XqPB9n^so8~>_L%|KVICj+h8ngfpN$AHC- zwXoI{GbwJb{l&I5lvZs-W$&s)z<>yd`v*b|hyHhhsBV)pA?7vLHUcaeyuaLcM$jq< z&msWeKc7QH0ndIPNX3Qltwl8NuTP%-ZwVsI+!a($D@=e2fK8Hgp3!AFH=N$~G6_X{tABh1HTbuT6C<-K`io3A(2 zJH3ASO5VNzM!P-Y>-8FEbn*EhwBhk%s3>Xp7l#aYnKsM}-O--Zow6hpPa(nOWXMd$ zrGR+JD9@;$<_j51bl6{4jo`~$x1ZRxX%n9^a=s!vDyxeF{#9KdgMuPHYma zfD4JUPKJ;$-j_;hId`nmKWodw)fUvQ=oXAuq3V-x+ zWnjr)^e3vo3$fL1>OV?2=}1EX#P%exatT>&Yp)bhnZogw_`4BMMQ9`la<%N0|7 z8&Pih#?&43iNJAz^v&)v%Cc=omJA(Dz}(H1G4KJRG&!tARPFpJL~&X z0O+2m*BDJshd@_FlJAa7OESGrGL3M#d15EDqGGyEsju3P$ zp%tcr^f#8=TiO`h8tPL@gVGtqQV6Q4t619bv1KCCFBbzLrSu#{4DE$Awmzu%8cR+7sh!luA#lxLk}MI5$z@W2|UC> z_5$+0h|^BuoPiBN1)#_8tZH(G%~Q@7Z`A#eoFi2brZY`e<64ysebRE?YqsdQ$|jm{ zr-xev>j~9tD+WMr%&)Q1jLB$2HHdUI6NykPG-_*W`$#5OnTk3YV3dQ+^blmNS2Xl> z^~4boZ?JSPQuFMF4yx*DHl5`T1$H}-#Yg-*&=QLhF7S5Opyc0aSX0XIS#%QhB;GG* zw`-r~#|HR_DFn{z(ftXnqvCueaaHn-)R?xa6Tf=MLU3Oi|sf6}uuw4ilOf6E8>eYf~e! zNyWr#ieBnV!Ncx26J?f#ugZUpTx0S`vZPtL&PSW#G{r4- zP8_nCznJ2ghHAcD_+WfNq#+@XDPR2PAom8?R&!uDnwezI$8Q}=GpqH!If>{)82D~Y z_<9FqlkoEoAz}dwu0$t&-8f(7-jq+Qvz!8et77ILL|_bK{x=0o!sq^cKfpo_Z79_I z0rxF}=S)UTEgwrwL1ATh?1@+|`zTb)MZz1cQFm<#YXkLnH)ugj-AH#)xWL*j-QRqH zB15=-`xF~b)-l@MB18M#)9mH@yXOxt$|2Mb0Wl8?qLvLTEZ7VmlF{+fik+J^QoSEL zsE3CGcYe2C{84_bC0^P3bNjBcC*oQr@WA8sZ^KA?1U=$Nju0=t8=m|hLHh6p@{e+a zchqXVJ<8jSF2unwt~A#N6Oq_Mfhe-Mawry$vpsitPJd<@KDN7I>`&$Oh@$*2*|$1V z!0&>Jp^=qFpXG{OUz*A1l{$-#jXZ8jtI@*@;kv80R?f|4t`D+yjth|2BFK4PrxZLQ z^z+`w1qh^lQcljmMp**hdtn;4>830147#_W>cI*x)rJ^320~@Unl@oy9DI`b+zIiM zX)$zBXi%pDMm$wN9aBOh`XNcgu^Y58ZS`v;>* zmc2xrA&wC-M~7*Tk5kna?ZP`e8stoOntabJvOX|&hGu)RpGx!8PdkdDcs2JnMQTK7;vff^8NU6OJH085TkoP zZigcel42EOv&Sh~A8Tix;uz-WVOkJqB-62UhAgB-Kka5qs4;6Y7gZIu(m)>4c7jYs zM3aAaFg&C_0LRk^!WUeYL5|)V<6dvD`l-6)``%p_cQ7^13wfSUtpEF`@3r}i##@kI zbCf+%DH0U)wIs+Df#S#@I0V?iPco&S#)4nW?0H8?r;>%)blc@+-B(LK?t|k-0g*gp zng-wN(X`=4 zRd}x}oRBVg2HOx{Xi*C7O-_NOt`{)>WMz5Gy`0eE*4ADHfl?a~L{<}$jZ*DbX?|XC zGe7NJ`b%^gh(Q0*sQuve8fHJ}!@zVQkI1}ViW)ja0aevX-<Q zZq<@&{8jBx(p_mhV8M^@jJHlz@(|tOc|8)gQ0!O5AQn237(tINj$md-9{5yhHuedo zHA{Z31q0{z>(^$Xt~iiLi42L&w>(u|X$|=^3cGB@n-b91rjzN!!6QRMS;5dsbT0w= zYsczcJL?#E7NJv@cT)1`(aQ-l#BsB_OJ-tUe*YNqaeULSWtsGlEtrakOMKPj&v`jC z^cLv^EJ1N)9HAt{ z(538&SD<()ybyNOvfS*;D^X^8jsaFRBRmC6vp;WTl#sTvn2Wi;OmHJo^OmZbNbdwk zxywHx?~5SV_57xOYnZ(NBkj9b_Mp-r46F-Zbd3e+s7F!Rw*310ayimN{!^t2v?{qc zdRma~A0-xArN|~gQf-#kz`T%{mji+S$|ZzW`tUNT8fxtq?-!7>Vi$=wM$hO)Ly+u; z&g~rl3r%zMJ_w*Pi$?prN=|iJTon`Q1ZAkl;*l5E9em0d8eX<0u>~^5&IoYhNrY5m zutusS2$GRo&5tlb7~Lk#M5y-9(Eztb5$zQ!x(*$W>satSO%29kOtm;cJGuVQ$kw~{ z75%<%?#3WC$&m;C1-^~%-YbZy#0oze#PZXcYDG;^cIGD^0}wB1)EA;(mFO>{eD>9f zH_3hkXJG5c5NT-sS!Lc@Z-!yRf$t8!U5{5O+CS3!W#%oW-0bZL>X#uqwDlKg#9B^3 z{7oBIyo2yYd6IRw*L959$GbB;gv#vp_r#lx;91y@q_?kUb)zx9K@AoVy9H3d(VIX5 zqx&)K?t+V&ZAY$n1a^JP>fzuCJh{@r!(JC|c0{}l(~)ba+IEQf52^kiT>4#35%Kbu z|LD4AuOJJe|6N1q2ftQ*2%|Do+{R^Liz33@#6aC)r%jS3@-|EIjXN%tT_Pcq=lN#x z%7WcFJhTjq?!`rw;%;zRsKp$KSPK%k-k8Zp_2MaPqTlNU6PtT&5%NH!g>kv?nV|TN z>_~4+e@$EI;YZP+X7DZg&`NP}QAk2}j`Rn8sad4xjm){&ZZwoZCDHDEHn5P{h5%W4 z5_~lJF9FOyIeVtkv#q>h3&?tH4pAhWz)oIxt48b%6u#(JIMqb>=}32y@V3>OX{%wb zA;ftub`bk+O8}eB^xmHt!K$?vV@uM8&dJ1e2NZFJ!*Y|IXs~jNx21GTB_)PBAdu7r zEj=3SY7%<4b5A)fk`uOQ5FiPk_3E~So^GTY-z7onyg+dtTn9#)p`dDoG!b@&dGBa30DMu`mg2%uyLKU5j81{=nt#7 z^M~kShs`GO1())kx*r4)Qg1Mw1xJg0#Ccgz6RN?AiC~_Ys~OVY&Oz(B-pfn%&Z$wC zASf=%U^6;0v%Z4i%FrhrFgiQnD*)b9qw=z)Ypm4v)ITs1|F7`?Dk?g-5;MPoJZ*&E1`9(CJadkDX4nKle%jZfi4lZM%pr$s9 zYjCLMQKUKOds7FGPAZxsntGG%Da$_C)!iM=DYV+@O^`B*jQH6+Qn5pH{7RC|7*!v* z$>J6-f_A@W!BrQCsu%~+fs6udxadyF4H@^Rie%!z17f%kO2{7OH<4ky#E*Nb+u!3; zr^5jDAgjpaot`~AcjoWc_;^dT2F`+=x4?#bir=as*G(ANmxu?BkeF}~&#lQ1cZJ*V zhS{c}5ZqPe+#4QKF)Q6mRRna`UL(2UuJa{!t4qd$jV=BMIc5m$>}MUlLkY z&PA?th^$x6-gg=j5!{cU2D4)STjexU4lptdz!BInS17u{kzbxvFv8#aO|{K5zrX;& zx^LdoZ-SBgibm7}4g#T=kGu_E7X=b4^kfSFUcODQ#_AJbu^73UocM_#&=f%@lSC3o z7K0-t5sL_yS&JM(JJESGJx6rXz(e*+aj`=6ywj-uN1On{-lf_OV@s3; zq-wz2XunViqSvwlENQ{2jjI?|UZZHm)N!Xxeqv{T?j0cLJus}J9|}cIsQA=sXxiKX zW+VD;*1=ps|19#2RlNM|3_q-}@Ro5$!=uhpMZRtVt-j(FZnfVN5W>oMe^524vhb^) z&v*`e-tVn!=4D_JECeoq(!VNROcsxsMNV?ecD;%p4i&b=w){yd5qYn}Bc)?8awsi> zVEm{~We}bM*tdT|2X>h1<7tlYw0cz}!nIe|?0a95K@Pl;1S$?WKAK= zzMNLeqai|48waZ?ofC`@(@U6sE4(R)dc>y{jbXLr(Iuw~j|}-Psg`PUkmYA-h9m~) z`M0Fh>C@G&nU?RRm9fJCA!SApIj6*V|L|Q#hkWg=%;PvxOl_y`R#EZ!%@3i?6>4lR zV^I}-y+}j<9Rrlp#||U1EduInQ-6x-W)8*_0jfa7W@Su>MF$!4rvJu2vB!grmxuoZ z%RvIX+D}X_95Iz2J^45D~VTN>Fq`B5KA#M$3otp=4KK*zekrwkZ z+$qS#mCLG{aDfJ4qW^f$xGjr4<(Q5%KQrCAXZX0E3l8wcmK`lSf*4!vR1(mEyu|Re z8#&t|t$}S!kIJ`>?*dYYR4#uNWgpq6u_7$Z|Jpde&02(*@t8@aqj%JXAi{ zTX9&$U@c1ZM()e-k7{`4NLsKVkSXg9oOR#UNyPSbag_!H1RzFWdh70?-b01x_XN`% z#Zn#g`;?8hW%F!|xXjtQMpNB;g^bXwBYuCHK!>>N>n6K<=xAe7!`Cm0sEezMBSmo& z6H2k4@sPZVj%luGm!4ABR*fGjzWw_Y><%&HShlh3+C$8v z%wFGwW+IknbXz8D*^s^H)tfMWC??pS(Fr|it{9mFW$pEXu(eb=&MXc#QnE@{KQb@~ zvVk;wyLjfu%la8jE4}CkP|JV1i>phEOjRm$vp~0bgG6bQn9!o;jX)!0Jc$Hd@dlD# zW9^XN7_1s|`wsYR6e^h{p@mA|OP)(e_fbBJK2dFK3~$!REcPJVY+I=oV9fEW9DXS; zqoeXrQ;BH|7e-a*^GDkV%L z7$ZvgylkdU8+4;SsBXF_Appa-#4P&LtBBvK$k^dwNG04uF-eZM@B=;{$#K_|JKJs) zOM#_rMqHe`TaIL;8+B93d2RX8v9Izer#}*LSTu>8E=?V;Bz976$>+n2e}>E&D1g@@ zA;aa`Ugu&h?nR+xg!qJP=CYzvk?zu3Ok217=C9hi*tZxsSzyC*sNcAy=nf8hm zhn`!9evp-3y|obGUEUGH1*D8-rnwVV*!>o_r{NA-n?()oBS_MToq-~2oI9}1GxJKL zHG7TxmB4GRiQ9T$HGf7n0*iFsBK}F;*LK7{!NTUQ1`ym-s)$NzVI!#WFYlsZ8enYhD@ulbs+e zH?VKz6}79%|HpOiKMLYpi7efMIj+vTujGh=>x|XVeADh#`ej<|vkLq*EnlUux*cRC zIN=LEm$kLt)$^fkV0`V<;1Pg%_ybl!zM@~6td36Op+C!a+VO&s{yW_FcTbIFoZY=F zv?%Ekd%UCDx#l)nX(eVC+v;j>xx7Bv2Fcd9ENew}hp_ILYoE7Jlvmw)oT=9r1nsJw zU2ifuwTJa33Vl=DqRB@ai|Dn9Tjwnx_sc8leSM4O1N{iN%VS(B+kdecr zVvtmInSnRF^1qNEeC)RGCEbx(Qa*AyvB@Ea{QW+a-qd!H?PCA^(&x%vIhA0iG?90# zZ{Fm*UBNVbZp$f2nB)G5pABdDvj4lJk9M2&CN{r9fO&ug)H=A|FViApA?WRQ&NrHUc)Bq*A>_Ss0e2`RM?~|2_;Jo z`z)m1l0h=%fhK(ottyDsN~SGUocIJYJg{G(4Q+*j=RR8u-;=T%&Vh=g33Qu)irn;| zLK+$#jBmv*mW&pEquaq21fG+smLdvm3X!+o*gTbJiK|T}827o*tVHnQKk>(1;MDUb zrn~xglH?c1=l3`3?DOfzBDfFp8cnxizyCVmn5I;xFBO&r9a>rk6%4VlB%`SkR|}~m zBA0+^MkISfp}_zQd|6y^sta>TXf8gScQc|l%1kPVpf6pK+UR)a|9k;-gRRwx^CR&X zWJ7~6ihG|ex0=B;paa83RC`!6WOb&{$=OS4)}v#GoMh~yEn z+hNl2gsZ7&%x>G@gz)LkaH2iu7$?#m=J3 z$x5~Znu-uYO5^n7d+65bglFWH&k{o%YkENrN|71(^11~4ze z{&D%^oTvnh6UtrC1ek)AL@CMxUD~A5T-7PaT%?_&%0jDrGU$tFiZz#Nc-Oy*EvPgC z2PY$Gxq5>_`(~tW0=xCrK>G%VS4MFF*@77rML5G*$rNQ-C?gX; zrF9X)#bU0B@xeOM+09V(QF{BOc&BY{3P;Q zZBf`auIFVc;avMUj&f4at@h6T^a93ho!gfbq|GTn^}a15w*3#mb4rg}(922SyJ7Cr z_s4G-#(yU~?(O?N?(R41cw%&{5&vgJM5!(|G%rtxiKiMn?=_`<+K2EH?g>Naas!;5 z$^FpTKD;I|d={Bk_8V4uv#VOR5Agd}LVo^jUV^(daIO0fstBe)=cD()pY4(_b#rP8 z98LedT)(Q-V0>}Q8lcr5$ANeOQqScN*?h)IF^qEI+obhx(GtgtLcu7!<`>kDQP?>c zn-G&-{xpRU2Uy7=zNwP#hb7&zAxyYJ!_a#MNu&^}nt$II z>*3$J7r55htn6luffaCiS*>OOKlMOf^3=$`JX>!Ko?ns(h{1o)|I#vvA`zV^Sia}_ zxBXU*B4PyaK#ynR>brXL8-kN0*5A{A^ziFsxVd_J``c;m^v%oBD(j6L==m{?s{K!@W^J|D_!EU_uEuClE;JK9j5nHY2nHRA0^)$ z31l~r4B_Q892i8zeq=u~lU2cV8mi9;GZOqa1(e#Drd6}uas$Q$C~5Tnft1b;Vm8-TV?Nz5a(_jf>r=K7s6*0r|L_Ks^ zd&}lutW$O=IzM9>VnUMWBE8{$@K#%v@gi$!iu>D@VWAE#aM<5ifTtxj^+yR9Qvw|& z^aGD+wk2rU4aJB6KJerckHIu7gFsBlm~_mHwb>4`g)>B7n?{(`W9z>79yaA}lkRzk zyT-5L1Kc{F8toe$7M3IqM(k#C%uM?ete_dqbiC*ljUdyn2qS%%GYH8QS;sv)Ggcf2 zbI#Fia+f6PXQ)7W4kvUcbpSahb6PigDbbp6eWrK{6G+o=mS{x}{b&ZEFXKZ{pv*Q6=MUNVx9 zCE)#FnSoYq6ASi?aycL`eFZ6Pd|>{jALmM(IPyg!hY&!Uok$nXvIB;X5TO2xPLY~~ zH( z?6^tpK(r%yNulPTc%c*_MAREyb`$^e?f^i{pvC1PEs>f{S7wCy@_4+JZ9#rEdhXX`j60}i+)4ygfscrAl9%Ttg2x%G<}1%A7IwM{3DNzaet#gG`Z4|w zX4~eVHsy1vk!T-QEs5WPI^Se&;rZs1vd?44)Wrq4TCZ}TS4>OZj8(YYZ?;-pzwvhm zr2F&Ey+#i)NY5D?%bRiYn?wPBUCAE@A~?@;Z#&UEPddZ9jd-$>Z`0=8B7W?U*|LlM zn@QN#4%mGeLP#m@!WWw6-qd(-y*x{Bd$}G8!h76*#(C-3Zb&+oS6;6wz1dVP8%(w+ zFHYC{gn028Css~PTt-fmMN-9kyDx89qBvq>z~l@oXI#uvRFj=Ah0~exvGJhtpnk6E z;;lU2%TRL%>3^xn$AHk($$uN-vwr4b$Q6f^o(;HLlHw_kij$+QRLgO+&Pf`A$YKh8 zLAn#TkGG)}H4ea|Bfw+Zz0ElPdo|F_Nuc5LMuN6VnR&>~JC2dHEhl z(8kRzL`u~m;Kr!Off64Da{8JXE28fyvhwD6ma%SpePbc|J>N;Sdb4ew9c?@o=&l8s zAj&oKzN5Z+R{KWtsh)c0l4Hg?FmR+9r`7X)6xMgQyoK8g_k+v757m-LpKnH=6K_tr zB-z{awWE%f>C^?bdaa0RZZZUy3ps?PGvNM2Dn`g>3^bh*JHahFEX8MwW(ivc%3@LD ze~BR~;fTnrY`5GwptFLZK(`vI@b3 z=+m)L0NzvoDD%jq<3HN|3125rzg(k|lK$kEv_+x@?RgJzD`u8ti3{Q~_eM_esr2fM z>B#_%N}TE0oV5&oUWkA?SiHK8z%e#$(kZmLaDQ4xbg!vYneOge(In0i?_hyuyZ29E zA(=@eQTne2y{@VXSl^fc#q*y5KE-v0way+M(fTb8JQ#pSQT2v;vrxebzZUkq)9-*Y ze{GbM>IR)!ZH5w7rgpTbxTgRJzRqyPsScEBoF=A$cu3=$CI*luq+xrI2!4~sY?|Y` zXg41@^ZL4)xuLj9VEQxQ@~=n4Uxx^iD0ZHBf+YMZ@eOyU9JUokSXwInd?nG!AkzE+ z*?2yBtbVo6TS1jU0|g#nqwAcf=xxR-e8D);5ICs0ZQURpn=}GZ#5~J|cYEjldEimo z5HNo+oZBuRv#C6S{dF~;`m3M;oiq-XXfk^;{U!!V0=zTB19VpY9To zz424jWLUlw_Vc^lM*nJ3c}i{!sK1d*+qJwCYq7@uA^iQV!VZ1>95^^BR#WsHIblQu zp+am_6S4oP_3>sMd|4sTbCS3@()vy^5?u^xLn~ubJmXHO<)1LwCSeLCtyPcmQ-`V! zvl+D80$_EV^U>Z)tB#)xU_>|F8KU+STz3eaDTp)qU_bmI0xX6D=C41riQ!iD(JRzU-Yhy`k~H}UFXoGf}#FVsdDAb z8a$$nIJocW=;nWFo=KF9&VL2(zpA%h$dJOsdqk76j(I4LLl2!FF|A}zFH62<8!w1r zQ)i?{$+TuNQkR!{DxC8tyDhP!uKeP+Dc7=(E0Mw@%$g0}f-EklY>mTKC( z-vbu6D(VAZD6RTu2G1Msi4oDZc4zH=q||!1D8RE)q=)^ty3Yks^O8mJ9vwJc>-d&% zdBG*ej#LVAVX=$*bnEGpJb#yH_TO&{F+T5()h&bmRRVI+&hWv8C>QP<{SgV;C!c;oiA;lIHNd z;|vT%IVqOE*@HqKGE2(=@8^Y^vr23|W4G;~%!4^G9gDBt9ecbx4hLQy^C)*S^U-zS z=-4Kaz~iFeOsZ?jKQ%6fP*Rb5YDq=XEJnLfg6P{4Y1QO2_u7`r8b0Z=#ZCBxW%HHT z6mGau(p842qPSEM%_?zje);V`m=`KY)CNx3%gzJgYS+#%7`Yd z#b}5!(VdC0T!8gTWF|B}FOejcTM(VZf?JBM{(|_r+Rn-xoC8-kKqr?b2Q5*&!-Uc1 zB&oei^A&FooSpliWPB*%dk5xeu!W%mzYC>z6HBr?St@{%n$iEL^OX~fpv>izwk66& z0Wl(`2a@AF=&gZ~Gk?n-36OUB0z*b=#$5koyD4Fh(Dmo>6phAO;E7@P|nb z=T`7O4jgJ&Es*nOo>&IW%nk^$$Rb5VLkEls6Y<6YDllP$e;#U9)rT`T+g=o?fd|iD znk#cJqee02w4%5qqavIp(}hw;00s+f678xJ-ZC&EgAoE3;nDna=qko%@oK;#jPrv< zkBwA?+n?_e4#cK0$NID)Dv!a7cXZmp@GApQ)StHE(|30BqD^_?XREDmr-ijfDRNvH z{=tUQNo*))s>X2Z44Goa3=t8gp;>)q!LT$E$q&ev`~-jK84tFxRi~tAYo`OgbaDBA z7&1d(pwIQ&-6-%On^T?#z$uccqV@<-g83kO*Pne{Fzi5bnBKK9q~?<+B=r28sXv1~ z6MoYBr1H-V0;iGW!;l?eYl9@6tBnaw59yBtj6TA%il;8Fhn%Y9Ao8h4QlcB!GJhL) zKu{i*qSEs)3_}(M=6s=@5f24F8TqmWa;iLj9-+;u-6PsAt0mIl$-f`BaqJ`;ks@17 zv2&387y2GZc^F-gw!7IK2qahw_g!^ioWGwf8&KEC!6pg_f0)O5Bvh;3gfMM9(GQt)O0dpF|105K zV2r!GbVY=ny^r$j{7qTg6I|TA<$gP!*Y<}|gw_3~K)LhmO6kqENp+a9lal`d0hb8c z=5fi&IrAKE=KmXW5wou2FWM%O%6rqDRXt6{c32!Rv9QqWI;(8b6x*V3R##h$?WWU0 z;xmWjXnp3q0s#$fx=DWO&NwT{Mx{b~X5S zECouZE|osj8opDL=Af^}xHoW!C^FG$q!?P^PGOycbG*L4TZ-Zo#!s_xKC!Q_(y5to zI!q+{H{@2${tEv7>>kj&6$jkn-3mYiZJ`wIw)ov7u62Xa>>Ai1DCh@)WgHLV$=4?x z;;nY`42qs#z#J{@e zZuJ=vLq|(5zA^mr<+O*2C*PgL3$Irj*oj$m^pRx!a}%NkLZrrap6YMN+;9AhbtW6_ zUu`R7C8B}VsAu&(fk7-oq{bJQKYIM{1Ga5jW{V`=r1#Ev*W{N19FzL`e=PKqfC%YZ zK5H~Y{l*S=?&qIEjKoW#z6my;o!S_}Oo#+hmg*n{EEkg(k&F0`bIe3qhSA=CS7+UUi@r zEvpw}8#Cgtnho9Y&gD_!OES@U^?t(D+u)-FOxLlR2Lc+kwY95%PgT^Co36`q#+}>w8F>{e`6c4m! z&c+!Tsl1jR&@6xB75`-|NH7};v{C{)#krdjYaok35QkX;hvfwC*bwp{J_H9N5qwu! z)wzpN1m)MUn@uqQwLj=Di#h1W!ZcW?3?4^QcU$W|=NTB79}{_|r4P{jW$IV*FRAv2 zp1ViN0&^c)`9F;8iyvtqW4N}88yjx+wAcZH`%=cEZ) z77e{QO1!W*LqgS(x6DVCBFYTE7|k13*Dp2hLxK0|wOc(;W%nl;+(wUol-`*A-+-!jC@oK})La^s zs!| zvoUp*{U|DjID~)0M*LJV9uw3&{=l&rzt`1#QYzi^VUTkm)W5Lr8TUramDv!Aj>e%| z7^iQ&!WF2{DRrbq^MVxxC^Nnkn*)cE(!F0V5%hfci1|KXg>ega^Kbfpb=WP#TrZGo(R zRVx^jTjhGAp8D;-8#P>BmM&JB1VO@m;n*NCT8Esx!c$*0M}z=&9W7yLs&1||v*`N`0sW!!1afn)chZ<(f97DG!moIPa15~+^rwe3xftJ4teZtN1m zU#Akq_4JF0jT`=RE9Ly_ z)w1T9EB)x$%z>?ft3DVGnw<$3GVqUn;pUt9?Yo1>e?7NSIUM^Dtqg#yl`4}=7-Sz0 zDjz5;ND9ZTqwt)Vp{YNuqU%q#$^f-xpuwYn-n0g)8yumOW?%`pYl(;?l#S8QB0HDj zXPaXfa>`f(jNwBjuV5t7h|vGX)LTb2{m1{}V}x`L8B!ZahcqLU(J9j1qm+=8hS8&2 z=@z6L1f--v0VM@#knZl^KKI`5y}v)UKen@Tww?ERzMrp0s(I~C5!4NB9;>}&)Z52l z6uVhg`2oizGr;H{Z^@QIipAo$eB~ldL}dw&!w`0#RV0G=GU#NU@8tJC$Hn{N(Vw`+ zbU?z#%J?3%`ia9I0LT(zzA2O)f7`lAeiGdHlzfHa&!}mY_3G$vkGKM@S-FsDCX{3% z4u~R?tuDU*r1xIZ<+)UNOypm;D}jdiukpOgFUYVRzex{MuL-8QSht&!X_S&WetDt4 zxs`4hse%f&#}%kEjQJH@Yh&puM99=@gX7DiQJ^*+PDv)RWbvYZp&T^Ww=D9Q zP!)I>aG9L;FS6SEAO4D2|9cmso6>lH!uNr<^GipqA8-1n$diwXr}i_Qx_S%=x|eTS z{U?aLK=1zlr_$ejQPLV;!A&Yt5|sPK`T49cFq@RBl$?@*pr0Luu~@OKgOy^_`5Rbf!a>#b z5@tJ<2HX&Crzb|*M}~?|A_j5jhzICp|L!J0YB7NQ1Q=2PODIi4UKQZy{^o`_&L!~Q z?JxY>S^{b3S=MJ*+N8dn7fLw5*27$d%ld`*nQt#1o5}DUGv{V;@(yJ7+If~JQ`_G@ zd|Lb3=_nmzH-y_{(7bf(pfU+ReZ-A&Csn|XoqJyu%`(dhSG?U|6*_E|#Sbf=;NgbK z&rLo6Qq%G-UU}jzQ^N1rkyIFe4UF+02sg51mM*hy)u{gsWHQm_(o$KUIfOToiO= z+Z2KD6nUcFwDv2@w+W{xEw&Jc?@#W&BuKf)-|@Ur5K2K@_CA}NJ&Ho|MI7Mx-%XNm&M{RwT*UV*9tj+{QPxe+a;tIYr= z@RwE@{xTXxLpyWRjNt=+4MvWM3tT_9zlx!d;4It5i3bfRYxGK;<@YL}Nyq0Jap|kR zP2LxK>hLHXjD^a|;nS-BfH^dhN6RV~hxNgMF(QnqN>W8?udYDLCUrTNv>06?jT`i&kSC}qpRjYAusDHK9G7-N`g`i87!z+dPT3$lX{(U7Y5W2Hc4+hL4s>V}S<+mLD)I zI1g=r+$+VswXqMhC#se?6^^uj9WLB3oyN&7rKnCm@(G_Eg(Ceux;mY}-*#5I3QV{b zgK#~=g8z>e01~jT(C}!KgzWwPxBXi$FQF<{p1*CzsVZM#$9@~NYH-pnR(wyxPmm73 z8j}_83o@dX{)eI;`(v^`b^SFIvB5&mGS8n43=F*X-5{Bqx4_%z(mY{SlpV9zo{O;5_qt;^K!X$&Vn z$5*~^N|(SGE_z<-X2&Qb59E@Lx$7d)j6LejW6QJpeJiEIMuroqV^OB6jZwz-9HXvU z7N_6)c^Io5qY{f^J}9^Zp#0gr*0e~e$hyw5bcPe-exBUfbA4%H@%CTWl0cvu+`5!F zVhy~y=xRHO3j5Hic2gtg0fM;)G@1LU*d@%&3p1n%av^Gp$U3sqH-MG3@cqgF7cW;<+*0ZOeDlQ&ql!^XqOiWKU}@P5<7S6&^%P z_gUn^0LBY}`?U_ASVz7txyNjb;gJ<=`;vSVxfq=8>%-RF6-p3j?cg+T;CnWR;Wj#Z z&;)z=k~{s}eUcly4ZATyrootf@21{$XUzh06dBf!5(uv3=aq$ThFHVf0GoD?MTD}4>3f69 z1`h$XtGf6K3JPiaF}-S3qPB7AymGOsmo|hI_0lh`#p3*z_^3mx@IVZFg}YmK@rjm& z{cj^&Xjig&{%qp`SUh;)AJg35>C5dJE9AN14lW|HY-#@p@rR&4D8jLAjFf^}^~ypt zmY3LTZ+j(rz&C--G|qm0KXmWOJb4aQudYz>ZUeI6a4Ss}4dEc2z11>^22?(I<67`1 zsqbA1zt|@4n1F712Mpti)Y;X&S9BL{GZROinlD5lsOln@a65!9CbR|B5sUhOS?-di z{47_?+5Y;QGotFJ(xusd1g+BDRLS6yO;0~ancML^2LiCl1R#6uo2SZV&=nvk*Cqz~ zi5%l~(C_9@FUYVzr<08|3R{tL7e#$e-&gK6GW1KCd%e2ns^+4LnAtj z=iMWq0jH?PGF-*YV!~%{V?*IHsPFAqsPu+gocp<`X_x~;cs5xQ>Fp{+_HcoKvPj(o z+wwsKOlS!7Jvl}tF_(e@zYuHB-}6FaS}j6~ zK)dv~A(2P~F)V}4HWYk3%vrs%w-<_f7P+b$ng>5%_%e1}%+s9mcXY&&n@-nn1v~o1 zH^tCLw0K!0aEpBG)k|StIp#?JqBgfz@?qc+_eJ~J@0a@~JOAE!T|c(}2k)KlMZ7xx zetmfNz0I_3J6yt{k(7{l^1s(ak?%XUKSC3+jDRp9MpSpnaVng__)FvaBu{Df#%syWzJ)xh9g^$Mi|CUmrwR>c6ru-`j z>VYJCowVG0j9BFZ&Q2E}dlo%e|N0UiHrwZt)*Na&OQNma9=}}!hg(dVNvVj*L{}F# ziQ9?CFU+X4ejVRDpEG~_YHWMIB#)2mw9lMj;vma23IEpd#@Q~Cr0II`!6iXhC6eI# ztD$_8Tx}KbTNOnL%tzBz;>906hXP}~ir`@nos`K@Q3p>nT1^8kq;WOIfmCodh`TPZ&F^W~n_32V3mw z5xnWa>OM!nU<@;z>sU07kqOa$aGk?kpdUjM@}H`O0zs!Tt&VEk~`FsEUus%nknAIRnw-7iXscX!ZW!sKA9CZ$%a=+*w&w1QQ}j-&MA zh3B9sqM0VDZ5qtP<7p)EVfX1b66fhWH@YADmwx$!B|nF6+(&y0(I>kh>h^PE23Q@ zLi}OHTCR7aiBIK!U}Ns&98%gY`!=K8%~z`!Nh9;6%oDID(Nz|xn^B@#M5obB@zo(g zP%b_+t!Ci>V8wFbt{MfV&N7Ae$+|en3tZ2GG~)zRTcaZJ=v8+T5Hsp8W6-w1xpAQ& zlO2c1B6aJ%#@3ck>lYK`{HHwbE(YUeae9UrZbuten6h?cye~JgDpezU75}mhhABXy zP&w%?=7WeBfS0&t$LcpGKnGvOAT~K-AoO(<(U7ceP_Gnnz|n`EaFpt|s+xNhnpGc9 z6>wF>WtX~RVFcpJNG{3npTguFXB8D^i?pN{($b(t=_PFNI+!~bhUc$bpy)&h=d zf$gEM@DGR~T*wou%B#8W2iWYN$;Tk#oh!P=ExsL_Lq-@qMQBf;kwEwI;%|<%?dCDB zn|*k>p3^YrzoQV>h=+s5o?wsdE5-%W@c!~GtKTNoz}g9_Y-7oN-L$T61sGB zYwrW=dS2X_+0O8oH6g$e{GIT1%A685gm!yQ06LAVi)5iA_VN7izCB#EVe<9N!iyKH zOCq&Sm{(6k7ElqDXp(m2f1QT4-$g3^KaO^o(ywceeN*csS?(nTtXxE1*Sj|94J~2s zgARKn!`CvfreO~s0Fu1xxZWkQTH7)E?xeTYjjnu2)kP-{Pe14CcbSG%fKpUpB&c*l6{0>b zR`|?QyhoT%P;EkLc}Nlg3cyB2Y1|4%Y|Sj**JmA?&*rdTyLm)Lx12yH{rAE!(O2QZI1_@1oR@L&xLA|Qg@-=6pD2{N>Zg375`&HV69F4K zV@C4#O7^dZM^)e54U%Cb;T>dgMj2>0MHiT`WAoZkT#G~Hb*osxj>_We6%!e*0|-Lq z5btNKhHv=w(V53`WSKv47JXwTV)PFG1_^=q#xGxX#Q|7ZSqIsf_((;6QdD>_$J0WV zIiOTgY5LA%uWB4Sta}OlzQJziU9y679a8D?Q~POIeh4IDSL7>3b>(%ix#R;rgA+z% zVJN;NMtVHm%z}*1beLP(huy_4vcr_mb(ATQ?%?7iDyPc6<6|;W5(;9~(-2mRS;a+$mEg#IrqM61#M!s`y z84ae(eR4z1NvctZqTH)UE%|ZP1r3?3opTFnCu+(} z>*s^m9^8hJQbW39wENJ@AJpcWII|YdU9}^*HzmOEkN1b|5%o{&FZF9(#Y2%lePX-F zSmx<4rqIxWy#Nmn&v>=ZnZF+Ga4);`P37t<*->JA)0;ABjXtdE5c0A66D-yp-$PABB0Xjvb zeK|B_RA<}K#)Xn`aI?jcuA<-}-~=5U<~8;Yx$1g@v#Syi*-wAt7)bkkc$~;w zzv&1ww;~l8v1TJk$tdKiaJT)NX=)ZL3}T6Kwj$Tz2NcB;OMQy#IMkcHLWN>QUw((v zQV0&H0PxY5+8PYsAE?YuU%mxqt6Wy~Xv0K#Syy1xamZ3*yOs@!_81VPQl2kpA5srd zVxttpYM%FEel8Q}wy*w%&lYkzK@mluDHO$YeByT`yNY3+8nkL(a@Kf0XTDIny2|uP zSBFRSOW&j9>8MZq<(&$h>B2jS+n*E-9gh^Zy!LmCRKDLHhp25ceax<3juBqv*oNN* zP(e<3BVO8shw%TA9o(jTEI%A*l#^8) z;)g%<@@vRbr+XCSYJ^JeSz zAu9Fr>YkYR%_M~@}noOj+a?3e2YFvh-l zecIvI$;{m#bm(sz_-97+`RuKqZ6|Re1=iL9yzJ_Je}PrLAy3?Sin>ea5pj6m1gZ)+ z6r;kqu5dD?iiq@Y4*KAW+<7%l&Tb`2A7O%baM}9Dm+pz_z@n|8WpBQtxHg$AOB#H@ z&4v9+e(FOTvyh7#Oi~=d3aq=xVHwV$vUjcBc<~F+Z=S(Y^yA|}@_%0V8n~1L~o+;d-x9l)FV@ZqvAw-IMM2jJ7iHna zFdnkV6cptuae`*77(~aDE$ViykcpOouG=7b=vK^-9|IuTQ!g#ii#)B@va3YvQWq}y zuGj%($Y4ve#Y?(>qM*+nF?c3#o}LwaBteVDTob>3b(1Oz$vSRgrB{f;i+>qFz@9jq z3HZ5VydeYee1h1zPmKF1_!{L<|0aE(dVU|S?9F`Hju)3Y3H4e;(%HH`}1Lvks{aSzBCJIU1$!jm*}zWQy#$o*ptw%8_SXIi-W}a{?uIrZ{av-!H(pvcs*YeAw+*7$+FP z_ONz^GG?D`51Lc5vfUy)M7X5s&(kZDC59POt+#}YLPy33+?^&a`qPHJ^3ii)&_6-@ zRQ8*OvIQ6i-R(fdS~37zpoM-8t*_T&`Q!jEv9l?_;g$*dtAsw{f2IaBQj#ZTPui~6Lqw-)yrLt+$e8wwhk{Y;eT zTw$RAjO?~JGO>TnM}SxHy9BW^`;#@e`<#mh3y)nMW=p0iJ8*BD7pHi6VY|Nvv@o3=>^xrZD(NIFV2eAn8&+9&!hFVKwX6x4YQ$cV-XYbeM4YOqW&vb zBGkhZ3jSu`aa&Atgf^w4r`y;9n%fOCG;`^S7wp9;~vl zs93q^e5*BQGQRAeO4L*_;7n)XJB3&Uj-amO(UaS%T@*Nh-xj6ZRB8=CE84j}MJm@x zevB+eW--?NMg^=6;ipetDrz{`mON>tQ)#E<4Cz|DNW3CVlUOr7!Ek;t_}*EkF(A85 zYFDD>eQlsg!}kZmVzxb@N0dOYHce#>gBgS(iyLo+^cTEirj=9ic7B7dOlEEL!M@Df zKR47_G9e&0tLD*1rOr;$H@l}df5s>x^tMInZ*?U2G^<^u1sGW3^nUTX%88M zNbPqma~Y^7r}}>vd{dE8{NXK&#Exv4y*-y73+FB&Tw&)COIPm_2yl*Kq>RaDdtwE_ z1}6C*)zBX2rL&<0?Cdp_)|ObCW+gFIhZcl=RK28lUif5CoFc_b%A#<2H`On6)NHzs zCNootpS81T*p}uY^-PhoumMo?#)X8hdz`Uq>nIe5s-Sw>3rOxY(Sgi>WooI1%^MACr+f>*xJ_ptzl5iNY~uzB{t1PHma+PiH!gqu zA}h`F=KdYXRNg5Q<5&HK%#Q$v!UZji4XzNe|Kbwr<{pbCH}(V*_}&P}i9Da{?BTU+ zXH44mc@20($3o@eK`q;V*X-rE__+QsmpqsJtbt1=*ZpH4A&Ui=?^Mmr<>D3cD7XS?V4=moQqQvBz* zEdrHh1GHhb83jkA2>8&e^ld{<-L#i3Wq+%$|Axro2?w#SX(ru2f9LeUngCLgta`!p zEmt&08UsKEmL?1X^V}L|0r^quvi|(X0w1Nm>(t@NU3_(|z%^%m7G56?zs*VvLp{}s zOhqyOW}+;KPhob&>|24?(_{zRFzT;6YN$Rd^&E^c*nuBTkTHWSNnnjZ?eE#C`2gBB!_5LY&HYb=h` z@pBC2t>xZde53zmv1Dzrv~M0rjelu)_2jP+n#+CqKE}D`F{5?Net-9NJ#-frBTzRO z348tpGdI!0ScJzKU__d~oRHb4DWY-cyL4N&qs2KY*No;Bj~30KXG)R2QZtF180_PC zS227~mnRK-Ao^%e6!s*_;b#?$JTVvQ~VVQYqloMvLDH9y^KRwI>`UAj!8{>$vjOoq*N z6A6eO^&sT<{Q%7~>1XC)(Opl8GF;;Q6_lwt7;AnsDi+Pu&f_1%C#l$wTx&(CX7-CW zTv0|qLF(;Ki1~2eN8gMRV8JcvEOW3xd2|~^&5oX5d{5NnA1b{FOM)tpQAV5jpme$(P@LqwBpq)Uqtjql~@C z^H#JXrDDU4B|*rg+A2lESTs}-Bac*B&>gBhsGpdapRc_1I?)odm^~H2fd2bDe!9N? z6L``Fqs)sVV9!6RwtSzI(D7b+%Yg?`Yy zu~P-s)Kkz2rj)JYd&>*#O(xA+1N|z8TjDYSd9mEY{(Qe+Ya#5RK%;ZgFjd+o zu6}-#re!0QTQ6Av(md+tKTivN#;)dcMV{atVO&*8?pe6^cV6Cmj%;RN;o1>NxVWBo z+-|fzHS_wla{Y<+VMB%Z#W!gUfyZtVC$v7K+|$8ihUUv<=lt3Kympm;aenJKUy%mv1Q8%Gh)@Yr7l-^7?|{AREB&I&mM) zWI9GVSK<&lhws^EjcjwjapqmYEPqZ%it@Km-I`h;Cv3MUd6f+-Y|yPXibczSl70FU z$;4#u^|k2e*w}w96HD$|A8%&3Q;}S8!0Hk%s%E4x{fd|;=8-ROa^z&UH%~MD*3+nZ zbCNF@mxR;!4ei&em$$MJ7l;0vp~&)!$GZKxYQZv^?=&v-Uq{a&g4G-Lrtf!K6Z8E2 zmlBr)M)9gIecCEyc0c-qG)(aS-8Q(DW^&B~wk+oz3{3W9kc~xO8>T->cy7{WG2J>` zqZhCGOBA6^iER1_(0xPoon@iY3LT<1Timn8Ael}eNSF9#w(DmVz#A%WY-+0M`!5~v zV=7~QIqgdx7*HGL$A;93)r{ z5f5=*^8oh-9zOE&ju(JnH!Hk1$ZU?X$-#^5wgoiVhEq~vJ1DwlH$g=eP6}-82mzLM z-LLbF(T{o@y%Kb+{xHiQ9@V2on9qUQ=iA!(A1we)YSXmrL7p#jWC0_y7>0E#z>ypQ zX*ycXQt#FU4kM!ez9ILELf7%-{3|viBULCfWJHMRcFTXD00@d}=rrTG{78eDmdE-f zJa8(n5&}CB%3JP@Tk*9?uQ-p9L!{sC($IZ$%BuQGeBZ@FgnZDaX|F?{m&6=@8ylk~3pV9R+@@!BBJhA}$lDI;YKSJAkRDBsYoOUQIXaPIsm!g41jz2V6-zdl&m{wYuE~RI^)f=smMHl)v zFEPpXv*^C3s~M>#DV?n&+jl7eFRta97;8RqvSD6!#r|z&AAW2*HFnApEa4bShg}j15c%%6|MPWDYv3Js5kh&m!bHPQw`HRSP-eWSqLO6-;&5N zr)#n71?STRik#Y})2cJEU6n@6KX0bslY=413VN5*pW$KZ6pBD(v8Y)EH1WU1ySmu& zP1nfa4!FRfkdIf?Y#8%G&Glj-c16SooRNuIWU@|r=U zZr#qC>91(zzG_kSTJ|{<-`VWAI@yH>I?4zf`R|z?twz7FY+Ov)^l>@MXCs0hzwH1Q zo?(+y$=*$x-Ll`+kNJh;zEoN8>e~kPjN}g7L>_+KE|$PQr$xS5a%ZA1Hbg^Y)8z3- zER#nkn`9-?nNI!xW94t0jD1>aBp9+w9+WWrJj)6lx5Xr{k%SEL&gja=v(o@i86ba9 zFu{Lb3TB0IQcRK5fy#3X^@4km!PCg;IPNH&T3$zPLANON^i-CNDXxzxHc@VBZfe#v z4BrBT%&BvQmfdiclGrd(Xq&}EfPwLh`fdNuu(BWo275H!Xn`*}2 zBJ#`N`@!%gtM8g93~raa9-Yq}TqTZfyWf!i-ba_?-^+~5#e2cleQF+Czsg$$m^@s5 z(E`sTlCJyCOwmBu6^HmF8{+6VO3fo*UY)9oCbt2C-sB@Ur9nrc^~q9tU9qHtx+W*v zK^vQk3rdB#!)2SklP&o5uSte zz9ZwYt$K?}K+o4ck5Tnvomb_+xdbDC!NdS5ln*2GCmH(F_~y))nEeR?SXVhL)FIRY z`%kQZNtzs8$zSUG_)S5}mKHob_azD9ffH<`}I6kix2yOCT-?W)H?(FK1hQD zXQFsar3(WV$foXY)ZO@|V_ zZS)HdEqk8QSDL z54zLHdyUa4FcTTOwCuVY&*#u{A54Vcr8wgc6hYi?e2xur6a7LNHZhq4+WEG>7jv~F ziz7>Pr|%+-(UP=z#(;|p>_wM=bNcJ!WaQ&ciCK5P&qiJAO~ZNb+wbC|cB1I=m1BbU zv^Tzc&(|>DyuLG8yi}DhAM$O7PfG(W9HTAo!A6spfy!|8c?cp=M z!@lXmeVF;tzez_x;4V65gmh^^_kS9eKj9)DmA1XCEls%uHV#uxD4F|1xEK{`QhDE$HSI$^2#Z{-jD{(`3T`{D z_zc&kT+d`NdVATBiU!&2G2HdvQSWS*bN8kqU)I9`jFjK-mze?8$BzUp%VR1Y*@!ToSXf#yUVUyfrT2_S z-?Sq| zTeKTmW2(Y2P;&O5$lxfQKc}?A{=t?)&H8&3qP03c8Nk(EV8-OPcNpEwGJn7!Id~w= zKGSTIBy!HmfwvqSGX>6+=DFQ`E-L7d8f^If4So4}hR!n9VB{$_|#cgKcz%0Hi@y>E~$-sYKh`aW6V)wvR^z{ZuDg5vL%Ay!5yGc8}```VzwTg-JjI^{`AdeQoF74lF~rCd&ynzKa2eK`B%*3Ii3 zaxvlrCX+EAzz0H@qfKwbH+nGFV2pAf`pn5Ir=J<-_q%<0N92_DoU_sn!%fncu!qg| zX$4=6{HNP1&c1c}o!c_fi1temS)MG0S}2J<5f??s)^5vJ!oL?p;&A;ni zJI^lJYBFpVuE?Y+-{v}yzUv_k2&fdoFidBZ>$;!tHM>ySm1UYCc;zZv2QVrB=Uv>C zvGav-pc2M#G@GooAd-MsBF7zmuzUD76VcLfe5I5G#gaTRVS0$p^*g6`?cSXt37kQC zF1Cu4?fNc?|574aCNSHs$u_l>&hx$<$XV##im7ft6RMcG^BdhnsFwD=(|0jnchR=r zxn`GpSVFJTYqkOZmfFcn>n49rlUqOhA6tMf$&BhkkH-Hd1-V0}|KDiQ$CJD67xbnb zUN8Lt`;h~0_0CcH)1T~-qD0sW&rAOo`J;EIj1Uz4z1#`A!gNGOxAtn4xX8K-Z4EsEk!dh-2dLse-FXXGxo4I_OUZJ z@WK1;@7O)zJbZ+Fy{>N{@T4zGjf_vis}7gNMhup*lq+>P(W*mj zX<&I-V)=-sm5~#I(5SJz?oIj5M^t!$*SBwf8EeXX+W+Jo`VKqC;q}1CP`%3zyLJf_ zrGLu2CtDO%BmnrZ^rMV0M2)?Eparokt)4%SwK)CH zntE8xs}uBMc)TyCpH0t@R^vzk>oD`^sU3u@{LY_|f;6 z?vWev=p<72EThX6SaIDUoQw$e0BMm*LsoGV@(9;L-{$bC30PK;mNkM1ic^c5IIwM% zuGQ{w0H8#HG!U5|8~&b427VA~bmkco;tKHqPFL}Z<%|6v6;qMoz}f`oM*RD@Z(rp`8vfVJ>` zuBWLp$-UzW0n8ifBuEsaca7L{pRkU@VNasm68UIuNym@|g?4Ytj z*K3O|-u>OdlzyHR5uY#nW<8X1AZo4vT`FH&oB)MyE*}5VfQI6FtK<-M@4rz(8J`)d zSPiyx$jgeqny%VzQyxSJPNQyvjH~UqramtjBCdR1S22g+x0aq;ZMg7^LA;wZ~qgruL86Rz*7l!HwUN;9|Aelg-RRl| z{K6Q>px_U|xXS#&La)h#k;t-}U6gTxERie)NUj|dBuASNT}S*SS)8QIlF+#dO*hAE zi9OL6h0Zi3aj4gd#Z56(WRP*r71aHDc7Kxw;&$M>%WGb1_4%*JwDgTXe(v2m>+v3X zZKDc2rosUH*W(dz=^04H@OU-ga(m&p{Ahc)VCm2@Dp330r2O6Cg8vPzW|8U;3%9`u z_ftpSCMIU#cw50~eMHPYh6FAU>z@qIUt zn4<}^2?raEmaH1}8m!xQ4AM~j3kQp(1b=69r*7H)uT&6Htcdqbg;(=j4Sw25(|ncO zA_Ka+NH~*dvvz(5yj)Rj*>NU6?c1XacuP^W}tlN^s_~AS5fE50Z_;px;VZp zG~;^_9Z0*5J1EK_;>C{ZHJ#15@5hG({uJo*OceY#tC036TNv$2ehT^4CJSIp88KeU zy;FjUe2kzxBBtRZ4_4H91g3P1I=vl@nF$*p4{fF!WAh1>(shv?te=|)x6(@+qFmyu zc9+`=6+>G;umY&@aoPD%@AK-bj-Rq8X9l~h6R%VtAVyOGl)zXQ1aPh?%JFJMHzD_rlKjaosRE$o~^Q5Il1SI6xEbo#QI+;CiP<^Ft=B6EGp9nxNL;l zzrN2yW|8tL1Spynx~V`~zvctNECsx>G_n8-o9jM$5u%kVu~nCuZ}Gw5WRCM)e}etC z|5P|n0u!QpU!>f$%33GLkdlS1Uwe2j4g@(|r|Q~eHp$~CbA`|rk}kz)oQoj`Fm}#4 z#;K9=%(mLLKo$rk3k(F95d6LfE4J&WC~7`$`l0(K8=7vc=!6n_FABt7?qCVCfT$ zgs<`*r3|S_WS0MYVL$P-aIbzb+~YnhUj{PxFFoqK*57?ywLMCeSnLK4bYFPgLWK@< zE2(NBdY^7cN60g?zw6Z1uKreRzrqsz@F{haC z>1V5k4ypMjTw*vfn2*gefBAhDB$_LnjE#G{6jSm`dLbk1ic% zOY%;TjuU1`X{u0!*1QpBxBJARr}NWe5-s-#Daj3Z7XRvoZFF?>Xj1FV%GnvHq@={_ zWaxj-;gtx6{u0Uiw-Tp61ZIBsH!gBeVt4>fu=1Wv>MY;=WOLyG;PRTqQDDp;K2;iD zJK(`y4OTz8Q3H->Mt4T)y+Uk%LG~T4*RR)y^_o|G<6-6@^JJnj_K;3E{C0z$c&6U| zqmL|>J=BAh%g9t?=ff#pHMC?A{KSRhqL+s!ecu!*~Nx1+;HHmSzBeODp#BWhK1wlK8a>hogpH@^=AC zS_Q(1LHuF;sX{*aqO^ByjGVvZN?WlSvY9tLCj?Vd*Z?FLH}#pw#*d)A{sjDsDDgz3 zeFjE%02nrrMT=AH(tCW&r>3U1O!Fqsgrz2SG_#Zk7!k0%%db1mT2F2a`n(PZDq~zY zB>C#L8EiVHq6g5xbK?p|lY$0SMC_XFp6FmxH&seFytd(mYJMZgTzL+|~D>9^d}MKfdji>Z@t=vmiB@oRxpD-=b9w`l~0M*O8e9VT>b$Cdfo5yv9P7 zyn3-*MrxtHW>5^@L}rm#>ckQNvZ+%j%O6w7%P-UYu)D;7P=u;boDIG#Jn4Ajn=Q7W z_-mAF_GZ-E4Boi2H?%r=fF89c1y&_)mK>$)cYbd+L-8b{HfO4Kw_3_TF%zie5vm+Y(Q~C2+lZAE!y=l*)hzlr)m=o;Ep1?8%TX zC58XGx3aOIm71QqY(`QV)wQ@cj!FwTZqa>uAw>$K&J8~!q>d^0>zFxN8>B3-k{KAE z1p_S&aFs8!8-B5lNK-tf!UmBvz?!vi*Im0e1wa4b2|RVP_P;Qpr6LplL3^Gc8i!fd zimSs4e=vsri&Z_MI>}1#*m^}OI*n3%FI_PaMU6%9U->0c?)Hk?>?*3fTGE-xl#%Lg zqqOhwY?t+lA@Cer;>)&vST`W~&?$T+8DJY?=KG=fDm<9P-#7j+@G!KnX?cJl zbLdI#br12%uIjNS;MLjwy6MrU!0XgGDs*Q{QCb)QDE9l8ny+bol= z0p%58t=;W8sLQ7J3nx3gB}_JPIRd{*aOL6tX_Eku7GR58W`}?Qp z8Rop!Pvmzqk=wt$%^t9!7l18!Dj=y<2%7ex(KFb?`B?3yclhXOf;}7bhYvn%d|fTe zgi11l`;{VRT3@I}cedSJPo&O#BnHw~Ge1Mkch?{N!o(UU(Qhz$_OX>w@v(Mtyq z)(T6uxkbP;f#z-9AL@gIaMon2u(5Jt(bi_lP?yDSHej136VlZX$Gj2NOz8s6hZPje*gPC|Mzu0;I+NRc(Ad3j?ed<|HP<|3sPjJuG($O*IF2} z?^Bpo^YB0{f=Glvc+EP}KAS>?D|U1E?{(JidG=zcWg!q;pO;K1G(Vr`lgpkRDPEG*P9*=A&y**QS&%qi zuS*y!V{s&E;z5z5!^br!LvJjO)w9)7;=NmKMk#3UH&jzpfk_DVBl>-jP<#C0H?oh) z)W@6-(kmumB{;`z&09_GGsQj zx~Sldmuzv1MHEJUs@nB95B@>!UfdkKlepc6y$h5i7?H{d(yMN{F?diT|31OX4`kb- z^%@iv6EpU?C|bC9^p9;D^Z3P!m?vgnFGoR{$cbiPLtMEQ{m1>U^Io^P0@Yo(tYm}df6$kVb&6V^wViK9&^WGsG7mFk9g zm$vD|pej#2KG`9|N=ng^-T$iv=s*TAZRo_TRde_i&3oUGfTN^i#uA-{jNC;d&hfu7^PQ z$|`qXWu|UsrYvs|PMN}=!qRs~LE z#CD7wXg?9R<%2E+;`pK8;hHa1#)c>A#(?boV}C3gZ59Sy0g!Fwx0bs0C2+~w)fFxZ zx9%O)$#8?;$Jd6gAs`NWEGSk_GS*9|yCqIY^8EFD4@?gz>XGrYLdRfKxW&~lu(*R& zDk=6Dw@=^V{GanQ?1(YIcJD$Uv(7`et)q?=zhwkNLCpG>Z6Hpv3Z@ddfKSWK{1Vz! z)sE(@B`%fuZG3Wqn*RQ0xlo-Z_cFWiCs*l##c|`>mif2|4NdEO~|2yH-3tiy?53sXPB^;DrUxyO&Y3(j0CGs1(P!1 z(-6aa6!U9U8e*cqg!jI4f5Ycb+jVMhqBo)eA$>)5S5;6MCIywJ$ysUz!zON*Veu&i zzCY~anjJW$<#S%9@M}hoDRVyIEFhKZgK`xNh^cjv8efcJ9 zmXs_$`j&?b$$EOZosuCavv$a<0rj*X;QyFBFgXB3`7xc);q$66GYY`+hNs`S-9`N< zwIo=!2?g;G;o%Fq$UN$% zOF)}9bZN&t0M3%YAnghLm+~lusSlAjGcSkC6(EmOwuonEfKZGc@R5sd4~K~aO}Ln73TNp zLsud}J3UcE7cQ%AIRzKDhc`n!qHM&I4-ct9>ZkTH{Pw1(j^pfB9?skGZqHc8XJ4UR zUUw(n$$q`*uYJHB%kf8XYVOKnvIUyOv3wRPPeIY{Dff(8>{#y;R_S4-DC3xfz(2=p zvw;@|r-M8-&a<;-cd9|I%j&HL`;$X~f5Sem-bFnA^x9i?1;2@up!Mm^Jf#Lm^274) zR?4@Zs{VK6HMK%ruA=zmCQ(2_eykQO!{deg9@BnPA)Lm(q;8bQrA}s+5M8-u74wan zy{^v5zd=QKqN)i~-u7FOFp3Ft0s8T9-I7+6KI3)B46Y?m!93Bn(~hc8T#vJZVOi7N z`4f5qKp&_F*k0ZKV=k5)10P0S1(Mp?*RlV!cnTCm^JQdR4c8`AtQHDm=QJdlB`~$vf6H z?Y=n$GJZ9>J_9V#&xMp0RG+vY3;bN4Qmy#epefkqvyhUJQHE^-$7hZFdU$?r((z;~ z^KTu^-7P03_4u(6Z!4asp*JEes=sb&Fv4qHXk|2QxWto&qT3LJfbsD6_v}tbUYY0<$p#%6oDZoUYF`G zMc}ITAwveih5gOASj|Q-3O%f*&#>q}Ry_WMgTx_C_n;*B-u)=&jnx>hj1?*WkU_B= z$iOoZ76x_zsGWlg)9Ll_)y?_%AX*rz-#D6!113uQVQKBWs4;lDl=Dk=GvmhNjt}ph zzB@Xzi9<(1T5ywo@AZxm0Vf77YJ>LtgN6MqEH?4&cCjSkP-}G|DV0#1V*ic{5~TAZlHq5v5H_rml)X`?k#r3fo{0+% z?Xii^$)}8`7aU^}HjByFInDj)Zx(K86HMNkV9OS#sTOL96VCCGOMxg1<(U=&z;43#h+(v{rM~}mU|~sLb{RgBLx3rp}Zvz z#ls(wKbbSxDrXt!`rwS=H~FrZas1S2zXiiB`*`E$oW*^Pc{R4`7{-KEqD&r*zCwti z$>ZPFrPH3s#l6B5rWQygAn|ySo<&EQ(~|f{yrh?i;jncm)P2xNolm-6b(ED=l53?} zXwF%Ev(IQ%NLFr1^#$c(FELU#juTz7T*KM*-LXHo3zTP{IJD;M>{~3>C zraR73_^-AQHAzML#cNl#$HP*2Mmsi4weW-vzZIzzpnZ$-p>2|JIz7yfgSZ0!Fw+~E z5v)Kw?@RQcx7agIpjYPJ%q#ewFDy%4M%x3H30n>RKQpad1=U%v1yh|8=~_T1FO(;0 z(}!`pQ$C5vtn$Y|i>hK*m1nUOS~vulx?A#Ec@g_GsJt^AbQVM*+_H$R%Cm{B%9OJ= z$y{8MmMiM5K7Sv>!RMXnzp8=Yt8janb|EkJUIkIVdil?WmH778t2^k+)2LT#lZy0% zn+a0!c6k95QfJIk!RTB+B4Em0jpW@bOI|K{te$vvnZ3;_1z@q+4=+X$Mzr~{dq5Ds} zv$uUhLjG^u0ST_QH7Dbei2x-o^-Dc3(!@?bYl4t$xm$s7rg&T`HX0|bCYhv*yY&eJ zGy`N=Pw(Z2v63=>H;AV@6V{t4A5pd?F*LDG6~nP;JXKlL*}_oL`6_FAE`qx38mfE#2&zv<=a@1mDIYwMi{(p>kx}9G0voz|i5B_rsvQ!$TP+F#RiRGZHGG61 zvFEU~*yLpyH?+U6bsg>gGw_Gpdb9i2QqXogPsDxvVSf z)-59%v42%n_qxU`Zv8-&JvDHA=Jy5+-Xq3!DO)vj{bi>3QtMgppTW0xM7oNPk6%;? z*>?`vPBCIeR}%k}``yvmH6ux>xmqAhocU%&TSP$?T;=@Sb?o$md9PSZ4Rc*`B=w^W zK2a4lhj^;|i+Y<3j9)zD7%lEcK9RZ??Q+V)AB;G9j5;)bdYBmPnF~z&68#X-s5B_C{KbSX9?~_v;31!X^+Km7{Nt}3vzr1iK5%;P|kTXfk*xX(}Hb-){ zEZhlGG%4bIgPWv<>izg_fPeY)?|$QcbOu}-G0ZI}rIR8HV3YoWCV!`>$}S_LKRvs1 z=*+}2g400$kqy09B0q|dd(Pq6l~}K@QbB|x7tbK%!y%_hf|DA4cM}C^B(Q zHbnXBWu*^xS^YCUvMrhX9Z|wWkI)^o#PQy1*0oMiG+u=?)BW%##8`d)k;>jee9j}t zrAdikdyO?e!M-U3>uHDJ(DwkXu^dU7DY3C>I(UuVSf*KchSHF=b`DwPcft-J=J}hn z^l$cPWoom<8MoKy_>A&bZ`dNreYrWDGMDKQm)%?&-8VO7SDA};qDQ3nqm<&eAwgcj zK^H^W*WQX|eM2ulgyU$O`Da2;)vG-eyGPX@?dtx*Q9Qvz*^32T3UFa8hI z_FrBtARHNTb$1U|qz{1RT@A3mHSIHY1l&}ZYp!DPYZt$y15a1+yuF_j!yh>D)@q~8 z43nRv1$m_M*7@I6p7$*0;J!Y-2>XuY%lEKArhtkjoM?7l7#8m#PH$61KDjo{m~;Tl z;%flFw@7o5ghJ)11PN2HQ?^hE%*Zg60taJaUNwYXWPPyahBM$#63$lFa|F&mGfVT6Nnau&p@4o(D}eB>t| z6$&DmP&yn{Uav9oHJ;;OV(sxWaM~Op?XsYC05cq6AgUr@ev9G|E!G<&nnzgLBaV(# zlHVrY#%oO&lkK_XSX9eT`55QHAW)z%WNLs<{m&%_W%H>%j8)GL6Cy{s@5~1KF$sZl zq*y-29*<6@^@Hp!G+X9tH%MS`xQt99L9G&KwCCtALBgJ560~HF4*B7DX3CXJ79(qC z9~43qV7^SSbsgQ;%{$r0r};^~fDjTW6!L326Ny|f9U*+vd=$Z=m>AHJs6@JGKSVXz zNGL;#GDyy{8Yet2Pq!>!&I01{6 zWk>~D%`&h37$AqduJo5(;_l>iOq5%H7#SSL@QejcVV|j;q|uNGRB}U<2l=jN{Iv)^ z_-sre%RoXzeHctzq!6|=822SyF& z7|5}WAePo8pDzfxVF0lqsPrqQrW4Qep71uS{ox=s!1qP*Me^ynPs_i;ceEy0XqG3a zAB*^z=dPlJERyX+dnm8~sofpk6KGDLv~e6&rvN5x>9%2F-%eToTAlATR$l49w|OSX zjKCajEoIhV4-~Bq4xnSOVp0Djug?km)GXH+=`0>R(F9CDg630=8q`AnL zhlH&ncAGg$36sO^C$sy@-AsuyG0O>aT0#3j{ib8s=SnMcR9&!)8hkPgkCl3XRCyxn z`@v-J_g9Pf2%(;!yLEy0>L_Btz|)q56Tcvh^YOfZ`Snlicz{0#7vyuoveA7vVsKhv z*L?MZzKM!`tswjS!_6!6*2CAXjs_S;wYhRIjr;~appg2yftbxmr^~u~S_OMvmdO_qV%D%B(e&h-L{YeC{ z0Qnatr_8kHig*5rnEQGV0`Q)G1`E%!gwlvDOo;(1k^?&%#te7+Ziz?KH zI`@3W48a&cIH$kUS->6foKj8UFP7UF*N>)qth?-*RAn>r^>)YQpT6YnupdZiroxtW zvJ=UgjZihwVvQ~cZkKLaJ^svEtDhwj%jd!b?p&|r;s_QV9>`5iNeu`BGQ+By$D{Oo zjJdX`5@WX5rm$1D^vw-k0MVB|8&T{h=TZ;nAOw4!Kk0u0m6w0(6V^ZG-Lm8c{5A5w z-K6iH5w5xLs)1NAjV~}UbVJ&ROtG%gJuf^xw!86zn$`;viSNz2H#sMzBMD`aTNe*N z{x}Q}<+Nn~(ORvP+JX^}wuOx>~*o}`Wgw&RoX z^usr82G=O&OAM} zqG4kqfKnS-ssr4D@s$Mt*SUwZ6F!{-LQ zo%-Ltg$T(+y5?FD`pYsjU1FldU%{)ke97vIdK|n;VK$F6YKYpB2~loL3{-M#qTL?x zZq(~lpAo4IY1Raq%A9h+Idm*p%@suWX`A^dH!CZ9TZ`OClEPfC!?)ztrinV`w2KiK zJzlctAu(X7RqYj2KZ&a~I@z#cee32(&?n~%0le<_7O^$HXb=)zX!v)m&scE)dURPR z7{Tx9BoU(8AQXV5o+`sfN(nzOt`~`5O2-mIhtJm91iiv{W;DwO@nIg}G%SXkWAhER zEBp{ED%LJiduBH%q6U{PSY^G>RH90oDO=IQ!D9@E{UE_*r3_Wm|BV&K{8%vD4V3?u zC8`P90au`YvZ(HjmzZ4&TJ=dWU0X;)Wo&vi6IP5gC5jR(hmERLRYV8r?-qeJmE=O0 zjWNlX$ewDej%iL>(#m+`u;OZ~yJnx|^Xj{ISr#cax-6dHL2 zDVI5Qo+!RwwP&K?00q2Cq9F@8>R5J;m(Xkv{aD@y(&lD?kd*iDyq0%dY zSr-$MW9&5qaKLIiLOSQ;JPmpXMLgzW2+`D8cchw#dt~_WCv@Fq|(mhtciuYEZ_^=+W1-<`w+$4$# zplGX4AJ+Z+iV1FA@|G>Hxqjk4y=lf%q)Univ;jN!xbCy{Uh(GujH#Go#aa{@5@vOV zw3bQb!%iA+AvOV?b7C#^SId82C$BHP`*yo_xvpvDSNqjZ^hr;Evl?F@1v0z`lhLcxf72w=C+VR`8($Fo6^VC!M8P7C5_5>EA(oLu5h6P%Uq+d2mQx-aSij>0{ki}C_*AE}Chu|;Y z%wGy!%hYFyh8o_~R0Zj%RNb;eNse-_)2`?+H&W^O+IXfF;!REo+)=^u1dB0D zc?$=qA3M^=SIe2X@YN(A)ZmN4bI3ZDK%%IIa_vhhlWBi?BlrE8#^0$-qEW;ajgrR& z3hj~n^b8Pk{I)^Z(<0-^gYd<1x~vg!<=AS|F(=kwaebQG`*aELX{?R=oiNRut#{CPXBV~ zhMxLh$Wt8^(e-ucOW<{g_sNHgZ()NEXM4=IBk3c(>!}_g5Bn~kHgHyFi_WotVHv;g zS1Zm9>WNs90)cWLexA2J+~c(V7C6n@5saG3KeZA2fCY-RMAOBa{Z#0OwJTEnPP+0n zzg}tidVF_v67fJ0xR)O2=E>KJ5`Xx4Z0b#Rl=6v_#_SdUJL;<2Fhgt8>K(@Bpn#uvCyt|@>W3Kf76RqR#{46DAzccmp^^YTLzNh5qLw@Ik_ZX@K58qgg{yLiQf{h<+4*sU z`Ef6h=W;$rAX;0KAWIBAyt9x|Nh*k{BbVHEKIZvLPRvFuCCkx1l%Ruvtj+J6A$3O; zXteG5*EM^D!MmlrmevvoGiq%WB|iP>AP%hTQHqY`8b}Hjd`i^Ip8=}~0{&n%&(m|I zO`?Iw7!c=EF3M=vPaKQ^$?$2AyRx_@zzHF#CtKDSvDX-;B}ot>XTEMg|D$StN}N%d}oE&w)@BG=Gya_4?3| zRSqAVzmmKSt2$_M=v>kFF?Dj4kf5|Z9NN^t}j=qurI1KK&pUo%7COOPEB@{!OCoQ*3 zU>&#irAbOc)fscGF&J6myMg z*dzF!vf333COO6wcyO>#I_**u_A8+&FxR}zaL|z~a(vAGH9es*gYrVb#20 zR)LBrCEWLa1bmgxNv)4M+Q;Be!svAP|K4B>+Q8iPId1*g;(7UV<0fIsrYeF~_~ib1 znh+2}dsS@5IG65SwOGpuC8&jVyUY!WsC--+p$ zzPu!NTm2rn5z9nEm1x&<3|HLv`{u z)o2ZK+EuzLdql<`yAyHt+DO0u<{OAz=B1rSrbszBq`Xxf3nY>Hh&d)Uglh}T7kb9n z>8wAP2bgllnDZ<=#yZ3a3pyE(KfUsPe6@S|8vus`d%orgzC2f?xxE&kyXKYJmpaes zrw^zf^bR;jJeHJP>;1^x&rJaZ8gTK_mxOK3YDlA zU*4_hG;_`)NN?F_w6eg#C1Jnc*$uZ7isjx?mcI?) z(7-t#Z){;M#v+W1H5H*{oi#Xnp%ur2OlCr0TRhS(B3z?^tsppA`&%i#bw17b7x$Sx z*9QV;1w=ne(xA z^(P%^9}kOv$^je`cEN9oAr!S-Kc3^NQNg!nsqgRJxFeg0#1yxdFks$jA%8m0>$7%; zwi(BmlQe=zw@CeY(cU}=B$Bn)e101McE{Yp zAdrbIuHwO(f+lLqX(U^}f~!Z8@UcLFzAV-uEc=0HDj#(9xGU1gI$+S^42w^-`)?UV zKpqmm*j^?=wQ~Fj}|89DC`HnT}7YdVfk$$V9 z!qHTQ@L^-S?`GgiqA!SsOd@}Zl$hdSVQx@)rSPVa3eS5HO%2VQL67kJph??Xej)X#x_q(BW{%aBPU67wxZ(?h zGFf&@^%#Fq9FIbj4G&Q6HBdLASP_Ah1E$e0VL(l()japC2Nk=I9Tz-L2bIC@j;)EW z@-g5mvB|)S*~}DjL@-l|hns0Yg~N5mDhH;GiG6Xd!uEwgo;P$~H&JirrDKxn4#9_g z6Q@OnFW)odjFf&nQK<-!&cU)Ltj&kb7TjW)pZyUjf zp>3L-c>EaO@~vYzNHxcf$&!(%F{qx9<6OV>Reb^i9}$SCV#V{dXGz$3sbWkQy~-qP+xTiHWsn8rFmgt%N91 zxYHjjgubm;E14ZNBl{LVefNbLtwZ*Quf3-df`Ws-@SK0Pmz`ABUmx^;8f1cfxDIEzto@||WD+5^>^A%m4b$mB{P<@c1 zTx+?{A4K05_g;2;_gEhj`izH=RT+IDDZidv8}HgU=?Gd`o9{lM+H_ojfUZgau5{I( zWv#QtXKzd`t!>}pq=1_z~k!0K?N;a3oAp|b2=7PK{V!QT7wEVa9KEpUZ};^2ZM}tgx|&Hq;q`Z0a^7c zN6UVQ6IRgCD*|Vcf1s{ePOgkfMfgs31w%^gZYB?^{v%HTG;Yc9b};Ch2EYP(#gqt-mVM9o`5?Je>>hm4Lfw5bom zuZ$hPK9M)t5t#ct&-NPGlj(q;QQG4S@<>7a#E*00C1QpwX1TNzMRY}YV0w+}?`H`V z5fbC+J{iKxR)184yEY1W&T;*k5l4oj^KAdK>zKh{-V)776T?|RAbhqNchaI|kqM=g zcJg`{i9IEUI9zvKv&X?G(P?`Accp+HMXjEwEi*-&1aN)CWI4>gSXjRpt-cesU!>q; zi$}T=`}wB?6SyleoJsc%9OFeJXL8nPhE#$eVsVqLt#bl=47_!3^BWalSSxM&hQ!v= z*xQYcHm#+-RJb-8e7wBzgT@i>cCe}_AEBWhW(S7WZd8wj9-HZ|g_*GcMMfyR>>6g? zF=Kn|=_q>{{aY1qYmKgvg3DExV{)22|#t*%bd-?YaBNZCmk7%`OxpESa%( z{;gCf-W@NoLm4#Iq4Gf9Z4;=)=?}PE4s8IoPKs=G#ZW>-5jSo=E0_DeR2unNR#Zb8 z_a7W=-$BM7V$spODvaCO(m^00k=&f8Yy`3jn>6msmOVOSsd88Y#0TSz6ztmCTfVY> z`#O}AID#wFr(9b^Fip7-ecr696Fo~uFI8(Be6lv3XCPNzqZY(i?Igj{TPEr)!H{?e zn~t{uLGVw3kT+J+99y>ejg>0z7#ZxV=f_MjP*yo86{QK78OQXGrrHQK~6 z?b$R*dQrd5rN2Gs>g`#~3LW4E2=ZB}fLU1sXGqfV#1-u5N{O{fL3UAx0vcp0r3adt zykU58m-f2-n_)FNDgsI6;?nQ}MD7Twgz#1lF9CS$V}Bo1KtcoxlTYFWUIoCH%YY}E zf73>2Z}PswY7a}vAEl)%_)PjVvf`KDBM_B@gxs*-w%E9_8PZSdLc-Cp<6srBamccd z;?3u}3mb+yuo3e~4~ZF=xehQ6oUN*uf*5S*nM%Qb)L@g(Hi!ySLDzE5#M%joHi8Y} zTThZAL728K!Ze4MIJqHW-%1i?u?9a4K#&8tIt@BjH( zyHUJFC#*`3;dlR;XZGLzu{Qm+cP}j2;p$t&>l%Yg>WBUZ-$w?k?YAFII)aB*WVbc} z1#!nRUtAtPy{xSrPA2<-m_F2i$vQ6`v~;P%N}a@|P+3pAg;_EoOc;1O6yy(_LU#bD z?YIgvM5I)IQvB#?)sPlv1^ZDJcA71$uRM`64Z!zO3vr6&s z@qvjXly>}?;9IF2CPeFzfYOprf+f}Dr7V^$HFiTRV_&dv@pHN%5;1n5UQL56+>+&u zKT{ckiVQ&S{|(CP?YW51yqi;45{rQ{OHhR3`}~b~IwiY0v`!SNpk&)E4a{@_2lh*ikEbl z;h~Xg!sffqmW(NsW5Dy*XBPHyk{q;bEfZk^7-e7M<+M-T1kS|?Czza^KXqj!kTiOMO` zdtv_mH7v_=>pq?z!#BI8Urqi23n>`PhHs0`(5h=u!GyxE*GnD2 zCA?vp%S4!l6n%AuajJi?E*!7T2*7-D)T$gaRF6tD!N%Ixie5fFu^KW;?9o7GWE><4 zY09-wT1~=CYNt;z&cwl{9bbmqKSbM>hu5oocrBnIw z04wA)Nc|-jpsB~NE-n4M0@B9E8mPdbCXPoAttsABvv#4a82^-)XT9rJ46R>1KJZBU zA+}L$6}x`gH@fwbH;!y<{1VXp3b+^EL#+n_gW%DEBEGpUQN+RfnzG-5^6UJNKc@Kg ztBe$Ie&oM^vrx5T*Nf}@va2&~%`5)rOI+^m69qq6F-VmJ9}Ct%ZI1GNKcD9AJPiy~ zyL~N&z30L|J}pcEyzZZO&j&P_nJ^`1jmI2w7dhqL|Ja1vldEt=b7{X%aL&e7-^>Kb z*CRH%)~=dTv|n_qqKU*44hI;WiAghihFGor<{wzzvXu^x?~?S3&Y<5g8l-BwqH}Vx zzka`>S)H;rQVB1=r5AJgF2cJXGz*xZ58>#W%lpD!^nGJ*UeMr%9wVix@57gGXMVh7 zSgzZipsR!xDY&CC`p`>J4YRR@#fjjkAT z6GT(^qrC$tpLPe_Xs;R{(3nKj)-bJ$ls^pwa4w&%|CXkUW^dj#4cE=~MK_*b|I%N2 zFaIaj|3BmAgK8=ar|~DRhC$5KUDwch-4I|jba~!zUAx1LlagG(_gNlP?^FBI&DAoYh)@@mX`V>|tI-^i$m&l(cv;IHh{ffTgokp z1EwL%j8Gjaxwg4W0LEUszj3w*0{r3qyy~JWPCf!T!cjbbG2*>xI{)lH0d7Rmby9y| zpm;ADdo2HpZGokr1FC*v-f+AjMUy%>#SFFozwbP~zBolf8u20%sEym;UtNppF{qF2 z6I5}Q47?3a??#Ih80{z!J7MQB7=I(cD@IF_^OjkpD2}yV`w+LB{M5eBW$4z2E}9AB zO&)W9tYiN*w%7i9DWG{7-}yUUCX|@IOWJ2P&|I;~!hBK|6>R(fS zuSE*V8*m9Iq90M?XyLPxZ6y~(<$AuuceFHLbU?i%y0S5mAllKu-sBwHdc1@8TI{Rr z`~<-q;8eQ5(IB=)*-kNNFdrQ%7H7D+Z{lXFV}PiJBHglp$`$A3P9z5l?Qiico?bZp z;w_|*m@CzkO$^l-#gmV5L2}GpC7i=dtCfH9)4)9JC(x}&^WG_>w(EVgTeLm(IJ$7i zc~M$=a+T)#Cf!`Df6`es?JtK_5MTa*B$D%;x`xH;zIW53pkOP0TAv0nO4@4@1)7{( zv$dU3Iw%x)t2&$_Qb^lptb?fB{5Pq10xwt(g}G$_f5RevC@#og>-8`LftliX5A(^- z?^`qVi%uu|dt%PHhbRBWA6{}Ln_;~jtjtX*!e&&P_8p$N;n=Png06S6CnL21Q{0Z* zI7riC+S3?BUt*)5YFy0QYxGT=h_7D7la2BzJ-sy*Hl&*~v9wa?_U=+>_XY{}(;=@| z5yRfVYZO@cMSK1O@!94Bk1~kkjp(s0LJ6$CnZ#riNG57nsT%x-SIrSpgC$7Dn*o2X zCG6-0+na3u{if&V8FfMBZ}3pOh7QAx&yfCQ;d4r%k}7GN7rGRc0op=E@kM?6@0lE2 zW1+ZLStt@dImnJS8>U)CreI-tt&n;M71>8wXkHBDSo!XS+6(H{9y~D&OnCezuJtqi zk80D9s)9Cj&;D{e-1zA$nE@6HcV$?Ha>lfNuBCXj5XNl*V1(97-6$tK>Ok2G(wKi@ zd7DBZff=a|gq5<&g;HIK@>@7`DnG+QM&XM=I+oMWZleRVMiI#|z11e{fSftn+QJ)m z{2|W4YrOLGF@ahc)ySSIm}93haxBb!2}=~nXcl{G2e!qD%gAU{$^1Pg21Kxwt~>V4 z{t|msZ;iA2n#?*F-AY!suwdwpn{?0UcnD$g2Q<+ZeiZ>7`M-obRUrA<;x+a^_V;la zkJ#MJIT<8^VAMfr+{YzB-^J&RwSSt(syH3f&5zl6wXB_U##@mM+1WdnB?fc!$_L`>({b zIiTuJ>3$W7fB-u`@)39}l?f!N=9;F&oVh5aPF5v!(p9lVS54k|{^i$DLcr=%Ed0D{ zf1Gvh6jpOW&kA=+Y|v|23Qhd0v>OLW|8*{+pify9isyFA)s2vsSAp(4KBt4V8(TZ- z?jyrk^5br#?#Ejnl`(77h**S(Ft&K5t&{G@9Kw1W)!?{cTdqv;f-_XNzY}hqZg;w` zD1kqwd@vqro1xJG3?7k!pZc$g4xGPz)ocMvdX74^&Hx=%1a<9{os6la9%|lQKFg#3 zuS?PQRNJkuP^}IupW}6!SDB?^_3q(cq-3|2)a{IVnJNhev%h1Bd0-z1CI@_;u{Tkq z_@riavN9d#sznyHuR=@SQyHR7{_f}71-g-#XKV9}$Of?{So!c z^KX*ca}#W3{PEzJdCjd1X_P+RqsPEiRFrrpY(o3n z3usIQxERc1|C3L{tedD)zNbEG;LhX4m6&EH%c_0@^AArhSA(RgCU@I`lOqvN*A;1w z2k*?rBl9arquWVW@8>eRy0P^u` zGi8A^&1NXEwoH6xZ%wSMlvT?C2oxaIXB={etooNAOc$Ni8-nutlJ=Nn7>@g7?8$$Z z{!hJJwM){`#aAyDJm;Jx^s8xNfsT@R#8?V{tahvCc?S9eRvAGSYJJ<_sK+nDd&#@c z0t=Zehh3z8pE&Gn9EoGK+P&O}saYPJZZ6($yQu$tgP6=+s*qm6-UE5#@^sVc)!M|M zd_qx?I+ladsZu;x@pwImoEAxu z3{!JB@NawJrnos63pMgng14W8Gf1fwEwZg704KEC6ea>L;wIr5*nc?#ImX*6Pr{rj zv`%#EmU2x2CxJR@s`K4uo2Z7OzyWMbFmT}`j=m=>w2BZVAf`nd5J}ddm`+x|ebQ?P zXm1rXls(0A>UguEVc^jW*3P!oFIDM8l>ZA;!Ydh0Wzb|n@Y{5Z;!1^}FnW;&eNU-%WObZp2OZ^xAAxA`@CY<2n_1EuTva(Vm8ZHfUtTlgA2C= zX>+ZckSgKEM5V4LoADfh`r#}X$M5te(c1a^Z_>t9EZWCZ91pz~KXhkSFM*HE?u;BD z((-zo0}#fcKX*N8>(uI-yy{4#txoFZn07~n3vk@;o)G^@MQDy@jt-4f<4y7`;)C8X z78BZyS{-Eo`5GUsAB88)l)O(60Gys{e@8|L2{v(~j4Ymre`MXABP4romG4St$B>@qOp>T1y?&2#91QVvw1@i z%B+oEvkK!|ocUwNFge`P^M+j-1{u&Zi#S&Ih=D>I>Q@yk*g#=j$gUXKo(vOzPqaTH zR49IjfYIB?nm8JPZXYv}DaJ=4{21|+7cnQQ9RtJmp>F=2exq3xP)Igm2c2&4$Y5chvdm^CKG0#ro>bl@2qhgSjO>85BnT**;zRb<7$-9)8LoVhrq{P9`NPx=q` zvT*w?u?mo!yB0MWjA_U)#<`*3CYP~~+C5wtU*uJMW-)g>G&*p|BMs2{e0mf+$s4`H z%*crZ@(Geyty34Hy7OsMX+V7LK; zGsTSNAI;c$t0UB|3Kc^i*64Qq>&;;esNmn;=lGz(oGtA{ZOdSZQ4+ab?U+DS^jD{> zh2vcxr8xRh1WH6M1JuU61?fELOFx~EUB#?M(gz(v=zV+!9ZaVd8_GOf91V8m@yN>GU(du=n`A&D#C^ScV5WPBqsL>P(Sd9b|Kk_OB5S% zQpODs=pCmHS+>;~DVZ7ek5U1wLTSXAJ%5mj-IP+d{Rx|Sw;zK{@oWJd`N4*2cL>eu zb<%+|>Z_*9O-5*{MI9-@N}};5$^X)6O|MOCctlP9y{%RrbfL&TQ;|0E9{B{{6XW_Y z_Cs#DE@|}Hy!}jPeHPO^#fNQ%P|Om1yC#ZwPEEZMR+`H#af`VX5j|o>;S+p6ld)|3 z=qR#3FZ;8-irIeTSOU=lhEXipM8=OQ5D)FQL5E+B#+?>@+5W^j$In;qIR1TkGpCU= z;DyVPi7BtUp;BllQ}|g1EMIUB@=m02P9(m?DZa+gBwZ?~yalP?Y3Y%cs6aLlt#JH- zvgOg)DqF9j^$nm6yZg6jeKoBgPTs{+x=#(4EnQ8v0y_Y4@Jcb6Xz&}imNxhaXAv>Y zb0Ar$F*jI5Pp^KPQz*8hMt;?0!kg||Js~@r#?*|Yu50=CNeNFNcsx()f68+4fII!a ze-nE=CMrr$oG9;R{%X=(|V84{7{JiEb8Eg=_?sMa1kpquX4$CwZE~NPyQ`F6gKDpZ$usB+#9|kL(I^uM!um&LA=lkkK0%Ig{qYQ zmvH?pk54U{#fpm&DNS>v&0+*j{Zu~a{M8!_9Im(xl!wK5Ng^qBJ3Uv3jq$tK5l$8R zbyB9eKNZZM9%~pv6qmo+F;H9TsJw-8^$Rs5QIw(;3{;WZiV4Iq$a>rAeC);AHs9c6 z?!TSawgDk^&#ZmU6@$^7tVxrr!WV57bRyRh>FVc516oH&Re&^PO?Wfbr?Q*XOo=@L z1kEy@=A=`g*2J&$4Z=^!Q z1yv{t!(WI3)g*1`KISU)5v|94DvXp-jh#ofV@=e*Na!nsu>!hU=w;p-z7hza9)yS#VTB?!GqPyi{;%l$G2!l!3!U&r{BJEZ)O38{RdT3`Iakq!G`udA`z)v_vDYJ{ed8-OMS(-Mheb_MaZ#uM*s)pyzQiAhantJ^@9&I+vc`iqYNHs)y)SV65Uay zpTiC4Gy~OXSYSc9{A)lkWvq%yg+Izg+q_ZX_PYyU3)8Z9yU>C3;ovOf`M1D1Fj)Pz zpBqqVcARuxb-rhC(e&4JL|wFy?^y7O@Fnu8grPIWQ&#%h=BE|=o$Y4<2l3}K?4G#w zb-U|92|rO^>8$(j)x)0BztZ(i17=0c(?`t}WZj+ro!gtCxe``OCcR1tyb^e(d3ZX1 z7BlPVY9sFYB;5PZh|#~(SpL4}6v=1VlZx2HfIe68RZl>)eA_}XPyv)pPqfnSX7K2y z*Q!*C6_w_?Ou5rJkqdTx(@=<#gLgkWz^ z#{eD#s}ww&v&pT2<&q=o*yka=YzV1DA;#n?sA1ua8~wpc9fq={{~cjVjmLLNfz2Qy zg22HK_PIArh=p1I_=iZ>&@%^c&7&PSKdfM&q}0Yahn;&k!C+picFf@!d_1WuEzi?FlEbaJ&;i^Pg>y5>1muK(|k0k#H zb~v>3jHeB*`<>eV6A_(3MTsBWw*czt6bJoW(C}+O^PbTPLl%gbJw~IVpPG!Sxy&FY zU|`6M-M@^jd_2}M z!y;kZSNB`gt|7a$@Ffwgt^`l!Go8CcO=_YT2$eE_2O*`@_rpiV#ww&a{)Qn5jnoM_ zl6^?kw9k#oDv>6P4Nlyi&pX_%DB+z{7xP=pP3+Ix`Sk7#t&TS3@t(?qRJ+ypxO08N zp|)xNLYIm4LaxBT!<;c(b=)suemKUaG*<3kjw95=%(KEWhb-qrNyppFu^+p^^Zlb1 zs&|M?=m8?;;~FE<;g8JSb$zo_7JU-|Jt?QXtH!3|ID$&nB&AQ9Ym}Wm?Lxj)8cC(!GoXbiZu;1(w(QV-mY(m( zGYDrzE`(8ZcIEQjIaDdL(_+`Jyhu1r`EHV=nExe{9CaAoik^^3cIgaoN^H!2F-v4b zl$Y~s{6vTH>XQt}N8PD@K8^5%rIUJi(V40=tj2kJEdh+4bhS`Twfu6h6MSA6Aewe>5}k0ZLuxmKDN>F+@@8Q$ zg;SaBQATPt9w=#j7|A>mZhJ=!3o<^HA!D%xf{B(QE2tmYfnF7-5D`rv*Jgd_r@P0+ zR)e~<3IREF|C$^62Uj?dStw&3t+n)~bXpC!q6-__Q2a$rIQj|)j6^b~aX2egQ>S-D zJayPcKoIvDCt5Ml(d{3j$ROfVrSc5HW3ue!jGt6BFP>HV`GI><;^(RT53j0{3`BHu zFae|O%+zxT6P>~FM8@Ql*m(3&5V&1a(dN@nF3kgFN&mybmvP zs($rXBG1JS29C>zZo4}A{no%kc<&WH&r|32`p)HpC={|??84uqAFH@~h!hm`TnR}$+ z9%orxDED6NQuJ|jo$lYdmF+IJZvCM$0ZLBC|E)fc)hyG@seIn)9mqyxGJ4Gl(W$(_ z?(Mwh#kgkg7^N-JgJI@=Z3pP~RGBLaD@aZC!(zs6+AQ^2a-@sjs*<+p4y#acejHa> z(OHF*DIOR|J0MrbDf+5w|0Y#jR8bwfmifY%H!u%Hts6+lvM@Xl5FhCDDxdA>@%sr6 z-6x-)E&)25@Anh|%a%dSqxT$U7qk52Z!UB zm*hIPrZ8mUl{bwzph|cx?F;TtZ{jWqo1A$IlFzoacMo%Oz_ox3ELBr3VvcDQ(%F&3 zPKgVsrc$8J6F_0LQHJIRZ^NfOueq-}BP- ztr5_RfPfpQxzKgMRa(p>bLi+GT5~NY2ROUOw$fVbiA9$GhKqK=GaQGuvPbTa7dTh7 z%8F&w0MG_eORRw(r9A7R?Z?WKM61ToP@UfOd)}chP`+jS+lu%XAS?S-O8`bDPgIzt zQcs8FqPZHH=e$K0kqXah$|pyjA>^Sj*d&~CTGbM5OhYhNUMF?%@evnPep)e+e@?m} zwzKOx(DHuH`}&DXmQ|Ux;`z!~W;w|!zzj08AEqjwd09hEXb#1tdb`kxRsGlg1U(@V z%=MWite*6E-$3G~Gm@sp>y_GISdUYV0kgLGlPmGgUsNlG-1-nUbwY<@%K^_bMXnN0 zhm}tqEfuVKhcx9Zudx_5w#*3qZs=r0L@4H(G4E>n9|v*!joV_LzR)-L)&_+8ngIa8 zq~X->DWxD|Csj;a8&>6kF4nI~yO*v5mmkEkZD(SBhCa^L!1rEzK0_L{B)V_B^Io2}XJGdOJ1rjg z4&`0S6%B?D#HEVcAPsiT0^2tLNtw4p(unETNSt;)Tf2iQ=m%2ea z-wCS6>8Q}`VJOxFRz=T53}7nG=vS?~mvq=FQD~N#ilUS3SX6QrMzQlv5Ze)gRNuhgemmuIzqgpO zq&5guz--~SI99C7)>%ZBe zt}z%&^xvZQ?fKm0<_*$N3~{5se-JBlCbgHIc<01grKg~hro`1#tb_GakNPT{Up+@a z&;3(jG~+E#f~A`jSZ^8MjRAjeK#3FA-Cb^Cr~R|3bcTWI!8`3==5KX{aI;mSJwA1b zS5{Q`&qh;8B32KKUgT7cfg_`~)N9#Zc@ONm`V{1;U+AKk`x%^~$;`?SWR$ey$k8^) zID|J1HJ}3F%fE&29Zb0Fr~6T2pt4bT4Dh`tZE8XvQRJ~p$pV}qT?vT`w+suIkRLI} zwxlkV%7Mz2+nxf_M|Q$JsVmazdpuR?Q95>}aQhI31BgxL65~q+E5)JUV>C&mJiq*g z5Uuz4DxLq)DzcAavw(PVP_KONYsc0^cl>E;216)cP&5o@(t`;(kQ%2<3Ls|+-BFp` z!(JqJ_w8%uAQeZGH(hupwHy5U(u}%UG78u^#1e6Ag=(RT-wdNYF9wlcY(GDtJ|DMk zp4eOj;6R?X)3Khfa$9bD#k~Y$mD(JG0s<0pjWHii&5bV39|lOweI@U607pXN&P|G| zhCag=7b{H>(4@>3l%IK2MUWit{-PHYulq>nXouJ>=v>Fs^gL)Yy2NM-o!>lk_uf?A zhKk=J`Trgt-M)vIp72x;z96cw12-*+~X9$pb39B;;eb|Hz1+KX|DAZ5D)9s$(GZ5 zLk@^k8ygm_o4ch!ccovw*g)Z%E%NJLP|M&Y)b(l9$U!g($@*CuL6EwRvXHHa-`}dT zloaY0NH1^l&)*!tG(L$Bk~-S!rw;#6iQzpL{q+mT^X&br>+pfBFbUsP5DUXTbx=tj-B$FM|K7C&dG=|4bo`HMzcUlej(K7nxvCZ0FP$j7jmLFC$ZU^nF0tkPl=WphKpQQw~=_F1Hn z@~Ag){kyIqHx#DE_;oWU8jcUjQLaG4!`m$Xmsi}e*i{%)L&HY|0St56de*3mV;>Fd$}duSE8%&~##83-;A+!r1mFq)Ul=?>m2Fs1#`G zzErJp6;7~UN8QrKdSmPH=7Tc;ihy{Aq8?l1V{vb=8DeRs-CCF5kjFDzo5l?~^zHA4 z;ZSFd6z<6dD3NrkPEr!A1ilfg?>rpKfNpI4jKO=j@R3_z@)5}a=6^tqy?&J>kW+zn zAOExH{594}dpzjbIl&Dv>G9#lH4L&^zO0H8y(*L=zhUB>-!#C>vGV8Dar?1*0&`1~ zI5th1t)vpk^Q^gl)aWR_X=yw)9dM6WG7zCqAI|S1jvF1Ni7l@W0|yxIy9yUNIr^Lf z9|m|+)=9v$Ey69BtD@`#aHRtc%oxSI=R^grH9n+u>wms?kY*(`*RX^UqbpGN^@-r) z)Hc0sE|)xHvB&Xw<+Fqq-jLkIzDOL;^_ z3NBE&7Jy_ImOH-9O5NtJKH*Ppq+IbdfA87I6~5G@4Ez(p0mnEuRr4uu?YfHO|IN`E zc_7D|3-03sC&$(UV6SK_)rB+SEs&DcbIxRK9BsulXdg<)igO%k0VPO?{#i`N(0NL# zQ^R~3Y2!Fbe0gyZm7UE(&-sl$lsZjMBmIbQnzDfDAe;^vSoNrRpU;hc$ru402F?BR zA8DBSzE;Bc!qRPu2Os4D ztA6~Ca>6!27ZEzLsA(T)QnUd17fV>tmg&O`>DQNNl&h9RKl@n$mQn6H_p> z&M;98@)pL-IL>^l9TIqI#_hf4 zq2Zst6TQ3K#a%y(S1{nRmZaRvo68_tJ2kfc01O;~eftj7iYmZ_-;XD%cUe;jmkLLG813ICH z@wWf+i;I1YQ6Sy#|0{#0C!I_4FcoU-D#I})@Q4BM8ze?T(1gD{G{`Q{!2hE=u9|A1 z?E;A@W-~1MOdU=RB@ny2K=QxmczTHR3haG|+Xe}}{4RygNOG-Gh2sgkX`)&kC$VCv zXj{%;Y9xU9NVvb&A08|g%f3@9fO}wV=?`lHxmiul0D}SGY=7@XxBSjU4}cT=*Tvo= z(d`~lPgDkVj(F!VC+v2Bs0V)a4|dGz;^G3p$1i81Yr8od2^*Bs5b9#6mkB6hPleoxtIkN#iZ5cw))%h1jT-3!Kh66Bhns;_wWMwmcU!sWVNK49 zCeubELF2eLdcpef)p2}4DnJXetXd-LX^j)Emdv~k)UsdX#kF&sFWUF}ml459`tK<; z?_(s^+u&824qfKv&S?>bOHe4UXz!Czv|&%M^Gy<5u= zP~b^+h4k@mZHVq2IfiC%r=`?w{kLFOpA2+J}2den03zhNVkJXMa4jA zZVv!`?C-i3u)0+<)mZgPI(DGW0bTYK`pal`C(59L@3JYdmv0Po zXn?Azz_j;4xWFCtiriH&$1R|FxQTUTkz&38+VzW+u`XMdc5h(%4<=vc zx6HVF`;k^4ROS~(kNXGJ{EOdzka9N7Bn!ggON0A#xlxCw!X#--LW7yBkeru4k_SHtdez8wUm#b!t@Ug3hhiOh~2C|@X2EEqBT?Mnt z3td^gugy0P_k=<)6s;fHOYI?+hujthT<;aT$GtV3sGn?!1@&S}5klhG`#cf(GI&s? z5yMaiGr)XI7`0T!(?xL2LAS5e{R>^Ip_uU=1+zRm_n6gt7j$Bbs#94jYHiffcf^>) zko^GNR0V9R7{#dtUbT$lXmDE>a~Zx}1rH;2Uv}AylUEF7UG9;trrWZoYTD{NvXk@b z4OH-@G`v?^D7X!B5 zihUHyXS4t7nvnA%qo7ED4oUwL$w&2BZS zpe610R@BK;S3d4te90<@tA%5^#Xrq$UllrN3>r-L5gB(i?rlq?{A^M{ix!B!3N03m zuxjqEC!Ob=6W(Y&_{F6PgI7vL(S>(1R_JqfCR!19eVDQ8-M$pE$;oz5Q7S@O2{c9&J&r7OI?;3;d4 zX!!ucGu40(Pr0a*s2tH)B|vhf=y;E&@ZHmYcH7Wd)|AuGjSSN8%TBBziMloZz1nG|0FxHoU`TH ztt6GV%^AeJq-v00j#vIIGIn`dl>vXPsY`Ku)s9nVPoYep+Ls#{%biA(tUiRvQ7m)y zDmOc^p<*I!_9eA;ELuV&4Szr+U?iMm(qo|)DNgky8t0?Pl}e09(&{NaXYe}U8h0z` zQY>ZSwmFyV;>z6QLj389;(63u@S%@xX#Tvh#d&1=@g&Ur-&z!hNu+x&Xy@sPVvrN~ zhw*TQ{k=5;t6;#j-UpdPV{4Hv;W;qUcckN?QEziyh;z?9?$lGFCA60?zoXB@x+)GuCy?;Y_VaQM#&y% zL9xWEjGV=aU!*5B@+NEltAz`Ly4jWRCxu;lw0Nk)GvNX*69tTgf$(1w$7Man*Kok_ zxSC+CMtZ$v#ktkK6Ki={zpcAHdg}D7eJYw2!F`^p2QUrms@T>9VowKj5pMl&8>N>&5?7;HR5BA6mUU)dCG#&Qdw}}B zCq0-uJfW3KH2#()J(K;8S#K1FLW`$t>x)ue!`D^oDu`JY5bjoBEuJecLh+&~<*O%V z&5bdDG#oSEPJm*v9&fPaP0sl3{lj-fq?!*dk3`S@#{%Gep09v?Nso&0_#oRqD#ac~ zmw(Qv)$b~Hz4=Jv)k$&Hl;`9mXy+Ob5EnU$^iIX+=_h(_SJ&Xxy6CUhYHe%Y3S9Z; zz$_~EN^o!Zj3TCgp`_-*RWKFRBNmMVC^X6H=N2mi-iB`hF|N^WxlV3>_cH9UMjlm` z$i@aJM(XC9{f5SU)jjWXc(c*MC`wQ~ZIe=&U2u*qL%3e*+Qytb8n|2OaVp_;YqRA=v*$&%`kSYnqZZ8O3 z-h0(${p_=AxxnJWqmp9!>HX@+_vpUxVw~aq*9D4B(}cmx*mREVJZCc0>J>FJhoKZ) z?Y>EU@3uAPuikuOzMk0UEWm{CezY)_-{)Mz7ShaO2Y~*;OGVddzR!c|X4bu%c@7oa zgVA>!$1q!1GB&KH)=QA$h5z-q6VS+-W^H}*C!)OFb)}WCGSm2nj<&EOV3hysq@bl% zNS!!ygG=ogZALMC!@sQ$K1fX&xHM? zKsbVf!r|l3BlOq)*G&8YFV0`3Wh#i1u&fq1Lmx!RUy!~ZoPyH~A0r|G8r}b4oaJYW zD8H$+6FNM>yoYM{RcOvW@BXDLGyF3s<1+(!?huA<4>cuibqx`)(+x@)ih_;-D-Kf? z@3pQ-h^>E^D_e8XkJHV57j~~L;|3GV^GfT?UP;A+WE}JVjdBT=@`A-7Zzmq0C=gez zkVAUeXi|=G z`$!YL17a2ld@jtrYTGY z{=yl15b>F3n9RW1{ydnF)3<{NNf2_NSd^NGfh^brn?Q;|z`#)1;F8UZ%0HEo|M(*YfUY_ryZ!qs&*aFNClP8s{kwy}LAkrnb$ zrU?@DnfQ;p#N-eh=~%7sDOOFaJ>+yeT;#qh^CKr#u6G{L6wFyCo})bjb? zrD%am6N_Fcq3#l3R=WB|-i1y*=xISn21y|tE`3by%f7hAIhTcyX`mvaa3*LfZKf9K zewH%P=o>!Y$Ij`r%_;S(pTUjDl`K|Wz4_KnFEw+rKzaW`ESFWr zjli3p3XV2sa%AMZ6h-B(y6+un@ZSu_jK{P#;zkL+rA36|6*6gDa{G=!;rg{^0QFq(o3KUz z{Jh$G4-fiV{qp%B!C2&w&VQCUdywJz+0^WJ^9@qqar}qjQ03km#i0AMLhK^Q{t?f6 z80X*(8E#Y8&F!N3BcK1{srhK{Lwe9}Bol;kz)R1E9qh{oqNjQ90Ag{hKV;{3pe@^g zEi}~J)9h!%#bKZz{=YidNmOpDQvXXg3vgk}*LYhVA@wb*TE$v38&t5MslY^#iepQN z@7l|3t5=+Na6j_E4|*Id*Ugtck&#|nS_;l`SkRdik|a|;o)~4De$^iw$Hkd?{4|aq zu0A6ka^=(dXOkS|q=S88xyGq}{R~*N+&wxX)z@FHTPkoi?((^WYzf?cOYez_ynl1M zwy$h{r!^j2(=ERaAkVln!U#1x6Vo#dU95ctko@)%Xo!mP<>DT2#NRtd0ysrB#XfJL zlat<4qf@FK0l$u|BS0FVV#oh+ z5`T1uW9Y(b{@m^qrmtLM@{0zK1L`4!FqZwqTk|)Hnxa`Dls8lHvVdbulK>pGB0dM32LnEhf(8D7bHS0lOZ1EV=KZjFnqWj49t1APC_rm?(lUijY+ zs#`Y6Ehn80`pwo{T$a|(HG7U@&yoO^AMbxr>~;fxuDv*!M#>AWslGh=1qTLWUK=3( z0BKMrm;J4<4NhXJhuk)QnbVEetUz)DCU@N4)%##rsz)q?R9V0pv!!rvk3EX-D*?D+ljygs-2I$ z{jIApZ#WHj)$q%`Dq~WjV#rP&9CBA#zxb09t9pvDN<(E-tsQEd_ zI$9&s5{1pxCrlbj74h3}XVzJz1d_nkL~OIZaWt5juw)l z1v&aXP_Phu=~~G1j0zduFc}4i49$d+F7-6a$Ed@Pq=d)NgdOP_k++gdtd@J3pMuGG ztkhsD^};#2_XO{UPi*2v6U!a5>~v-bN2wume3gH!4YP+UOnx;lHT_k3Ck+igR`1v< zSP4{0(@>Ijpq7Xjvo=X~Zq@1-A{aBvNR!7rcZhpEg3JHLfM)f#3ccY9|CiimAdfr4 zLYX#^IvZ|4jW0BH1+l-2E%oq);c}uzC=OdBn$l7ERGoNJvEeE@fX|-spT#H0q0%#S zke|5a8EA5OT((WN-=^=L_6j6Utg~vNoD7hXxsI}%M$3j!GqjoCrZf%GVNbbCzPRCS zxMIK~YX4lNhA+dd&O(LE+mkfD>WHRX|4TqckLe1M9OFJC;tj?0rb7sVmxeDx6*Y{m zUJA2F95Q&|&Q_w08AU0(_mJ!rP`ju^D^f8XNVzh(Q5kt`B;c{*aO*@5BrZd#$|@@G z!V~e5T4;YOK?yp(i5$Nm6^I$(X-CYt;Yli{UuM*gq_Iv8c(k&y6X%>~BksFc0sC=a zCBqsMQO~lA_OoHc1F7AP_(MQ~CBjvZ0?ZzVa&kC4&)$?QC*1Wj^7n-l`WT+}v4x&K!fwSsh`hwGUC z4qpeD*2mGN9*x92uw<5_qtA;FcIr<6Z%xbB!Hd-RGa}FPpQwY;6K5r(e>3Bgmcw3f zYUuS%(Zx6@8T}v*OUK<*Yz#}8&i&DmV+ABCYf>WFG%bc=X z`mgL-QvzHt#U8#B=7@F<@UoSegu{0J{w4KP#cV1mk6~8LN{Pt6J-!M%D;abk-mU7t z^a-hCc1N=4;~NRv2RbdU&)otpA-_IW?xKzQwV9c?%|DT9e<5?azCz~=@c_`%H zk)!d#+vuy1>v_S?@ zg4W~CiSRh9L{AvyshWESR=1cGRDn`i^`5%Hu))> zwTUEJPK|ud^9c_#wP$#z^=C+6^T_9HR%*nhnLNXa!!EJ?*#Zf!GggiHCTkNU0M_3p z6j@TUgOD}VKU~u%WU`no#a$vMSEnIgAL$jrTsh|lfRVn&>{nQ$0D}`wG4ffH19b6c zkr1&T(ORHlWR6?+h6BumG$Y*Q`>1eoGqLmcW2A%8#nBV4voR5+@G!EiePG&U=a2Q) z3&N3FbW6F0^jzU#!D=DpZ1@HsZieBMYtA4OHl)gH2I&zV5|LRa625BWLIvPair4A@ zMB_`#as&b~18rN;3fSDz5E|>QmPFW9lcyu6eP3`8^mr7UvSAw98Hwal<0Y8OP_~xu z;z*u=RG==QR7RGNAQl)tArw15pot}63Uoh{Lix_o8hFw&x+FTf35apqK_jHXA6JRN zHRYFgzi|6d1D5mLUyeFhfZ!VeQh8PHPGLyupq0<n7sA*`%=(0oRnA!3z(2aO?F%%O z@{Nq2@R`zmy_50Jbp3VRbfzIG0ijlT41>#rNIbBV(J`Au_=G-O%b(5uiA!Z8w(G5f zs^Q_y&5cNqjv#hQCObPG6|zmLvdcftM8d|O#a6LjN9y>x_YnWu-gY$_-T8|Zo<~FH zn}N;68=loZKS+lZR515NlQWVvjGSdgI!f@%43rBPyI%+)ZE5o+yyfF97h{rRiO>Ma z)tfPJCX)-(nz4+85sWQTmcq=nQzGV2OZaWs$Rd*ZsOSTH^y<*zGB<3NmJHYvMZFGj;Ol*ulQg~+lq$-KKCGBQ0! z(VwE5(>CSxa56{Oap6#tQPRx*rJsgOI%!Z&_uOH_qTfyL`4y$#Xi6i^HxcY5>!Hu+ zi!5nCt(atUN*#Lhb3$giw42i4T24#@j+sPl6aCzC#$&A9;tr~_)VOJo!#NIsUo%$d ziuio)X}IVA{pp*B)Q)J<8@@cA&IB8{B1Ed;)d&DX&x@)Ml-p%8+GIkL_C8hy`W zb-0m6ct?5WkQuk79eSv_ONMCC970^wZT1L-go;uU36pjYMZ&IWu95_q95CrMs%ecg zPs2^fAmDGhvP02R%Q731pp<>!t~Q#2KhTtSYJ}k2X=!J-@S0yB9?i72rKeW;h^@UO znKes6@p`TWQ^@jSWtJab5^C`qDGn#v1=JVM{(&P62k=5MIlo2lB+^1O6&7}G7>)q~ zL+t4me`9L{7?0QXi0}6Pt0sBAR{!|0)haR+eRj|GKG^)>2TAWkGp_jk6Rdjqd~~v5 zr!YZmWRXy4=HJ>Cj&?XBjf;HDIn!_@Bj++Qwab_gSEg*LsDcuj;Zrt`yA(<1!8?I` z=WHnnY$`klE$ADnJ%@)cI8;2zgMt6jgHX($@BYI&Z*lbz6kM-+;vBDvy#pA59#a)W z6w-fO)$^|gduKHNXs{KxbQI`5|Nqrgxsp;&!X$P2n+|SsbXR;8IS?{Rf9kE-%Bc4x z(a~bs?Tf4@?K3T<3eADYw<*AeZ zS*5w;d{YtU2g1LdY}*Xsr%DKNy>c!cDob$ z#w9=}ylk?VZ9j}zsjOPh0D1+O!AxUx^jHq-jBrjPcj>kmAY!thBBs+XNg*!6-eG4#vJc z;<)O!2|?hg@2p({wLLNkhl5!~=&&S7a{|^ah#3UsGYDQ;?E$;A&|i%thOksP<~ZC9*E5+Pe)e<6eW zZzn~Htm@xKszgVATby=@;OF=%FKd;HRHQz*)Y!^3+lX6)4Zm?ES3FPF2mrm({Ot^E zo@>ckbVv2}#&ie4zMxi(YEU9FJtgw7|!dEgs;TFkKQ_ z%Q$)O*gMSoB6iT=-DtB`8JW5oF@J%BNQs+V9V(zuTM2~wV)^_zqR{VTV|GgPHJf50 zqWpkXWD_KUaBDuLGHdu|&!91zcEkz-W{NGvc3ub~R4fJh6;2Q;j_+Gy2Gm%FDP@T$ zwD_~!^%A)=7IHN^*#21i5FGPBZkJd@k8>=K>j(L;?%35zGbUgM&`DZ))pvjsvzk$Y zf{o2U{o)$4{KFzFdg3_PqLH=c!!Q&^5~-`mmDfmWkm>ApI|&n8%EXlX~l&>Qe~q& zPhHlUP|yGfAFQY0V))XFA+HVIb8aD&MLQA&gnOp2cocDcpiuNUz^QGQqNE%MVRABz zrW|l2Gpp+3GYn^eGQ}+PQ)#<+thYdwB~);^Y;}H<%xJL=;N50jZge6;>{6sc7|D73 zWn~B^;mLTeV5?D;6K^LKP4sz~qKB2*yW03zU#v3b7pZ!XLp+GuG0%t_t^3=ed!aZU zDVS?2iy!XkyXZer`^Zju3@GgpT&TRB(iRllA9RLwhlI7^TE{&!a+HOj+L^19e&P6_Zj8Whh0FQX)SABmuI zz6f%_B75SiWp?Z?3ca9rx@ek01kb?vSRRIrHjIpaek*m5(&alOkK2WE2&2*O(nfi< z^O3IoUZYr6@rE$_VvjqCyuxQ%Mfp0zMD@G$Uq=bxiOJ#K6g=F(nsHo=FrTSh>}fct zuvv8o+wg}qjF37fYC^>)rI6W4UTDgem90d_O1>@j`8jiuDz9~Ff|D#|1?Rjn7&nkq zAD)d}CJ3_4nBun6nw{*Z=1xq)X$)zM&lyz!IUU%UDCjZKHHoN=18GxMQbl?dZDlyz zpQPIG_Zm2g7IaKt1aDZ2QUHp9S-+oD^&m0>9aoqKciet@Uq&*N@S-3sy;Qtb<{J!B z6V9nyfQy%4YZKP>IXp#)MH7S92Hc7fiqWW7y*7q3)4P!%!psfH3sjJHR7#NLgVf& z`r4<-E_DxCb~ViSV_zyg`<(Q{j!A!%=8ny=E9~!kYC2K$zhC7Z*QDUJtg~U2;vYE- z`JH#au;U55CwuYmB{$1?(;T)oQsr+jCwZF4jhG`MB0 z!GzEh4HQaBzs)ICqlQaD2`Q&R^zsWDLFsQZQ74iPn15vAu*3ojVSu%-R2JrfPNDzR zlwM4XuC--O*($zbbNF>AK3xv~HJ`v)MMX$6GBRMW_>NyRtEAtnQFhP`Nn*sSbMO<< z?B&xZqW`uP_V9iS7fNk6`ChK$fII@RT_v zIII8N+cVhdW=JLVoqwsjX6#$eHK30*Pp%;pTJvXY%*UVBf`3RMkHOr`k$&}CSuHc< ziB{dS8?&kfPnKUGJq!+~{nrHqsWQ8fhkTzs_+E_0#$VqatEdH0rfB0r-gq5v_rWwy zb(x?A!UQGcC!3)2d`C!ux5|M%7-pH}=F!Y1Lm?EQy1nN^iXNO_9-x`_2|@xo!U6Qn z9h2{EGCEs({uHYtBsP+hqs&TxuUs|Pkfu`RVm$&ZrYe}LSl*7H361-pdSBCj$-DQl zS60^;n2?r>rs0rOX%Q#juZ;j)i#ve@XYNr-o6-qbFItO6c~dY)#Ts)2m`umXqa#g>brZadER}Xn}2jcIv?9D_=`2`^4Eq98yA6LYl^5R--dSg!8P4nT|i)bIU4@*bcJ3;~@k_fhSZ2@HIv=TEd9OO^^-4-!R z1Ge}50{Dtm6(fAz7slTitL`);Mv=?6h2bdoh)&Cw8{AI*F;9czD0ctq=GciB#2MpL zhxywCmJqzr(lBd13^Jt(jy^FW*G&1wsb`&ISCpaQXKo@XQ;aYWQuT;#i#xD#R=HwB zFJrx$;Z)05&DjXGvHS4^yvgH+-L-?L^GNytHH+eHh4GJr-9agYxxs$Pw{2!DM8ccN)Zv@C0OENPO)m+i@{~ zV8R=D#lqfM8eFnj>}5G5K&ECUVQ>@923atZG;JxE8kQ+#l%0#YK)(jncA zND0yL*hsRG~lF`Vf=ES&aFW+*x$#)VXosT787hR2cNZ6`hBGS5E^*+v!% z|NKdT?A2nn>jDkcD6jr`6Qjm(+ZC%$@tq7>Pop9nI@mC3>PkdbnV#IFGs^PfY(kGi z`k7%8Pvt-Mq88o54&o7J$W&hW@U_CJAUBCtEm6S^d9{x=I&}Uz-l0`Y!FrqO?HQqG z7+#++-{FdmltYU5qo3T*p<*FRbTp3?UN>Xy4f9+ZiH)v(sg{Di)pM)eX!Az&7R<9O1gLb-IPL zi}Ck;`@9yE^EE@$OfJApR~&<-H(|c>2Jk%w9e!50Eo!FRn-}w@!`pFz1y}6yXf!Bj9>t$@oUtgIUJv=g;z45dGzP^yGMTtrw#GjpbY@)v7-__G$ec3k_JjMN2;qXtccIT<}1m~-S}*K z9lcif$ND^I;~P6cE@g$#zPL=3{ReIeDP^{D&1jvwpa0a1Qsi4p-=AlUg9?-nWkY)sebh&*6Ly0>*_&p)FkTLVu)Eq3 z*t9~rO6e;Ly0G-yK%k5FRl|gA0UsXJvS)Skna24$r7_Tu+iFQYjzw2M-$3_A$GB|m z^KXVr6v@a5f#S1QINMTPNp#-uO?d=m0DZJE538Y*b)~zEgd3{xmc-LIY=aw-uP4Vt)f zYSg@(*a{!Hi`XyPzKC ztdkvp``#e{kd8*j08j}iARt9d$6!S%e;#x{O9JA9vv?vD3w7b^7SfCz5~*f4;jM!( zt`cvRu{6hH;Z^@O10+xE<0DiRp4sp`sseJbal~r$XHksL4F-| zl;4%|kk}+g&{#j!au!W7aNEJIE^C&{^KpmPt2cn2$#DzdtC#%zcJhyDw|r3cxz=L^ zDSSTrOI!}@)=5}lT^q51Zk5n72U6yz9Fg|GE+1J@Vm|jGHMf8xwaqB9lH^&qB?(5z zsOzddiEtU-P^eA~#Rx8Ty4@I(H=z~1ms|2Wyy;7Q*j&Fe8U>@5jl5C)jG1gA!%SIS znsMxt7)`{uWA4u}2y?(`n>wkx7n#8jD$+Xb?tCZ(-SSJKPJ=kk~z4LlCI z7wqvG%Z-^YZ|sb084Zi3vYBFwEw_=1YV=&OUip8;2Wlz5oXL|iSxTb5%OpHE5y(mH zL;cCA-igSM#rRe}-P>_lfKM(sqb$Kp*6xHrj|9>So{aC6f#1y`xgTk!|O$QF!D!2u*mC8f~c129?MBNkNJW zHz|$Og%%p^eGgl+-9HJ1hf9T#VCGvS!}_ZlDBKR~t|!L>7ya-Uhp8tgLIcbfy&HAu zKHFxSX8u}#@2@e`B%$ocs)fx)#t_~nPwXk!Ne$xakvvMbte&1@4B%Ny7E?%JkXJCG z%DLjO<$^v}#l>Y)g;-BL@z6l(tWYotUZ{ZaIBQe1tgw&zjzdXoV~aO0%@fLF@=mIiKF@t}{as{VJR9i0X}qN0fu*XO z8Gru=@(hBCNvtq{V=GD73x4{>iMbc(kpEX?ph=SCLA6lR^O#nxOr~&QA*j3KUW277bn9SOZexgLay}}XeagEQQf=8 zJ%3CdDF0LF&h(H{4ZkfB4ZKLZ48pg_`pYeQ_4!2)I_ds?B>29Yf49o5Cmkz{;dcGw z2Kb!&>_(!S_-8lX_tnq;bMEF%h#)BoVWoUV2)k6B?A~#=vc_Z3rxWI$S?=hJT6@+s z>ts`Dv1=S22RLe<=+YC?OHg2%!uM~ytR5tbdA_p2RY4hv|xWHzM8WmHHX~? z5ePwSM@XIuP2+c$bBhOq2i5}f&;5VA6m`h2Mu4`WtG=* z7EJ$%pS7Jp@ko!e^3hH>s{U&GCs;-yeh06NtfM@{MCzzxH&6>T|FC_Hhh60UL}R`0 zt#ZJ}7Rw?|IVb27N1R*?q=|*rbm74RB{mK6L$jD?lv(Y{znV@A#Xe z-`&n0Qs%%&u|H7#OeqE2dl00(zA)3n9O^0CEXsM|5;rdLmcAd)EL;CGhyb&%SCD9A zo|Visx1(>%Uv7^e9T9@!5zr8lx!r`W{?=U=`Be0&{;8MTXC9uTj{YA~aL!Guo(Nu| zf2Ha7SFo7v1>IgF(Q(Mc>&M45jdoPocx~ z?~;~wf!GY9U@!(lBf7a3Ue3wp$VK7PY7vqX$6QLUc~H$y^tKKcW(`q_?@=sRbIRuZ zehu=aHWqO@E5s)LlR&(XB4IcX=iRXJ_l)D)u&0udHuPQNkMk7=_sy;mm=;a-@@w8V z-L<_SC$*S0cGeDf%Gc1g$*cn?%^0=rEw&g&yYXlM8xq@-N{ z++%eSkZd<)3QdU6GqhBXYF0Sw4`IjE0?*WJi?YzWht+FD+&IrKkC>EK!7{6Fn{wA& z+j+ec$%)lZ&OxBd$2WnoD(oT>SVFEps%8&9+oSdUlc*Y=-+3CijviZxpzreLquMPo zZX9_YO@qvsdqNoB^{V~bo_nDXnHdBY^u-; zGei#g=340SUaV6A3A6YN^#I=^PMyCuQ)h9U)>gWBmN^<94MZCCY1Ryg`t6ot6^`=` z+Bt5>;KVWz{K(6SUQpd{IWt*|7}J7(-Oq`@O95j?i=O!?)G~EgC0C=aL^#sUGe9cj z@;U9>s)c6ccMQk34BCjZf;(L%R6&F2h&Bs-ryVfF)PyzD>eNqWFw;m?FJ?ShjT@&P z2=uY_y}1!+y18CWd#PSa#;{JWBzYb^0*-6iuL;FQ*1SzH&q4SB&w9nvU?s~h;ccOR zq{F_h75>T*_BHr|CH=NT)`qu9&?v-RoZ$KN5p?#7{8vQsP4w^4BTKeEzC@-n4%A>V zmmW??MEaBbnb=?`Aqxu@!^+*@fx}7H^F%{EjZKRFEGGFXkPoVGjrb))AP#lenGk47 z|4`6NLs`v#`7B0z)VuZ5ahFz1XDG}9uh-ZscvhUSN+=AYT9n%ozrI8dDN2hyI296I zGW&blCSJguW>$<=Y1obBV@Pp5hkD#E(b{l|mDiWCGl@;IPh5*Wp#I&rxPNeY7bzcE z*8aQ@L8*wdDLt}}cahG7AR08%`lmUuLTBSvgzB-l4zx3h1*&q{Bj z#<_3GVJ@jgU2@*|A~-Th<{nRt_4cR5lk?W#pOI4j^XuI~aU>WWwIlByRAv${Ps79I zjk+zEnyWN$SiVG0e%>^oVlsL@UTJ;6)wQD{pGdhau-$kABJDh6?G=~6G>?KxE`0S- zw5`Y!QTxjVefnHygPJYe?jTixIJgHb*%Kyvzau-$UU<9rU=zHyD*GVXeU0Dm70D@f zcB2c7RsesdI=iOr{$>B};WGFk$YQ`?{eClPI+&_=BWPpkg8vQS1Wn=XO7QP){+;#H zpZ{~}TyB7Y2$i|tw_p}2G)D`FIMhuLKDfRs5iPaUFwKS-U~-YV2t(>M{YtJ4jppW9Vex4>;n-EMp7=fqy!t271f>YpNO4JPp3-F~ zdlZ`2;2-54e6zajCh8x!Y}2!`Rrm1c%%(uP`>rNw&IhaQ)K`*8$is8OF=6LNs3$OV zh02|VVJX+tQrf|iV&p-g4=JIpRYeLlAZ=&w`XT{C-~(ojaBZeE`2oP$LmZnG6}U3ICV*jwx$m zfj~u3|4L~(d_m1&h$cZf?K=?`Y);L}lb%0HXzvZXW#h{A{PINB}2l9y{we zJfOgeSDaV{r}ejmks<61AO8JpR+xe>3xY69#{MI3qc;3P&)`sux3aQSCPwUfzzO?! z+-vIM{x*)vw2mwmrC>zv_)7O8GeU8Rw1Qc!OmjoGKqSmlEhXdgT)I%tB>j?Azwl%> zRg}RCNpfroP@x5JeP%RO)&%mgxip;nku&!B?C$H{IbuyclzgEz&3Jz?A3l<&dMbrb z4U9hVc*-uUfdf2eM`tejB?<^$=8#U)z(D3={SLOzb7J1rZfy7*Vb*ap2@^m!uj8gG zh5-Mt`i&wE9&=(~IGrvJ`-jZoxECZT;HW_IY8B10V03kd-*Q6`^+Ant2;;5*@4>1O z-grU(n?NRqlt5Xa1W>@zuRGo`=ltTssF1|~O2W2FEN&ZcnwV?$Fof;@-iH?~D5i9zY%+9E~yP>Ko08K;|PX+aZC z=Xab%$JefyH7R{RO+3_~c0LaRTChU?>;sxS&A7XksKv-_1g-A)zfFNDp^g^TEZnl$ zuM{#5+cfKvL?shTuEKKExqZ)^1I&f$gJEU@L}Y+78lw3;kt@gmPzvx&+w~7zyzUd2 z(pLLWODOCU5&UcHg-$wlmsbLp%%LY+fO_jzXM9dsi*0qw=}~-;s*s69N-T9djYnnewSoUB5zfbiBD;n;plPd=0Gi31j#MprA&Rw>WhXhAx4OLTV1 z1(S{T@XJkqdR?75r1AEhenC!h@GtaNwlp6smQow~s_1}8lPYiAYCd8K3t7%3X8Blg z^t$&+(jx7D6&HifJ~{YIi-zWnqd|R=k6mBiccp%RD?I2Fw1s>CZbagZJaLSnx zT}Sr0@6IyZO{+l8*f^L~NqOxvW$Rk?S+5koSfvy6w}40PpuBmXq;IY@$$R+LpTG!~ zaE*V@qq%8V(jwCSI1pS zvqE28p75UuDAW@M$jq%2uBkoF`4La~o zU`11eizunMjb5;DUvmhyYb-8|5)09~U5IUvE&WldImH3_SLfyZF|=bcibX1bMn9_z z#+}r7?N2DY3EG;niAgoZ0HOzeNAr zq{>Q<)yQLH>x?@D1463Crsh~8^x=(}d-79EXmD0xNJv}HYrr($F^rhm;>R;wnB2$_bem9B=xcHV|ZjQ87`jOE;eWPY%ABbe{FCP98 zJMFA@uPp}eSSa3|-(3dLSVaA$>bY6XlYO^Ab%AKLP{YMs+kxD-H@%hW|KC0J`>Je- zAXjC)k`*DKkj@zdGR4dg;ugZsJmCab`aGM8G0F0Lq!_7xXn@KO_~(F}Pghl%?>rw+ zxfMK$PR!U6p!WJlb|Ai9704)ctjBEr7T1v9kQ&#KFphg3J&ay(O33KJ8;T1`*9Xu^ zNXx8CO}FKIGpwMt&6Ev?44}X1IoaqEsT@l#ez%PXOPba(f2-}AAIK!vn%=qgkdMcA zw@CEAVG{jB@c8DDx%AJiK=_7^`PH6;&FYdV9lPC;6i|KfNb3NS*B!!3)bs_IznlKF z=k>>owGPukZ^g$HYf5kmON4N0ibbUa*x{!#kI8H@sw-9f*1Esm1pS6}< zC0Rh7cZo9Gejka3oBf~Szc)sR=07z-#oqs%fYcTKh2`^cxQ39V5dOY#O%j_?1~%hv zci<)H+xduUTX?*9vJ}L)Cod5q2IbE5>IYNJr(sQSbN0OnRmY3wWHH z=$S&DbjrMfVlDvCj27Gs%&GtGdv#5v9C-dJYW_#8lQE#+`rG-aqZaxn^9%5&3K*9h zADO<6GnCu%WD!Fq$ppUn=>HymB*WyP{b5=>mw5mN_*}E`!jsScUMtMFEHPgp4+iiV zg08~(*T0~j4(C*V;@#^joHhVL`Rv&I63U^9x@H+z&-{~SWM#J(s-Eg%l&|zTMg(}~ ztJZ9Wjri(q?s-I7Up{grQaj$tq`@zhIqt-Prh2_?`~j@aGJ$t^B_RVpVu#+6$HKpR z<^uko^e-wYr`NB$ts9*<_nDN)Bl<1^`=lU@3R=vM3M{lL#xW28sQM)E-}RH%L1EqQ z9x&7TRUbT{9J!JR%g^ln$d)pL%x6s6$%%M!CYigFN8`ot4Uu{mURh$`b`aW(Gv7s` zs>12g!4?)>`0g(bL)W{_e&K|G5UP((a%Nfn;^y@mf3?-DOes0E$s;k&#gllEDr|jk z0W7VOMfa;~SLk+omUX|BWLFT7ndS`OA4_!{>%BLCw4K*lBbzd6;76)lK?j#dce1m( z8P!W+dx82&g2Cnb2+^={PWwLviv)HE8*{vHh`a(u{mO4c%BYbj8LBKYM~%900%O_o zm91-!Vc-Tpe`ykU@fVwxASr3pRO1Ebme*(bhWA%d3@5-6>m6dujX|knm>#j^@M%lB z{Q-8M(&qxSUg1?&GS8Whi+>$9OlPf;UI&tUCyFwc^POR5Dq9Cn*HCak_f5P)YvKH8 z0=dv3%Dvu-9nW6R0zO;LRgV+wqZQD8ucBE94tV5wUv!p0gU1Xvv!NRy!i$3I;5XGd zPon#0CW_7+Pbux>7%Oz6b191T8*^b8hWO?oBS>WQ9GM|6*TdlWc(2U|j=^_t6Q<{! zrcNn)(O&Jge%J@5rw;$R@ocWUX-NF01@RPmMqW*U1SR>XF>4H>I2!_}EOpa&Qv(X* z#Bpi}65B3h`UOS{{1bStrC5UaPuT}x)&&mai^Wc>L>fccj@1J7+(<~slI;q=_~AM( z2afLN%UvGJ!xK1K`LDcqVojy}d-7DJMAc;P-J0Bizqx*lp$l+cN@Nf*&a%xY|t>%eC9WdSWW2rBVmh+6?3Dl=3U6GaOn3}GKWF`UpDXk zb4xFT+Vy?7CG=Emwn*d&fmHmVv+2^#+KU_xIX*UgWCx8TP#-OwM<<=#)X!q$Wz)de z7?yn?dxh_;h*omK#$p}7S`SFKi?E_LI4I;`83FL3&QtKMPf#n-_1&bn@k}LZ@(k;l z>@P{kGJe#K42zdM)DBdzMikwoT_0Dp7C(vK!Ts;8^AN8S_QjrA&)FL|_&-)Qq>{_C z-4uw`ZUD}PY_+qHti|Y!XdzXC@qw#G%y#?cso?+90`SKtvtM1Gzs;J&{3aWe$eYsc zrA{}74xizaSJ5kKug#EO6$QSZmDL{YrdKE6#An6bPa^Ss5cZ)s?Go4=Y|Ept;-G@j zx5L!8hsqDc_q#9dC4mq=_O{l#@<$f8Set<57!%;zvhFl{{JiLABKAzncMT{7$)u@^D$@gW-y!!6Scsq7?HkE+Q#QQqWhAq zbHR_7hV{VEOZ#yYReoX=u%LF|d_GHiMK~Iv2xdj`x)p_XEz%0=%t>J-0fwBB5nK*O zeL2eNZwt|V%xyHo+FSd95|;Ssy!=C_XdjlnhD-murV%OrHdA)kS;P0&0>(C06kGE< z!~lWl-wm*D9H1Sk1NrYiq%3po$s;1rKo4G02Ui0uDe8`L0M_uiOUdd{$hvV!El-v6 zr=r*0@zv%;>A2>UFgpJ9kK@?&#XJI9gqYNkguO98U4__z2@HP{mW9drkqk5gs+hxR zVYEbXsDobe#0vINx@gucVf?z5VhkaOFy_1>@&2H!l%#KMp&l$mB$V3`>PIZ?U>l_} zhdCgCqF_h;ibN`LO~>rjJ+>C&Qgj^?H2-oZB~yjS`AFa3N|@6Bkhnf#K7|2uJS zPqP8sLbOF^ZKO9~x6Dv^lt=Gs^5K)ZqdM^uP7GHQJ5=}=AWQIhh_`wTn4AJg?;Bfe z0`|aTn9$*iQ&6$5Yc6TlL^K`~Ue}v%WGh3oFb07cVszK$56|aC-!o75Iv^>0C+n9KYfXPYV3>G@#v{L!4KAn}zsAZbYw}^-NE|ANsX|nUfGpv|HK$FmSH8CV7T@^OJ zyGg10`SZKxuzjf?Xgj3$e=!)Js`AlN@np3F3ch!CeMi4W)%{PXwe`idEyZ6bb_&rq&gOWwDwYD2yU{5A_43P=Yo`UE~X zLP1MR{z=rBRS`}>pqVG0eJc3CLOggKI8^TL4KYEDH;V%B``lO7!045LL0pu`Uzy@s z!Y0kMryP})3TBkr@S!7f^<9j*htySin?V?0;LU^eaF60iW~#9fOeW~yQO6;@u1;3?>GZJ|k09ym)mlSJ?gbD@IVB?SOOh zw|{9SREyCG)DS~6i+cGr$29P-oE?&`j~p>59+kT(khPfs2RE(WS7m&)sxD<6EeW#{ zyL!`VfO$~tE%7VXFF!EJq6oyJu4UF`xx|G2q82~+b!{-+9C*mcDvCMrE62+bLKtY1 z9i9g7eeKK0Sg)Txx2?j$0!FG9TVe0xgB(boN2|mvdW*B;JE1suX548Bi_>2S_F*TH z1j_VKWLn2pR*u^k^qN9dz%IdVMD2Blh-Mx%rOM za_C5)oO8RkA>GhZ5{@dN6e}NNi1Ss(Ag3V3Yx<-dfilBuUdXe_WV=>gudgWw6gHd3 z4JSoRNS|Hj1GLCx0&*CtkSNNG%jU`E_$`-?zg|KD??P43Gby)?W_F$Zu6`Ol$VXO6 z&R@L;!;zp`p^Ga=eUSo#(l+;UK!WAwNozXwCIWUnv=vbenF@QqsdgpnmYWJvHwh8()1(m#pcF%a)Z%mcqI!GME% zKpjQBOnLO^G|4thH)HQ;y4bM>8kLnXn_6hVgo`|R#ZkJgqJ!--Uv&J2+*F7}HyUPz zKW4aJo1ZZ>_UKvdpCeyrD2``@;rB=St+e-9bWpj=Tzy@nG4r!uor#a>s`S^Y8E7?E z_xdDn&YxjG?DH)R4Ux{Dh^XxrX%bqA=SDA@$SL>!ei#B#ub$@Bq>N~nfOGnHP zqqpd8y16;M?0($vDg!Ut#0#9l{F2W)f|}+~?LW)opWkg5-v#Z4%yzBI4X3B$2Hvd> zP~se*lfln)c}#Q_WBS7yM}qKx2s|JRMTAr6AfOL6oxP9!;xXXRd2V^)GwKF0Q*K|i zQ;q14kSjz7z>PAgm0}SjomzT^jvNa5FH(Y9tgrPeT$TQTA^7NMxq zXzU8mhp%wlbg_t|gg~(`sXs>azI`6?XXhfevKC+`lS$9LU^c6M%WiKuu&0x>;KkOv z0#g;^UI}lsbCDmM?7yVg`^AFen6=;JQUWh`%_VE|(Z$cMD(y1yLa|?pojGfZK5=tk z1ALy7dGuN@AH8+jd(zof5&8HwQzhy~`yRsC!7Un^-(S^AKB>jehdws{X+;#`SbFuv z@tE`gja(6L8?x&BSwTI1cl^9}%OleJWjw{~M-HM-Av7?@Jb(^lH*^Miv^rX*+&F-N ziQb<5%9^?I!66FdOjNrB;RL&y0L>qUFUulqit0W&YoIZliN4hW-lU47RK$>oFnKXe-q#xDE1PAWSIaD_ec)1+q6Oxo;aX)ckOgDGvT%@EwUB@=X)t#cU z3mLcwU#k0Czi9258dVG65XF+i!0Zh?3jIbRSz*Px+3Rt$sL`#>dWStJB0{kmYsqK04ncnx)2&t?H|8(7O6RCYWHd3Uq%_jw)$Jjh*`9YEz{}UXQ zmUa@N%8pPGQOxyUKIW8(BD&;)B19F(5|@vrFm*jXQU{pMwhKjqY5KcjH&_IHPmcdO_aI`2o9T@G_2Os>T~}hj8KA2W)KExdUcJxYvGV8ZjM)DuLT+RG zC_%Dy_Mc`c$#YK`)^Ul@n7`Q~!1}lKqSsqa&eBwEjDL( z8*ek|OaU)VXOgt3u6?ZZqpMYs&46eJ>kN~{K7r|s=cs&K{~v0YJF%Mtke|;9&FyLg|)+> zbY!%9$e3B{9AL$3x%kMzbcSKyT76c-xpzqWPj>N-ri!!9x-)Z{h_3lO%P+Y%Zd->6 zESuMRAO@*dY?pIgMeT&|7ALkB{W=r|{RW($j~@GvZ+7ed)?ltvj8Qc}ciH}G9c19R zW{}-TCk@1FGmVs@M~ZZmRyw{Q!)PCr9xotck{tHvp=GQ7-ti(@T|PdBx%2N;qwI~4 zDIe9^YSu<3n*Hi9>S61qJHAf+#y$A5RqQ{t(RP(f&uc6o^SuP!gR}X62~Qu#;ERtB zeK+0VZ#!H6=kz@LNreC-5L>uC_s3U%TZ37t+&%`3ixz5gQ5myr=)vtcuk@^x4?>d` zOOHrJ2;eze&b7=zO(2b^EP(X1ChNbyILxHEYIu z(cIpPe(M3aReX$B8`$NaD7SU(z~CnCANLKBU7lVwPTd{|wLXITTscA>+qI$s<*|+e z(TvPf2;#hcWONxtQY2!B!%sv`QB88v8Tn6~EuYT@=MI4poBHb%TZNNw;)q)}JQ{_j z`k8F-R_|g;g(x2aXBDlP#-@8g1@Lj6`HimSc0*l<$WrRc1p*oS`f!Aer(s4629NTk*}}GDD=A9I49~*Gf@wOG;>MvbXSPd+(azO5NhG{6|$ww=2}l zE>;yDKPuqetG?QdWyPV}JSRDF8ThN3N&T;MtKyz=!;juD)c?qpI&cR+$M(vtSfODm z3oquttFATJ+mw?09W*e6K+S%11k&cs>oo{T!)jyk@w8)2MZ$MI^%%>y8|@~3`j~kY z3>U|voi4KXMUrv|&atbZ*navO5zzs@IRe@lUtb(dfC7qkHRQdA+mYzK@glk!pExwo z%t&r6luz1;G22DTPVKxDTGqw^ETCXeM@zrJB*z3s1n;N_20>yFy(;JbwXHGn@TmRIDIh@ zF_*P4NF-2A^9Kw}EjyAfF2XK4KJ8dK65G>phbU?t%FN-gOsOs8PynDX29?@BlGzM= z+VI1ei@0$pC>H*oyViPpTh#xliV8Pq^ytFL3&37TNSTl*F5v0}D0KNio<0HEqg)zi z(wzH^ytnlxy;{fC`*Xc_SUy$wOA>zz zU4Y{fp}75AAm?bz@ET`FulP<2-iYFX@`2UrURlK)LW&)XGKmhetA|?_`)MaUsj<=x z5MvuvBtyjJtkdr;5G5(hx`{vP^?mNW5=ZXgfl*)7Uk>p z>;v(%`Js$G-yl$L`1|aUD!bO4)yD9)O>nH~G&NSYbXM3U3ynMJW9S)zbP9TkMM?v= zNxPpqr&TZgnmuCWD^g@3=itk%!?5Yc2^AjADX2AIigmmE(R-HOa|qW#u!^syzg~Q- z0cu_Z0um2|q^Ek)M`UWuFqW&NS}0U@JItD>Th^MfK zGVte_sFM$9R?42^v3I?kH5yW3V77Q{cEjJj^y#*MZAWn*SNbtjwfdA={%`8B>W_!+ zzal;fsWEw+1P^6nghCzfjO_HVk8b7Vs9uV+c zlX@xnSZ=px#Stk~L5e}^YG14%SrB~6f(i*URfloOO_bGN%&l?7+bs|kd0FY5 zIA6br*U}bKw@Mu^f+~>{X^(!^29tuQ#Dk*6Tifgiy_q~oJhUB(;(I5;u`&*+Xk9_k zg#B-H5C{O-1p?o#vUL!z83@CE`Y0-7kuZHa&cgmE#JRHCqGXooA0S@B!^0h+?|=zD zs2vDzscC@CfH*_Yap>87vkZg={=^AN^AovHR0`@v%BU+8+GoLTIKkLbybRHSy`RDS z)-sL7T0=g)l(Hi_`Y7z*_~z?wOFF8qH)|=eTB|OFk2y5bo}YsUU=DjOYWO=Ui~Fv6 z%vaGXycNy~^FMOO=&ZLoH+*3h?E0Im{`&Io`7zs5Su8t`L()AyC#E}3f#&Szw}Cx) zn7Ow-nQ+iYQ}Ljj^P+L45NOmQ;y#$@x2ATG>dCJsl#a9-jH+V*NXOxr{p~K8ifC78 zwdPBg7NvoRWI59sa>aH)7U`QWUTAosSyWdsPWrk$h zHNJ@Jk>N3tXGrTY;C7-)|+EfmMoV7o2$2s}Z)RQp6EH2xM+_}wh$-x3mDn%5y zBsd}j&P65To3TiYrDHr-qN7+)VZdJ+BC-Wr4SfBYq2Cm?LK^QpZtqHoc!)SZB8t|| zopQb6hdYvTfFea4^==^9@H8y~?f@oF$1OSruP^>mr-0frqa!B)*v%fF-{OpNVjp zmmC_UIuBP}X6z%v(6DP=loXnH#vp>j=%B|2(Z zJr)haH*;QQ3usQ{I?bT<;3DIM!Bkz`0Vkx<)s2l|-t-imxHOt);Ae@p^mx}o!{OP; zL(G#$TS~nXCKL^JReo#96hEp`><*rKX#d?wCx7`t`xgyUSe4h$E`u_Tw|bnb_~bmH z#X-nvlyj+(n%Jf_o(j~K6t6zj*w$>k{Zv?Gv|R(tEy%QYN$V+~rzYp!-GwI1Tmfsi z=^FR3MBoigI|w^SOX9h-N}qiR9L9Nn{o^yM94oE+(f%ZJDT(L1IpaP7urA2O1kWmK zx>&-i%Y;bV&_*iUyoB|e0whGQ7(1QK8VQSE>v$f$nq$*S4o*4l7%!?m5pN>?B0k}m z7GlC61xnQ8nR;KrH87kpik;>O+Su_DKky5u{v*L~?e{VRxpXWcVpez9nYiKXvhI#G zn>cq6q`0^movzA{TAUByu~()T(Bjz);5#5RngJr|&*BQ6239w$;49+MZ8mGKqdU5% zYKfkmrf2$b|9g)>%yq_YA4+~6mhmr$1Ib2fyfhw*A=PAE(n6=zjx_koIkN?F6r~#D z0ohdeaSA&jD)wrev1B{Toabkp1bI7YOF_6`_z5b_$S&HdjnWdF@20mWZG3bz|) z-bDhC=j!=B`(e-ZlmF!a0~da33AD97Sh)J5|1*+Y`nvzmd8qqIX=DPZF~^3I zH?^)zTIllYeb~lXu3tp;3)v>q;(;oXx!Y@F7TVE{~DCnFFGbroRXJ2(c) zr^37o2>tRG9&P$}*fQ2^jz(mYQqsRLGuiR)2rUZW(oK`dJXuZph#$1Hy|6?1aU$A| zEzei?SM`ugtR^V5;$?cM9}&+>*1ZqGI}}ZVfcK*R8j0GSJW>(;qfJ1;J(Y3>2Li>e zHi71`K`Z1ab}HfIVuvwvS>CnU<0tL9oM=TD-Wx=P7Y&*Arl~{PK_VKA7Pgu9Gc*)o zw>f<(xt{FB`f_W3=@)|vj}}*jCrdrxJ97~Q?4SNJrpR<4XNlhTiLr$!@A@02)@a&w zW7H`>A(4Kg|)8QS%h$sAktb9U=<8B?tmx zMMtF{4LN+Vo5{55V-W>G1FjKA8S^Mks>-U$-tuFQ&+&kgmj17_wHm+?da~{PxPJB@ z)9d~Oi-CHX9sV29TBbr=k_y(}$Sd1&BV+e=U<1Z+#~Jshc?_S8e}1B< z;%82g?x^jXn8;bI$rj-Mx}oF@$Y!G#@bmwl7NDagG;~OKN?S#soF(HaGPP!tg6hzQ z=p?zGD+v6r^;lr9xXGJ-zN@HKolc7i$XCCseU4W(A7d*xVf-GtMwfl|eYN1=V0@dP|vpTKpsh-0*D zn3_rZ8jft_6d{vT_^cZD@iBPpEw!t5J$L+?VQf`ng2IpJVxemg7RH=){R+N(rj4f* zqtC~o-56wPf)dzvmK{eom`xxD%C=k#CknCA(*H<+QSHp6UZ3inkidxK=8jz8yR5zrHICQT(jCAWRC^E3`A z(8KkiZzeHXiBg)3(p}EU74%*o;hVir*KSoE@`c=WJKzz-FY2{-g4c*zoo!q$Sa#So z=A{q%)^1GCxP)U|coP#W@Lh@-7_eOwHqXg$0|MqO<#6d z51O3Pvfbo)Y+WB(gul&~yi6&BG2GoqT&rfk+o(-| zZ?+0AUh|T|jK+EdveO~a&SnyJVY`og9*%AbRt{L2JMn@Z2%0}&W$PQ-G{lRjXoRCq zfCAr(D;^f_)Wu1xM;O*=Y67Yb>cI?wiG^{3j7q*ZcwkjddIt?Q5mI#~KK$48EErm& zXzj%<5-DVA#xJWNwv%zW15GB#7+5$Iv7x#zkW#QK6ojX7SR}-e|J*8$s1p4Ftmb4I z1$+&xP?YVKSB%qqw7qJ0DMGAGq4v+B7icBclZ_dl;a?QErA*fYG)JvLaT`gcZS|9T8XEZS{~_wEgQ9x>c)z=_ zbhC6X-6@mxg^J2)7I)yp_ldCM zQS2DM1x|%!-dP`vL@%UT{zkndr7|ee{Dpj>D)q_J&zlkojs;j=`i!+n=q^rf374wT zLMfNRB~H8v53|c+@}Ib>BXGfY5XHG-aFHgPlA^^7yt~G^WLPjxtpE^lTArl98$Ju} z4c>=gb8*`1I?ah3_nQ~PPAk`LrGxiBKWN=;Fg#dWlpP(8x}@hlCtnX~@)ipE zyL(R`vgL870i0RCDTtE4TVw7=ZoF0M-s2=}uDjY}ml^QuzBLazn|X11Z+Xx6Qqx;5 znJZu7ScG+*hM{Zc&SBlZbA9|8%LQi9{g!2&tS75}M6}nn5#P!{H^wxv7$P>Xi0&l> zN&qJ;L0;L#1l!_$B@y@VH&6}E)M_wGoDI_A^I)!T*Fc?6g{vV%UwfFuaYW3w?))gF zBr+~7Z2mgB5w_Bz)MsTsqfZ%${hy#{zWruqBZzK2XUJg&h-g}y#+41>OW!ZhIN479 zFu*t%;5vUzb<(=F@yl~ih+j3j;b%unHf3EWD}UH=wOv?rOKUwwal$M_B&)fcr0w7 z&VM4i%;xt$$wDsN*cnJQtR)*GG_=<%hsv18Q_8Y_jo9fCNY%Q%EOMdwVGzCV+kZd{ zgb_JV5Fq^$`rJI(Tm^=xaTAE8ey4(Xt0!~nFU337YUIf_RpnnLBN&LK4pJ1w#q^-pI+64+Ccj3 zt!@qeD-yN=Y6{o#U1(mLzwg_Cyfkjo(lXhe*ce}8u0$JA_XEhM&0k62t6e!KH_n)P zu-_dRKt86_!}yny(&Uyi&?UclxDg9u28#4!fgFI-A5>Sv%Rv!d*m+$-geT)V^nOt+U4ocoFVL@2kfYiTv#GqKe)CaG|MSq5Y{~D-07f&Ka7S0Sr0eK)2E^ z_f40Q^>2*fU&Y~~7`2v%>(AP}hO=IhE3rYS8f#=s5v)WT>_9}F=%+AjJxI|+K%hhd zBWwgy$@+BXkT|N33WxgEO~Yr+X-v2cJwp}*;Y{JQ1Ta<%s$OE_!Z$T&N%K4BRE!-( zQx-nv=ZcNRlZ`NXtFf=eFZuQW|IOOoNl3l3qbUIJZK^(%q6l8tysqv19$PeM4spsk?pXp(T%=$-CnNq zIAASX4P-N`vcsj)5LE8xg#W=B6=XbnCMfB|!C@=l!;>nG^Y5!VbW3}GK za#!=Vr=OdHNn3zuxM%r~9muI;kV|~m-<=t)g5)#_>;itAr&5Op>B5?y)KY0WB>GXq zg>I^zQ?Q2E74}hQLS-9qO%uBKN5B!c6rFt0bYCXX=_LUy1#&AjY$rQC*e^HqotDqJ zp;nCu$b!8zV4@hRV>SA2ZNg|=M;jeAxa_BBS9nQ&{A|Zw&fJJjXT^qrr?;{47%`9e8Z-jh#+ z5ylGlqmJ%H`Azni1R!L9+4mgtxwlLcE*L)t;2~zT(vU9G6op!2lcNsc}@koiqI^?fVGU6nH8*QSkObIHmHs6efL)F&z9 zGkxzT^u~6~7Cri+sr%e7I9%pBS*CY4F9fgxc`sd;Jkplt3f@$P54q^t`*6|Gdol=^pXg z-IXn1SzU5Jz4^x-bQ!qT=l(gu4=h{wNI?7~L|KRYYMWoCcWCX7ZQ&o++v{g}&*u*> zDTg>67d%>?brOE6pa#Mq6*!dD^=pT~vaMBByF0`ULi#Uz{MQEPPF6X- z6~!R6ernwp5zK`=c=HTs`H9I12*4%yVoNcpB=hx!0UrQLG^V4{G4M5HSM@T^`t$~? zuI%o-fy?9JLE~Ko2x%uUDa_F~FE3P})LdWj^ohKu>o2GCFHUY$>;9jIi;1jVmC{lM z*LN*xwdYuYvl-yM0X7T$OS@=ywAw~w?KP40idasM{1>Y$LutHU2yd&K|Cl#ht^n0W z1dgf%5{1}M47EN)RsECD_1HR&X#{0*If-Kv$s$1p^@+@SPZ-ry8eU{9&u}3)jJUi9 zrI{`4b1bp)B~a#1n*~AF@yljHEgAsZIEh9InrebnD- z>9L8Pl1n6%Fz~rmDC=Hh$XDUvD?wtZ&&Mz900y)??)71+cL?Nw6PKgE=O_tLj zrIQZI3;f(guJ*TSKh8n~qL7h94v!v4rwsc5<7Kb;Undi`9Za$fZfYC5&;Bte*@I%5 z#m(QsOd>CjO@UBT15e-9IkpD_fq?SXDBi0dob+Bn zZL%(LHRUHk?KU${PNX+auftbbO3V(VhJG#D(yGuN5wu<~H_dXK;k{6Sd|LY=(L?#3 zUz%3UEob*?cCxeY`g>m#;Bc)`36q%A4tX zgf37#!8b>*l-n!uVbr(B@%YH=3jw1M3B1q=BLtd2A}N>ac;X7Cqf#6eiYwcKUi!TR zRb6bK`K19~8aF2?ihy|MTq@dc*0EvD#7l0;JS}C;YN#bjd0hc&K#}FDd*7>BG~(vu zFckwLy#c1Q$k3dCCV6iHuCuU9+av9?&-f>-h^SE^?b-#u;013lTwM zRZJQ4C={^^A!&fFR6cI6p$ZY^JT|%2r%-HtJ0+JBmeA zb2&3=)o1%TDrwoT379eQF-wGyPszq-$hNa~CE|R4jfCaFR!mIK-NE~chS4rRBE<2B zGk-Ri8c&4DlfblJfNIg>1sNS;Cp@>uAi zTu?g{l9|X}IN5(xXaFAz+ob0y=q}(ukyNpIjKIOPR}uapoN^=+u|k$+A6nr8`SC0f z1w&i^yC5BUNKi#i(4ah}K(H!|PRyLx=;&X|_cE#~r zRX%kz$to8-|E`m_I9O^{zRb~FkkDv;sfS_1XPykTrv&nvOzYpvc7t!}S@vu0Qd@KE zOmb)6!1)*cK1oyaQ$!$X1)GzE-G|zjE2WB-{J5hpi4e0AQR_ZVZ?K8r;A-}L+Vp$- zxN9qtmf2-?&3;=y7L$%n%iTAz*1zaLoDJ;6avAHv`;guD{e9~Wyr$;(=;1H6QQ5vP zWgRGjyw77a^Dk+q6Xf9c@}@I0J~-f2l~p~XDM^%>OyZimD%*EUO(!Jr2-8=N=oB1H z920Dd*SGtW24~WR2{mfmars}_?UaL|s>D*L-Tgx!QtwEIuP)ji7JjBe zunP;~`+gR^_>Jr^@!#e%>Ao%Y@rw*3-N-N50g=hyn~8&k%e970M=W2lyZ<0*o}0?p zb*hVvbaV*q4UME@*DKA6R4>ql4SAJ5fh6z4@?NIE3$=UsV$S#|{67-vY>L4;x~78e z29ED|gDyKBnI5iX9vLjn@wzs5c7@YMEeq!F#^&B}%3vP`f-JBxWC{)gEia*WEKR@8 zj84w4_q$@}E*348Tms!{51ZdM%>d7n4VEW5H5Uvz>uZtnx?v8tXQ zM*;M)OII=tXnDsy!D{lohY6X#WbUcwyiG2}fgeybaTV5akD;ronDVtavEBch^qBEa z2j0s46!s3e{ud}G6gFX@Z1U#!3U@HeZaNN&n0kEeCwr5~fLy&$bsT;hRw{W=Q^A3U zAyuY6$GCRNlg>uY8KWC$6~=cqwAQJ$AJD}}m>&g(h>WzfZR6f>{KGXm0>|?b6AsDw z*!O0pj!TpU_pj9GiFcPxH+zIH`pMBaSlvZ)E4D8Nk%Pfk@T(trh7eFl72?(90RC&p(3DPXlE@2v?oGCds6Fr*RdUarH#>|UD*L4U`D8^UdLgSl5i^_acBJ|@8nE85`d^2s z3Kmy+#qh>ZTg+`Ag9cIz7|ukbkv64cOgr1{LgBENl%*FCxHIbFN)Xl#Y$MnvNO1nk zT>g1&`50W1l+`^f>?-<1T8iE)WL}=rJC6|(E4N1I|9AxINACOfh)kXoC@m2UTgm2N8OLmprpY3^l+Q#U23Bc5A4Q@XG*oR$Lil z`QWsmuiM{UM zx+WB0`@z|4n5lReyH$j`!yI=X;Hg_NKGz>sWDAhC0K!Y(8hZNfb8&O2&0jLZ;cFtY zvBNYYaSu(u--di1psS}qfc~vs~AfRLpk{-rIaI7(q3*oIF{ILW&Nlw z!trbWFCk!lG^~Tc{ew7Tm|gZ`6{pA~Bu|cQexL!Urtp%WLi<Z5$~VqVuZtiYl=%!&IFdm6GE0W zTbSFT|0YS5Nl~{-*hRAGTxyshX7M@&e)AwIIQHV;`|c2^KEx^K{D3cPn+R+;EG;cf zDr?RQc>E-i747+)AL2e)dW5z&^RqZ+n-O-F87Flea}M_E@L&;>!!*bb4$-|pYA=O+gFjwd%NP=#plO>}1>mhwt zdxqjfTQ{^9Oc4ZeHmD&vWj-_sj*BKLtW97=S4|OQQ-3|`CGw4kgDyxBYnxmM53TB7 zbc%r??H6)GgPSs!7*J2M8aTgZHbs;i>+2uBvY%8NR3a$&TSC5n>? zuELn88TJ8jhWGrb>VfHr;JC!i=brq|okpg(OXO>-FwwWHz9*DS5WFOpP*IaCThsCv zX0(b6&jA*31*1wURtefpK(EMi&3?GImbuYuauE2gf&RN>graO+TFz3qYL-1!?Lgr{ zY4f;1Ip;}G4Hvu;n^XP58v#0Pk`W-{K^-n#R{otJMJqfvu9ExsBuLa8o9a7B8>3R( zZ}e^4g7{hNRm&V(c`7T-Tv>B(>GAeX`?!eLJjK`Ba@qz0ocY!lid0}kv0t4^T;{XJVNhS ztzid__G;_Q(Vp{#xBUu;Y~V25#0ud*jM>Iw>Bq=q7J9?FC~s4gUq{kOo*nG)hSU#+ z=1&{`_ksU2eH(++<8_*9G37lW&`&x*eV@EK;JGxsfGISjC-R=C*#pidyGv9w;>9Mc zi3)8+5KVveeD|KVr1+}ZNKy?_ky;bSxh2$Zb_6j)Bb;cagj*zoLG z^7F86l3Nn>e|&h>^{;X5Yw+h?0Bm^-9L>=Ny}kx__gx3c#R4wtg5$u0OU$vE@ILD( zA_)De6bnWOx;Bgo6c=#nw1}h4#_6GeyxK^AF&wL`XXG!P3*b*H8fgv35hpE0f##ko!ogV&l!qaDpO9Fxh`eNzC)j1*m!+( z`Y=v6JUF=?M3q2>;de_wT-@1yfkyE3n}Ef_)p}uF*asVmO6x<2Igzp4>^05=cr}^C z#Ed@0lnlj9#ScVVWeyOOr>~{99KY2AytTGtiG{ zZH(U&9Ivfx1RVj6txnu4PpN`(?#_2UJ;0;>Cf9WqH`$9g8Kl3zSCUd~$ zw(&(}&X989?5B^85C({`uGWo9vD&i>kFpHgV{O?B<5g$_BPObBm);i;-w#Q2WUC$& zke}31c8n#tu{2uoB)p+`ils1jc>Ecl#R zG#kI2Xvz{3Bx{}y1lN4cH@3EjCx?W?&60Mhs{WmX(lQa;;@8}R7~p5iJ%S+JG^oSA zXWLYxc$eAqnY7oT3P``|^=cpHw_=$CG4Z@WsbvOZvOldS_{)c4nq1c3^<(`5q^)P3 zOl6_gUc7MZ3=Bm4Xd2nEw9TbETV8LxB-92S0lZs6T0e*;(4a(SF@d(ae7K&|C!h)3 zlVabTbWhjT4hEtE$fl**DblPclL>MJv@a&#W5QB?xFUXTXjoTSwM*=TKo{MJo+Cl zOxTn@Yejqi=`R%E2#76?l?G~)yVv>xCu}g+rG9BTGJfrKn32uFpS>Ovjsjzrz_KdB zj4?17*27dX9f25OpUBs3UZJAXtJh2ia1lvF=`FQ%Cw7Os3=76rU>@7>sa9msh`&T@tD5BrwJpu5PA`Oaz^_ zhi$ZRx2#PBwl35w$mfFee9=h40TM7b<*-YYXs0Mj>*>FA1Qmo@!>|GLSN;{LAJ9eh zy3}Mm*V=@fXI3trd@$ij3$C;To;cgFcF2r`Y#{@@(mA`dS3DkQhaMJsU*nSaa>~QXauO#Un!ERe^B-zc9oIgg|Dtm&U0sX>_ca%vun^` zN}N*< zb?~`D3lvuwhsdZtG>EEMI=Sg?hnjP!M{Y)P;cX%Ntn)xU6`$f!2B`2e!QxMu)|7(r%meYwydAHngj+;e(lg+b$rXlJ3ZO*V?K|d6X2(8*k_vw+ zq#7@;;VxT8oFJBLn&5gVX+8y+mC$<}R&tkm9?=01cHLeY6p6s67et4-Zt!k%9PdfP zo^oK-+if5durLPC@CIl+ESiN!JxMBYXb%e{+Cos7 zRVal>Hf^A!o<=J1Dq@($9S11sIgbTu+f$&DGgAwB(ICz=kfteW+co+0CIik5Gq=vQ zk4D0MTmiC}XtAT#R_@$zo$@6}TB&-CW`ZjOe&>mX^M}# zuj7gkU*B}dnTt6sk^7o&dCqU0Ps)@X935gDuYMU4>%JELE1zNCDzjYR{K}ZZO6c44 zVJ#4+IdaNkc z5jZ!i4QemNkVW;}cF=B#GexRi+-OBRw*X<=Id0D3kN;dTUknuOixgFJ182*=Uh}_D+(n6m|W7t?3VL+L(^eUgsL#va9zZ>7hs$;1+G91V2+QX1T61i zx;Snxnb1D~K!i7XwmGUF7evWq?DBbpK&){gh67_U18qfx?t7i zhow(?C8JuZofxQ<@%m!h`SSI9_Fii#-N#2;joJ`1dxp#lO(P1Q?+kp6LR#l&Z&O_? z;RB-p|Hq3S(I3P!u6lQhvBZ|a;sAnKJ58eL`+<;LJnp$rQN?I+JW%K(?eE%wq0|+Y zKjX?-OUYG^9wQVbNF7B7rk+hg)wzwl1EGc$QaO=-iO{%p_7)dgB1Nh1WiP$E0Ez^T zDa~TYf07cOGoJYY&QvFiedIq{z7(Y`OW?=7tcs#%&GO=GO}=iNE7fL#rs z`0V*B>)44n)J z(Q*Qd#i-nVzG_E|JZXih-CtBxZtJOzDy*pJsdmLRLQO0$j)egB2Ie>$-|}ByhB9() z)+jm9;1c0Ie_p^{Qt*zn&c_gUZ#hPUzS*uFepaie>vU9MfbL6`I*0Fc%|_bbRpB@7 zhN?a*R3%HbU7F<>O`MRBArbNzBNVWb-i&zWq~v8$idlFGXy z0c~w}G<7ow1^?$fUQ7r8OB@W*Xr$-tf@)tsGDV`tvcb!BgA8>#hvw`sCttlD&)=oC zTqpU>qU95tIHKwOG{Gkl;VNVpk)zHX3jeBtcM>}IG|mmb#2aG;UUkWh7%0Z)@J`Ao zl^73Qe`ce6n`IWINI2XPZtorX-neh(3AMtUMMGn(I4yQ!7*dV7<70wLbb?7EI(0Bk z0%tX_{eEx=rrI!^;=p2RqvI$6ZLaHDI#TJQBaa)T(M$;q9l^UJdte-ayDqHdLEMB_ z_p`i;ocN>>%LVxb1&c?*9LpakYUVpYD{Y#lm%99EE-@|JTzt4R$Bl81~v*h(Sz5w?)ci58XvP{iO4o%ZH5KPa-j7FdB zcaBKZsGepOC_!IP#5C}H&wPQAIc9z=rNYrK@+NL)J`xsF*B*n2<~5%y_M;0hly{90 z?78;M0t_ANJR0$0&R{F=@*v-JUwzsr7H|F;9HvQ9DvcY<)yx##lWAclpqN1ITnjsc zj+ALz^h|-1rNKNF5u=!!7)W~Zaf0m!yGiawP}ln5lGrD1Z}b^6ZsO0x3}`T9XAv{; zxk0REzwuneKl7+#8W&nki>U?08Yc7`JZWj6XuT3gQn_LereoEj(~w4K?mY#N7hR)e z&?)p`lm7uCbJa^Y-OL+&`m`Hqc~fGkeyWJ9bcsorN;*#}I}h=WP5kg3VZDphmR87- z|0HqTUV+qGE{zHRIo}P+Tt!`3KK$%{>nnJLS~@vh3tCA(N&X&uG50V+7<@GOkUjZ$ zS$iuVOnX=sX?5cAxQ!`;x$f9~v=8hPYGcO#uTJp=7*rH_d>+85hBZjNumenrqS*un z21Wa(`UVmA!5=22Z}A454lbWcNp<$}2i@-K{IpwIy+pfs+7Q4$nw07&3~;__3Cx1> zCxd|btO$C%kwN0>Ia$V&?iHciTuTRLvJM*-jh{qn_(n$1U!PuSEi7n{yqXM*x^Ec} z0VavGNfERP;X>4ll&_W2tGdgal?})_zR}JG;4zz+&G};QKkGdI#C`KDkyGSPMNiZR z72w>4d5q?u#Ff{{TCzVh^q)pexQ`Y}v!&TGMEe9l1}=TkwKnUit8C7(q?d>fO=%9u z?Uf|#Fg_49Ps)Gk2s}AQAUZrIMz?As-6;olIZ~QXAhNT<=LBHE^3-|O z#9Z7CNb$FMquJK00 zojGq6ZN-(};}rFYZ;jteb4q>m0etZGiG8MAL~*2GF>^f|8_+vScC%WvHyv6HlZK2X z=K#s*oOWmiI{Ow#F}s>V<^}@*>O12kx#l@uwTQ)Y3hI|>DNXVxS6BXD8;lQD*J`BB5hi_($L|yyLbplR+pl*(8rlV6< z5`w!L^u+6QtqRfXLiDZ~2K%^=EqgWMc zO4csVg2e<;?iKK)GI_T%ADq{fF6+i|?T3#OUIMW~&mV6WnDtFW3TL}1FrK?^+~XV( z_MsP%wWsBt0s|Qkb>pgpu?CWDVLUI`Prq)2HPiz!$eHVV>4qcwNJ#Plm`sQfbMg-CBrK3H{u`J#E%nqi!Ev@Y29Yl zfBlLbqf9Y~w$BtKcm_0i>LuD@3&jOwN|>?%$S7HE;1|N2cdj5xEsuo{HI)zshCJZS zk{?T508T64jQ z2KG)BkkzODj-jf>HO{&DzWohjl%)|jwS}MJ_kFjYtgbH-X0XK-4o5RWp|-HBtRBG9 zsaiu$jFTSR(;%M3k8==4GW~<>R+$6Z86e(s+w)CQBXfs%*azB=pp>feJL&2l zbzX1w8+2c?p7~kXe7~uC(4$TQ`Cy_eiUW4cbjl-tVv##7?CJho=?XY9r9*Q*BLO%x z^nIZ0j0mt^b#N*fYWgedYI)rMER6jI)P$M}m!7>l0RqesGX z?Uh}Caz0lcp|HZYy#^k^Ntg+1IP|7X)k~{sdB#M2pF|n)g(GcI5{w@T9`ESOy+N6? z^h{tQ856>6AxVESKj0J&;>)o=`SN}Fa#5C3GI=mNn4~A9fj}v@@x~jvom3)>=EoOq z_kn;BT)g?6#V*5cfWat#*6IBxto#qCVRCsc^Nf+CUsSY}-<6oYkcdX>1DS|&9F9Im zNktJ~AnrMhC3pHLQUhnOvB8>me`*&w@n{$I9Axi+M>`a#!_$YONDP`l=X^2EdV$g7 z6Tht4dEVMg#gBr_be?1+Hfmz%;ht_@^m9o3BH?W$!3)=BBp~^`W!h!P`S$n<{jY(b z$p;lhl<)VfoI2Rc7;atkTl9*=TeY;>Z#LBix+C05>t|yu7~T%wJ7spTWkrC#(4D3a z*x1D!>RCf3X%pup?6QtDn=fm8k|(CAh8Gk$wNUQW#0%yT((LRd4Fn->7R=-S*43zL zVOT7Li1(nQrXJ4fnGQ89m!{0+O3;eBYM-=~SK8zPTU*^QsXTgzTU~NAHmtzLiFNKR z>$p?P#H9tR7?D>r2yvJ;vE8I%KSFMalpdsHta!bX{=_;i`Bd@G-^v@4)k+ozcexhuJ2f9iy3o zrw~3aW5`wtjw)iw{hYEu(*59t^!`&w{w}+%#xRM?niEVZwCk8uLQz$g`#10LEO_-P zOexnUE>;fpF8{PhIp9DI%Fe zuG2%J*Y3vG`nR^2A4)H7yB}|_R33keCHG<5Xm0U*d4KxAl}94q8J%pCgy&AHv)%q1 zMZ!64LW1v9eX?>KOcC-|B}7pX7!0H~ou01s@Ka>iocmgSdm(>Ik9fRr>562~xGiU* zTrV5T+N^vP+-4ON#7g=9C5#X~y}Zu5ntC*Z>q{Tqi*YsT=hdaw2BkCR_DRAx5R(J1PwsZft*T+%BvwR%ivVMf+r}vg}jXWgu zzHjHN6DJ&iz7Jp<4dIkZSmFFPBU1lbU^HJYUo%&)AizYG&UfAq-Tx<$RtrUJ2ltDQ z0}a(S-@iJ{ut0rt?eT=jhGRE^-fDc?uPNa9>9r#d;@rf=@E;b+aQ(UGNVJi^|A!23 zz=+`%sKGi@_N{ zbC|Sr7vlu+EpRclfDtmV!1s6f`CXlyB5(T$IBN~wK;gzkuiJoZ zAdvgaVb>)<*g2Z+!^;hK7QVjv)?HN*wt|(09?avKon8O2+WHLf*D^OTqQZyXo-=cr zV6e_queK*7O%J06Ry^n>XHJ$u5mPvvgkrnC%RmVQLbMBG1RHhMBtMOWrPYXp2gjI~=ZHV(0%>+Geul za#bROr>JWyuX{xVCg$0df2;x|2>s^&6IHBUw!{Y&rTX^tvljkIep*(A zv~~GGNCGMkVn+hT)<&U%+%#^{82@MuT^iLvjJFmoudfrIHTi%|3>oFmR`(wE+wBtO z*z>R7($y`ITm#VHSiKL`?+FLFf78c*v z6EvQ^$=qc-#N2N3qB$oiiqHk_i>LsLle@dv7B{(O&$qLgf_Bglx_W09F3KpR+gy){ z?&vpqf`qV>U$1+EKg*fy{1&BYnN_)=?nj=d9#!&D6l*wT`0n z$(eWt_+&|wtL5>4!3^L6K}ijD{vB?N#x@luxTX8kUW9is1KkoYyKk-GMsN8%60sUR=ofmFFxTZa~nI7{wDSRfIln8ns34`@Nu}2tS3AM zo#dQ0J;&9>TyoM_WA>l)$E{D6q(o?5cc*m(dsStrVJhL51hWCK00Iw1^NBaxQUvH# z-tM9Ox*QL{ZDeCY-oz_0hIOSdsl+@7MMRL@fLV_(bLj?#l~;vMt)3CSI8T`^EOqwB zOEKPIRdVX5G-RZr*1>LzLj<5+GJ1O<`l%AnmBJGYjLt%VMt8i>zvbU?zE!^1iJCv0 zId2+SkXvSM7z5>=ZB|xn3XjA!Ch8(J4fF4P-tF)ah4u-IFamVUsSYStZrL4eMBVQ7 znB1kT9r#)b9#&PXw@W8PJ1LH3k27tV`!4N5Vm z-niwMZ2PkIgU0(aUMjWpw_~;P+_opYunQqjp9tCH+tSU$Entg-mJs#WntQFb&*yji z+$*#Sb1_NVdpBm{r?4y!7xaHo4-?`;#LfwJ=VICx`})<3f1Ci2L-}`yAnn6<-UG+KZVuX?4mA7F$VgxH?QY#J41zJv6W^Tg31tSkwi@6q$ zg|Nycu0VA~SXYzMQ~rWkIj`2|9~eZW2Ml&a<(cDnA5teumoNWBx)yJLG%2Xy9-GOb z{RYpw{8gfRVP(>29~*eglmmraI$LU6UBdY*0)q)Za2HTB`teprSFvtmjMuAZtD-+e z)i6ed5j~6je$d%JAucEj^%h}_V$7b^g0h9bR4I(9Sa&h~h~?CEcB|q2zDFxhC;$w( z*;f=q8jm0wEN8wKpRhmf=dFJR0*oh*v%!~sArv7Ojv<@Lk&p z0DwDyh^AS)q6O8hxSpPPe#m>g&QmZ+LFmpOie{8jEgcffn!cv{Me<=L9L}HLG}wLr z`H|+~KIGVl7(9m8bC(zL@13jYOWF^UR~?VNYrSt~zGCWLS@J0~Yz0Z@T2n+#uC6FJ zN7Pgb2IY83UwY2kHWt8bWySVj^^9XY{8`t!W)zoA=eDW6TAI3l5QC+MHJ`D`4^jTu{#*KPW6 zY^ny(IsHriU~oU{`NOAEV>bvS>kHl0?G`aUM&Z0iMSh0xIL=S!quK9Bcyo3+qb67AE)(!wwgWmGkhFG?rDb;&t5fQN?zg~!hh zQD15Su4AhiMow*?)^sAya-S+Rxq%0n@7-1C!gcVOE^T1Lzdhk!ATpyAdjcw=6~Qx; z;ecCW^GDPck1rjJKWV@K=^)_HJ+lMQl~nT{I%yJsEP#GB(Cp5RlRIOt_!3wjaLRl> zbo61Ea=&&{7!ax!h{LsaU4#8T&%q*{4cLZKoXg3!d=ON!Lk5ogl1#WAs)_KWH%+e4 zJ9CTs&V5qbDmyWk0n=44@qPagPu*slf!@W*io;pFnG1V!uT@}iBa4#~FSB%u*czn* zfsJgMc@*gt^UHA+wFv^#94R9?$Gg2OrqqJ#;PO8Nh=>7yB#^_jFX*b=$MK7zlMV_R z4DJrS1XwKu6M+Ydc8|893>*KS7l11z#@>9i^CG!Oash@JoII8sIK42^{K$0qjbA8SYNRun>UiEO$Pzi`)&$ z?^-<+ZMDGUO2QHUIxyqsL4YJi51X_ze{LJn8$4%SPoQPK_4aThM?p`_EVfwwP-L=d z7#bPMbMm1~_^h+XT_YTTHJ%1ZDHH~PA^^WF@P9}6eB#!OS!e z7M3tsFEUdwf0^*bE$_n6zk>w+JG`h>{VJQfKSB)QbWh zVeFu`oEODEwtb7rUA8j^0oVGX*ubng65|2GI6VOV$`$+z>S|VfY$Q7^sUf-(k2ta) znI8}B<;HLxa#l>7F-zY6X)qKRvCMO8iXh| zDSrol!S(bM&_PP$zUL+5PD$*tMBp)~)=N&}!d0znQzIMWdv+-kso+{vWO^`!vG7xj zynI-#g58VSD>~V#MzoGAV~vZ2SxGA<&k@s0?0kdNZFM_|%@N+$7&xm*-X9OU^p+9d z1u{**tkNCBk7v!MH2&Q^lpm|cm45LO)8&4&wZl_dz4|qo^u)b7V$1BNkR$2d-!5Hf zQRR0gKkh&h_Ov0VKmwYu2ezb9B@{EP5&8rAp@&<^W2g&@JoLZ6fLu=FL&W7M;z>JXirh9{FWmA2$!dfvvw)1Ll8^i>4C__{#5rL&9oKsTb=iK}%z} zCtNYbM9-a81KwmuvSmm7zZ#g~kEN36xF z4A;W2Ho1iTG}#VKQ=~O(IcEd_BZC}ZmRNcBeTZ7w^gp=$P26ciLX;#-bnoGxGqX&X zkHpQS*b`<}de2mqD1%xvk~fyPZ`D0^obGr5b4mn^?6 z%sN;wj9c@}cpId&c-oo9K@|NSyO+J;Bhi!{oi-4Xks4(>rI}q+R6dPI$^@i=!5IPF z+s;vx3x_?Vi3ZF4Hb~D^cwHbyHPe2_SVNrxm5K;9IKjqWesQZg0T)Kx;cm;r;y!%~ zDgvJbW_P~iRQ&Ym``i1gzgHp56nAI*k3zv)V!>#$l6Q?E7i$}sGFM>GI^p99;b~>} zjmy;wfPIZ>Yu%wRg)sY^4f}mOGKabhs)zNG!S4q`;TL73G~<|rb9(w z!6yS0!0T@Oe&l^{ly!z`s1(8c;TyGjb}Ik|mS2MdQ;H1E08*4_`}F)}+ywuJsIv@; zqm8!p%-{rf2=4Cgfx+E9!8H(Eg1b8*!3hq*2@b*C-7P?HcR&4|x~J~nuA;iCr|G@l zz1Mn{_b|2SCxqwGiDzbjF#eGa5aI`+-}mq3^azB9KYh`-$c!chYdT_Vy0_YBaLmxh z1_ZqP>G@A`mmX!!VcKX9FwYl1raem6DYbLJ1M)+A1xkF~@OTxrMF&CkUCxM-dVqAx z(J99^kRtUfKs@T(>vFyg6Z1%nB6h?l$GD;iq|w5lKq#hNIOY844ProcYZu%ifp5yZG~l3cm`SjAHZs*CUM}jcC%d?Q z4#Eg5V|Mg!46N78U3EYl<;t|rvVi@YJ_-obKJ%d-w)D2?_Qv3B1CA2MIQ!Cya1La@ zf87~(^dnI$PJQX@>rL2`XTenUbKGOV84Y*A1g-)aI~Y}&H>k$}l_Fz|R4v?HYn`ZB zA;YR>a(Wkq%Y&&onbe)CTUjI_rT#fWUx4;oC}usp?1LH}91Q2Lxf0VtIY6-u{qeW| z4V!NV0;kRmTe}+@X_yN{&Mu={A0h)mpSFWZ9v|_vLzD*>zvVN&13;f9KY(!tgLS+W zec_}VDv*MDFrB|eAE%@PEXe_xV{jMdL4KtI3XDb4i2QUt4hMVPU%B}b0xCdZxPsvg zNb%5GS^Av<9dJlbJ?;U63?DiId@N-E(Vjwl(fF26=hX-t1uXOY&mG9DN#lpq%0E@uppZU{rs4sGJ3@V2KYXmH=U^93ONn=b(iyA1 zU4l9h7yoa0J-q@YDk=b2Eaiy#t({o-IgG9284Df#3m{M}877W4!cAT#5GMOnyCvh?Qz0jqS z^jA0RO-9Rjx#WNT<&ki55}80%wAAgA7oTd=;vBt8nVr!cVt=bTYmhE@FioqH=_g4p_z5KzR*&W77y^ll^s z0+xa!MnFWQ%?mRj?*<4KAaOBeK;_!zuMi@7CI{CBoIQZ{N`phfDy*WGL1$iYWQPrc z9yh?X+#)e_%HNL@koNi~H5YtY z8Ad(=!DR9cKWu!94d7M|T#dk-IZoRt!a^jV5_lJR)9!)>uNPGU$oxEz&PcEg4hv4H zC7=QGfrD7W4iYGfXYQ)0Jb)H*F%@m6q3F zFQibhw&ksNZWq3dX(Vaxnpcl)L_mmPcehP%=<7bViKIAflq*M$Aut+U7$YZ{M}#{Q zN#N-07ANsNJtX>;nX%)N5;p7xX`-y!%@d#dEXTH8#;CwN?({oFMf*7{Qu#%=iUU0U za}q8-4ROLn1E)D^2x|VMY(;iN+zPBVixUDKYMGN1!p(MR?nkA_eT-GT-CR{eFu2r0 zB0MfX+tHTEzlC9FPey;>1?O3?D07fS)mACs451=`4qN2S16Iw&F_Y~=U9$5uID=WK zx~no-B+qxkHW7QjO(a_mM;V!ora$;{S;h{{UsQ@}%`lPt>=w+%)G?JH(uo@H^iqc1 z*c1sWz6uD~kUzKTob zpRe$jeX;q2@77&J;&F+RXX$85eR273!*OS?uehwW3itzUvTfFq{a_Z=MI_)L=~-45 z{@0P^)W%Gn&xlJ`FvTJ=)2IXlhEGHc zy?m9pN*nyg;Epbg-d6!XYo&_gL8qegKGx9UxCKfbXOpRxibVm5`;*UQs)sv^0GKf& z@fp67X)ub^VeGCE*;KCb5*0^nGzaW|kt+ux8afzh4_Qi%h$6Dj*d&+^W$eviVF}E| z!+xVht$e!X6m@gn&2!tFxBmeD2ZMSsePia2%u%5wK5o_{MZ_-%_R+o~Q7(TT8nK4> z6T(@S{2-reJmEmZP{)ukUUwz>uU|;!*V0bf;*|3k`{Pd}t-$CCgAz0Bz>tL%<##GQ zJwPcuxH zNO9gfQaQ2Sz*JrMt|P%bVn-p7ww6v?tE=~27GmsBSJ2(3G&{~Ok>=I&NP|k$K3D@( zQ*;t&id8}STONLU9@EKR0Yk>?Ci*MrY{Or=fFADo_RAaZe;2%;*Uw%^L7O?RGjGHI z`MyJ0Sq$JHPZ4sahECEP!Eb z{o=R%{y*A2>BjTYmn{Q;I{`RJEL-JjU?Q%&-!HZ}XxYtFrOr_aFa;YTCm&B~^WCSFa1n#S0nJRHL>%*yjPEhEH3B^2c|kzU_w+;plrF#X9vK2NRV|BJ zMs$iiW=>5lDJhOZr#}gdd|aC58xBOSMzL3E$HRB6XhsGm1eTe~I-X?brzfPU@Ov)t zfP1EtauEs4LE8sYz5Efm({Ay0-g`J9)zn8%UE8z5&Yae)@Fz}~DdbaOu8I`Gp+RZK zj#OY-CDubg1U;tIM{3-nm@j0aTFkbrl^U2d)W)*J__9vJwi+7U`q4mT`y`j9k!qn% zDAxsza+hCg!hwcvl62aV+H=Yhek*^^({Izo9+Ey zpPXuDJP!{cVX_Gzb^MEuy9%=R(fNbb9guOO{a|sK3 zFb(HczFR%vtu`EN|0uJ%c4GY7w4VChu@OeRbG;ih_vGP`a%YFqpJw{r-Qckqc+UMR z;gb4w)+gj9>HvJ;6YG!S|ELE&p`D`yid^9BZQ~2a4l17LDX8@!T_&DF=Sv&;1n05G z8eQ3?IDA z#;E{`n9`ITu8m=?!ClkPGY51t8I?g%0aqz7c1;mb;TX5kH9_-1&+moVwtaT)j4wp& zF=px)?<+2@uOli?<{`}SY-Zd5Wg(-IVwVZ#6OEO<4h@6blS%ie@5gU6kFQZrt$>Hx z=b>ZKyHRze_DcBt{dccVjlKfK!wop{MI5#7r9$lm+2l3JB^7F8M>rytsHxm$jM=rR zgUPN<4GzBhxuyk>5rxPPMIQ)jJ`5rAE0>aemg!c7lgsDL%Kfch>pH&VU3JtJE6@)l zY`hH^8Yp`Z{k^pLHV#X1kXg5o?mf=&%F+L}R&6-%=~LGiW`^SaMCHCBf;R$hzmjJ| zL{Q<>3P8Sk80!tKnpRG>0Q&{zl1001#Qi2g+nA-){>>ab^5#8~txuH8(5s_FsvdWn zWh6<}s6`DfUzqrxlhXhba>tvl8#usIY3whYXb?w-%fb_mi>EYXryAc=)7SIsU5rV$ zgMV)i!uQ1;SW9~k1j-eL(6+(z{VA4(-$)$u)$^N&wy~5W^wT@GN}F}GQX6x-MB&>= zM`M3uVnF4o?|zf;U^B=F=axlm*6Q={6YKW^o8y21l~eXOs`Z=T2>@U>5dTF@2S}%E zYS9IQE>|J)+f(`PQ!KIvaaYzbqr;dlc7a4#A!6l4GJR%z9vDl~eqBvmy@Um~G*ATw z1gO?(_z+`a6_WLr$~{c8PIv##yh^853y7u$$0nHhJF0stOjJ-d6VDf$_Tq0j5n}Qh zeqZ(QJhSccnjRHr{&Rl~=Y>p}uPBX!u^&xB784DAVe3lAULf*$0cE8xFK`~YXMfTi zCS{txVTXTeb|(Zwm?0C+r@4L2q)rb=b@{o;{P(8p!&n?UhqTWT8(EKTaK}w0StmE# zF}gQ1{@CZz3O9(fBE;w4OV|{$Xvr*las9XBqvVz}J~>({XRT{6c7O@NWHpt-O8pLR z-%SD8W6Fg?+IONLU58)hE@vXX-|GoM2xmN>Q)%WZpd@;BKRU(J#`UC))2FV_B+rKq z_C(Ja(yk#bcA5EbMm(3Bv=tjF=w^camW3f$tG_$ zzF(RXUnTE6qn@zIF7Sm?22M8R?%`s0TE$p8S1CDxqo!(QTWacWYyLX?&Eqcopf+|~Ub z*XHAg5kd2Mf-9K=dFED6ILlCeTuoUuv6PFZyJ>p|L2#JQM1#yh@ zlxSvgr8qi`Ab~dxqe5AvGC2z04Pv(B)%fnTnfKTN)6*3J85!@}ZsrX@0V5*{J`W?G zEE_`*s}^gNz+_L00~fJhd|-0ko`Fw8@2@I9FtDKN_!_SpK=6~3^5YDZwhaqHr?)z7 zj=~x$g@}Jf=KDYbaR-0t?aNCnvinYi^FMbl_C7biK6TX{oit}hM!!8)=G@OVetf+0 ze+>R2eDdVk%0^Y5?{Rs9o%1-a01|yj`La#o^fKUobENWwmu)mrX|+&yv~+{ke%R6- z|L0ET;!gDb!}B!T3)br^(CPX8v+~Dd`*YuT(fy8X^YDhf+u|&K; z`t4+m)JV*@zC`zD8d!eI^N=E{?&TF~9-bbM6xnSwiisAtt$!UBy1)@@-tUj*&^b z1E_Ga0S2I+F+#K)&d?mkDeePyYy0~wBUer^l{B2{)^q8ZGq31>{pS=Rz&&h%0-G`U z?OFE{c}M}5{u4s(~lXgS#z|XoPQ7QR7;<4?cz^);zg*B`Dw=Ti>;7-3q!dt}Fy;X>zZBS%J*(vzdWg%6~P>PQVN4B0Y!>;mzX@25MiL_00UC8>%;40-kA(@dQ|$rbJkN2QpOyXg&e5X1=z|^Ot3uqbzaPN z352Hx{&RBNv32@9<+g)2jSiCb5sM5v^;OZdyNCU9R(cfGTYymPaOSD_*RNS)2Pho@}qqk{r|&HbtbT90$Ka zLTCJ+9)+J+$elZ4za=o8U*9PPnmx#$1hd+vswsHlO0_2T&2V1HmKQbm}18}{)YvlT$Cz`Z%bJzOg6B#mW;`AyAsb(TdJzdk#l^$wk1T5D zcy3aad|Fzj?fRX%QRHcDGFs+CX`M>hU>w_YHas4y3Z@W5;O_vck59z@Bfxp39N}Db zxLZ6^wr(ZOxPhbk7#0QK7*CV_L(Q>*DVz6HZ9x5)l}QM-936!-+ZQK=@rxy8rA{;lMO%C(usTP z06)L;G$DM`klD~vLBk2XG$lOBc0hxDqJ=;u>wJW9tDn0x;0HyoWZPT~kx_9NyaCd9 zf6+t<%OqMYp2V4dAf>Ei1=w9C+}H+qO^=B8 zO!bu2H;n=0+x)bfz4{7E`|>na%;2Zp2^5%WQ#zK1Me`TMDEFmsWHs4;xjseZ2NJb{ zI*duvym?20KnboH7HcFErK1?MlBN1&qfeED$`^4?Hx3T$;xt2aE%*`0tQVidq?Eip zwM65Y6rdPUP;uQ=%P92TdK+0AZDJTm4x$pEdHa;30BtCRi(#cD(ovh-9 zSgrW}*%1$kVms#63Ho=s4KMO2;-4VhlT;alD`}z=#kTO$*~opg;y?;VpK*P_!!|$7 z^zT(NvCeBNN>5p_oIz`eYi<kZ2|EBoJj zitP+y);*8sFMlq-oFn+3BY*-HKKYZNlL_x|6u%Ciod=@(fI9BHJHiR5{#<^m+9dNo zB-23MsbRZ$Rz(H>pB8|LL4}E#}F%@q*U+x?Sbt`p`e~C$jPB@eet{^Mt?W zJ$1Ge^)vpbwd6NcmDdw7|K-MukqM_A;PI%%ObxmrCIri1(InV7*`_5k{se);DC%s#oAEb^zbVa$ROCs zMbazDL%5NItLO7ZhgzCT6+#G{8bvruc1%)CM{JdhdxON?YD6lAAzq0b5sbELc=#D` zJn=9jJKv)PchA*b))RQx`TPr}HYF9qC2f9uw}`_ImIPVA%WHff>M-IXm)IIQNe%eu zP|Yl`9w@#He2}|zLuX25G`<7qBHUo6;QS4%Mv>~W7U)9!s?RTMQUNqH)q?9$m*}EA z`jB11TxRijULvV%ljag9??#o|(UeB}=_^(Jty>3`L$P05nc*(xIr=+zQp&g8{Y2`V z;y)eaeV&B)p3iD$e^X~DIBlxRIpwBg53nT=HB6^qen+c~&(;c0s%Jo*iu~rpFp;9= zxI4GjGt6!7?VtyUts~ zLd)@ZqJk*#aS}dPiio{egD4R9M_w&mjhgQKtEz`L;wxANtEO6;zdNwG+<)|QC<9`w zqxP=FXNMEX$535GpxFg)NFfv$4Ong=kCFg$rXuinpEp?YSEZASdyQZToX zj^e4u($a@`T9bHQn=9!3_3B6U%c_m8=WSXc`Ef7hUT&_YUjSdr1FxmWj`3NY>V61S z3L?Ahr?xN&3Y?=bCLlR&@ZM>b(&7SF3{GE#LXpv`}Hlc>o0r8znif;f0fPO|Ph-6$bnwQCx8&z3tFMo_` zgl?5iWJ04@rlVI)|Jn%&S~wM{s1Fdb7u>_qOpdWBeKb^h0)}QPla$p$jrM>a4gS*E zdA0^mNy(*#`5k3i%+3$sos-d;GHhvH`)Q9rkDIWE7kmZu1~s~x478^8pB;tW__OsP zk+Gp_m^09$g}hQk)mfr&puHT!ik4D>C9h!jiaG^T8gv-^wnxv$O;t+!3)^<5TbCa> z%29#K*#Q4tu!ING=&(pS5!<9+ApB+P$6x*IAMg?*;$FfI6lxoe?xP)`z(M|&ETyK4!0N`B2v+{Qrz(VGtlPo z&rDVGw#<~U>bEdg&Uhpa0<_^7OD?d0l6G@E{Gpu6jU^jV~wF)&qqb#7H${_axL0Qwg?qjI_^*i-Ccm#m9LDfRUCb6Lwm+~v_j^i36 zBL~N6_z%KjKN1*sFtQtV;GIrAd!dn$`EuqybQatRvS>TD|1`2{6t5F638+p4P+OZl z$&xsinlVK^DLRZ#o!p42U*xbm*H0(uwZQU#O`PUloXTXY9)8Xo?oe_Oh$U-S74!b+%!}ldy|EK9 zi|rLV5ji9!=VX|eu}K#nXf|TaY*7k7_yg0qU(qSgJ3TWvVVNh#4eNt^KkL8y67L;? zKj>7{<#iiM{m;kTvU_}c(xMBaXF}8qVF~>}^mhfxRjZbGK}+I=D5v8K-2(PkhpV=f z7H%<^!UWN)Om3>PcL!@n*T>`j+4Fy&>Q4SwNJHm;NvF$WXIpnB;AER!~Y)mi0q*Ur7p@X=4V$hT(ve9kjaTZKqNnzY< zxcTeT3o@z5*AS1xo23aqyp)_up5w*7o%w|u9qNd-_}tiR^se~& zc0j4yu77{o%yJ~j?xPa^-9`{16ypGdMLJ7n?#F3X22B5V5n_s5@IX%@kyR8IZ2kwkg?eo@bz~(nsJZ zTyJiVws{x?avPQ4ww7Oq)HklbwyT~W+7vPthfKF>5kk%z$RukNiaRd2)Rc* ztse-<`Bk!0m4+FcMksDV<%|8<{-)Fi>E3eaqY$#SiZyxE3Jz2P21ov zzEAKAI(8u#goxDV_oj7j=ghzMDk!QIeDu>+|!0| zXb_0c?8_ON=j#@YDJ)gZ#DaEBw=>Acig_x0G3KbM~C zw|$Q7GPhb=G`FTEb%GBu31+x6kxqWbZq1*Sm26l;9qBf2bvmWVZMQ#^89n zoluNJ$QWm)vJsJvl2Os<(aV->^RY0S_DI+XKcVZywFuV2#ca3taO+0-LIlU=t-}cD zGT`VJQ!iqsGF^&As11=u&yA~~x)IYb*UdX7k7jJVzpFkl)S`hIEz1R3rjFPtm*#9E zsN(98`0Vl~9b%Mhmj$UFGa*tMl1%DRNiV`YxH{36+M=NmQ?Wm2$0;ZH^(i6t3*C&- zJzEiF1vdru-p98xhM%?ffoZyxMdWsAC=a|2zMU;MQ)uK6;xCIHTlIHlEVN|StDqsv zPYe(=&itRhDUObVK=M(p`-`U^xyWs&^+6bspX=KK&`Fi-Yt|e9+Gb^CC2-caRNJoJ z*uFG{I|DATa-f+}qPYe4@C(uwk97vlr)TGD1H+T@U&zJVNa$pSrUZlad4un?3y8}3 z)4Pd+E6JvAsKT6j*;VWAADv?d_zZy8J(Aev^OT2q;vZejMUprur!LQ;g9u?@qz_<|iY)yN_uEWI3Krd6A3*$V z6#tWKQWK8$%*mxOydHk#Brw3&zFMEf$)&Ytw+~q=(TtcRsyp{c`uG;X@RL#Q(N`R) zxYmJ_rBBBT*1r4V|xhq^gIjGE6x0N;uXlAey}4m^uXeFX>T zugZkOo2VGp8dzO4Pn58W1G=)IM>4>ldVc@)` z)Cn!nDwI`D8e1TFw*GUo-=9CV_HDE76?=|Pb+Z%S{8AE?-lEG7MQVi=IutCq?)ML@C^1orHYplbU?CIpdxQr13cmS+)?cgS z5nKn*wDh_xHDz#^7+|&u`Wf$S+(AmgFu*)rfpCs!u(y#?AZKRH57bB8mUCN}A)UF9Qdg299vbHC@UkL7~Qx##HPpKgR^EwiWrAVAfo%ZHvppA`$L_MsJC;nR}sG*89!M6y^aSVU1t0P z68{}4GPw=99U_W^&EvbLeHk%iOcuZ(^d_+Wa_Vs<99^2EE2v=FWG1pi7~ zd4>;=)A~kyTC29}P*UF}7WPE%ntxA<0xiwi_0cz-k6jBLuWoIZ!%Qkq+Sx`MW($3N zaH2pa>*k){sntc#nHM@F*a|jt5=_}xpbO9Ug(_GsFIyZ(T8PBFAX28x8=m=Lb6gC3 zV35VNLPge6xOR|f))~W`n2ajIM^&iT-xz=)7s|{Eb{0k9Fx{8=QIx57EuU{wR-l`b zIiEKObeKrkQItKF?Ex9WkAW>TJO&kaFS4ClF_VO)kQj(*!I{HKHX`h5Ng}+QxkTV% z01y;mZRNcl5ph#yVlX2Npc4SWGW&iwsh)J|p)(Omc^SEoq%)v@s;*@$I@3gEmkKLl zopKjh3VaX8r^FCs0(?7#du*3f!>JP7e6kZ;JI78$+vDf*wqQg=e!T=9=S8m;#a#a( zQ@^@({Cu%`0}q+ zK)KK4o1kXXVH#7q(R1Tkxvo|6P5-sZpGN%1{*&3+;UlA>M&~B2wV9)E!)$Ktjw*TV zed`J4cYItN$a1BOQDUvTE7j#{ZY5F(^Dp9GQo+oPh@!?Fbi2MYDJ5mdQbkj!u!5+; z!Rp2q9808k!Blra7}bW{)!JqRvT99wY#5Tz?BuUaj7zjxET=jn0Id=1GGdWDYXmvY zRwjuGI{98Nk!Wzw4)n$bo&>~UQxtXFmBdV!QY>woULGzk;o<14KXJe?J?z~ADg{4I zNWbGNG@#BQndiZ~Cl9hD&LypTYic1Ca_`kL(JS3FRw8FI9k-zqWC>}!jy@bZIDZyX zQ7TSy`8Tl_XlVL94M(NB1OlRmg{|$kYBd@@q%Ew6XRlSK_e8fx#ft_6$iTr~6IUvS z_||(?DKbwtmziofiWrepZ0YZzGt3zsd>rRB41-NHrJ1)60Ht%{C$-7iO#g5uY1Swv zVHbPzRc@Sv!ZaxSJsnWEX)B8bHax^)=%a(?$)&VMR!+bp7O`cF)oUa_agFh`^xu+% zKEzm;VYz7;6G+qA?-2B38u8^ab7_;nm&lGylvO5Lz-r@pg(dFocT!h&mKAC!O#CWU z;C74bsZlCua{1-h8*x+H#qPRT{(b*RPfOHUQ$AG<#*4VPfPRA{PM5`2(XV?FOLoo) zI%K<)TNb6c(&7i8yU7#xa7tD21aJZx$bcOkmX{@a6H@CM*v;tY$yaNmF8#iZ_X%A0 zr?f;14tbUwzr*Iq)lp%hCG}frCbSDJD@z1q;FluFOVoqCr)K%_CP(yqcJ%=9OZevO%uelWbw_Ur~l!wI~j*)#ZkyYrRnP z_>2`6zs+VlPg*(cN&b3~6iSG-k(%Mi*a_Z*m`ChhB^yU%-o_n6n0%*mmYuf2S6xZ- z@l6 z3F8e#HbqYKN-jixy&t-;(k_n52(ap$s$BsGz*Yh}zD{ef>q@xTgABr`6i0JO zs9tp@!-|=3*pD=`V^X&yA=(>JLxxChVy=So`glRkI> zgKU90=j?aGh!@lleaGuP_|Pmw4R-Q=hz^bgXA&KTS*9xj8*%P0N>|PR@+#S{-wwaH z5hPK5&{8NU{-8B(|G2S|KTLoSz#gheW%G$BsaE@6<*0|=lgL>zW@NzjYA>~X#;Suc z%9+s;ha@&V%l1?(>zvgxo7H(@9_ppA-Rj=o9qwG$tPGcvUK4 zOC=p03q|@BPqK+M8^S7`KL|=486`d=O!YTOJ8Ht67u=oia<$w$VRmWKaJ5$={52j$ zc_86<`QUkMM^$JbpRf=M;}=h9E0y)BzS#o`<6N9f`iV-v0vpj-f%CPMWw|$VN}O7tN5{YzKEZMPw-VFq2DZZ zk6;DQBu@ksscGpfkGJb{JkzY(k1Qad7+DU2x*sDUMy(=3LI!i-@pdSz-M8enS;jfS z^52^%!CQnpOB=s6D}0LK5)cbRoItZUh>{4x(l$? zb^goWPtVbBa2via%T+H#+5WFypw3_f^nX?&V;t-_d=@kO`c-@fdmCS`SlXUl*se(F zYokMo`O&3sBcK`Q-@PcH#Gr-GFiGL)-n|XwUyH_P_tKIj8gK<$e42+o6u9_b-1u&g)+z zReX>7#NLX=Ha=FhT_O+H z_J03!P1ANgt#Cm8@ZY^AUXLfTFW3HC4Sm`8-x-jF-rpNwnYG+_dHhJ)Qdw1XF+%o6 z@Y?$Jnrxj8N4qyQt5u6&#LZ($9T3Bu{h&(o+2?F3euvr7A)h6@(gt}FdFarHLCu8g zzKUMv-jxzJf@gMAtvrM<&5%46-Ue3jvq453ZXx?zAKumCEv%?Hp_Rf!IJ4cs$6awj zL7C=#AJ1{lchFoLM%#6#?W)QlOHIz_f=GHy_k-LK)TW3CCvwUz$L#lmZ!BJ6pr(Tl z@@lq=O0b=`RC;!0OGNeMm#(_nk+Pa;H4SE0xkqsCL3Ll8FtJ*9T4bC$3O z07fHTNX;joUvPyGQlz9C?uY>0L~TiY zV5cfb&vMe;eB{TTIi`^oTy5rQ>B-k}9n_*BH7b6rlF0^Nh|EZ>c%l_C_`}#Hvzeoc z+PJ0K>*Vk|?B3;+&(|Y9{m$q5$t<76bT$SZzDEy{y^flPK=WWl{jcG(UwVvZOpe@of=56%|5Ybq#zVPv6nrADdS z%H=$RpZllKs2tARVP^?rNA(+SvRxuAD#I~2uF?AG-T&m)@G8w7XVGe#yBJER>cuz& zxsdkT{w5@>Sj?Xyf~?x>$fOqNW=e;$`C`>uWjopKZHA0J|$=GL&)_KzInyJ^%j z8D(XkuGW0c?ETrRLYhtj1DJv5kuCH<9Hy;82|(VlJ@=gbaK+gZ={!-)b_f6(po;?| za$t4!5V-oH@A=rCTIz*W9;x!-R?x_AISOxiex4d8GG%f1R{yu~`ImtXE{cH;zE^fX zR77aLawm~W z?nQJzh=48z1fYmEldi6xIQcgJym2TnynT5c;#F zK@A~3Ys{s0mtt^Mm7QOe|5>Rp4om0wwOt<&BMEyw!)h57wuiW6i`!SsbRd{IqovWt z*AA-Tz^*qK#oHk7!1w090pq_^3!H`A*`;NfT;eZl(|)Sr#jua!rY<=lzzoRW z-u{7oCem*LJ9`Yz?xZ=wt)!}-UuhesTrFq9jJFH|FMyI^u2Jx!NS>cXVPG;Cw|tOg z&2h;fL3dDkc&V!pb{P~vgFJJPa#&MCTT#019TRsLZ+6qz`xZlWV%PVzdGMX{M8aNg zKwW|!eJH6a;{Ry@Ai)bO1cToKHmZ1z8F9N3=`@@zuxfvsO#@B<{w(E$w$obbB=g?# z-Z{l*n$5XlW(Tn2fKAYQ5?U4Gtm&P>R13n2jAyjgKPuuTYCDm_KBNLpm7b#Ue^pUr z`{?U6NR+~`BAEmdGWS^3M5Kom(H>?4~gU1)CXZK)C$s-#_6!j$EJxWjEj9} zv(z4hJ$S8>Tf=#YzsnfsWx}lPOnQj;YP{9R6@L??)ui&~eP z76BkZDvWcvwd^=3#_Wgj^PNmIo#`O&W%kMKXsR9uzsiQWD3!k@4)%ixW-myLmNvFEME3iPvZkxIX7e3PiT zmCJ_>tA)2$CNiTx`GH+$2nfO7vu{z`uq!Xl{Y_RoTy#yo4Ad`uKL77V9{zV87t;!C zTf5&s^?!N0{jx1`<~1?%r~bcflzm6T%E`>1P^*QzNjERA$nT$C1puS=t77fl_oCq~ zN6P9hqFT>Wc=Z~mnJGkea};J6g<0WT$s!2G97=&quYimi+PP0^oqqn#XDxP53{wz< z1fybVl|GYRriGGcX`gl$6DXxl|7gil%nC9UXnBtB=w{s_NA-V`fN^;Y2=Tp?jj8vI z_luBhaYm&4R96>W<8k4QSk^4eW?kJ>NHj3_|Y2+fVpu96LI);zD}h$CJ)q{RDZVB{gtQ} zd~6&1@*1+6*PY0+^gWtLO4>b}&qD~xth!(hRw+XbovRJY5UynX4*R#p?ZsIQP!t1Y z02nkRSiw^yAzRcrYNv>p03Ur9eN;hXgy%)&%zmK9eHtlhHnJy2p|-XcH- zD=X(C$H+{@6D{^1DFTIz3i>teubLnDlo`$@dx|Z8xL`}e_Z4iVrE~b8;lo+lVn|Vd z?q@Zz>cdS820iCNh0R^z&Z3(#r^d3|n);R;P{qVcnJ!e}3Z#^xCXDZYQD^n?9ks2a zw0_HNB&Wo5P1tkr1TWYa%aD^hy6}xA2fV4<#g+}rl}@-g5J!$W+fp621eqECwD;!M zM%%S4L_PXYfuVBE~g#$YeDd-_&hI#0a-45qlY)pAfk~l zgx8Hy!#$UtB*Te{AlTlb^aQN53IQvMzn*!YO&^H+Hb02Pq%fuDi3I%mrC?j`Z2$A0 zWmqS&P9ZKgUjp20Ag}9NIwc?4lZZ3?*N|(hpkiiw2b__@ZxR4>ab-P^SpksrXsmz} z4Q1l&2O3I|Ti4L=GkC;cqKCX)!?E$)`lhg8*A2{6Q?6f3!6*GlK+SL02dwI{H9X*_ z7bHx~0gZ6V2`8@)sOf*~YV=vQijml_1ZUkz08KYAX}~!oWC-T8t63w#-V}|A%m2h} z%Ke`##oCrY@~nOj#cQm2e24p|dcNog^KCe`wgTiJI>=9Y(8|q-qe&iQp!Lu5`W|h> zBDi)i!3sLMOr{Kgp8NGvq?8Z){meVZG)B>IPHz!raRZHt8+zCU0ofBFeZDTS&HWx> zVqMI9$ssZyA5L0w%}P86yzj=gdn=%<@I2k3K|>&FMX%&_Oa>CX0iv{p-p@0A?Hu*h z@zVE>H6JH`tepa49Ls5rNo%dgT`7rwA{UjcZ%&H43LK)YX1*SR~Zyl+pw2qX(Sg|kX*V! zK|s1&LRvZmBqXG3X;?a>rA4G!y1S(WK?DS8C6;&q>F@Z?d^7%YW``f=ocp@3q#jX8 zVNcA9=i^@>%+dm=UoZU<25g8{jSTgxtyfO&ZybrA6Ji2;EjiYEW}Ix)zS!P)RglU_ z#p-hE|NbNVn%oepd#UPY;wW>_IF0au(@uiqmzzhIUR%sJDJdINOtDBIWjV=kIYF6- zCU9_^i!Yo&lRiIIE8{XFdXrR9r*xOAN$;^{fGOMSWK{BIW|=QGTWED}tZ0T^>3zXU zx=IE(4KLZQTJwP+r3%$#aD1?C8?SkBHMf;5I(8#~5w~T%E;m1=lnWWh4RvWUEfbC! zeZBMZ2UBT5^C7TGAen>0`4xUl(eYC4US2u|PlDW(aJn9A@ZA)<5=o@p6R>H_l0$^4#0$)e2L@o6m|tBF9qiu>ae>zC?pYfke5+tbfZww^=2?^JUu;ABNxn2jc zN{8lpoTCvKC}nirRGN@{txU$gF*|}S01KH>bZPs#Fw4RoK7`cl)ZL@|K!q$;QNW4y zKi2q<6z&rfy1B}+6Q=%{u;a7F&*?j2?_;LIY}|P=P6d1Z3JPtN2o@76=tmJQtS6YW zmpg19x^Rs$pSqX*)_^ye<9|xl<#1K}7%&@^et~K!+lx-_^^WDm*lWAQ6gyF+)q@jp ziaq5DenI=HSDHN}V_WQp%f$N4()UeYR9+;;f{90f2cM#qiPSExvDhii=Y-+!33`Bl z+FbPvwsIg94mmi>+VIjnSKwToSWmvJtvP_J6i{Pf;TNT0ewjI@?j+8wzfA7lLnuB zBrtVf4Kc`cO_IE;U{JG9BQ?C0hbQH8Tt*ZNqmO~|d&&&g{Ac$S-G2h*{K53KfEjEM zj+cbpb4<{K2)W|#0ZIj||Ht&q72FG%`~Je}Jnkp(eYja82L0Wj>WTShFs|*op!w;) z&-+i5`n$z09ZMX19PWGAw0JzkA1o;LIB@4_f!{0i$uXdJeG7Q#TfU}SV_y{iY5Z^# zYI&R(5*tFk_{&(LKjh+vYs>$BRVyTi@ag}45=dNWUDf<^2)FG1aDMi`pQo}26uh%< zSdyUFF9V>|f_?^T@NcRICiCDcJ0OW^9WOv5(5ASo%WPzgsd6QM)vvZ+N)IW|%!)mC zv1NUQ3yRU`?HYX7=Ga`^(YE^Q`pu-qS%Y(cRC&|gX!G6r>y*f6G#SJiab;{xRxv;i zzLu+xuUk-PH$$E2yfdD1^!IP6dXa#)kqL+n#qH9Yht|oz33Q~>ai?#2%r1jTT+63h z@|gn#`SSCjdhe3&bP4&Nn{&OXUTddOF&f9=BM`NP6rX6l%Iy==)#0TQ2Gw&L)*5|q6+*NvjQRh#sxw$4%a9<0i|E_7vHO>1gadW#sOyz0QE=< zGsyScyxN9;&llAoZ7(&O12KX8F1=JIkmF$uIC{BQbcjQEhfsW3w8HcIgZP_XJ;lV$ z?SF+vkkX{ z^*s4Caj>|xf_~~@Llce3q$ZEmO7fUqNF8N(A%r5eIWxcYf|`HTK8a z7)Mj$f1|!VijlEh9$05rK!ZLOJ(_;&iW>d?s+tC-Q?!UhG?KBR+{^WA14422BYyXm zRhu>kw++$EjzjuNeVNI1>tl?O3{#vMzC|I!N#~&Fn&dzhBi!dv@U5-sSno1h_oujjW%7L_oZk`S>RHX0L&f#)UtCzuEr0_ zFJGF zH9Bv0)USe3JVly;;k@NnFIV61C6{rXY`u=dS)__RX5o4go~3u8mNNCG%UnQvNbPA{ zY0SzIkrD6X*0Epj4s8qab03jqs zzukXPxO4DC88+9g?Z2Q4+g3icXgo^KgFA z#Z}T@F?sT|HMP$GB%cLq{m?n$-J-RxUiOG6n(`+=)8c7TtNY$=QSN_x!r3z<7Zf6T zVqT0vQg04egIaLx=5O?D06=~+pAw!TJi{ix7bPT(ZVsr3Mw*&;W?Q;UO4sT=Q0C1s-09C|2N3HVb1U+09dm6HLXuLaP0KSV^# z)%WG2@`@*+^?Kwg+2xJcE9tZ!9lB>}4pt(%(RHSL(+l39V<`Kk*h?vetS=eQ(@`5Y4Zft`&M2m1WcIvU{0~JtG@S8go?fLl;!1d;b%N$8#HN;Mump;Wzl9 zXII@+H~d9dM@CR<3m=VVo3#>A#6W($A5`eaPtXGwftTQYssACfE4C{@5R=2|HeN{$ zkZ9vL;H<7Q?HG;;eCrQ9mc({q;bsK58dQoNQy>?!%s~DvsP-20VVf4CQeKM%8Y?o} ziG#thXcF^bLA&bf$^2~FP=a>irC6uo(;vMFiDvH*Wsa@)kG-|C#=1OuKy6L2o(6OC zRb>eRNKmyE4CGxxa{5hx(5QBClt*l32K`vzGu}p78B{UeS9tLbCaVDYxE`n=(rCm- zsmfF-`h1M0-Xf{If-5CSL6#4#-7CgK7-JK55N>CYMYRQk!VqZ^?rI6_EnL%o*0&Ts z*@HP4T@_w>I3{;Byv{@{Rm=2+>2;BlKfY7=v*G@3E23Ba{YvSepd2e$b!rRl#Pd!n z+(K;@U7dYPx-R)mElqesQbP zV?)@eH7$zbP}DwN;KX(-Wh5*l~&hAZ(nJk9)pdsrkkZM%pTm2YZ@Ly%P zE@DJUSK~}f`A<@E`%s?}oUc*mKtVt`C=zD%{`=Y-`UMd_*(9G7zWhk{s}(Lx2uo_P32%Kzh}p)QZiknUEdixI(DJ?${K=d= zMDj~QEEP9a@y)2lpAQ&*6$2Q?uSwFYX1P{dgrhEkWpWHH!{}rnz**(M;4+wS5S$)< z&?TpRU?lS*&|~Fx8c3n&6O= zr$waCYETx@$VCXiKLD-Uxxe+$tiej$3DLy#>&y&SxKa;S(`!DOxAd)2XW7&1lOk(_ zRNco|pkCLO0d@Ya2$8i;bm_yN%GwP;j~lX=I-|awLf;Zeoy2P0O5ZQ{990I~q7n9x z@Seo|kDr1t-(G%vID6O%xcC3kqy3g!xrS#~^A4pslb$|Kjb#H){{~kp6A} z?rB|O7XSe4A#5Lz;6}J>J5%o;09TS&;N8B3R&MUOKj5}V&*CmDD<-x$g5gPw-w7}h8JTVP;gFN4k%^5 zIsKfnk3RHwozs$)4Ci}jI7CGU+kY(yHiGvl1JpypX`gfS7^d9(9OBloIzW@KKcNr4 z7@4(ddXr_Wwbo#=P{wUizsOx_FknOIazo%NQ-ol5`4JUAr1HB!!nd88T5ZF^Ygu+nlYp z7Vy$~LmMwSa=1IKN}_~+jrg^~T%U9JF@EFUKelD0g>xUq>tOLW_aOVW6z5gXOM zac%)B=79f!vB$q~PE~b027Zj2jB;m2@?-Hx90)eiLu^>V`-7zrp60_4w+*=y-u{ z$rIr#--G0hcp7@8$IXAHV1JW-H#G35Pre(=rbMin#PLj*7fm6dV9Om?3QJEZ-uPS^ zjs1Ghf(gyb2DyQAb^|`&zmB$8P8)(~5$SOD1ca48-Jw_^q z8Jeh{0ZMIZ*@~48Mt#JFy*fc(21xjOL|f646&`;W@o8;a0z!3s!d5=fnAgEFuX*WB z%?lr6udKMbOEil%nSoXK`JdU|{kET&flnvfQ%1{Au*5uddfEJW8b!Fgs-s33zKs>n z_9R)90IK++t*CHVTL)@Xoncg)F0 z@32KLALf7ih)uPRz4mv(=Xmn1G=|L8sYpvlz*6bq?+Dz;A#0#|Nl;8Vq2_6E{C7&s zR2{X+I@IXPmwa_5J&s(oNxVni%D3A-`Gt;eB>YcBw^?wSK~gwM5CK4qI`;_Or8gzb zW`O|SVieCYkOZ?!`PgQa(C6wCCKwf?ro=qWbKO^;;4?Tm2|SK7Perh^zXAA)HW2{v za)iB}#C)n&&O-5mMtnJ2l;m=yCd0z59QZ+OXBmxkpyn-xu66rGk8DAyCLx<87 z{h8?Kf*kJ?9gUzaRX;hk(-%E%9e~8;KC`J~9Mv3U5Yi~SQGUXqBNqV2 z!Xy10Q;djW^m(9(Vyb_Y2qVWU2h(CPsb{tF>w8UIx!wdDb4&lcG`r#EW??Di@af1f zHSqc{(ZaufEhVCRY3QYle-j0av8-CdluS*J>Xzu;MCW1Ham|Ny=C!0zOnlD*bSd{i z=#_xpLZ%d=wXP6Z{1!&b?X`o8`lTZ`@Am$VOFnIbtqbyiZ_mXZf72u&rvYjpw&9m* z!oQ{68k^U8dSn+bZ%rL0r$w;QU-m;!k^@ zxDFmdAQAH-nrwJvG zOLPaoso8VMem8S|teHPI`Dd#E99X4}YLKL0%jK&vO#3+@WqrJ4br4R62dsXJy)HXO z5}^>HYTl^ZfYr#M*7d~er{mKTYc{G#rQ+7Xr5M>VL{)pFo4~7WZtP^Rx5!K|G4q{D zur!7w^73%LK*J%q4DaIRE2g#A+}}%9cMaP<$q`z}AER%Ql|pkuCqd3RF?x$$bRB6} z^ns*^AX+5{8&NKGzmZs$#1y;iB;7yJ`Jr;{nawVO3CwrhGE5VDAK2WtFf_BJc`>RIqEza)Rz(COZ(a-?S&dmRI?Tu<`9v?3_&|7FQm8`6@&8d%AagP>(+nL{KE$Mwdz~;=dqtLDz?> z0-tF2<0eq7GD%D}{G|gC-qLRcxH62 z7+`j~J-wgZ>`uIt57@W3w}_Ii)E4^aCKOflDbO`;l^n--d)tJ`CS;2!uDoYnAliGb z`->AxN&tuBG~JW>_l(#JN;~}l<7kd&qhFz*$X=&`JD}~!=14Ksw zi<$z0%UBWJ`|8ECR>FgYYRWv5DqQzJnn%6;&wYi91ZkFo4!_-6Cg)aBe%Aihh{-2{ zW7^{%=I+sYxlXp}kiy0!S52yfJq31@Q@r+JaMsr6MF}Zouzo+{N~bV33-3EQtWkhQ zs?0&CG6PI|ypcD%uS`4qkyfyib?Z2|7H1soJ6}n0vlKhd%SW72w#G;ts#g}}Jg4br z{i<}L#&I0+B$0ZAs+(D;Kg;wv`fFO!UQq$Wd^7XBWnrCR^J)%Q{e{wNRbTg8*ypX({J=u?F&VvFN^IBS%Anz^Mom7T0R5BK_Tip7uP>!dRNAVi!( zuHd31lY245d#!=W_%MtYJrFt{M_3246o?un8Fq-@Tz}tXGJVyo-5~ip&rdD8^!W@x zV~L83|EhnX*66-h6o$Zx9p7a(^on$6Dg5jbP-~ex97`c9Ni`>rytmwbm-4B+f-?6o zpFr(DXDUDZv1K~;xbrumsG9mEdP||txZ6P$jO&C332=2QI?fMqJVV|VaCMt4zdvVR z9L)(*KH{D7L@wYjgnj!eNU2CfmuziVrEfR^_RE)b3U{O>f#7@13D&d9l*i7KjgY2h zeUSGhN`d>XrEztmRaa?7ig4@`iZov7Y;bT4reNene#MX@w`y3m%46d}5)x1Gla7n~ z5NR&jbci!fSc7M)6qg?v@e!;9xW%HJE#qZ#h8;{i@QVU8x=snTs}Rg!tvTJ4E8DK# zG5=T&q3?8DrK%eH;kxCy*ua?I@ldR|;=j~3jqI=SVyGgq zsXMTY2nKcH1?C~6%~dbn{JtXCV~y0+fzBy&(2mpCv#aZQ#jSSBeS4=T@Dd|60yK%L zm_>OiWRx{XcI?R2Ecm*01GPp%yF=;J#0Dg6?xG#RbzJc=ax|)Pr1*aM{bD+Km~rrd z?bk_)FKn}AxZl2QU(Q67G`aL}*PCp|Y{tmSU&pv+xw+R5&1sp*>kG%og|oy;*7M;C z5!odG4Ug?iGC3ON* za5n}h=QZz({lo#1_c|(5FgxR${Z{{N$W2fz$CItBWH#WYZno^n16g&_u{G5ux~1j1 ziAZ-rHSkz5O32K4b3Y<)(*ey1v=QjEGQ>MyD~nQwYo z&e&_~7~JZ84&DFOZ~v9bPi?c#an_6XPy5L}M8<~Q3M;6;v{E#2T_*Axcu7~2OUBNf z3}-GSbISULwkapD;N-7b%gavu9+(*nk3jev64 zNUw|SF$MTC@53;}Q7@*r++$U=rT9M_*?Uu^_zgV~U2f#%PLXHug!kl{%H-jsI`F>d zp!L;Gj0wVklV96g3#A;hVN2olX2aeI1FI>jsmEx-!}Tx5}=qalTazCFT3%xq4660>J{E=Rv& z+2n-i4hJJF*?4f1i-n~{Mgj^**`U@HvW4IXHrrw>Qh~;UPqNKF=`EwfpG7@rj*1M2 zFCuR;SEdDjzX$c^#kOY9B{s6hkN+fN^dYes)iuKjHC(^(GSTVo-0*sV@WJS`<$ET< zH>A7f;33T9#iwYN{78Jn{!utX%c=9WDW~OUp98$_LySlgH=%rzr}At&!>R{(&DK|R zilnc)JN#B9XnL5$39%0D%QO*IdA_cjU2uyuqlM{umUmGC!OoL>_>C7Z#N{{Aj*21o z!M0tYg-w>w?_C6Y?1MOd&8Oxi9M-)bu#>(>&WYB88M@IakAWi2FtJ2AEM!UF-cvc7 zEDkPPF8@oH#XjSa#W$omGY|J1LO)ZO@a=WulN!U%JY}Jg_kK7MJBbgY0iT|x&g2?> zo>q{{p%PvpRZgJ&J|?T<^v4IBHQu?ORriM$mRwN#h$L)6gNlLdqn;s>%$^n~nlRZfpbNrY4SyDzlrXFG zl+)w%j$maml5j*lo?XT_6H1YMZPpEfcf1l2m!A=3E)JhJCA`El#u+l^5xo}3ek^Ab zSW0^?d(G(1Qgp4Yl1Tr{d7bx0(zv$QR?4N3p#}AceB?b~Km{h`yo`|lrH)3#;Kh)& z2&v}bi$mh)_EsYz6t-%YrjF=G(1t1z!SS48YMkD4B&Ug@l(W-Gv;kW;Dfq`)_hVFn z5xxBP8zFH*6KzD#rj0>u`#_=ax7uI|i<=*d$2I`%WF9ZmL{?+RQS($It;amJU;E#- z28t)Z;ph7+BdKZh=fBiKyh9yhwAPJQh736YdL)dglCVo-rm`Ks#G6a>Ch`6H<(+3> zZR4VOz$1pcJ>`>sp7#=lJC6S;p@3gqB^AQoc?<@5JoCLfUpz@k3WNX-mw)4?5%&3h z*q2AE1BN}<-<17>Z0eAf&JQ^#OdIR2H)QwGmo$LYo(7S{J-Wm z_PBL;?JvkLX#Rs+nLW35ptILT&&sS)Q5Ou<{xA-Dy12R+koh{4!{ z*Ds%Vv~;8rtrragAF%H^`9wNjM}||N*9#b$b447wXovMgByR5t|2DdzAN1XsSXA5$ zOjMprWTg-Zq2OqBG>8I;jz81;vhH*5qfpdmozf?(qa;8jI}9KUR;fgHMw|o*zdJv&0ta zAtt@GY|~hPO9O(LWZopY(ooCIy=`FZ4aOMBZHe?fxwi)6w$huRq>3ZjHy6tYeU-@pV-x>E{W>I(`_{;E2MBN zJH*$=f74{X>CX5^+bDT!}@E`9X>m{rQJ$xy{NMgZb$?i;o@x z09)3qkL0rs%okb)kisX-YM_sZZzAKQvKt#4WXAbqy_P~kQ~@9luC^6=w|4X7<$h6k zf(`2WZ2;0cMo!2KZ3C+M*pK#Z*>(1gn>fU9Bx9P^Z9I_jM47MOhx68$8($q*AXBpI zmfzF+>SBEUlxB3GP#vN)APPsy#Sf^IA~{NnuTsw9zx*0u`~VVy+LX*b&64FZA9=Qp zu}jop{A-}FLf7`>fWSM^R1f$&!4v>ggZk~n1pwi~DjFUtvG5$4JBQhMpmxyyV`0>+ zZBlS>n_VUXFB&!Mp~Hy(h@6gaBa5esA@8jfp%^&{hNGOZu&AUl6CtoVGvsXu22sXA zjZ=HYqR%Gi0GJcHslh^nofBZ=j=53HLaG%NjlX?)WU>C|y>R1eA95TmLe&O{caB?d z_rQB@r+G~P7~ImRSz?580WX{lt96Qf`Jbq3mBr$HcAnFD`$DZWMST&6Tq59k?g$!! z)WJH;B84u0t>jNO&+p1cKK9wWM z^o^M;b?uA|a0f^xSdG1-Y0u#)#3-WCzhue7PqM0#4r(SzRjq!;A?19JL9}w=F#OeV}S_oK=tR%_6fJ z-)H#zt{QmVqGH2wVi}lm0ERLM02C$60=}hGBItf zAbW-})<#z=cc$m5dv^Igb~H*Mb?_%Ovu&Z?LEmx>pmEFfzQEFw(m?ZLj`_n6ZT-HY755DxU@2p5%2UXetc;g@%be64_-;kHo z-u>zFd3-Pf50TBB&=m&-Q}3vKT$)y|Qz||sF0Vya(zdMiJPKxD8+F<$2&pA}M zYAOrDv;46K@C^ayD`Exvqh7ziqcvomHu+p~$C$=%8$a`dhfxx9xw~K>Ei#XFu^^h3 zfR=PRqRus|7eneLHz-J%Pq-M#zOkwC1oO2aeYRFvtSX*_^m~e-BwMjVRy#hpV5p5X z@g%RDd6p{Z*hX&w4|Hp456(Sk^Jl1+50G)!j_r42(|bO`inraf*dcJ`*XOU;)@hU7 zu$AX()#Z_YT|+_)Q7{a?H4&+t{Y}5?^Hj5>;4vY&J_kznsz;tvgSKgg7%FWOf3diD zDR~i{x(jXZ7Ge#{JV@B4jyp#1uN3G+uFD0q{p^sASTXDXiuu09l*G`9IS{v-^S5S@ z!3l-ep|#Z5jycy?hB@($Xi%@a@>ieFaiUr)#lkOk6eU)sB~(LqT#p+b=0634LT*Pw z2tlo$yL{jW@3^(W@g#x1+@J zoa@{cR~G9=|1odGT+xb5OG2q+r=^ak=+=GI5_8|VvIxeD-g11V6PUdv?zxEmd&2M_ z*m-xc?8`6gXV1>g-s*S8W*%@TTxC%CFoEt0xa4!Km%pIu`K#Co*!)}jUf?95?!IN- zD?=G>^Of(#)-VnUdd@6D*0=xBT@_tx%w(<-M+CmojXQk|QotD7bmO6S+^ZJXUl)hV zf6@0h55Hoa`qD1C9oOEhvRr8FpI;ZDU)3%WyLfnatfsjimoll61^!pU(03V(zO;lX z6EbgOB;_r&t=~=o_ujd4vc=jDzYfx`7i@R?8^9o(kXFIxGQjPBndnZSXdj1gGp}n0 z5)+9l^?^T_Tf0aWm&lRE9U~n1*hTs{l%ZRI<5_g(GGw891fN9(RJDsm4H(2W=C4IGl{cQ68>^ zzzU_CKWflAg-MfqOEJ+d#Sd#tK%;!0C|VxNo({z$o1?Vn&*fT^0l5}7OOjAGa#6(+ z8>jt{yo7i{>+aE~P(P)J41``_-4-Ki^}T>qjD&ifk*)Kz z>iA^Eo1!M51-Vy169E^FhZ0A-4+1pGHat3fz#|37@bAgkvcX) z|Ib`YD^nX|yP(W5EQSv2g#p1ojj!TvSF>bD$UXF%&W^m znMO#Ms>R}SndNhU=q7>`zuK*no(ImP&B5#<)rh;I!SFNQj5ylmpx>%eU@|arlt-D1 zvs!rSg@M}?DQwNFHTV!}|B2g{GxYq213<4)Wp;?IEdj~J_1zYEV;h*#f0ChuwzX5e zNuDZmu(?57HtYvXwlWQ7 zrkEs7G1Mv#(ENtq==)N!OxWyfcqFyckvRAhyF)itZ!+}=CE;&?Hwwkm_v-DM{AwdE zIMOO_rlI1@t-OATF6JE>iR|X;4Hag{jN}Z zQMkQ%#6LSg;BEbAy(wQ2IH$w*p!;kJ^PoA?h>wbX-64kvy&{eS>b&C|M#in!2m>>pkca_6a%OATqAJnRV4!|cQD66JFReCrkrS=3%f@+xPftS zcY?zG{hPkpXmD{1>$Pa2gvgV^J}1$YDkN(Q_O|}$lgx{tq{G*7?Mxz-HT&5zGCI&F zmpWy)pos!iPpvKexndf^uwHvL;=A>}O!vG_%tW6*y`A0Ug=!CUkwrdF3#Dz>B>mzX zkd86MGvb-C)&>aQrLzEyNDKiwhqo?t5R6a>uYvIZCYSi9zrsfv)9#2d#Zbye9rQtK zbGJ+9QWnd`<2!s4_{*zAcE&)y^ne&gV>6=t zp4}6?Y_3 zf<1}Va9Y6g#c}n;#-O-~Xku$}(7I4!J`A3MTm19A|9xP^J7%mW!PYdPbIC zqKSpz?QeHq)$NESF*AtKLm%JnBcNX}(KdHYVKNe0iKvC}=_mXzo|I*e%GL{drXw-C za%=VhF?+_F?nj2Hw0DPO6)O&*6E(D1C@B$K9!)BqFgR1icVS~Ry>#LBZYskU?APsK zE~3Gec@OSQBm2s7z6-4u9%1NDW1@`fzYJj#9W#~V^4=b)li=23o5dI*nDJ%!6f5gW zONvK}Sv!UKpW4aIg6CH34dqf;a!({KU`(Cy>0-#uSW6(ua_CCosJ*(fbqp(W?37y- z8#$sqqgJ2a+t^`>V3zTVl>Xbzlg3&cbHl4_NPAi0h$0r7)g-@*w;6#k?Dht!syuRg zS}&>nv@bcv@BlnWJc>irDyF3L2P#LO+?I9WCKMbb0eVf+;c7xgeQZCM!+%6`?6f%= zP+qfd%pzA~>7L3M%N&t%;!3jtXGFWxvd5FXWe*a`G9$3na`odcmNZt|5!qfG>SjnD z6a<9PRNSB%{83W5DfR(TT2joNZtg8W6&Dv=iY%zcyoF_6In#b>L!T}UPjAWXX+J@8 z1RmHhoCTFtywUSIWPV*0qD;$5HS~Afuse)c;tqpY2%6`~=>!;Q7IOzubllXAV_H_3xu)>MLd0D{GT+n#=GA&{1pP~mC?@9lS zoVafeKSEnGuATjB0MEA1?*n{j!0#V##PM$cn%+O_KmBy1wBs5jFA^R&eHlnxV-bSy z^^GxJW$3l;VYPn~Tcp)oGso#lL(8@s`w)nOQ582!Z4TFs=msV0F#1(kh$e-@2y?8m zz!MbOHUk`RM0S(eeL1ug*j%X;irAnm(fx%q!q)F8EToms!3ue`*+6ZmiwbODM=Td+?FAU^em`-;wN>9r|zZ6NA9wi=G0i?qodCYwJ7nF$zb_nKs?*r#s9S*!)1;MDgV7}z|A)Nv0~$U z%~X;*0n}>Sz|~MOAh_Me&T$?>e!HFOKqLe7BEtgcZrw02=C2yG zJ!2VCUdQnyuL>Vq!X!qr0ucqEMIt-R>G{b)#O8p250QgQ;=F}t9~e|ggZcJVg^?ng znhocUdVMJViv||CdGORPE3Cqjuv{HmMa@WA9b^RK{RwWhJYN~C_Jvrt5^9VMYggbu z`bG+CFvg3Lo~X9(5?=-Z2H^=Hs7@tnhhF@V2g6FW_c@d$wSjY@BPeO^Je5uiRDwxM zB#eYB!rnj?@paazOWZlQ3GZS!kOD85jSrQXzNVW(qC!<*o1$PYgf8VwD2{X<=C%7^ z@u-dn?~i81d^^*18bGblT$aay*wV0tXpm37HRFH5GK}e3BnT5L2+Sp4VDAQ~ESYbAuYc3JSpJUqL|dmjt@YS?8zKd?lwt1}_Ag)dDAZvfX5UaNXm<4^ zE5-TkKF`J|BcU)KpO1jj4dGeEQ7fn>i=|X@UB#U?XK@IoId{_4D4PBV2|t@6)MaT} z0N?WLw+~sTSkba!y9SiYFbgSMz}N|JXr%QO*L|j0nBD0~GqW4!D6Xw~Uw0_yu>B14 zqg5)!OB=i=fq`hPC~s`JH0GEd#okvNihJjDlSiVce)|4~?l2OC8} zfakgWNL%>Pbei!ZVkF#f}YI{od!gA=MdJWCpcg(G`1UBZ5)+c`^9jd|;r; zJud`+bNZ{r=l}()Q3V;W$aU~K4C4pY;RS2P1URl(Mw-x}14A3*RKgBauLPsX``6C( z6Elt|@p?*!CpF$shZ}$0xq7I0)UT@`nT08|{x;~eL_xQ7G=0WF$R#@BgB)arqBpE6 zhxdTP$$0%+ELhi3zFrYvJmSzC_+51MM(y&d2Qz}SiU~U%HpxzGJwWHkCG^bZ!}%FX z7vE($RZdLxww>#b9uqdWam2iu5~?aVS%X0~EyGxBR~#1Eibh;kxYGt$msA~ULo(jb z{k1P;MK3=GHP*zDnc%)CCcBU+C#wqwRZ2`tWJNMtMvjtUDDnx^i4c|gQl{d})7D$H zXUEG-PhDj-*<@0-@rfr0l`*6Ik9h5(l&vDtZN`AtFW`BpUx~}B+L@LGe;K8p@)>3H zfz9D|$99RyGtUvfgjIJ#+1pulG>*uAIb#wj8*HV0SZCXnHCt+#XrAr(jD^9y=9q+u z!;?{(V+O@)WD2+wV2Osnr7*`iuvtDNwUdHYo+naM7KlGk z>o284q&F2Gu@#TyZSs}KA)0v9fp&CY(?H?Ls7cvU(5BH6Zz4frt+=Xn53w#1I^T$$ zy4_A9Aa8SfEie7}uP@hc=I$QE2Ib(n!f0!X0)i7OyyUwiPH#QxIz~d25VQZ-h)H_- zsW*Hvs`==zM2VHywQQ*VmBcVR_8ZnG3OfQe4(9k_h_f+ADX*zn;|0xk&zxR~DuY~T zmG|0-98>>#rhi{lwu(u?6JsjCJS@HaO9ZZ;G;C0#^ZlM5{2a-7at4L*G?7F$9{k?^ z0GOqu4e{MMHXNYT3@D%X1GSiif7g=CuqmJOm{;lbp*+uKHZPEJ*2+qb!Pcii&yvUf|Nmv{l{Yc9kmcoo(&Dt+|{pn zo^88-uPg!|l#{u|(5^Zz;Xb8g6ysb>D8X;%IR=Ge(2w`wu(@l~@)bJBkoF%Xea>_5;B)D$8r-?3>t+4m}h{xhNbYF}$T z{P+0pakTVCLF6E6)HAJ*H<9A$nBvAOumeQ7RC#}QE95Wn1NrUn+gohV`gW#tQpo*u z2&NnjGY+y1TP`STqn=It$^b& z9w5D#bVEaLd=nYs{r74l=n*>l;^^VpqF6fc%-v!*pxCA5)x%}8OV^ui@z1O6Ui)}$ z8$sV)*SZr}RF7}ZrZ-zcZdy(-rH?Uvce3pR`Jgh73jt&Ns%!LP5!dy_kh{f`w&@@u z$D9p-drCrY6f}i!q!_PE=eZ`Lc=8(tsd#=Q z@?8Ef$T~}m`>nV4%yi2s=YmPm(5xlz{8J}I^H%7^Knx&yeVJtv(#F?Z?sL$!(5m7n zk(Z(<`_pW%*mmNxiw8@F7lrF8Pa_B@be+R(w8tDm-g@?hQ}{bqi)%8U3Y{=^Z&~Hc z6dqzLFon{p%Be}k#xatVu*K;+1s%xIrrvct%Td8Ik;N*OfEQzO)~sWY4*h}H2sPi3 z*)1izyd`5w9DIa8V(2SgoLSjwf3w}CV<*M-rV}tJsWMR*w#;I4z$Vix{N63G3A~fW zG@fO=6ln_QF4gi=mTwj>TSL0f-ynhej0rDE!}-?WoA^oZq~NT;(8!-YZV=Rj5tHT1 z7);$+7FD+Qbsg!g}{5^eOMUkc=LkYJwyW__uVWEG94nfqfJsHxSD|I zxFkiK>Xii3GhBoqx6n?2w`r>pFM+9;_|S|9>^dU`>j-ztZR+7?+2Sp{M42BFHk@)+y-C1>BCBz8h=?9M&`#CdG05gaV1@mrPBqHFL(dD?M& z410Mb%86FBp2a&&4qpeqE=@jl&~0kUy9+Um`KXIdP%#Qb^l6_WK~lM54^vsB3Rsau z+E8V_A|~U*_i%SGj-<{eF_ZSS%Wdt6k#tx*|DGvqFaZqa`N9=RIBK0$A-z6Zh3g=# zMzu7U*|IE7&dwjvumyZGWuzZna%HF&5g-H3yTr-p*vc;we?J^m%dy5ypMLbdEu%ND zZJPEKQCwOm$dP!er79!mY;cZ62|Cg(s_qnj(ww8Y`XrX!Qg?RL`*55}T>fY?t*LyU zQZd7yM3yrW^=78Anw{FTpb7PhA;t5dxEpO?y&D{>QH&I5eZ`Ktb;*I zHj34oU`CXhNUw>9>L`q(&bz;;LUxK!uoAcv3GH+%k6#4Cy5Mdo@?rrweG#EgUK<*P zFi=U``G$3z1o?SInC+bSu0T9d?%~w#g05_KaYV6z!tx^t>_-PeRu;M}VY5QsF~0H@ zx9zSvBGuDP^w@9+rxDu|SRz@mJuL)Zb1tRJ1DfiQAL{jyV^PFf`~vwcY{BH4(C9^`2H+PUJrd;i( z3iH0!h35?kyig%Wa^YnK3jD{cp+Y$~Q7l7}{KnAv*F?p(pgiN9z*pL@mqPb(5}|nV zKm{%(5}*o(gGXZEz%95(%sUjfPjQ_Bi$YE;dfo{zi>9#8ROjNdG7mj>+TE0waw(-m1Fof zk99>N`yJ#+RmZ3$I0nX#`f5+4$TL8CY~-O7BMJMBL((Lit@kGmw%t(_?DsP3w+GacGgC zh=~*W$Pd1l;!!~Q7iT;iVzosb%1kwOKDsl&(!p$ri~ge_rY*n&uw=OpO^}+Cnzt?j zGCr4wcIf6s6m@sXvcupUCH970rLxIp~*jWtf^>7t*BW4!}qPq?laUYL@sk z5RZp5gCa&&%tvXiu;UX=R3EsT)m#Ew_{Zv9858 zvAVbKT&H&-AfhF|N$jnb$XUW8$9mRq&ArtVIyj^Xk$oHMrZoZ}*Y!E3Wm#{mq*lEb z2D2~~_X)~PdW3yneiMJ2K3PwHTHB=k@i;gTO$rFb;el30vzL38?*L8#QRJ{MaY30( zjVsY<@cI>l7F79!QtuaIy)+x6eN<(@#dq)RY_BSS`~)ZvA420%hY6N^2#Ma7`xoS2 zT`!knXfe*yiFvSunVr~k_}M0y)cCWcga>HvS80FljW)Wr0?V!cnWpD#bNkBQHUd#Q z9`Oyrd;jGt|0a*U)Tc(k>y4dzzrpe>97Y4jo{QE7se|u&gig+X+`NfD=kIv)m*>8= zCsXS7YhSMT;hs0?f&Yud<3*{HOJK5tcl7zPw`)b|?yLcjAmVi(N&BPt%l+Chi+ZC~ zU@Qcfyq|4Lv^CBxz-H~4`FZ`+(KW3mE8ug|NAXm{bE9}c8*VtNenj{0I0-0@C-mHKR&n%Lg& zq?P|IWR=&g2lq#IHVe?#pzMH5^zh#9hFiT@!ZWCJ+rK1hXr0pz%-|g5X?UFakD51* ze}xd1679>%u>+T0f5?BWE2J5f(qQ#ZvFx5Rw%tfqdI_qLSX^zJtWvE@O~w$fi#;** z`vFv&EH~L;CpL`2RBSqys}Mf(?Vn4tSRO6&SeeEoSc%lUeh^D|CAiwa#?~)5RnXp>R}O24bbwi20JpfFU1QQKV4 zc!YPbbow+_vbI3sjXX=V?+p@U{YOh>8I0$s8&B; zTTTO>sE4;v#7Tn6eFlD33L+GJ{jTT!$vTne0~ApZvXee+uNsp1W%Q-EY);pKW-}`$ zhc`DCk?^+`H|+jew>hK=eQ|RlW>mnGyE96JEl4ZTKw3#Fw*>2}-5Dn=hs9U`r)u#N zU_57D39)Nk3QjS?U?m_Ejboq-4G442>sA9(s!r~>uP3JsGTA4As#t4&l5mcyr}F+a zYd5+nCFnG7tke`LN{KBj7+J-s4d z&m}Lzhp*J!DpxE%YnOhb0-^w2`3LB^wrWKspgXzHxTnPsbik9IO>O7w*qTEcqI!*K zfTY^X?IxzQ2G$={x8qhNDU~*Fp>a_{OU=pr+uTflY&XYmq*2xUnn!YI8#R; z_R8-s8V+2l7cE`D>3}0 zwgu>zHmS%1Ru3Tp+4BzQVvFO@S0{uK4JV~IyF#F27DbLH8rAG5zXsMZEoIA6MNY-n zkLX!Ykmg>^qkQ`&GvJ<1>KVEcSKw2RIU&sE30pUJ9pbq# zjkect22)Hzh|ef~{N-?0Vs?x61{HrSs<=E65ul4ID0x5m|2=uv>?8)lcACs{5K~>> zxEi(a;CdNQ^OxpfdsqU?>~pXDsi0O-Ll&&US|U6|=F|BlKfILnm4!;*)XQg%RQ9NFl@Gv?qo6*k*m)5-}q*xXU#$8orIZ^5D2sXNx434zJrC!Sb%w84_lP@ zLEtUzLZzS)hFyrMp3;-i8GvNSqH>m=K+Y(+*ZCU@F#BaODzO^LJ9wfeMT88Q{)ltoj7W2AOs~_fOA;k+ zDNo`B%;6kTOBc97v$HzI8%FIhBjbw<+hkYzE5 z9r%-dHs&DlKJ=Qv&58QDoPSp5hdmShtc205gvXS4hrB(@846}k4nY#8lA)If$79qc zS8$^Bzx~J6+<&>C*L5q1Cb!&*;~D$)cBt(HZ053kxXv98OMd7L4AnhE~BKS$!E=7-Pmv^uqSFZ4Zt z&prSVphX5fr}qacA9tlLtO_mHT3N_loTPo+kh~$28QWN9+U~)Y7|1KOftR)qx=&LY z4+9Bl93yL#HxJXT3@%)VfhA!z)oblX{?HT=lD42ZUD-h&&FB8NsV|bD-}Nik=9?Fr z-7!W*?ia=$vYr}Sy^hv!Os|mxPFVtpfi^dE(6>UVv!DDR_;XCGvg4LL;NRzffBCZ^ z&)80vQ30-yU9rma^%A9&?CU?<96p0@ ziF$Stw%Hhy&(==6690zcs2SH`p~N!A4N}TrJXS3VP-m1VER&d9fLR=`n8;X>V*w3O zD*?Dvv$88(SUEUxhCP^xk>=M=WL|CHzOGLCVj=Vpt)DeXxlBRW%WcqQ4g`twKH?W> z7e%zr?h}R6*D&@6=GhKKC zx$TUy&SNpJ%%~J(uz|X}WsgkG<{y0;M7pppY+lbO=7JI4va9&DSg~D4Pq1Lz+rbwj zyrI}}5tc|&D~bJ_NaIvXu;yEV+#(#O3we8U1I{ErfGPv9gFtryo&S7guz#Bau!^}#>B1K2_DYo?M>lp*Ul1$X2wvSwx8eI*ruDJhJp$$d}Ak;%)0km0Aifrs*J zDCb@&6SAcKgKucQAUU1+=eM4Q{o8C@K1vBR?|1ruEbo|LfC4f`P2yBQLOE|N9ZA6m zEQmN1!L$*KZqxX+E>rQxumOt4pyw5fiThoxKFnG>j1()|qbaZ&mfB}P%9er+M8T`( zKfn9!_3)Q+E|5S1$+OF`o+^|+MQ<<`fo+tc8~X=3(3gXWN%GcZPkQ~{0;e3MEENaf zG?aZtdmF8-lAJb>1QMXff!ep^oh_-`>W zsqNlzs`imh7TAK{n65M|?LH*9LV4~2j}o946Lxq z+@Dj8uvDlTNlYPAW`Gt03*T){0b4JAlM}EWFVn-B@`#Oe?S5g|DD3vt zHLI2Iwtf$OZ8uN;4HLYh!%8l4d55h8k>Q9Uv@`H`n)@fWH6gAs^wmPktR8p#g9J_1 ze}Ew;Y#LQ@-zjtxy4}shC0roukU?d%-N6f3So;Iu!Au28GpmbUN9N6(fFu9RT~}AI zgKoh?LN(P5@v1Ywj8K7SLIB$7k~L0{BEwyQRKN@IsaT-(CHSc}*-QSL9?+!*oY(+` z-D{~GgW9f0p8@!DWsK7#-8kgq1gUQg*RQ`Dwlk{YH0GfKDYQY?AeTO<@) z4Y{tg_UILPDQZI$XR{PMK62Qa?gFJ#=>5o)A{%&}z4+@=~Nf z1f{#=CQ^iRV-k=AI?}{#fgq?7?hNa448~~iLrM6{vmPnVyZBe zc+NW7)YwqH0I?0%AVI_gr6F?YMTRjQnVQphYv!G9usAlrP*taf2Txg?7KPxGP4A&W zo^lrBpi+9@k*y8aZ!b7#?Ao4Ih<()OdRre5N^sO$ zht?cprKx?W^qD&lM+Q9S`J{FUVtR${zlit zZLKyO++S%M;~#KYEq>5DEw*2ZDj5GBf)phTv~$S)XKql<=EvqhU7+Z99JnT2*svD| z=NVWx*HgnblTO__HcRHCXBNx1r>Z1og2HXwP`=9mE9y%f?5ORpB2YTaI(>6dkcp6w z1(*$v72~D{H`%1_NvVN!$vTwapA$9V+W|26E|=pFh%b+vRI6iT&6{Wm&r&6|j~joj z4nh)~>f1M)>+7yO>%M%;471e1{Fu{^)gzq8?trR_>Nt;YZdb*MP0R8+1UYtSVnHmH zB%_4MV^08ZIyNA0kKqoA6n=AHbnSM==+9LN87~4I)maJ<2?70W7UdRXrJ3uJ;+UnF zbrpMI+xanF+IWSr7(uvFg+S=(f;#3EP(f%f>)@HQE#Fb2z-|n~XLoBOgsXH`^A;I! zX*Wcxi7Zmg<&Yo%RFj5y{&kf7()>#{YrUH>=@eu{(u1_K^J@nK^eg%4EO_2iff(?n2{-$~CuDNV6fP^os#Lz~2s;RbpnWLCQ^* zN2pc!Q|Bt}&7j_f^3 z)|q?RcD8(H-q{-h5>pFUB9o0NYyOD6HOMK-H+g~DDQ}zAoO`OnAWtByaojNdvU!5; zSQZ^e7%GP)eK2Mlx8*=T6gN3|q<2#rGMzCEVK{r-ur#x&`+TT4&8hKf{U(3=y57(v z+@F1QVr+hM#}d%*F9k#xCBG9!+O-?K^f?{;HSp^?#pLC);~B-(xl3yHVRjHxIdZBYe_Elv$6fMX_YhDE&b>*` zmC+)-KK~;1%bNezL{dF6Fgt=gOeUi5qm%N2G$i-RzI^8OI$*r%3zs~n|DTXMdOSQ@ zd3?C@-o3pj+`i_Lr@O&GV}>Wch$ft6s!>>Y3;~mriqNQBLOg4(XHB1k0JDzJ@%JCM z8nn+u8)^>k7@+{Z{IFQKOF;B^^r|v3v*1({7`A4 z8jaB!To-&L*~{&u$oF-?7|EbQZ*VdsIzs1X#(s!v9XJdNmM9yA8AWi5|Do!e2#L`Y z0)IG}qV06vD9aSUz9_%&)@B}sMODyNiRl2jlYwg}GngbUO%fIXt3#G&4dJwL?R-`Xd ztS7TO=qhK-Uwc1EsHuT{fC+dR4p{lcaq%kNiS+eW6J_MC+Pq!6{X-H$PmO!DxC}(x zNqzQpnJi+z5t_M?-}%E1aW#d3SeGJSb_rILIA9F5Y-LCQ;9HR$bDxAwc+z%wk%qg{ zFel|xyC^bIDzdop^IV$eESrC}uccT}2^=o|2;rlesYpnUBNIe{pZ%iQvyKCD&4%>` zJnkDlQ8i^mF#2xI^`&;4|3VM5`aW@d(L^G$M3z)lDQPfJYBY&&U|FSj5l zPugba8wp3?1xDQ<5JqYjuGZL~U=m7@%>@?O1ezjdPXZ1SeSGe}!Bah*l5^ag8-2+L zg1{Zh$|Niuxb%zRI9;UM3Pg4(kE!!3!06R)2V~1km<9_v!ha*BMrU=JlbL0_2AXqA z4qP`KV}Ye-A5AZ+@q4mssAEQN&Ii6Y9jk*oqCF28R8}V-S(4M@i;jxjY7!}opKi5c z4K>!RTdMCtYHC`L!$7(=YED_*Y;S{FPF)x4_5Cb%UW{!6n znYBvM#mU|u9^KO%K0Y2v)$H9p9z6woyf(e#u5A0dORkJ$n33mfgo{Epu$~6Nt`W%T z;^m$@ARvnp@7uHqZ`gBv*rn9_&h&WpwD!Z-YUbg5Qe$=brqQ(EX~p$_`NSb&!20|| zoN1Ze)3=FF$#Hepp)h%A;3^*9D+|buucbDK#g6{>pX9po%Zw`TB@MM+HNwd(zAra$ zB?+$;@FFmKc%ilygTR9)XY&n64Y>3_&K2B7%l|5L?(M6N{U6S0!zmQ@Dg>y zh=4RaP{d~jXTHjCO%jd*0nK*ShKb*!3M}3y7H>FyDCLc10IJAHDL*Vm)OxEN(AEi{BG%Hw$Y4{ z;{w!60oycT=G~uaNsL9_CTEZyZ-_WhSC~j3rb*M?eSA87b?GA6w(`C@=p~V)jSFz$ zTOXYHB{O#W)^~b(Nt41bW49i~Eb4!{x;76C`680AP-F$zMyU2Ki2Y|)yZZ38tT3xI z&A#BqCjUXsq!!`iioy*~TH^=wROYW7Os+D6(TNZlYqwyZ+uNt1rA)NFjOlyb9t=#2uvs#R#S{t3b09( z%cD4C)N#3*B6KwS>`CN?gXr?jM=LgK?D)^$zIgm)mGw_t-!V8mn=H`?js~S2?pQUz`hE`KWBgIL z_Zq<4mN*?BJucF&83;k_ljue7;Q?ODB+YW1vlO~$PPoAQ&+rpb8-`8ma*K1-@{!2c zym|Y(LQYoY%~MHkD~U)&qWKTiho2wBlp;RT(WS7SmC@6cI8))85Nt~jIiM!21rFT7 zA0FYGZbU<&1+N*$6OGA3jFbDb)(OX03f45d)lQczs|_re4F5$b{#PL2wFF?Uwv_Sf zWTno*7~13xJw-#{#H63ni1ab^TC&#g?X$+KoH1Ucp7C{WaZuioTpW51wd>0w`{DOz zfb^qN3#}7=I~|NfhV+WD=UwNrIpa)bi9Iha(4i!6n5vi@(rMiwGsXk6V`W~(?IBbu zWJ_kx>OIW% zN93}@m^!OZ4j<9m0*?qrqed=rT{4+&&_4?1t+*m1mX$Zs`hwd97_?Y9_DQF$`36Ff zUx&{)I~+ux)KA2Q)?VVGK(5lwSqMbj8K>Xva!`H#y_GX?BA~9C(K=O0#QEi-4`=)k zMQo8x(P~Cm1d4y0t>%gvX+ftyjmEM;FX#1M1PC5R6Cz&)_76MssMBv;GNID?&_rRS zQ^T&6v8os2wJ;WhHo~M&7|k>v+&Dv7Ti61^7Z|px#gadTxq2Gn(9`|WX3n>P)aP?= z{&o*BpZR^H^FjR`H+#pA9YadIzRsOZZyb3cisJ``U8Dl%A7xuYA8mkHESJKefr@P! zWB#D5=(+}gtI*Z$r1JacgUF{HG6|9K1D%v@XUV-IEgfe6w*0S6w3YPN2AU^!OI-lg zZ$@J`k+j}LdQ|3yQpJL*{(iop;t;VMT}+9|UVkg45BZ;Ll7gDJG{vK~nq(ry@*)U( zuS)-9pUK{8V&agHh+1cRCCklwXeu+PkhtNsZ6ra@;zyC{;#!6VcCgVN9Z}!CiI~!v z8E9HEaIg#sJ`Wc@926&~?-XcO#3dq*h-dV5qdaNzRN)LJ%w~*JHNDLipg^y43g3K> zRxX%JL3orvEXU|BKM3A1SlbpF+`w?Ph;%3CH&nh1ivv7KH~X}!cR!x)EH%V0XDz)i z=LiTXBP~6w{6AeN8Q(CrXlBLQAbKF#C3BHG0HlE6IL?a@a@D?kXS!k=uw@H9;f&*_ zfC8wkz=&32k+Gd7Axs&$rP>&i3<}YlG3w-a$&0TVt3ywh1OIbK6*nr-`jbA_;m}xy zHO_NAUdKOyK`=(~+nqx1<-4WuG5CuaBq=57n){WZAHNZy)Uc&5Xs| z!FuVhftFg0F$^RS8_Razl>Ka|ii}S0?-eIF*3?9B(^;p>IMz#myleayj~swNvxsdo zOe%sbCqtJ|$A1G8Ma{Fh%d(l3P_}b!2z$UX`fL%2V8JVjL;uzFLT(3fHqL1`R1I$; zC8b*1Sg9=R74~-+B@Sw1qe2-4**o7&=B49tT}>GgW$y?rf-14#HCZOZ0j2(`?w@7L z)QX821|*bA+UKU6%0S$&H!vX>ejfM96QYQB`*Y+d1%YSqgTW&2J# za$0W#S9*KBHP&+Tlpt+-^47ya^9!UmbYgmAq0UYpI7uh2bU>xN8{F20Mh*u4dAt<9 za}Bzu@?6bMRXPOI#B3`TesDpmfnH#@tvTI%Ht4R+CFG(%2-M_Ej z==KY0$w{zw54i3{6LjzkA#}MIW)qly)EG7YA)#H;zMvvlwX%{}uJ!QGK{9VJ2;?%FtP_641;7CM z?Yl=RmjI4{MSWRbU4PQ2!|&Fxb;PVOs+FbQZo8fna4zephYLE(&$wuse37>$-uYa- zIs_nJ(AcALSFvLQ#E;&(EX=Ysi2+%*=u-}$gf~7ZtUAffO37oDpW}pM= z;1N_Tz_I(!gI11#a3zsApt zsyaOUqJQ}!9y z5BPt?A;*NEB7=B7x-o7BwJ+r*!r*v|MNc5(qvf%0NIfzVqk;X9f zgp!?CBwX5JlZb0D`wDkT1J#C~4*_8sOoy%;Flc`sQ|E#i<{gNE<1`bi39r3ID^L;c z6J#Lh6kB;BD-`LM8GY=sE5xp?3MV)V?US~b{A<-W6w9I0HIl4WN?`#ztHzxI>Qz|f z(F~YoKWjoFmt^huc*CXz{ywRe33{U^p}4TjAqKQ&E>5^vP>Coa2I;ksExyLX!M4=~ zDX7;RZhQ0bpwu29*ro%E{i4dgy|Wtl~!eNibHXlO{2<;~$2??vJo5g?(BaK|5xcBgJd$eYcs zk57G&N^EArelkE{o@i`|--*h`5Rtd8A|r`ve?h z{viKxuJR+qtK%&Dcxm0~Kff1@sli)K;bAuPDDi>J&E6UwK|Y)!-~NGdj%Uf&`WfQI zgD_}6Vgi{t;(&vh05Twfr(co9=Zc7=&$)H8f`$`H3bryEI?NuRyJize_C9>NoE5=V zwm2_)AGKN?U@R-9xsIt^4|UWrNeOp8D!`D@c8+l_T9GAL%G!BME&y3zwmcn zyDALiFDk!WK7UCNq_K3c?JZF^_B8zjnmIbUv|Mm7?K*h2p%FZc697f&c}IR97iavb z|7TBoJ^>w@Z#&SQ%bF!0{%HV`t!?HJ+o^VL#gg_8{9LTK)`daa`+Od9ALerV-e^dK z0@7~1dVr><-eIO{{r~{vor(_(NM7=Z19OSz7j$y4{CLphc|i3n?N$Z?_6Lri3HCtG z(76Ol@DG?%`@8k*z$c8-&OT3H?G*3;8$0?=lH}|DAMpE0fqctivkXQ^ao(!L>}~=! zyT6bolK%cNvW3j~OJ1Du;$OAh&=GLTjE=M^H+D?2LaJt1o{@Ab4W%8lSp}Rh9M~BA>VYe@MBrx;1%jxK z_-Sp)FFeq1a7OwSB?NavN_%!{WsSlq$H4$x*s|79h)A$pC@9`9S-NrSGixE?RGcUAzh#Pk|JT4 zLRnV;*>Cx0#zi)C*AWfZ_jfE{vawL|e<3TKYP8VuTu9_1Ok>!Us+sfUZ1#X44Z@2n zq3qcYDwWm;uCnGK^xE37rRy1E7SVj&PEzk&{copj``=z-D!LhU9IGT1HfkGUCx0;N1qJZPESX!?^Sqy*o{s{!1>D)WFN|G~;@puB+_z_rSi@mE=>tnCBxpNj~40m+UA9d8M!28C)Z9%_7 z;KpC*NV_aEpV-$j+lE0%$v~I)lV49hNw%8PT|1ZmnvQ%_nGNUxpaa1S z&6>-2V^G>~b_V#!iThk(gMt91714y+=55(**dWjN4#8JfxL`C1VWLaZYx2cz~p%GxStqH0z1w7|%zzkt)0kOMxXQYZPJ z7lvw?%YT1?U_QMXSDZ(90~1CVFp84&7VwDfpiN|CD~VL(H$n+-+4N8aX!k8~5t+KM z=AOn;FU4fk)(511FsXQILo1bu6r5L?f&qLRAg`MW6evAq6*`N)(-$*{qf#V^4zgq- zrjcuO{!h!QXovY!C#-FdFYbIvZ@&nb?hGecMv?Zt0RrfVG42|veS*4Nj`H4nY|Kv2 zMuyNDK}E-In8#S^X&sBTWAMJPT=RkNxqp0gG*?SSG`7|+c%k{`kDv`^7MC(!8iPen zxCn16g)mE=#M~DO7!lHU*Ng(O?#;GyR|p%+QnMWgZMS2&1n-=5b#zK5t7ZFM3pkvv zQ?45oDUy%y&sS|!RW*`%M*dD#w2#{mjv7iGP4>f!6fvn4Z}9?FyIhCA=t@a7)Z&QT z0_GGjC48Y46-+~*{1EFTLzZt zgLcBNRR+L8Vs}4bni(Kwy|k9d!QQx>yBe-5UP3-H8CWM!eoT1wR?}@s{Sf54!4Cv8 z`YNZz4>5IcPVQQSC5dc`ZwD)|GX}y0Q>W$}Tk$+uHI0(nMS|T(L&wkj;kVK?bJoT@ z->|=5V6!PG^#;5-Yf9OUKXLJln}3<1m=CzjYX9m?9iA`kJYc%8ZNrKM<|{cyo32zx zDJ@I985d8Fk^>^OTxz^RJNeZ4wM4y*p3pE;GtIgm*cjiItLlvYRq>alV?)fJ;VWD^Z>3Nbxo6E>A{PVrdZsyzteCr)tP!##YnoY^I z&!!-r_zx7@(vjLI(ag>X5f&3fNAtN&piJ$*yS+DqD^7wl~PN#j+;M zo%9WK17Zn_q+TL^7T<-L`GF zg?NZ!qA>SlSH{;YWZc|jS*T_SXZ^NiEsx~vb!J3zKaXe{z+y9A zun5T_kp)6o!X5O7D#)BTY$jWL*V}npH?JQU4^dUKE)jvwOGj2YDgvPH{fhOr=%ROp zYFTnG8`pElwiKldx9uyNNY7+RqNk0^EdqxniMStH#c}>EPBJ9oAo+u06L~9NtPUT9^%~b7Q+H zp=nv|LpZ_GfP~m|UD1);N}42-iTm~)YG1P*^O4l`O7Qh>+6S$+RXo#JueNoJEq`He zW=fYbymk}jHg&ss^zfdErNN_@Xp@K4&5&Nv%_)Fm`?&>GEC~o|#^^zkm9j6_hQ-ThFsigA!@^^dy z>3_bHna57cmrl=W0t5v=_YitNPn|kZ2v+{qJDeQl_-v(vzZ`GAuUKB+=XxS!e(P^2 zb>;E*@t8Jn`Sht}p5Ua|xl$h^*um=#=^cTS@I7VNL+;YSK+{Y|_x!V(+0OCfet7^q z4`tgr^-(7dPa9l8L~Q5XUFIA&thA&`psUm@aJ zB+D_dl3D+)K-&jMwm2XdXq)R#4jj5BVbQf*QmHzCj2mah(c8gZy%s47l|jqeabH7xP)Mt&+-FV*;6}6UrSZad;vH zg=yZF&5#8V0DNV`*K;%W7Ulv-LH%~;J)}roE%sWvDdm6+dRz1YF!w}l)&wC}Nlk-! zF0EQk8v)oOulk1@=J71Q4K_%-Un>Dh_@kNTKorf;+ zGp}aLW&k<9`w4H(;0gs%!@%Y;pQFgivIo=o!B)JwYUrZ`o2wZ_qGH0t1U9^77v%_T zB%sr+E1CW6zL^qb^16XgX(qWD$N+*)9-SneZZ2;kWS2oBCut65_QgQlG77UPva3#F z4j&Xj{|Y3QGxL(5lTI;(BliYH%yRVSTKE5?{_MzfIi7;EJKG@;N6S{~mdHVlWl8^0 zuTy<8TiJ(putOXBjgI_AHJHpOg1l5x7#TvBtF}A}W@oi$9#=fUEFi~rM+!Q%#jB$~ z_Gm7ZMny+P#0{Xg_7LfhsW%C$5iu4mISWfQgbNxATZ~JoaAln}%^qrzi_}27G8VP) z!%+@@9O14H_EDmt8*sKbL(y0$mdgZ%f6T6Td}ncWjxzC(?)+yH`n%cg-&etMt~(SW zx|r!IAN*2y2?O1cLGr0j?YsOV3_v1?e|Vy-%fFHsa&Ld_q($E3*3fkjO&#QApktjS z6%89AqDKK*da4hPPro;wgjKfi1W_afKN<a(^l0sOc#}*WeK2X zh(L9Va96jTR`QX}AQ@I|RGK(Ebs-Mio`|06*BM$m+Vl0SBT121BrO$)dX6bIymCav z9uoSuS0iY70xgN_+IlK>tc+j#cyWax_<-A0cxr>nqP%PFAC-s7UPF|nHBhnK>)EJ) zNqUzr?e5E5Y~?Z;BK|h<;c!RulY9nBX;bSvZeYj!wfhbUAWYdqKYxN_HI8{TJ$1Y> zcDxc6TQtjHRviVF4s{3c$zRz0tbnfV`NSXRY>{V{Rgz|ZWa!WHP3uTP{S}91opLN^ z?QB`9_~A=#QWV{EV8{vCV;Bw^eFY5iT(exhH+TBB%NiyK1|+`eXsjpqSWF^GBmf2h zcH2sY2D)gM0}R3bMcyQD9UTNkJ+Z%La#yTdC+6D^QkQVL0pzFx)^UN29U@scHg+5$ zl~Jk6s2srg_OT^P^mQqN677p}&z5TCq=SZhW2^O9iQ zR>VtxBAqI)U--}J!C63r`U5oy$t{vnM(1f$&2)m3=(cpUkwM0OSJ(`b#ONrBjYU1H zP2-EXR?8`UmyHjApET!B3JDU*t@f(vt?E>L!N)9SAr28TwqKEhSe_puFZm9OV=%c2o(`OM@oV7^1JS(tonQ)XOeV_I4?# zv5y-5TPC!l!Jy^6iM%yek1wpHM1e6Z!+N#-z^{e36K&YOrY!cJVB>3wiV_W;4U0Kv zkWYhw_oVgJ_-rPmPmvTB+2@AkK+-UoQ^55kKHb?%iX0Tv{Nb{;_Mv$K+hn(E5V^$e-Q=rf=XjvR^cb0L_}B2>m~>2w zd6f#YX`?i_x8&zCZ>m<@?g0_ib=MsXH(ezXC^~c4m8KB}THdD{DEmso0dIs@Fg#WD z-Bk{Q?bLo7{TDFuRm2KYg+0I7Fsi%8q3@`Qe0Q${p1=M;Z;pLdnv1l%th*@&dcs{m z6N)Ou%gQSnV4_o1U^GbK8sqjeW+9F#Ro<9-_yBeBhj>*9X&>iZ^0ila0THT@krT6@oFL zPSyH0Yl8_;C>aJU$;}-&)2{oSYdk zW=zm=!XO4U(i#Xv^P8=c3gwG97Jo`qE=!)&!|O+>?cW5o9B~QA#g+wCK}V?*%k~)s z>9287Voe4rq|88z;9r*d5!BpE&2pGc>})OM#(BH#tXLLLYmC^2V9| z?DQiopK?7>e)}eCGIJejdTn|F(9#3Lp*)0Xr5f&@Syz0hU=`HnNK2NKX%Go*@0`-$ zi*vz$oLk-t6Rj+XKbLR%|LgV&*!Eh}57^XSgWM}SKTn$gbo$bxXH@EQ_jCN!kEaLI zbN3^kF~5%e4P^W9u_y9T8lM@HoBbI>KNE}TN)?RYz{fyHPWN72Pe<0l^~8UxYfpEB zivcly2meX8{w(ubL0}vYGQ_U{Gorg1qss*cpe*ls=Ldjbj&3WCx(S|+3D#G`*^q&b znRlI&8dCqO81%ksU5*t3qKeOLG8&H?8qhKKwyXA|J_V`U->nbVSAR|Hfa`!*$NK!q zR;53G-2{=e+9c|<0W%e$@YIzYr!dlrO0(6~d+xYzc5;-`p8K#IdZk)}{er;H>>mD7 zod(gI_0?(o#%^lkAGK22`t98ub)(V%oBw#7RWiUNkC_&RyamiMd}{ca7fEH1FIXna zJ!<$Puux7l%^B)E_-29p>{MY;Toz9L=af)T=5ZORYpX#U!giez!5~#_Zx!4>{fktw`(U@x*bE{qV-}P-{9{Z4}l)2`%x1*gZ>&pE-@&oVd`Gtq- zuuSn(73A*{m0hx$Uo+98VWB|j-~5k8k2zTg!>i78S)F3}Du~ zP@9Lb;2=Ahph`s~$ns$VLyJ~9!;LfuQJyw)UnrsGCy_cmRyU)gQ*oxMMFY-nP|4&i zWUr*zCJObke)8@fUR5wl_+3SgIm8zbA1-kLCG0rbMr^SS2PrtPYyWiHfE#D)1ZS!yiOCpb=@LhNDb|oNK1{;9 zn~ptAE@gBxyoHT~k^)}Z^_F)t3Y_FPAXJ@A!zdtcB62}%fwkRU;SOF?GyY9J(cb$ZH`qSL>N$=2ONgmrJQNeLY$s$%F#65%A14I!& z3@a0DD03CU46&ka7Tj*`WtIJChgRJ5q8gqwiRxxPAF{2P(I4&A)QBE?6Y>77Jq=|3 zH5#QmXgD=CMt5W^$xUYlVP>`;vt3RLrump9RM2S~U(TZ$;a*16+t&?R_>#0p1I=gn z+4(X)-W4)b{Btx8zsSO?)=!g;tkzrz2fB3%w%V3*wFTwUwx7BBCyAATCK7us1W4_E zGN)ehxz=Oio=0=QZ9X-%y-0t9_(73cL4#89OcC9~dL2c=s)j(MO0)OKj^w3ZfEL7)zX(Z^v?M{+`&KnlJ)*Y~7s zyhjY5BWc&XF&=**YdSa$^2yL6U*sHZN_yMnR8ClpB^qG(gv(kTtI}2VPk?4swg34G3m@0v|Irn;WvL$^Q~@Wvfp>${ea_!{ zUG7n8H}4Mrw{8)=AKhy25#>l*YUnkm#G>k5!#RKN7$f;u*ZqWcySmlDlqDYWV)h~^ zls9P>oEvbex>4}{h!v1Ci9O%#&Gv2so4REeA>iwO*IWPX?!Gg#79RkwIb&vHu<7jk zRs8Ratlwer7rJugl16jx?^%Um_&k;x@#HD6{8kjC`i6L_^i#KnjX$YyQerEmFkcaN zQczd0OhE=lMm(g9>+fcob?>Q7So3KBfjD6(NKdTSCLk{VqVeyVSj{OM@S_6;Wj(0_b09xU1q1w7drWo^c~B1Xrzi1Bo? zxkh8WNnBTCYi6n!ucDif<&oWuNRd+c_6>!B96JB3Z~kmWu^;Yzx?_M~VK!6(9_%uo z2_64>6#vFB9jUEr$F72=t!4sa)^&-kZ^jWE2kwae8bTw+84G_emaQAhC|p@(j8s9> zJjrQ}v)72@>86}OB?CM|M1WJ&i_8+maXUMn$+e;DZp6vfR2TW}`**TO1+W|rM>+&4>|x(yk~9(WJJ7S$7ghgp%6F-hI54(JF8-!}GBw$f0#tGzOid%Ap_v)*&(m?@1?=amc4>bRiE3gQZ zLaQ1Fk5(jY4Lc?Q`xrazqI#1Svlw~35+Kd`Ho!$gNGXGXD9K_1&h(42bDn^7<#{6C zw?Ih?sVvlt9$dLihc{YekGWICEbd%9r#Oh;U6t*dvDIeXI*Rb{n(ESiDev&OHXPE%+DQTcDzGd(y zx(yf81W?vK0jtbw6^wKdg$buIvXs)JViSIa@bFsj=QRVM)TvtioQI8u0O-vVkiy#KUF zK?a&YWKsIe^Ct(=o-3tvEEOkRy=1y+SglE7X+qR|Mg}2bXy%G|GW}G0fB=P}R1HT` z4cm+lQZn_8AXgh|zKg!2XnZ6#hQY5?tiuQc~-XKo|?(s|%3BVc*Ede0l;_~XeJN0L%b8r|JH$>~) z-&UKG4z0n6+a{loM-(5)eMbVx)+ruF@|~$5>>I~qsvW`J0uIvhT%T04&XkyPx|aEC zaJ1F75@jGRg4E4;Ji61RFaBA(b`+g2P4r@is~zOe=n}VKp~H9VX3iqy{3>XCj@~P z>KeTyy5*FBm7w}O&9o;)y)vrHeHLkgeUZbfY!f5eekI+sm zGM}Jn_%JUXnr$r!lV!X~OjSjOzyMT3djJFC#H`8>gdi7nB^4QG*|Wr_Q!=TwEHKl# z;Z4usk`R|ff}6ymQg!T16Ke8L_LRd!r@w#1eih8Uf5X!)3Ps7Y3(Uw}OtUUT;P1le zA}!M^!_(j=+ak*pkxWAT^ybwD@f=5aqKD1$lby`F2c=Lnv4;51XOuo1ayAbT3#QL>V=!$u?eOyju#ogPTo@=EMxoM zn=8qBVGGDB1mX38)*U>`p`J5Oqf)Vj7j6e)3%qyO#FVt)$w_6{PmJmIkISdu7s3nQ zAg6?F=oZL8wYq4ud-K2PaYh;b`4l^OYhR){zbZ z!t5{#0_}{0Ms_T{w3IW-mhAa?Phliv+b?MnYA*j^&MsRfxT^%I4!z}zD@?s*nu<4O z-;6k=l=93fci)8d6qN=o2S91?HW`m(GLIH>l(5kYOvBO{thOyC_XX;Bl}(d*wc^c$ z^JM|oV?(sEFxthZi3b6|!TibDL2ch6*>fbN@K117DwMJ@%%L#x}GMBayz-_z&!^NZ{OVA7rqpp8#om{ z{H#2$)(m2MKKte26CD8HA>Xt14}NdkbkhA$BnZQ&uQ^ndGEho*C?jlKCh-F z9ytKcL1*`6A~2CTFuPx0vI^L1f4)=2d709b{JXmmoXTw%uz`!!cRgyc3i8|A2u@y- z?QZv5cYfhLt*$JH4|yJbISuJd(DeAyn{^t;TmUqcNetn@geB-dCHSqpFw*o zRL?I@zw&f|TywHLC7PftCfpN(gr52{t&ez%O7)LpH@BJiE-kX#;W37DQILkMQ+JQ| zMeKZ7&k_Op?Ak$Yz@`4Luqb`2|R8WA_8%1o3O)bsrvsl7`51ib)9< zE)|?ld=zW-^;+Pi9I`PrKY%O%0f-W<9?@uxY)Ewx2uZ*-p~6io3)z7)L;MPG!mF^> z8W8vbQdP|IP;%jS@}L1S;E&lqX5bI(819{TMU;${)VXK9*FR2my*<4$v)!_oicsrl zSn=AoZ8Xk0Hz(+bPq5n8aTi;JiksmVQQAl8YNxt(%rddX2Ig#cVH;&NxC(0-J&3Tn zJwSLoYD51O)KfQZnbAz58OF68VQ5F8&>Yy<8{s9`gU`)@z1(T?2mtCG;~Qt5n#)XZ z%k)=y;x`$JuVJ7Wy2JdfhJe99Y*0W7dhygI!N@5BX(7nM7^OF}2_hKINRlT?r0EDk zA&x!l!*Yn_CByYs*a{yFu?WlOp;Pe+xztwr@BJEWgtWC;qFyz*wZcr*GWM+TiC@&h zA<(r?mZ*w|G=KRi_vu*{oM=>y@t?)VXDUzpjs)}%@3t?-2z;S zG}xfFHE}>ZeBzOTqyifdY!ZNAW{+s4K~#3!T^h_eSJJ-m7u~G32`E=J)Q+u$={{2e zTgVA{gt|D(vQ{fS!LW5%O_0Oj_OtVXV?7(7?+aE+t<2*0cG~>1gju`j?B$xoK^#Vv*G-_p5X~?s1bJv&sz?3Fp7ue&$PTE(u-p#w!Yt| zaNFDjpcQTF6bdIPo0>6xK!}wL0Z(z?$VD0v zNP$eQE0kPhKGxLc;LtYw>XF{?fv_L`vW^?PK*7Dl^B^WQ>@?J4WM!$7-opRr;6Wvy zW|hkXkfw(iVReM%6jD;tK$y($?-;~u;)%RvZKyLi_-srWGr4le-#7k*7H}S>jG{O= z|*IIq29XfqSjUcooZxuQ)&!;TQ+vgqymt zPZ`zcaqkLsn1YTFqr*0Xmaaiy;MCEks>)b;Z+vL>USAV%sC;*eDiKiy6_!EkSU!af zy8x*%K&?Yy7x(0bQ!elj9H}FfTh6lz@MXF%RG#Em1&bX@i5Wh|! z(1iA~(0!jC+7%r3QqGquuuIF_?j0PHD!HWs#9hkia@Ju&xs+Y+9hsJeTiUm7-QJId+zO`>oqJT4y#uxjHAvx|w zw%keFWi^??^3L2Uapxt;h!ab`o(k))B3)vuR{X+*M87k&^vJe2m>~QkC7G>Dg;V@@ zb)FGAVHC5&RD0GY4%xMI`kXwm3YeTW!A1REuWi5PKdQs0IX~qR#PC}=T^{3Na)rcF z#aw%c0WwQdmwpim3L>H~?!`12nP%=l^)}+%kafNSl{3nw2#IqVTm(RKBaCcXogCJF z`o)Uh_4`viVrZy_a=H{h4cuQs9qYh}i4bi^_vDH-{o9;BN?`p@4+X{)qx}>=h){eb;Pa|* zK~NV-IB9V|ACD=S-o1n}7Ea-h4L3uw&k%@XAbOBE=@>Z6M3evN&@=_~VppEu&CHyV zw#8OH2O!(&CCYz9=cmQnB{#K@y8j2d%S0EzKT5%Rn5hlRb!`w zmsQQm4@kmnlZK8-By2k47J)DkZGvGel*dph6im6IkIR&DtY}a2tgp_PeD*$0YlXeg zJIK(E4(H&;+JNYk<@)9Y)N#uUE~g@FJc#gzeyFu{pAg`QU1vksB4Y`^(@xEb-pDb` zt0;o=8~NF|kdUgQ#sagRJb@4d{aG<@0vo#ihoODpm5Ep-L90$v)74SKS2#?}pEfGT+^ezHkQLXA3Yb#r&TZKr(zf@Ib@2cW?*ta*{vz^}*mp zbn||SIuZpp`tV6Ln?EcZ-EbhMqYZ5UFV2OOff>;g z)x&dZ?_Ln=Dj>RnlvaLic=aeb3{aiO9UZ>QC@}r0vT* z^;YER7rzbXHgbOV^t=%q8E|Uez0@bO2A8-M5xZUY1f)X7UY`K~W=HVT>w@41r~j}A zzPAWxt=*eIw%zaFtmAxeaG1izb2(50*%X_iw%2z;OVGD@rXxY_?^Hu>f<|9!e;3T z^stRa0L8Cyu<>`Q9V<#3hK5c8FsA?*&Zo{$_&K1?EVlUfXgaayuwQH7m3gGF1izXAhI7|>F zbu_wA0|r~WRkBQK3aMuLN4t@v8YbkmPr+V-9BKvV*`1Ka2g<}AC}q$9frXhQUKL`O zoW7m3e6dy87zX!ZH*(MIa>9H1Y3=>~VmJ5W8zKXZB^MafMDXS*wuC0?{ZbOk#LC;g zdXs%4u=AU;xM9GLrs8Dk^8NWe$!nKeMcd#1xjF!2IpXc79YY}6^A}Q#EIvAk=oCbF zWc&G11Gcv)^5^UO_&)0I>5F9R9p2b*G5v&i{x&$1N;70=?n6RDtx6uWoj|IkqNkQ3 zFAiOTNH&mTC@wwRmA#GtT8(nBPQcGHT$2%;Vt+kkI+HR?t3{g_swphltnX{9uY$13 z^6Wp1%u}U0jjCf7DU!FaY=jO*`ID3e<`8%Ov7NM+i?M*&hQCGqwl<6KlH*tHJ@)Ye zIONjdOA&_$M>gQFA3S7o5t^tH${nF)Q|#_zhPWB+ggs8Pr2O-fGq(kvsB-qj(^-dv zI_~MK4P$&Ak@0J;Yxtd^A@B5v+}*w{u#?9|xoYn(Q!Be-X(cA=#P@4`f6_0j;CFF8 z?vXWuC|i@DINCIrbGwV3Jio{MYcbQplzQ#%0zAvRf&rP0CSYoMXW3e-^}#kH7%BvS zpnw~4Yn8k1tNc7If)$H@v>{0cJ%c4bV9lo>Kj0XK4H?I$p{6@*gsT$ApJVehi z*#~HI#bf*w$%24q>@uH@Kb;|rEPCm0Cwi=lwjQ#I59vAWc3=P?AVL>bKa8O=Qm|3; zY~+}Jqc*i;9RSceqf1b73@egGp0#Y6>t}>0ab**u^)U3(2BUz0XZI$f;+?M+Tx`HL zNla33PGG>kS1R3*!r9}J1(R|io))yWL6x_Fv1klb^cq5{6v_Wt7`I6e&mIs|RoP}Y z{-D{sqUty!nBUiG7q2PlA9kar1QCP|rY#m%oI(o}_iUTL?HHCGqx>EGZ|`L2+_1t? zk}v{Hk_Pa%``9ZTyRbv!_d`LJMubo*azNvbi(e$jGr@P_1Ni((B9d+qRuinXN{@|! zQ@UC|xbmBc%}yS{V2QJaO;PUvH|G!PW{gzG83n>0Wtk~?|Eyi>0O0>O?QIIXrGmHL zbi8jH0HjslMX*X`t-q@?PvUXJQ;h688ow{7VJPc zJ{f56ip0#njjAUH_F|33=>U+0Be%kau2gaDT8aiQtBNN(0nd9LNVo+uaCo-|$GhuC zf7=tr$zxzBQoYk9SZYB3{FD3CA)zVJxnKxc*DkDvqljQwm9-q`sVrUbT))LRD%FkQ zd5PB*ntmww5Uw)d2v%pz=;mN~J4&Md)(u6yJ2_zr18LRNqYNRm?|4jqorFPooQs|+ z$N>1XF7o(Og-O~tNHO@0XA)Z$jv;5c^gr$-qk$)-CibBUqgo6ReMs0SnsQ+>nb$oQ zSa=H%@IzmUw%n@YzEOMy<6O2*{N86Vz=3#wFH)p_Y z=43KQt|xAQN<@*+pt#3x=?<$MPtEvn`wcNarFNMUG?R+{XmKT$lw~Ds9!?NT(a_y} zUGl+xsiptO5`57*?+Z~J_MxJ=c$i2zSI*tQB%#eU zZ6%RX5Q5If^A}!UPr9uSNXAQ805V(Mr&=083U(BTp^tyTdq0*=w<=Plzk3AyO~Y?3 zl*H0V>JSifVg_Yla#s{NkvXp)xUoOpsr zkDu_-82>Cs3uBOH<2ST~AUyBP4D{5TrmPMKcciW=@>sYOOPHDxH-M*9`eOT=X`jvoXB!c4FYu!RD0|o0$(RzS85(POqT)V~Kt$cWDB)!Ao zmAJ^u1r*=f@*5ZLMdwe(b4d_-#N{R`3I8a$TvH0I&I=Eg7pj5SR(Ql5+2l^_5FRPx zG(bua*>&PSn;zFAy2y+5nT+a0~ZPt6jFa@R1;x3zc~BQ zYDNIw7AIU{|)ea?3SOFLdH?{9WKglHy zY&~_qi1hu=>-%qZGb-xlywKZ%85Hh#&ru&5>*(}Wf?~(gpVolWgth-P%*=&>c>f80p4aaXGwS|ydC&LWe3;eH&;)_z z4@m@g8keoYrE~3PjEm0#66wv7n>iu?M#;AICR77p`~EUD`QGY$gtB&u{acT1jKrpB zfGs65o?vlon8UJ_rHZ72phYkfe!^6nWm{e&NXQF7ZSGGoy~J6OfSgdr*I>FUu_$$c zh&069ihyv`RZ|yqQ_b4p3%^AFc0l*@&pM&Yjpr{SJm}4UV58SXZC-Nb zS=i6&lCC&6#9A(rkubf_!<6zgVyNAt+Wl`Gse|2)?*wY8ejr9YM)8K1zup&$&qFZUb~4wak2+? zMoo0AMW+F3r4c&&S%8w|KiMYgy2RJeR+L4leJU?kLqk$8FVJP zn6{nc$d@!}=w+ZcSYxSg;T}^}x{j^mnGb#r>svQX9Y<2zc#$sWy1FpFcCt81Eh2W8a#s6tQ7Q zApr9xJ0KyMrOmS0SlY>w0{v$ZmJj&3hHmsU0SFSrSUUy$z;x<(rYG3$^Rd^t>ycv^ zt8~hEZ4Z@INN~#WrcfLzy^q89og0)5rus^?1Mgeq)&vc82~EBmn~FTXtOT?ht~LD? zJ0#EcFZ8Tyy_Lv5I(qBdj;;_V+Ce|6l$AP_wIF|sE!ew7nL$`vMv zV-An}7dg!Dv^|Uy?Ct^&hxmw|3N4d-_vozYI?8Xp?fUU(mpCx^@?vw!N5c+l#W1+> ztM)uP>0QjXNfzOH@fC#>Pl@Ws;a@o0sb0d>7FC)F*1Afrsf<);?z&u9R98`<@FH=- zkA;%mJJ1*;Z`V@qudM=G>Bm~pi+HfazQTN;3jZii%=i+iEzM;?M(jtjV+A+n>^4O+ z!ZAMZ)tJtwlZ)x>g1ywYAbPhO(Vjj@yz{QwWooiAp@9Q^7d48R_zxM|bWnCEVQh}@ z6sBl?>O|x%RcrBKQOq9lA_)_jR^sf_Ao4_4zhlzcn)uuho;&{(sD8gf_*U`6M=%=p zjc4kx3jx5E8yMh@y{o~y>e-$|6tUo#h>oF8Q_+B9>*;N0Z6rp+qV>qugk+IZoLjIF z+~KMT4!)>p-)7qok81kst7%2{3C^VD)It%Ekb3-~dpGvPW|my1p#XU`$x5$2Oc~wl ztSihqe~Qu#TTtTPApo+WnP|G}tn|dRiOsA^lGZbuFjCPiSuYf#RV;>4%(jWk^XW0B z@#@e~UI(QB{j=VK6I=Z&w)DfJ_&u1E(4ou^_6fck8|2tImC@@U`+iLj3QH4ndu^34 zRu#lg*(NYYQGeOl4_+h~R;Yonsx288)B!>Nz7ajrtesmzMUu}xPO+QbEC*4Ai zjlin-e&3&HgD?_esAuQJAp^QBNhEqQ{+#1$MkLo{WI&6oGt@6I-{E-l`n78sp(sfs z_6$bVF<$gSmezLf5lZPRQ9H(-?7l8hrM0$KPU#BU_9SCTEb91$720Vm@Wxv}#P%rt(G>8&qj*9@ z=_`>29$3nKNZLMq$Y%Z?6u|?9U^H};3`+{O9y8<%dYYLhgPVGlFQ1a(@t=#jitsTY ztZcf8~&0r?ZXif67;o#&l=wPuxQ)lS|f#CQ@37;hZ3ooDlI@ zLsw&SkG-Hmi>=p2Sjv$lw~^@IBi9NX@ii5mQ9$I{e)l~26*u7IKg0Tk@5`SMg)}!~ zIuUP*HE*-wRh8}5jq@D;i%Uk}#~~CU*I%BYJ-&Xo8@?CpUoR)1h0}K?A;<3qJ@y%; zaM{rnUu$JnM(Lku3~j6WY^NJ*`=0X>?3fkGvs4M(`mLNpHAlvOSfOI@l1t9h@)H{+zf!t>7d zKOOy$?eI_Qx0P`opWZk(a5}fZ{>0!;`Jea_4mCYToCU@TsKdkxv@!|T z4;r?XSS~3lJ%LmYsI1?xK*lFnx=vWSN1gbMdeT)nvy_bi5CBhcV=K!d~t6vk+?OA!p9{UFYil18IFIGtI9cRew`j&7RNA*~B5e_9~F2LPp$fKK=Ty*qc93 zdBTdRNoL^q?fsq^0oh!8_oqnb2TSQn6OX!WZAyFJUk#j{o{~OwQJ*b zaKkn!;Z^P~iSi9ZDkeUHXxfw8vH&UsYVrES_Z6a$7xNeMuLGx(uX4Nk%TLk!*M)a`w_})xD+i7|T}bKfgl;KlT*~FSPR-r0$RowxNK1gI zMMU~*fuHwFwLv}?CpJ)lzlDjJ{rB#n8p~~j-e%Toj=gyY=vO^Oc4flxR`u7cYn(}jp>FHkT{=c_GWj-4?!yG z)Z05Jn~=M33zuY9ytc85&11Nz5c#M^ZY>EG%zBCSBz1vx+_kepdA%gY?RR~EAfF{O zP+ZRz-{Vex;4cl5N6ObAMsw%UM1XrH%zrGQont6wDRz=MM^JyW`-Ee$ftol5 z1vvc{sAhlK{qWj4drP8vw9KJyB{2EqpEZ(`?UXM<7VVjvB)v7?71ZVBcl{7aJbkN# z7m>~FR+L#{NSwF5a7>?AzI)zR-B^b`DA33rE}yP@H>G&%7wj7`Up@T!7up%cA2%Gs z_E+laZfbxt%qaY+UIrvD0_x|PGBi-E=k^YBQr;#}GciDgJqhNT@>Mt`4a2|}%qRh3 zi+00STSF|^XA~~!+bbKdLT1dd_A~&@%0m{{0DIiw#0UN&y<0H-Oh%nW0AmU8?lqs^_U3mxne<5 z$D2qm)T=F!aAJX&;b}A+m{dfQzTYOY-Oq%rPP~FTOid(vs8?^l_-f2$;JWy;IDy&}F1#gdYC@fscCfDYZr(sqU+KL(p zU^dC$90xvT3?n1cw^(iQ@_|31;6YAk2%qUa6s%oZ$|^ewK6s2JB|Sp4e~W4cFo2YF z!PB#-yEn*8_!C`b<8I=qDY8V-tN~6`&1#PW$u4MO1r+D+w^uk*rpT17jc9v$t3ek9L$o^{ot7kuJr9SnKz>_AJq${b3UBcx zQS_J-p}1iH_?2BO9**Vo1IlBI1OYpanzq%8)=gD31hmj^OVEj;kPE_{Sz`&AZpNQ5W__ZQ3lIeE?f=Q|V z#{;oB#XT|TXtJPMU&^cyips1J+R>3ryDPcQr;+Bje(Mfl*0w{+p^K`7pPZ|%2L2>q z`SEMLLe@WIcXamuD#t*j-Bwx6c-fkYoKr+Q{nji_*V5hF$Z(1C_4^rTHimbvzr1IX zF!FhzQ>0Wa9K1#0!NvAEzz#d$AGK|Rh-IQwg!P|CDl<3z!8Ou8kib`_oWe&yNWCNQ zP;VFk$et3I?`B^Ay1!T9DRHQ!n+-j1BU9ydlSk(bQ?`tEMmkyC>+qp-Q`W*55OGv( zWW%Y%H~$*^3e?frJG}Ju*}`%|i0Sy;6W+;Tg^EG9FxS)LN_E_I{ttg!{EM*ko~p$& zU*F$f+@61_hCj|4{t{WS*g~h3)uHD5$ot2?|5!RUB+K^=S~eOUTzZOb)iH3IxG&WE z7vtD8BE&Y}S@eNNm)VWGCtY@m68QHs}1i%gFe)1k(>+R-(h*n7}n(>3K?Qj)uyY=J|gWnjSa&fJZbN-5h_)kv@D z7~Sh2x7i!<1OK=vH@3ycsse^%yQH(gJ4#@=(|JsyhtY_pnXS4V--yDb1RIfc#-}7H ziI(B}7XEMOMbqVRZREt{3!;Wd8RdQ8LRU2MgIy#_`qxFqUk zrN>=pJr-P)O&r6gr&M8Z(n0wbSkA?LyLl0{;*W{=HQA(K5?EKu7#wQ=5ZuOkZ=7G= zb6#@DOPX(Gi%p*&U9*Nu=;=Y6DywHoO-9zNoZzDdX%eH*T z1M4iaH);F|9|uLKZ47~)Je?`0f^`1hM(d>kncvIc5>o%yj^W=wcZaV`JR&<b+k zTE2Z2R?L*wpebNtcN@Q64EdY=k9Spoo5!boEPYAQ<#?q3Cce8{e4I{pDTQa1hI_8+ zABv;6-<1AYT&wQ#0zyns#C`Yr7x2HR?No+*(mxauw~Leq{#Jx;QpUE>cJajp-qg*# zn;Vp%C0yDm5w1vlsBdRJFcvMSWX&uQ^f1zQ$&;O*$@iD=&8ZLp%hMwD_`wqD$$=|t zGx%6!#HqD6X6XO40MWMycG4I}t(U;$Ey0&pqvRA7pga!tMc-1rqnhGbrOR{B)eCDk zUoSaTC`0eWfx=;)%RA3IkqnJ29&`cu+~N;b{lpS4c!SWL$tQFpmBp#69xaCSuBkj3 zg2vhhCWk_lC!P`(k1`{Syi|-DYNnGTj1jWH^8x3!`s*|#uRbrRg|W^c|IEVG>s}XU z-IPDM(Ywm}ZSZM;av$xl-$3Np&C7P19rg2U?W7Z;!V83s!BhZm=mb8~F9tuT`T2fG(DC(mQ=9vPGZ`lWE?k1fmoj_ zourp(!9yyut)JGgH~mj;%St#te0xhVm5uFfw(H?EdoAZ?T}W(S--l24_9WHllw*k(f@+T=_Zo*cHkvy^L_SUX-S3hD?9PHpKhKbFCfshg zJ&MAK%YuT$Dd_p#rYMfD);CXpirDSlO^4}gB*@1`7Cr*`=oE=A#jJ9_$6x$ECcsEK zn{I0uaLSu*@zDOZMHF&GY_OKu)yfyCj8>vNUxP;n6jJeeqhBL4VqcP^mrehPAtZeP zC5C=Te-nhPW%n+%44ohXd8zZm$Yj?P4V7$6Zz3_^N62$8DGEQcGFHBBC<)RdR&~tgH17MhXr%C~VbVNK>`F z+;BlEXe2GDonTS2{Y-#dfbT6HF^0yMOocCoD5_JXSQO{*4Ozs`N&g+)j9|pTcUKbx zJNjAO*q>!p%*+BFGewPUuH-$c+uMFA(ns%L!3o=vx8=6s0s6b|PpMBCKdSX_VMaPm za&OyM@;qYfYF`Z~PTUQd(>I|ddR<%@oRvD~K`aSDjB=##l3|gsL8O22^q~hN$R4H; zywLDMam7YXfF-`parY1GqaG`ltyqTp+xLt$e%QT5Cd)2#&Q|j4CDdVCQ;Do;sTWUw ztT-j#6tXak{zdy(;p6dZb*E=5yr|G-V`n7wc(YQc9!wr3pZkJ=kR!o3SKNka-fCs% zVL%Of&bHZ{&)IV|8@y$VP)*q8Isi@nZw8T8!Rq$z%pH2-?&}-Vb9Qk9mmsFcY+;)4 zuM@zI85~st`DYC<6HwCizss7H$a6QbZWL5c;+W71-ntzyj<~uHe;0hU1OtAVJLG<1 zAFt>)DHO$F0Qb#6r(#igJe-+@wxr6B=tFONejHkbqS*A9*g?eTXbA_^%H@P9dm2$1 zWO!NwVY%loyNH70;qm)jM8xI4Vp-m@S!68op6}7*T&SXPA2+bkXuF8fmLEx~h`>?M z-SXzj`8{Zki+gNcvlx;i#oY_>UbB-7I~2s+4oN94?0Q57BA3cEk`9 zZ}hh&d?i!jp2~>Sl8YACV9$9wM1?9825u0y@1Z5xI?KvNgL%fo5Nos-2V^TH3H+Pc#!w{8SiMazgQsngE=nMB z`fB5)f)a8x8s4LMRHd|@`24+#8zvv(i` zN(m3&(&u=S;`(W)jnvHyB35l*=|3=dfmBX7&Ns@3AIlKG10!p6A;091ZT_5EE<3AZQ zIOm>Je7X6!iHtQLDWDFNJ@{`9dnc|a%(m#&@&7pJ$P{XDrvC&&X*2D@G8gGrC$WSNqG&^(zNSyq1WRu0qf$&%7 zrQWU6bHtYi1Fa=sxsvtDThB5-7L6&W!xiZ;5r3G~&{^sCw8}4rVqZTJ2T*3Y>d^q{ zp1|JDGMzF9&#(KHervyH#^z=i$e$o3y@?xxIIXykkh_x4^sV*`~9QC5hF)wF?|@{W`?m|4#L6&)qoY=H~m6V2w2+O*HKs%vc%`{Z-4En2X$%ec;8zj7eMn zcvNGHdGw(!lrY1Dh04iXY2)j=8p8&0DsFh zX(pA5JKV^}=@gCj4YN4ImF5NZJbr5t0Zer1wHpD6qI35y%Y1ua>ZwH_GS0Ur^ELUA z;rpj|xnvVfv=iwaA$eJhU?k=ARPgIYYR`_w#S%8B6zR9aRPDm3NZd8=AGnNcSh7NY z#tUp3n08TdTdd<+eqe%O1C!w($^VL8Fr^fi+_A#rz{{R*aP|OCR1HTQ!7fFH^?V1H zDpm^gJ(?r)(K~IP4A0c$WE5*rZjtG{WlU5LYTi{#&;8W$zur%;!eVi0AyQ}eS7R9Y zXp#iO{U7(RVu2hE|BsDz&bmyPe$q4<^Z{;Fj-r}!pOK7mX+lHSy&0o=YCo>El^iSS z)g~$EE&LVr#~$3GeS{zwjmG6$_S|9}G9!T zsh@|V$qW}??Mb=ur@!Ic{%nUwBSKh<1Pl;?jgO@Wh~o-x0G4YYLY!aNZV!2_{^qqO z59y#kxS@5{a5;@e8PA8NL1{ko^bu%6l4dDEVeiskIBQI_Ge(?4;~$AU%q|Q+4MLNF z;iU?Ke8HeG80vI3Vac3A3gYdO4V7I*TqB919m1F%-y9tp^C)2)_H)NXc%S`mi5TYX`gPw3|Qy!|gC;9Cr(!odQROZ3O^h@7G zr{kK?kE_J3`_rwFd#}hvIdIi6nZ?5{G0-3LQ(yz;XN2K1#c^JaMJkgCdw~>?^t@oH1&gK$#f*b?W ziKR505nSQR^BH`@g0c;{Oc#tKgiY2vCGPFDa=cx^OVi+&Z`i>H7`G z_IGBx8MN7U)1{nwb)=J)OBRaYvD zt%Ux+Kck%~=*GLdv^LV~8JUZBx4foKs2sk-R=;Td4b&$_qt|C;-64>$ehryzpq zd{5Ewq3A=s>>J#$66z7hi__lyO>HY4)i=OB^D!F42uo1{UTsoWYkN0#NFtLlj9Mqu z->2PS?Ev|>tGF67_WGiU!_eNN8+yVT^5ECi-`RivS(m0}Je?z#wCAfcn-W&kVs3nF zL0!CXN<{_5FM}^Bevh8hJQ|n>9}Aq*NeuJmug9$x-VphWkAJqx*Rn-I0-|<45w~oN z`ES}rku{5U-pQrWqQ9)@zy{JpQ7M1OimzK1pL11z=F2e6t&Uj7@;~KFfVy;|tJp~iw&8;~GHa7h z)Z-Tn5QVjfMA8Lly^F2@;R0nw;uwO}02Kd!Xgcq3xY}^*kI{Q?K`?snLUcy&LiA1$ zooLa9=)Jdy-l7{Kdhen~38IadL}wBt+PB|xzVo+>%VoCbx%ax)`Yk36Orp242#I0I z0?%0_Rlw(9_=468Hy+A&94~D$g5RlZSm~{5^A@@^cs>8%QaHd&!_7e%gf$AYE?_nM z>P-afjGA4!d+x6`I4=phyY~0QOc%Bo=N3*J3fT+iIOO%mj>1-%w8;sE2M$%ia@9d& z^STbx3^*7oW{8=4(x4*58{lb~x_M*+Gfz*vT%&pCXt`j8RpAnOcH0+D7=AhzN=YfT z2uxFcet{B25hOrd0L~jBMx|~yp{Zp zi3o{;!TPc30|;JS(h#PBCwMM7_C?sRh(Cy5kt8r+GSI;<=o%SL=iO=*RoG5-E+BK4 zBco|+gss%zO%2a1QkYiFU;n0`Q0Gt>l0-Np7enXo-Vs|PPICsnl}&g*dO`Io_9vS4 zM0HFL@~SZ1HCel25wvEmo161y3!=&x2cU!rAk3ZHu56SO=pQicElrr?H!3m9iD!VW zyA&Bz)lWX5lTN&(Wjdmqz8lyD?1TU-&n%KiBU8Ko6V<&0Ge$I!eE$NFzc>>LC+z^_ z(11G{V_(;}AW^eA8Gf&F5yUpqCY=Yc6D|A`OO~*v=tNLRa)EO(XGu+RfsM9w_o(O# zi%bKGTi}T?Jr-8j*$s>lf5P@|ju|85_dlS)j)eAIJem83h(71LMXdKI=R-U*x;OW* z!tJ_o-xkp6kp`-PgaK#2>XY=GFl)R*5t36ABBG6&x;k%@ch>eG0mdg_v6Zwy&`8*W z#KCwfvdg8(2jHsn_`~2gJd_7G)Y-B&0!m(z)`s#;!8N%ent*MT7 z*n^nhMn5kUO%cgRvK%EyCv&qCYQdiwX?ZjLMdA z#jzC=Q*K(zJFIq>QHhiZ6uoj0%M84uxI)GUlmiPgE&tv>GG@tFA=6z!Lb?ie2s%YK z+}Zq#6Nj$itF_EhhB}y_X~zA`AqXIQPodkgm2K^ zB>u)In~fZI(6=|`mQ-?@PWyAFpipA{FD`a8n~W3|!N3iRH;g3LJu_1N3?T8M=|Pd+ zfTu_8BwPb&O4|vr%~yK62?NuA7oCSs<k2C4#zUeOg=%@8v-qI4 zY(H;|_TvvuJO7hrmS{MN@v{VYq-Sy;8(S{BTDQf3I}z{%4BM(ApQbdnY03ZFWqhzD zP$CB105u%$Aqcuh-w?*Zvt$w%9c096eF9E;kLa=fnKJIpM`-m~xDu?=?kuCIOsSlzSZQ;eg8Qfb-?blDRAjGj)rbVSYd)uA=RZy9}bxj6L7mHWGz|_d>H{PQs z8Ube9n&dh&%llzB1n2$PCB%&vYYWw<(syJcIB#U+dNJ=@VH&A;`7CrNWKk>wvsM^; zC}NU`l6tx(FCe(PT*)@a?sFX}c)nf6=@RQVI(kNZS~y_QxV4;-r~E;oVQZX)(Om`k z6MkMF)vgCJIPIUVRMmILJHQ0M0A`w{yq7<@OS4iM31E?qNB7f}N~S+>EPndTW|jl- z;A(m`14x{WkcS+2;3= zzY{sXLX~|_GRI>#m|lb30bldUn_tgA^<`jIm>iobt414OSJuo6Xi(j9P8%EMXJl#? z;20!fs$$}tSsE5kU6U=qSeck%i9r=ZB+tOiZgFrJ#R_btzU&QMoe&8c9rF`s_vQw2 z5@~9j#-R6QX*dz^yd_bkRbo!Jlu#u}Yp>r~?h^<_4MXTikj?cyJh zVMuY@h&<@7-97N(Sh5?hP%y>Ua3v1hh`c)h*h|j?3ca6t0evVWoE{}2fM$~0J|1Qa z;M9R-UKh95qnFCC2a$^+-cBq67x)s~P2%`^ZG{r#h*PZv2qAm|JS^>m%k zG=`6RA+Ncqo{3T33n0ZaG{;=3>;$N>yTeK*@Ln=r4@bR6M>|K#Hg1`gk_dB{i!IxFVy=la`#Gg4eJM*XtZ#3z+|$zX@I`*z~# z(TDI7S+i#b9Rm1S;>|H-(knBg07CuFe+r%(S*Ns`xqkb`1A!7qj2yS=FuUT8o>{O+ zM{-@>rCd(O#!qrmZ3TTbO0msLM`Ea?BEXddaMnRl(m@@HO*^AHd3{XKyg#}Qk_zPI z>kJH)sLtW8v}vsZ69;S`-k&k?iJ4dcWy8^`**?;|fE{oySUxLj#OIvv@GPK9LL}K1 zF8HCtzYftPHWmx&RPgg%(!cGuw^LCGjv%pV8c-Qy+}(wmuKJk*r+Mw4y1m9Dj^hIE#za)lSb(1|QFqr! zmn1N9xszx2Gm{a*P?h%6fvL8I5H20w+f{d{5hV@BzoJ^+vU2(D7f_{~jMo9*#SQ%w zphWCh0PiUJ+I|`?j|t`$0M>BIt1^OINUt?}dex%2cvi2jH~P4$QK~jJcBx_%3j4iI zevNxWeXqLDUEi;fR_=uS1|_7D{&3w1Rkh4*9@{B5zV47D5d_R!^$P?NAU(rE>hU|PAXLRJ?tN`H-b2BCWyfJ}s!Y4U}7@q=R|TZCdlYZuV{7snmos$R;S^Bo$c!T52p zsq?GiKi~RSgb_u(;s>u~PH>q-ymfGe#=~COMRLAt&@OZDyf#eoJbYg3^lXM|sK9V6 zo{buKVc6Y_838&-r03vCu#})Ncp7;nF8aP%pW%AqO6}W`=sZ7-_fH3&y0+Qf)bQ6 zdc{rU$Z6HTww4W1WAlFdJXxG59jon@^i+QeD%SGF6E+0My*bG^2K)TY^*jdIP)Nh| z>hYD|hD}xq-rw5V2gZT4<9>`1($6H!WfN;T#oCz|>zp-SABr=+svs%8F>+g!6HmBL zs^W*eCzD|G`t&AO%mm(vo@)M!=Nqas+2Yf{p*I~v2TdDAB=@^R$8^<8c^eXwhzW8s zj+T0SP*(sX+Pos)30X$FaUdvwpNbDxzCP6$6H;NB6ERTsEzBojb8y=j8G0VeTZt;N z8*1XLOJ0~)up0&q+kfUoNvJr=^|{kM=8uUFq_e~Ojg7@Vaej)1R#K263$N*ys?zgC zi@2aLK2*#KH0194_Pv~tHhJH9w7?FaJOIawY0`2@sEqmLS%7FC7})*OZPH(<8L*FI zJXa$7sdKGOq^JHSg$evRReG*GJ7nlAwva25`20MT-i`hEnotqsL4@5Cc8|pva?U_7 z3_|9o+4B`tMXX@;U%5Wg^<8GmY5F>3Krg#qDgwJi(~C7kYm9+f$1D>Or06>_AXznZ z6^%dTSwSnn-?!Yf!-!6icimLNFgVyKi`(}Ugf(VG20V39tQdB;%#Ty?BXQ;JR?{zT zw~U2z|0*&BNstMQ1Qe7#MrxVZl*j~vPZW@@mP>!Pe6-?WjVap-qe58RD)IA9Qb+(5 zG7_YO^8`fdyr<57^D~7*AR=w#ne2ul7b{mkddO_sf^rl+MI%3$n~dBg%uD+1PvoK- zwA%9jya256e(VjumrLcjph)RBDg3$dm=#Y(@Magpahzs6igQbRM5GydG9hNgfN9D} zGJ&hGq;w$Dzj<}}sAf;X)uQcx4Eo=;qLEe|7;eJ|} z;FV%I|5Hsb8N)P-^;?>?_WT01GJi8=+(&i`w7WeV-8{&ls+*1?y1MxCRTVKA7#Igm zRk;p=*j4jvM?8$JSqR(4{)0@b@q=L7x4qkm7^L1K7hA)qE=`>@s1;Q%E(SY={KX$% zMiVN>bF;lr5W#rvIcf$@5&om;4*O=*`cC<7Fkk`m9I$HlKI&fVVLyxk8@A%;tNfv6 zxfi6ka@Y7L;rL9CZA}Q>x4|g$N13r_{eOS~>VF3%nNM@vwx&!Jb?P)U8rZQ95Nd! zXT`$G4(H*`mq=@QQhtJU{2tFyeX1wcUUR2~SdTuqI#ijl+6F~zn}Kd0h(n&R!>#d23{XQfrHpqV!|t1Z^$ z(H|Gxf`e!L{5%jXRrdP2@|yN;yrH)-t(!gRYT(;adJT5SfK8_v{A!>>*ETjq}B)6bbi#dof3&)nS0Sbx3weAeejyFf~!-CHHR0T z>*y#bK04Dkc<}SXQEWWg2_c}50S0Rtb~m1na;tu$UG+58Xf6e%6TVD(zcFSm$blgJ z_O)Ti=a_gfP|BHkZoG)yGr_3n9o%+Pr4= zW|#yGFcSY9rxkDE)HF~CX1tMM@Rqe~-dG0mS$>uPt{G_ad&jFy<7EjvxE@4OYa@F; zzYtEW^hUOXrkmzivsFO~8EIXg=_bbd8L^;9`q>JsOe|+23`u&X5^j9n>4aEBG(AI` z$`YW-+S+g=CHsa>etc&UnjsqRI}7)yFwrHmSm#d(fQ ziq4qOP^<&P;B8O}-5BkPNtR=ZsOC4gZ1l)qPG!9L_z%QHw^%MYWj2&Hqem0JzS{M3 z_`FXO2TVOi8TJvj2AhDj$itHpuB`R~*jaaRmoMoUQRU@EZ=(Qm_IxwlgrHW%m+i}&Z$4KJH^Vf?QUFY75n)N%{#dlacT3h=S`pk50qpBqpKpFuqI?{f0E+_fS4{)Re^YE00k2R#*2Q6Fe zgDXOe+%^RwL(xsdRu9koBwq#r571r|xF3qJV@9bSiQ6QnT;o+fMO)73=ZBVOyAL*X z9)kDr76ihov~7}-JuJrbw1yG&zuh+kQ^*s_lFqif8h>Jg@grbWE_yH7#J2=+f|Pix z#mJ?3(VHnTNcS;- zp{isT4}!pQrC<2SmRxXNIK!>ccmR@Cgwuf7dN2uWdD9Pf(pWiAE754h%@ znuR&_GX>d?4)MihHpXDS6wHU(E;gGug_&ds^}bmJt{(S@@f7uE61$d1B^!sa3VRHn z*X2%?68}cRkMk2`f~Rb99aV|!8ObeiYv4WYlU9Q3HP|BrL15}>;6feMp6e~fo%`$U*hM_g-ak}*H=}2RyIyg@e|ONU9Ag5WI_fW)c}$!f`bdt8 z{Ds$RF=?=TX`g^Zf2Ew1+>s@`ywYT6h=aP zZE5yU@L7MVqp4mto0W8UOi+GlmdeuCz`sDk>N?<2An+{jO-cTnCpUK`oo8Zm;i8P+ zqOM9((cZc!vZI3{3`S}7Ce)b&d9@75K^F8lB_r-B%h%GftYZ`I&~uA#VCx9_{q|*L zv9Kge(^s;ZXFVV5q*sbXW{B<7qGW}hSM26X&P^)*Z`EJ%Xq|z zbduxp@f{M$Jg0N zo>tyAG_#8p{@DNb7MNk~X0}Ik@4xCY^UFzBku>_Qk1agU`99{by(2RkLxo9dIyyRN zmgpIJRJ@xT{x=s9d`&KQLH-|(0N=ZTNFE?1%t>Ar{`mew|FIf*bFgJIoUMcMePd}f-v9o_JABVeBh z7?PYyd#_Xb9w^e!fvDR5%si>f4|~>kPptYv6qw>xBrMkh_3)X2s7Y`|PQ*LWhf zU`bTqpdX3gF;PeC1uIlTi@!vQ*bfT(jOm-GT-1@OUKghXsuNY^YW zsEtM*q4U&yT9GI+C%DHz((_v~(r&oq01+sQbs)11?-nV^ShgOCjg zac(>!Q!XlP#1qwyc1H!G4%EbV{BRoyZ3?)am$+~P#BO_S!<4`?+e{2RG@zHdfO?bO ze?Ei(={vsCVCejLtmF)P_CQSE(KH+IcE$=BLV+^TAQkb}6`GEnmTe<9KK0tsTSWeV zCFuIv>C1G?`}bImMMIKc>7!a3$6O%5W^#b(XQ|*iI^Z1{mNzfTCi~V;7jGQeXw+I} zZ11RvL{*MgGNe^&A0dKGf!6!j$zm;ly@eR5Ub- z>-7M2G^755JH%=6hPL?jMG_bY=0IX=I9YaKkEiHPeJVdp2YSA!WsEZoEw{jql}D|X zlrg~rhqN^{Yh<4qDKINYyj!<-Pp?4zeCJ__(716-G?yjOQE3YUhIH+NE|0)JhhiVS zvnePD3t7z1Q{3Ob;}DbmQR?Y@DBOo!nGgQFZFHW3rwzGF(cJ&?d`*l}*^QTn=(a%Q>Fw60A4_ zX+FyrwuJ{YM&(&51tf#oh9jmq|7FfDAuM(ptK_t2^EUk))L1}Vnp<_1I4`J|(BVZDxvW&f5+$`7KI}F=-@6(+&ac_%^U*LqOj)Zezf z?CAZb>NRNcZn#llasdskLNvrb0On-(?bl}65mrx#cVevle_garT%@nph%D5s5u%xi z7)~l2@obmOJWttVe*~Ta|4xe|f(l%YdN~uxTlyF?l}Dw?gSG*F)};7ObHPt5n=tLx zk3QD)P{V$guM*ePMQ+_@L7LjwkfBRT!w<@JmdleZrKw-aofEST$j$m*7ow;dxz8>WW&XSL7ucv!8E6D!P&**!g zw5Zxivafo+P+X8B^Du6JM-FetWJL|jU*BK`V05b(xMn=00pRLL` zHQEDoZ(4EBfxu{xRr93@JsIbU=E185LMbi_77|wOA$F?jC0wB3{45x-klf-uxh=vy z1*KKdzAQqD7N21X>X0Q&dLOR?ZJ~+O0_Q8!)Xgh9UJ`<6Q8+p389S$^RDh@8{q~*T zf1U)l`==0^g7Z6V&?h@Z((!ICNC^}77_I}`XEE;&_Mh=(iQV^v5nN+GG+r)vrzDdF zN<&sT(ZWbSs5`i^s^h&kaWEyj9STlOv7GE`RMMZf>YMO|^gq{Z^Y{nGbfbsm=xgyCJwk`aBZOF_~< z9eZR^NkM*ru3XJoQ!_-pC@I589xt4L%cS^<6l7KKC3!4QZSUVrp%Rk&Or{4v9fMIZ z?vxhSx|Mi;R`IAK9_c5EN{`!rJGK@0$P^qifT}}?w7%Roqn6&IXYx?u>gL4+ndRS{ z?VnTa{k=WR8LgmUevd&+9m4u$vL{kCROub!-}W=lt(}eS2XUZiywz#$Jp1gi^>-sY z5zJ@GJZ3?o*^*=s3)H;0uU?oy3_#nWZ7*-8uER06Zy5W5R>7v=)}?^CrE{YqIFoqbRyrP?a4u!|{YcUoGB$+4s+N-fOFz zG!lTXsaiAEcf;25vop3iCFVO)$?&Ej_TQpqDjK%W#)-aa+n|3 zXSAWjc~_~fn2k?R6nJnsB4QuRsqJR*^c%VAdXZU>Ou7aX_|r8hrM&SSZDyxm>ZclMBPW zB%96vqXSbsuB7>!dV-h(FLw)>hJ4(BG98z+9cXTO~m`^>mvWz`CEm6z?NE`nQ4nX9kqQ_W9M!uQeu3vMk5JU<}hQ z9PtXK4i+0CdQ-!leC$qz2Q_*qW&liZ!ha!)f~zncc&&{(GeBVa6j2LLbdgk^Rt)N$ z+WOxC6O-jLyZ$;sZG2^;!m9}~gWG`bFxO`zy{fLsnj7WZaW=13DT4}{&1VxD870Xg zU=?uAJycWO@L!+gTM81v6cIVbh+E(j1m5cb2O7!_c$_=Ad3j=NBh^I#tWFWKL+Yed z?4$`eR6Y;|zU|vt{{y%ZET1VFwjzD8$8*lREio(oHWQ!wvvl@L+0fr=yL`kw{%Wx^ zOLIf70@luT9Q^fW;P52{W@iF065khDkd1WKOpvjksA^(_sLG%qH2k1wTMEM&zw9+CD5%U`We@1pL_5W zp_7-RrE$nv@OI*?EY#rg;?hM{XJNRCqb#hNC#iYGr5H0-n0lwU)h{4S?!V% z+(cqg$;Da!3{PWjpjCnv`i!|(bJ1Weg}R+y zmgGoGewnX0iRjo93X1Y<@7Xq|J^MCUXyly# z9z3lALrX8^y5V_t;lzlgmQWyreU-@t_qRY;K%F*X;R#eIj=b;qXZAW zbGXpQUfwE~_9P2Y-VWzs_*tS%5FKE*m8G(;l=IwV;dwOhh#cl3eazpg#|RQ!QU6NL zsv0dKH1!M>KZ&m@Z{ERY^0T}gWNm9}nr}3099zaXp|ae3&1K%^9ulw$HI{k`#| z1^tENvgrN|n4xm8s{TGr%u^)N>8`c^fhWr`{$KW^eFy%2}aIJ>Y61Bu%}!7nmln&j_?$n|*{jXgsc8`+P@<%f$Ivl83YSDZ19+?Vukz)bCMynqpnbTTd!&yY7RvA>dny2u zXpfO4{t)2Ir>~Wk-pPs3Sb57lr)G^i&qu`Wlbaz~)p1bLjMfLgJ|`~iO+B+8W8J^o zmrk~P*dhV@u=6kG>nPDbYg?z^+DCD5cI>bODe_o_(}Hq1iP3^6uh9a-#p(~J2dvcz zQt`bv@k;9QY*^&RzlZb@lDu39RgRd&(tGnt%#2x`-1$@bIQmG7!KmcnH`9^x^^YD~ z)jg{6iU)aLOK$EjdJK>0Gie}Alg|NIV}~lnXE%jpt5ZBNTVSxVJ9G$}z}HwJ z2ud&K#(T=MsT<-y3Gia>ru&onAFm(L!mgac#aI0DRlXN&M5o~s&vV@@x*GvPiS_-VG1Ff^JK);%nA2#- zbl+%YD2iBoV!5rVx!qUnT zK}&PQ1>gazslYLMYe~omYKS<>{+i%$Azi-b)=5$`FEb;OB;Fy#V8i!O@~D>eWgkk= zqGNKA;=7xF+P% ztIdcb6pA(WTzR*sn071lZ5oiu#H&jb3-|2}UP)W>c6-RL62c5>rlh&Inoi{H(~Sgk zT~qHH2jdZZeSwbzUb`Gou&R$O8%AC{lsN0IsxLdt6u1o1`@%!2oa~Rz5MkIe6?sS5 z@Iy+9qM}*B7`KfRxco;LZ)Lsp)DT8SR3UvEgiP_ApBtMJoWxGTr7hY98Pa+!npIZz zcIRwT7;PUtL0Z{Pw5R-wfA^OO6a~Bf{FA)u_=EhiwHVfAHS!s`jR6`=PU6}V3|19V zW{yAy7clZ=y}v?Pgs3LXaqEKBb4{_x0JS8=b0R#nqt~T7v^QmnUk+aa$(67|NXa@e zP$RFrnwm$Q=wfw#^E+v}5{N$DTD~h>KFpxx(>0Lg2PpY#D8d8D)4X@5g=$3u#hhalv1l)=KW>b#A|9J2hH`fj0qm#|0wYi z*$jqmtMRw``ckPL#`LiM{8+RtqW(&l?lA(fgr#1e6<-|gVl+4thClvJ%1*S84V_VT zf?#VcB|U38Yi@)}=)DlQ9mw2xXZ|h3aC#xsf*Uj(}w|O{|SQ}W`g#i7&Xt*za<=#kH9A#u` zW95c1kPYs3BdFo=F`R(&HYNgau!6L!+}g586wvXW7-?@!0C+?HZkBQ5(_a%hRy*M; zgDbccnIJi9hS$R*zOvCmc*7EzOM@s%cIMouc9vMGO3I?5CeClK-)t1u#sxec^hoo}U==`b1Bj0)vFJU%Kw7o-Nkb+0LPDp*i$bMRMiL~P+A4;;~gm)P?l>;3 zx>{SCR*9?ZU4biEcP^Xl9r20RrzgC}hTbXUBJkBS@&vL8RMH16|FyG2oZp0qI94GE z2IoFNKZAeq>b(k-wKi4$1@J9ph|ysb)r!d4Bs9lL*mWwkkAk62Z_z~akJK^W*AN<8dS;tJQN2VOukXdb^GnNvAa&08 z_kC1XV_cvOK|z&`@Mv66y9C3vkU1dZ0n^3wpC@zi862T?^bg4F2~y`?{W?t{Mx0~l z55%emhytx*jOGh!Xh3-iipP-Mio;w~u2@pc!PHAJMQ(56tuv)lNoiqdibv8dT=FRb zSE&49<)tMWN^5}yx*~Yd+H~|}lJSkWZs`pwmrb%~Kj`Uqfsqr%i3~97^mfCM28`@_ z!;X*Z`_joKb$l#=R>E5eGQC2lSTb@na#z0bVCSdhISnI!dB0$+?YQWokrcn6C{YBb zh033@xMZB07#$Zl>`ApHI>NL>)YZmCxM3Ylfx1jxOp1!!g7qbz>y(N-Fz{#OyV8~v zL1Qj^VtmNbj?w=yGuOA%}aRH1Tl^&4B6i^GUPnWcV) zt15e#==zeXuYVi|GED{P|NbYjy4D$mNHV1F)?{6V%_T)FPtbKH7pz5MW1X@2?nfh`EPjT_9$1dUggd1cs2s;VHGX?boxQCOhzd z;i6TstwAN6o7sRqV3~xJlK7Ca*#yOjgj6^0xTJg#pnhXXjdae@-ya;&5e_P{wKT5a zxYw@dRlp-1Bf z=Uzt>@*bES-jNh0X6?#{tjsoX-SJ5Z>#Ckbng;^yQoUa+NhxTw9T*uoSL7|EHV;X@ zVlnZArG9qhXCg)ajBz(H5O>t$)Pmb7*E|d}|Mp4IzJOigEZxzRl>p~2w-8pus<%z^8VJJ`i@*tKt5)ZA#6k0*6kcr44f5B{@Kd-ESEQg|&X8#T9_I0+ zj_4^`H3GN)I=KIK&+Z((t?g~{y>a*{F#J@{>ulfrJMI6wMtsp!7OH{qE*xX$WIPOL zzr1=#eNg?q{n#&eW#7}5d$nk_u6fJsX??rCT2{cR*=hpIM@Abdy0nQN|9kp)?D>EN z(%Z-6@q8iC{$V+We{X2s*bLxvUuhPHW5M_bL**_UEdV(s0m8vn3wnS;aVFpdK$1!3 zkJ>E8^|dOE5_bR^HroqRSA(_ckAu>DCOO%I%KQfcRJodfwKnBv7ipqjhlQDe4h=YH z3Nj2J2aDWVR{^r-dMP7&+xIv}Q+qC(FRICD|In;t1n3E@psl|! zmzIuhDKF;tG>3CYDl?v09!y6ysnqVJi2A=Buou}CUil5l-eB|0vYxxu0}06)jM+aj zXgNmt<=psrQ8cH+5`fPJ*d#7_$JTOl)`r^Lvwjj{JB5k7P6$O>lx6hR$If`K>?^^b`7S~YKE=d@!y zxBrf6e3%HBM&{&#l~$Jh;+yU!kPZw*PJy=vXx*XY*$;C6vgghZ{>WT)GxS}uczTD2 zkGx;KzF9;z0T#fp{b|pOf6KU@+nb1!_rX0up{cjs=(X^Hjc3H131CmFZN$kDHhX|W zN52#^M(nU{Z0s%YsucuV!P0)QTW1}VIJea|wmZLr`rOpKaWemv?NnDPHf zMWB3+BQUq>8L=hl-`ur6lVG3&yzU`?ri*v~@Vw1=Wz0NN;}r;urQbG;fdtxYplS41}gy*7`j&s*n37YExL;+4ampy^>XTk zaJy_rWcua6d!kQ^)g{&R!E_M{U(0Y{_T5WJ6s3zs!b%ta$CB|w3E<+5!LQedk7Nr; zOXfoFbvW|*OqM4+r^PF5*Ce~Q`|wn6=kA1Z#Z2^A#bA}~sv8TvE^E4MKy-sfWbrFo z-{UE5wbDD+jp1Okjrvb{xtPG`<5S#eqO5!mtL3F})>-hE+3M*^9kn*d(PRGe5SALc z1ciANzGB7YTE)4UEX`K5%q_XIGT6jsk4Q!&)pFYy$2Kxf4$)OaZHpNK)?bRbIVVnS z|1TNSVeY~8b;EVBQsC#YxF|Q%&Tgn45|A{f6+Ng8lx3~WSU1PrRY@s<$MRlKCE7iw za^jN0W_10>Vp(HtgTxe`&?BwYOguUxK2m&XS+RR6#`(O+JJ!=qCj|$(ZFR@ z!|iKzrbcV%K)bT6|2uiXf&7U6pND*o6A;M7DN=ifh;nQReA{(?Mhjdrh1WH;V1xv4 zO8^PK#?_~F=77uw{6JX@3x0;Dr>WB0*sQq9^MPl;#3*q}$Gc)zK($^>%Vb=zNghcI z7{Gh#SlHSnqBu#I!X!jF;Q&2!(ttfM8uVp)WMv5p0JgtbvoB=lMJ0)?M=fe{EQ%TOEgMwlf*_w?_M(f{oRMCxvp@gg0w(rFe?bc^ESRX6b1fMFd;$(JUfqkEz(G6X zp0JMLFk@0sxmc%p;LiOLE#RxK<(){bnF8GUU15<1`w&Ht_7H6!Mil^Blh!T2C8X#S zVjbHFTpPF8gHIsday(LNI(T1t&jO3@eas)}0ICf5`>!@J+T>!Ygy%g12FL;$fcoTJ zxF@Lsi((bZdzG+YmP6ZQ-5a@pXJoqb_bMw!lt?g+lZR`tZuhyS18QM$pG+LQ8 zdAUMFOkFZKJ7TVT|A>25Yv;J2&Twrs~-g~a?`TNvmQ+p zpx4k`b5s!eD3r83hDiR;jCKC|Ze+iRAa)pt2oIYjdeiG?|G@UuJ+%?G!mwbkt|i#Q z{vAquMxQc{PD-3lBa=dYZ0GI1@l(TF`e{j4Lcj}2@@SH{`cwMDTE!wHPDzkM1JJ3a zACO2_go6fbfGVn{qc<;Ehal6!?3TaQiiHoJU8j)PpHaYWV}sk=6PL}hj3(_D$1ga1 z%_$yia;Z2W-zK_v_4&Y&Qw6L{t;ghas;|(eNAHzzUPVmWDDId6L{W@`v0fF@K;BP@ z=FdKeYUibueEY_1ZxEZEcUG^P)1IyQCw0$+VFnxPGpvcrl7VL)o4ge{ zrF*SVr&xJ=j+9?gK_@>e&SlhC@ArVxIfLMy2rB)$^bg zK^~XBUg4ViaZsuGZf3>olv{DxJX9SEHe|;B--<0;5py8Xg4uMi;QpDRMffu^qU7A# z+KZc;r`vZ2&k)jYUBbH$z9$(!9)#cgk0dp2ecy1^e-G$VOXFc_jBTN081EP#W49&2 zH%)R^z9D!g8~u;gb_`pg$K!$jt4!ryDQ)##eJURMrPe-~p5O2p-@Ksey%B_hn_rKn z9e(yN;-N_3!R{{y^qqG>8auA+>SxzeN7J-uA#e^Q%bnI+AO5mNgrLka{=eFs0O=AaOd|(Y=g3_nNh+<)? zZS-x2ewt257is^M?^`&>cX~=hTK|M&iV?f6cp9R5UXeu@k!7X~c$w%vJZ;S7IqZtG zqjTqKJ}vl<_6+}mK$Z>3Mz~}d>B7=2UmA%1BWVbgdP)8CnsD7ieh?b(T_ET^`{{?> ziih#|=5G6u{qFbRRF`&%4_EcDlD&?#pZNIJTqB#NXzJe&1!wSeR1NwP+)pHCfO{B; zq`FlCwqE+ijy=4Yl`cd3qy{Ml-v3pNe-Zf+`J|zIQ9$#BiN8Q#NS8rMVA1aBn-M`B zwS2uD6S0=(x}@YMAf(KxPB4uU6ZS{Z_|f7@2UD4uEW}9&uqYh8nD^RMwx{6$rWc2g zw$1Tbor-xRjyiHlq{n>I;6zJ32WVia9Uf&YdApC?>Giqo=%-2{VE6hl84PI-{@{qI$ z36?pO+C$ADS$7pMI|-^F0@qsp#l>lLR}I<4ueG^y#+25^v9eBCzy~UObQ97#2RLW7 z<_rueBidHXoUzh?_@_~}oArD9PZ>ged+Wr&!(s%yv_#+c#RqSpDwRzS04Etjg3N31 zan1nX%m|s&Dd;i+atJ@?w_j`mK0U#YBNq(6|Ek4nxDLTh2$n|LN87>(5m6A`^j84= zH6_>zbYj{agTn=lw4X+b04FvU&c5$|dEE(XKncTyU@LEc@cp zcu}BsOL6WM4xj=^vvP)-Enm?SV>{4(j2M-@dRy61BDyfqO0TWNngHkB=^eiv7b%*h zUVp#FT*j#4Pvs5Ocu)1fKwg#4`+Id6B7g_TEu&@*E|HMA{0W2cJ?{+G4l60}O7al( z*<3m-rwSK%t~s^;A60K1)$|{?|8Jv1x*0V(Bm^X+b96{|3Wy*rNR95421kPulNJH# z?vn0QX;C_U@6Y`^_kGUyUk+#6d2f5~`FdX0^|*$eM!x+5gntqH+)IflC2=&w#Sza) zjS)?f%klvJ@jy9V7!h}*Q{*O`WkQp?ZVnAs5vfFbeBTbBuz*^ZHbSF?@4ctDDL)ZU zV-bh`oLn~Hp7g+Iv~HO8)(|9C+FF8G%OiNmLL^VL|BC_G;$dOpe zRr?3fn$~Q@cng@1PGYwS-|O~)i8m~=?Z_a&JFVc0qvz;T88zK$-O+5$!x zzun?SPzl(^TOa&-x+c4oIXl*zxz%nr;;hI*d@|V5=ESADKOmsE-?&T#nXnqdM1P~& zZC?w0o6g3XUbFnAK#>g+B;Oq};Db#K(*1M6|KNQlM1*W|FIvu()t1dNT&+gBQ+!U!0s z1|3vuRq`{aHOzx$c3$UTYRs&FZWNHI0!o)|9-|~8Xc%tL^n`<$#thpM$F-rBuRM4F zC!^jOyI_~9H|>$ScSt#eI>MvQ)_|BNB4x!1XP z)b_KOFB{XKD2WGHtZX!;;M+Ir$%p^!58`3bb!(2K^TSVmK1u0>p_9j8sAN%*uF5uS z4VI_5fSSDL-4qyn>C!|=Vb7aIF%!Ne;4Y>eocS>Z)_>a*Wbo70<7M!OKa1(zY&A zYd^$7q@s`b+Y+%anfs}R#d}fwIHWO+24sx`4tPuo*s?N!AO{AvHPVrmR}q$-40l}& zowo=8|MZA;jKy>k;Y$(YFEYVb;SHA{OA$#>+1e*q@yi(UTD$(~13M_3+e+OoGA)%@ z-;?k@*StPgTDTLSLG1zj%3dcm8!SPJ%)= zf$j8rg=&?LedKp*avXEM_$cey7Bhn z|B_HsIck4zXDqid&}N0q$ol5oprpU6H~UTxzI5V@nM+5X&o`*c70;$r$fE|>Q!(xk z66^;WwX73$=u9;U9H!Ws=W=h}*mJ0@negV77#VWKnySV6?Te|k^A^9C12_8wqDK%! zv5`D45e@XW26Slim!qLID~jKKf4A-YhnK={yAOP^n#u8Hb)(u@fJs~__sYT7J5;nfg;r7T_1t1-ulCl@^_OcjrKg590 zc$`t|KJ}k?kJ-4qSf}}>0igdvSUBua*RiN*RfunjRos2)##P*3_Z48~Us;Mlt8_A@|54<)6c+&&6VJL>|0zC!qVB|~ukVf>91@AtIm-K1ci(oz#@4RG!C zt$+G+V4?weuw??`1&?v-j>;4&U|pDo+cK^*72Hut96BIjiYWyJ$Lvg62DU~ zM(el=sqNY=Oo3$lJt~o6SwDMwY1#+}bYop|HvIceLQ7|dy2_lH6Z7=H39eso>8stU zAT*O%bpj}2Y3vswz?Q9Dy$WqQh@Q=)I`l#R^Zq2oK@5!>kO>lNskl?5>L`cS;Lk@8 z=8}ITl%>_F%C6CBrcm5}VDi|=Tke>9@kG)z-Kpv_E<6Coy1$QSu>arUaexLKC<5bv z5YBtsvo>yj&%1dIrF5(Y{5mGw@5_*RNx%#>tWix4EIrOkBbsS(jMQT7bba>JdA$x7 zz@;{KGC8bnQj8iu@9IsIQBT3ZxQ4Aj1~l~jx|Tcnh*z!w0J!Pg?921Ycx!pMm-qbb z#J;t%umR?`#l;r!HQFIR71};t>E{mw#ZJ7=K;sd$hs6ZR2cRF2ZG{DWO~9SN z%GvA0cTC-8B?d7BK@S<|eyCw)=bkjla%kX_OYz6~h-ZkuJ?bD-;1aX)NeojNbl~l+ z!1FQ|sw|U8Fz#otH!XG;$G0|xeCvfC@2U@gZIv9N6~EXQ?Gqq#;4QFdP2 zWi{UymGG{Z6#ZIJ*jsuaHsP9=ni&q*7M%{H`sGDC7KTwjs#Cmd;uSEM9u`}csE%N^ zLMkM&HC6>?X&;b7?I4@B1YNF+uuGtTPO$km^QNYas$H-wV}Lx_Def0QSj1?_5|Ad_u6zE@yCB>A5Pk-2Yu=~ zfEqQAW#e~4jDX&?Styt#X^Ib5T5O|eI%3X3als_BF!6CVHLfv zG(G6ZD`Pztg9=e;$Y-w~d;MDmN%oBl$?xI|MS+idZhLmH+(q^)SZ8+bWr-_TgAwv2 zB*b{Y7Ou@x%2IFEcdfP)H3pW~t8F;GcKps~o7}&zLC_kzVCm(Q{O%lJG(UOR%74I! zpSt>O*b#dF(D^Phx z!mew8{+zlqt+`*)1liJsPN3Xr-n5lm?FoN2f>?dqG)m z=Ec`Fg);u^xcTQ@KiY9%Xy-ZBoXLPP}pT@cn`zZz~*x^T0j+XyOT0=$W$=^lh z$#+`)by-#D?>qV?19fuUZ-|c}q{EY7Nep>y!Xhe*oon9FX2{04?!`%5Pqa14kUjFh zUVvLqSe?}~LhJCV{@F(?f_hAaR~i1`~Ju zRqIf=wDrTJ*q6c4(cL3m{Z;CWmV~qDyyO34td*!6gRz$D@QS#pk>kPKOgg3$#>>qV ze#IN1P14L@x0+tdOhBXiQUa-Y^>EpK`9Jd3YGx44;)AjjFq_~W-TtR<1>XYtR#=l( zgw^RK=x*hI^sTwT+sm`7@<(6|6aW9KTmDY@GPh?8k6(2%$nA^7qneHiKs#^pKQ+kZ zysAoz&i{EDs0iKur*p^X4<1v5ANV#tE8c6x|=5;((nZ7S=y?3i`7){~a~m zq`oekjWs0mr!~v&aKEdhyzq3J=W>jUNiln*|BHC*!1PpF-)!J8)&!& z0bHdviM|=7aD2|Yq37nfS~=;J+!fEFJn83~}mWpG`#%dptCOZyjGcf|9(ATs2Dq=_?Rw$=LNr7ceUuh#n z55H|A_b`mv4JYlTR(^5s?h+Hf@>JyIz9rU!~UZ)bMZvb)e_p`s$2!#K4~~*j}@!k@EN`ERMvW3Cb|` w&Led$9o-es>P=OQjezfhR>1vn6 z0V?6U)5NNDjKOMEk6dE4BN)5>1z_)`Koy|?9mL+)P3e6^5u^XQ^DgA0{(PpUA|l z<4F~_0dKCch89RZdml)H1HNH^pkvX|9_7&Km_q?2^rye1M$H3PG#0_0)_v^};Yk1l zl;*vG^jl6#s5u=aUP$>q-mxYYPaJDGc;6adEFe0^lv80V{TylQPXa7opxZ)w_M6|+ zZ3KW7ku*__-VY2Cm&qi%FZnEF5rCuo;ug3$Z;kq#`kGKpzVr1J-3)NGMS1B@J-ish zJ3hXc%*pf8ESCi8X;Za@k{$LbbrPq8wz5iQY%L59b7^{H&Ttfw|I7Ruv((a|dy-_U z<38lTgUe=pEt5!RqJxg6%mZZXsE@{{EHWJiXM`%41nG6f~$x2 zw0EI6fwqoz-%E67O3W5-9?@I{Td0GXX)L*lAZ*Qh6#<)&;>c)8Uy&Yu#?Fp$?SN#q zr9J;)QZ>E}gjqEN<5d=>O=jrJ9Pc$}(Bp{K7Xs~(l%s-+7Pmxh5{Cl#q{#7k_~b}k zTD00syu<{@a1pyrj42&(50TcIICvAe>Pjitj20cg8|u(l(#++OuMZ{t6sq~CmorY3 zxE>=w7A%WSm~%c5m>?vqK5P2<3oe@lid!tYiZ`*gFZCP%EHU@CExVLI{P2oG zLvVH4NVL%m&ckpTF*BPIZas&m@Sf32esKMGiJmqh2%h?8jn-n0{wqQoeA+(jDTg?% z;969PL=!SBA;fyJ9kL9hhf0(ig-`a8+uzj9hT;x@_(@-aISx_wG@%KaDgM8y;Sy9GSZ?WoB z+?s>=ZU;7qP?nyR;j$G)f6^mu$}6kSO|;crss{L5qQ$BD&OCAU?@Gv3Q)r&6kdoP} zSS73m^mk)oX@l#hAcN$Tlw6?>CSHcIRpCogw7B04=E7j zgu~y!s3sQyL7h&lSnP^e5=G-l>a4E2AJvbLD-OPXu?agrwpn&s9n644BxP)PSU}mv z+1(vJgTw%LGkm%SfHpDWIa`;6mdJr&XkCSN2GF;SRlq+% zI-xPpD>Gy>pT!2FWQ#nu`pN<=CDSY?rO&6|4&n^tt?&o4IjM6iNq_yP^JY#miPT$O zoN7RzKL#7e-t#ru#CiG}#&Z%}-{ZboHdU`TjLx8t-e>cDKjg?36$s3Vd&1&{sVSLI zIFGOp8KmJw?$ro+)`k`V9i$!4NogDj2A}?YQYR(9+0P1b=Y4qGY{)IWr%3lY;J416 zEGqO3cvk!K6%;SzNwQ=PfcZ{D>>FW2Q;0jmg&&~q9T*?lBd!{WsU+5EU$Xt4qMABv z@>FXkV*D6GqHY448peFJ-ehXi-NasTB#0S<7#F-3=UM{Os<_&*J;K1X_Pi}qvP-W<`eZa+^& zBTGu6-N$1(9&SzkE{{$|@|7$2*dQvwgZacb8bc~k(L@WMo}T{nMaTK_e`}T0r^}Dn zK9)C2z(}H1IQBozoX7v0T#`U{Kb3>x8E!6ssYS5m?c>A$JGp$$zj@~-3f0*WGra-( zcn{X&-}B2j>!Q9?@md=7X?0?77FARzAWQX(wD5B;yQS9vS5J>a7DusSW1s z??En277dclyKSRD-^)IOv_m4(I&iq?gPAzY zzRYJ~{gNannonO5h;))maR5ST=F(O+{{qGlr~L8!Cfh(hO`lcQmg*;yob1djV72g5 zLgen?z0?%lt#M9Hx0zr`jq>+MO@LAjz4*Lh4@NxOcQa~zqu60Spa9m z`y=D)&pP#Vk1aPpmuh&@WX;IL!kikEguP?R_Z?Q&R~5bA8Ix5hUDTeMri)2%8~ttx zKc`>Qxr^R$dBIkpXCD&upD`V9`IK+dk5|`J${X*jte3zKZUriEqO21Urp9*sCiU_P zxC{Xe%|P>SWvN`SK7~8JhGAUDl3Yf5sX0(nYA>nc1DD03SDy z!y3H!<)rElFn1Ip>$qEjU|W=?kK!k_qZwPWqEY7Dbm?}0rnZe~WK1s3ml1n#m~(a) zpp;YA+!T1nbI@W#!>*?vvtRDOW%PyKUO)LI+-5Qf9l=braALr9%&Js;;Pe(<4n4lA z5h|Z503MU04coSksvC3)o}poFH3ZCN&dXi3KTc367~?!4>CsRiRu2Jm4h7ehPZ634 z?+H?N=N~WR!JECK&$~R7la(1gtBI?SsuoV^gD7Hw5wm9>&!;f#4Gn7!RNduR?M2_M z60LePuod|3afDhI>>E=g2DlMumYUEi4N^;-@vD;6-Rc-h*kICP+ zuLGKd9VW#gd1jNA*={Vus$lStSZ~q6i$qoxX3*!ft#iFlA+=)G>!(?E)%P-ud{%ue zC;@^{8Ct>-TM_F5#No8aei%@vSW5lM+4%c!STd(3#@0^|f{ypO%mYO{ZpdJvYRZor z3DVC-vqxVyVh|AI5W(6D^%vwh zgtnmiQMUO9Y3<8nx2R#rLa^iKHSt_6EoL^1|T%iA0drPzK{mAhBeANA3h@-PO(dkIdxic7U$bhq!|->G!`cj#U;hx-Qq>FVJi-?n2B-_8iPKBBpmnTzx7 z-wM*iCm!tmp|{4QH7?pAhpo^oXQkVxM733Idu!fCG16>+JGHCPf8zSJ$MW%?bPvPh z8N+tz{ZTH&?eXm$7Q?N8RK!K`{|q@-|2O2U2Oc_Hku6<5e0juGyRA;Tr~0387Owwki^=jW+ZDfOaD>?x1S( z=svK>`8vO zQHtwgg_sHn&pEU!pl(loRD*280+;IDJFJ~Mi*#MzpdcmvbfOV?>mvthV=-Edi&=B& zq9YE%mWo)%1f&D!nlutPx&v5=K1xxK#!r>FeoB3}unDV%%}_fTY4wF88a6o|Bf~h@ zg!?z2PZcnVEUf{_J^Mb1F(4a~Oo`D(2!zhO&9z6n>-rz4m4+oUjew4CrSaY;?j>&H z+t(|pBz{!dhU7pJcpRuWS5SON0e$@8=e0`Yi32n)Q^_aYs8buo+;| z7%4%ta83T(Ipv?gD|1pnvQqV9_|y*8lVv(bmGKgX#)=*3>u<$fPUr{&-IKjg*Hh&4*-DYwSATee{JOi4WViBKo zaWh9EuwRXM6o<0+-C3{KKq!G+_SSJjlwC6KA#^Km07x2HL>o=}q&c`YM0zXOiCYeN zclt-QGgv?Upk2ZB%7t4IqpGC>HUyh^X|@c;+ef{k{?=*tU$h-4&-j*O$JsDtWSA6n z%PbZiFIeW(WxY;xT|THYPp%1NNMXUem-&4+u_mRU?=X`##iSUUU@qNRO`xxM#;YM8 zxKBrn2oIN4)Us-9$oE<$mrBFt&42?d%iU{?`*j$Es`K0MwkCu6(?3 zYy}%<0N+gd%uW<1v-QqB>DW{Y7c<^ihw^(m^4tI|~k;!2L^jU9x-Ec+OV|EvRMdOUqpqFn`bUkAtZh_X5?-zi1XkeSb zPiZ~4y#au%p0{m0JdpkHju8Nc5FpZ}To7Iu`u-(p%(2JOR3lpKv#2>tl^k1oW!*oV zFn)6s9mPm5jE%5Cy&y#{(5kc!ku)x5h5`UcSZT4uYGPqO6xiTf5BP|!SHl4>@v)+u zEZn~}?99$wxbw0{ru{p~A5ZJ~sJqfTa~%t8@xwmb;5p?nhJ@BjQdwc9{6Rr& z(oJ^^yeN&9K11Y`Q zhyAY&jaot4Q@^uicp)k+s3=dbcEWfrDj&ZBUqX`;1z|2%6B~wnduj>N)SrPl*nd|- zvuA{q8M#zQ;09u!)imxruW!OHZ4s+DX`+@ylVTG94{YniL0d8!4_j;o1a_)RQ6c)- z#v16BYpu}{b*xOH1@xs3*TwrI1R`(WG2?Sy8y}*B8C!ULDPf(=*C%p0XCYO6PRG&j zmuqZQR2@D_Fe`(rhq9ScX__sEo*|fJ%;LdB(_tW#g3{h)k$2u(CiGZtReVU;lFiuL zBbp;1oa=5OdLl~U?AaatZRaLKR2F2n>~nTV5fH7(F#QO@o?fZFIslUD5>ir|o165P zmzTc2{}4Q5HnXAegfTQ{NT_3M(awbWHt$4?-sR1|133RXbtM&iv9CsKvmXw!l`VGM z`9`0?CQz;kCxU8%iA}KiPxi)Hqt(n}Gb^HgKmiNcP99M}^mg*#F?!yzeIbCku>V$2 zAea361`L1zgCi!S{5`jWWKJwDSgzk^^La4b_B`(A*2Do##7+kyZy4)Fr=p^;?tnT8 zCLl?#b`q|FF=B&5rlC&8tRNhKzCe6}MUs?O^CD4Td5u^_@ehIg!gzqw@P=d&H@Xou z-(~Q%6xjU9m)sDX-%Q$RnYQonnE)K{YC>QEoTLwNjH$|;`Z3&YBU^&juETaZvn@}E z$;xa{fTXg-_mTKQOYaP*xFcXf2|})hZ<92iM-~S$T8UbzlN{homF{8|B%;UW-W#mY z36aveE|PCuFtYeBhJAj^VuGpeQE=Pl&6|qdSoR6e`KU=50cS8ZBbIEPqX{{Xi_FKG zKC$+!OL_NJh&an`EcrXDc;RUa_fxAlU1AY*npP%Ms}QDyvd)|H_?wJ5j~Icp#>L+I z*UWD@9`bkLOxNNV?ho2i!c51cuMe=U`x?q47lNlJx}ut!URV1`v?TBp3#+GY%m?4k zpXGL3=U!#!UsJENs2a8Q-?|5|oAmj&#nTNq;EVIEkc>8E(f6Q3m-q(#fR>NV%b=6X z1=-!wdzTzjl<)2Kc+VECB*C=$3i=YBgZ$HA#70qWmlh zn&EQPNtkcf+q+)V0SWDJC*%|%DHx`M?T5SJrN`mefuHKUoX5+Zg|uOb!#5+Hu%K6A@LGFLzSiLX!i{jyE>3; z;oT~gsyJEvZ3v?Rae92HbD7us`z{i>iGWIxk zlSyyMv}vPiMPqV~D>2W9LvQ_5SRhg-4P&^jxACaPnWou0p%Xu?=74iV)FD+lgB6&H zc<_vsPk!STO$(_9r7U1Ob5{D-Qn)Plpty5dVsUkbl==SP4{Rr{Q1Q~G6)i+NA^!_| z+}{JZ$C?=#mBm@JaDeG(k1Re=;baIvTz2Lfva63kzKZ)~a=^`phyV6X`;MQ-!$=#H zjHf#&6)__a`)YU?VJ)ZyRSD(gf1-!9fFHJ{T{+b;FVP(T9g@bI6cx z8NeBz8H6U=u)-(D(G((HXxY z%Um4QMRZzoD}GmqJDfDmwXOG4`CUB(&;_`==RxIrwHts<^SN0xPYfw_d z;W97k!oC7Uu_ib?mD|1{KJ(bf+JiZ6#BbGqmGU8ivPgEYl~+|+Mk*BE z(thb}=XH-Qx-qnxG9=2Kwno;rChlt;(OyqcX>2`5ep|s(I!CU2i@0a~q-0->?5D27iZ zeRE&V)qgMA8&eyVZ%L=H2;EqBxADj>uDyE-(zONH<$RHO>_&|{`rWZd-pj5s#ze+% zj174Nzx9@=jItzQM+Nqc^XX9qxd*?J`G_s-vdlap2yB;He#uRl^Ye?13DRo{--PJx zmE^EpX5FKDkB;aSGYYxt3TozwLrz9i!*eA@w8^OJ(#&Y;gskmz@$Oxk3xYiB2X^x7 z4IEnqdI2RgT5Z+F9Ns65Pg*%od?DySXCPm3FjLz1%gb8ZR|(4Ac2WLmnB>-+_|5Y7 zB5n6$U*jG0VKJ~Rg;@^4xQZ9_2`Re(K;)kBftJfR-Ks!~|I2oV*9~^JA3t@*V?$I| zcA>c3Rt!(GyVo!x5h&qaige6>Uq=7e3xJ`>3%ww(cm@ohKu({Hfm0&y^-m6^ndvJq znwG9=T0lOq4;mHZ(5RKnad}MFg{Ma2*t7OK*-#=v_UcHp9EOeQBXM#jXibPyl47${ zqq*`d^U82qf^Zcw%V;MX(Naa_)|1d(`AUc`3f#In-_MYot`U+Fw33vojpf&)r?V;Y zC!^_&CTidFlVFcT+@KC7|2;uU26j8YM3>pvz2_t=j>~&iUmp*DV?NJ3!3jAq`}$@= zE2G|JUS7o`d&-1qPqL3PlaDfXNJkfItX z&OoW-)5VC`XsA0G(+J7m?cR*NhP95zF1$q1STuy2i|rv!U}Tr!7t~)A#krg&pM}c6 z6*$9NmaLBnlWQTYUJxQ*UQ%E&7@Gg)$D-7#h5c7G-9sJOJhFVGsIoJ`=cF#?1!c$U zCMOy(HM3uaPynU1aj%Qnxx63X?>52>{XX^rtVtXaR|O&HOkgkl^UmxA=hb;d(&TCE zq+hlrIOwhob3MrxquB5tDV(h*M>v7BZQ!ePupBm~Z8Q&j9Lqwi)tsAC?|Y+kh^|2X zeZw^P^c)eM)Ec_nkF_z7h`(TbG@KmU2fHNBeGJCYjK5W^QK2ylk@+J z!7E7fG(~>17s2qy(DwgV{rHug?3Gi$Kbs}i3wB>!{F;=AHr%xrJfg~6bMAi}^l4>S zn4WJ4EF_<|!}p(qtBW<<-1gz_EP1nLizW@m5|nMr1tz z&E8l}wM&K#lEU%#8`kFP9(p~hfuaBILG-U=9ZwIc!orW&Yp(d@lH!Kmk(`ko=PmPb zNBq-4u`I}r!Zz!5t@w@QIC^y^k> z=#UMb<7cFA3cToWtghw76UzTm=0{Ml#UJmOOQDr7C9ALB)z$lLjI;YgXPzg}HzM|M zYWcvFI6&(`xbg1sK#Zd&Yqyy~N}gon#%4EMA6m8~_n0U)6!Bl!(?%K!u zlW(Bc{+%l)BAb%^6NH=Q8h21Ik1{q6XQ*wqG~Vs?VFajs&4aEFmX)@5%l@~TU93$P zk4by+tnC|{M!5TNjQB#4Y8%LY*VAr+l%=nkgEee9lRf_WC)!CsXVvqTw+9==x1bu* zWNZassifsjOa`cEn6-*1DtQO_q1){3%bAGPVUPubWsLIzGQBZFCH+vS@BZgD`6mh= z@{~Wr3;*0Tmv8Exfx`yXbJe|+|CyaPq>6(sh=tm<=;qg+vp*q@P73kspRoD5MHWBHFUzw_IU;ER{$aY%l{+HHvwa9vB9f~SafCw|v+RpjqNYg*u!1a3l_Y;fX z1pD1#HeIDSeGyFu{Pn3*mEk9@C&^_v6|g9Gi|^{cw{Bko6yAdMj%fcry{aMI=Nh)W z*kgr*o9B1Dl)A?jzbQU{#ixL5^Ajb1DDyr0qb|1Z7mK0=Ql%9z!VRkLVQRonmW0OH zLmZZo?djG-e9JF>4Lu&_f7RdXipnYHTbPLKpzO060A5rxYd^g{f{uIlDG(z1WyY-b z5}QezoEi#U+*N}pPGnLZjZQb9<=UfaD^o_$$g!;F9S9HQ7OCL|LAi?K6JuO7v zdcyeVIaheut2f0!w95uf!A1BwvNrLAOoUIfRV zcXOSD$Ot!qGgO(>NPBg{)#Rse0=0TWn+oBnBfAi1!>W<)jCtKf^u4H=Dg~yL`Zt$opB3Tv?Oh3fXS&K1xXP7Wj04d7%2c zzK#p7Vf!@kmJTWP&E5eoM|p$rGco5#eia{y10&D!GIN=qV(NSQzxd8iE?RN%xLps*jZE~AgN7-Q8EA;ln6twC{7Q@J zLrLn|2{zdeRi>EYf_BNn5vwmJbkw}wYOiTHMQyV|D%E7;nV9=(aZR+0;fhdpU*AvG zRr1|Ch^*?90jI9}9_m(e9MLGDM1e8EFW+{O>v`}fnr`yipV z3H>9XD5B1P5X-_uS>$J2(5SS0QKP<681EGp6-7EOEEYfc&N-g6j{{&mN~p;nj?`(7 zDs{!)+(zMnLe5K-mIk)M!3C&HObz zD$@Ai0*x8;8PP}>2YDjK+ zV2uZK-)*}yn9-6^ma#g7ymKMs7bpShtjVjD1Em4HFrum4a|Vc7S?8m57rMS*fxa`^ zBi~mGqk9363fzFto_ExCh)kv*O|A4{?WiCCk7(OHZ_`eTZ{#()DtC&{?V;BYVVuyN z)rfM>b6YTk(g_qe`2%T;%jcTSV)UnOEuBhaZ*mb)=2}B@l0bn^MGkIohdP&ozr1?#TV8kb`i(1fbnUrN)ct$3At$YK zmJilc@Q6VSFB3kYP5i3%zt8)m#5>VwRf$8accURgjG=~qZn7{&5ZOs0lO|aFsk58T zAY+NngQr=NQ?n-G4B*h>ug^TJH{`yvWB4+X5>*Y_6~tYNboD*jTe}g4f2MM-<>lUD z!7V^^7!Y3F;Cqd1eD}2bD6R3A-hFjKfuiU(Y*~hb^SP;KkJazrF?cfClP`SM|8xq~ zh?)9MKGK+-9mDADj1y$nFYP+`;NQPcb~MvqNUPRsCcWnB>Y7~k`J_tb%^6E{A%ml9m#nDn& zjel~WF-Ig*VzCUFf$9flhOmFCpJkv1u`r*=poR7kaS8tiAa9SnSruXMqP%>U zZ1gHNBFn);;_O5u$mP%c$-J9Z+u1?g+gRJ@qpF@6JahUWZIONSFQfaCA^V>gq`{}p zX%~*IPh98<&$+MepMjR}ySb}DSiSCY^Mk!q(hd>qX4aBS-B_kV}pk>p3o__*Glbl-N)@=PnoGvG^?SXan)AkjtoLGu&DN=?8=yaH_EQniv4%$EG#Jq{@ir(;gIMYSmOnE@;z+v6#*>` z($Wvx(uoce$d|nn|Mo3#g6^Q{Hp~cLN~QxdBdl&3YIxz!><;S2ST!a$*Ys{C_$FAY zg(?8+sbmmg?Ed52L3?~sfN9HRamRhO$U_$}OG#_Ze7S`@K$eoeALCt#HazSyv>mJY z0`pX@WYfTf!0XSJ61JHnNU&aAxEQ}chn}+KSf3Y--lVH#AS=O0rOX6KH#5mRxz6r9^ zH&OWg9bUZg=5?v?Qd!q)_>)w7?743mFE+d?m`W9p4hu)B;diD%oNGs_*hEBa>*S&z zX?bBrK%UoE1jiP~%ZLK)GrGl^G*B;^W)B|Aj&W$>UOT${)NJJu+`^a$)3e9K)BVC* z-@_2_FG-t%8ko?o148G3@GW>H$!?^=+5m5xgL{tBbje4?xa236NAYA%RY);M_n3Q< zlZAlh(_`05yZnl#HkILMS9edAxPx5V2sYikdE6B!SKa|{vmSs{_Cp%4YGAbXv@5KW z*04r|*LUVloB%Yzaql>o8bAbMYHTeYRXyP8kI{?Ksv|QO+0YdMr~$W<^zgkM?w8_0LhlBzYVrtVoG;;Xa6Ur*2xQ=~63J&-y3#474C^JmRrdL;V# z8v&m=@${mT8E}mt6vfbS@wR5^s5XmIGX61Hu(YNpBP|CffE)gkH~URPq*IKxh-6E& zd-Vt`SK|zVP7C#yqKF3sT;IAv&h|FFLX4lfx?X4x*S3gu*J&U7&-lPexMCT6Fn;@V zit5r=fIc@jW@Np>>CvQDL|R)=nDIWj&<~LqmSb{5I%-WNSYS`$DWTrT>^&Nl$ z#h75*;1cz9J&3mBAApT0G+$r8qJ0D-CH*7MOVKuf-VtK{w}Uqw9G~8PhP!O8KnIQI z#DP-g^-ja~KNHdo2e+dRK_t}NKR>{G;34}Ht~y@>LH^}_At3wViILd4(Ni}7B=18g zMq=$^{-mY7AGjLl5&%CNFs}2c077pq%8t@ZL=w4j1USrq_BEXnF%yK|4u&o-#H5Lw z{O5nPK3i%mJ$sxwg?!-Z6=lI)R8l)l;v~P!Yzu8p$IFHUz4MoWk`{PLi8LfqP%kw_ zeSPv>>=@4K0@WlGMoLNAPysHO0oH)it#A?KI))q-h_~TduBhvlPqVpov4_&@dyzNN z!RtI;f_WfWC}FAr?Z&npYvI)Y?J2ul8Ow-gJ^P_Iv{>3`suH5 zPL6gy*;UCS_hp%AoZctS2!V+>)S~vaT;0UKs_!wUza(=8-d%e8lubWxJSKFpGsgr8 zHJvohG(FMzr{QU$<}|U9BoN~qW=$9s8|UaucQ|C}5rCGi`iRo|IOYHx&lo3@0&;*k z4M=-VB-@*Mw&sR<_Fz_^Ob3%FZH&%IcX!_}Qdniun>jHGm-Ndn68=s?&vBW4ropZK zE4EC}?sTV7RIBOxCS5rGR5S}9AHQZHNi@VU)W_`XqKOJ(NuC`@n-pEvTjzdZbmW7v z)Wj481&te#`6Z5&V#@45Pq=3Pq1_;%u<&H~3>87@M=uJVei?4CZFGb1nBYZB!b+MRjq$wvG9iI$3`cp!x z44?Dvs>_n;&B-KxB^<&5Mz*GYY@17$p*eZAF`+0hV0FdgtTp-PlGi9f)9MA-lNOtK zAtd}}U75UU0YS)$>U=GaPE#u6koESpU$90ZxYpY|y0>P!h0+fZ0~Wy|z4-y&T*4k) zzL9m-!1dT%Hw>tX#zWwJme8Q$rr&v-u{GpO%pxLDb%OsIjOlg>CmGgYmwB#Y1Eeh* z8ym?EFrwV5cfys{#cBf^8__pzy-5>O>#FNJTQI*0J zT_xVH%t%VSXH*-2p}m(6Cm!g1Lipweo|JC>JHGG|y~C2bR6v8dWHdA^-m|lXH~IsW z7E+=sv;8k?!1`ry?7UhW$J$(uQ;xhBa{{NOzg7IQu@wd>2?kW}6V6rbZ&^((2oVvH zNw{wqTp4`$&n_=wJ3AaCO*q2!c8Sl8Jf`OKF4R*UzwkaHFO1_Dq#j-PZ|cp4K=h}Y zsvRO63x=v%qj=fglNPTtf>dYbeo?9Vv#sACJY`KBInd$jEm`kJWGm;T#!p&X4Mqkk z=dk63B!!w|{eA2&-It!yz3gXM>z_zqhrblydNPbJruJ_gsG;c44@7y`R?S#*r9^J2 zMI2F6uILiV2h7mEUH}Gf^@LPfVrmqe3^}Ol?!qW1?Ql|M@`K(w!yuExIx0DrL0aNQ z2~1zP|39kEDlE!2{PqJ3-JJ>yLnArJfHXr&Hz?gA2qN8`0z*kjNlPQ$4bq^1(hbtx zu-|X*{omKM4?N&NWN_wv?q}U={T7Rhfqgub+P$OCazA-J>WFY)Tp0tsBbasE0owE# z(SZDMPjz{L$%uf{QrY*6<5fzuJFbjtJqBm~SrSOGTiRlVidJ96JzdA0G(67uhXH%m z>y&Nb$5n~z@M|IeYeV_)M5Q*9lL4N#nh{$(7)}=R8x_N;L}Tue*3FWb=PZ zRlsQVB=ItkEq3lSi;MX+d(cmHyBZ7S1TqaoN-z*ZdNhe~WqkElLEdsmI5vVh6ReQ@ z6&_xg8)FKZJK*35bJ^N&=U7>paC-)MCZ!12uzS6aBvx*w-vGxsV-%Si5U^%)U4p%c z_#ti7KqSpDtce<6@zdc__ov}&uWB#~jVw~C_8Eg!_;mD^pNYC|T^-v;j+gVpp>&in zUG8lccvplrz-j%re!x*L;hmE)L$c}oHh51`c6UBQ%mBN#wD5p!Jp;#>z0j`7+#VMp z-K8(DM9l8&?%lboomg7ASEAoXfHk8z>208!Zx=*pEGo$!%Jo@;LYTlC!UiquO5WG+IeXWJyL4{yPtFPC7dxaAti#UW$#Vy|EMMSQ@)n+HdcZ%DVL?83Z_u2x zC!aZve`|)IOB7)r=g(Kff#)31025eqZewKW2s`1Di1KjI{5ruH%2^Fbj>PET6xc3d z?NiCg>0?Y$17=dDp7=N}aI&jq$6FvYEUAj9H4sgk`CNSZ{n!l+0JpgpN9DDJcP^w2 z^LtD!(4W|SWiQS6d;XLa8wt8~HU~xEknSmg4WxaNqu;aGhoxo+7;Xrz_K!uaM|d(OhPFUM z+pk99!!-4?)q2<5HIhH|l~mMaFHQmfc`sidx~F_`N3m-Hcow))Z$CmVZ}A+FGPSNEBZUDFC47KRCcp{46%i{c{dol07x zOtIQD_s2m2igWe10fSQwEYOvLkQL(UiEG{Q^o)>P*8<7RCw~oRDYOC{<*x?p!dyuW zm$E^oK=_cE_j6MA*FwG@5cwczEU)qg5n_xlpN{`KP>taM7XpSPt!mM{4tiE_%DEW% zE#Vyp*_VQ(MhPP)cNwJ~K=fU24n?}d??0WCMx6^L%sfIJ00ybU&9RRM}vt@Lel zwZmAde&T6`{DQneUOduU$6nYAz?}w+)xwR2XrzBM>4)k1r$ka&u(zyoZIhkD0?akv zhHx>NMlM*%ac9vsrXIRd$yrh(RTv^NKobYsztGfO@_OxIK~?6OLdQ3! zn|-=r1S)#Ckz6qpR1VNeXK|Y8f@|)5p6*4ezJbPKdbR%UNFter=W?-24^-I)>G|E> z+i7xoX$FMGGPOIpEvrM=^i9Y;r^eeJ{H`4_Z1dP~(w1h3<7KLef6ZDO2M6&DN5FA) zRjfT}w!UD#NNVT?5^}mY@v(U_R8{8zc~%7if2^k4`VD(HAkDXfSoAk5l@>;Ltq$!^ zS%6BIkJB5^7A4)^(y(=TLZQS4QE?*lyz|xkamR*6NLOR=n|#g+KiF#D2_pcT24Q;~ zkhN7zq1Jgarsqu8^+r58IigjXNYTnbPxmzX`?hMQ&}Q!*k>?Lt509y_sNd=vadFbe zpsYIX%#*Km>UgDheBY?gp~n$p-kJ(51n+y%mNCI1#5d5@o#zrZt))wx+HGFC@-Snj z5{6{={kgH1(#I|-Qx+~h+54Y5e;P8<>DmvC_R_GiM{2L{G~LZbcxItZ0(y*O-cT(U zg5suW#o-Vg1PnkBqEGnV4XlLN@UpJeuC+|Ylny2qV{Uye4;$F zu7OE7Ek=DCZ#spkBYIHuT_l&MjRjOlf0p(>JfMl+40Rw76wJAqc;L(jKQ&7gw->2E z`lnfL`2yJgv)%C(=i|g5)sz8I&`mZR#v(SfXUOy=VSSc6yK*!S&c~$J3UsoPbY@1n zkXo9LOiBqMLrka+^SNvv$z%iV(yPi~1Le$}9tOI=q6IDcmaP48z(3~b@vuYs$oeC# zMF?&SQO}Ce`n?GDqrl!^lPnypM^Q;|_3|8C*g`bCqsY}il~r2?hSFN(ga*Yz+)U8+ zf1c^Wqu%mk7<#|*Bp(cT^a5UEEnm4jYP@p4!3fTa$m_$(;Ws}k!vF_73s_!ViqWrp z~Ynp7)3^A^29MK>=spDCKeS zk9aE}Mz&i>j0C0{Rb#9yRtOe@XkEKS>i>8F2nQ@D_qON`IQ<@K$E2mCUt9AZ6SBM@J7N;#W;3-kaWjTQ+_e{#QqjSFj_l#N+D`#1#)b<=4Qg z0DCj#{S>n4k|c0UC^<|XcmOVo3M)#!?Sn>EU5WZXVm$sexzo7c`tZoog3|t%Fz(=~ zP4LKP)zzeXAaAHxUE=(YyTrq*r?ZTXtLDnhR}S>M5h3)q`z_hvW0Q`&1MXihxzywkOV0y~<60I_NQyYwEM>>ShKGU%v5qeU4pv zJZcSFj^M=r??~6oU&H9Lg02&FDW%B5U4{ZguUi!70ENCq^?Y*bR_NIcUiPDIE_9Zo zlLbEIhYGq$RNMNKaw$o62@F#-LSDQZp?;VcFED z>mEYB=o8WpZJ}yDYbw{C`*$y5nd*^l5llaS7{>sVnw>CWm1$JamR-M4`^jg*gIm89 zt>ti5cXy(oJON#|PmxS2rX_X7N)R1cBmqZZ%?RLU6~A6V^SPTp^0l445?ekK^SIog z=#iY{QzS9#m|xu#V>kQ3^7_KgSX~J5oN2SfJO?T1&yLRRI-at#LPeg=>ZwY=C5yBW z#88y(>u5gAsS8R#y&|OCpzix{zK+n4*l%5veCMqBH84ZbayNXm zi`$Sh)QZ_uWRwIe-sLk-1i^Z5Kx02#MLP$E;og9WF#P7|HG=ymqljIsA^Dld6ch;1 zZD2sax)vH_)ZdA^LJ=|?$NU5EaiEzt1T{~O?A2>aEW)|}3>xa(0prn966&zNQD?QB z{#Hp&jq6m6A-uklww#nv9DE+ExUTIeT-ixg$h&pQoFo^06Z-GbkLk7q!ik?g3j= zg6VDtuLe_KJnS&N{#y`#rz#GFEMIM#Mv2HQmyI7lADk8B+UCF*xAS3A{gWyLDVhFs zC@e~2PwV(3DT|SJHW2Lb` zzQr)L3~>FZ=N^s|Z#8kI2k+BN4$ljeBfK@wj81C}gO1}75uQJ1fP znHafEZM>8X2!Pni26(}uDccJnkpgRkEeUU{;QjwrwK35-86xQTMjM;{ton#xO7>-U zwOTb{V$($&<1j2(sFwzJLYZ|2r`#OT4#jxAztSI#H*~4~p?SQck-8ZRupyJpo#SCf z8A*t~jyn6|>rCe)m3-h||FC|R`s@wJ`?{-|Kfc{$aCAzP&DfK`BpQ(nse!V0>}H8! zZT`LqRAy}56#t3~_&KV|Uc-Zte>JMSzl_5vS8v6z)qdiGPiEocfE^;l#q#MO67+ba zPS;!b_M%httGBj#ZE;y{w7^+wT zgzp!GT+5iuLy73ndmOpiJR-@)1`F0cPCxW>Ej$^T=(a;gkLGnPV?SWpwLG(v1wS|*>G{Qlz&3ZGU&%eH( zKZ&;(DP~LXG#qVg51L!FzjV{8&d>_qbme6G_O)TCXzRt$L!)sDI#80dXYxb?G-zlf zqi2cxM$ON^(VbA+xyu@C+c#bNwoq2*akc2q_nDOQ8pyq7Q=MO(rLVb#nQhoK{I?;O zKg1>dTHZz)niR#0yB4zB?RiB zjP?dbM7~at(mejt*|;}I(y`^$fzFFm>6+ibl|piNZbel)fUsQN-+{9%&9wqMXas5> z9OrPW|D55nrdpDlo=A3{p1IvQJ{{rb6iT=)m|#h?vXHAwKmu0sH{4fi@6%T$W)tP^ zALREL*2fRpU)?v;&j1$#h;X%-1YPAbti7g$ghhIvjtMxZ5+!KXj4*xu-GWC=z(%bD z!;0PC?>iJ?O?&Tn!m!rkAaXDD@P@Y8heG0rcuX6_aU8KEK_`{7L!-_LAx-PsVPufZ zI-j=HtEWDRf#v%Vn`7^etIcDd4~~w>5mGqAyJ2Ck^1`4OX zVKzHFG24lq-=UNs-mbQQ$MyvApr31iPpJ2U|4FpR_Sc4!xySucWkJV|Cy78Mx5_(B z@l%IgiEB##JAv_z>*mUJU>I@545s&9q&#-EwRYs4^*?RqS^wV~GQfT`P<#^uD<{9y zL4Q`g*qRfgoxR#P@|ulKSu47RixK>X`*~bAh@eOj6(ta+DE)G`m5WMVv(}sF>{ID~ ztC}Ru|E^8!f$OUQY>*YlEJ|&wu(PJXDUo8s2i)d5fq&M$eqWf>w0_!SM&vUvrxyYi zWqr&a4-xY{1f3yp2)da0Gh?zy^=e6gJR1JJ>tOV`XUfW_3SxO0I~p0gP~cV%E-vnv z{}Lbx8gbWAOdB*B=Q-4l`N3&bh6)z1Gm0xxbL3UAJff0KKj2g(XUmr~atCIh13wfC zy0Ad9dlmUVe?;;Yj*WD397WhvI^QnG0nJLv9uPwkmPcX_7w(fW?EQo(nwB$$9@nf? zEw6rRU-@VUT>WnY_t#C9vQIV+6=JFEr0c)n?Gp!-@u_Y+2N-c>fUGSL3rp!+^(Y4V z!I7FCBi5ckR*X*tJSDt6alr&29xFIj1m2Ac3VX!|OX9!-owKkeehP3WB}C0u<;_yc zGAIzI6()_haB&toLsuFH75Z>%N`6OyiU4}B%S^p>@?s6mr^Uhgev<7#MRDmo4gm#r zjSWkD37-5N6jC49c9$MHTH7#S{BoN6GGX|QzCVYX`!r^dkfOLW!QSWx_x?{*L;L;j zB$`UvR?p3O^AmQO#f!`DoTV2(75~I@mDj)%XMOB>M*us5&etaz@fsL#${un{q6U2I z3nc^GD}{CdYQ7$F8~)31EVD9$;DJ{fL`MtJpa3&$dEyj6g=xw#TB0%$ka8jK4Z;$3 z_6aAvAxFJ#s%ZE2hv!)f&#{!VDC(Py0Ff*>At9j3mUGR(o-bA)3ep8nm=CwojI%Z; zL7D6Xqt=9(NoN%)gBc<7(RZXFPK|BCYpb6a*P?YBf8m1yjdV-}Db7UAjPddrwm;jb zW%CB^c6*)?TonljFDgVjzpdit49lANp88@tqfn-61CtSa8pGAjstZ;2P1M zQBnZXTtUl_-+3^a_4_W!Jc=sQJyxx z$U6-ovD2h6yfGkqu=YtLw^WHtRyxYhCU_5>LA@9NKL942{Zf)IuSt`B57!*iyqOU0 zp=v!lpwv$x?<2>K&djA7`|{HAm%K&@B5|}iF*dp(L-VB~1PcY`02p)@K!;YcI@*X< z=K!>?ge`uO`GVu+)XsFdTyAFgt-=Zafa~P>3?xnqf$ZO$lH>>#jYUF<^DQq-%k6zZ4Ma<#96AT-Q;Lh~#Hq24@4IdR4X@;om-osQ$OKb2z z2|WEpiZ}y~0B3*!m3_TI`5lDVwxH5)oc|?5PfF(fCj;r2x@ga zit@ya(tD-c_s^1+=n7lkiNxBKmG?_xQ{VpP#79Y&$+88>_Y%+xuZ{~aa^q#3MPrhD zW}cAli*lF|;@n9dvYwfI{&HNPMO%@Lg&Xv#ZDsl7Y9qNRV7$eR&b_L{WS9E-?K>7+ z{bu)`e9Ce`v`ol(hkGW7&Y-yn8|APcTm%#~NRPn+j+fVAU1gjkl{+T7kO{2pYE@8d z0!dVI)#H0M{oQ}FZ_3Ftt#o*Y0)ru$e$XoZKpArjaL)2F%HFmkCYOKqr=N?{>?A2lHaTd_iIkQDNlFfzxyZ zOqfM@yNb73V4qW&WezJg|ECZOPKeymbMuo@ktZ+FuF1cSw#pPX8)HT4|0n#NUs0U(ZPj8(jmbFQA0VrXn_ z{IlYfj_-pa4?ZQ;Wt=4y(^y6lW_rZ%Z$F@ta`6e4RMy;OTGjJ!XuMV!A|Zf-s7CUO zvDEY0e@aqzp#W#l3j43)Mvy(YmgEm`L!H9!QE=6W~EpG=_?n1~}zA?q{M_6SBF3q+IU>O7$7*D>xaj=G1`hy{A7C zcgG41EsF%pPrl2zAi&N{8Rmlw#_4e;TlXmuo~K<6)x?s5qQ2&tnMUBK!A*^4)km&6 zz4OVl7Bu!HQwnk$Gnx5F#SQV$*mo2HAWlFaXoP24HcLa}1v63Xskng|YB*aIfRf|h zrZGr=e+99sY6qTTG69r>P3xa3kXHF04RwQCGSH@AzzAX6@*H3haMLK(s}@0|QwpW9 z;XIs$o^mM(_CeMwQ;9)7lf_4v-0|<~uL>yrM=wYBl-9ikDF8?T2d=(Nsy;EJ3RBh@ zTA^LPpZp|Iemh1Pn(8)kOsJgm&xJ5i8~v`_B}BuUx5u;Bcc+WW zU|`6zNw|3)X*o73aPYhGN`~IUV<%t-;r~pJ`)NNwRJ5YT)Ga>?k8X6Y;a(%)QNRYH z-#NcHt$u)a)Z?k`>g04Y8jxU??t58@1}rl=D!|&7c=w(HuIa#jj)dQ&1dL4Dn%~bjm1yGybF`R4XK7ER2Lj#fbYwbJn2f z4;wt-BzK+8E9K9^+>o29dzN1qfmE>XCI0;V^)yo~3|JOwMoHo+*MiS#@&+|C_fpnn zf$rKMn99V}f4^+ttt}`nqQInLe%?bx7o1rO`08|$6E9ks17alYLZP3XgoVgHKoB72 z@@fSGWH!q=-c`#f$DNK@I;EyNH)leKIU}$=OJM10el@Q7^I+?&ch@JdI^XYn5;_fI zQXJf6RDqB&%c^+1`cS}pD$2+#arE7p?!-&Yzn+V;H0onvxSe#mmBMuDI4dF~A`eS8 zi$C>;Q~f2Fnca;cmMsb!H1>tYN=KSAwEk$ws*h?US~lHkaQcASi^w#c681ut9w}H( zAh`!eCIXIsV4JuOpBB$%Zl#9;{vA7#a6ySEvKlU_=}V{BK{tTGzLRGOauKbnqpArV zn*#TXSSrR8(mJmcvvqA}UUM87vWGSU`)*$yhA1t-<@DT0UgFG>-{Qrs8DzG=v6pvD zj{t>W9S+!l_OEo*r7j;LDvo4evo&Sc{X!j)P(`BMh%S*H&>Ok{q7FwLm!QFjx?b8(E zQsB-zM-~@k^cF;qBDGCI^XgYo7MA3pm@$i@DwVh%4WLY~!@~rAXeTJLB1@B^ZlDh#B0(!IcoB6JXE4mFn`Rz-QjAuPWm2YvmF1I% z{8#3M26z0NIjq-`sX04A$C4h#9wZdy=owM-1F!X;qbaeE;FcdbU!Q*I zhykb|+_+0#doMmhIF&@k53k_aJXGQAjTQi2D4#tLSm6_4o8~^O?Iym8VG^bVOnwMu zO{E0z72%b_G})NQxfpVE3f9GoM+GMdm|0JqAui{|vxqQ=fPAju%5@EC9o+Rz8<3=9 zHRHB62(vP{u8lBtF5x-%`*lHtN@tXMd@*r%)6>J=ihFINBnL2_96jdkvLrqmvZsnOj(bTs^=kBs`#{l5x-XPQqIy_X-L;duBAQ47wA4Z$@U&Y zQU1QEK1l2jd4zsUwA4(rAj%wKJ+|Z~yfs1M-(LwsLKOV2+TFgLjJsP21+7$d`XUf) zUKs1Vr>Xf5{po`77WaMLrbakXTY;EeQohx^U3Nw<^RnxdQCB;T7UceAYzvopetOLe0yVALmJ{!? z#S_0IslvJ|TsGNFn=dz!gpv+xU_UCGmoe6a9=m9+?$+8|e_g&IS@PU|CR#7y9er9f z_fP=nF<(xQA2|NVOFWVOe)=DwCa8-C#p4lBZN4oTKR!N%9X>4oe>t&VejDvAH(jYyI$7hn5)y-{cs=zdF+igRLv((r0YMPf3%pa z*G^(|MVW9%1JWz1C_$M-Oa9Jr_4K*<4DmvdM0T-j$Bq-A#y!+e`B4@fI{Yb#P3e< zKO8sMF*thN46}f3y}9C54Tg1R0SB%E2J|!Irh$PqfI2Z`|73(al=5T!2jK7l4m(%D zeAr?#TNG^Wj+2>K9szNh$#uK~vDvGPVGwA?JRb1)?aI(e2F?4$%tC9BgYaUlD`r@X^w_y+jpPAD^ zZ}yYaNkDCMVDES}PO>182^4c)-r?w^5l=Fy63Ir98zLA`>c1R2XA-f80x~iy%TyDKLG#@aNpKkT<=k^q$;v&O^OUs^)_(LIHDr(;{2RWc5#LjP)SA+J)WW3F z`+GOZBmY7Kju9@p`nGK88_}x7;tLk^*cCUbeVLVW>|S60?7>x=Mvg z8(7-@&DzT111D@#|I7oe@TvkP+h@Q;V_m1W(h+A*rLKdHEG(0qzT96?@2rAw4o}60 z?hVQMN-!u|)RasOH*%&_%|d*Tfo(G&A^NNA5Y@QVCxDCuAY)<;H|KGjfnr$| zgRG3=nX#w1WD}t3QDcCEOM^IVHth8@i4%^gUa|rSsyQh9&-RCL0bL8{xg*q^1Ze)P zS^}0PsE5})laedCYjl*LhZmFKOVZl}MP||gguZAKQ#iDM{E+?~7w1=vcW#M%{pQBH zpB@0jvjQ;>)VIHN?QjT1Mqi9AaPQt^J@AfE{h9L8+w_3X?p))2a#_I4STM_UE_qcpqduaVUWKcQ zW3Q(?9hCMhBt2!369j_9ziRt7dGq${NEkzv83_0RNv{9gw~zZ|?23csmXRYkn20+QU;Uyx ztCfpvvzFVQfi|Ga1(lmZBtv*$3{Q*fFYW($0dSvcyQ!k+_?4aXuf?(NnHvJ}_f3!I zNmllycBCham=9;1tJY3gM?r*2nGD5 zN}t_p?hCmVeNSIrS7EIsU&|Dn6h*c&O$M4Vqssl!%U_A7p3swlxlie~+4xH^CHdpN z;C#~nv9P7*D@TunNU~Hh>iB^YRwe~@hloy*IMv8U;Hz| zR34^_Xt5S##9WBuV~1{eN-f8&3VcOtzwTQO3+O!C9v5EX@$P&6mOb(d&ylmcdvtq| zFLb;TVi&SfOoeJx?y}R8h2^2_H+&Xz_nJ|WpCi%;g9!8gPc_&tACzrL&P(%)a*wv3;odjqo zS8%!-xtP2k*SG)Z#1@q~KqiZFZCk?i&HLbv5p=Wh62;?+$iIJ)?suyT<|rlo?s}@} zC-H0)6u_2g2kCP$AOrgR*pEohM44iT+H&`rtGGpdZKszGaLDP8&;C2yt z#3-_lR`I8p&{Cd@zUf~qsIW-c-HzX zt>$AbXLp^I*a7a#{V!|p#7*Y!?;g>8ex)|1pMl%o*i`ms;l)y6?PW4CEDP(aCt<9- zTnl5O#O}hwwpRfSv1cLBPmx>RmmJ17d_=K@X{wY=q9lpt`x~v?*_S>%yGS(AyKl@({}Lz9 z;Iu^gad0wFLCQ}#t|wsJ?^0r*^8ROK$O#%K`(fWd(ByHmBMzSHVwV4qHO@!9U$OE` zSd@5xl=dMrQ5r*IV(VQkQl|bk9^Xa~6U-mEc9v$z7tUImsm7Xb5XR%PiW`V^J@?p= zAxN5aPy4j{Usy}#)&0NijHlgg|GZlTLt7t9CKA7$+N0;7``@#^&*;Nnw%$L?`eOe- zJB;-x8m}}~<`|{&^av7#v#g+d9ySVuKPL&%fVJpQzq1iF81hD6IbZX&xh5+|J+iGy znD@9~0-rRjJ-Dv3mQ_d_DnLQ-MCg4)^6ibA$yIsVm1hTF5?l1Xd&$nP#3mAg{sV&e z2x5JYnF3;zW1ABA%+`y>6o4Y%uUms{#8UG}1hfIja z3Cw&4IJ$hXFT4C4fsk=c3`qrF(U9$&*<}5**rMmNdd@p%Kla~Nen$=O5pG5BM0Y(p zbzAF%Q?|DB5O1dtEgDIzYxe+Z+Ip!Al`0?qr=*CjZ6 zbpQAX^{?ugojgEO;lvew(|m!XLj8~ZB#QCf$vc!0v;~i;(nK! zYkZS8umsRX*3}A$SXOB=XHNfo4v9a|Cdo$iAbY7LBrCoLC8P^8mZF2LDae43*1G%~ zDjDoQh1`*Ad@uAX_o8ot!wDPQz2DCW=4<{%nT+P%ri1F1SH}S`nR$GDLGp{>GYY*VRKshpV$S9YSds6%V*nr2a4P ziyDjXQQ$Bg6tTVdQ{&2aR4)VHI?y6CLI&b0s^+t+4BA$oOFa+4V=`M4Q_YkSN`hus z=PTl2;=*ZaHmJ*Ud#1K-8E;nx<^Cn_Z#LQozIY8ZhzD zeEVIE7*);B#R_g!Z9bc20u2}ma4C(cTa#JzWzJ{))dMy9NwQ(vJV)xu=u^;cNB8~< zo#4Ga^8B3q4_f5$O3ulHpwYZ@NB;m9NgW-Jy&?SOSdyTW)g=Iss;?y#&7$jHt?wqv1EK^Cj&&N~sTy+#-#cK*nG2QV%{sUo;I##c z%~E7zVV|8FUSViV3P&FlcEMD4ZuuhgYiD*^h+{`Fvtp2i&I(}z&LOVTl03M#e$aby zLb+*}lo2HrCQ0x#S3hs5sgiz7SEBrEK&{8+DS^xt z!A72YWcV@*bSD$N-qe>*S@8u~MbX%_WSVN7+44NPdawxSh&N4#0lXqd|8BR$Gu~(C zHp=3_JM+*Du=PL7YQMnJfS%m<5$Mg6|Evj^!EL_u$;E`r|K{H&_}&~8VW}?x$~h`h zrv_t{=?NNj1VxBy;=I=tBp9IBBc~2Cf9Z>jMK^AvOj`ciNs>&fwE4hGIWde3HLh}Y z?%7zeu3&m|ucJS-XSAfJlwCsy9ZKpsh$ofmv3#~yhQIxJS*U=_-80%Wpe|Nq%2)Hm zPjjN^kj?qK32k8_l}cV8{4c`>DpuYkAVyVHk4aTa!os!17D>5HSg*ZFkljV+g45BU zko+2p69)D4B4!Zl^+Z^fZapVsbz>Q!!+V_5?dYba~GsIbVm^bFr5~}Gxaxu!A%Cn#}=0bPg zSmiT3^2sK-@gSPmKDjPIUQ6?dcUtJ;2$UQL`lX_B!2439_?UyWg?e_gTyluh0p;?V{q3%zhc z4><>;2P68V=xXm?p_27X-gLTltn_%88G zwQyL)6+D(oz>m>K{dadzy#q=B-x>EW`Xnpj7%E?h&P_|vKv1F^$;-10)AmS6=*2s9 ziy>Z3opVu@JE3qUc_9 z;J@dGiy7FWb=+mnW1+5HPi=i%L_QCAJy<y0sKd?U2~=U+`6yoG=*51~lJxvp(93iZNnc zQmkg4F7q-xe#M;)d&=6^Y`Uro`cApyk{^ZfSVopXWExCtM#b{7d}hLn#o6$N1_P7% zo9W7NP{T_RQ2_*y^*Yq@8!d=JBlQ#dz;-e)px;q{_fM5LOW>Xcf1)-pJ>vZa{u@7| zV-_I`<>J=ke&N;Bt(CWpaX62yK8q;C?A$E0BJPyE)j_Mi5qWIdtnt-x*2-DXleotQ z{|J-oBfnL_+A+eXW5RV#lN-S@AzD1NwjRv~DD9txP{jJIhZ-+ZS{m{G?|C8Bqx)(n zR3pUqiUpmq)vR|}fZIj<_*DaFMN~%yr}g5T-EV)u4-d%Nd49|9B%FV_@c4+?hD%>~ zU<7(v30{iy&p5!GF$Ib25YAtjz3RA96W=lNn0sCyeqiQ3CvKT>L@G+BrmmD*!g;>% zRl&o>i6i8Kj{OS$LzskT zNCA1~R9eZ#4+R{%t>nx~Ozacxq=vG)3zR$``0Rtfk81 zckl<7c~aE7!wA;6N`{c$VLkW8zX{hspgcVaVJ9)c^_|XWxl2EX+a=Q)pOHCsJBvga zyTAndn+nf@UCN4+==!afObNd|5O-hg5O&q1pe{gR_z%!j%AsM2(5&h=PcNQf7#E;n z2V3@lm4(k zUnv&eRsxOf#%+J6k4-0&==d?h*Qw(i>p=ipyvkq}p5>MA9MkfEqN0UDq+m{SoHhQU zzL;2+xS}2(BxQRDmFrFQldu)}syYaqnS23G2$~(1Ushr3O~LUbKuh+5nys+&7V_|dof z1NJVJ1oS{y*bvI@7VbiIipvO;ll+Z+hqVUnhuZ;@5!dT#qe>v6Gq(NQVZPQjo`_;m zzbu1>yr|6mjx-HgLna+>U`xmHUQaL@idc*fB3W@wV~QfXDo`_!A=@8QJX`gTh6!@Jk!-OYsSpc0&YM?&72wV_1L zf2wX2zRQ>v)1vloKj<~iXFIhSdE@{4?4ZOh+HBktm>^Z@NSJD^a+T)SYpwOIgj3Yp zIUE}6BpDW3KZHbM5Wx7F|m3w7O zX*OO8Qrirsy2@#&s|=q2{6hI3ggZkN@O*ECOuMP(|y7+9wUrQL~$zw}Hw zA)3pzK^qvoz&KOR4;LM;G8TeodnmF`0dm!RLRvAG3r#*pq|3a;%()o7L^H5Y zO||(f8jZBUHeNaeT6+r9LOjuE;0b~3q171MZh-;4ut^u`^xla?7Jel@Nwka|$a56@5dK5N7xP~Ww3IBu)?EYH)bM}T!*8ZawCEQ)Cxn6dE;Bk2mU>eafB_)WMS5HPMh)C`% zhsk--&TB&Mfb*xZ$ykOx6!^~)_5Ao*ufZFbbb#@Q|EDGUh&go^ zH<2s}FsAnao!dTixs=g5M%^MSmxox4(6Jyk(d`uVd4LhXC2-yol8#>Vuo?o8;go~D-I1{ST=A=Oc1uyq^>XFl5U=!|@)jYJVgzxf7mTaZbH9#$=S|OA zQsXD!R zTCH{7(v-#YU`+Dbe8EUi#f1@FP1HZNy)LW7o+c-Cfg3jdZ8mkmr{X%K!pZU{-%L^1 z&6#t1X<(miVTfH@r~a)^vNnj8Fb@`Joe)SlK3cQ#bkp%fME|fOe+;;AfPjPm2nq&^ zz_qIk=3l%XF32QHtamN3Y#tg2DEhX#4mmQAB3RZwMjEv{^sKg&^ZbD*Hc%VKlP;0Z z$AAHW$|zgRm2oX5!>(kbHXYJ_q^_gWc$pus9Iel*1~}Fw$@;WkAgwIBNl?#3*L}pN zg~xw=E3DvCAuTQKhN)2X2kwv&8;wJ!3|aanZnCQ;HTlzemT7m=tgx{iyN;xTW>cYx zgQh)uEozb8TEc1mgNV)9C^k*y=VqA_xC0u>M{X&*&#^HX1|zIRils2w)MoAK$ z3^}N!Mty^)Hs5>6A5mGRCgx=C+8eX+9l;k5?7;|L_G_2lG?E;|Gi2=GvLCDVBj$}C z1Hbp@SL$eV@sbaM?}dq~`3bJ*acQyOS=S)vTpG5Qa3eg7!;2$qu=DcKl{p@@)y+5^ zw<|WfR!i&3QK(;@X1`SLRewfRz=<={bZEBNNbAg<;O`LE*=Z4mE=8}9yMXnTXu%~c z$t0)^01`x`7j%Ja@x>B7AmFb;e*G3EOzrv>jC7N9J{N`AjPb-HA$Qf)SKG$xHj9+U71j%d7WRg__mjC+_MT&;Zko!wpe z_)m{JEG7IvZ2@Qy!7gohswMOi633fw@!+MpZ~AcLGx6%!Z0;{%Q`5><_oXf%akC}z ziT?kLQ_t(4jvUf$a}F>=4N@5036w~pygDR~akax>it+jE1mR3;aOwP=P#0@Dc19wb ze@f`9#Pb#FV?$WOu*n>~so{+ikAB`!1(I$Az1oY?8cC#9`ab}*rlYm?=@6iypK=xC zqOnQ=>2RYj5$jX|o!&D~MEdGS~a0QgsEu)6yu4wS}D5*)~(5)p8BOBcIEjlPuQ%YFlt+`e6`X2s70b<^6YyME1fM*oWx? zI{o}5HPlV6x>H550xz1SEpWZ;g8Lrl^0}9;bmrDW;E1=)A2QKA==}IP>x`n+CT>KrW6!9|0 zp5YPJ44eclGHN7jdmQSM<*zPuCZkmvKRdoYA#XO5 zP9bTYp$VoY@XTU})oW}MTRZvoq6j)PcY5k3Uu<77eyoG9NYXRHS2QiYGc~&BJ4dw1P z^Td9QTqSO%ZKYJ-(!cH5=E!49m1^yX@atbA7+sg9gau=@wT`bRDT=hBT@@9zuvR`D z@~H~M4v@agAU`)h-f%{1v!#*F#|G~3vwEB~;`*djf5wPadb{#C`13VF^xQGu3*q;t zi9{ztyGnC!ak3|viS2V~uqZzJ8U?FaTz^`ko%g_JKaJu0E`Gok&jL+h=EIK=WHp$A zTAwP0a=m`s$UZr$BAx=22g=O9Z=^@!aQn@=)AmG9MKQyOWwUZiU9kQW0|<&PgBpEg zGLABYQi`Duyk;#dkP$B(em`KY_+A*MnGn0!9Oh#Ak46q?({xOae^>HTG-qE7BMIa0 z0y(!W6`;WwFC9#3Gyf}M@jlv}*_rEoopWAi%N=4P zOr@omgN!?kv5JGjaXDqlZ~Bq+yxhNLFagYA3u~wzH!xWXYtaFowxvTXCHp+Qs0wgu zm_DiY4iV6=z2l`LTDAHG#<*tMW3vB2dy__^c;Qs?V_*Xsyl-P>s)1Hjb9zLP?nMka zgbG>^edJJT5cTCieEeO~v@tMAut8x`I>sk0ukca9B=P1eM?lF-G?+|cF(Y|wPNFD9 zVF}s1n)j1s#oOh{6fU;FZbMmWKr9hRG&3hPq3u7YX%=PXTpFHd{Hz#HJZ&(;FV$M zz(UQ(bh|{c#B!|iL((BVAI8N>m*qnu5;UL3Ga@hbO9~>Q199oM3_AS#6}@q9nuH?f zezK`=(3JZ33{C0YEnm6P?IsrsGlP{#vuNiI=(M!O# zGUCevAkkI?K@Dqu=ZmpVyjZ?0;U`<6~{xRkrmu@8G$Nb5Ru*B-#d&fn z^hqXXxLPj0Yv^;oUGP5>{blaF!6@_WX&`;?;eG!?8 z7cF>9{B8-XrT&U1Rw`PA(LrakhC?GkA2LB+CkBK(eN+07E~=WnClsQzsy$pAvk>U< z@@3#W(g}@`x2pNMsT}ibQYyvo@nTwP7b1~&N4Rb8dmtX>^9)-}IV=>x-G%24jJHcU zHXl%OSQ8^=xi-Zr8jOt6_wN{aVy|yB&SZo!t>7pBev5*xUbJ7%y}j<|ltFdj2WpL% zyih{w_)Z_|cTSvceCMpj{0~ObPTCxdBOBkvED!AHrt1G)ks70kB>ggm<%@_~3l)pG#-$IGmz=5!)$O8|=|bb1fQHX=kIT^$Y_ zW3?T#vl9r|Hz8=uy=&MgTf=$!6cTUn`*)*IS;otS~fO=lOa>-st6MSo`(P^=bMOyMJD;n%hZ+5Fglj`}NKU?$q7StuLU=Kk| zKbaJ8`t@KHRnZmQGeF10x{3(ZolQ0yF3@`MDDimSb^m$K$X(x}K2z<2T1U}p5f3BY zJ%3!U_NLePw z`WSfv4CWJspRXE*5n!Q?9<;5M>1_8K!hvBKfth(x7-&c$K%v3Xp%x&FO_Fu2@F;Am z#Ui(nbmG;VSqQ^ex4j1Kb`B_osrAeoLv|E~Bj(O=rk7b0%dK^AP)9!rr^GJMNS!(; zBh@NO$a=cB(!=}znv-%5Y!izR{xm@!SNOm{zV1R)me`kTa8XH{7UO1|mx`gG;aI}T zozJ|ErWH<1k!9W7DJM)T-}@$MFqA-Uf+ZxG=U!?Q(C2g+y8R!lzm*V)zRL|G9BZHLqFFKF)xSRBdL%fvh_Cl71pwnWB zxN`0x+*Qa28NM1y+;?SFLfw9M)OP)C?e^O`JmCMfQjhnIh6WxJ;vLaSzoP%=LapOd z%;rc|08e;$nnkTVqKr&`d0O~CFF^R`x?$gDiAXkm{WtJu!l*8}r@8#5>@~X){hL3x zO3Do$Zk@Gohdqc7_<*?8;gJ%qTu9m^?HLFNUpF;*Ut2u&JgG+y`E#e=J@`DX>FkKE z20zhu-i*CRWBzxX^f=HJ{q-yVwlTJpAmIWV@ET8g-{^=<_TsXVd*t(uEr+AVAIZNI z0E2`L7|hIzc8^ukm9;ku(1G`Vs()lWwV-!%r%9B+smD?u4Yj_ozJ{21F?7+5*{bFT zZr_n(9zLpTlS_dX1ug8Pc?EOHE1WBF5-B}sr9z>);6`VAqb%gNwKH3RH*&tjz@9YC zCQoMo_yWdIFe0Ha;{3NR(54-eI42bfWuPIgv~dU$zwG}KEzocZ9K=XWom&=E^?8i}@$|;4%s+ywg zpj#`2rOSAuu@TEchjhDGXdcT9u$=%h6PT_*O;>y@8@x35G`FE7I|0(Ovck~#g_0I^ba=)_SyU;}c*H~EOfGA#Yr2{YlvWQ&= zRpCghUO%(KVNsv_M(ZAGX3w$)DzkZyoG|5V6$t2UI(ruX)gAe3UWI(1*8CeG08TEl zRWtb57b2x~Q_lr7rn8Gsh4U3|xX8xCF*d5KP@FP^2EFAGFUzA)w{JKc+Zms1{v|rsT$ti5;kafIi&>@9GAlTgq^h3}u*k~$jA>|C)1qWeGo)Ks z$9IvWFV)_ZZar2!QmvBN#Z7CMI&_bi@+6E(&8Cn*-N|1`&yC(=kfKfY1tDQH^%o zm@2@~CLAl(2bs{-hiYW%%PXfqTa7pNZ+VK|eoD8E7NUx>iDQddAR)J@uL1_seg(w| zFM|l%Rk1OE_W0(lNm^ZcV(}}yz?jS$8mj zZdhX~z}MxQ0c5@4+6;|LScb-Vhkg})5YN~ku{#m4=~AJQsNyT}#nBHIzYX3nwOih_Y|3h_PKeq-(kLN~g%Jj`ov3yJ@pHPAU$@GH> zE!LVV<7uR}U>J=yuU{xa=?;UZb-iV8ks`m(9Ea4oPi-x)_U3&c$LH)K3Lp>Nd1rzHYh~5}pA3z1z7Et_H3E}Mc(**C z++nsPfFwwx>oX@z$$8iCnR*859Mi`3zqR29Q)N8_-74+ZkudzkPr;{u-7d6>d{ADn zghTrO`u5|Gr|H1_NhPd2Fmq*%vm?%v_CqNOi`93}_B3q>TdN$zq-agHok~1H4?UFD zT0o+6%P1SY#||B3e}&iKVV$qchbPsmAjW*`S^F7wJ=P;ATbL5W7Il18Z*Vv66Hx87 zk8eH3j-xCUlPh8%M_{Mic&!kkdOOy(>B=f)%<*TT|;NnRw(YP|t zBmh_2X>SFPNIvS}p=_+qBQL~bGynuDEn$7S@)O1!0LveXdBRmK!SF-F$=Vqf(wV>^ z!hDle>_k_k{&ZC1o})%KB;@o%99s#S?+i_HuE)pA!z028u0R$5QWaqz60Tzl74|fH zWjGclE?w$xl}ivwT7CT4dp`p6FL>gHHfOxW&KRKN!3!->L1y(@23FZ(z{((AxVd#P zRhMbN9Uea}A`&qLV!?eC#|7?NIrZsRl|3W<{w{9Jo?J6bSfBxOFe@%=7JH7^A@9-bR&r)P4eRg{j?lys4jZk@rI z>{;*455{oh+b>IaByaMl`*u)r3N7;&OyaC)fVd0A+A*9uRpR^RahAT>K2zoMX%U8q zG8FjkP6d4kL4bC9(7kkR50gj5R?4dp=3$!RA|-1w$v3FcYNq-ZC`AQ#k77ELet^N& zGf+b3`H4#w!KLP0-18s;_V6nT1g#~9C&w?(EZyzNV5izbJWmRa2; z_L1e5iJmuJn1TZ;AQh#|gO`hK$h*S&`UINvn*@-7@b444PS@6#)*e4Xn2OS`H>tZ| zxwm_{B_3~da|p8>hHG3HA`&UyaNiss^Xj=z9$MPMMx<#BMlg_CG>K7CL^6lRlQ z>_-q|-&B;iADy*q92eUfQC#n;%Esp2Waah%>|QzH>uI+`|1R`(YMI@YYa!R%$2{-# zwU2l5&uH$u883o!8>6by|EJ0QC(UWOuC~Zd&;k2-{8GP4ujaNTmI)6EJE9~y%`_Tr zVhqO<72>GfezFu9j&H4s9wr%xPo>z63{5nU%`4~K9k7%{2w$MT zDoT!{(BRQz-FPfcR@=k@$OZ?P%G!|y9!u73=J^L$d~%TCnz_KFz$$={1!MdjlhC@8 z0#+u1*DJfE|8z!yN4Z?;TMBbnsu&w%DX#kdUFcp=Eg#nW8y5miMN);$Wipm-BwiA$ z7qK^x(v?u2PA~f*RdmhuO9Q==TF@-sm~D)#ppdE9FEr z?u!RCivv)0YY2th5)n<7WO|8kW%2iFdl7ZG?k8;nWg5;gi!CEK_j={P;R>VKd{oeu zSb}1@(n$|J1eNBGTp2hyUT0`J+wU$xZC`EroEn5RsWG%#|5lmTXE zlw#a$MSuC>&F?Mnm3|!^B)vR)!TYG$qa6yPn0VdAhsjKLW-os|xmFOzBS3QZv;$cWZt<=eIZ45lHwdsTzKSR-;hLt#l<$W#zD7!G3U$<#H#y%5?fB+?z5s|u%a9ig~0arbvmkPci z^D^7;1czHr&-A2I;wU`CuN;MNapLkMPQdB^d|~lsQBHFt4<8kteM7Xzd{D=bGtcFO(QD^se@jqY;CQ! zt1#1;30w-`AfFG+Fjko6d8yR-9PddX{xGvK6Bv+zXg%*+J)dN@=lRN|C%sOjt<6hK1DFerTrA-(3-(ROKV3f~6<7f4sAK$N%kaeDXY` z6lSJIf~H{Vh+^)FM0yVubWnf;<~Bf7-D{6aPtrjT^T77uWAuXQLZCh6aK(FVU`O`J7p0rJ^8_>C(8a>POymFe9^H8?6SP%) zt@tyOU|m_TosUP@C?z5`A!_8J81-l7vSzTS2lm-fcJdU*$3~sx=M-CeWr;D?*oY%L zW^75XP<*n!em3Vz7G~Y~bWh-9eZMOEM18#ye03?ujY4AX)uicJPG zw{AD|>;3>yJ@}#ndBXG%B^$33bVh!GhK=pOK(s?Oza+jsERjF1MGTJVFue09h0>qHt>??{`wM@vj7}|5s*ppITwgam)u|^ zBDFJ9qWErq$l zNor|8o~!Us#qpaSl`@T~Qalewtx=@atg~U%_?De8yp_X7Q*Tnvzv)GOIexFzOH?`G zp6;IF_%|P6^<4yWr2C?9kFu|5I=P)*q|P+Q@?mN11V66ZFAOAY2)!TAm~Qg1%%5|J zYbl1ac3$JG96A3gRR8P8o#M9$YTKT8~Rx(7Jxv1aSQ25Ni@`!^%nO0_gx@DlEJiMjyFCDSP z-wzPPFXXGJ`la0AYY*32tNloibaO@rLe%wuqZ((PTWQX*m=Bow)T_b0n=aa8fEA{{ zwP)ohdaO097JwjtV^}ZxqQ#GwWB8;UmRr z_sc67V$~(fG9h|_j!UAP5;-%z=emx|=x3};#huDFcuwuT%+9L|^>eq!BPc$xu2Nx1 zBl%`bo(jSH1A{5oWWxU&u#<{+d0o+YVc&az8cg1IA z#;Npo^YvEY`kP)k=tQ;xvEau}{&>pCMGSO9JzX!oY_>8Dk*mM7-=ygWcc+j=9u?yT z1mOw@JNG#&y3!gVKx}K}84=^^rU@)y%T%`MFlW)SrtrlZ?R|?VhLf>R>t?g5T|+XI zRW4{I*W0*6{`jg$uWw;|6R)bCGySZ%3>n`hTM+AWi6tRjMgz zd7lP_TdRm&UM*b$$1IFmZyFWNRI-w6Ypc(^VP1aHTE@pH*i}fMF1l(=a}zxEJlB(3m%{MTh0-?gvR@28mt9!MkqST`im)4K=Y(Jx*(c4)N4T;RI>%Eyl?*SLIadB@s9|j-JhvtY zFGUF<=sK@Vxn>iJ%iFl&)EA1JoCi>y2(hgle((SX+Cj2iJmrqK1upF{zd7^i?gOo; zcR2pDXJwX)I7n^Pu(En0*7*XhX@Zel_2wsI?EKvz&M-@s=B@zTiKErwKZK;6rAsFG zPW*#TN^8hTzaHlXJnQ%UC8XT!g-h?s>}tkQN73H#Px1BjB6URKf4f%~-tn{4b#NUL zKIvMN-J;#nvV|~&V&1)Ce zXY_n=+u0m3cE9+lZd=oLSKIiWB$&30U1p&1&}^U>HWi|hp;5&zYBhG6t8AE|n_^u^ zL(3Bdwe5i;W?3o!3vUEYctO>TY~UWDV9|*S2|y@&*a(@e=#iSp_p|RX>7fCd!U1Wo zFYpV&3sNoy?SnC?F(DoW;|vI6l56^urf;p<6ve?Mo}ID0Af0-uDWaBLmcD*N1E*DB zN^C%g$hD+}?J|MIAU1yQcb^0{ubtd2zWjHdZ+jg}X^PkRpR1@JWvC^y@a`0IYy0XZ zZ_WNF`NG8wkv^pJLOqcRbYzKRBApyUmGrBbwrp7uJ_)CL@5|fefO7an!-_Y_8>Y|< z+n}D~xYYUAILu^#$Ij%fz&6@YS6VvTGk@}2{nQvR7T}dNG>r5n?>V+uzZ{)5fSuT5 zdEDH%LU1^U4=fk@|AGXNrvBx%?)S7@tJKGzQ>8dhk*wSp22fD-4!!}_un`S+L_}9p z=}XD2u-~Ef2KyfvYBzdh(QyEOw)A6!9mpb@%JgQF5T=p(n_r)len&|t$asf&!BKVM zAkxLDY_X4yY^sX6Ed!N&Fp4|czMf|6j_2@hncTt2f z1qITntPW)+rXjq18c9w#SVGKjHoWKkHr}|(2!6}=$7RBPA00yC%H_WCs1C!DZL<-T zmFp*(lt5?it1nsKV!oywl!)TgL97Gyw56xW$JOdn(7M&#)6!4RUiUlf;cD4S`Qsl^ zR{qr8^D^s!*P`!%;S2p9#asXW?mJ;qFp6l-f9oahMVZIbq^*}0w`4L;Hxq!#V%;J5 z%HgzFFc6pNZegf*KHxOY0t4m#>iyHR&XWkib^5hytp9KY_h*7nAFln0m-?=1q+J2a zc<|^sU%MJ&iOM%4zlwMH@M^{-$3Y0os(F*#5=G*)ICXdm)F)?MTTOeiNz5K1CiOu; z%ixc3!KIV^qW$|_z+vgL(~#Y66h7C#2Oz36>M%lg{)o6j#t zae&+`itZHaM0xJ=)d3+ zHt`MH8b^98)z+wtBiRy3IZ0!%6;J@UG7~^ltz?&vAX)Sx;n{@XDcFKMCd9bPn`IGt zRNs@-$s#`c$fCU8Pc_@|BxrX$yIRt*c%f}BcByzS`;i2d<%rPKi3V4-PfY=PN_c8C zZ0ut~V`1XXR(YSjq0RPpYva^1eV`pg)vxhX@Uw9S>FY01{N8s4K3QYa6eO?;S%gXE zfPxE{_F7=DWSqqg_HYVo%9TM|pS%QELA^qnj{9gP^cC4P7r#GIKKz_6AF!|Q726Yn zRD1<_eX^l(;Nt#OtGkZ9iU^bAo~0R@rd3SsHX6;zNp&PUQK2DQD^X`1C8JP|beb|H zO+I0M3A6gBr)!4_?-TlUTx0w^z%>z=o9eGRlF@)FvluXi9iD^w{iwc(xUDf=KP?M} z-=HloH*;~p_j1FsW~NzhOMJZu53v3D=;2XFE5NwMRuH6%i;noRRj%B(=?0q4(>{p! zDWQ&5Ptv>QPWB5D1w{yAA;fUY?C4}rHOy~0HbQ*Od%Ndo!n+=SPoSVda{O(bE*5jS zz0{+DNxFh3iURhYQv>Z%krV!ksRY+h4;G{?YXob~>v;%aWt&nn##P{!E2)Gep6uRY z<=*`Z9@{~|r5G}ZJ8TV2M)L#c6j=tbKtd|S7GCiTtCW>idd@{;={rMlq53WdTca>m z#~e*0?VC3)>B?Bx%&~w-EBg9?GO}~%CP2aXm2Q~+;ud7fAomvE=k72`PLK^})$~0x ztozYjMbCEmPK&$2ij5B2kW#ZuW1naBFbTd1Hr<)#eB@hxOPdyH$ z^q$W2atcO;>i*k;uxM?bICz;^cT`Lw$vHbwq+LKn4&d)a+yFWvy9D6B0oQ|BsK|vM z;8vPZE)WC5gm|5pa=`oDyCz#A!}xNtaB^y!ICuFM2lOPElG#Ttmcjh1Sb3MW{rLL}U<{5x+Cg#_ir#hYQ<) z9R5Ubu)bPSRK}a1e=8Myg*N}@OLAv{m%Rc&Hd|s)FQNixqL;llXPz*Cx6BnDj7T+9 zycEIGpcB}p&HDV^+{cIih*p~h(*>j=oi>apHmc@n9Ws=Ng}Wc(vLcXo=oGBx9c6Dm zk^T@-m5q07LzUos0Cj&7R*D5IgN9jKKKqle*kNpbKW0BB7*F`z>=PL(D|Dn%PQB{N zK#ZLe#IZpC0^Tp<=kh4haGc-{XN@D`0)r{wSJ*WJCUVy$@!udR7zV9qn zW2jtb1Wir;e|%#BiyfCbiqTZd*;lTxg3#d6$Vtwm#^ltWDKhWM8st-o<(XIA-b@bW{UDR- z{0)w!5L@eW^Y*VW7@nRi1r4bSNuuJQ)y%zQW>#`_%yVEH+7_UmdyJTvyIHJG2-l;bu$_Th}e7?avwClwNE{+(E3>S0X7$fkx*hTo4gF}}g*LLqRLPwK_{akb45NuBA; z+^?IK7%*xf49lF5)DZE+0YQzYG~>_lSaGL=5RFN{`avPm&Q+Q?F|Fb67$WB=N}tsY zL_E1T1;Mxh77xns4~a6oT}L?Fv`NQKrkji!zdIrsk-&bnTn;x`!CKf;7OZzaWkDpA zv8tcj_`HluMyK7VoHn>By-91;6H}K3vj76FUyx2~NKKWM)d=u25WV!Z5L)x3Gr7LtqeX>4`ADYzvF5g! zd!F}h|1^|WYI3*LB~3jJzc}X>*4mLsVbA0N-_T@ZjuxCIR0oGAVB!J>Cr9Z*C%XIL zqyV&7UM(roZi&%?_HIBkEBr!VHChwUp)0MQ+OL+%){gD=oF1Zzm0?8#^cNuha>aoR z4O!H!fu_b;X9gvGot-#Vjm#lvJOC5aw2g-mj5}q6J&5`s1zgcafJ6Le-TLg;7XYH5 zf(L-V@&55;98a<{*3F>2MXa)KW>%?6k3s%XvpJEiwh+=s+y(*VGj<^C>Ds4qyNg-_8s)=h@5*hy)p9ADI4Y&1&M8u3Daaa zuLN@6o7`dPvGbP^BqxK`MpQFi44u>+^MmpzZ}ea*ZWG75tXVVh%A=IjLtD6C#^}~= z=bBCmWp4}RNsxO%PXX`v=b13b`jn7F_(2>+9&gXvDq%44#Bi$AV_r6;m&)^T=DRID zr7OqeZ|~b;pL0Q;iTd=p4|-`Cr%nd`Aji6Hi9@6LE|B?OEU~^B=OSbPt>(9mf(Csj z$D}z*>Aq{6}2g#Q6~2coJdnEtS^5=uFl^7 zIM5;zxDVDr4L|Q8#OE~jq@wo7Xc!#g3Jd*-|0m^DO^vH=4SdQwRC4{e{IR7E_1?{` z_j2p2du6_VPwy+b0y4h*-XEO*9vn7gskyf-(O4BTz;p@ENlyIfvnWAd*fT6U&r2}g zyCE-u!KqQE84XPTGYuC5RcDPfHlA->l7^;VU9+o=qzAq^p~qd;E3XXHufKn6y54`& zMJH35d)JcN7ko=D8)H{%inQ#5^Vv@;X6p`c{-S*F=a&uUs)!efR7XR6XWo50S{^9d zrV;@wlg`c>pNRStq2=_>Tg7iht0}({{9&&dqM0-}DRE5r@Ypia75>UFqU&n@k@tUw zDZqIYDCHV__A%(#n~?x(E%y*x|NK#2oTeREu60LQ-PJH_t_C8_{#&N?d3W8J1#FAv zqM`&`ezh3z>lk#9Ij0S{8MPRE0f1O_f^Vmf8IRN?DhZ#O-XJY6$AF(Jt;ar(aBRo%%RJe!zV zTW;hB4nZp6zH`@6PrJcGNl%=|>wD8pfL&af4MUq8C~mu)%{I?w33Gqx=7qY2QIzK# z?qptLTrD)=K@-HIj{b57)C%?c_9c_#WZAoPm_p9Uo^JIve`k`IYgB}J=%KsqK($D! zC|g4KnU-iFFXiRwspn~R@R6u3&xX}S%exp`y$pEr^Y}%vg~KGkCFP6Qm^}n)Uh}JB zlk>9e_jSG9cUw`jg=Y;?@~g_i@{Uz;Q27QUtIlRCdaZ&7_hx{n!K+U|5*}wWfQ`Lz zNu1-Go}q+xDUkw?RA4|t+e6H_8KZgi8*%MYDqva*>0Wt^7UK}BujL?US7R&jVBXre z5_3|5h5^V07956-mCD`_;g{sQ11AnzeU+U|r&n*E8&Lskv+#5@vtVILfPDZ&76A&t z4++Io?x-lJ(5>9h`_giOT*%0`6tSCn&+*3!URQ30Ic zO!YA&@NrWjwxFN~oj3&;M#c;owSX9vMtsvUJ0tY$#0PBKp)($0$$efBbhx$Quw(xYGD^~o_D_K5)|XH$!6s7J%Ld~|<`@VZmB0xfAO7Z5%lg8$32 zHO$b{a0Yxzbkp6%!v>5Q>e}Sx$(yJc^v_W6MYgWF+m2B$b1&N+J6Cs)b*3p=r5_}q zq_0Oj#fVtry=DqsspKR*`=SlatPx_birl3THRiMK&7J}N>CmhxlJ-Lt0{CO+q8rHo z%;x#vx;q@Fb~T~7)7&FfVi59Q-J4fK7(#sR04pTiJX&nJ;ngTGm2cazq_?KS8ylDJ zUMiT%YR9t}0s<@$-L~PkIeJO3)qjm-%lrQPfFqh%0YyWZ1yd*N1+C^3WYB-Y0u|+Q zR51O7ftVA%#Hf>Ny5$a5oNHkap1=nrX2`g%hIM_p{9X_>?1)e6*F)F8j+d41hI~1$ z3}^jhuU2>9{(|MyO5QIVN1!GY1j(NC3czHG?>S=yOz4Je&(E1!3Pw}XxbWmqup|MPATRF z{hS>TOPe*7t#>S_H*=zL5lop^PqauglAAe<*`^f%iCL9j zsHgy)Yido5ewA)q!g~m%u*55}@A7w0rM-a0e|f<5MMUBhj($b&;>0~#{{8Jdc?$$| zaW%FPw(AeaiIv3xVq$7h*;g`a+!qrWTUPo~ACJT4B@-SVfzqyLUt<4-iKB8UXvac` z*tN;rY6O~FOODma(enHoLylTyLgKg7NEtB9>9KYQlxrb*OdPN6O_~kjxI~&g9HI^m z&_&GYw;;V@`iM3U)ql^#$Gye*!lBb*y?3DLKbc$}N}!w#ch_A}$*3=i;Ux!URC7QW zQ_=9(vP_Q2j8|yf`MVlVX+reICBpB|)X2e#KP#gf$62&&T=(0W+a=xqO!q!pEcz%g z$|qKQ7t|{@k!c@S@e?Z5ASQbr?~+11@tN)%#VA6WKzhAAMN^ydPi3Jvs-M=<7W#2p zToqHTEF495EcoA%gh2Jx$?Dca(i-kvbIG22=hC{nEA;8`K(0S#3rAd4`r;wFfbSQQ ze>=-sD;2h=kB7JPE}`ycxP~`~)8|<4{i|7HCze8NN;ND>a==+ zzSggcP%s z$^Rw0mhBRI`%*zH@R#q~%(Ttag?HDXIn5dO^Mp-lVp);p{!4Lq(I*LZ({vpY!24xI zvr(y-%2rl^XAP}F`6y>M8xX5mb_VnMG15)_YFo9+bT;x1Ja9KD_fFdB@j1BjSxxf2#wOmD}tkxx{vIEKOR#NUCkeu zE4fojTRKAI#s&l-pevuthIv3fS|{GzVtRs5@WxGxMIeh5a(8IQ2PR$fiOb}od4HhA z71A{RHUZk&cR;fEXmQ+RF(aIa;h!v5){TzYk?BncQ;o$&8{MF7ueI(wOkze;@TiEb zvBr;wO!&z#JA3b`4*^ER)@gL>YIitdXr+yMS0a+zKEx>c^B*zl`tS%sH{5fvX%no8 zBYJ^kH_&`K8_St|Cb~vM3%m$-5E}WK%FeLhol}=$q9d-ShL?~Q8Q2sulp7WFCL7H- z0~6)>FKAiPSsR;*6I|twM2glPZOWz(6u;{I739Sd>7-1&Qr^yakCcwmi76FaGW>l@OoU78>8L-YyP6b>44GVnG3Q4`m;BNyimM=-Ox5!$Et5V3 zWk2EoMuLlhL4?6LdBe`NBvGP3HL@hGH}0xb;e{Ga1s0gmcvaheOv$NQEGAW^^6^0~ zG0ux}yf1q~h4e|lnEVf2m;&M;s`*X#S6#sk>GZN0=>Z!J5H(HB=N&$mu1e~3{{x6adr zY~TB*t1e*8Hu(M?3uxwgzm9L=LrP8UZJA@XW~Q^=@v|e-CFCs?*iQ1pi`a!dmMN^b zpDdjpvr0{>t0Wm^l0$p%b(_7aN~B-ATW#K8bjcWGwJFS*AG1goGTr7s(E#1hvOVt~ z=H7R*Htznq9vv#gxjJ6*xw5k8e)?jC2!6bY3M33ZI6dg{xMf29$9Uz{zBCm6`Kie} z5Ov`g>9Y|*ebO=!NTehC05}cN|JMvG*nWa0bC!~{{@WpU;6Gs4`pr)6kV|z(hsHF^yIkLig%Fx^gK=M(;2c>Yec!p!R2B?A5>=xz)5Tq$I? zsq>Qm{vi0_{cZ@u;)7@2T@c|hz-b2##TP9%c|5*|q?NXCCpgYU4N==6m6pH4QoMUy zUr=!G%?;2ak3-mMFkRd0AitErH41likWV0Ro^o3q*@n9#hz_T0~nuLf8?jDEL~wp5tEldyKjCI zNuUo1ho|qf5oVWcDaw%2v3(U)AJO)wDJ78>)}HY(Hejt6nOA|A&d#0lH|X+Vn3TGRMCbPp4=bQfgt=LUp`e=;Q7L={J*2mcJgqgO#3#I1dZ^>FLL_CV8z&5C$P9-cK=D`R5B94 z)Ogzp zo`VT;5tx(`x(d*wAaHl&k;IYtKOt=;BHCNj^Y$P@Wj7SSOfOZcawbHuz(gd((OV+0 zQHl9|@NqJ^HCr^Mx{8>@%X`{$;oZxB&*)9pmVwIzOem2lRbHp~XYgp6cQ2UL$v6s9 zwCv%!Ro;jJpq1`U5uG@%3Lm~mr24VO=dOqF`|Gk;G)sNswS@e+=(86wtfuD2!djxJ zOzQFA2|$rF33>t=@s<)?82~41S6Hu*wh?Hlg&4?5N;T<}67?z7^2WUxJ_nT=j3&H} zFqqC~Qi12bx5`wiS)l;36iTL|CB8%%$0@?mX%wZ?xMn)YD|blb&r66oWz>|<`SLQg z1AQ^YVxuZxWcY#hrL|WqrOpM;Pvua{hf(ybl)OA81M|&uRp5?sLI@ENX1lTDBXZxl zJNvutqv8D#vHs0(gK$V^|NZI(2aXzFce#`B+o+N~qgibiC9{kWtREF}WNC|LP6<`? zCs%(d#eGqKdL;4j)|BJ+uetGnh_u|TTD^BbtN!5HBB1@UxqVqwNL$Vq;UJX4GS8G4 z(z0z7|9fh2t+9w>g-P4z->NYRJqo31ESP*_e;YRJ2w%+D^of_(v)ye?as4AbyK4of zfe8bXUEVwY|5oPzHmI@l~tnrxiih72n;``0R(QTm*O45RxZ zHtmD0H_=n%tB}BVjch!y1SiCKI4@D$Gm@8Sj4koK1j-0W<&BDuIyl+=QuWz%pRWhJ zNh{P;%$qBB`sIag>^ILITA~L7mgq|f&5*C?$)XcL79*T3_GJ6Zd$79W8aNLrrh{t4 zVpn24RpijnOyn$!3c)q%Up(1%C=v_ZQ8}<&BAi@RpFG7mENaLwie5l*YMu<4GZz&7P)8lsoaGSO(y$WFVrFoBU0TMP&`NGFh(9)K#oc6 zUy<-N>mI(At7$RJ`Dmx?F#OQh7vk^cF~RTFhyhTIamKInSQ{nicS+J^G@t(Lx7-*g zqj#TdttDJchIvO7)?GlVnno<^BdzSoRDfEEVq-kpN+!PhJLU!6ih=$CUN@(|)C5W_ z(w5L79rIg`Wk{mD()Dcbi&%oO!lm3Kb-`HvKYK0wP0?QtvU(-3xjwKNAC}IW9y%d1 zQR)}((;C{WPg0ygA#xu}JVwc`d|X^Hlrh?G2I+_E2#)>NwkSmVk3YAgzgv=b=@aJq z`c~!VC0C*injLl0;m2^USc$de|7=0P=e;iBw!}P;P(6M{)~BE66|+nmQ*kdl|n?@_OjU>fGX;6e?!w78b~LV^WcSPp?xe;<*ItIle?RKhkczx-#U(~HNY1>jd>i_ zj8AobXjBsLPRt?mMA;o+AK*XsR7`JW^U%g-&SIsU@jI3#pZn8+tAyIs`V)slTQ(r! zqfs-*=nHFx&?^Njk`H;!^DzhV(KV>EJS@EtM$|hC`F42Xv%6f$dautCRBSz&C1PKO z=_{$Q6@-NAl-K-4%yejT;BK3C*`LGBv& z{%i1M@Z^na*U*2~G@s+s83Uc_^VoS7GSoe}KQ$Rw&s}m#y_B}28U&U-hFdu%(iv_+ z)me2q(R>{x>GfaN#Kg}TpvN{( z_f{5z{#LeKk1t9E1Gfz>-xA*`JU-hpQx&>SvGCc#MR|JY>r6!UULQSO-nYqsQJFdZ z2|k?(ilRgMRAq1V{u65ZMJJ@f9dZMoHPg1A^x`iZmi0iN9s>actA$T9^`qneH-a%T z>PTNw94)tm+p!or0+qIPd?+j&1@JR2FlNjzya%DP4O7vYMeGyn#tcJV4A;~}*1@$q ze;vzgJ^<94;sBh5`2e{Enyr^^YgW}T_}eW`_P$TH|D|BZ_qy+we#7@q))1hxj=|3B z1M9`v8J<(>=KUt9J_i~YD7Qpx1hS*d%}M!I^Og!Nu#FKI4Y0Q9lm_!${Aa$90YMyt z&wtqR#0095Wg2xzra|t7xk2dnXJ;rtv%K20@S^0v~6 z3bPB!APxO9h z=kH%FT?+n0YlyweNJijkSq1zoGpBC=lN(n3o(LnAL-=Y4%T7BH{{aH+WJ_T$v(mb{ zFney<_$=hK4*=)8>Kd|7!Q{H2*+zdE(h3sjjTnpaG`48A#0qT=e)=|+9gvyuUTgvG zr?6fOIY%Wk^J8e|lD=Xf&B*PNZavUkV`|P&Q~uS`SjTx9LmiZ6GbEKZ5NJCo_Rf79 z_{pNBK{_=V(cE}5Mn|`y6s{kwzFtKy^M6;+`{S8Jq&0jZ9{DQny=-&7#35fJy?#9v z=0GqT^k;$#np;#TTDuqs3golfreJu?SO-M_0a{)saT9Njb0Ir@1Q}A5%u_uOLWsx z9)!lgoYnY+u1_ek-O5I6KlbrqGoVi{Fs$T|%ioau16$3jzUg$iBm>3YC(4Kdrxzc1 z7SdU=Bj)JqoU~JEzGT08hzblJYh*J-mSblAKbp=mtjYfk`(t$1=pHRyGCC*Sk`hu9 z0zU?VAky89fV2pRfaFN&l#=cm2ug=^J-7eodEV{Cb{yM|-S@8Vd7bCy?5zI61M0lT z79Z4)K{DIqBO$qR(egm!;AF7+{+;8@~|tVK$tM=hGzS1{Z$kbOW6HbA+PGi z?%Nc$re=wdPQ@6Og~KPX9fWl5Z+}~63_PG&ywxIp>I=T-&1$ZvazC?{jrq|R%gcND zpvYNAsTh9l7y@0q$j#_aVNc$mo9Yos?Ves~b z_X{*jYw87nBA@NcA;>qZ|AR4~?;`#rKQfuf^0jnXTpj>t4aC`tRa*f*O7ay(cUhZ9TS z7)2hMy8|-gVQyN)VPwvG0BxY1~X3}MJI_bheE@6r^?csE`PARZXq5E)TZwX zj8xP$Hss)#T}Rd=44*rKQIKbb0ZoGbAk7}=O2F9>WD&y2WWBQO9-~bz^oK|B9}idl z#_~RYsenR z(#vq;a7AkH3<~-?)>80yhCp~CON4OzB{dchO}yVA8IwkF$zwP}$L_B4I}%nFh%OIT z(F&^9j`T9@eN_Hoc>#A3i(2$Pe9NPcRF?x}tXRto<@}N#P9m53uU;$3@ER_XouUNzZ_Pp%f>%7m)~hbnn(-m;dhth|b?|c@gUXR?--}US9B|^wyU8&X6~oM9~u%1AO_?VIsSPG}NDr zJ`nz4p)n;7dI4um`l0A=Gb3~V9|+&S3X#+FG)e=zc|Ykj#$~p&lol`kwv!DR(LhIa zYcH93Z0F@THaN2v+c`ixVW<4*n>EPnZw#{m$I4K%XeU(5rv|7^(JNH8E_BTI96Kxpwe%k+dXdbb0nIT$ePQJk7I7p5t!B?1>amb9(Mt%9Dq z4W0)d>A4gMQk7A`Q8^1{9RHPdTA7UB*5_r|M-O9vxC)iK3YEX{5q&t_=x61Zy%7=o zvu$nl!_WHtnMi)Q)w_ABlSY~&$&jvZk7Iu%K;ts|dp?cC;*U-vGr7{e9Pz7UJtQ z14q_*@2Hi$du(R7vGa-sVK$xNBd(uCvyq`-aMFKq!M5;KL2Y1_q|zw1cj*hb6FN^X53#pp7xjUhn!PRvgN8In9R;a2ZPDy#i@48v%PhKeiYCmv@hC?K zJ8aIc1BRk=nFEvgyZ^TLRd48bw14=kVN zso&hoKOH$)Y%+&6Cd<>-HfT5Fs`WSnMqHn(jYdLm17R{Myb`dX*iRu)! zQ+9z9ASHGQE>>&Dq1&^j+AI|Sh4O3k^Im-$HGVr4Ev(?d>xG1(0D|CzO;{b62cL*3 ztx`*CSGu%AM}kTshJZH}x4wirdO=c@uX$#s(*Q$Xf4&b4}7K6}rPjmFuky z>*xK+K)>`pU@p47^iYZ}Dp;IH0>A!l7b@>~mbV~}zsz7=Q%d()AVa|ty{T*4hMl~c zuoWXXDw1PCLIiMTU)CJfH!b{9_(79X3Yr4GEDAj!E~Mb#Khq( zRkSCyHp3N5;H9;9kCKs6C$0XY(94PlY+7JaLr7`^T)tM3N0-F}!`!3i*$z(N z>hgVHX5OOt#)_GZ99WT(;>G_$1{eT=4`*^0LariBu!)1YezQ$I=xZZkWvKjyI~D@S zTZn>Jh&*zIVQN6&^Id~)<&_*9uODCoxI!g43}GVEkK@+)+cX#-;;yafL)1;C3sGEX zt2&aeoz~EaZK1`cw9i{W2TWq*xIb#c^lkDhVK00!-EiAp7)D@BCa3;z-qZ*aD39NY zU@_VzlOQ>B&`6=y#q$QfZ(kM7(7Qa}Y~PM&FIT&>7Kdw@$GKy;1@N|f6T(;cdvWE9 z!aH{rUb}*vqId;8H9OV2$;DXYtMoabGi~Ocy=)zs6l;o$nKa7O5ol+kkt457-`XD- z5e(vzaP3}ZMn|cqwjhsg3X-U79JATj%!i`ovwIOyl%{k0=MT~4H%JsEUPY4C3Lo3k zgedC2E_HFLQbn~L_YZ7p;6|S~a#C}+^X$Xa}sT-qx4X;P~Fg-7cFo4s zs?Wpr`EYw#bw`iAz@63|1AA-!439&^kAkPt_-7{%_t-zpfHP5+U<(k9K?8~3~qd++cGFar^*MI4RG<(wR1_!UJ5hAQDJK^y0^@S7p zLBG=+?tozVMVNLqFVTk&#y|}xw+iMyl8)Crb~~$Lc4#9sN(&Xmaa%0P-iWl!nXb1n z27~X1Q;L40U_`y4XJ;ZF%NkS1mKXN`sBAr)p7n&&96KCR0O^*nJQNE~f@qjPd^4?% zG4k+-(k?Vvzwun}hGE?J`F3#n&M9~wFH(=pLbqW-(a{#0FyTS1PW!bfMu)lu0DDV+ zfo}s=00XIp3ydXj6xMSF$&iVIAXR&k#}~F zn?~kydTJ^tc)CvPClvm-!s^@ZA@F${*L43&XdS636w_vZyh<27y$VfQTW}7g)tXG zW%Zsk|KV>b8Zeq&(pv^x+qeClY>grL`~OC&DjFTxYa!`}E8A-C0PK$+Y3YXfI7_G4ejQv6|f;>UiRS^-!15QfumE#)xQ795r0vPU+-wED(6x z$YLQ-qx`tn4-9a0|Fs3n-Pg(WytTY0vJAZU0uGdWJ_o?=|KPtsx^Ep1lGzc{zrXH2 z3NTHHCO2@Qzy0sK7t`Z9)7?uLtV9h=o-BnX79}cD|7Q(w4*h(~6%&%pe9R({Le!4o z=BpFAbYBDi5r(C|!8bU`#+7$t-S09~E~!NZ^l=n775W`i!<>JcS*MR*FlfHlv(!A( z1U=!Qd}k!oPb$)M2dk!BxUJDAKtnvLv{e({{06xNUE z-VNg#2gzdD<{)hLRYtLtOO{=7qrQh;yq-C(0Cr<2FL7V)&jMg^$+HEV;*k?6tzReVWfBIk;K|n1B|m*2 zba1_oTB-0gVrm!%RD&E)jfV6$7X`~G2N1d;PmEMxMrEWX>L7o^^g@;?qzs^O0ABM} ztx@l@H;Fa@NTBTSWnaNG`Vc(NAr=-591Y>z)%VA}qh|X26{DAMHa_0Lq_WU}OkHCM z73ZIxQcE+-j`0PoddV#>8;Gl+Dv~dp*;#cxm3ovXbC~UQ=PrLPR=>vYQ|^s8tGgaB z!D6-bW&jzT$9m#V#t9FFH;HJA^u6MJDU7#s#g7mDB%$87`9>Px(ZvikeQwLtcmOuq)Yf8sN-Wj}e5>9DEaL{==-fgt^hr5|nlp2+LfhuLBgdf37 z_mNxLwQ}^y?6^>@BsNJf=xZ@9FEca$22L{Ll;#)>)ec>zWBib+X?R&$(WOJqOQosU z?4C2}PgVHS_Q4C1%lnC{)WxI19$-DZ->sCJ%3^P9P~k$^>5jC(xGNoS1lH3WuRp*F zhyaSVYjRIUPH;r!e*0?*>X55*oJPNEt12(JDpzm0s2vd;r4+wKCyi-Su}J^PM#6f)(Wj#p)}2wuj{)M9Tzk+ zFdufLN#ZX6fY5F|aw_yPj`xQ*Xs%M#_hP}lvl40W;4oY*ttoQ(?PyhbFFE{VI$X>j>*J%zY9f$!Tj|X%!t`W); zSJ*;)RP$xneGPM&sUP=a3_W1k+TH-TgzAL{{qhmj6|WL)Yvz&kXBz;6z7>m|gfpbi z*QK%8{ew@Ctwfs}DFy#GBKHKyutcgzdCKf> zwgiN)SEzkqW)ZK(g0OUib^2-OFr7S_*4(GTXcE+Nh_RJFAzZ-^{b(r9Y*3v=i58-R zZpj)>lER@@T?Zulh623z-=(mrfiAm7U!%pLErat{Y4qe@$D5FRtR{wrRBf^sde!KsD{X}M2;aQsBb{aT9_KI94>wUSe{Z$}v>La?M# z>^Ih(*mB1KaZ`}lPOhT+ilq0GqSnHi^f@YQw7n7@TBN5g-RF9;Dv*I-)s}Y7mqiA& z^w{O)c)el4YGAFU+E$9-Mb{+{45nnF^ioN=@p^A+mhIzP1%JJ8-@NX2)ql8kmJfIJ7RC6y6!I2-O4ctGRbSb4b*Bi(buzTU4i za8uM$;3?-65Lh?9S!$-CS5{)QgC_=4V1=qywQKUEibLq7}Xb zC`{RlznFnz7B}fTFMjTj7GzAMma+5O%O`MpW|AKmzp<>o_3lMWg>I;(yls0OXibpwF&Z~}hvq7;>f%xIy%qCV-5C+JNvR|u$7Hj7^(p?jUGX7pW$0N1j2n*VWuu6O zoVAUe$h;_3hkZ3j91L6Ixzs+4M&)TmeHJ>3i%Ifq0f%_@qPQbe2mj07B-^50Rlo|n z6QAK3n7|O#VV}jNPfkZ+KRm1vSIO57q}+#q&)w{F6qVDx4#=?!?F)}YNK-*q{*lsN z?N%rr$i~$g!2O)L8qf zPVQD@+ABWs{TA!hI=0-E@x$`eN!XyW3qJ1qd%BL;z?=Mga<;s*J)~9j(k#J#Z{fyw zUdH5Eu2b-=sSz$(P^4#GG$y_@|e!PLC4v(A-6cfV=>w70_ZJ<3j48X58`AF<#xL$et!6mjrFI@uY9~_U-wIvAdB7oZY_FshI zuYdWoNQ^;dWIr})2!(jv2LaZeDm-8jnpWhO#6~)qX`@-P0F8#4G_Fs-Nit~nB2uFd z$I7yYhwIy2`gtRRt#F?I#s;rwDI`Lnmo53lNiKPqu&_2PT*s=MV9Ia z&PUGxR`zeR9BCm?W30!q?W_@BpKt@9ce+?PNSz!6Aw?gb9dSW4f58X64jsv)_FscW zlRJJksr*%a#jZ@2M28928W9OT$N$P#0J(ANT#?#wAH$~5&+bpt_-|oFG2j!l6s@L% zL1Gu><4mf8V8#F@K|{USgHbIyXTXi#mI|FW?*@$3}poq z-h9BeI)$YA>5EuiHNYZAedMQK3WT%v?t`-AupuHx9(|rEYWZURJN}5v=Nt|pR2?6P`Q-WK zAUhUJZV7d>9b`>SG9dIL1d{5T(IpA}y=59B9a~u7beM0Zc^21qy}rf#(m$JHewrd9 z-1z}WbS*HU2miWrAOA|zglOb-g!!)7yxt#aGc1&W zS8eWOlx%4NjgQ%G7l4&NW_o95_+rWK+H!YYe(jA@tA@AI_-3-sJRIHdB1 z`)tmp^~=I{R>Ixp@*fK+RvW7;Qktkir}1r>F>eaeoJ?s10@-yw%J_rYgTba7K1Zmj zTfY7QbC!>p{$ns+<b8ZxyljkvJUOMW zXi(KJKQrU*RRa%*eYk+>xkF6r`i+M#VYAlXIG>)_E%06p3@@60Xu{x_@7o_^_8#71 z?xXxmpo=5SG(Z}GU|tVoVRp7rT-$f(<(4fMjmm8xMY&_kv_^C z+*hzqCcfY9^P|QZRJJIKXQ7aY(!~A@a|`z;ArF=`}Nv5^;KiC#SJp z6(kd5pQXqcMQ!q29t30MV8bbJ4M9;@6B83>s^S9$Fo`+iaYVfyt{6W*eUJ8(O|qig ze3TI!!T3NVLFnTHKT-Sken-mPt!pz;E`oO$tPoLg&DW1Wy|oFxd}7x^r-VUiE6OO{ zq`c(a^&R8=HDK@^xTS*<6KGbSt+E3AOJB4`n4MDuK)UGJh+1)@8gq1AVon$@fP|oj zEc3j3wgr_xGY$8_0AFGEo~Uc$oV+vddFnN47eNG2)3~BQGV$aUb+Fub`$#F?yd1-l ztidStDEie;OjujK!3g>!Hty__KJQk5sSEfp*^wU!_oX*u0tZAV#uHc(zsVFUfQGDs zDjtBIR(13f$yWr!!$|De2s-daZ)|cO`?%8fq_u%4Bs41hVwIdmg&wz-7a*x>))syj zPqzIdlPnWV!k3)^jg6{S=(No)VL1(n%C>D9_$xBlAkP!u#>IRnS4Uw(Gh@I4_DLk! z1hejSt23v{Bqim9YpMpx&4Bss1qF{+BW^VD{K7LYu@Z3o&s>K3Wl|PP6}8OxjtJ*A zX5eK^SPw2i+y0+HTcG?JO-*?>8|wF*?pCwbTo~Qx@@~|4Ut>YcZb|z;I>(}(#||EV zO>n1+Cyg_yVpU&1yn~vND3Axkin4-iulBLOv}#t6iFJSmL!^@`b6@q6 zMji@vn=zpd=Y_iX$@-L-%sgGGpjk$=mdT;X`cIlXCmmh|`I|<&nQ{A67ToVL7BrN! z>~U2o+Qd1^L90{&x>AlDg;XC#O8!J}P-zj)SCLV5gwUOsIt|Chw~42XxPjB58#fKS z8>XtRjbom1%+Y!wJkN4;&2g*M+67248GhM@^K)#fIs6jxX>&n%$(5F@FW zR2%lXOcNO4$*KC*nMn>bvd3M-)tIfX(p8w!dU^mFflb@p>G0LqTT8T{j#;Odc@FOZ z2V~#*xtKUUylcB=h)f!BM90dWQheMKzX*rf9i8o5~q*?`N04Ac9ZQ%fndT~)k;5E$dw zQafdZO7RTjE}N<}&5INIB56d;dYUmluldAT2t(2T`iVZuR*IG+L)g^FFbzoyGHV2W zuqBLS@;;^DPRdPJ1xfC!GoHCv4E~^t#5K+CL|9e`VF3mh!z|ku#$5P6Xpzft&25rN zQ$e0-n-*Im6?09mh8==vX|$FK%G7U`3zXP@T?2OI-rlG6J%S!esluo_3f}+k1%P7K zpMY)(2fnvb*;O(aB(&`~JdHDO#E1gF*lrQs0t)5n9$UJ5X?lG#pc+%4isrsT+a$f` zX)h9zNiKs2NgVA&#WoH!DUVSgmY3pan>bHbP$SiX?%yCkMHz0ayT3R!cgZ(u36ocT zq9)Vx%gufoq&hpP1Z`MOh>b-|cGXZJ;d$k&b* zw;-@0`Bx{&5ugB8q;|yN_PxIBKLj%_HHRIghNo3m-LN_Z1b_Y2uC%FJH>gJxGn}wF zs_a-=c|t&4%k7|UcOY_m*0nEQKPF1Qak|7Nna`-}St=?aPkdoNk@ZVL-xCJr@Oe=K ztJ)EHt&Td{eV*1X$mfaq1lg!UPz?gXBf0YLrLc^T=m6p=l+ zb7e?6K>}8w6W}J;B_I;fEvgrAJg7~aT-Y&Qm-hV9x8Dt4#&l&MLY2A>vki|FU27@1 zC3YrfZtfPuNH^MCAtFILlG=ANJvp`QgYj8aj~a?enOOTI$$=XV`UO#|lgp`INdu8o zxTLZ{U%yj&`Z!?FQ!E`{#rnBm>+&73{sB*TK#uNK8s|QJGDpADtG6+@hNhj49=%`o zQs(Hw3z;@DFiW=~(_x#UdRrr+n|CguMT4YueyR{Sy|L)}?zXBOg8=eDVs47jH!sDO zaGbSL44BC1Rk$=_j!A+Xkd$?wO-P(L)GG!;ztZVnzlbd<6mzwKfA>nj5vmAFe|2{< z4;?4BbBbvc_y!P>Zp z4Shc@z)Jz9xhgtf3h#C2bt$z37&QYNNv&)jKCG@_=-B~XOclANL$82s<;;*h@G=w1 zNaO)vTukO=fF~v?5eL76=SA=?Thk9&u(I1|)2qPpxU6IoSRMO>6!!I*3sUQd21>$( zNK-^{iKL&=?82B#>F$?Vz5l0QAIR+JLJjJ`yyEGW4|7PK)m`nzH7 zf!Jhl`wKHjFb3?I!bYo^ z{cG=avzaAD9}~2%V)=JZlRhuJn|CCajlA1OWcyUIHMDy|(ox@4XgT*`%(tqEPC4Kt zba+8dP&6P9BOy$B8NZyb$7@+a>&eGendomtOS2eIpQsNQ1tJ#sof zcU9gf?`~G87@_%S=dM1rv-yqk<)kBnc}1^;YxYjTkMteR3G~OqwR>6bRuMaTUk>II zSNr;T)Y^kMT0{671dRTKbM3((t|vM`1)8THC7YI#@e@gkyNX|yca?63Rnd_Q zVEL~BLzbvk=!)Bbrk=Syt2Oz(nbTb1BU@hlX7%{Hs^KghZnH*K@|slK8MVs6bWq!4iZB0p4$6ey z&CQJjj^*`TAtM>xqBnt4{fn+Zalpj*?1m|gQWch2Y~}auL7aivod{gx=YhZ4f5?zU z3P)%C?0>oSy^7@8KEcZ(vZboPq=D}|t%xlw4ijQex|=D@UZk>Gwq%hOtj;HYe=ar)(E*}_6 z8H875Er0sWNaxzUpkPCkPIigi(N8@%p1e~w)L<~yr&z2ZAsH8y&fg}YsE^~ubY~uw zQ-rRdGq$`vTh}2oSFa!ZQ=mSu&xT{WP(C=|!mYK3=UaOSzz~t^{&ZqYyd=|kn|DJ6 z%s{I=n;-v)S_8zl(1(&u3%KCb`I>|b`uY^{t>h~HX2atd6(DTg<^B`4g1-fvf4yq3 zx)lQ!cblM~+smW>p~~9-eiqok4p_%Np0`chF!dI_`lovRTLDJ)p!w$60{$vsO6ocr zmrK+ETvu1!fOY>^b_56?{xiV)xl3PfrOvxNRba8ng{SB<-i&lQ(GOsBvf;)+fkULb zXPv`qxMZ34eGpf|{A^}62f)uCCZ~3FM+A^&o~bF0{xO(>YL{)yp9472KC$-l^75a{ z_p!FrSpTZFGIz3w>>00qn#Mow4m_{~{3#6pKd$KblRf@Ql#36%NX+jZ_dgvt&U!?p zUXABJP#?O!Zo8OWf_bA$OJ|pK?Ewhmw@0h+yq(9@BhuJKX-@lVIv{ugBp@S6RP6K| zHI>!nY<0JNt9>b+wsKJc5qdHp9+ph3kTy=lg-o2ybij5s`ue5^8NWTd@x##>hh2zU zsW;Et+FqA8hEF#08EH*_snfH(66z9~NZTIYOM*;qnQh;OZpdfkgW6Kk`rV(CBBNn|e;Ye$kfFn-2PeydWaPb6FnkWaQ(U?(Ke3lZKE0W3Ly-ArtH zzDPotRMH5WQ^@qG#_ZJ>rxog-N2;wg@M8@^n);Mr z$t|B&f0@cRhK*zRw$4I}h**T1u73zXwzJ`i(alA$dHrSp7$p96E*r;(?093HU%{cH)`c_sHsU`yS&5xT*G=@iO@_Y$Ef1@+k?@V zM5e+WUh?VITUxB59SQiThL=R60Z4$Lh~Dq*c|q%Eq*o%NfWK~xzicn1Ht7=%T;b^z z2+;EqN`aoXqE~bez&l8O5%OdDy8RoYvlNedHPSE~uC-ak zz?CnaplkeVQBw>{WJxI&^A4sB{Luz6z7-hLg*buU7DsbD=`H713|)~JF5p$sXA_!J z1zg%nON1~nK2gYN&UR1DAKf{CI8u7M*;U|Kf5F0*HeF8Y(R0wNl zqVXy6!5g}*`T?GmjN7E|JgyxCN~QV>cg!!NKpFv$2a4-$uSgmO&k8c~_*%KP()29m zFp|j8rs_Ni#VW+TNC$JYri6lo6`jJ%c?Y|t5)jU2@=gz$w606GC-vU|+oIMK>SW+B z$g=m-@$(pL3%dVPsF{83!rE7}@yQ zS)L8{OX9sAF0VIdZ~=2YCHO5BGX*_XpH69n6pty&GlEqZ&_hvNNWr9oYmv$K^k)AZ3uR;+RF#ND7M~@`S#O_~WjF6s}!^9lx%wUnXofo4R?n!2E z=v8>{4kyeg>Ndxn*|mSb^?k->yHE4}BKhiqR*FO^ejWcLj{4*iZ*YdQljxg=yWX=a zI#F-IEWjJkC8{0#n@4@p9Sa1$MhCU3_gd?)%O}6cAlV=ly5g0K98+b~no{IW0Bex( z1}LnZlh}8>O34k9^3D5XBi7dN^_SGI5CIl&?DSFbafWB;GH0}Rk_bldkd58?+_Edy z94~q|#s#Tbs!bUb>B=b_{A--e*~Mnm=l$M`wQinoZD8^~pR-YMJwpl}OD}hRlJGZk z4KO)5;_(oi2&E`y7^4nQo@kn}arnJ;E1*ydW~Hn*vSlEc*&Y(oxofGoUX6kk6PRX1 zTpF5JVmN+kBK$!JU}2|33teAah2wyMoMn1t(^#J-o(W}4gWw_{Ud!`@x4u29mHOFx z2Hym7SEdY)N9RH_STH zLVGWIf`CO75IqKH${*^<@2&%w7-c_=UXYg7^SJGt7X)MMIh*_c}$Mm%5aD zpYBgZHQ7cyM`0yE z#De+-IPZ1t1Xi-Cg-uvyYjvx3?=6|$b*!pw_AB5F)jt+ECgB~%ippyH@aCx~S`OzW zZ302(t~8sn$`>Xw3e|6T{txS_-TZj?tv2$qdwfM7UQywM^#5^4?1@@uD>k-axO>NU zNZEDr6c-+4sgK?3sPwvjfSph%$KeE`rDQ(WukMN)O>g1O| zAk9DNsxYnlcJ)&B{n^L0UZ%$rrp?bEEZ@yD{Q>rl|JIK(VzM_AOx?F@j{#}yr06M` zwUh9gm$|mTtr#j z-iZGTN6Yi_!zYfZ24L|`Eo~tttw*QS9alq%n^y04RZfWWub7dBYVw8p8#aI`nDdJE>_tuko#@qH~h&}rcpLU7j85)#PY%7O2 z>{W_dJSOpJxG?l28{8oR$Du4Cd1xn_br5fHMp2M5l*A?^O|zPmTq=wti-cQeq0j;u z%41=8x%w#K(6JWVb?N^)pYEfZM*S^nx0QEz?h^5^xBoqF?Wn=V!l>k1x-snb zbb(`B;W_Vfdd((B4XUO>&eq+*6dO|rNNZ_BzYzxc>k^6RM<$og*Fjg!evC;&Bo+cZ z^D6X5$gJkv(Wt!ory@nNt5oIy(ivn}v2T&>Rd*M%t50a5iI!ZRxh8zJ!sT2Z#0}Lr zI(kz+NcJ%c^(=?j1YRmnb> zo&A?gVFL2qjG()-&x$E*ur!*n9a>Y$)bs!53=;mbaIX6^>uw)j$gAHBTAN1Gd%k_! zd#(S8*VEDVCz9buNT>2^LJnk}RU@HV%KFBJq8{;PTo21YY9xM1beh_;*MQGnS|i!h zNW7Uv7j2~(M~(iIo0Q8^MC%edzoF8R1aw^>dZ^zbX4!D1fY(#H1(4qRqo697L%xMO z{o%#dYz|Q+e-M72I3EtIa}cs~TrohSK(}eEs2YiBizD$S1Y+|%u1L`UpperRyX86P z9}|%$41h}w;t|=TaE>xMY-DUlhg6FGPt}@s2R~(6&ZQRMZbkIwJ}M=BUC(afjgoFU zXEf`}P|uK$NTq$=>=G3+Dd`-3Rk8#;UCH?b=TD&qVUYu!q?i$P5q%Ru+eyTIG~5+j zK)+0Cu+=S2dgoSR+j8kjK|hgyprloP#F)8M+t7bV_jrdtGe zFW3-qXP=+tmChT*XsY^*52j!sP`Z>7t$}falNe)W^hB5`Y#Y$@o?ny9-o;fMP&i)D zY!jd#xoXTc<|X7K$S2uj`{qV zU{FaRsj;T#jtJX7bTHyh*8k>a24b|&v!&+f9qU%6+%dp(B{1)u5Z1K&%63@ftOw!l zM-XXaZwjtoTu^=}S1{e89*7<^TZ#~6=_4l4BGvsB>DLs-&KEIwjhoxbb zw`|D7<_SqBXE<{Vvm@f#=>)a$r5H(xJ>=T056Bu%ndQl}s zJ&UVe5On!5SrI4_xF-UQ7#-1VT;Lidys-=h+(E*a*)89~YZ_B1>5%UoTb4tvVG*oCvxzA@Y1_E6W4yd4kGK1o>f1U(w zizdnJ17Dc~DGr(JdnRB0fF;j%OkPrB9>fD0I(~mrYX&G(`6=+NhRZ3L%atT=mzsR` zOO)?q4+-;ohEU)AFYvP{Hu`tZE1J1OboCb8`#{JjMA;P@0#Ii4UM)Jr-? zyQ!nKPkMac&L-1GMcd#^^8{NM*|+=g<|xG3I4^WL@zbD9-r#3u4H0k2PZAULe6?{G zzoo~2AKFGcGQaL=Ne-Q?9m)Jap+;|;-7l}LM^cIx9+s>AR7cw>fi;!46$4QI!ZvBc zOoYchK_`D!Q#OH1Vpuv-`rVEr@pv5p`+$7%QWW7{CTNo<)JJQHj76Rs0%v?+gmlZK z@Xk?r`^JRW&UF{O(c5}oQgj|6t0RYAmP$?tl+hZ7^J*ZtG&tHOmRmbo@x>y-heSNE ziN;72Vd&uM%JkJa3y!95OWKl29lW+SOHpO;*OKwXqkiE{fz+S4XEpRNVrT8bJNTbF ztg|Pi-*N2gMC@ct&?4wlMbIwuE7sqpHwNv-%)Q*@;F(zvQ-oZ29I=o+tpeFG%u1tm zh+Fb}%az{p$F839yGqaDTwfScwt~01h#rP@a)7E~Zayx-Bt-j99$$meD-CfvIA6-$ zF@9+lW@dy&Wr!_byNf;gvZG6badZ0XNN{9qyq~1pt6_*0GR<$|Nb~vaW3gysC_0xu z;HWuTy(PV1xz?UzON?ju*uC2G$fGSE5uGB%?GXw-h@DdwrVZ5Ge(90fi#{|?E^nnu z^mnX`$xInXb6HRm{K6PYjDt|&(R%Buqb-1nV=0!Dpc}lF$AOr=))bMLv6!pdYQ-We z28YxUc{^Z?IyA{wH{D2hP?7|XYvX|}{SFMmN|ID-kH}Mu`K(PshU@cf(g(oO03s z>p7t6xayG1s)xtdYA$TSN#%Hs(-)JM<$a=K-nd!`hc96iTAGAF@Kz#pG1!g7vY)KExd!N4F7oZsd9pHDPy3DDA5gm)O zUVVSw<5AUiAgtEq9&hEMJFagubbkmI%A=bdb+kiiw+9zSw?6G@Gjxrh)cx_3T0{9D21u@C+ME%6f}Lr7X|n9EiZMbWfj<==?Kk zJOrdmB6d*O=f)jNemz#d6_3xpy2_Os|AVl?P_4d)Tl|c|XBMipmOt(-(-^vJM0yYw z4f6Rx)Sn)jvo;%Q?v5Mx!O*@fzeJ{&5*m5?T@IpJ!{Gyj{3T!pdtrS<`stQK#c+&u z@f~noC--7#m#7gOeKA?NRC32D;35o` zns}YQ9H5`nBWLP*1m^P*P%7M^=6WL~UuG?a*?8Xe9p7j43k7DMebeMcegf91oAywl zr_!ywT3`islUzkiK?-#RCG5{o3c=q}ggs%t7QQ(#2OJHqE3q%MELcbN896l-*HObT zKEXvr?nLX~rUxbNU$WP=Q8FeJw$>GJI|6jE7w-OOT$?#*Q9@`-YMPzNdOolr^XLiU zV$0T68Gtz8k{5HcDcS?4BzCA>Ni4!~q7ToceNFhaZOD7B7O!IOol8JpAy?84wo*j` zR=KvVH{P0Uag#>Xcb_DYfBD4ZxGF@7`lAHjqC|N7%$9dY@_LV9rF%`iIVQk!Fpaa$ z1R9*SvrrU2LR@@_?Gr?!5z-K#t2hPIKkzLZynM1+50ZA(BM2018yP0+ldErRY=i(B z+q?1!V)UHYBnR9G#ItP4k>QvUr-^e`OW$jv9#!Rnb|!a;xu)+jFD-GRcwz{mJ%iJx z>SYdyBf(DDNw;vj5SfFPB>c!Aq0%$VSrd99iN1QDbssLJjqgr>>SojN61=9M8UPn5 zMnvW1$Z$mR+zTij4e#)?m>b{j>&f-^PP!1~ay6UCrH`y>lfNawmBjW6S)*qmqS0BR z|A(iujEb`1!u1T@FmwzxbazR2r+~DifP@TC7sfuARy8p9fNe7=l#w) zXDxsEi^U8x``P=xuM5nH9oq1b1+{tzwLQk#3HWmttqUdI$y*WdAwyEnYX%-eT;Jij zH4b*X#b^ggkw2}iy>@{KO>=(khU2A!CWIOo>2ilzv0)IfzO#A9FR=t7BHVGXT`sAh zOEf%JHQ#u9yFmbFc6t4zVms)i^Yka5X^Q3lmj&Qiv$8PE_ zHHrn5R@#(HX+50H1o`tV)I_K+V^IHzPD$9SK<;lgH0;5K?Jtxg_u+Y<(^TH2O4k?A zZ((M!d4tk-cPlaJjI~U9V?Ai05toj2cG$0p^vgG9vRSG6=yi&Jiz!RiZhiC70|{N_xFCQ8HFGwXb_#sd?BKoaQ+SXGl!yx-4`nC3s24;Blke!27$-|aCz19jYLDws3E+|!s; zV?F{vygKG0sS2wS;%xP$l4!hH7ot~9Ur%5uEA=a|$|2rZ+KHHkl8GuaYMweiNe149 zG}%T&Eu_CQMjGah@~mRQ+U#jZAgJ+>Aw>;nF%sL@ynW(425Q_J_h~>F{lg$J!aVFZ ziAum%9&+ZKZ~0Q9K{tuJOqT+dOhri5YG$Y?I9a#yhh+I*`}J2$;!8mUzcdcMxmt{H^g*Nv*ZN!qU)6Zi zW9vS%Ex*akCa`$rU{Ni@UG)6j1f~_|tU*wFS)N2+kFQ|XC*YsQdV~snReO+i%6#fz zBNJeS&hE#3k+dVl;$J1&GPYd#lctjXbes~oj^N6Z{?j{PhLWq<63};hZuDgNaLYRL zVZj_5{u@jH#U&oa1ZyO$pR(#Q<}M1tdXJL`sXp&F1ra4HowFRzs7TEs1Tx0r%`NH5 z#;EhM8o@!zg!ZIxl!O3>n5FgBJeZ)5GG2!=GR=yb&8whbJ9xrCP*Sn>&a;`AiAq8g zfj(m{mi}8T8yPd|0g5nH2w`HI3spx3$qqJIc(B?_&`I$2TF{@>8@d(|sr%{+X}>@D zHx?`Sl>O_yet!ai|Gs`&r?nP+EZtj846Zo-pN{FjaM*m|li>dZO}o2j@4o&c1+4VI zzo3)7AiTocN&B-{?Es|Uo9N(}!spw<;6LU;z^ny~T=z0xf{*LIxcU3XI~Ig_Swlyi zS*EV)YAa}>QuSrFp!_xFM+1s}<|1W|1GXqs+(9Eo0e|Ib;b;?lVB2g92)aD_(e4;$51hL2V9&M*H6l+<;Anoc(&#FLlD;_rWMC|L~Md$ zn&^KFBE{5=^K>GPap44_oj|Eh76SyYW^Dp;+7Nv#HEeo`>jI_HBQlF-wPbsSzSS|z z&KUSkC6ldoOSi)$QMk0IP0W{H^YQfz2EgBLJ^DtAs0(R3o~bPKA0;(yfN1zuF~%@Y zsnD($W@bG2s2X!DzBckg0k$6v@eyIlYyKsiELe=hQgnW~fn)=#Jw(DM_YSmISq;V)jfaa+5kxcsW57?qC|ObU;a=Rk5P87l##pNhk$O)7j-mq6c$;VgxV zw^bKslYH9`4J699E}p~?1s@RQB5<>}1&4l-TOK z{il}NJkV6zE=F2)K)OH-bx>xLw-3cIty8kVTTP0J3E3&HYU zIhga51mW+E-O++dV#Z*QJ;ND9Sk3;~d}idd6r)2%f>+nlt8p($c*Dgwo$sO1|&po}<31XiUm;sr`u8#7NLF!0?29R1@M)zZng zL~T}Bt=ECyP-<&`e(9+)qho@fNkc6aFn!S8Suwgjnr-O`{k_99Ujdv^L(^%5-xag> zFh8MZ+Tmec<;-v+ac&aCR@6tGkTc+>W>uiN8sOnUSBcB)O8pHw0i!EZHuu@S z4myWR?@fQNWsY6sV;~<7$Mk=*Bxy)yWIHx295=>#Gd}wwB#Z(pRG$2$#mt>zme&~(y;mt8s`(IQfGRP;kYTUdPp6vsG*G0VT-70mRAhp@zH>V2%wu1Fm%33(`x^>%B~ zAjMErT0a$a6ncu}5bwxj=Me;+~_9ePe3HVeA+kaV^#@^UdKnbY;MA%#| zxGXRMbvjy)cwS(J{PXXkh=$Y(J{Z~Y9!}7;bv)0hLdKXi-|6kWd6)a;U>_qE>_UlK z&N%JxBY{|WNe;OUj23d@0-Px$8{cedr47kKIE&hC_}Q{2VRI^S1V)*tE1d(&G0@R(gyw6} zVtT|oc)5;=Lcj7pf}-a4;s+y?pezy<21Z0odf~e~9dt3DmRM8K-p^Q)Epj(9vs8Y- zb<9QmdD-cTGK7yz=>2FaFNl5ibbl(4GfLxl%tV5`F`=q&Zpxk*C{BrTDY4=3#U%EycDX8{icu5IEJg4jKhG<}Q+MUW z6#ltT3?VE#po~mRlf4^Da!u8uM?R8@c>^4MHI8Czl;OeL1C!fGGjsHCjT6V9Re)9W zom27XKS8I$6zZTTfZrxHK~Rp^Tb@c1b2Ov2UzG$!g;`z1)V^9YM)1F?ZB|r^tgUv(Ti+PH-hV*i}S^+f)gQjFBk za#DM)xrL1vHQT8|^fq$FZVXNOIV76@M78E@y%hE)SQdu0IhI12AG!{$sm3VDy~ldFfP-+wGm;lRL!uW;YW^W*i?QRTOHQl~)yJjdu!mS;rI>pa0Y zeZ9}!_vf+>!RO`A1VPk=J|a&!ZHU_ho}lyio9ek&1gvVuf)U3_7S7c`VIx6HO_%%}s5UGLPWGN>cE>xKy~>V+&2UKCj8Z zx;-5z!Ovpu$&UYNadaf0R#RZmb|{g0krcnCxgu963iF_OO zubWpSB|2R#%g5sQXUIWjv$#Yx6BLeWAxb*TQd0D)Hr(s=PzYp8?@Mh+8}J3}BZAI( z7zgyiGRtcHPrv$Xd{CTJtZW)9VeC{!))6D2}{Zg%P%g9>uPm*hbQ2;H>f4r>%M({}E8HQUW7Srru{ z>#2$oi&avm1}XJ83V6I&SzjMy8cbk4${6n&zU(hw|BKtGUw?py5M+Quh8-F{I1-8j z&QYtQj&*#rKu%a`wrwM@-jjIm89tUK5Q-#+*W32PCwmbOE;@}_N72swQD(W4Jr*W;`n5Whar*?UJ)Ah-5%!%@ z6&jAU;twI{h8a--BI2eUZPm~PFKVDWw8Myev5->Ym94}LqBjaNak4DM;7$r-Z*nzh zISv6P*3Aw5P-{y(LWhL zcT#iy{CCkmPh&#>(2s|k^wY3qNbRz(4U)>P#xl(@zj8XqcpCW1LFTXpvk<0FD4Pnj%=EA?2VT&}iX23>($f zIx_0lJ4H*8%aSU!XK;p00C{BOaSV?^_?Vb;ZFXT+WGsZ#m{RtrKi>lw{^-=%mcxiA zQQBDG5z*0cR|!E8*L}ywV1RZ^u9W09_uIaSU7G?F3tRR%s2JQ(5ncv>!7CEr-2&LV z+SV8foa1|-%_HBu{BLd**BL^!wZch+e5c|77{h=d z-r?KKim@gXZvM+WBPO+ab9_>pfA0tFM+EqmkFaCAM|cHUg@{v1N$o zEY$kG%2AFwh*Ktuj3U=`zTw}DtEow`chuPua!GbHDOzvjq;h9w14cIaoaR6&aE-xF zIv)P%{+~LOg3M_s_}Vk=Vrj^-K(w&X$@dh_>OpSf_97qn%IzW-9fEoxEACN}DLdri z?Rfw%=2_yqAnfU3@uEGS@)8Kgd-*+mU6*)kFJn@2r<|&aLbd{IIu{0dWP&Otrw%Lk zlI>6q!@qSa-%fO}^JBwbyhh)oidBgftRYF~@RcTFL88~d$Ur6tVH@@^S|iom3ynI$rQ)0cD*GhX8L7 zqx4!lB6^KFt_}Y5@D9l*nm02J8CCtahv+&h{z&esUdPCm@{Acw-TpRg zgmUgn!?&6O>u8Gp>%2H_x)H4ItnsisvP9kBor1oiUS+znlnbAkm@FSI8P@9PSX-it zrO-3Hzmv{BeX#~#sEDZQ4X%0-;=SSjao>%VYz1>t82nY^E7h%i!vS5N*3-$ztf!^FGV1 zh%MkqzaBoPx6WeE!B0|E=yP3kUDD-9Vmkn`n%8T=g(@%D@==Fy8RK9f<41woMNfjM zh~({gZK%AGhrNwRd}6*SsXJckzpT?Qat}Y%AhN4saYysp%k-&0zO>!Jhc1PQFP2C{ z0ODE82b?|u34xfVBjb_bWgYNFqP;CnJ}TozYwSO4*Au@rT}YUV2u25s17MKAh5=;)rtCr7evb+ z1q3_aCl%0M{`*BD9J$#OpALpB=ZFrYK;U=j*Q{Y=eot|+i6goBpgteAGYP6nwr;@Z z(vLzgaS|z~RQ45{w|h?|_`}f0Z&Cq5qxGjpD{bPwDx6rU0)M}{6j+ zpasqqxCBwd5sS~b3QOuUT^zI#S9LQ%H4onrCqviYgDf%7daoky_P`HEh?7zL_a6`5 zZGC-4&`JS^%Gb+Xr#3xX-&0DR$7-)9iu~yVrmDFA%8UwF3*tO%;s%#Kr8skPY_p|uWQ?L67h}3aoTo+U$6guIMPz{g_3!lNcBKuL6wAts zgB-N2EEU&w3}j+rjWcy{`gmcRNI%*L$zQuaUEi7kJfkMr*CI`2dG`8V=r&a$)aR$V z%&a7^!>FSVs*gm#)&i5wR9+jQfr<>Mdj;b1j1l`i1vbmX$wk$H){rzyrRbuAT)#?e_1M!f++0 zI!2Z0-!7#*Y7H5BwgNrF8wb{Dxva?pa=V<;YE!+>jqLp#05DCxCW`QfBeA3GGid$=QKa(p}h%0VVv#{ z?~|)j@k?RG9C5@da?4Hm_jg}!D}dQ_eXBU+XRbg8NvA7t-D>{ot1u0oE;(iKG*5Os z0-n`?bQdkwo9kiZxUlvM^DOtHm{gP9(O+{?;d2aszd?vhG@o0H) zuM1#e77HI->AYzFLy`d@(^-uCO%UPB;7VipFN#=KVdF${DQlEFOoi&sDlEQA+k^u+ z?y}(QIn)+TlOS`H^-VNqjNznWF8nL$JpZ%h`2q;<0E`^8RV5&hR4#PE$wG*_QtKoi zsn_WFT12-fZS!A1ed-V%fXg~X|Gi3MRTpK)f>bW(te}`uz%`3VC~;VbR8hSQRM`;| zfQ*>LBg(^mQkiL_va9A6If=8@r7-jT@edd{*J%jziHOHM6VDLKEA2RQtKm%&fT^F8 zsmd9i^Q^AXX+fhxi34&GJze$oR3{|HxxiJb#pTP&iD`JnehMRBbv6ZP3XuVNScoNshE)ql1C7qWwja9hQ2Rqf?L9F^-6N>Jz)_!D>Q6yd4#z|}mVdj7-AUHSQLKkb3$3ub_ zjpQPZ(i9=IT~G$%M93YQ5~BapkAYjKIOdSGi^`e%K=~{>*utMC_+=a4 zr^0Zcz-?3u5f)LZoLA~VJ52bg=X4IAA<3@)n@W@Y^_kHw<^(_bzpXZ4y5^#2-j?z7 z_vjlUMHu{qO*lNFKh$3d0ZD#jER{6kX!(&cu3Q!!8FP{BH|&$*WL7zjugRE90Zhjx z#v^aZTa%a?J>s)b`OvmQn6~_W#*U}`2nRBh=1e{C#=qI*1Pvme^pyJH#LJtW_ ze@+#-s>2RG5RVblfA?f)nIperOJSd9R9Z|1z#p3Ox@-$3K#uZr@FP`s=DYq6NFeby z5Hafl4A%A}P2QsdrgLza1 z9>uBSZ#~If{oc9kma0loU;R}^Rj7{Wby*vUHMmI5vu~hGO!u*lBmc8^16Uw4Z=meNkHeciL=b+VFc0m+VMS@7WCey-l#8jjEac;$7@%d{3F_)l_ zoW0mJ#y@=+o%peoXTK2pU$gtn>#&=oQg1@9h)js~6I#bRhid$ghM26w7CpTcyDTO? zQTvM6uf6O-!*JSY^ieUV!fVv_w;a>Q~S(tRgYxLwN_*R8`)3_82Wa&Y_0|)BQGw zFkBUmZmTg*XyB~B)A;qH`yE)q8#(74CZq7a&##8t2l~&RhovX$DnGRE`Pl{7SK$Q^ zm^@BDKXrGV1v-g{i2M&e|N5@{^}wF=^R4~UB(+r7>wBJOfq)Z_!ohb>yYHkbX?p(e zQtB~&erS_x*8#cXuk)W$7ZY-)hRHOzl3{{g0PXv4V$_us(;b#JOI|=>Uq&~Re3Y-M zdcg}@ZKUED1TttHr5S=hnBTKTg35_c(gAy<_nRq~_T1d+tG4k>#C8j5S)|H!MfAU4*)2Qs!`?aY-^X|ZBQ%snqp-h9cgnq{)f6L|FNK@#GRLziDU` zE(ay*FXI$YfIQyqWX1d<8bz_)_3I=%Nl*$h9q=zYzAJJbN1!av8WEFtPUqAQit0j? z_tyzi_(JKMn2ivBRx=##>ARgmMm!64d>^)lZog1uAT?!h)^zpYuluZe6E6}ds=RE9 zrLDvSz9Z#Q?X$CRuYE=d^3&`w$;`*6|BwTuH#qCQnD?N}3F<3~1uPj`&ZU2E*{*m& zAq5%uO2`~xktM&nIqKYkeQZ~3X`wI_+akGT!Z>|3@aPuATp58)Fia(?o$o%~%n8`- z8nz~NL1hgG_jrS%KpOBpg<9%Gcnmt#cSfs!7Ellks@{Tw(|=)m-0Lljo!Civ(7eT8 zvqfAHW%s$5bQEjc7mXjIulqVvzxk8fo7LoEr=gI3y?%P>T|=iQV^PLyVv{%4U*h;4 zz@g@0$0LC30gxb<&tXW4bt`EdI8NN236Jk=nItsQK&{$J?ThZA{cG&BesUG#wR(0l zj?6#Jrez&%#rWxcEV~SfgG=h3G3e#cx2u5Srw|-6yKsfp$g9NRS;b?aUrCt{)627<@WDQ$xqF(A+WOQ`or+Rc7@?dD4)DSDUf9#keFadP6iuTd<~rpYkv=rZ+PRALlvR+NEPWHEjsVw?;3 z8H}7}y^-5o26(4MY1G|g=K2~rc`v$E(jq)+_q(nhiDhU|ktouK&bxn)q0(zM)C)uf zMMW!TmW$G0#T9ORrJH%lzMv%l80ga!+V#zK{H72marECFlNJ%7s=PFPyc$MJde7(S z=pYO}QauxC8mu2K>PZF@aZO{l5?|84)YQn1-aA598qjJ#j&|w};e&28w>A{!u&@;J zzL8HJ+@(%OYouw2AwEL!_$Bh#88H<-{ymaUdwEXBVDKWScHTQB+L?##G{l#HpfYT2 zufBu^QNqhY7SMFdWxmD`KX9TKmD9q?96UlACTnl|= z(-v>^L^-_qiv(J*ba4so87&jhk%|~Vl>~GVIE{O_M4|*g8q~%NvF}`Epq2g07P7^( zQEpF&Kk}NE@g7K<49aS6#O%k(Nk7^nk*S!oo#>X}C1uYRw?x^87=fbftjfES2KLgB z!$Ul&6xg&4w*=D@8^`L$;wCvF;vFYHuc#G~!E3VJl<3e?Yx-njZBy>oS!F~10yX}p zM9@U8d5nUc*0a{}S|qqWa`j_`L=&12*Ao2Hhm^kA7Z!B()aEwQ(XNs5Hg_R5X57J_ z^lP*(<#GqLAd<3Pt*Iyj2<0zj;LhJZTV37XuZakTModHMT;_4!d^dh+9Tmp@%IRSZ zcyu34rrr9tC>`d40M1`0icr&3M$BEm&`!O(*W4t)+i30@IkzHofzrs|FA%01p%AzM_@Hn|y)2l~zpPZJP`EC>v;bPKg_pP@8p+fqsio6~_j+^H1+P=bLK z{zhF&4B8)g)K_%)q3x2r&7y{(83c;L1nAw$?XTbC`$oEHv-sc=sgPYt2xVM=q0C4l zZA1d~S3V~+!Z&BleLh0;_89AR!uSKN`_03tHbmc}mrAK5g3*nsz9eF#>u&Q-&6ALY z=p)qT{Yw!@t1n-{PgA^n5TLfR=7`CfuXtPW){q!y*bw#EAI8JZYnopYi|T(*zZV|Y z<9|HzpxJ0fjb1ZcjvsqeLLETqaNtzn>saQAh@|I65lj*ex?pcd#q3aossFu>ENkcI z3#Fwllos|r#ym&+#viK??XNrJO1g<*mmMJQ#r}k6B5U*cHWpEm@}ljh%}b}4pcH$j zTC}3n^6?-GKFUAoTeGEE76UU6lQZjIf)2l2-JX?5&gc3BkzLc?e<|=0k-|8h+FK1h zZGEH@BY)rz`M9^5OnZ5Cga7Pwsr_{6=d*SHUFxbadE>v+-=5TU$7zg=(I^%WuzA;W z%N+E$82otadG@~;JlXNd~de3$r&Q8li* z#5pOC$SU%~mqNt;Y|Nn<1M`BVE?t&jj^Q2`M26FJ->RtI8*V%P^wmzj+@IH6Z>QZV ztyf8Z)7Q3UbWAA%`|K2Ec!LZH$=T`@*t$?NB8SG9(t}&L`n0M@!7|%uEa`VIu!7>F z^qQwnV&KFkA>E5Tns4O;3iwJ+K(7zXNLQ4w39YrGQUdA-D0eY|54>8$(#1^bChi}Z zOw+O426>OaNoWhVI_A=;Q)k*mHj+9L(yOz%%jmamiKcG;F%~qB_9Bsi4Rmwj@OSF0 zLuOs`n2E*M{v{GBGLXcUI=q6SmJ`%B1ygYPK0l6@2`7zN81{*=F{(n8FxeqPGG#Jp zK52H2thR9j{N9+E22Ikh+Q%R%qn6LNW?Ls$py58x#eXVB=gtXA1?3LQG`hC!H$CgV zoP)oN7f>I0Q`1txKgTG`Fi93h;cvt*Bx${j4Hfe2yWMEKfjwPoO9WFk@sq>DIw0Zdm)j5EiR3*|2DwNPIHK2h4iqA-d&ggOL(S6hAi?Q!^}&) z-6r=|PIvZ`X7e+_DPWydgdrNPM}8NInAZfoJ7|jx!#b@VdnqAlKHHRgZ5%~td}pS_!|v*ubi1CH*XRyq25@JvM~QgAEn&f_>GlCj6qONCHbD3_$Y)-5bGoJC=A2;ZPog?ls67QNdbR80 zhB71MGH3Xzotha(HgrI0#iuN`#)QAoF>0AuGE0iieKyIFM&Wn{t5K*t>X->!aX6YQ z0IqT<>8fceUEq6Dz0vLmspRVgEAlyaw5$Dqe%@&-Nf`gyKqEwwW_7LcTYij+BjuJ` zkprX@H-U+)OadrudALh$NY0Zd{!(lZ9w>L^#VHHZ^m7F|Mk0`5Jf)YiQksP1@|IVm zn=HZ(ie)t)#wAmk21eWJoej7dK@pO!x%Qm3Z4(}P6rc07KeuAN^`<;@0(I6UTGrwf z$=h-PraP>w?6p!oe>8;P6to}aO6Z@|l;`wWp#KY<(CW_;laFp%>S+;XgCl$dconL! zAwh_c8T5)ANk+oiRt_hz$^uoC`I9%&%m|z@Z2JS2u0Rz^$j?~_BSH#vc&JuSs1XCu zc>1G-2ynrABHR;%GVkQ)`P|kXHP` z``pSD5*p)WY)Ovm$;4uD-o} zZJCS`s`t?B(ED)ksyD8Q6G-f;BiM%&XDPH!h^eHtK~*(aAE=mIT{=WBu}=c za5<5;6!bNbeYx4~={?2CqTg?{)%7bXhB(Hp>p-Uz0q}q{?YIRCNYHxcnedLr45qM@ z#QP6ONg$t5X!MDJ^}%j=A4N-IR#1o{S~2T`eS9vuVYwfH6^&$eiflx`OFE~!2}`Ek zu748VkZEW1cS_||9f#Z~OlsyKZZnSL*cM*vm4)^8(nQP?Mu6#hdGzZmAlG3$ilduZ z?jTo8MIR-a@c%P_B3w6??_|D6fIRC>t^A4WKF4fc^!Ea;%VOlcRBHa;Cr;4ww`oZ3 z;>Y>@Fi~%SM*&q{Aek1+(`M=X9PJ@J+B}IZ`Lf67tqX>Xp}(dq$S>9oxO6VM2c-+G zxHHatlleE9gpG1V)vzMH#)mO0ywIn(-7dd=+GD8jaOA*cn|9w>sI8bSyC#dSSCF#2 z^MtOg;};_D!m~FAA0vmicFN0z~+m{uz~KBzqY$7 zlP7vb`8bCB` z{$@zPc`|d-h@sRq+3=-<&z(O0IW0bX(e1Fdv`{@TA$@oHzrvu&h12V*;H~CD_L-S3 zhUbFxV2`CqWTr^RP2kgWIaQ|}%1Hj?Ao!>-8d z6zuu@25K9xrM+WF1m+e|gG|@I zkW>VqQ13l&^K=oO;S-s&ZT}4xus=6_eY;iU`Ja-f$4NTEkA?-)B5;SqVP~$*7Fk@& zqkSya&SfPrPf?k@qw|D!3VXR{RDw%o9tF{|u4CJO@?u87tOkv{1nKK91LQJ6qV=2o z{e*;2=&(%70;T4vrLpkkV1%79+y`I}D6(09FV7A7>PmGNgk#xdo1s_Xr?gH)c7`ID z3Tq`s=|8}0q^E9IaY>Af=R_{gICZA*1YB#=#+-RBg+qAe$}-j~c*T9&B{8A0?|bG2 zw{|Or=3kOvHKmQyj2`jw&9LH&B`mam6|=TV(X0IvX(r>{L28#uBvwp2{vxnK&Nh>& z-%!#Uz`3Kw-vZ|Zd$y6-kRlihlk5Bypfu%??zF=`L`|lZwlq*-7^;Epg{Ozp#MmENZUn2t)*pr;d<%Q2R<>}^*kLig87#B)vs6_4I zJuNXg8ib>Ghu;o_s|bccAcRD}Kf9=MCV$gCd|)EkwXt@)o{!hkf|x?g;;iedS*~Ss ztsn__xovdFupJ?%xb9~ht546z{0d>7A!U7hb9M%@;S6;%b0+KxXp;L;+`!;L3Id3y zM(+!zg)U&IWxk(O1Alr;5)*%Fdy`bF($F9ol*_C_6g{Q{{-HtGM4D^^g9&OzGkS{_ za#ek(Dhj>@R8Yml!rJ78b8EOpf0TuK^Rprey|XrJUCbPsmBqpXLkOg z=a2eugZakr-)N(}u`MtMX809;7qzjTE}m?x);^e4KzP(+F!AdC6m{%Jd zZecEGJ4V$z6w7yNA1j#@z+q4vwUtQzp5dHfv&XAJv>enYI(eya$7hQ@Ga;8Gx;50- z&NP5U=6~23ibNnr78j0HwxGQUVB2*oTH|L0g=!Pe-0FGx&tqWFs_efom}R+Rf>qJA zORel6V{8u#$p%mbY$zR@7S>FY`MzXStY{04qpPBN-xJH=)oJxT#t@|fcPjyaUY?>H zRNy92b2r80$-jJ=iD;{Tcmm$4F)rr7J&Q)Nb4O})BT#-{Mh`fLNX9e)1soCGAW4!} z2#MjH@4!YZq@Kx*OVygyf|CFF z^Qq9_18csa5Ef^KyVab@v!(QWFShPvj}RLnXoX+6!_leC&*>I z$Q+A3b8`GHfXFd7l|(pv9m(BE^Yn*%%XFJApSiW?HWW5|=44OD*$nGSGA`pI2CB!wXS{Dt;L0IgnGy<>{2slQ7!WNE9yYm4 z9TWeDYw~EmAqEUbxjO?#5FCEmQ?^9S*W8r(2H;-e`p=H|*B|Ta^Nh=R zw%O>V$ZdENi4?iPzeRX&zoU7z6Y$3hhRE=fxD7Xpr=bm4Fm7pJ5Q)=O4jP+)s%Nu( z{k}e7I&cerSIwoH+1HX+0Moyo1=fT6)aL~(TDVBQ-+D`ZdX-rx5zxNQLs5(uE7DGl zTsGGLZz8Elf=+c)=Hf#IMF`RCxJh{G7MME=Yay*vA-Ce!0`BLYE35(uzqtRfl2Pbq zf1g}m)9#8X{AASVtUb(C1$BLUZ%nFhFm)o$EgI-hhg_|K!3$_`S_6Ow3|R$p#ZwH5 zH#uZO+#`Uut&^KROco>IuoKOIE1yFghL_AB?ljkxc&kCjjaoJ)B(WRQ!apO>wXV~W zBZ>;47s0ZH4HgM2+D%#2P8b!Pl9W1i6&V3-VXt{h^O)ZZw%+b}4BwLpP=Pgf<_?g< zAH#+A0~zm+>18@M8^-VoxbqtT>9BPk}-x)WrIk!~%EWvtqL0BCo=dp6c z$JiWwi3_}jh?_6nuNp5t{ydQr-W)~d%O}GVPVI~dq3#GYPk#hb0%v|$N1#Sm(-@4) zf-R&L2}d_t%&M%rxZhp_xu14!j}O~`7>(CYe5OO_sd)j0(*^~5hjLCs=Ek$tsdg&tK^{mG$q62v3q_dNCI{tYR7)MO4D)W6LnYN6yA+rIIQ%0aYzL29c}`by_b zBv&GCT=kIwQo7qWscg@yl*}+1f(_MZd$OkhH$IG*TiI!@!9sPYV*e#_h`s$~*6*xU zaaW|y^_`${!ARF_F(WpT0pu@VzWnE#Mh>{!uk>B&>8_in_#A|g4i^pil0uiyS&FjoFl&g3#W>@Tg_us0cjwuB(g546t~y-NRALh@mD z+cbaHk(*1SNnHLK7&CD_>_K*hO zS<>@Gd$s#R`so8bF}{NoKvU%j5uwtz1G@;~>WFE6u+NY|XPJIDaHC+Y>o+^Q@f`4expkg%w;&X6 zuEfz|9xbX$pv)LGPSA3wOd2Od5Va08j0PR1cB8P&*T6J+l*KgXo!`U)1K?k!r3zCj z*p@3Iqxb5)P-+W2+0)w>5q(0NL+)YY+&Wmmso)vIqf)i)@5UnFEUo@DSZ|6qbZ z;_^D>Rtn(L5$Rg#jGi@=E)8o24&sEYRP~8K6x&X>&m_KvQ>P&%yBw1WhqJ;jY5`4A zD|V`63{wm*8POpxod7@@ZNtDmKW?7_L|>xHN+Zz;K1M8v&@y{@ zadEyMb6laYrtRz1Ywz5;^E86-jut=S>uV;y#wc4?N*2*P%A+W5$3u<6LviAk-F}QqisYI!H=ef4Q{z z2D}e56eLczp&T->OIpozLmYN)db(2JYn8OdDD73?$~SQ`TckTl3(LngC2D>_#V(!oZF-QsiA>v0yAmAV7+hu<-)&7Dd+0KhJ+fIQevy zBb0EoBGj0{?VRzJ?iWR&2DwAoN+re6UW|@&;vRy&=#@pVtL2==AhsaJ&)^n0{hxZZ%gYfRIC3qH>VJ>H67Ke&jKu2)UW$;CWQ=S8Nq|h zKoOx|;xkYL`Fwh5f$f<@3jvH8MdRoQk-xk*g%y|ug~6L+W`Uo#3cOJ`ue7&Wk+hdGtEG((tl`GaA{_Kl8adcDT^ywfrRL6*@AvY{*{ zin&R*s#?x$yOaNn35TAywV`pf94bNhd6PI9PvVs{Gwg}W_dnF!nQs*fbt zwlypdjq>!!pcPss9r(fUcz zHB@t+8~;=&sSWu`J_A#ILrsnz@W6K(AFpl%y0&g4j|?G*H-et-3&*rY5 zp;2DA8&c(~vsHYb;b{ zV_&Q5Yw1{31228`MV+m;QMR7SpB1%WxIwQdglkB&=oY4;RR<8YcLA~N;VL0S1GCsG?<0X@wETvQg=?zpDRPdd$R>WOfB20Liv zwRlOUa{U9|?RgzO?zctmv-xAIV1-5dCm`{kbeWstQX2J75=fB7Q-5lYzI7{n=`V?s z775NPVILpdET@V-EauLZAMt12hvS!u)U*@@6rKv0k4G+ z^yZW+EK1RXr9sOr{MZ=?+T<&c9eub=w|K*1zKOy^*~p~m`1XHcWUS8HSBu0()BJ?> zj6fLwj;xyE;uk$NR%-W2y>AeZ6IHCy{_Z=flrXgKl<@69rvLqrd)Mt}sgCUU?eN9= zi(q|&1s0DPpvD|HnScBA_RoThv~HFr1y1v)egn@g9mt#WdrWb1{yP^t%{PMIleTeD zI#GfNDKr7SOYRKFgTS!)&)%M1VRg)9=LZwSCX2;&&jn3LWRN!9#Y~jU&DK3iojn3@ z5~6o&8~;^g7ysK|Cci8@3yUNPN7p*>-Z`wRlKz(hkdKlVpYc(Ah~i1W}!5I9h_ho3BnJlt<>1x$Pn$@J6WDN;r`XX^sC(u1s1ASG(_8yE=?kMG?p%>3!3i6yvd;yqxpx6uqXkEP@EcV|({2AGO)<;2IX8(Kow*M3Yaec_^Y-@c``9k8 zXC?AwWT{1R$i6S|8=lFr>GdDIk&iE(6!ln!Tr~J-+&|{!ibagkaXbxMcJArHP8BJh zyKW>6lu9Hl{MIb=(`Tsg@lPCYwAw7VvN)tb0jAZr^(H*fj>E99d})CaO~o$>!@T%g z9<6<*j6+1_HlA=hQ7UxESqC{=*nt;G@cHG(m0WhpNlUOod|Jc;em^f0f=p12#7S_k zMkbTR+gnUl5#;>gqsuySxUj3Yf*ZZu%r>fK+(m@WwQ0iw{KENzkOo&f#>v?)vk|O$B^}XKA9)+3Ql;=E!4w;{LEQ#%6qtF4~m9OC)&8GLR1t z=wcciNlDG+BXleJ+HQ{BVZm8D-gIdxmdJlo;IKf(++{)a^Pdi660?FKTlk!09xrX$ zkB|O7ksmq{$I9WL(DVMB?)Gf~o4izW7J9%iHS4G{mAmJ}zN;ok59-OZ$48|x4po}t zm&8rEvzurP!=F>L);$)Vy$36#TPqKz>@#zt)&|F!Q15b6fvw#DHazYWitO#9cn6Kd@5ujm$EqxI%cEe33m5AO_q*dOY{WLeIL8rFD!L#iqKsv0tr#S=}t5~he!?kx#~Otdwv z_j9Zr8lohw(kliy@t?NCg07Lm^*UEiP_T1ueFw(5#M}Xzkl`etL31o^?)YW`Rngfy`2%rVeE*C!gUE(gz zQe}OaW{Q@kQt`vZ(-Kpz^V1wx$c)h*nXu6|@`Of|`N+#B;jDE~#L(N@N;%Zdp~y3- zs-}fCdMIKOU>4PmDd)!NtgyD9$oFP?hVwBLjU|$a<4{C&nBCT zsHlkIW4qW~I9(!93eQ!1T6*bkn0&6LMhicvlrJh~adLFaZPY&X=t zxoSTYyMvP@y?U|;0|1L?(F*a?Dwt{qpy8VQ!1$3$KFr@-F}D`lvcHQOr&?*l=U^At z$_@B^XslA7Y@qo;#rs>|HD!!)3JO$&`_#|bcTO+Fweim|=+*=a*aW!tIe+T~K8^Fm zQwD|Zl6_wh zlDcXwG{L~rpHDqZG`@1B$XW?XU2RgPYxjops#D!MMJ%yb7CQSL=NLZ!v^~G`q)(RvD%g&# zoM|e7-cdORmjp~beAU@_L1m2hLWzPm&OnwTzS|Q>fQ2QJDq>q}6^-bqq#5!EwFDpqm@1|Oo#mIWtZf4wng<$iklOoPyM$A?5*7+*7=D{3vi+vk{{tO% zjrh+aVYFa`bP)MKcwXMK9~NP#evaDt(8~hWxR$4yI~+eC82;Et)!4|eMPaBaPhz!@ z=yF}@*`xmu@A;CW1KGwb<~?tppGKi%=~bx`!1j*(1J1W2QnCWLw}&iQg5OLRk~J}u z0RBD4+)F$@vv~)lj`!;Rsb=rxDm$a6_uC-9DZ1Z|VzMr_o8_pzXRP+`)4X-5g<^3> z>dH!rqcB<(;SAQ#-WtYFBWbebAyi-E`Ko@T##5e++bAbk=d?cGKCM-d^Q4$*HF7BX zf_H0aOU*7$PcQ$jBMi4PfEme=$nn{rp?FD@$$I)eku2q0pd+p?kidRZTbXH8anRva ztSeo$9A`|}755*PBZ<9OB>{3Bsns?)c@V)WCr!YeXWIotDi&8Y5}&|Q)tfDcx~;33 zPyaXCvjN`Sc#^pY9|hLMuX96a{&aQK*rVlHcYCclhZ@|`-{sT|-iZBPwsRDEnQ7fC z_`I$mCe&x3Vbsr%O5OJLw$LLDJRH1yL{MX-Nea0ewWS}X)uf)?`uCPvi|)^cgp?E# z=rWP&diZB*%}iLnwNm$LQG5Aa+k66_<~#EoTYkM2JfF-jV5hKPsd!M{8wX&F+42w* z$QU%EQ%+WyjZa{Rd>&Gh`d$zq{VKh55f;9kD&`Jt0 zi0o9H%}=qW0XkIs5CX7Q-?P;)&lm)DW!SM@>G))sn0lRC8a^t_3Pm&XKfMTGAXH68 zU;|A+IxoPB%*9)x#S@9YjwySD)_P`594Ea|mvne!gUK$zC&GQW1ngU z>K}(T&;YQa^sT!@N5BwoJYYrJ7Br_**uer>xCz}3yT$|E+V;7}d-DO`d0;8Bi~pb% z?$&CH|Lj({HL)dvTMk@;6uX%_seg3ge|$EgU7{1e4UVUx*NsqASfT&0-T|Pyhc<48 zgs(c82HUtpq|%4*YQHWWc|~vIZi`s7uT2GtP_I*ODk~)k)I8_2|AD$I=U3$21B@Q; zvGDdlq$#5bd-{J2{3^tNJCvZ>ri7N7U8g0iV}Unz-L&ck32|1;B`o8NTbFaxI(Hd+ zOc>{mEHtIAOOF#hAR=M6-0V=yeOH6i_wq=u3XfDLYl>>X3?e|3^Tqqfr*3m}gn&t@ zkz>GTJaK_ZRJhs3m#BV46K0t5gU&ZAMvhD}8|^AT0y(*45dF5>ksJv{ZKN*e7EWmOuuz%MvTE+(L@g!sa^|Ie1t3(?dy+ zh7~4)C6*ugDN&H%m)Kn*u~f1OgcaqT_-pJwD%$OJRY0mO;c=^*35w~`ZGx3TjQgBk zWxtG|Fe#sWXv$A;zJI#4{re|hsCUn?&n_L>&G_iuE8PT7!!W*{CM3jsO96i3=LOq0 zrBIxD-j*$RB}FX{pLmybn+q1$2?%;;YbWoK${y2an|eI11n(saJS@(k?vv)!EJxKp z-qc%mcOzp9sbhOJKJ;%hbRU^q$^U$~_;BBk`1rWhef{UE%WKEhNt%Ze@A3Y2J<2rv zAWr(O-YhRGF#G@RDK8(^gW?zKO|{%g*sI!Kj(vAX4xe|0YB5=0uC&c0ziZPea347X zXq(JlA5^s8X>-&|dnb&LZn?bU#=SiXyln4PyX(ba@E^63>Bpia9&q{2u+hg&Fyu4H zTmPp5OHBRvWZ1M$@QPFT2<_XGz`=6XUVwOYf7ILPcl&RD5ovwsYYH{g-Vr@KGG&Uz zdm*kS;HFT60Wh4vqoZ};A@pTCIhJ7$LIBORySjP!akyV&&n*cUQqJ(|51nzDC%$*^ z4#YDHnj|%jxJtYnX`=XO=pyoRbz7PHY^^R52ic;31j@th7eRVBr$9lMcrye`f?8w^ zT>MZzyaP4qUiR=wR0-oW`!;?Qv^a6kyt$a%gbX7cfRsQG+M3!cX8G)`H~tb)&WONl z-b7|+=N6!_y5P_ma5MpwxQ29_(Izg!U?89ta(@l}gZ|<&1~C?zmq%2~lEV9%qnu72 zd$w7Vj3?IYfDUF7oQC_UUvQ$~EVPROPq?#|U1cxv*%0s~f>^FzTD@q=qgBBelVDc1 zob#j!kB7Y8y;QAwK5$KGB5eT-Zam?-8fjodg(U;N-`?unn)9*|(e1v%o-x)YE)rf~ zg}!*B!)TAh=g%{JdPNNT=uW>HW{3*1yJ}_#66&fjy%vBe1I8ta54q52!pnXKqHkhc zT;Gp`D2GPfhA-$I2)}VRe3YO4sA`v;QqDK2rlEk1rh!ldU<1(Nfulajmf&GKd&UFG zX}nZu7xV)(CY*qHhPMy&y@-}5?M*uC3G-I7H=Wk9abBEvF-195lsUdhbrv+O|LjXK zZ30)Xh!J7fposeS&NVCvpTz{nSia)RJZ&)tk;UHrOlw1X1~e+aV38O;1i_6tP=BTZ zkz`P}%S(iL9u{D;?*=%FiDk8;+mm6XWg#&+K66lkDm{^S-JjAe(#FRrLed@HlI7=7 z0jSGHf@!PYSgxw}t)b+BQT-{PPEcjQOR}Le#dwMUDLCjXcScb1@{E6;HP-xqRyzT> z<^J1$JD?Sg>c>?buN3A)Ri%(_z(uhg$mi zU?_R8c8{QudJ*@?48@951lQP zYVWrrAK6mAVGdRhR8w4f2v1dYr6{f$VK4fsV3J`a2xilj@9qB(HQQ<_E2(H`r*^^e3Ms4`#Y|W{<$sb&qTp~sHR0Q=0fuTvEi{K^H`OY>V@%I^9ob@|b zucqFKz%azRLXK$nd1Yl!M#&VO+Jc{|IcB*E-Xs7x-aNmmhF$GX4yl!IduuE5M*c-iw$H{x5R2BzDarf;3OoLl=?N&zA1uyY2S`Njy{3=hOQg7k(=F{6x&k762AjP_6%^!swOATnHKr zl2XX#9oXue4k3KJ_8&SpctPO8S<`57!ODR6UoU`r6e-M~*P2}j4Isl)Qp>GRIf@kU zNJpues&GK<Ciqr7hSuQ%vs7O7*=w4wh+yp?+$8|7{34X)c^j2e`rlzUsH=0 zu``IG4QB}xmP+@OMDVht$$$J~>1|M0i^Kw$T*HNIsO1qqA>U+US!kR_uS>v`A>(!g zNV1o9PQ~tp?_oAn8_adX-`h}fzbQGxJ1|*3p#=m+N`Lb#_lda^Km*JNzr~+DC+g?( zysMZfOaZ^|J0n6wSy3@JKdXM&(g7O3VK~Jq%!Y3Vjb#vo%|mu|0YxZY%vTZlN0Xw2 z+e!-d?*IN$T79#T3wnenRNnGx|w`^F^h8!Z1FCxu*0=o%HjuyLa zIOAJcKn~q2W`Z> z{UPqVOiHIkbNCBj;U@7~OP>X}XKgdHz}|JYZ8KR7yi%oAZ82fE`MZ^!`e-7JcATx> z=Qi7un8uhkxV?>zrYBtcskF>O+9I2)B@bV7)5@HRG#+iLS#nZs_}Sl^y-UGph-R!r zVuRaJT{JQ{wBT>KuPnz>4k1qHx6bx8Bw+5@@xiBj$1kZ)M5FSbY}m*2_-)KWB<8M& zAwZ54QSalm0>4n%9f9Kxe`=PSO|8nQz-w8-*U(T@z$bB;H2?N#_euf#BmB#nu1Eo` zE=!E|StI832ioeDd80UBgQ-kgI^r(krK}(&RS2kT*?;{b&efC4IhX?2RA_7r@f~bc z&*UIsm9CqOV(OwPn!vG`7*;tK9eoAYA@1izj#R{RsV&WGjDpGH?MYunf868dIVF^b zM}`+g3r+e!X9B8vo{h6c|C(6@%Y)+F_(=Zgk%kI;hO`{nRgv54deTHv`ec^ai>rvS z;3+tKS>hlJ+*$${PUl>#qb{#q+C5^rIMGJXRIs0J_NEjuD4Q{U=|A2SMF6ny>U2mN zP9AF!EE{s-mCstXy4_y=+A6;))p?_?vRF(4k78lw8giePzBA`7mJjT;-dP>5e{osW z>1$^>5ktO1H%$EjApue&o=eUgAnsS$5fNS`pz*4){Nu0r>xrtcKWjd+D;G>YulLdL zZZnB6jW|8-dpawdgXB|~e>Yn#l0?VLrj&!(;8QAO3A_5iZ}ck zh04gcM=)32wRX&}gc33r2GR%M+c7mT*!MBu&5>3!B}{al-$Rd4lT2ee=l9XWl^C&* zS1GniI%22;)!pf}M6q2qKhX59gS&wP-j}+ODPTf5g$#at6|-&LoQ=W)F3;Vc42rO9 z+PAK~Lt`L+g(%Zm1(tqVZP~SPwym5Nc5Xz z^P455gD2$VN}A=(NM1GLdvcuKZT~~128*WUz;@ZO-@PKSylT+Kf7>IATKEpsbcwcH zoGjn1?IaBO(+L6Q#eS5I5{ z1Sh}K{nf07mflN(UZBA z!IgRrz074X*f3MpA*{tAWdJW#Fr=#{f-J-oQ(10@{8zsZH7QDtZ^{T~yZ5VIIjogp znp_HuETZsK6=#UoNxy4BKFG)+<0}qAlLt2FupdH;x~O6X^BFG>T=PeIFb8)S0a9vx z#)e+l`?2U)Pf&4017o#k%?YEsY^Jq89CvvIQ=kN_DKT53B(ZZA#wkQd@XwVl3ZRp5 zK%hPdlhyp^8HFsnGZ~0~f@)fCtb4}B9`Hl+)=5eT7INEB=$X0sewEZKqFb-;Z3~1K96ED(M90&ABtuh=5Z!oeuCQ{-t?>5s z4b_H;SJ&VZ=;X%p0h@doI4a(T4Wl|b;?ze|Qju=b(C{s+nLHOXuVZIrIArjFUqwn< z8mIU50~uK=(w3Gf&cNXd7eQ_$ynm36ajO(*tEDVOvK{UI>MF2}K>>LMP{g{8IDK1w z-&$+!RPEE6-p|)>{)@UKg@j0)JrC5-&hP0KB8?{XcTHEK&6bzcObrTZf0a38)dFYr zKI%iU?#FB26d;mQ`|uV#d-H@p7#0Z`cc+~knH}Hx%K+Dsn&-N7?8XbGqCpwj1~&Yf zdd8Gg&!y0SNs4Q1#Bm~nMTLX#RT5OW-!Da5EIaVwT;q{~A>fWrZi1*=948D+QTo@= z%7$4+nsAi|;lSVhA-PIrt5x?YZh@u}0UyCvxgJo8?t6wo(&k#-c4ovV>kLwg4Uy?) zT=v`AQ`eLcB|($nUqp<{qKN76nPSx!6t(-Vvi{Ik49wHBA7n6QH{B@~MQW@($!Ae0 zEe^T+-jJyiQ4!j0WV@69G%_XO@OgGy9o`cQQn&p<7d9v-XqFP!j|Wxm4(H(GHg4bS z<|G1xYS4#vZ^y(-D&7;`ct%XhNDoh5SoCZMl=^MA>!KaSl(Ax`c>X(DH=X}=NirlW z`g>1XTxO#?^0velGF4V(DvU&RI0S04D5 z(Y0T>_Qes(+af08Ab*~JcaLh`Y?r;!>|Z6^l2SJeBM>mG=|!-VtWWxOIvctCRb=<}|F@mQ zvr*P{K8%LuAN1rmNM!`ek@srdHt7oWh(Jvlm2%-berx9msBiQ2xnI@~!s@NNRaGog%R1&|0Y9Nx999s;sG8{;} zc`HYK4m)4X5~X{aQUg^tyJXx1v||7Im7=Gia`5u#t?YMXvzV@A+b6rhB8d%asnISH zLg-##ws2b<60L-peBKN25X~3>!F-(3;x!lZlVmQ%aFM03p1k#-ppt%f z4cj^eaD*$JA7Tq(X!_RIy_R^UzBI?uQHj3SF|}Daq769FfYLOxqJ~pOc7DNz(I(8X zHj8|&NOLnJIn%Q>5{$ncMO^rR+wx`=sNTiPjGTMPmQ`;1&UZF}kDWl}jtVPA5Hhvo zQ^91a)zhDL9cKEQnm$?MBXK{B%*oDxj89BL9ipPhuZC7+s41;lwL~G)pG>2bUv$LL zYm`CLj192M&yeA+xeen2mdLqWopN2eR}|j4-Wi!f9e%`dK*{ux`UYof!aRuk@1lA0t?>C& z7Z^{mSz?_?vEXnGz@*x~e{@6dlUZCBdu$tfA5Tes;Xg1{BxIKNvgg@{$^HxTh?HQ~8M6vg=7_OOx1PjfjesWh$xKbc2xFQR0K^ob`56{c>Ss=Z zz94vf272E8VUIuA2+C0^xF#%*w%>+ML$HWem1&lL6<9GvLav3Min*_{Z<9aZcx8}W zE(%mW&9(rFj)`zljhoW2NU=RLVgEqMS>Nw&QK*c4;iAh?kzWMRH(jLyp-Pue6jV#L zcI}~jeX2B&m)>3&2T>G`hlR$J%9xFwapB5(>KPZ;Wbvj$8(;mv&;foVROd6n?dqwR z$|@$K>33V^GfKAi(t{fK0<;m zc5?d+#9Ct2P#Y#km;Ca}h=3Kx+Da^BxPm)|aA0>IWl63oNw3?_tIlj8_0C>l?O^hA z)eoRfaTCZeeEU=^^P82A^hfZ6i-e3r8|yQY;$0e!zNEl&ODcMvC0`J)e7qZ6dn8pb zD~RVMzQWVQf$3#Q!#EL$u{&V$7CDDMXAf^+32Hf`kCeX}oiwo7-G;cQ5;l~-VceRu zK+zE#vSzE4K^SA1<&?vCZ#A1--suReh` zKVnKb%ngcB?nc)Gqf87OoLST=A%>t z3^SP$W4bUj$}nyOY^avU+ecNXl*5G>S)VAAzJ{FMJaDt7)jW^MXXN-mg+4gKXz@O^ zOkX-JytKlp`jjzN&ca}TvG*qLPih?wcZ{;~PNe(1Xm)f2yXd#8)r6}fGuep~zM3Dg zSc)ofKNd|0Q=#vDsMZH?8)JP!1{FZENKm*llauICpL>iu=fjohBj2Iv8pfR`Jfdgp ze%+Lv{Uh-(Nss)LE3up*IFczk1udB`F$jze>;UK0`F3AD_fCc48TgAT(CCaecWEkR zMvUn8#!u{r=@uwycXGW}S|iJGfK-r2e+i%IBd;$#ch@CFm)CsvW)DqT*w#__X~q52 zHT3qypR>j?ujjr)u{@W()<{1uviCgsUQ3QbS9wAE`y;90aFC%)+CWnjDyTlpZqgO$ z^5Kc8?RgTU#bn{t5uMQO3!s_WM1WD5EZsW7KDSPFD$DkWy~L7s5Hx9P^!RP%8R6pM zj{M{fM$LEE^(d=uaIzH<2>Ip6k6mrvTXf@yLWhi>b-gp-7L6~+exiamunvBpibB)D zPS?Kr+k`mINa~go@nVrYX2mU~*GDy0+Ttl&jh*OsI7bH;9HSUn|AtRsX*u$)L~y<{ z`2I`xcHAcOCpS_o#mleQW#q)9ZV`*><`=yZVoeN;-*@wZ70q~N{Y=%y4`eyW_376> zn$#OBw7BeLrv2>8;JIgDrzh9y95PQmLE*B98;{S^s1m`V4*Uu{rjP7c6~nu6yXaZ& zafEfbmuIJ0C`A2%ufm?`q4;Fnh&n52fIP9bbcS)I`@I_%QPk5aqZrjE+Ap7Y*Dn4h zU`a=dvNn-}Y@7*P_8~lD6TI9s2n5luG@Hz`A{>}UPRW}@d{awhLZyMT+rhu=8X1cGW|TFG<&TEq&{!B7tqdQGp!E6Lw_%RcEx6-?I^Wi{DuY z**$sgp^&&@g)ZVdb?6W=e@c}LJWVUqCVbh>&fRAnt=?UCYzG7V{3gc?9)r(%Y0)sM zCqf+QFjGW&_!({L>x;lkuOQ*tpFAt=ZyT>M{|$Ga{YUmO*V%Y@b1&U-RB&auf(Qee z0nv`XUUoc{zFaxkxZ@Fd`~wU^!v9zF@d`wJ)5@58v`5j%r<|d&5?kP~nEHFuko|2e zdmSr5^6K55N1Ry+`#FlJKe+yJZxOh;FD3zjwj>Q4sD0#5qdTNmH^Gr)4Pc+qGhH5j zO{>(4pn5nDb~TK#YTyF@4Ly1stn~i6vK7|e-hJw2l8eJN!K`7tbUm&R_IPdj2oC!A zrzjmT_ipD#c?tVW|6AV{e!K`mBOkN_i>i4q=g&6WyvMC<_^Er$CBY8A(qt1P+Oho@ zT0eBU#7VX05eb937N-orQ+8$6;;K(;oCF5Wu zkDdQvNw|%^BVf8DA~qIOuz|!k$(bb?U-)P|`nW*M^}P%#D;dX4!4Up-&%Cqq zr$rM-3M*e*;0`ne52K^zIZ*tISC%HPM}6)Sdh@eM(8fxfh~$(@enVsAlp=VG7GI?c zTN^F7t;E?A)I@a{OOIXi_505c0DJ+!!=(<5&^)7;kMxyrrC|gN_)fw_b@;WM$oVEg zSwkxJ@LaPO@6~ZqM8n5P>{SFYP$7DN|ADf)tm0BTF( z>}x>@a;B?h#4s;?%9@VFZZQKJ9Cakr9Y4w zJ6S)Df}TE!OGrIfn~N27Jh_dGd5%6SC~NWy*pw=8swaRVUU3xdEAAN5M!Jo)MOt0| zh$KNtHcC`l6?l33N->RTtH}1h@(I^1FqhRjJBck}&qjw-$f}aFyxp&1Bv&P4o;lrM zFX#4l6Aff731Ro_BKdO@lE9FDmjY9xQ;a5>AEStOrk;^mOfue(TMD8v;&zt*Q8L|F zD{-~mhAXce2+5jS9MSZFQ`?nm>d7lry_S5Hs#216QynMKZ)N*H%a2)*E5x{*R4K49 zkF@!QynXQ*E3N!}umnObYTv3FyVS{#LLM7yFcOzct(;95p`?_Tg$3-U>Ik5CTJL{A zhDB8EmZiWiBc~xT)o)l^RW?5eQ$_~D5a4^R*JhPDqYBK+aLp@aIh1GS5WtjDCX4D? zsey!!^Yct8)Cg1X3k`F1Bmw9qc6S9f9kM>l$*D(5G-tqhyqeXxL z4}?I7_Cw!1*Yp}1g^cm5F7Q9e!6Xq!++7c&59b{>P4lK!Cu83ew5iwlF1V}#=8>P; z!tDh%#@Z*i7D_2;OV-V@xgaKUI<|D{NFP@qz-rg^7&?3(n!p`L2N;DKTlvNW#y`r= zdH{DBdyWEb+}|Z5Cwqt3lYTp*1xWy6M5ni<&J0E4B+ZyeHa-?FQTe{8W2A4YFg^+& zkbOMqJ@puWqXYY2yLS4qtt%9nYxRL*news%hFj%x!wkL#_l8Dc=Y{8^+s{^ zXfW0SLs)S_jXCTNYa@(R9LHap1<1NcgLJ=^L0LMVTco*D?|ji+vlA+r9E-Q7yM92* zX^X1m{OJkB1l5YDO_UJbCvr!_EsPmKDmcCRcCSK9p;wmkqpI%{h%UJyn6N1FPl{4ZC3E6b z(}r?Pr$DGQt8y9fVQjlEv(ni&MLj=Zu-+LNw}Msf#Zh%OCntUzxAZ_(+x*4n2;2=H z7Gv5lA682f>2uw;MQWrs5f@0w?1mIG@DQhLEIYQI9#-$4RY91I5njaS%^WDG*eTBo zHZlV1HHK6#IrP^?UwmL#$KH#;P2k%&8`Kp)$9Sq8aOJOF$sDI4gVbMX^lzWD* z7HCpz{yD-Oz8ABENj9upr2KiGmhfz`IZ6U?{MGax*FHDG(wj+JY47GH2SBbS!M}w6 zcKcUIdMB!4@`vWGOJ|28vKI*In&(z%%BPgU9?AAX-HDx6A}zhe3Pv1rZP{ZXn(BY9 z47kSPxhDEfC`xAN%O;s5L}tXx#nlFzAT73qfK z*A~6~{Rf5_0tl-J7U1FL6Y0qW1sbjy!HoAT@_|04nn;>oa(`0spOBC9E*b>-aC;^` zr%;9MmjaQ%Qm}tG85W7}rRf_XDt6x^+u4zq))7xIVdiO`i|!4K#`+!Vak#aN^JrOu z0pp=fq0liN#0bnw2kCBD5Qg-W-D9RGO!IhmZRSA)=?3F?OKQd@Y`eivSxwm<6EokH zs2Zzs=wm+>(h;faVZ``Oa%ACl|K6vrU1bwz8Arc3y7={i8sB?na1!cRl?n1~+R7m0 z4X=d~dP+u5R;lqfIsfFZqI4_!UM~~(I0LF{NXcV6Rz|L$|Ko!8n1=hd+K!6xAn08k z8TBZ8eo2tIM}2h{QSdmN_2dpG;1{0yN**ugmLHGwaz+TeD*j;{9VW+`e4D#K`vnlP zez>-=Y65E3muX$}RpY(TFR)3PR@-Vby6<2UiXv!SpI&WffZ52np!eL^=wwwoRQ+6gHMoEL zP;`yysRBdb{5+xaKVnCG@s={P32A_*4a`P>6#*=V(8^JTg-PLgzo5oef=nn`j5+(p z{O?fot~z|+ER-6qU^17qL>~jIfqz>M{@^LQ=XI^2HF%~;iSRkDf-xVAe+RE_i12`y^HDo3oMOtyB!}-#!Hd{Mx%#TwJ!(u(^6+U?aAnQbzz}Nd?t{PXT8#I=x7Ncx_yNU>6fRK*RrUELK^!?}E|Lt%DS` zL`|a%ofeOMCJWFHLSDHB5u!j#_a=vSWn2F3uxQSlFsAj%bo)hump82Qv@XKO(5G8L z;Q%ors>V@uSFsz@((7KG6|a z+T>MiOCyT8-00L{oG$x)m*`Ow6>`8iy-a-EvnNquFJq$TxO8l{0v}}+o%w4)2nE>< z49Im99bu((RdXs7hzUB8px&hGMQ&GHGYuEl;h*34uqMLQgmfKB(gB7Wtcw>LNTAjd z!z2v!>F3CQRdVqI->*v|uEMO97L_RLYvnR%${c0Pn$ybmgL9Nm#s0qkp_y$Bd-3fE z82flk?sANsf61}NY$%(n{PF985;;UOSxG~%&^&)r5)fg4#6dK3O%AYMnj}A{aPs3) z4Pi9r|6RsyzB)W@(I}8A$l4Tw5yvw}B(;J?4;a)3Lt_;Tf3u$vZri!Kw-4^l$%u6& zR8XAnu9k2`L(0+8eXz@c-5S(g6TYyuxBH$6-36Ya+c-@B3sCaFcEwHo-WkmiYMCV# zswd^Jj@l3Zl^T5LJ!Aiqgi z^hbPMSijA8Kl7LhW4Y8s ze^|-t>4B^=M6kzhF_?*+onGp! zZgiim9c_tkTyxI|_V0ScS}Fv$+2?A_Q#Nv0zU;IZ7CZLQ-=dp)>&)5sA=wrR&E!%$ zZbfvK?SB(X)p~{d$MB#Y_@8WcEd)FNen#^lc0=GvYq-m7(*NV?Eu*4rptfxoLb|&d zLb_4FksP{_mJV?Qln$w(1cn?^8tLwqk}g3+8l=0s<-P9jdA{|o_5R`?YXQT|zV<%O z^I)m25{nx(^(WLjMb;UCl*ldn=Omwq^64%NI)>s3b=Zd?B6bojjahO^nzlrwH7{uSy9RR zF#h1ZG9K>aWFvUSRf#IZ*8rA&D_G6DpA^^laq6hae!Svs3}O0P@;*0*5H`?Cpf_{; zmur`AXC{rJ>dFCO9GkDduQ_gTw-~r2SC5@t{$3QXD?Gw(x(scaE^&0!{Q|i--sd>L$ z?&Fm~<#?*WbY232M} zl`?kDr?%4W#Xs|Zm!2nz0atc6V*|@SfCS((M!$Xj(;4$8Tpl?&>1+@ZZ_Nm@lKqe! zdsFu^kvMBRG5B_ux3}kt|FL@S%v=xb3GQJc;vvQgVsrOY04fjIU^rm1z=$j>KxQE`w_aof}jE84_oUac#;UNRO1 zQ0+L0^I?lW9}RL_JjmXzaz3>mV(OQq8TwLk>pMROmKS5jcn-Vf25j3E?1L^`B;tzt z9gd3n>k9UC1g~@y8tLOjeps3hdHp7F5+Ocmx&v@(S>5d!`!Esr z#LY2^H9lp5+NC1_66T!Mn_yn{K!SPittLyeHIFMuFO6`Xs^1nb-we;AyOLhn8x)I(+&a*S`sZrV&j)|nD z4QG(D9ULTdv6NAh&`^-P3e1jEBag>rv~2sjFu1*!%c~O%e15nyuVHb&xU=l8|?<#)Wy7b-t&OPQlTR*Cf9AlYjjQzl0COZF7 zT1st@BobvDBTSu_Y}U%SKb;Eiqx=k)OD0slO!^bUL~do7Xb+a zt&mVgYNqKip9`TeGmV_l?hiLb#`9nxFiLjBzL96e80gx{)S$=%h6SD}l{}aP!vYl3 zNKA(rok^MA*AT#)`yWlCiQtpBIQF7xjcj&E5nDYhPRVcZLVAlR1?09(!`qEt2t>e4 zp`eNSeJ`TR{IoQe|7Vf$VW z@1`(J6 zmgfJJn`gKF!zGF7;=wqSn!bHxalnUm)%vRja7w+eQ*qg7LmTRB6Zf=WpEtlklL zZwGdfBz7zeOhBr zCEw}VKfZTJ&qpObJQZOXD_N;1!(?*aYuwM6!lk9qWOhTpuE={oRJozIp}8tQ6358*Gsi2J%^?1mAIBD%R6Rk+mEr zDFL_ciMHhAQDxV7CKDnYAt2^VJ24t`_wD&R-y=X28wGFOw znrfO$d^UFZ*bUxFSXaEG4HjB`Vllqj2I-Rr@#lV;i*oawWxg=UEE_?xtj39e| z!Q%4L`czrUMVmA${Lz1)ip8bMl|X$`Vay7PO%!u20rsyg(&7rb3(Qo+s86{jk8c!HH?&@FPjTk*2@1{rzV?qPB$Fr{k1d91KUy_L z2g*dEql6O8AF&($$g30*+Q~c?a${=S$xg|Nj@puANwsYJ#x`T*emFpLaukX~I+VM7 zH{En{-}!X!^>KN*TVn0x6xkdu-!Mm%MtU^rxR22UcwJjf6#-M{|#RrquyM4 z`q4}6Ikx(T#6C4Gf1XJ>UHspPXrLGvG#()Yp3hA9@z21)=9~$O&JU<_MiO3pAcDtm z5!Di>k#egF(bmdXkKZVDRV~ssQ9r^M{Us@)>cO`6w?KXJ$1thK$tQY1fp!jA|M!o9 zv+S<3DI!S!(9G)dBXMEPb~h7!X@icFLJvo%<-tS)@3gn9)lS!k29Wa&8no`@azE(l zY<%1#dqRwkAbZb@sgx0Y1=sur1R&aR+xZ=BuXJf$8PF>e$W001Jmcg$)jWHL9nYT! zP5JOd4rGzHe{b#fH(&o(Etkg1p~`iG&InejD`&7x?RgekNKXXPO3_`+rqr3|A3-$k z=cy>#N4N4B)f{W-iGR?a(hx=kO;Z7tK(Xdh-?-`wN3*u6M`~AoPErGc(F_b;KAc>5 zXuKC@?JFsBny8+Tq9RhAm}iE`NmgQ14*tFp13@r73a``Z*qq^7Er(u91Itcs>Nxf@ zxydV=?V-lY6#GaZL?&U5MP%rQ4vGZJ@6nZf!mVYOI`9> zJFx%!n$k+1O|_ELW{La5C`7%Qhuf}MhuO~{#fDdM9H{a?7wRzze$2w+0lx9eSWSn_ ztT-J!-9AY~ zSoIQoA921Z(e@#6P?rQ&K0BhmXUC$ZyCUE6j-DV?A#P4&M<*h;4g7XoJpQ)!DoI?f zyjrz`Zy;2HlSj!paSfBlh%Ly9o5ZfAnJcw~8|@=@W?Z3_EH3&+6cgRQjef8q75<^(*!Nm}w2891kOzzEbta6*gpW7z_xriI zpj=p%Rx*Z%duZ+;(w2{6@7^E!QVm#T8gsj-D|7bHflr{Y8KC? z`BNz`DfYqo_$YxzsEN+7P}nS+6g@xm;}8jzd`^~)9XE#3t`oNn`0sbiueq;1;w6B< zOo*vuoB57e-K%Hhvsicz-%;f~5=ck-=GJ$E?t2IvXV!f?bXJ$sW)*9rtc0>+D8~>U z7a1ZY9S8Vv)AeY;fLF^Sms(^3NEdwXi%95IBc=~;(mZ(BL= z<6*71Hk%AKC@tonL4bcL!Qs7m53vJ|BSkRjaQbUGEOZd|Dib<5J!Uc}h0y04qO-?RJE*vVj)y8jexPEaqUQ@c zED$i2k{5ZehU0~aD971Re{l|(`f_lX*L~xN@k#d)SGqgrX1Gf#8mXSz#(AZO{vd}E z41OzUZe~{zaqgt2r<9O5M8RH~GURgW!&?9|iFm9hy2>CT19I`ZAb&#l{ z_%;nhlqu1b4-bq`9qB$L8c`Y3IHw~&`yxE@37fw5U!ORyGPq=OT3kAV3VO*`YH0Kw z#lq%UPUGP(!bi+{<0fS06z{J_q~S(J0SZUn^8E8bf5k0AW?`J-j}RSk5({>EJ zQ=i;jvJmHc<1-g!12uD2^}(B8$xpm;{bgOhZT-_6|BPUbeCu>Q{`6qJvbu_j0>rQx z>x93_tZ@|b!$U9?Xx;o6P21)hf2^;w95<0Lp>N2?bTB$eW)H36Be1E$?Nq37*9MiO zJ;KkwcT@0#33$>GW>|xNswh10NUg}Eu&K_kOv;lwQa{NjY3zMEc|P(9caD`L2JYpL z&%AQE{wAX?uV13hbor)J0w>X{x;KYDxd373?23bG%m7@*w&-{pm4u(Kj$FsLK3}948v}!q4 z7i=s(Ya9r_yJ>8e%pNSwO9S7zgHYOyZT^G7#YG!oHDm@ChJxyB7E|d(WXI53oD~uQ zCsW@XL~3kRrvIZkW)5KuQc9!@!dtU%QbM_PVCF85jCD0*E&w_N)~ zvF!4!X+37tkChy5jQ!40LFnSKSsKrMH@VG!xZYprcRUGmm_3vMJ0D40$A`0&y{EhX znT8I~gF6XVik2_kABvkMXPy)@p3bs6_D8(_+Y7yJ+P<>><9}uML~wL;qgZDf5AKG1;G<=1DF+IA20uO-8RtVG^>OEu zjH%(`sW<+^PpZ$+ zI#3}mVbIf@dDISt#HcN`t%|>K!UGiLX07Ux=IDq}iB#t#bIbtrb;m9I{8r^E!SmUM zcwiH3Z*aPW5x`!PlW?R7fdMX!o1C*jHd)+;vxHw6buI7AGi_JPAv#oFcjb2DCu!h> zEdj@h3(N^(Y7re7HYK92HH9%f#iC4NlPaf2(cDPSryf~&IOh)U+JL2%yqAnZK30*< z_Gct^!uG29bcxt;1Hx>Leu>bRmiA7b1{K0~o$QJ^rcOO6`xJpA_iSws;XRJAc9h)0 zCC3>cz%Uw{HmcR|OioHctA)tT;0w;Yx;Z@I9_F>9M?eO4f3H+mS!)X`7sDUV`T`>% z7wx2qT?4h1JD*)-iEu}q(~!2DwNYf>tIVZjVYqql@89X$2!Z$RZ(KTL7;}j0^{7^^ zoyU2GGQ!y@HjQme^~svdQnIg#CY8K6F=|A8hYhqhd2FF=oA0h_wa5YRQoCU4y^jdB#pqz z+9+9`$2gPE0K6(7C>>4$WWSvA$;2}&fu9?>{>3$4-)cnx$INjCEwHvb2{Wb$2>LKv zrA(RBGe>T*eycg6_N}BIoK#uu>tRS+Qb_~>Gf^*b@#l6Ahs=)JdA~2yG{>FS@X|r= z7#wX*HjmW(y}8=6lCk>g?d;~k?lW-XPQn0z0MKZ1w|fHUk@~h*vFV zSZ2zk%{FJT(xJM{8stEHhAEEkQ6B|zxo~+#f@Wgv4)%hq3C?c3KV^*}eH(cgj8s@F zR{&dlgymN!m@(j_wihjgt=?o|0KX!kejThKrV*0HckCg%QlbkPM~XNr z)rDlxB$IQKR(g;tg2S>b%U8V{pR=_Pl5OXpTJvs&npnm60_<1} z)!JHvc}*Etxqmbi#1TzN_)KjQsG&J^`wyKy+1q?w`)BpH8y%Yre5H~LSaF4*0LwMH zbt14dFl_z)BOg|JfB#xX(SFg=VD)=dwibnWdCI8(dykFpb9Hl|~iLsG{`qmz=AJ)6+ z(zp3Jnrntt*(ypg`FC2I?PF>BBUdiYubrPHG&znZU1QYJ(v$UZJV!v^^p^~@^6>B> z*s2d)-+P=$7JU#EMRL)XqJq3>?oX35*vgjoej?&E;NR5EXX4@nQE3%L@>33c{UJMHS?9hYKu7G5$C*_4aWi9@!*!YMnG5*Dj-66Jsv?)=tZV=RLGWJ z9Y^9zZWsC=;-It*25s{p9hZ5Mm-vW>uPbx(I4bhBa#&<91@X`-XMiI?>WtvsNBOL8 zJSqrni)Zwxzu3lPlp=oTOThyNLLF~|uXpYP@526Ou=nb%{nzho!7IKDlwRJuu|Lrf zJd0WnhZMEvPvGfr*Pf^NaPA{6Oqn}?&Y){6^!h5X1462zh=|m*ZTayKVhMYaU6}kr zBL{+RQsjqm5m2Yo*+zNb!D}3Hq(~$W44W3G=j)u4=L!6UU9h1OYHFNd|rGr~2a#l=^w`H9J$F zdGQMf?>frsB^f>>8fl6)=81pz~(Kn>`a5u@JpZO*f7iB__!(5JhH(SKGdT0|HyD#Vy@`9?~E&cXSQF+A-gez?f7ZAb>jFIVGf(fEy*F-jzOk3gZz-i|DihSt@Xgd^xsZ$nu`-uX-U z&_P3zUjbPu96ZRG-|gQ{o6E@vTY0!&IY%svs+)un@qOA_5xeG$czxo$L>?3p#|8oc z&nF;o1c^#tjkjuioIjKO&;M+AtAzhn2u~Iz+vnWEdX{~sW1a$jN!|c+)3Waj<%~ad_S1xi}1aGlFkC4+Q%b*X#8q=7JB9yvj20p)l^?Uc+Xne)LvrXKGgyq}gAw(Sv zIO_Tx@!A{0&LJ%0oSG&rWV<8TT{kzTH!%3LNuo`Vj1|6)J<<@AlYw-Q2C;R%rhcGY z77^oh;}Gf3vD!Spej!eV=4N=CWPU4eGKNozGRUQ&JB^hu-E8u9_}jbvYs;?!7uGxy z75ji(qL5C1TWs634kI8OK6LxLJB$b$3$<&YicwGlcfL{4ltO7TgbY3pMG40F{`$Ab zw{CNbx3APwhmF!!cHR2KqGk`dsO+62Ok0Su*ImS2Wd_ziI|}|}a5vRqxTgV3@ul%U z-W32RD;wq4>Nb;EhGTyC#ryHnQe#aTBw?ne-C^XgwcO07Zt+%<$rGo}A`YMyvAc0E zw{fgC5s`gQGiFS8B}$>cqWmX}tOnkt(nFT31vFFxXa(K4Iwa@1XYfN7cZre@*FU!< z6h{%GXf&rW3pzX2G3Nv6FTkT|A;G6C4XQ5yy1VMtDq8}Fs0v=#RJARTd-+1%)XO2i zmEttsu{V9W|4vWIPg#E`-IaZ9W0Yl>pcSOi3m5py&MUKr}8l7utYwb$glXpbl5A#!P43ejmW69dBYc=8SH+oC22yO_h zV)lyjdup?w!uqvzJS3U}^Fbg>h9<026sxq*W76>qu3dNp_b4EubzWj-fH|F5i zR>o}uRLL{|lNeCl3h?W@5&*aN*pVwfCa!x&|gd`$1w=~h$bzEg(sWQg-88-K`Jg#4)$bRtwl{?35CVLL@d(rDlM}~_Z z)~n%}Nv1>@4FY)j2&;u^Q?IUfXl-*QlMu{Cfn>;Tm+Jva=s0;Vb7J3C3L8CPnSzpdKDjLL0D~VhT;`2{mLuZ<~6#0Yt!4v2bJIB zB`O45E+0{B**_EQ!Vown+q3TSj)n}u5dK_WvAe|1+)TaN*)F7A+GQ7$FHOj|{1x-qt5&psKZE#eb@PQ2@ zL(;Hwp|yaI*%YZ3#ld-&aUU%9yUh_9@XD=sS8L0J`C55VH@=yQo8_3Tmya2T#v16t z0?^RO7u9JQWz&5uBSMQy^k6F9Y|dpuYSy_geSq_0$juwg0@O4hb5 zL$aWR8focnG|V%=G*0YGm#r2kG_d0_~vZwztwC`b()~dooaWt2&z^~|e{}8^JKzk3%PzP(O=2dw=_??ra%8hN_l}9A6%c;wFBbng~83a*=xRoX`VrrA2yCW}}?- zRFwwDaak@f-1E!2CRyxAS0%b^*B>>8i4T$N+9aATuG0w=HwWyC=xj%ywFIr8g*gk` zC1fYjpM23e@4t6OZeQ&>X7YJmRz3Ore_JEo`@<@er!xM463O;`+}rvqIaPt1)PR$j z0JN@vhsvt;x?dfS<4>eKOZ%RF)c?CYTJ(>a=YL$|Ujfduad_IpgPANt7DmZfx!6R% z+)Zux`1eUFq!${kr~Xt-@d0|Vzdn}?rCiUao--DY!N1;l7X8s;nd&tAykk0LD_sgz>DiwRk`gi z9C5Yb6v9Q0@?Ur4e^Q)VYK2+)`>2MyM_sdfl%eW-nq7I=)<$c4+#p`00G|y`j zFi@)k|8^Yx5?*HftMWrVwELz7|I4R%DELwh(mzDU2gR(K{p#XFm;SvN;^+ zp04F#)~ggHwm6k!8W$cF<{S>Gw=&`t&=8*g$n?s!0C3?2{>BOO3vK0E@#}hA0$fNg z6Qa;(@Q$K?$%TAdW<{Jv$DT`YBBfB-9IGx!!X1Yusi7SJ*uvp6u|@ddo&?^>D@R(w zIjif}8HMDqEqIPr@~ytfc{p{4k%}PL@g;Qo*+_Es#)Vc~sFNli9^v(~ivy|?H;4?X z*Qpa+CqI`bl1>smij+JZ9YuYTOde_3S+=wCX%Hhw2+sL8AJ$rI;`p86`ue^YBJA+$ zJ^m%}UMzl@@%H;@T3>ff$8+5org*gwHi3aTs<+Ig-`w#X zQadazrLofSy-ZVfBwQAXOCccdF&(6ks!2v?La#hV3ChcnHSH}Ux`o$o8^(oE$vDff zlVp86_FHRvq{GK;vM51c3b7p*n8sZ{cNnjqdi7bFpQgzWpz7d_>I_>_lIOXyb7h3* zyr{|Lh`8ED;QDsyv)a!y811c%7sPSRjToa|R$75be@;FMSfx?0mdH)Ic{NLQ8AY)KgM8Mi)2wA0CD?-_6qXUUDNa(f`g(ThOTSVw^24Nfh| z*36%$43=EP#-6eD`?h=dd5a7H-6ycdOCrG5n}=|~Gxvk`S{sLxR2kKUU1^qDQD_q* z{hQwpJZ5V3^Qc(KyBCNyCRK-!;y4Q1s|wMMiv}LmnuRH(K>pObT}daNSRE*b%h*{q z9~UR8cPIHsYuCv?+cfqIKSDeDvL#p*MP_b&w}|>zY6xr2hNHz@avKd(&>QxV3hv_q zN7i3M+(YhMk*vDR4B-tTB{x{j8Ag_T;|_F1RMwad8xcPnX%E)qjx3TZwxYGA-8l0e z1M4u2lJjhwwC_4bCmdN^@fHf|&<4Z^@bn$g3HrLSAFf*~+n%O~Aw}-bp=V*EyRsp~ z)k@O=ATm%DcDxk*%|D?Z$=8f-rlgPr^h{TQwknO5Pgq@?sZ*0}nP{?1C;{Z$cT6Y^ zp}oV@sv6cLFPUcQMmNq@f@5#b`wcgYzO+^XRcF3f04jX{7^7r$4)xpo(q=X1sJg@H zvaH|Pf0=0&!47sj_3t`w*2i0W0?OtD<&p3u1qzTKTl`15i2T}xsTu>Ep;05s(a|JRi}4}U{B)RJaW>#E!!BBC*acc@g*p?YG1|2 z5c6)sNU0Z?(`}8QGt|u7xP~0-0LA>fSzv=N!4CbZ2&O{uNHPG2k8Fahc>v>%=%0Xa zbj?R$^~q=vw0Z84>$}BmGiKiR>iKnO;;BnZOB3y?bPlrjso!WVNGX3n_ktxQa4SbX z%QgF^JCVvtuN0GJg@`S0U1b3Wku;>>Vzj z%hP`x1&x={+w;*GO~fA(=ev9(G>Fd3jmV0JgLF?`jt@Q48B`?;dLgoGWVW!IRoeV4 zRlHv-BR#*-c9tGyN|}!>{tOWbow-)iYV$K&m~CGY#^TgG6`Rf248f|Nsv=PgdUmca zmBSHbYqtLSZ#eAYx`Q$GBnO;Rm9u6T~Q zblSf4f&RM}IuR4>S3L{G@jrjW96b&bkPAK0Huwb;G|k|6|5${~bR3_?{+kF0`)}5v z=l8mte3Gocy=b1_zIrPCA7&`l(~mfN+W$Q^X6IwlJ|*fy`~NUQnUyy?0p43M2yh|$ z4;s3EYI+>ze9qvS zztH~2`{Q=S)Fp?OWZ@jW4Qc>U4A@@2dwCN3bb1Vw4~=XFg@rxSA8T96cVbf!D-ewj zBaHLAsgkx6$Agrcuaa@l{P@7J|ErniDdltEa<1$5$ z?a<|f#6&Gn>OgT}yoEI%+WcH%lDX(-S zwKM&=dMyGrri^uDA&UndynW2%^qQWqf>8!ij->H zk3XdAs{Jjq?YkALx{v&8UWOFo(|h@C<}*ap56mcjnvH9c=ow?`ZFc=ymcjzqtm<^c z8q?&SVf5_&U*t8UgRU8Rl!&oMT66am4m{Xu6W7Gd78&DgIT;u=AHJjK)7B*Xfs&Bm z$}$^?*#kU@-d0UOLM=Q=Tun&jBTgiO@Tx~z{(}W~yPw2>ZnhN15D4Mx?R*bB zB1OB>!MoU};SFb2!Ra`aM88-cl(+vpmQKvJWX_!MJ`a4t>G43LYe@fmNVETKpO$tn zGdj=6L-H_R2wX(HhR3zu{GgS>-Bi&j@9<0U@AzgyYY~0TYf7vQw}i~>510(VvlWoGF4q723;(fKNnS-<*DGbv)Vxwa)RhIc|TJ0oH``c|Wk^<7#* zZYoZiAAhMn{x)4}R+mi8XV0>8=bf1FtUSUsOXHoqOUer@e7wI z-dl!iJSSn+-N-leR14xbi%Lo@XPTywN3Qxho}Ts5KkPYom}nc&4h7<*+YHcv=IB%8 z3AW!?Fu&TOJBQ=~*M?G~*Y)gHqwDL${N{858XI5V=wY-_81-DWLz&_(yJ&*l@h6sS zFS*kS?(C|Av-r9N zlmr{PmifW$s7bZ1iCO^3dF<#0hNQy7YT%A)P6HtJAt<_fKV-!~gk?gCCtXWR3g>L+fYQ!LOhdS3osNRteFd&rI-wY z$$G@BO)16foE%$sE-dQ%>v?wOQH|}*$_xO=*;G$~2&jPg<1WM6?k_!dq$25MQbm7s zmiCqti=!^}{A*_VM?*0`#&Cm}4V^pba1O*PBMmgRw>$=C6i{-%N&Z=wQ;3YJ>= zW~bcIJ7lq(+nEb$qKyt~la+|g5!dmeeD_uUR04J6V#FPgjP-D0{Z@N*d5^orkRNZ1 z(?dj@aZ9nnDVmA+HBgN?jjgHLcEV84MZUpaahMIfXt1CtA*GFOF{VsaMQ`ZpX5GuamrHStubt8i|355uctOW!aaCpKC>z&&x4w2Yv-o`f?Ly?wgl((KcqzFNka_^%H--R=>zB@{W1@ z^HezwbWWSgWwidOu5`KC#J<>j1IeDaH29M(r5 znbzh*8XX1kSb}rV8Qfnh)}Q*du&oYd|K2Vb=NZ8}Ht;o`XRgfsy16z`ry8wDnGSn#DJejw(Hkr zHN+0!a9GumLN)5;ou=^)F>mpX{*JvRI}OG9s~Fejf`l!0|sq zk;t0<-QQr-Dg*trS20CQ80XiL_Y3WFj_KRf>T-`ImE7QEZx{NnUd!?9KmiJqY`Zy& zw*25WEg z`_O3;bLsIotb;!WXtKI)K8)3s8#>VQ(z&fV+AhPj?>6K7N9LeKRbgXAP=xEB0AlG7 zMRxGuUt>WOz8J~wB%+sc+6%$gC4MihEJu9kx7D-KQ>)oZ-Oz--Fn_ zP$JXB!?o^OOz^u5euE88aYnX?V0Q}rbS160w1m-n$q+yW67G}II{|rDZn&ljF%CaJ zqUoK^9xUfueGFvxEKstVyzr&)P;;H`KM##d>awx#nQ(wo2&(xOJ$4+Ry#%3GA$_-g z(+RWqkcby8DyX4%woHYuXNavXDF|>D+%^Pe4nt-FKMpBfoJX(>)&E^PvZ+$G;Q}Xd zI&6P!K5owZ)I2S1XF-#_zqX!gGWe0K%vKx({UJemKjIibUMtpo45GX2LfQ#^`#Bla zxWASq>czN(mh@L?TUHk-+>pVGfBh4PYOOW_<%lPX{!V3opI#!D9xH%NO?IfqzyI!9 z-oRZ8b{LjwadM6N@bF)D>~h-gTJ!XV|6lt5UFf7b0_=L{ZMsyww$gF=;~D=G*sSAo zAI~Rx!q@w)@ul!2yxwjCB+`sb-q&$d47$=bf<&x8xLV@@!X`8_?--O??oV%Pxq*Ta z)cgm(%e~hRtBn7uu$WhNcd@gd9=4^(Z?6Bk_E&}4v~XMJ>_6Kv2tfPy7(hMQL-~tA zGIrqZ`RU=B+(Sc04>2|5FQ32CkHbl0EL6vZ{+XvG^C$N;SE#h>0&8w9U_ef| z?2fi9d`@BU++tAVXB?e)&1X}wkKKaRvU9TxfcV!!enU+Aqh(fs?#fEJgHFvp)v5)+ zhl(va+n@?w2sb{8P+@9YA~!#+DdDfqhQg)ES{1*yBGBUivE~-KKczfP;DbLE>Mz%$ zR)%vGiamdP;A3M}a7ZSc9VCs9W~;8c2zOik`n`wX zKMcB{TXE9km$7w*U7HuvuTdk_W1|hjcRDnG^a!?jVz#+U?%r~Nk385&IkC#YBX7AR zdAa2!fQMOt%w~4h4PTnFJrD-KSf09KR=~^=79(2f$Q*iYyE%v*+sZYokcK0*F1CK8 zwZ5*ICGe9BCR2%ue(|3zN7X7MluVazhQc;W4#w4;t$~loz!67~KZEV%o=HnjRMH{~ zb&FxIbnL@cYIw46SKcbz?HL#sp(=@0J+@{mdE6I@wwJX(e@Thb! zEggz6`aAHR)Kmxhb7O`)Uf5s4T=}$HzZ>O}ktR}Cj0A4~ChE87&3^|Gog+Jk^HJ&c zIOcFe=${sv(lQ~KMn|SkX=#oUI^0y#kkbk_IyN$#!%wVkGYYWm?nV=r zuWLnCsS@Bx_i!>BTaBzak3X)3?pX;W&X+iBXe_cIR~8ECPVr_}^XtVB`UBI%&^-09)7^1+AcEX&8VV3pmrh)P{Z|;{(D;0?f+vd!<%M zG+vnnLDn+>D~31VisszI^gLNaA=Ay2(UdW28cLy!NLppEMfSYciM)PODe^v zb+z7}TItEFuUpjX0;{Wi^o7p-4UWW+xI$eH{<%si^*1J!2AGet_*O<>RPOONfJo#B z!cL($l&fb=_k6<}a~to@e`DEPJK2cm281~5c+<$pu4gh6dxAPB6lR%mvi6U_QEKh8 zWA%c;1vP>$oUAM~db)YxcyLF&{wj@(CtIf>14S%_Fu>-A%=OC1TUSQf zam@bQ>FYt|PVgQE%Pn|76J0lkfdI}3(>WlI)BY*$Dx$SO_{ZG)BW#|p{}dR6hJ}{l z7!~0eNIQU|T@r8-3GES3BYTrz==K=SQ{dBH&J7SB@x9EdlVWzml6IyBwb7o5FUzI( zoKr_?c{Xp6SI|eXn$Lfk)OAKjf+FZ?B=5qpFs-h6;18p>-Q3?5sPpoEN9V$n=2Z9? zV{j*OPuSrRSEPyfbYFScEJXThh&b5y7L%qB!pF}|WT&Uo@|qeQJkOK4w61>Ujwa(B zJ7-vBwO=rT6o{}%{S<3tdjzaj=zN%e5{E0n-K8!zG|&Zz7_`XPIMWSW^pRph13uo) zM>=N@K|Jn=q%Ggr+g3RyjB?w)CNT!F=kV-U>)&;kr>&J6V}Af~<>?POp4~7@iz#kS zPmBj*3|lN&k=ZNU{AoPAvtq2A+o^$lwgEO&H*B$1wi0YCmN6UKnwAvoL6&VC<{&S| zolEB4$5yBn;2Jy6Rfx}b#&5;&M5iOwv)7&cI}70-QIoFy<{w81Tw{U^wMH%n=M{bY zLBV)WF&FK&Mlbf=!c{|Jojt9FmfY#nws0zTe8Dk7r{3qj>DBW7$%Pvmt33VAA+FGV zWYi5TZFa&grZ%$;>wp&(|y<51|AD|4s?Q5RSB2*suK zKrixVs$ACcVFuJM@NN_G6RrdOc>FBQAd=2>2CS^(dueapGaPd8lUK2ahSr+9mZz^b zKg^q*qzb;Wb|Jl-YK@V(*2&^UN}SvQR*gOc6f365{h=a ze4SNSAvzIS=m*J^^y->mm5x@r5**$EnyS64W&NkMfB&KBygqK%?2_?fd z$e>tf5KOFUQv(-zSN^_rCC&3r^Ddbb?HIKc|8+6 zgXiOn4(jx`Vom39grB-qy>HI@+=XUFlnFr@&a@tbP9df?uzLK?9tu17Z_tn00b*iw zDju^rcWVlwY-_agxp0(=xiiU&gCbZ=ua!jD?d+$%2zWpJ<<#4-e462gI!W2_eoORGM)Eaehk(Le^fvBide?3 zCqSr1XY76&qFDRIdi_#CD~dMo4U9h1q*qja+SD0@r`GWd9&kgLjg9%F`IEe=`o5cT z`O?;xBJJ)!=J^3&o{JhZQ>GrB>iIkNac_9)_nV$>zjuWE?-pmYarq`1aNhZzMw2{@MFydeMRWzqVq?BNeBS6VlEvRjka+E z&5X6Dos!uAmDot_+ULU)SE>8Dn-id?Mpk-K)dp@bqbxXrC*u>cJ@CKUVqog|J3-g_g(Q+&W`MOxjXKj)og_0Cq1 zoRbvLETbz03V{M0^r~i(9qckAa%z9m0Mm>8#@zoU~Rls87lX zJ&&FS1T;MYYd_Z`4(w446{q*yh+g0^Py@Ss!sUR##sVLqT5>LNdc1>HnJ(rM9XJq^ zMp^UheDw$5mZPSriZDzSU-ZUAhIl8(t8~Ss`2pvb&bknp|HIT-M>Y9}e}AL9W8fsl zgwd&t?ot}*knToGYV@c{mk5Y}NJw`|BdI9epr|xR*K>b=&-p#)`H#anW8>bvUDxNj z-tX6YpT}gLeZngHNy1{&-UhgR2hk_$OZMS}R%?j(<45C=Q2#kA!z>^fU9O#QhS4@} zd7)8Cmz^16Gt3#@0oSqRwCI$qX*`GrB1i;O9|bPo%AR|4R{$u3P?jvL?pMLbztFR< z|C#+QSIjRhR`sMa&aHFq?`@5G&+9GX7F+5DNGakI(?1$#_TY1s5evv#f;rhqxzFSY za7+Y~v*3iSf{E1f+B&%0sCtphAfG*fe{8v>ufOnexzzsSbG6mb|E7+>?u=u?V{Wxrm^u zJS#JlGsS6KCv&#}FY4!?3u^)5eT-Z+q9nlw=FVU+m@$FaVuuI#gI6=3R~Df#{CZ$fOyLpg=IVuM3~p77__ zyk1ITyt*PR+4a0=cn$j_v;?g(`BWtp7gTH<({=Dwgtr1Yl3IT-@XpxA(n8J6UW%Qemdk4aj^xBg08PFxbf&ti<)%*Zk|thYo{OzcU>O`>6uE*_41- zrGW%`f51D%1SF%qY%ApQE{;S7>k9+J%X~cyDsy?FM*Jtlv%G z3rs1Xv@=sOZbbOiS6~k4zOERo)1$gd0&Pub9gp0&&nO^A(R6@qxAbqkbOs(ID1^S- z$S(?R3+;LHL3q$h-gv9Hi`dqUXM+2~NrpA++yMJC-g2&?(O7Kwwz$T_%)p-q&A@XD z)GXYauHKPdg<3wojyNgl`?FLtN;a^XY?6n@YHut49apL%leo39ZpajiK6f%U1a1?T z>A|k2A=$&k0NCMW7e&w5z>j_g^-=j0(8T(k_GYIcd3I~zr$&Iq3RvS+9z!5F91-NF z^LbQXBPl_$S@o*>zw*aX-kjESt^IMJ&O;a%j&8Wz?q`K2_`QwsyK(e|*qI4~=Tp z&D}&vz8GRW2V?oIM$oF|vOLqfBcltES@Z7nhCa9akSMuO!+!!z_>F}%Hk}yCVpt)v zkV9>x7L`MKQ(D`zCfNi@04YB3u*A;6Ii$}h6>;F?a)NM-og@aPjGf|O_TG1%t7gOX zw;KGPNQxrvIs)?rHFnARf`Yx>vl+Ar9pB)cG`Lz)tzJ9jT8CbX@Yk*qB9$gIAE-q< zzrTw?*7S$HpnIhmAFgmIA?D<3)cM*A%fnpdP(73_0!T4UA=nPw{21`?`P|Zcrm=Us zKD=_+$7H}d?;x7O1$Q{j_Xi}Q{}FHqB6LVds31_<)Ly;4*gW`lYp%Au==-oV&br;8 z+d7wBL?g1)$+Oc!fJBkyh2i9y`0|5zBABIG`mdK5ov&~0n^)IQ3hpU@z1f-aH1xa| zgtSihbusQ6fhO5R9)~9Xg2LilQROJhji<13@0=HEfzt1H+FCvk5gb)!z{&0xR__)A z?r+b5NhvX0a(~dO_vmHB6JQPukYdKBY1G`m7ub&pi%A1Q>Z<#=D16XhUuB!ynNAnUKCcF-Eug#3rHOdmBVoQZv z$v4Uw(=LWSlhuBI1jtiCtjh0jNiOd#qJr@rzMVSMn#=$Jq1py4k#(05*f`hDq`ilzn1c zxo_YgcKZ{e0L=+KF*MC0-Bi27^HJ7Ao%d0!Ch(RnAmr~(xUI^bg(bEAj$7{Z= zUDlnUwpY@oxJZXhs1W}f-DMN$EP+Coht!*i_Ed>+ip_2-_H~ixDg7|pdOM4aCG{=7 zE;56f`_T$!nr=Px-mFyn5mB`B18<}&)cJ)L=-p5 z!Q`E34F4%~J!gbp;XZc6Dta8Q`YAaXCMT7w%Bo+KA2sM_Em4=HDFMxAXk>I%iKWmj|7Iloe%~h)lu3$g_At5i7{6H>47# z=z{$F6D*zQ$99w=&Yv|6Hu34*a#l`GMVfJBMKS9@j(&n z4jOe2eOcjvJHKLY6OQAKP~;(0vzUN=HXeJOOk8L?AvnL0cq8x9ed>VI2Pa`=j3`h! zS3BmvFJAN>GH1{Y=sC9b4o9S)zn$_el;Up!-FwA?Y{6rB7 zp`xV^#VfZ81!hkLe#|R`dr7M|oQXeX^Zi8k z7em@T&i5Wplf_~Kw#HHZ?nLsii@tz=zbU1!zP{e*W4;r}584;&IR3(Yj==*-AHL@-O$iq0s|mNlk97ZHT4ZYGJY{)=a-b@0QGU7tt_YfDqgK1_ME;7Wq+1YY>m=QDXr zjLdf~c)&PB86nVf^c)*Aw-=bdAt7@JzUk$^!2)4jR5iA=wOuJ(YjJVLyC%#35xYRp zYjXb5>v04lImES@#?;dw*z|_*?N*nduuJL(O09X|9%p?P z%rGXblaEq~wavX}z&%og6<5x@8NGpKW2ORP3v~158c|RhZ(9aV*tOL$hQQkYQ+n@5 z=Sz7AVAX+aCff;;4Kbp6e+ax*CerpU9f)VK(AV%ts~rPRE&apg?%F?yG@fqGe{T#LXz) z?Rg9HJx`>8yAP(|EaX5{fe~{%2@L1U{B(QH59xTMnYr*g`O?HgbWd8wLjk9KYJOt z9ib`-^<+pd{Uw&VR6{xMljF=d3Fi#~&OoK_bS-Sr!A|Ltcy2aqmdSmtmJ(?F%Lo-iHC z1eE#+0v{Qax+({WnOj{hL>QEr!U&TiGGve2{!k1&FQjYN0g@jpu#{2)RbC5_0Fm^$ zn6C9#`ZeRh&raB$v51Z7F9#Ak+K?RcunDN8Jao@5K{B}ji=TOM43DL*A{Cn^mHH++ z-_5(EkWNYPlgB;K_-g>&%@Ok2|aDK=6e-wvfaS83?jPG%<; zRp$k>-13xUoys*MYyqk1bXbvi<}q@%3?h|%gQrd z*T4r6a>@GY^(sN#lBWRJNDc=TWWu4#p9y&C=W0{1R{|?+l zlii+7zDd}_yA`lBr)%lxkWDGsm9zz7;OY`*yi5|f+1W8>0-^vmb6VAMbeO9}Z`qR3 zp_bY`a!zXQk9Q*#46tYK>n+&=bO#=m})f&r2rMOWE(u2s%&4Juc0T^XP5Y2y|4yhoK7v}r} zFRZGCh!-7*-*=@`?F9e*ph!zNr8cQ?9|Bd2`$%idJk6+8@SYiOX?afyBxm_B!2B&_ z=^YZC^O+Ys9Hq~7odwcEZB#n`JU1_)`50>#W^i~LRRqa{Yb3+tRypz>$%h-g!?xX% z6ix|(DkrifoqOd%$^=PF#L4Guod9fn;4YqnB85S#kf7XBNHL){mmu}a{Dg~c7bfg~ zJJQ$llhWYf(HBD73r+7YB2p%ZZUrcQi)i4KGxl|}|2ii=h|r#;t@Pb>wLThqABz~p z>XW6UTpY*SM8c-PfJIYh3;5bt+`}8%BotIh0Ug#pQj|BF@bo5wZ6~FCA37naLOj(V zU_Un7sQD^FS|_quhQxx-?mSK_b{Xq1IN)pAGJ@~JTtAXYd$4<9Z9DG9uu=!}+67bp zX<@zgWJi8!Uv``IoOoC6jC^+a6I@^%V0_Al6EitjmnHa@5CJ5UlkXs|)KF_m_WJ^) zZ0!iuJenH@Lt(`B{Y2Dg7YE8Xbie4E=v|O%Wdf>5OI)?AIw(eoQ`)B?7gSZ3-}AN8 zz$H5TtwvNOu$Y7wZM-a>I`8bpCsdQ?Ed0bR`Rd>BkZoSI2NvIS9_cNFsu?9vEd0@6 z6qv)_*QA=l_p)k7y0mEq?4tq~kvO@njD+zYI>l=1)1$;1P%!sPBidu2S3byxvsxSx)nXqWRxnv?ksw)3AbN!VvqYhk|)U5)=m< z^3trmBlA+!f8zv$G%Y|HhK^N%B+gbf^$C4x+izG{wh?(rZ1X{O_dmBGI*0cY)Z z?>{Uj`9Hl*V!nR&PCKGzh5k|Fox3`MPvUo)(a}g`t2EI|sbHC5!X7sC31qHREiF;#stESVB_mX_mtA_4n2-tR;9()-h zRnvEBVPQYpr(YzENr}Ha06MVXU%~}o(9-g9h(ap3rVQYMpGQSnK?E@W{5k*Lc`dAa z%Fg=c$K4);+}PL-l!?Sx$uIj2f1BfOGq4Ls6SM2~02Sx^EZa}sYJ(F0V2X;XgoMY7 zM-0VIWIL7qFvthOz+Cy=m-q(WzPBjAoNMuuppRfMrKrNmq~~i;LDJE{>Zb>_%erO} zpqE4C#Rx`0~ z-KPq5K_ln6rrE)G4zB zna?=U!roYBB_C5yr}6Ca-=Z&}4X381eS1KydFa32sVDK_i|uTm_yF=9*^Y0x4u6; zChBS2X4y2XZH=FbO$A$NQDLR9^DS{|pg4@B@w6=)TZ?4KL3JWZ##>1J#}#s_B}*@* zHW0G8#o9y=j=t#bm3A{k^0)^y+NjDKITSqumrL0;s(wae9P@)Kc1G6~W!Q_8XTv%0 z0Ji5jDBK@G*`-YinnA)Vi?TKVvZYSzHM!LJW!|X`2LD z?!@(GVn-ws#mQ6Dnh98Bh{>E-hrP8U1ZQG{TR`()yM053l%BCnQvbsaM_0f;JTCZr z#G|3}gY=7#it(1GSs`nY-iAIez>ePErwf$ZdBMn0S)`--ZO$~s#3iMKbAMkGF`6hx zp5P<|<&b4r5lBRD;%F#vDR^s7S%f2^U36QVb%~Xp6J%~U$^09xGn*s8k;MpWeqc1g z57-$O)yc$N@I$R33tCPl}yQpk%Zwr(+7_@(w^-YWWu6p8T2<{-lkt;w5u+qaZK=JERP zI!lK+%ay&qJVY%nVlzo~$kO0KKICk;l`?2dzdzte+(f0w)fElb%0TIpb+C8z<4)U( zk48^!s+#v9TZvOmQY4XHH2Rcl-2{__`S_nGYW@xa5!pY1mMG}pO{*VC0Zn>( zDw+fqTxD3?BLmeWh@ki{|4xErGpfxA@Gy`KQ5PZlfBeimc}e;=*E%|{9uYrAO@P}# zZz(Q_A1)d$Intk2v_W;)Rk9&0)NB zRVUZNTh0N6iEP80?P=qr8U1M7DY7}uz+84fRy1%o#mz}rhJ*b(h2J$T2d@FE&_SPp=p287hOAtKRzDtSOt5sNG-pHO{ zwKE1LD+I}4?YmlQ%Wq-<16}wlf0ABB7w54;(^Pu}{((|a+bdklkzB+hhGqozUChbY zQ)y>g$L0fpSeDmb25V>7Z%xyX#;$KdEb0|fi&ax;2FEJ1eRs=xZ8<<8&3P~SLo92X zn$$ZISe#93S!FnqE)c|_TIREYt%UhYkZ8&jh6}O&a0R?V#9U|4XNDBkwV?1a!F2!( zq-0EYSpE`!%-%lrXHknECS0tl@HvXb=vU61H#db5qkyaij^Ntpi#w{f&x+763W#LZ zkpzYsa7mM4!4AY?Z>zaNXzwr_f(C5RLF2El!HZtrs{T!EB%}K3(h7@|C>8i(v_x%8`%U+8q=P6<^WD7wH?jl$Hc&N)^_&p#xVXSCyZRjd#p?ApXlVovVBYw(6PHGTLJ zBv3n@HskEoy5@Brc6Y~Y*=ey^BeNkBc6qQKcG>u1h`#GkDfmvb8!dCbeaEu_A2bZT zFR-aM{u+pxyoq^ep4UjQNnoG9o+t;2hFqs?6lHJ8vfQn0$K?Q(ZAmpXo#4>^NsT8B z|DaF&;OOsVK}p9i&JF|DZT`wr2~xp}ev+BcgLXln+D)){MNaR zwGF;^V7ffwR{Z$+&TaO8wE#-cu{tGHys2+!7P zFXrF#j&G0DX)KPbP+hy80%UCE<;wYXp(`VAIW<+Kn22h_-_qO!qQGv#3|j17Gl3ax z_TJGHui^W>)j>Ct@+Q-{`vIA=+RWFzlYBuc7?56~%sTE`Y!v ztE#C-ay~=iJ`!i0fDTA$~t&iA)!TvK0&DZi>0)eBJRkOl^!K*6=`WmH7p+b4*2rKwAMH~Bx@?z8Iy4eObiy8^`-m}gbMB7dU8;h0XPUNe7wZ8&whG*&L3ritmVdJ9eO4>bw#N3zZ@B{ z@egxJTFxd&PWDt&SkcHGT|8yL(J|}zCN7(=R~Zv|a#=iMY@k1ge5(mWgy^GYs9P$1 zEmBk%YGzsr>6hM^yc^!89PDE{axY*yK$%E|iD<$)adxsE0BnuBN-=QTZYxsx(z~=4x*3gH3HMpAk0dE|V+1#oT zR`*4OT5yO{yLcQ4WN5RHWN!&*bOlt&k_io!pIxid;N4)TmiAr;cs9PPpRHBSrv|@l zHl;+&B@xK$Za10ZmplfBb#9_H;)a`7zfkZv21iyUcFH=MgYd$@eg{&ls0RFOIDP)F z#=fKHY`_P?w_auTwd%&)&}X<>)T~7au+9ry%SRJpx2r_g_>D}TeR)ZqPAsdk_K}Rv z9||VE5hsUvs(t^~x(Nb#sPLVwCiqsLeff@?Zq$PXR(B*d-3@BYlz-J?$X`G zuWJi){(AR$pZumwH=Dl3GPr z_K%9p&l-L6)AAIQJ*qtvI^NUm23iz^J=fhnFX@wgl9H(gz66gnmU`qL=40VD{e6OS zBPLExbQuNvW-ASvmJEF0)LJ%N?^2ago6!NXsx#y&0dpvlo-1lL+0PO(#A3odbhcmB z#QiAmzFq9bj*CO;(^zrDAAQ;x$%v+%+X$eJW(9yikQn6K;m=h&ug2`zgANmW-gX_( zsU!vt?(Ol$7p;YSy*QAgWX2GZ5f&lN_$aRu=j6Ct2l#N)ILa9@V}yMaCyKV2a%QlN z{xmKH_Ksr0WkX=!$m+Q2A50b({4acLTYyCHpVSxcfhdIlSWM;Zw{wwaAv7zJ(+uI5 zgo(5n(Kl2(r$p0|M;CE|XV@XDo+GJQUTmP!9MY!6$9JD)E)EW(C-3P(H$3i0I}Sot zBM$EJ4|=y>5 z#mbIWv;;#N3r2C%EVlz+$)jbrgtn{hGEBZ-gCsr2rc)l0L?xHri2HWY6M)rezUAj7 z3R~*)^1-%>u&Q4+V+I2k{YGz-SDEkSQLAqb$kV8!AhrL73h49}7jyF>Zi+_?8jd$0pjdp$v*64C_9)6|| z%9<+jn@AHHVtIRO@Qbx-RcoenV#MVe2eL;XnO_rV#7xZI7~##)ZWlHSadkQwnOm_TzF z#c+04{tWrr88H-(o%ULFuIPvNwhRY*>iZRN_rGV|QP*cG%>lO-l`FUZw;d`C-HkOU zc(w5M;_7VtsXzc>kB?UCgZple>##GKjenEOz<}ugHAAj#B>xsDJrbSfiX;`sssyolb zfh-3jok{!B-3z#Kz5{yxm#K3{akimACXLiV=xqCN`Qvy`fB*iU19+QLed0FaD z*ahI5{PPa{gIBZl7l1~b98|W$2>da|CvQk;-R{y&7oP;2B#DN+!+yHXe_QezHmNp$ z00P3r^Jup+c|W~J_U|ndqO2c7I6p?R$gYwj^Hm>xY8>>dm#%+fVU@>W5ICM~pK#iy z*dzO#Mk(K%xyJ3`N3q`#Gy|-Q`9lzn$nmzdXRNeh&P`E4JHIe{{`hF`nqfT}rI@~2 z81YX2^K9cxS*PeXi&EdK4`=huSVBq>wZphm+-^B-ypB34m&eq30Mcxw?8KP zfEP|?RHgh>JvJJd45#D{SIEwJKJ#3b#OOyW$W)htao$)q{>8LNV6@OuDrx!moWHm@ zzk!edbi#_QS9yykB~K6IeYe1O0_-HKyjnhDyfQj{l}z^G6B-kzymBH>Iy>WE0<`e zP|s`QS3Uc69u1l-Ex!ek!b!$5?0zK#DRy`=%~dbv^A?TRo4_&_HxsOOano>t= zLt+SlnvX#KQ()Xa5sik+94dm~Rz^gb_Wy>gua?t}&rq`Njz1YjSz+JH*vZ zVJ?&W{u$NgmAzK2`*Qc+#?v^2i%p^$#Q2u=#z5qOR(Zfm9I{ZhZj;GI0uf{uL*h?uN=Fl7)#pYOPr_UUTFOQYLhBX2%Jct{f@#~zV zeByfjrbd1;JP)m@4=81TjOt8wM{#c-f(GEA5O7lEf|Ri7vz&6HJPlr)d@^}Mk zs5%zMod1C&y%b4iXR`;e*P>CcD5S4aKcq)w_x0kVvo zKePUM11pUWVNGsyvS7>Tj>bEZ_v!M}e$Y;N%fL(>%_F2HB$kl8+HYl^3j@2Uzu!Dh zF3oAy+HcFx@WVMg!)_H6IWrf=FOL((m3LHa4S38vd6Z;x= z#~fTw;Y)!t>4{OZ1fc9oGu)D7I)+j!#ld|}zy-M@(XdCQC7|&Vk3W8i+TT$JYG!M7BnmsK8QKnDIL@5etqL^Wh}@G-Hh_+N|xBd|(@R)!)UrRWccRR)0>0 z7nVrJ{$RK3lpmNFbx<$($ebxu++R5PZ|s;}B!!LWIZev!k#$g;-2T1A@(0FAfQBh7 zckgG`i$N9XV@jZ%KERem^=RGnYpn%HZd`5`4E@(iZRZD(O-h|ZrH|sYB!8|*FPGBN zn$`1chLH(qupLJbky%j`mOqdT_EeJfFs|dRJsp4|aQkp^ZFt9Q1u?~n=uI>)!bZ1S zk<#FiX~hsBO~sEjnkz3Ls0lcgRtOD|-$gU`2v17(1A0OJa90}B|5kRNgH}$Mf)|@Z z9xQI(0hVp;nd-71K5osTyUqEw;5g4Vkj}yt2)yjOgc#NG)6p}mA z*24T-{y_}uwHu|V?(S+hj(HQhTxV(W~)S{%o0RBm0ikbCay}uM^MCrKh(QUb65)S!?44khSM$r& z6S3z0Le7OE@KKTE6^uhS$~O1GCcx<~4OE87ejAwK7T!RtA@BfL4A!?aNQFKS9_tm@ z8ZAf%T&g3ZlnPlYt7h|e?j|4_a+dk@b~nwFcP^Al41iw5Dwo9g*bWEn-dw^#Z}g0= z+bNfY;4!v14jtgh0*bXa06uapfLP{{Mu6trXU(*2GW4MDnU#$k1k{D=SXfKA=&ynG zXFfGLS+M2%DK>U4b*Wdsd$Zi~%d#D|{J@K0dcuwDVV)TiSJ9GYahi-*i>IpASAl9! zRuZ2Eb8;P)_=SG;;<-iFr$+2_xbKvi;0fMfU84y6pLV-kN(OhHJ${|N%XeFDp0Q46 zaEb!9s^Nz}(_~KS!!~@^$X!-X%~#_NF89eMG0qc5(jVUMgu}o$8^XbSpNWZ ztR&>ZTbdF-)4n%o`ti#`g9UB&AQ)trnE>pS4oWIIqNmf1#ZY)WGcs` z-d`1Y<5T)Y+B%V=!p4?X$&Q8fMp1W9-`42H7`JMN^gyB#TFek5`6oX`EX!}tjDJaY z$%4Y$Z%62zc1lYwazqA^Q;go_T)>2x4uL0+|rr zxMWU@R$-EI+}=q#xkY4}`boFzQK#jKP!)BPY)U0TgGXXi#x`C^eTcGmhL}F-N}JT$ z@}#t_Y=7aNxS6?yB@}o~q`e4Ps(}?dMErl=OG%FNM5kQfA!R#wi=;n8OkLJ1m2d=4+nio|5@xMhA#gK%Z?pV$Dhd z(ork`<78sI8rMaik+C~Q&;C?*m|fNqgR!;ZTJ<#dDE!LdevoU1&`xxAyi$tqH> zB;Vu^-zSLsZX^bb5YZVjfcGC!8}XDSV^59wFi z{jtGhc8rQV4tu>h$NkJ9RN4z#R?cX?%1Y47(F3Zp=Ld9?%9uY#g%#rX^gJmy6H7FT zUgGt2VLH}r1NPb1yoE9SVoF|7fkHJb0z%&z@ocmB#5O%KlVPYbR;g^>EnK{>=`c$} zkc4j0gE9M3#9Lu~`@+X01Z(3$Facr~N6QYz6avUg_sJ8ezIk8UBNJ8)JsG}%Bj;R) z>bypb_nU#-0;r>qR!2?dkJb+V#La$|EV~l^s)y#Ytcmh)wTPx2P!~C;lC5iq76s1u!#w!5Il%xhB}r&ueT9iBCsJgOk4p)CrScpkPHmaQ@Se1OQH*qFg_ z9brE!KG+*!T4jKQVpcArCSq$j9LEMN8CA5dC{2$HUxbkA`zkK_IkrzM-lX{qC9)6* zVj?+82x?8t;FXO57r!a*8p%TlR?n(d@pc?7RC3dIc+Zp2Y3j(o5)c<1I^2dCB!J6} z1=|@P`!lAn|Dg_gBZ$YEb~We)pG8#FEV~2xA^cjf5}DFw4~xHQt*XP>nhp)6p!_sM zi%L9UGMKrwwez!IdpP!#25=OgmmtT7BUO6QTg@orPp&-EKAT(;bMT`UTJn=!<&Ru8gLsB+j*;L z@+m{x%p?kd5lEu$&rv3z+C);bX3gRJOE*D}ZpasA-VUZnU<`66Xexghfb2IVwGUck zSl@?GWm{< z3U@VDAMQOFOC%Dw%NGohm$ z%C`qRB-Fm70qznBYh!=32T?6PD78mqTgUc^M;I5mLP;_0;YpeuSsUAYCn?q;Y+M^< z7=xwqu%@WICkkMtb}MKg!( z1%lpuSbps<@8S`9{{QQvG7K#~e~>=qlnlLr6kL7(aCkh*zxf{*^62Jda`V3q?POBs z_3Pj*wmJ7^t@aA7PEL*Zg%}`&L9%|q%1ScJPOir>e;wG%8E3w8GTAcz;ulRCkvu=h z!Y(5FAAY&_y$ZRM&qGXIa#g)!d%o<;?WvcxA983Iin6mWJ?ZW@3ND2&<_m5;4*l=a zx+8)Ar;R3f???4|q7>t{{U*e`K;8thKo#(OS<6Q z>U)Cnw(uNYj14IwHln`fHHU77E?70KE@SWAw1_g*kSB|5P&?;H%4cw_9x1BF7R9G1 z2bI+jF7;9tB?0Co0*@ZJK6Lb0Hv7fEtxx}W!Cpi0brYKdmTo4F#YcITVCBLjU84*! zWrO*LT927zLdS6ZH~AxrxXAi?=!2K%qqU#Iy*Wz}c#`j&VUKj9JZ=qOsN@Q{ctnxe zaM5swnZ{|6k?O?z+x*cjDk=&r{ePrCXOV%v)&@1b z;WcHY20KD&-95-#I_6l=YGNXZZ1FIBSy_xOs+J5jC`s)ph1pOqwB)rzsem~d8+5Z1 zjlXjec~+Vo&!o?!=z)5=IS#*2*ztaW4GhO;L~W|;4gIecz$XRwCA=h7X{$~Bg*c{}ofVx5PfnlU(F8*r3PFlq{cDh)WyDDFhLT^U~(B4wxAH4#mZ+u{{cYZp-Lp*zb*uoBd!BGxqwaVe}07l zJd41F~{;>k@uRE|t5N^^E0A^$A!# z$pph=KQVhs>Py?d<3U%ZA1+8~q>}SC?c#j*yG1$W5)x$pHU(m*ZFpj={{3yeO;J_w zqLIT7_b&q@#7mrlTxT9hJO8q@DSxm13k(ou|eapCE;)Tw>O*F1O3C$>>}m;bS>%E3E^ z1(f)G8K)l)#rDHWB*pHepU4=5ZaBLx88fVPB%fPW*=UdP`e#WW(#&L>$#&#y2F4z~ zgvZ;gyoai!szYKab)eP|6{hywZHn++1(~T=9vK|MH>;>f6pG1(6k70JG3R&QfU|xb z)vLnBaJeX1{IZLXzVPmyG-q90+#Qfhj3XnwMuR=vqJu zzuW7Y7xsY_d%ZYu>w>@~`?oBg+*2n-9Zdu8bBXkzE?<4F^ulrqqr|7h%4WU2_ zq?!#H{oya#zJwo1N2J7VP1bnp05;o!3&a;UfmFw~9P({PLR}mz$f(dr6Ccb=;1_USiehv33hu zrO!AWXlnr)ifBrK$vd(Sg~@p-u&a0HE{cmyKw2#zAEqYh10vS6f6yL_L}J|>(0c2v z`ftJMA<7wJOvjW_^^AH{fuvf4+XL5`2h|gFSoBA+ z88RHxIjn~#INHCj^WVelZJm^hYh;(M&^5l2Z#@G8!<%+$=PSjWH_3p7<0kSQ!n;W^ ztA$v%A*e)}+6Wi^L^wqh?O9WHyPY$UQ2&;p!(wS%G0x4N7`uSiekHaD zxP^?&zO=mo=^nU&JLiV;oqzn6pf7pYd{>exs(~z;(zttwa^SU`DMIDE(J3zg^VLV~ z?8cSkC5Svq0?#g55ms1%)E%n_gkA{45{`mCUP?N}8_V`UixW1A^{lh}DTy+i-7Psd zw+S&^{F_PaJR{DH8{GzTJ9z*s)<%eERX^Yb?MAC0-H8b0AJr87Zpj2PEF+1aA^iBb z2FdNjFs6@gs=*PBc*1llV6jo0Cx;UO8yD1ddZ3iHXi2whbVD+cPy(%v_v>3f zFK%v!rBw6CqeT#>4_S`}ymm+EGasTI6G8H2UNfJahR(fs>(eGlh#9^fcd-g4&WJIm zz%>Pl)Cs&MhDIR53i#pl4AI~L3@7{N9$v-aXt*pHbcT_6T6yyCjc7{XE}KU7oS;uJ z+GgXMBxRsou02)J;WGE6Y9$NhbCcU+B=<@X5_n(>KNc}QVn)~o_rrJ5C{T)qLRNUXj&VO15Sk1_S1 z>qX@Bo9EmNyFg_k^G$p?(~Rps>1G)I(~5a4W-sjV)z~O$FOJVKBNJXJ%^&yz?2{3q zWk%gHcEZ}r1X!N{#_=znVU`3>0ao0hq)&3!FRTp`*bm+3z+mXS)Ov2}}XQ zy|O)dn+3}GXr3U$n%=5&|Eypg~LCErdUW>~aXazEum++>G2 znjEb80dMCqSjsxm^=+Rd!_q#vQ8fTZjzCUW*(aoY?#%U>_g{SMexUl3`$RBa-ps-^ z*b7r60MuD!h@(M7%9rXrM!+9J0Z72iMFS{)?_+j73@d0M-PRSlmi3&3B718;DmA8i z#97qP$kY-+de;%GG$Ao1UWG68@h1c!UIvxvou%mT2gX6{!bd^V$UH8@K=dQ+E}MMH zxfybt-TpjNQl2lbo0~bcgtSfM*bd7dl_0P!@M%UZd5oEvwK$A~H#atVv1vREi6eo= zGR5N=`O22qfOq2NFj05jNj&YRgR_>oz2Ms4d!b>|s>P*yez8qEQ|D|O@Z+-yUG$kV z7idT?2|<+XfV0m*NISr0@C{V>e`q?(sHooe>kmDIz`&4_!_XkDL$`EG3WSfW9o zHh$!4vpCR&P(S7ASZ)9ELx=(qPn-?zipM@M2DgRGq4E@{%B$Q*hFL{+OSuUGvCXlRC-nq7oJYnb}xM`}lJcc3z?Dh9v*j&KIvz5c_r z5t&mmEDVfj7OlqD2N%HV%``MnNY%iFa8O4Lj)w)~Dsx_1p@qnk;1E0V8Esx%1OWCu zC7PTPrS6q;rXU8n#c0*3Z}EL~ndiMA3)+&F?%+}GsQRHAOi${~oufVJAYKAT#Oy+u zO65XF%My$L!;)Rz?IVqEmC0w#Hk`3q`2pmkyZYu0fVYOJk+4NYY=A}SZTS-grUW6?0fF!K zX@0$zN-OlZ_-T{j@DBQF4i_Rvf?mZ_F`8;XVdOo4 zOOuZssXn3g_%5|diX21(L&+XmI|kiqU#`8iFHpV7u-48Bmsb4JZStc%4)per_&oDG zAE^};j@C}^Kr!lYa~suQ8xQ};;;1g3<3%>=%19eYGGBVk0LnN`z6&Je{TbQCp`!KD zJY7sJ4F66r6QcnV+Y@)ej{UMuFZBsp8@k&+n$p~Q=$VkUf~B4vO_1iT(D!%y=Nb9@ z&ohbP#~P6;n8Er3aqlF)=ir!Ol`-C0qRVU88t1> zdy8$czz1JDM-BP>TLIObY&}7%Y=7D{w)$zdU?8r?r=Ejx!ja^Val})^eX67Ib6Dv4 zDmKB|uo2_mND&uaO%q>gY!aP<_C+ICkwEiMmO5jg@0WOx?^p7``Ivh#FM*S|CPm%qKDEvUV{${SG@=YUO%9YxA}te^TtogWDEGftwPwPUbRUp zu2$`P8(3&TrIM|uiU-EWxu2)kyI1E{^IK4QVVbRNibQ=`mx}Roer8`njVIN?5l2Q9 zHeVKcJXWfs{YL_>(x`q2l|cGYxhSEiR;TpJ4%a_#)mo9 z?7E)ElU09e3JOuEe2nDdZf9@SF_&lsoV|E_9WjE5Xy#%AYbOgDzLe?_+OI7Aw-UChiNSMdzZ&E-ZFpI*acM?X5t2uTz0uT9!`p!SYkew_Z@bT zG(EdCb$kpFl<#%b`gME%a?nSAGZije=yzs< zktZ&U8e-&_qE;uZPQNhPH74GQg5RP&A>pz}xzz4ePk~p(U5PLj89ZdBZNkVY=q#>c zi1zIWWMbm)$AwkSketT{ayHl^DNlMq6f<-T)sfP~Yv=Q;T^}BHb^&^UM|u18vUgB- zminz9hzGEfXEc6z8Px47){`YudbA1oKVpG{U1i%}ypFqVp3T$E!K*%2iNOD+AwX5~ z*#4}a={DctnFiC<7z!-_@*f5H2E+xglHvkHpo*T`IHSs>A=>`y_|xUiR)g&pngR-_9E<|7HLV z^r8KnyrQzQxvAvdYJ0d7eN~^GO+hP!{$af{Nb;6;HPDPQZr5@ie`1@IH_z64qE6Sy zG`9(a?)QyNUCJ@!C-D`BaN&za97|i7h9%N?#9uM_8EuKZ_pL7}u`_U$1Ag_52<<9v ze}f{3T9|mnnG1dtiZ3;w+?`m5gHC2AUyn3}tW08SL*TcU|6i?=J(S>6(Aa+J)NC8JlNV zA6(K#xq!(a)+5HKmiO$f4@VJ)*7AA-W&t|003AVF@?Eqd&c}FHbV6Zzk=)|yT4JA;b zJ`FpKVae;&r2k~V!#HTLyYhL1qX7uF?rlI2jveEvc7BrQ^d&|vkTcZeo1`2?@gHs? zdNi4)A=uAC%oYzDfCs>6X1O>ah`=0H$Lg(rGJd|H6)7lU7@g_^BHMr1fU;9*Am> zv|b@>`2OBb{0CVUXbws8FDeOh!HgMwz$`lXpmFO^u7dg{Lzo5}SQ=#_PbGoPE(*#{P*Tz@m|%$HM3>@e zumcbkXsge|>jx<6zq+Kpl%FgV0;p8v%pFy><+9M}hiCgOpp-eorIo{JA`BqanAS%J z;uAQZHT$8kb_DGZsAH47*$ z1zM*W&E?{A-ixxZIi6-`ObrOUYCAx7t1%L4L_`MqV3(9p6QOL>N&b>+Wv z-VJ}~!g2Le(phU}(+h#B#*fcuekJnP=_zht7L~|k?gH5&wMA{YCm0my)DiDAe?)1? zS<+T(u~gao{ke*o4VG~`^xnTLU_&jy4Ef@FZtndlv0(!*857shKZ=jjk7k3*J0~y_ z^r#Fh(6;Y>3aaU-s>a1rh^jO7u>HMwa9E5Nh+|HFH_p)~g_GZ*Pk3gJ99G)=fkgj2 zLZzUdjX7uc(V5+hJ0B{cdu`ne z*JG$Dwum;_;jsw^_Ta7D?-T*dYC2c&lNg=wvqF48+}Nl6VQ>V$=z#aYb>B zd^PB&vRy$4(jhk9yl#eZ0}Gt-dW}nA?_<~7qm+`7-p4of7h2%tAYh-cf+e#&V|Q#^ z+Hv#e@8j~HmH~v?+g~wx=0n@I8wSMXOl8(j0&*WkX9U*)Fx%Dm>Ydtu2aA=@smdFI zeUu9!S!wCKYp4^j0l{Kz&t;oxpnaZBy@?2IinWF9hUN|dl--fsuG5dX3)m6a-%WO? z^7s&Rwv|Au=&-uL_50T#$(<`e;4T)>a$LZAvqA7RrUk$yj z#}d7h_e&`!A0EE*^wfNAcA+@0#i8TDbM)71DU+WdX-WZ1p%39M-C96#WeivL_3hU1 zldwRTx7cr{?VCW-$}FDtCl6w8y5s_AL`Q1+1f#pZh71@msMJcW{ZP&uI$OI~pT~u9 zBQqvCAVLO z@qPSDMIlL!s=TONFgkR2ZB0|3?4?Qw3+(mVn8;igJJ6kuMjS~1)5%Q^!d$51z0B^D z)w>nd5bW)7zn-625wNWW@(gRBH>)+q1z3T|;Gxmlva#kME&?)y_UtK6)9^FT>a3jT zJu5tS(;Ow-p|;tdLjpp+lbi|G2ARkzq}d6VUAeRT2s3y4%~#48MBU2j5vV+W&J~t3 zsUc9l3+-+;7qVlZBkJu!Cy*DzUJrC6+ezFwPn;0VB6h-*g|d$c3`&Q% z1mVkZ`ukP2WqCOD$Wjm=C!hyho~g9OyTn8up-%wyvI7XVPK`=z$AG`9!wXU(kd2M8 z_0%CqZqn6#{LMz@+AwF2aFoE;^)s&C{{G<1N+=1bXe67bunIT6u+mj)gnPB7ws|)- zxS9fn*4o=g9X3gUp3*FP9A;kgfd*4OdDSyug4|)A@jFG(BCs?QUs~zt5sdb*_ivl? zyK^;q9P7MoXg&3OOW%G-csG54gj4$bYY;v0eA|0yA=YEzZ6AAB-ClgL9!|djXjk+8 z_w#5Vj^b0I&Kt>%ULwi9%g)F9#>M7IMVGOS2BK$lb0P4Tc-h9a6;si9Q z)z8~7j~bXB?>_IHmg zkN|@-zfGtzDaagSgr*k(fDr#HR7}{wM8W#Sc=BPBBtXFFejSrNfc1qw4aO7`O0dNb zUh4T<^E1^3qLAQN@a2oR4T$H(%UvkhzrEWfqeN%VOdB8pbiW?4zt7p`;~Kl%F!12< zGNG?3Bes>_Bc6i2VG-~0mUP<&KigJRPcp^`P9CR?^V)Eq=6QMo4YpTJ&+>bYwial|ybB_SZr%J!{%Y?m#EyjWN#_T_mvw zr>|4W4o^sSGg`~uGkoJ*AkZZl6&E~dSYTe~l3W8M3U7O_(VNEbfwJK7^W<4;eB^uQ znEaTgp}vVHNsR9q3VPghBp7DE2Un|%&qkc~rR0MnBjh*b`qvS;8^?%o#>@abwtvRy z4TB98GN%)d!2XnvTQImiS$8epdT$W-tc}4+#S1*L|K1Q~q*Mp1k8(xOO#%(7>EqbC zO1`Y0UB=}lp2EmiEG^JRLOHv#ku-zShcc__c(re?*6^hx{}#S3a|IdP07#>NNr`zw zi%g2BnJ8Nm%@j|NaCx=SKfhW`i~{Jdia~^`B7#UbGEz|>hAGPR&TpopdO5E3Wr96G z7!8YePMF*k*!fbH_Mzf=zABdMD#gfM>#i=pjNDY2;i=0M7W&is_KHJUv+JXW5Y`v1 z+0QT5L}jFtx>_S2FRgN%qU&CA!Q>2Oz+^BEw?*pR!r*#2-j>xYh;3-gv#C1q5m-1> zYBhG@2bRh5*OQ4E+Q+CTQvQ;f_FX;7O`FC2f}@Nq%S%ai3+1U5q>wTkkuI_o`1ib+40lU)-#8mGvQmg2Ey{aqi{{^c z8EWKu74hs7f!cgtg$s=aH%x5;TLuiwad2)&u@@0}5kqXaX#do|i+H~`bjFAyITPzH z!>?0M^-&D4nQ!oTxTEDNl}2uv=1^1~li=aasKUE#TZoN;PUjjfgA_7tTyV}BrlW`u z<`wTxCml-!%~Sh7B(}=$PG*X`1$h(`DKBp=BHDo^x2wF(6Od{|zCkJ18OQx+?#(Cp za*jaCZF?GHmKKel52p6c9P}#64J`K+*n%SJdF}ZK5YD2`TM|%t$d1)O3)jL?!`nqd zP<%*!w%9e7n$qV{tbJ4C!=Yq^n$83jc3aTmdhWLiAWrc~SN43*-o(zMJPE*k*0}_) zU*cmIbG^O*iUnwBvU-PhUbDagfRx+H%~EyGi%3$x9j0It%rUM}u374-!A|hh+76iW<`Xz4^9tAqizJA!$_uJOjoEIuo+VGLUvGdV( zejUYx_HssU3#cwzU{t_ye%gN?bxB&C479-Mb!M-BrFrU;(7e^hbZh$%Oq6jgC}Ma9#0!Cm&M(I8qn&01B&2_Wdr2!`^pDCBZ&4S4JK zf*b|bcox*)YC2{6L1qjJ61#7Wg-}Vu66lKTzhuMA06~@!ug?&Jok>v%{>?UXSgp^a z5sD&?*A~Dv2oYMXoJ1>w2JC<{t&qX80erwy-KF9;PeG#9xaQ*u7mHBtk&>`Tn^en|2^txd#( zPfDj5hp;9S-H87@dli1#hry1ix0{_CaUs5+np9zO`&DMZkKR(8v*oH_!%YJj)t$wyxt zJDR%h#0-H$y$SK|+`I!MjFW~#5j5zLrf!i&Bx3KOuNkVxI9)v1t!<3C1!EH>-*g%0 zlKQC96yNh$dhXJUUrISP$*GEWEv(ZjMmAXjZs83qjjGx??A*^={uBpoY^iV6LS%TT z*H*bO;d|Fay^1kRa|{*=$p9HWEFuSMQ7zijO;-OLP43NAFOc-XGLmaq?`s}}6#oK&bc-TJFBDgP_ zdoKBC$0KpK{CIPHx$36ibE^s=@Ozjyu}8c6(zqNuDQhS3aI<*yf1{J{`$b?v^7Z*Q zt+2j2{&Ar4;ZJ2pJE1T3Q{yZ4B0nKOu;+th_t$84)DdHb@oWM?CRr>*Io~LiFYxu{ z1bmNXlrr%q%4GcFv=M>a1=&j;Q#Rk>-8B_Jov0(Bu5R2rdV8Kfa%`zGAZ1*jDB|pQ zNG{t6spKi+!&&E9mKjoiX=P<|dsO2T*ymCBU$q~v`-tEST)l7X4X1xV-q}gs&Rnep z6KN)6N%);6%=*)oz=*D02Y_Z3+z}@|$2qAK;Q^=a(;w&)=8cQyYv>?Mv}m$jba59GR@lS8m<4Ri(rb@kZ6}p)1Gb|(lM}@7KD295|EZ~ zC=B~D1jU((pxMwWz78%Sl(}(-G{)AlLA{*{ZecNn)=K!MFP2OJ=aTSCgcRYa&vhE zQ(5ZVi%&!dFxbhp^(rNrep*WCQv%yYTVDuRVn8YYMe<^P@#I!~%GtL)kQn{2d9aPk!@1Ts&xPv9 zd{psyF=ze{>E9c(Lyj@Vh%Jn@2o(K?8ZE6hCf&cvBd(P{{;uKB1bzgL`k}XkzZLV2 zMa!&x^X^5nUMo_q&)zdyX3o3fG7p=#iDyy~ScqC2HP*8jxIZ7qB_>IKB9HUW-sX7z z3p_f<)Bn`%=cXVKTS)Q@n<-}QN@mgwnk^<)oWU2~8$Krop*;b});l)GgU$5%sjea4 z`NC#!7Z1sSU-3t5?s%z;*ji|kW94I-`25A2T=fjPUypKG1W*=9@<9|lCT6{u4O}W( zTXOI-WftuvMb)z)KT0ifs(fhE%IpaQhF(WuV#5Ck#&hy#yJ+EkBwTZgDy<=$X4r7) z_1X>k-Rvy+?LDr;JUZdR;X4ElcDxa2c{rX8h+Hh#D+7O5+rqZl%N5@sztn0jfuszy zoRf{2*T7T)9GFKBls^>qYs`@jL$5Al*yi=0-dzo51)(m{@2eP8nEI-NzLQA$o$?a{ zRkn)eNPU{vCx8dZDZ$iO?}u)n%Z!Y2q~K_rm0-n$Au27BNzSnP=JVgsg1DjYAsc2( z{ro2EN|yD7d3UCC;kWm~#FGu_f6Q%pF#mGlhfX#;&CWMxCDh*M8AX+Fm~w0C3AHq^ zI?E)O(%|^41Jw`(a+&Yky!h;o?X^;{Bs@LC)9qj@K!UGf9}vt!Ku4E2U@+V^s$`6h zP`uEy-z~9M+6+lBV9O#;+xk`Tz-{Urlic&%m3HQuNo_M*@7%I+xglsyjzLqKVHntq zuB`9eaDWVy4!VV5aa4AE1Ud^Y>0uMH%1Q@BHf5?Ak-6YwN&hh0G*EoldC&!g-YmN| z(>`17Uar_6?-ZrRSyW5Kvp)vX5GgM1CCfnpv zj?KWZXpMLU!jZ5D0`+1nNjoW$-TP4@cK+o2I;*i}Q3@(40TWo}2D6@u>{c0mis;rI z^u;J$yuVpnuFa@re0|Md`J#K|r$~)>;bmAC%E<`BjCWL<9)%`CIG0ep}FJgMk zU$@|I%^9^~Ut~e5ce$&(7DF2d7KY4C{2&M6V12+ssHXE){`ukeK>-8ox^>EfdNbSn zRMaOKeK2m89L$m=DULnqHY~jXy$X7BUs;>Ti|4Ke;IG(P44uIjR7vttr6Rr52 zgc6<9Ki=D|-{Yg+xasFKB@r@-?p&QhRAJ!^yX9t-J+~idg{|^!sTJAJRBx-@-x9;D z!(&n}tsp~iy14V(AHd3jegjAHj?wRw^G)}Exv7ocGpwn*Si6P5MFgNmy-c3|Dy@Wq z@3jzy_X1)spiR{rc5Gg9?wor7C(3~#Om+)UjZQFt&N+H1TQV>-lVNlBuBOba(jfWs z;g~LhNqrMKBp|2{-?0j+Cp1jCI$@RU0;;WB>3XLuS{J1i1B)gzr4%3=f`n2vF)&Mc zY&)*QoYA1p^Tr44j{8IZFo3f7NG1d7yc_Kd@!zC)fc3i>pnjcXe$don`{0O z83HV+*Au&RVT6`QbyGf3I9owHoKIB4mL-~*@z=27pi~LL7J8Nr{UD#5qh1rJVZtz9 z36Gh=xi7DBLoh0DEwLZ|EIdy4&@*Zji!d?(^YjtpZJO#K3E%6w0uo$)t zb&f#6$lv1V2=(w`yaNKW=Gg9-m18|^&|GyQ_90b%oeeAgN+Q{6(X*o%Rhi9kHaRtr zYLbA@GhNIkPO=Nk!K_Q~?6q?hJdG`~Dtp)CyzRA19M;|k@`L;6Cw+|Uv!P=zpWgK6 zbd#V>qG?``%qZQPNqHgT3fW(}6-Cuq?+T{no%JN&tMe)aT!J5tWboixG#%+sSRBaK z{@ws$7CeM2)|nv%y*_J*HQsQQQGQE|#v`V%@<^Y_N^?2mloaGY<>zoYxjdNQwM(D# z%rZ?#PGMnfZ0!={wR)}Q2!?|m8+G%EyUiNQtIJsAa*>1ewIu}J!P}HUsl&eeE!d3| z-DfgRzEl1<8iw&=@8=dAC(h&uP_CvyB&|tEm1)8)<<=yo^2HZ5W4e#}!x zPrn}D)vm4m1tuv6iAS*Y`|OQB4({7$QxfPWl5N`(As1g@lxx%NYZ?V#n!6n@_e@U~ z=obH{Kpob5W;(gM$L6vPy?jr}8_g8Ow_wk~0d*KI_|Go)#!dVo%3`~o;K*-)iKfPI>XHqGUe80)7Qv+TQH9rO&Kk+J9G zx0}D~b3N1Iwh?IZ_{mlSGesH;{2y>bNB2vqjU~->$fi)vSw)`R=d;+JXK9&UM~6v-s2Wr@VL5J?i=cH#MC_PUqM_47=Vvy-Kc&OrTSUl_4;H@!>Fdm0vC z;w&wFQdW&{I=UT*H}|h)udewuArk&Xfkv$TXHQ@T{zfWSnuZMwn(>p)r?DJlS1sB2 z_7|NJ&F1fMa%I3HNuLyrL9w$F`s!19OCN$~!QS1mjOCoek)5rE$qMw^IZ#ary*Mc$ zHCc#Flg;9l#k&1VuhkvXte>$0BVzrf06Dah!-II~bs)YxAJi&7RMoOKwA<4JeM^7` zzw+saWUkG0{{bVaKo|5&1xiwr?X~{2sRhp%p5-P+1lNtD$L^@~vliLLH zhwf?G#w!8hE0))*K$6Zqq8>mDC?dkTICpEgtU!rB0DmP37*Bhb&3e}n!K9*daOv)G z@y`}CH_A_x9m_MrJsMQ_yQ)})(ysdFtF;o|j8?Y4?Z)CXWUkyaH#zc9X2jRmujI)c zye&g>rIo<*Z1T5)Lc;QB?HeTg> zqHp^&X|;VSF^Ru#;_+{x)6OFGnucbr#c_R*!pN2V_`?;zm<_xd0PN>B{_~GbaY#%mHEYa&!~0?-{HVaB8Xqc##v_=p(hBp?-ID=FxcxrK91`lOoKHyX z)U$g^lHCk)>lcJLnQyxn?kfP37T}*<&1$OB(EBbgJ+;yyiv@czH2}<@KWpJFqPX;;M3mi zU9xA&(!<`#INBL!eY)OS*iSjq6bxNn5tmPH3i4?w!_-LG%E5ITwE&|PbQuZsjFs2U zp%aAN1c|PdpZ^ZLx@U`F>cWlr?98a}b%$_VJnfUEF1>AZ#eVfMj?rPml%bP#9scT* z4Rgt(vjp6(yml=Ps*R2?Gt0OU26b4A%1P#yK;hT+Z-V#VpMBo4Q5%^;pn`$MfZS}; zH|?$+d~Bl$5#tO~1HtdL{}%;q z(U-w2lpz+H6MTq2-M2MtN>9euX72BOK{Y-<(27r(Mo#^t&`&z25@9Vd8SY_bU`!~{ z)a~Th8O?+iW(J8=<>w&26ay&zFhBr+oZjB}``qte4ZP?GB57_cJPL{OCUYHiagNYV z>|$?P#uWl4E|=7&hX3s}mfurI4b`xHA&{FOpHSdKTfe4q(=s53mB5v#H@Fkv*36wD ze079IZ{8&8fGYLrK+E>;z>EOc5}ugJyeiz*;$^ItiOH%D}n;FA_&4?1Dg05xDX>82ymM~EYXnvjeUdN(E8#LsFIo0BbO}-(+Rh7JS z67uFlzT8BMI=)Hqmj+f*}n}uj1vK!oJtc~ z4Hs=Oj|qOz1v*@P9Y)T;F0$@SA$LV617-t~Q7kNfY5Pbi0QhXrzVdlZzd@PLaXrSH$bYJPZW}<$end8{kS4Um}>H5h0b^mj6JkoGjv@q5OaNlVf4^v=@OrhEBXA^`I2$oJGqwI{cBJj1;=rJj|uX@{j?EN$T+r`;G9K7*dT)q;ki#?%&QGWZcWY1&K z7kt?H_$KXOJFKL8P;okj;$p#LF`-D@J&xq<@NT!xkoR3~=VSfHIjY8JkUi z^Sl6Hlb`%TV;0PxbQS+*pQj6G9CJywC;FUkZva7YeEfObf@UfO7@+{)ENB-{jez+C znarSMA!nEe)ZkLQgh0^YWLz}gc)1uH-x;=@9Z=gQ0KKjRn_$Lo0ZDQYb#64C%Wwg< z+Mf*LI2(}_weo{(Zr0QvktpMj z)YQlNn^D6ngmIk2{XVCz>)3BUtD{<2cV5Wv@8mt)>J2MyT7yCwe9AC)A4ij=K1_(S zq(lap3_YHDvUdx?$B4CjQp{Lj?#RSsn)B3Aq7gx(vF^f5k;U#DjPe-}0gge2g0&!= zdO_x(o_7Rk4XiJs1zA217sAq2?VNzkOAek)+>`g2((IunV<3cTZ8t(4@m18)6KKja zE8F(5Kw-X}prxT1hzE1J%KPdX$|z75xsamB@1>?ml;g!K^?w`aX)yyg@@%JXr9t*v zw-BW?pum}6MiufD83d19V?t~o01H!*&Zp!cdtcsVjv3Bhfrp>W1q|G=K)}xTd(p|`}l$*`L0_=#h94p#=s&+KB((zC-316)< znT;5#fzP4eW%T&=?qn8Fo48`*D!xeSZK@o{H6@~b$&&F@g#jq4auoS`G6{r5&j)TU z`~B}HWs51#_+@QFt%P{@@hprrv2Bnff5m+-Sfw^^PGcnp2I)IJEbecAXFafsH8;Q1 z{Y;=YxEId;ZLvlW_sdw=ET-_n)7wEX~`My+pNUoL*Z5S*PUh9u1XV6X2h5*rbca` zJou0a@ZIwR#79O=MWvq&LHNOSo$M&tL%tmx`y&UEiw5ph!V= zf#g|J^R7{f+Q#$*-5n-imPnhTODj;ST7AD5_%#gL|DsO3(5dJAoP4zAZ-;ux*jcmm zj2m%~Vz@R~^$d6hA@U!wm207Ag7Gp7!hqS>mIg4=EGi`GC}>%lMJsK9N8bgdPoL|K zKO@NBI=)2{QFijJ?=GwWDOjf7S9c>4YKhR~V=O*@t9V0BCE;5Sl*+zL-UWl8SckqQ zkp!AfCYKrE0WpeRidZ^H1SgTnsTe_tkH2Z;e|F7&(IJSmsKgo!VS;#_5zuO83FsktZgMVM;@W!JX7N~x`9eMPCa zo@jVdGo?NwM~HSenU7!zt>3DCog6y+M)1hGp5XZ+Z}LQ7M6q(%S&lxocjIT~&Q-X7?UbhC`Q? z=$=GP78Z~3vp&=<8_3fM8lFm600p3A2ttEs;BH8k=7K>hFW0k+!0&hINlXST+7k|o z*sKuA4~&>V+ZZa>a`B@xhw=<%rAfOC(3o&dK--^hPIO}#=;%i^2noN3$j5Jfb{t=zGoG3f&eWc$ z6aTxXvhy3qLTl^rVhswnWJmv@PiIFlz<4kn1isG1V8fEPyKw|G} z+|SGMBnZb7m&Cir{N4R`Nznt1HjS~w_{OU_17e>O6MA@LI*A3}QT5KR@2Q-6IDVB^ zl5_{iA>X4xkOzQhNU~nm1&e;B~U3fbEw#1o`IWhrorTU*-Rkd?ZD4xa;ymj3G>xrbhL zw1H%jH&=idke@mBol+b8!!sPXZ0 zY-L=d!{-dIU-eI>qR6!&3m*{;AAC%N?HI2%43jORGi=ybeBFZgm$64{%ymAPmi4YH ze%V%1Mb7IYtHk+@{Zd@}5fghij0-#CqdoHYPlvEt9mw#gIA3>ZA2kfrm1Q6+fN$0a z|KPeuSUvd+V)NsX;xGed31Fm!d$_g^o_Y+N{@{gJ%FV~JIiu2e^-ME|KIg1uG0Q`v zkAMHj7H$N#BYL^{zzyH$=1)xIljnUX#BQ85?sL~bvyAJ@rs+;KpN&WGcgNw^3Hs)({2u@fA6r0le$s z?ZecX$GfSI;yYi+c#ZmUM#b1UP%u_r=T_#=jEO#T{iYe@JajhRmR^I@A6r{Fmh|W-_G;zQKWeiWH=xl%YmZkg2Sm{3BtVL7ij%Jjj;xdE|B{aN z`f>6ssDgg#5~C$^NQbWL?9j~Xa@?X3V1tiBO6Ga$v zpSd=b0<$a{%bVUJ%qgv%ZJh|6pk|HSXb8Xu20~wOu#+>)dHS->I2O=<21J%tvZ~6k zN6j4@C39@O31k)e#nx-LmD;!QcPE4e4+AQmqF23$0t)I}LuwcXzbe`tGzdLU$7^+n z&K-)gs?*3s&UTcmG&Xm&Thi+sN zcjKlamdZV_mD8E&rVNgi^o(rScdB1J5wX@Jue;zVa6)9*R`3?HMq0emjVU$8Dj!la z&$N9&*j0~_0_NG8GB$jaAIDz;`FNNb43H$6+86VVhmTr0@ByEknyzUk1@Oa&JOtZ$ zxY+<=e6J-?8X62pi&52x7qp}rB5d2V_NojoJx?$|Hx0P?R3bR}Y$FNf?zTkbCFqUr z3LFoupAOsNNNlNdeq#e~ZJZN9Y$MBuG&*BR2DRUwXlp)3UY&nRq|yfL+Z|5+xY2i= zo54vofB)c@R^mNT>}u9ukOtQ+2ROkT8y#$ESvT@!b;&XBCOGvhAg9O5o0LeP*2a3t z=)?8h52hGF7Ly{eZ(H2HzwH&hk$w3X^oMb~$f~{bKZr`}PB|nkeS#}IWL_74Y*MND>DvSx1QV;hfCONn$g8kPA$GGpiD zd;pudd_2>RJ9c)v5_`0wg7mTyoFDyPx3@mSD?auKq~60RJP65{pr4Sjp?R|(kh#^;`^9et><@&lPG*ScJ z+}8bWyo$5G?UeBhQxF?**WB;FYD&b-mcTN}5By8mKA|Ji_=kHm<*>3U(I&Q^U(}0t zSAIaIg?Wdw3V3+?*l`87%EiSnjX&e6^V{~s21{qdf{Q`yqxVi{qW~SkqC^55 z1{e%A*zKe&0d=>x-m0XK>idVo$gnf9ykl?de0_i+sb&l?9U0X~P&AH&XJUMjb_0?R zgPqZpe&?low<;mQ+IX9SH7-(7HC#hq3WkOqLb`jy@;(A0%V-Zol171_pe|Y5`zAy& z&c3|k89rOf4!?v}KHsEe@3R6+g+k~Yb)S+d$YV9!AS!h736OX&L@!P+4Advo8S9I( zg`;O0>yHWa-@WyFIoj4$BLG68X4>aY#XZ05waLanK1x>4nP=`w!5xWK+KJOKy9{c` zI@{Yrk&$=1#zs-dcq^)yLDJ?iTqh?@w5pn?%JY|im1``|)fl*g1=|7Zd^K4uH+Oe; zMCQcXMe_Z3yxfBN-^k--@PA3O@{6!axCY&yP9vfQ1f}ml;y`ENq^hEJA7mjRf-_25iaLn#JR$ zzHgq+M=U@uEyJOY`ES>1Y>)+>KhJ0ghoL0aV+?oz>8Qlq1Of#h_m*mIJV;F_hN8dY zi#s~Gt<(P_M4Z)B^-ctz39VjYV*Dbq2oSTSX=*YA0xOEYLD{b_A2Ctod}yjTj*%0P zjrwbRk0ROOtk>5EYYdHL$w1Fz{_^jPzT$YZb z+*DOl?q$w9&+g9Ho@+Lu(KFNpb$rZKhRmZkaz}2-sp;U084mHCdnE2h#%!>h2*Af} z+nLt5u3yUX4cR!}HcBN;UKYWCV1mz9BonPn*4B7=*%yE&@>8@O=ixJl-Tt1?|E>PL2eJ# zVh+TiWWkt4VQq@l#heW|v@%YL;9&w^Q{-Nce|;$*&~CO%zNyHEClSj#sh!s95YCqC z<5>WY86?N2AYkABD3@;q5{uad>e;cGy%*2fMrpL`}y zp4|v7Eq60f(||6#%CJjJiVwqoK+b%~z2<9jdv2`K6Pn_T1i4KQ5v?P(MW)xA0+v|G z{f^QRJB^K+$=abCv+3``X8BOH65?RCFLyQ1IAP_8^aMX^3^O}hY2;=iW=Wt^aH)TWb7cC9X+{`3R6A%u+bN%y zgzTPT9zC1C_nrc(!E84GpjQ{+rX>&LSAYphM$onLPrGlA*LJMKTXOyB!_Wu;iYik~ zgyY&;Rq^O(3maKXQ8Khv8^Gi+Z|_(uWUnjF9cbg(H$Kf*igKA@nsgZxKu+z_2*dK_ z6665F>n6hGZUW_L0?dT@P{dbijx`=8c~CjFe0+8VTiC|^<%+!Sj)9)Gv-%7T^!DMg zhKmTrjkswYt=U+*c-tB{uNJ;3aNsc z*y;wIWM&9+s%ZPE)n?4C$r@bb2;Qc}bhW?%iE5yYSP6vw_Lk4`FUL077hr?St_2m0 ziHZDZn}%8MOES|@3LmG)nxx?h`AmrA#?0IthIk56!7=paRxp(}ls%*R!MXTs3sXcO z5RJ7`QEH z6X9{vw(nX}QVMk|1q3Tz38DJAUY~ZuL5nq-7xj;=&~5qM;Ll_|1C;*&Ky3ast$i$G zYDk3C+c_;vTF-2CZ2s@E49e_S1;gi&xisK52Ae0n>SQZIK~k{tj|_M~AnP#$j++3N z9wF2Ky2v}qphOfya8-UsLW42tF5X>5zKW!vm}h@1vtD%mz1I2bw}DHOsd++NM=*l) zvvwq+g+8;Wq-%QVdEWF!w5+v{5TO9NM5w7|IyU_}Oa+_vTnY^^D3Qpi#{7->e>8n% zJl*dD_R-zl9L>?aX-6|{x;v+t?(UAM8DsKHGu=7OblY@nn&*LME`zMcdqPmtS8Fa|dpUD+t9(pLl-u_V$)=-3&8A9S|?y zE2JR;qr0*ufX0Q2iuoMlMRze#jf@6t$~tN+FwPcO_?5MP4fydE?&+aF zX2D<+@UUzWWS389Qh8W|oL>!?jq*Z?AXmg6?v+A&dRrYBSd)38xuy4Y`xc@WhhEDa zkZqJ`4%_V8!DBKA{ljdgneStv6`=M*c-hbWZ@4drF2!1rwsDqxFV#N6ql=kM;ry)k zGgD-QOr<2;syzq z1}4su@#d4rubg-T6Lfd^GLNM222ZZyAB(-0d_pRcf8mMGl`KB(`U*TyDSh1egqq44 zB+kN-Yqtf@GxK%@^z!aRk(9&-sHe`6!5uQb2SBCnGd5Bm@5i}8g4Lb7Bz(?A~ zX{DJmIg^K$cC?b+lZX1SUUa8Z%0Y@sbb~fHarJbmh0Y9y@>dxn2^(-lG)TTxBVw6nk*|V*C$^zrTZmp>z1$T70A$gk;V6 zX^aosg zjJQBt%~A-u?&)D`TU+T)Zke)=hPt?)F-ZxxoFq!+QjM2FS`6=5>(?NcH?YTK%Za(Z z-CaFdWu%n7Q1mm^$x1(y28jXy6d|xGx85kz0k(lly0S=6E z`#y`2vw#j(V5Y>ogZx^0WoV8cNIq*`V}!PkDVDG!0>22DK|u{w)d6-W=x50R?Q9$$ zSpQ@p5Svvk)rg>Lp0Wy5= z5jwytdBa4ZANbI>C@XX&zaWe&MLPXwTiJY9wV4%!#BOUi_xODs_o9=N9iYneBr1g(yiREYCCk zIL1~;&spfZF=14sj7!NL{v9g;<-cm+7vC5(6uRy2iIk$S2&=6VQrO8^!?;SA*GiKN zJOnCqdiXhjG~V)AZd`4&WjI9=>QOXa!(!{NMNxU?=H+s+02AV*eljyEc*TBFWxs={ zQqDpn(~=Rs0Y$>AtzmPhM%nV|7_I=|OnNYnz{N)(pe>D|G%jN}q;n_JBV+jvKnY50 zdCH^;Nwe>Zw5ojW;AQ8pA5KDmAzB9m%>D?ln#K|m1A$G3rd>YY4)pWsL%oYKBVd0A z#qEvqv2{g%PoslZSi;epM8{jiFmSZ+F8lq+1Hw0$Gb*=BC4??BaMLF7R|^P#nu?)U z)g3=3w@54S$YG9K22xko7TgJl2_%4J6CnH>`sPV4TJq6#GIxC)8dm3}+ytjF+P;6- z&)aYuwi0ol&n+j@(E%%4I<2^k5y%d^_4VHslpp6BrCI9h7EEyv9pyUZFrdL87_^4@*vtBuvIawCuB7Pt5rOD1HZ(A3S>ucG6Q0(k1ZjH7M@xp~I{j5DlV7)DAFN#6UwnI@%@WNCu zrKH7u@gev(KTeH1jF%wL>o;62n1U)^^xoo(|*T8RGyc+D<(~;Ex&K~9&=gqM0)qURR%2gnu?z}7`2wLB|{bQ}) zXEf(jb25r4r7`Z`9qjTV0=MCAIw;n3JF}FjUFuD4gd8^r6rtFC@x~^QXVvNejNbST!pzd>G$cpM?ib zoU#weekH9TJo)u?bdv&4I06BYF6!MaNJZ{PirNtsL)gsETflqkJh!z!o(-JVDthWt zpIk8EynwaKSDR$l;K$p`&6nryS^gPf~mIm$KL~e>N=`Z%Deof5asG`Qowi}mQx-wKzQVo$BxiW&3;_)0vJf( zDx74wM>d%Yn<$}A6rH|&y7!ov1KNXlxcC5k0Z=F=T>*-;?3?eG7Pf-Ahuf=FK9C{g zmfDkx20rjt%fAH9tBpeC10MeZ8_=e za6Wt}&{sRp@v*+tK-`e+JJ)*Yv`GlvIZEYE-2U_s7EbS@t7L%CzY2qh@+(?K#e zOd{KnDLvGfZ6F+r3HM9i-He|?3<^UMiU6HydMPT~hT3!ch-10elTaqQ|G^-VB(e|X zFoUQX^zzI;+kapm`$!S}nLFayB6kUQX=m#YAMY${!RQ6K!vOjMc?C^m_YITEHbz~Y zy9bS|`Ni^SV{uu8ekC6=8_{f{MBO*6F zC!fpG>D_##rh7+8h;oZz{|qwD}9gk5jd!_%{4s2ywSW zZP}ijgor}5Qss0~Wd```>aj7oSsR_>OIel|Q?JiB0&U|Ga(G~UmkupbI{P_?nNnQ> zMkenq)w7^XifN<<>_8?XVOM1@H#1ICN9xb4#~huiMVWmcI$CUmhmq?!_K9$+q+_gk z0j*>zre7*}x9!ciGVz0rR;lx-u^Fk{o?jGLZRVEX-68TE|L%be3f+jfkF}1WhLzR$ zI?f2+*xuPA58+6@H)`C`v2micz_JTFs?_}%hHc?oXUSb+*s!z7=;dcN46zV^t6P#`#|bmFR%!gC6Kb**A_gL4+5IG2_iL$SoynBN75Q_E)*o%N{yt>(t~2W3$g_3cOSk zJ%dQ?#CV+WqExKFWZAE|NDDjEuip|*Ex5)k>PWu`>_LwoR1<=V#b6MiR1)YHm}ego z0q^^|q;Rn!m}Ad1(oSoVIszP199X81vGE|AY$pP=W6hMAhtd;~0-&1@KUQg#fv~8O z!~MkJ6F%x976Ad`Xme5ZBL`3$tziXxivr`A_qCEDA!F#7^z5&c3cx3b{H*~lWo(wT zpWBjDu8j56X9#fM##-m%0sTTc7#+oSU^R6@ElR?a4WcrL2k;NfRYq#UM)9XWV*Fx+1AUUsf3R!5*5vX?VnAdO0TK;QCwLmxLn1xzb5DWsj=0-B{J zaKGa-M*;*OP-ye%Xt~%p{K}y1Ke^PQw%@2w2mgt2_{q5TP9|js%hA5|VZ@&zj8c>Y zJXQv}PF3*I3M@503-UqpBDzHVseK;{4scEJuKwtwVap3H2X01_lE(>_>~wly>laEX ztC4168l=GMC~7v!V6ZU4yN!@6{jlsCBU@X11GE`C0bUF*b8rj;#c_QLS}*Y_5Bp8$ zC&4Yt00;qNwLlINfu#G#;WU&1eZ(e{vfL*tF7GSF0>q0T(qR-y)cuHK6dt5`0W>mW zN#=_;2WTDNN;*H_h~_LHOAd#lY0et`i}RR_b5>)zu|mr0B^Lj+^=fl&Y*C{R<89!g zzMoo4_LvHGUEm0}(n^!M0qJNg7iZ-a(#aLlo@9wSlKF?6ltd?-z`+vsLY-~0AT5I< zj4N{7JP3&ESram)>ft57*|rvcy!xHUck%Jki|RQJinoZlhu@Iw6I50C9|xbLzvXk6 z9e6Mi$EV1d80txW>T1ebs*5b;BYjH$8(+X217*6OuS0=b=;3|qj<+&mQiLi{R?3{h zdLL$?+vEO#>Ha~%sn3jnb}Q3*iBSJ>j(@-Vo9o{qD*DFq=?_z~niIl_ZpIfIfL&hG z?b;|INj>h2Uc~c@3T;VVE!MM0Bv-q8%xY{wG9naz|Ebye>sZ>q<$z|mBk^)x9O0m( zjAz!amnNEFiAUSljF2Jz-l1#nZNTaazq0Sj4ph)^W9ogfw2jJK$F@sm8K7%mnZ7Rg z1P|%NvARAF^h6qiVSe*iromSDj(Pf5iPKMM@F+ZSI=%7LaWrgoE#|GyF#XgaLD&7H z>&`A$U_xE+>G0)3T@Vqwp?7o&SXEP@F`Gwd3CEGB+zncIh?wS~iVmVaJKrwoAO9V( zyB(6L2=7-&Zw{Vlul+C{#^{?DzcDQO*FF!m%+lG#(5~-Xr!Yq-a5%UmFc>F7_dNplc17AiKa24VEGFZMj{MRiEiNWv9v%*E4NqAVtkA7lbrc*u9iFXE%he zO4+zFeh0VZ!*r8_Alc zwp}7Ipi944N%~H(8k$Imq@Co+*`S#6VoPh0Zj}F9Xd|vIvD+{F9{ppATps+8-CweY z=}QgK(isG$^r<3Vo)_cl1oHp$0u(>TL>HhV@sr&0vmmw9sIW2m*08|ta<>9y800UE z@S{{r1dl|yA0`}c7-huatxOn{o(5* z85X?zr)wOJC1IizvBp2$y2dH_{>c>raiYExfC#wB(wp8@RKZv zDYdu1$IOJdtP`7M@C-8`m10=<-nst(q1cWJRQIJ$k;@%wyp%|3lMy#nDA?eM)3o2( zL28XgJnU(aG_(J@J#`FubrNQB>4ry}b@B3nmMF&q^QLk+0@^CT z@(l)+z|0|W5Y^U!bL20E-;$Ylg~USYZece&N8rbR`@a!EI6$>5%0erW#-}l zu_py=QT<|NSS0lpyEgpR=IM;3I2o7NNV+nZR!fj(uWC{qb>S0-2r8|X-=>Vv z*%03Kwu9X7U1H5)HU=!?x;A&RCbO@@N1hfproNSESNOBN62H#O39(*w+QOooTL-&5+&F(F`6K^mne2CW>K)&Yn>Qe>xx8_g z141Ep>&Du~!Y!qom2`F-pT@YB*u5vQr@3qsJVFDtw4!`beFNTXfA;YKz5svd+U6;b zDj+7YCk<1@f%}EuwRXSVa%ZBw+rJ4LAfNX_8qGRs$5S;nU&=siBqICOjDq`R}sD;r9{#qudz!MpeHX9WF!RA8*8EkyRxWGD7{W^NQhRr-ESHQb9mY?0$l@>%4B zvecQxO25BW6AfbyPF{mFoj=W+WbPP;^{GmC;<*UM~ zRtOSYU;n_%xzWc_wC(cCdkIO7eW}RC$bdgP|996*^CWap^fdfRYCv!oAbN85@HN)+ zhqteYX}zPvNglb9qu%Eof#hpUM;6m3_fw$dDd#<#B1`1leP8nn#e-YizUA`0 z{m`@jYu9&K3a$a$#y)JXH5vz)NGUx<2FgC3Yr}Nk2$qV5GaICjhcvxmD`&m-wZ^y> z2piu(SUN`2&$8@x1xwN<^3}g#h4-r~%&s;Lk=9qgcFt4C?A%;vxQuzvMt4s+Ccz|7 zaa*YKWaxAT2MuA5Ba}_GToo-WoWAI_G@#^Xf9Za@6svAJ@&`ZN^pg@@#noNjukDP} z;3<5D)F%>97rhgvChsiZw9CT>?SHu4P3SM|aZgV}P`QB9&)f2J(I8BF|6|MjcQN5| zY7af)aEL))8;}MO<|9=~!ni*9;KXKBi|)9}_rchFLJM;@qT&$aPu?PVjlfwF7Eteu zRx+P*Aozg0n4fAX2b;+`_T%vp>du{7b$5pT* z!5D@QHWv^wC|dz8+lxega#Qrj%_R^F;Jqj+R&+VjLEnkf zYGi;p2kpu5@D=CKew&aKkr4eTCjNYa<})lt7;+s+SiON@+P>OP8ZJ8iRe!3=V_ama z)C?fG@?hD`%zfF&37M#HnzNJR5fH}xO;Ijx!EIq&3S-bvD(_O$qA)c@!8C^{!h(`p z!-^mdsl&l0jnC0A85b7`W%66^H+q&Xeob`^s|!buXx4C|KMF1{JKlNOa`ZK0y+h1t>pd*SR)s~3+9!VA{PFWfvdW<;tYYyG8 zYwnLda_IXXb!ax~rIzUl(Rt%4(ka4xgB!ti^55g(`QC1=w4tOt$QGrRp=F>TjKe=^ ztiMZ(=oOmAMkfpZ#};O^N4;&HQ%v7{()a=qEdnNLr4+dBv#zM6Wx2&Ker)KrcdPRc zJ5(7um(@ zuCnNX_34u4mFJ=B^P7Qd84Gn7B+^o#8FxHJxDY&jjoLUahL4}ba@-^cv@pr0_WMWH zI%+Jb2GAt(kVc0Zsh^#Je?n*MLu0{>t`d~kGa}IWb`g0ryBas~PnX@#=dbK%=hPSf zK{1J^{#U_8XW5}M`20;@SE(|ZFC)&sJ-dqS$(e2(7yz4^oSx(5**4s`bOXLfx1)Bx zQMHU>TCaif6voD9fL)@Lun;k@FJuO!#d7B1C=gxLH8@8rsCc$BUeY^28na8n zF7**tbV}ed$`X0=3cZB~W^0rz-3V83OaB!7<5gn4kx8DrN3Y@d_b67^pJD96_i&~o zYa8olQ-SQwdh`gVUpROd$)Nbt3ot|W1a(&kC_2u2CE~(!W@97`BgAzAb0oslx2d#d z)#hP+3E4oCb$PE#%dWsp*p|@AEed!K2jNdupKww@(zS3A7e7v8Trp>5H<20U;7#uP z#oNyA%m+nICUT|qpC9Q&+r4DRtlU2)LCw;?pExe%x4sYZ8d{7JH=I&;pDJ!sHdF&6 z&)Dw&L#8IM`zYhzLi@+#7xN>~NM@NBn<@|r_kj*hJ+L%TY3qkmAMwBAb}3u?YR1sp zLG-vsMqjTqi(3>XMN-QZGB#R7lzhFflAK;b(yJWaJ>4G#r4wWs%tC^RpPgE2Qn{ra zA8YF9H#MRx`tmi=&DUdoR@$#?1O!J^H`h8Qbm3XlJ!wrX;qTIwP2+;b1&9nbQ4N(W zt=b$1z2!}jkkYOwgOe9&I>jJH@-l@(I)K|hJ1 zWpqdorFo-Np(CmDvaY{O8mXvQ7Z4r+jnf7#$E18{Ys~r7-@gtg*q}#6g-p_tR*Kn@ z(Ao~hMO88{qy+HAS(3leDmBinzshdk*a8w9(OL52R|VvdK@MP~p!Bik7$4QFz6iUm zlvf*lS%8s7leMnp7#TQ^omY32Y1Sh?g~auBUG z3ofYwGwy^zzmjZXP)@zDyc;g+vH;Oy;#D?l{K~Fpm&Inr-F?xk-wnb(IQZ$q0QaN{ z^62GFK<{r)V3#1;?~j|0C=mW?HZhsOLYU3SNKs1VZ~&&v^i$g%mGm6lfDh(P!3kw)Q~zT0q93SC`S{elpDm z``_0D-!AVw;R#bnm35EU_5DeZRz!oZM&EiCc&s;z&Cc)Ce*-qG0MI7NibFo^M{-5!KheO8xCZ>qj(5Wqd|g*x zQ0xGnvIR4)W4SZnW7pQMk55RcjGvZJ^=xr}o1ucnFW9ekh&vD<9*T8Z?d>THnLES~ ziv~|`EoK(}mcP}ugU5^g8cV3YM06F?5AV`+17j$N(X<>TX#PP+AdlBw7 zt`Yz~r@Df~7E`h6yVRoPZvtJjY|S>$v%@$b1zE94Y$BnVCiuqYJ%eI_xG*E2?r4bj zZHA7NDN0${tikp#Z34LCU?foE7)I)nd1ynF7mUI?l6um~sL6%I=i%EO-3nC2>nh zt&&qv{24!bnTZDFTgyiC;&;35r|QJ~Eg8)@ChSfy9eY+G4S~WUuI1Ahg`2y(FrV`zRPi3tNDujG zRqgzW`#85!1HDWl?+*N;?%>{jgix@Kj#-|~L>%OJ)ILhPG%d2rxiGYYC^?ymZOT~O z_{ap4zVhT-T+nm7l z=zgX-xT6{qm087tUR0q^#P@dq3QTUbyR$#PSLCGs8qIBMBb9dtx|*8piAY-X20?PE zLTK@au13n5bcz;M`vTiZY2 zzwdSZ%I@ChCt{k)fOZi1C)tCYK=0pP6s+0_>rCBwo-#<>IE8`OSqL|!!Osp0$Z325 zOlwr$s)^T;M%m4NQWq5B4@U~LeLEjcQGOBd=13DiST)rq%IA=LO^|%vQpC!wM^H{1 zGr`9kLus9Cfcfn<_3^r){S1Yj5gAIzxb^!p%2G`(!S4$5d{ume>(&UWZyF`x2qr=} zr%U-`2uqdOn)sK`D6ukLA;hhY+8{chDp`P6Ze3zzIi=E4{XhbeVjW}?>$yIMJ9(mI zvmG3JZ-*F(dV#uPw#|a&u;_}(Ny<`_s^=|eCP|M7^KFg_GWBOV;ALgLTfLoA>gV2` zb)}x;Z#dSZUZU4rn7vLpS2ZJLoh@` zLy7u8A3s7)3re!x`ap1qnSvF(iNg{XmN8%5Lns92H`LEP^w{l8v9>evHx3PJCRft2 zOpzRo;Kqn?QAxI5ucs_=p$$M;a)f0CYFHtkd`FzYpr2daG`LGslO6@|;bsQ*U{ifq z(`#GNqsWub>vM2?6a7wtw;gxFmx=|j&f9f9H^@G+u&qDH+YP=kvndOHgYU4VkIY^U*6or zY~Fv`?EP(S$?c{6@0^g_P7mp?|Ve(#dV0?Kol!09&na#Lj6HWb~hjPP5mZ%HAAg_ahWtkDQRo2b$ndv@gbWVT+r#L)|kl=U)h_8NdQviYF7SOMubnY8&9I=Ey6A3o+e{Q>Jn8 zLqbMi-VBQPvG8&uf$Ax%<6p(Y9>BP@q#5PY7Pi6zt0>%XIuzkhx__AeI;c*imKEg{ zbW<^FTo^)eCEv+XHq{H0`19`U(U!GQ^l}ZHlURZY@nmY6mX~80iM4CJ8j5G39PSOpb(&PlZjklrQZ+Dusp3D5+UAnO0 zt3`dO9g+f)@)W~l{7rkVbZlQ=x#7gX>ve!;-*nU}qUiRxpPi&4C$LD)O$>yY&`Q7*V zu4hQW{g+HhFRK)$uY_SqTAch*j0&G?iIdvXb75@XS*m?S zFPo{Pa!^HUI9^MU!eEt&9J4@GIrJEmAlQXEud=qlm^NQpg-*+YY=n>OER2x8GQVgr z)~!8%^B%pr0NgCd(-Y{#iD78UgUdaI@uv!E!Lgc~{^$4i=?%WN;t)d?K9Oxq>l*$H zK|H5l=fI4XT-%sZNtL^v<%PRLYMG#cYVuryTb^52qk>bI&n=2m^@9m9fNU_>-%-q4 z<8k~ut}0`CFOQ8ahhVKE?HDHwuo78JU%%n+^6%Ey#m@ItH8RjS_VSO{uj;fmBb+6@#jL)%gj=Sxmc*t+ z+7{BxXO&INgpJg<69HnGnijk(8KDSup4}v~{^6r>B6#}Z{?Qiv1rhwcGx!zWQouIr zon0Qfi^=812T2Q#gTY?A$+%ifC9Q+TTR3M4{NlU{^t0%j0Ipg#HU&-B9RDCUzSKYs1uTKkOtuh6ngNAI_WIy0l|_J)3L02n$4;ImImtsO zlNSd_!pItb+0&!7IC~S+0bO)2eRT!}@5c#T>50e*7-AHf416P2KVk2BErsy0=$2tlRE@6J z$_*`n9sJz;6iVS)5eHrQcdilP;o|D96#L~8zeIeO=}5}^QY2B>iihY@%kD|FKN$~$ z--Lgpf6eRAxL#Ln6L@fbqwU8NmfW1t@VZo&tvC&(F9M zJhTJQ>OWctVY|1KJRTRskDV{y@RJ`p4lm_?p6~$HRJ<}5A)1eNOvp2HRpa;^hs=kV z;&Dyip)YHTh{?4y+*byfU&yF8CAQCep-WyP9x#$ZQk5A4dM*Xkw`$tM(dG%qYcTbi zppWAHOj(wQSIcYIaHJJTI*P?NO{bsx<7Sbgjj2AXQL@KGHf9}?RaN!0-z%Vtd>;%> zV^AO%-`pnloAIHK6P3+kJgJ|v(6?z^kLjtZ{lsjVmO5Lx_Kxv;(k;5{Vq0}J3uJVN3J|&gP?lj$o&T?2 zSW0U9#bsK5x6tX9s;!_JpB-TfxN3<9`H+l?gF<7*d3Qf7YpoZtE(xoq>v>eHl(6t( z_N%zy8PJbw8vUYv3`F<>|6l2AwH>*;@ysua)safeycjcp1mljPl1T_{B3I)gVRFVr zBT(UPH}TiYFLsVb<)lf*8rEb12yuMJ{~jF8C1SEA)Oh7p%cTrGq2#Kuh8l{4$Pg^I z1%Q^M{D*ZOjTr|4eCxoahwdF1h`X&HeJ>%blc0k~a64ydel@_m@2_cfqFJ+2KTwuKfs`5QSN+h!4(3T%- zu%(855TfU}drgqtFn%A_zYTIb&Z)?qMnTIfPb$MaWLZ=QQv1gV*fzdTcg0HpPOpK- z;oH{kZuzW3z&=>t6-ViIJhsF@`)Tm+FS_yXq~Vt{^5>=D@U#s~H&53E3UIf#J__ml z_!emcrRT8)#+TI6lyJrTXXnX!2V}ea8j#-3;^RjJ6WHR8`;Xax_J+rnK#O5($M zh)4Ce#aaCgCLvAjEE~YlH6?NbY$fuEii^*^bk$l+`h5(Fnn8YCPntTgj{{6w(|nxS z%AUC+FwE?6B>gP9arb#(C#677wbm35GbSbVkc_}}B=z6}ZD_a$27Z3ZwQQETA;2%6 z`IHcr=0^t94G+r${qAsA_6A#7NJRnr>^$ct7UN+!>L(FI>(!(K*tmT}J5Q;%(x~;) z7qcqprGZyi5hT1?TV4YgtrN20U@YnC?AiBt6-0h5NLG{Al(9`Jjpe_@xUd5yHo*3x z1gOhcvJTy#5p?Lmx*(V~VRyh^2P&OZEfzvV)rAXH z`0VsM`1tf^5mA@6WXz#TWk2Dk507Lm=hngoV{(!d=%}64BhT3i^sp13`p$P4YY+zQ zL*3;8buJXTLX4wxmzf25BaxAkor5Gosi4Y^Rq}-w&n&QXA!p)mwdv)MXIqyi60 zsROXS^oUPZ(WmXEPdjSA3q)b4iuP?NF}0X(T~(_ux@!d^mm|Z6UozV9oS@L2CE9CA zG`hUea9H`%kn0mNAdJ5>(JH6RWkurY{S& zdhZ{ul~SubENl^Kh{iBec__+`xxP2RIDWcq>aNzt3 zhY-&9XG?39_w=LY?!)}te1qD|3aS3I?*%}S{c8sKr-2XN`daE|TJIs^Kp}YA)d%Nw zy}zaEd#r^fQvf9g2VF%z6a;h5GnU&A?N9;&Kai@!p||~Na?3 z>I~3xNg;7Ou^lmSrCl&Rv ze5eV~K&|pWS(9-tVdstFCgsx%EidQH8Khn{jeO3e>w%JUEM}L=mH2p2GV3|2^YX+x z4aa)AcX|4@N~oUVWn@dhzB%^XD|1xi>@ zG80o(auQf(qQPyIZ(g_rhP?zpRbeeGC#Z@W67WaD{BO%D zfuG@_wk{+A+A!?F+}}^-j8+R5VxS7>a35U41<6fc?&#p3Dy}n)a6x;WG-w;2kCCUY zzT7LPN)g2sWXw3fO-Y+xg9ViUZU zM+}gCR&Upsuj?xH_|DIHqG}#MDs)-rPT14kmFeN1yfl8Vgb-(uT1^+Zcs-7`tAI@+ zw3TC#G?q4Bl&u^MV*|5vI#%6zH1Zq`<6Xl5{#ue1*kJ+C;`2Ing-5(S6X+0l$%Ar! zdLtaHn0J3(F89l`EYRA-Q3uwgd%m3VG=Tk91%W=y>o1A^o#1Ie+5gjC>L-BT00lXW z=AA{ORm>61bpnzvTD8AC*%~UMx-b*+^S$YlGO6lfZ|o2KFhk4wc8*2#&!((HpXfjM zR*EX*d<7l8i9Z$8I7?|;LOTNu+zhwCA6Xa@8OBCnI=j_M zI!OKA3k=9m$$Hv(tFeuz^|a8^GRb&ix}&9{))jX12v(KC$=13m^~+YEgMnUMl}A)0 z6NwNnue-7LU11W>a}vG#?uo_jn_eeO@;rpQ{Fje^a-hAbB-Q`0L=R;@DPQ7|rAGQ~ zsxY~=4W3-hJD^vV9))mG`kt)5UL5eB>-(IuE}II>Q_-&uXm^SkKkkFRyv1; z6BO_%Vww4;n-xw(KTYcy^^A{;q~Tn3#x&r?HYub>CE8Cb!ryk>PV+Iu?#ZUREy-=I*DE94KAKZ9o^m0f;S>C?2|ku ze6(xuFmOBKPHOGw2)8Yzm=ud+OXZ6@I;!wv;?3=pFruJJHyCJ=o&tLYb*GN9Y?#HD zf#R0YG$Nf7Vi7UiXf8J_b4k4At#*|1p!Fu#K@7WpRdQDgSHJt3uP&kn#6M=?Vien* zmOgVXjN0e9{b)`lOkvo&VCw0x0E_tIU_~lSX+G%Un0|YV^rYQ`n`8j7fVEQ`p?3LxqOgOrKCWcpL7*{N-ID9zVUAt0A zik z1j2L|s-CQyq& z{csI=JgeEF{UV2x)euy-cHb3X60=L=@bIIHz~IofK{ zI23e0GgW=jayg4>-)(grLD#~AV*-8sMu{f0_~%d7sY^Pdvw!9b#~Ao93RQsdV5NkD ziBz>}hJrPuXR?cCTX%RMgbaWyg~XINSU@(=1&|ie1e<3eahN(9&|_m7_H6FGj6(Z@qBm0gvMicWQcUc9tlUD5FhQCN^w>JMwkp8XK z8OM>MiZ@!2za_tFuN)hW$3Cq`?_+l2BH-_^)=+=B=bsB8Wty_v(E9-eJq|$`9XY~v z<~x<`mLA7LsAgW{_a$nP z2OVBgn-k-=9L#hu)20B}DbdlvFYd|RpjwSY=;0+8Wg6GqvyU^@nlboxh4ge=&lv~(h#{C;Ec3=Zq>piCX$Lc3BN?ZQvYw5%r z4l_5zdSgzGUoOyIkyRJt%3SBl+6Avz>q0;-eaRGXGIgtK4{d!*n9(QNT z2ea)l4sX;V&;O0q?%OA-k(8ZHaMpvZ~;1h)5 zA*h!YWEOmM@8>-UlZAFBWIp~Poucy=GRuL>@>&J^?qwkfvT+0&p~&)lBgAtnIhr0$ z@S*{$;xyr?AN8qqN`AfBI*!)>ueVSo;Ez; z+8^#|K1^FB5?Q?7V;F=iqTC}LcVfT~q@Hn%O>|o85evgZChn%c=dGL%l+wj0LA9R zV#@{B%Z{m;;rq39puSI2TW1il1Z`Z@GI+UPWGef8+$cOdgHVvUdi)3}28=%uTD>(I zXlB;)difg-2M4FKNYTO*Q1dRt&GO!RBju@QAXUKUUH%xNpSg9iA4j=ch0=@<`)BE;mK?HetBaB@uhFA?`DpnTzR9SC>G zIJ&fVp=f-9c|w*K84BS!~=g#dBP2jV9SLaVShl?K!6y?8dzm z3CaAOe<((jiWgx73K_vRVvl@ccxSQ$VGN&*X@jFRS5Z$|_ zK;?erAIHz%T^OmfEy0{AFpIPX8Wh+E_mJLr8_;VYV21H&{2#8~GaAkYY}*~Zx6!*{ z^j^Z~y^QF6qC^)_LJ+<88l50|9bFI+o#-_L(K{hgqec7f=iU2V>)ZR6AAYcAanCi^ zb)Lte;rRAn%BMGGGibzQ4HBxdaX8@IiXiM1D&lVMm06E~1gYSE(ob;*k^G>);4H|x zm=7a-ICR7WG}Ns|mS7~vpmG(|^k@nhi#&aO{QY)axR)nn>tlkTi7!7i_}#We??jo( zUT%^U;|Q0%p{?T;>pMAjpoJT@S46vea|lT&b`baL9~#A z=Y_xRF-WP)oFcl8ky(DQAwJq(k8@QxXg+`5Y9iuORu<*`+Q|b$(4U1M-nEm@XJWLX z%bTZf9>#(3<|JD8zHdsj`@D#M%Rkcclp93&|BOHtvi}%of*<|=Kf9*;9qmUb5*ard z%n=EEZdkRp7FJ7NIBK<`Qc3?t0Go^BQCQt-aJ6;J^l(({@)N8D!68JaJ-#`#WPxx533Mj zdFveenp}WLiQTJDVVj~WQ_sv~L*sx>?2(^7EsYWsn}{{q{jd6D>#Ym?ww&zvgs4&8 z113^hzKGiXE+)F!DzELssOF`W+=!)rCL6F70PJqO4w-!&6655`QCYJYIr99JuQU%O zrm+58+^T<=HGiKFsun`%RI0L2`7`OxlbLk{HmSzbcrxU^hgQ-1D}XI4H11phNd0Fb z$dr?O%kLeU7!0xiy6BX!FE{FEQul1f+n*!8hY)wd=trz3i;WQ2nN0ig^3at}~dcFHnzCBS1}c z74}X!Q0HfV1c6HyZCp#YQ4X9J?mX`JcqeWe6GbdAf!DKncEG>UD%O?-tMFGVB~THF4oE zHT}5#F8@36C=R5E^qAXGN66F4?Ich58=Y_^MSvF6Ewj}=m{ExTD0be0j3NJ)$A7V$%A z%+*>H{kZCpeV_Kp1MS%?Mrl!Yw$$?yR322B8r#N9P;zRCvS{n`m!AnZ#fY*Z)34B> zzOCiPRR2<(%HpO7u@Bl&KnP#(2oh*eX}p7w|7dqrirID|JGC-4t~rH#SIt?h#D5NB zV}tX6F=-Wm?BC8`Fe>LlVp03MFUbTC?XH!h%%ZL>@CKe8H>TK4eM{NT4^31HD*DC)?BB3rRIX*yI-~ zJ3;=^!N>ax2jF^OgHXE#*zXJsgn;be%f~6>@i9&JOq2LJMr#i}n(sJMEKV-Xf9tD- zz&A<|lT2}7$q0-yT*{M+SNPLx^GqCmNv>rH|Gdl_tGP9Vt4QOS6?0y|jC|8*KFW>q zXadWdhYlCz96O*w;I?Rm*rVz#ksDyw?Ktr+{avAkOCLHfHDPUqpxYICvj&_uZ#D!c z@WQibxi@hF#9vC1A)!Y>`IK( z)mIuB9|Jp-ZWj*RCiTyQ8%ui4y83Bp+SsAk0<_Z02lv*z|J<$5QAopl7@>kHTYZq7 zgm1O4zA`+WFR#anZzy4YnptCDqJ4$x!dYx!No+Rv_a%C$h-mk>VHDlqwH_&>uGcx-3gt8R=A2wik!@)hjLazL>Vds3 zu{=mk=uwKq$Hzds&(Xd`pQ1FuY?LlLmOAMvF-)TKs7w+`WyFQ1Arb;i?1zTBDWfvc zAWrfT4(sjO7UDXx1kwL!_jJMM6~PLVAdO-sR?byPRB!w}U*>2wHX*2EoQvt1M3bVR z_?w(^laeK;u_PbP0Y^*?Y+~aG_q=3bH@cgzWl|@sQBbBr$3yHn+~K@^UrzxN)PO!G z!H@iGJa{SD-4|Kwy};hb)W4g+KDu$$TsiS&J-0B*|J5ft5jk{ z2S>a~w{vO_O}H;&WARtSUd*6?I91w~UnldJ9+@)Wy_udfg!cV?kaM7``b7J&5fC2a z+qrAA%;>u;%X7vF75-~hX_{ztr4v`?+FMP^yBT!f;UI{cE%}6f`m18S?1J>=9Sk4% z9r1HqQxF;P&_mT+QtwgN8c+mN=&m3ei{nj+wmhuzt; zA#A=-?G+VEaW1@*vqi(Hg&_}tYe2g~uTK>^GKIO!3zCj1?l;}(eoAvI^?g+;R8E!i zdzg&x+|h`mip_ll%Td-aGFp{8YER#K)yk}{>z7xP;(0-MRhm@eWb zYVDYlbgYzc)SI#>*+C%;7KDSC^5eunsZVDIk`_+i{qbCg{7thZ7gWmW~El0xs+!HCK@7Y z`4a^JG#G#XYoI*JglJ2BnPm^}U_il5pBI#sL1#1+b6rg?6~0%tVz zkEbIXBi~Lb%+gd#*BLs$wd)B1>2R7YClLjSO3?3!|D2S>6bB*^i2(NO^q0eXz<>;d zJs;}i&5g6!My=WQvGmRzO9c7T8}l5fMY|!-0i9{Ocms%D zVMS_(|orEH*R;wf9^^GYE+Tu8=}@b`oF&^P(1vG6^VR<;BVujH+r#wds-v0 zJ7x-=Zz_K*0u(WJA^pi81sMkjs;`wZIOKeQAt1T56r8R?*OSO>1tk%imVtc2#vUF@uT$t`~BqAc43&5F#xt@nFA z69ZG;@ew;&y}Qm`#=A0(?yGsCR0+QGh#GHPo;6juIO<P%BGiIM=F-ZkjTO<34#s#54bBiZ&w6OGoPVa6?+zAhms(2dT5yUob#QUQI{u4 zvoq{$8}sZqn<2(z{{kuN-)zv`77w%N@Q*US&Zd2wv>og0e4PY<75`Lx%h$)oS(_~Y z*4uefJ~CzxzlVcsy(EQrtcChF?kNl`IKQ2$wsSF6m?u@4h}ougg?U8mgeA zyZU-y0DzdP&X)2>tLVKV)DT% zZ&)ZJBe&uLWBx_l*cro8!)u(mkb-h*I|NYkAe^iH4QHle8PK?720E;XiNfO5@A ztQe^-;)Ub>rO4|S#ml$t&16KS!Ck015l>EgU%PH#{yv7I zwK!X3h!}_7BvMU0n+1ZiU6V9&jzB5>1Wo4QuRdFMQyE`)i7lJ}`z*SL0%_Oux#Ww| zgwqREdk_SChkif(VhBdis7SHpFwVLEOv5>Kx3gk5QilEccQt$_>(E3#ArutH%(q(2 z@8g0Y$|*gL0b{KH!iTiB{xoG;sv=Tg0naIop;gCM2Rxm=fa7>j`&oRAR0G)&!lrS3!=Us_r z`q=I#Ow{uiO#*6mTV8l1@>id5n^j_*qLVduP6D@S*LxW6dr#6zzPB^OW283h3XI57 zvH|=Ck7*5F4FCK(^~ps<4ATVzzM4axbp7H(pLlc!hd`n}^lNlQC2a>VRi^+O?@ClVnsCqiQXTSCx~_Z z-zS2%#^ zRn~|>=A}XIFB{%!M3NYOVV28}aS+=lLU8+lRrCsp#P)@qc)#SnqW>s0K&>n|%|8Hl zXa0_lSplb^Pf;70;DhFD4O(17%N;|l`kGrPToGFgYLllCMi|uOD(rmNkJ$MVBt%IMv1X!@SI8Y$sZ}00s z_p`JY{3KN8(xs1Mh)Ll^*#sL;VUozsfNl}Z;_t!a6{sih&MCgI{G;p|6opn0Dk*Q} zpw{ewgL8kW;vGiQm6PGqL?i3KV;bnXzJ&ep2gIv@nMB+BN zJ%A3JsaAzL9ipG*+-;q+Q$k$nw=9WQDNt)m+$S#bKSDL2h!>j2&lK8zXgq$nF-w7p zc0IpmWUJNfa=7__8k%AjW z6EtxCd9cR>Z=XXT#LnjdEZ-4d!HBv1#EGvea(K0NNf)lG#yk(F^)m1XAp}eh9?PnRuBi9i3R^0i7mQ z0XtLrT@jDg{UndxsjQ^*iW(^A7%Fv|*jpn98R>$pUiW-^S0BF0YN4fv_*uCe;$e{~ zJaIIUXRRAQU+0E=A8YBatKwh@TD6496xZPlpzrO%DVom*&EIC-L- z$@kK@U8INj=9&QE>amvicYW3#rWxY@tP;?1N;I7xb$*9%5W0O*wEy<6i3inlrQ>_UiCAcGeS_!-Lb(NlE=$qwn#{$DH_dAN~r^79{R9)=vl!rt4G>CNj& zMG<3XersIvDe=vRHVh78M$gzHB;1Vx`jYShWi8F6Ls#PaVZ64c6Pik&UE9ngO`MY5 z0z>q&Z>1|bZZn6`SK25nTZV;UpEo_bED>}-q6r9&iIHDP#@!KT$gD~$C7XuUa(vhT z;zvZ zdk_E0hkPSpLYvcRVA5+CF2bN{pcr)iow2Z%NI5@>=j7n;h+^TxPTcC;(?i_AOZ;MH z%~4)H`2bQ?ROy(~@2KU`Ebjke18!A#uPI1L==|?|0Jlx{fG$dudLXOL@2{$|8od}Qp+zS1F}|yP5}qOx%qViL z0u1l(k9m`4nteNX@KoHn-I8{yf~Zi?b`-$p0&UL{iJ^PMji^3<`xErG2msFbEOag5x3bHN$fB6Zzs+$8=_3;YJOC-B~ z`eo4Q$Ze^LAcqyaPHsE+7Rz3aH`dzwMQM$_cZbIVvc{xIKj{_AGX^LK3r?E)$|#oG zw|@PKYZ{*Ml-{;HrpEaZqo~1l=*OOU>`qohah|l4;muo;kvd>a=MQ{Lw*$_-oP)8p zUx5bRji(~Q9tcgfexF4V6>3*Ak0LC~M(K?iYbi?$S$8bKw@k&(>0-nvW%YGO82eBG z_q94k9b;uT^7d5;q(cR@=E5hOJQMtWxm5kktzU1$HJzF8khJN@hbtFVi_@$eCH2UUtWH-jdJ}FD`(_(n)3-V3hpG~q0&73*kqZIow zRpu9{I&=CIADS7Kz5#dl!Elp4DT7!NN8w7lR0j2OG2uFTsTnQnJ%vc5WoL&AZQX*Y z8@9E`IL+a|_B!iZP2y0a0raNi|FrRiP%^g4P5!~r zoVidOr~go)2&&-4q+1bPY}u?o+Zvi)t?u7qV2t6;Uf82WS)=fmyQtOx5uGeF1Pp&5JjaZ+d;2YOF4EbjMYw%-I!E#i!9t4s(@PL zK|19y&-UNKi9Glw`U&&RdYAG#k=b%NXGkVUhfJBtkE5p^N}JfCN8SpC>Se`+tAk@C zEaU_Sd3i!%3N3*YL6f*eLrNrv$gOpXz8k42D?+0F5F|1p!8a0RS|ky)58ZBcp;c2e zJE?34zPRF*`L}j`3V3)3p&%Q4`tXRGb{_87Ek~{=m%Z#%hgV+swBdCpf>R0pZDxFW z{-is~eEyVSBc}}e7qKU}P~z*=kS-_p&Q%>la;AZ-VI`CKNKhp*NBY`FTU+~-O$Ct; z;-G#<@cIY}2O7wEUI%xChK4pd_V|kLMJ5VKxHXsi{0r;2{{r3dx}xJZ3<)oRpJM{m z8N0dnPUet`*}wVsKD_&vqPub4kU=CTPSvuhM|o(T z7sLHrBRX;Haj$c2H*1Yg=isP z1Y9$85+8jMA@8HxUut(zvt9iz9G05orCnFh?O)rh&L@C<%(Z5-9B|P6`zz5-t=gkE z9itZK>-zfZ$`cn#x0egZfmF}NSL3t(!5|+gddU*@uIj8(#IB<8uH%^N;-G-XyYtA@H8^Lcu1r@BEy>1FTajt%!OD*{Qg zg6|%Zi0hgAaGlZwK3j!!KV3gb-j5XA<5<+mE?58CpiEhP%D4`seHn2Sz5dVsA-HRb z_9k9V;ARTt{@lMamcQpm&_7^-GxK!S^=5n5?~6rU))DXp1PcCB|A5+coF4fMcyGU12*DZi|}1e zsFtz~kxy8p;RlxIy#I;A&)@9%vb7HCyVV~2Bhj4IZ*=5+*Eq?@&Q<)+3K#j+;LkT+ z-t3=+?*$V-DLI*}eB@plqz(7YS#PPPs9v)}B-?Sug*B4x>%$wM+Gl%zNb^c0kYqp< zoP~;E2=l$R@d%+qS_dPL4UQn{x~F;nUaSYyV)Fh?@fwfN3!`cmzXh@H=%TO!r_!qa z{%wrAu42Z;Vdo{n`eSVlJXE1KjQnk~1xh1wh4*hAK}xB#Uo9!TQZ&Ip_SMdUWT-Ku z2p!2#Km!%+ZDn}3y1a(Y6XmS^4Z4IPGI=nWY3r?>mbg6md%NZ2vgT?BmHQ~bb(4W%q}y!I$znZ6 z5lH9I{6`KoPK2gYRVT>>%ud2n7bykKaT!e3VQnECv>_({3%pPt<^-K^JXdJKeuIcj zNBrKrKygS&hO^~iBy>p{8vJ$kcYDM(`k2ytIbX!1_xmd{^581D4SkZWZS934s>g)y z#T5?7Ez|j0j7U3FN}g3FcL@1C!pfo@W!*pXMWbeZql?_~isc5zT$%Od=C8PRXj@HB z^d~sz0ql@4c_eZsvOSI$3 zjLLNUy3d%(`8Eje@rwlHxZ>;=@KGSEo`G^yg;PAVeCyc2*ot5os$y#{2IN6{2H0M? zy0}FELzd7KbS%i`Vw$R>tNM$B8tN`mKlM0aonWD?|m0wO7_w+W71#9C7r?o-tZbtUs_e%fz z@c{2BGpF;y&bF^2wVt36+No~p=@+7f$@NXPTnfP{~Ohh7UZ59gBF(DU`hN< z@Shda*+{nc+l+7_bC8upwbC>;hT$3wM5_*!W1262gQ8ae<(t%>dPO!r1>ifP}N>5jd{@eN|53mkT41=7?8hxPfs0g_Bt2!bXqv9a@@On z+pjaq0qe$+RCdZkhceA)pM>3WQK#X-O-b^+5{K{G$v6Qp4%XrU%^M%*Al;vbB`laPfE#7~SZOo3U@L{k;am%7;BWoE`j-(RGmtRJS&1|4Dc% zI{9I%OX%NiJuHWhAy>uIMnbW~L?2n?-OMSuitS`1_Xi%=0BfjwS6oUtwFXoRrODgZ zFJM5GF)-pJ@Z@F5k%W>ikE@Qm&Utm3TBe;Rwfo_q{MI-JFkD&qF#MNV`j}!@RTF7S z740cy5^jTqa!sv_VA1sOc>|CE_9A!c?S4*sbp}k)=f1bpz|Y!)1SyzHrpFXryYgPE zEUP$tK_cCp)C%EHT+nGz>%>I_uui0o(m+J!u*$(+PzN9t%pV-OxnI(=lFc^qmUJUI0&;y06h6iCCgq$-!S7_B6=) zzfnhT03)*E^wU%%rDW?}P_LYV6=eC_gk?NxgcV-QcK1JYr<^d*@5@3I9hLIIpZ{K? z9%&b#5MQk$TNk7W$Rd)8S*+z`taMQ|N>jwx0-Ex*``2UtN+0WaOJ7YyUpK+$#@R0P zOI8lP+oR&Vguk$wh*vv56S5ak=TAy&SbJ4#bUt!HgH0rX@@hO~Zg}-MS*nybz4s-aPB#-gev^ILzq$I{O@BB)cIn`4cO8szX&k&8xIRd^Iof?W@sF|N|DARGL0wlC zZ?^ECE}?LNgmL$iyA-1yWr`4DX%Wtg4zBo~zW2;XZ)}(_F3LvekT{nPVA;t1 zOxX;^BQ~RWw>M6qOyW!pc^70GySt6_2PO_vE^xJ&`AJq9oR%I8c+|JsadyIKiJB^ z+)J*+SYg=xuR#zob!^mp z07yyJu5~`M4I30lm|jFhWmRPvkNcPK;fxS*xB=Y@W%3PEPJg)eX3x`NP0dcUq3RJw zM%K1)RMR=W{wBSpBS-0rnKhuM?`>iNVK*l1mp}pm${GMztpO;eZLNq2`z71byjSC0oGRjYI%B~4?Cn$HdotNWvPG43B>|5BICfaIAwqcM3`#7r8p9j;KGwe;_+;%s=b_gc2(vdbVAED|FNAEBHuz|ztuWMpl86FM+v<5 zb8x5UBJn*E!z#H45C1-3+k`CCPnygVd^U|Qr=KQ(manYOc&VN|T}0!x=bsS)V+Pnu zuA;E~Pq>i#HGtUJ{!tB-6~6tM-+b$2n^b?G3LYHQ1a)PG^^T^g+>3OfvF2=J{A970x1;eIyqQKoNE&?Xc`Uj?!ZOku#?eZ~R zDmZ#k&EF6BhYPE7Nw$OP9atzXm~U`IzSkBTv{fS;T8@r~P5o|@P3sWk#REPWKdb_% z=#o11d7k$={cwscGc$@LaZ>8ML$IN;klg}-k5Bv7kHExsE`j)^x2vKF+v73Z4rsTI zRBS-B%4OXh`4;?Bi8>g`9Tv#x^pZ~56B)x&bHR0NTwJ;=YG9WnqWO#FndZ$e0OA;M ze>S9MPD2*B7JsBpHzJ|@)g8HKQ64Q)xZFo01ZrPGJFP$KI zx)3?x7x7cqeQ@q`Z! zcCJ>To9<+_72;lG@sF}ATIxh{waZeyII5_^yW4>o$ra$f=9c>e=6^TkkgOH~b|bch z??4?txd6a2lKJ-4$%JB@0Zth%i!b>8PR$xi)-r8eN@0@-0T( zH>5lVk@$twtDzc@%pVreM*m??8L~XwhUjkog0U~5$)-f%aw~}Wj1zf~ta$;-M~CPi z&vx?8@_JC~LD~sYQ@T6i>w$D*G<^?A(W?1&9C4^#=4d*!ft16~7-T@#>J&4Lctnjp z*QvBxLt(_VMImL$I2k_P#5NjCwFl%wf?bc7_1pgIcMMTo(Ww%iD@n64c8DZclG_wm zmkrc3m=)olGQ}5;ra&iSJd_($uSWLi5WARqH6{79*g=kAoBkZQO~u`7T*{R*@(fKZD_GUP{6XHU^t17VOZZ2o@C%WIhk4_c7~%5XC8G6PN1cub~cE;Ihtb< zdMybeKe94Hp;*tLcEvj|dqEWL*0~x{BfsUQ>o(O^2gQ?ga+mng`>P0f6fQ@sZ1wxK zive?@45C8IM-&{It})!>i^1W}JAO$X1; zyJSrLjQnj)wqJIa(9l5rYwP`|g1?e~yGj1OjFc<%(iwIHOBNL{;>0fDQQKr?%hisg z%;9-?hUiY`potJqZ}kWM@tvR_f~$QIHg~7n&jn*`!7?us`1qlNFMOt@C)F6)z^Dyj z2VdK8IX);lDOUz6Sn8sRo-B4>Ox6sj{FxdgIHK7RzLGmU-J?DmyK}S0(1m%dhWrt^E<9y~oYBe5^Np$9%nXgfKe z@m%SbAN?f}r;-0vV*sq$dP29YbrrzH^FoZ3@O$hY<7595j_my=(aSB8M>;;Vjmwu0 z+UwUY0VH)qL4U+@pEga`Ylg19(1J;@F`q8{J45-0FSmow)@@va{{H`0I(KiL?l|Iv zM0T$d=Z8Pg^`-xO!~CLn@*>Qg85@g;NBBa%w#+2}%ovT&!Uf4S0Zh;LOpRMT0ws)?H>)gJXsJy{UxVIyA8Az1tRrGPVv=iBoPe8|aJ#s+e zVwGPpt#h`~8$h0GCfW&K^zrHFQ`&2&e@<8t;j+9*7pztL=(sQzbc-wmSVv8O{?O(oYXWdsEKE>UeF)vL)xN2Hw62UF+k^e z5RJ16!`SuBFDq6tpBAN0&AwemXeC#1z1=}zvK$`FArUOIHA!8?knx|= zMOVyag}C2dP(|aseEhWlSZOQtsX_g9jE*Q@buuh=sA(K0Su^Xfb;)KvD$328(^xC# zGbfSjAOtk=!2XNuu18#Q6(&469E+3vRKK||A~eybbyBI*?ph&Q*6v@`&_T=s49Y3C zd87^2>DUFz%oA^2C>&WLTrv1eT#&_raj&TJW02w^bIL_U)Ezkm0bg1Liiy?rqs#xe z2YZKkB#_+R{~^t3jmGMAFw6kt^zB@%%tfl1;w!Ga$CK<*=B{phy|uq)L?{Dx`-zlX zR4Kuvx@Df7t;0=ZUglOgzAvk`rRS8B%4r*FxKkr0yr{y5o&$@IQm!`$KqM%)@-d_& zB#KDe*g)a!3#0iwE8F9{{%uV&eW^X)-YDmV|IGp@=SZN&Oj;w#Ek|z6Tu5V6)#c0W z%uD6zpI-nfoItvCNdukt0s{Y)L^(BYd6Za7lgO5^_3yUpXa&?1A1|vvflg>;g6{y! z@Zfvd;DHBvdaqU&McJf)6Zf#WZ>MX8Cs?TUsOo^GZ>;586;~BUQf0#rOw!u9U+))WCPJ_tlJ5( z^7zE{0jn-T&NS!DZ%Ea z5~ijwy4OWhvQ)O6C&e$nu21cCJ10yallJbP*Yp(^ICrfjE|R6zWrTE@;}+OFYaXr+ zQ@@8lr6a~Pg_-#EbZt&hLAM*PN^RqL3)if{RkZh;WpX4aV}I%KVHKuhm7NknO8^Ct(h_F zt(|1X3E*LPV$#%?curM_R7WW_f>bz03>A5@!3cK{gMk?wc|-1C1?-P0fGeQgYjwcU zfk1R%kZK%^mkAXe|H6^f$j3cb2FFP=+Ut%j22sEqs*cyaN3_}97>3{=1GT8+>qiZF z3E6lLj<>08S1v?%?jiGINTvL8&cz1q7}HGF*Nu9{rU4j7&qn2na#k7LIoA9=0~yov zalz74(MAgd5_~bwQGF;jx&otAUYfazNp%FqGxImNIQbakn!y|ZuRJ)n=R_vt58PTe z(+(tVGL-l`l4KqegFQj8n0fD~<$7nb+Lgo811Olu-<#W2Qk1y(3*}$y*;=omF>$MP z9M7N7&`)$z7WqXPCVU@1g9Nl#z~Z#LcrJGiBMDmQD@)SCi=Y3%92|oJGgGFm?SjA7 zasN1-#E?AI92)AvGWGKD5)n{c``3!4qb=O@qe!jS02Ez<1`U#z13LU?)$2Eg8W#!L zvUg;!S=U5(^U7#Va_mtAjL8N2K4mwI$k2k~n()zaNvRY1se)9my>pd61`pFD@FY07`J{x05Fu+wWxurKT#6a6L6Q@_>wX@m1DCvX{c1ChFPWvvV@%p=}VR z&jBk~@wpa@j<< z()e05M4@nuftR~BfhF8E+6PlI@&>{lDix6W3f9MZhA)&;LJ9pKDoZL=GT$WM{GAn* zXw-eW_SUqPX2J_EI@N$*mrkjpk;HBis~E~HgX9tJ++L)pp0phD=`GqUAWv5=oPKz7 zZvMiTlQI@W-tq;Jk6S?n8OhAX>D=)~DsV>r#esFRG$8a5B7RI@d z2Prl2uU<G(5sCle3Qlqlh{GI5BDky3*HJaFiSI-ruO>3|d_m}Z`< z5f($)A&PmRh>#)@sYmKqf{hcw9R2)pt+$SJGgYb(KQDZ|L!Vum4Y%csd_o$&7Pon; z6qq)vBGyn82bebK>V^8x{$wS|$jiZy7S>b`j42IWCP&U*+l()TN97*J^pt3U?fYN^y*XXK49&*WWFa+;X1Nv%;$_gC;u4?}*R?&Pm$^UBBF3{6r=`p zzOMg@vch*Q{;T=%TmLpeY@*H{b!MdKZ6b_k;QQQ%J&gL}lY@boOCU3*DBG(y$c1U9xfYe0!A)pIfsD8L!Ed7_y<>!>eE4drmA2ZfSv6 zIf-=s`$slSdS(`;5EPMmndkH!$xQPuSopL?4+6N^zetAiuolY8`b=|DV@)ECQ#0}h zNS0g`cxG^y=KL@ANR(5e_oPG6UcJq{T>_(RnuP&pF;uf-)U9j>P0du-c30x>+22}c z8v)wxO2N_ePPnMpHuh2b_H%{d=}X=H=j%jNgE&E0Qt!;_c~R!<0Ak^AJlS%)%`&{s zCJN@(`K;r_3K!Z~F-FkHVSz$CO>((-InS&~-)^O}a3uitxF}oj=7^UXhl{QoLq#De zTybtlZe0hG2Kp$J$V%ypajVsX`A;Vd3#Q>+1p>UzTSVItV`aVVwb>XuwbiJz9m&mB zHcJCx;ydk_L+*5HMl|wnU%eV8F`m6#Ac$dh!~cx-&x$xX?ebZs%46-HMcb&oa~cQ^ zYp*;r1v~4$9#`x&0kHFN50*$@TyE{{VWG?lhw0fdDM-%_Ru58D*^IE&sTi6MKeA`| zF`;KdDHcKv^GLT&y)Sqa!Kw)cH2Z}+l0R63?r#BCL}9AFbv;e&yOB@nN;U4dcXCTI zs#F!!fSHDhJ$rcL*dX!@jK?wIQ$&8zv9);?CsiRVf5>wc*e}Aj_2OF~n+EVE{6OZI zgQ47%!DHDH?a(nrF|1Vvt3G()Q0qUW%anR~e&dae4noR$|KvVKc{MBb#}0v^vAOk7$!#(ud#o*Qxybd5r1a4uiUWzQ7CK@4aUvb+*~wWM^CV^cVsU@RQ5 zM<1`Z^OErw-Kks?R+}~%5H6Fpw;{)2SOE-NvH}!+x<=DBz+t`8Q z`hJ{us;c7048Et5TZ0Tyt%?$Y#w4&9S6~5d!ZRMGR2~ZUInZ}(dSPvC43+T_f(B82 zRQG)g-AO|Hr+3{?cdv3NGB}nBR5d}-eVujMRI0Ipr2DvrCr1~{@9MfQI?ykxCk>^A zr>zv4=InTu1{esj_9}}W1T4)d2H<_46jb)B-1CUzzfMa{p?}G@8<&g~Ev(KYu$9N? z7;9pJu)%@$@piif|9`oy4Iqe3e?N2mgzd7-JmmrGbH08RZm-LV0WraO*sAD{TCHi= zr++0tA&KftMIm?fE+sDA60XyiW7aw44oOg<+8qtxf;fMj;NBRUalz&EbN4Ml1P}M6 zb3Rd+>%u!!zw%yO;C|@SZF7KSivZvO)7R2Vt&yKRM{}WdeN+gaL+`WnlW(Rv!=O}0|0e5wj1V{`VB%rEM-EX1&k8~f^dZflcH;XQJejQ(IKxVrZ*Ds|JTy>slKRmbhh5HVy zoUf%>4+24h%k3Db5lfr2{TCs|3Zb%ehVO3i=P^=I&qX3*i>I+pEw-tPH})#MlveRu zHDfH#F@IQvJoA!8XF#=(efef?B>BXj=p=vA>rT?a&MPv0t3RJ{YK_H)o@gPh+{g8G;3jVVf z>2>+>K=GE2^{DssCwI!u`lDoSTjDD^Bsf<@6w-F}JMYcmK%f7{;+%K!wpjrI0KTLn z@IE0?Raqm&5I$rmO2TPO7E;`a(FE?4K@ZF8gC`GbC-iq6Sw~a%$nJjxZL?EdC(Ad? zX0rG5Vn@N}U5_{ZtW@_)Z$zJPLY@vfS9>UTXx1K`0v`FFhJe`5{|qz#Gt-dQy?o4g zsbXjZ#Ef?`IA49Lqs{!FUf1f_4^hnxeeGMT$=l*=Cmc)NvaQ6rJQZ~5Ffe1OY@6*+ zamZ`)s?-1ejkH3J8+MNIUMt}&9o6C_EAUwQz_BmA7&97ysJ-% zmEm~G!6bL%t&2NF^{&hEOw7am?$Sm8lKLsxq4=h(57n~71|jN>Q0s#j_9oe_0)WMN zuiolAf6r8Tt&seUSsu-8SZs;}E#V$w&rQboUuA@g_VXtw{M6^m=4G{H>0}>*mgZ;4 z0NQjh5$q$^4mE9W&L1&;ZXjcEr}a#G_G(x-THo9%pAtBvFptsw3+lU^M=w@LDI2~J z38_+{6Jhqf&aL3xfNADQ(*6)e91@#yf9Rs!vs2Emcx8%A8FDX14vD8LM+ND4Ek$V( zUgILAKMUs#QZJZB14!Q!=LX<=(b0H^?Miz*1}H517t>_l*?^|@X5i5$eJ|x#*pX4; zOC&5ImLVXkVw%lG*5QUXwC@^l>I%n-hBpE^e#*l&LLRHbBhZ*ChgbmVxIQQdgF$t}8l}5sXhgcZyStH4xl<4%6z+a!;RSTyEGpy_5WJ>ZYM;CMYf3X%BY!9Iu zlF>!e97W29xDL~RgZO4Ex_T1o>odSKqp_jbppP=pZIw01omjcsT@e#H#B$(r+mv5> zB;#VUf`GudQZG-W1xvAF?J!PDVcirT=dGaBC{`2dJL`j}Y;dUJPf*p4Z<9%a-;i6J z?`@$23r9J8@VO|~Tg}V3x!Ct}=4)uqYa8?Q({xk3cHYiH1?+G|1MXPFH4hRn+wDHZ zApgKGq^Pgn4=zD&>C;HMV>}FTryXoy;en{@UYff0oe&XIaawSkZ@;Agir}cb&2D zR#t--!zF#I*?$pYND<7c?J$3!Q5G=N7h#VymzZ%4mV98^v65fG&fG%=#x$&#x$%PX zNioR1OMfuWf2i)NLZUA>iMIX_l%`K*Bi6P2I}A39?Z7`qHLw}dlk_kDOWNSJR#~n? z=LX9#&B%>jULRClccHLPIHe>`)szY#8Ym7v$G~9{P@rO_k7uuK<<)aE50Mc!;97yM zsv0d;R;%zfD~CtRr=6B@)lRU{y=W1lJJYtzPuh^k+q<(|c@#Y3m?5GCiq%ar03!}K z70%}S)Gr`(bBw<=+4$NSgb2fXR{cWp(qr}UR@F#2Hpp;n&6-`^KL1y@RUq|jxE~{Z zFv%)LI0BlAnm_Ks!5ZPHK)8kdhS#sNPOo(}Dxg{grbj<$&02z29Aa4NTVz(c843Lw z64-?qRm!0PScU9E;tTv%a9=wUA=B|h?-Y9Ka+}=x9Zg5(sI4y3o#`z~?Hg)VRBP)L z#Kns;0!678Zj!fd|8bmZfad5s#9H?Gjo9d&{OEcFQUeFXq=9HvM06H0MZ*uRF1;8( zfBVo#Ie93LHgUuXJJbnz%FR4G(<8x21KXQez%B*9i_104-Hk{iE8UBuw9=7lJpfs> z(o)PZ0cztDF_nU)(GSbyiNyQv+Kgz0YDoM;0!A`k=VQzTnn2Mrs=a^5ML>xrr>m2AIKM+e8MqGha1ta>``}`+?@~C-;IdO@O5?#BBnAo zI%0D1zw33Mljw4;A! zZaHI|^uk@K~kQCU1aU%w4;A;C2GP#2aoD%?Y>R1l2B>k$~sKsa2V^vy*26Pg{$M`qEy z{rnLX7IdvKG!>Oup{jH7-K&H%WNInUZk}oZSMJHKf4*Yg0R^U8qEUXQ$XdPN<6OY~ z`#Zy^qMIYPj3+{^w_Wg_*j|JDDBl)e9^E*ZDiBO8MKn`a1j|86}IO%jj(Bs}vt z7d)o?fBNKez!T|tKdR&uV$W_Yg|MyTQM5nV_uG(4RqxT2GV*?FO@+>FAL%*wN%c4g zzZyG98vdo&AS&&rEDV>%#k_rTJsp&ysO#gNpJ0=DJ*O4fliN!%3q*ySy2_E7z?~+iOWd zyz2L-z1K3>cFY{+aVzQcm(u;6xhMa#w{LDI1q7lj_c24cdUJim^efo0VMtmxl(ACiKF;G?->^Gho%!@)}73Lr@;#zsG82gtLh7;uqv|Nwa?Er(W<-T#Q4A#lb*5Lp10Ueud#F z{PXNbVia^nk664q_bsKJfaB0QK2s&ed=E?)iosEn_rW&tn<7q?gj){OARTt>fSw5j zzdQ7BSeANbjiGuPt=&xIWMv!k&vcPU6Vhb_2H-G-=3~mO-@w)_Ugxlyu?38w^Z27) z7hNlhWiS7|9g{h6y(QwAc)Gl+n6wm66ro`~c6GEf#bIi4qQnFyZS{r)+)t@t|pYA4@9UV${miwNSW5IGg!WzI{?p6YBoHR z*KMt8KIo9(|D>B#ew5oBWl6$UEX$yxtyp$-t#F%JPYbpi-K2ww8BwG%GPvFQOC8o4 z47gFfR>M3)u(2@w;1tQC4PsSQ)-xbslN>R_x|VmSX$Jas`h|lxqiT5^>3#?+StL5E zsRp)=${>DR5d=(LE)u#fVDRlzpigH~S9$Hi zr49nvFKqP~P-(bWhJ5^cpfsDP;0^P%hW$>)(h*LsA;8z6Ff}sVZz}Du)`}0k|TFL-nE};GSXE2cKwP z#X9cWKT8sDkQ-O!_0AoL+JGR|pq8%#B_GNbY^n0NP4yb2t;Ia(Tm91t`#2)$t5VgtX*QDw(X-Lv5%m|xcwHi74>b9D)3A${BqxC26hDtez3oHc8ljYb4v z&FNOsi=Gjjy@8vJZFE&r9ShvLuMh$1Xy&l;f+TxjI(i^r3I4bt*kL$@>D(GV?x9s# z;}%u_y6Wqe#M=y%ZSE0_#XX~iHLJ3Z)cHg8Fhd^z%cbJ2E6#4)%29*&tVHnkb$vba z^s;Gt-fvcAOQAj!BZin_AlJRO?qVf|xHd>OQ;dVyq4yqcdv)Ibq?Q*-WEzJ=t)mO4 zBU^&v2|2n>qMz2ZHdtTsq1OuUpR;e=p*)`_JmVc2mP;ky8XK~hPhN3IiH|{2hO}S~ z-=e8zIBwdRfz99`_h@^VWwKqq>8=g2%Zhx^%B?IJuG1oN@C-NBY6M!9p7OicQ01gD z@{LB8XyVL8iV|OK1@Ggg=eT}t$uuDp-J^PfAYjEB?%&5;@QAnZl(F&czw`3;)y#%z znj;WCE%19T(nj@0nQ!Mqmkuxzq^E{zGvo*Do2^!L4&v|dYY^TC@hDC-ndVy)a5Z7s zx6(}9BE}9el)E|?Uaj*_k%c3CSeNJ%9yuTe8Ey14>E&Os@R+fxSBS85dC=evMv6@U z)t4PTxYGg)B69H1`jduw2NxIkbpHdjhi(cMo39c9m-b)32(cM>zzc@1E{}l9g0Tor zQ@P`1fXdBl8JhP)vvlb^glGzfp>$9xYC)0S9TuEY>a{`ds;bUgmniHZ91pTWJ{+*J zOq459DxvUa8hc;AUW(s^N0V0tv+#Cbjm7Hy-C8JqaL6e~X+g7i!QgiIHa^Jz>B(t@ zJL+ip>SLEAYV;J`WZlgvr-B?#z(=6I{`tlo3r8ladg0ptZ|7(d;nDa#Zny@7c>v?epjvv@xR5Ww(#1IgN6vES!bntZaOMJ z%CrhSl32UcRK1<(Rr0=yM@`832x|%UUBNxR{;2f0NWln;lPuN+wi{Lnfgz=P;$WY^ z6($0GPgqK-X0b1phyUDjXBUdu|9JuCuNq?-Oz5*9>I9GXt-Wy@Piq@~@K<+kJ;hMK z6n#b8`#*ydlLugM@^bUvDoBm{4i(h&znbKP_VF{>`g8w7Pu&0HpZ+HXg|WEtnA02D zR2y980OMr`wnMYkBwsG_%F)+TzKO*%fM|ZCTlMp+x4l-g4ffUuWS!x&JKhH{Ex=1{ zw3%w*otT)hrru<5_(i|AS3armPld-U2yVnXL~xd!%KYwJ8Tzl&*6^FFMarOToy+na zA(?bn%;r%99m+_jl_EAf)>YgR{wPkG0%wF&F^Vjjxi0Q|(~a3L)XUCvcn2F(Mn>t# zMjJ(3sshiPIhTXni05E!O2C3K&PytfNSR#4c;MUpHJRbq#X$s)&)pR;F=&qzVh3{( znRi{6?7KC~J$G+6BV+FJ_e0%R0#4>&pL9qg5GEhtebu&B?-D;0Qf^h>LMZPy=b6bQ zA_gR(uK1DhxB}7>CXVlErkQlyqd#(}Qs>cVgRkxE(OsekrSq*uhr->mhlYPNDSvnW z@~DqF%waM2M<;_Nn!_NWIjWbgQMm!vILxwvi~aP}e(ZA@rw?qGC5GzZ^y1FDpGnF) z|Dxwqop`~Clvjp|sAV#AS7;52^IuYNCsw^_s;;bBRGHw58qhWgwk<@x9wj4!v1y^` z#Ph}vnWriI5Sq%|N7fx%JunVb_1l}9eCcr#z2q-*7~x9}Rejs#=Pd`@D|V$j$h8r! zU&N#vqFv77JKfgF$duI?f!I?cSw&W}{ymqR;Y-du9Ffod7sYQ#W`i&Owg~MV7D(o! z+1q_vGKaT_KPcz+=B^Y{*&bW0B0O>xjYfpoK6F35nI&Mg3R3D4c|#-krwk?#Pe-T|S@g6crM6cne#2K>64Ib$7mF8)yn znOtN4?`25zn@a4XmLvm&O;;--rA1ueFM1fE+>-i{R)=ETyc846qhxFdXi=YRwcD3; zoS@_mwaev*1BCZc*U~KPuLhJ0D(?{DhXst7avvwDYQ0zdrMSKhX0qVv+s=(I`#ShK zib@yBNjWnv;}MCk;>yKNQka5vy75G?%6$kh;qi_2lmK<4ZoOq!Rl#&J2-2L(b+*Ja~=QkJN3@Cjz0|A|NHYwnyUGoJ5ShN^}CJm3L>4so+ zS_;~Z(r@GZ3bGO9L;2xH6NG~WCrrx>AtrAiCR)N=oS8&0ZT?e>kEra2q zOSLN8YAMqxXUH9VDcVu5Xf!Jg64Frtb~*aD6{bEEiuhcD9Y`#900Efzd&X{9J?;5h zlMd36T*?k-(8+}nS&rIVShz#(P}>?#=Rb~##4;$CVGhnj$M&h=*gNU%J|Q(K%*Ot% zT0rIK>K1Zg($A66n=-b&7SC>xPlmcfl29I>+HunR7t3Ym_@Ui8R+{fyj7F{nc-ssq zfbNIREA%9ug9sX3SU69e!zFhtOB0sD-ZDQYeL3ULuS#QYv}v)4cdC;emuad>_+%h( zJ^-8k3kksCDIf4}=3-lxLL1Gv>=C^Qw}%@AT><}!&#&*ev4Ue)L~}wVN6H5!Q{rQ8 zz{Cx&9Vj9yEi&uRBO36=!l%eD1xP6pk@*^~6*^1I(H*&Ezc_a1GvZHskUXq#+R!$|G0408e;hph3#xb7vl$gf+e2`mz|j?#?W$$XIJc7@7$ z^da3wDMdoRgqaK)=mpoE23>buOavT#*h+Z0dmtORpl)zoshnOs;AgLPGSZ-jM%(2# zqE~j*Vm|gnh-U^n*^T=wcok`wtL#7X>#kaq2CZa`i1>k1I? z>Zl*##&T&ot(oY@zkpYc(IZhY((#c@A!{onLlIn<@wtYD;=Mn99I7brk4})dM{8Z- z9Kv$>Y&m;P-4y$J9jy?iOFVY6{ZnC)iGDyMMQp|^54pQyXSj*GcywZ2c}LeMN zh{sF$%svEZSb{I##2GET%Ky<2TGu9B%}Ay3Y6%Vi*AX^BdNW8Eux6-v?W&fb%+jcjZAXk>JxpE zee42}XaL+$r?uN@CqPn3elrtcEC>Y}He~+obAV!j6J&=i{!2WDZO;k8KbetmCtz0~ z@4`Fl@$7;O@tHnz&kahB-|e)^^Oso1O%@zcwzPaQY;Ew`GBhbT;cMll(NXHV#Tz5b zm`M@u^Xh#t>hgO)q5X9J`+M(qpzU76WBvS1p+iW2$JrLl)iHCkx^M#)h0oQvUD#)w zM{pRzfWGb_hym69gZ=#M)f;2-a{XavYYXAkV!_$hzXdxXCikz_0W%AIy~)GW9&Nx; z&UM1Z$cFz1B;Y5V1%B9l0oTUQccjPnvmc%Wm&#ZEKP3aqNdj>tAGxVKN8oZBxTApO z753A<8N)Q$8$87|b%m9XKx+6waM>UO`7d`{{g*)-3$Fo_=LwUN`O01AJ)h`^2zK0e z+j${npY88dku}Zed0hZ zDgOhw_&hZfLw`1Ikw#q}yS7ISBx08d6%&leIkJi7G&E8-9eR?D#r7J0Zj;;q>>T-A z*y+~|8veRCS-yQ&C!SYG5i2bj zh>jeNf5~=)N;q7BNv%H~2wO_a67X(4aYw5O;TzNJGJIJBQYY$5p0rBP6iYk;&`ece z6#CHZpwjz8H?=->oMzbgq(|==kn?@Fq0V=?D$OaKVFfq^ln4Yg=UIc=zf&5qg=;lI zzClQtSbiW>!+ZYT;{^7fEcY!V?Y|9!mLsxIB?~S7x8@#H$i&UWqWgC5 z8b;eeFpfal(xw}8*AAq9Ni&h0KV6D87>Rke0?CGuI>@lLz^VR=9S4aQ|_>c z4P2<3#^8~z@+#`UWqSL$9%sj#)c3N3O_K{0w=TQ-4HMUf`)=IJAlU&J_UGu*> z=#ak5G#U*xPDjpg2oY0Fvcj1g;_>yWrn6pYfD`b--)4Xaz80!|vCF=2Z>OK(m7uLc zoa1-Hl5;!;BIwX4?%21Z_tWzDT@T_0hKHhnm8e%E3G*Uk=KN%Z8EhlaFZLN&o)l#- zP|q?|+w00>u1ME53q)19zSmpLmI#zr`TN}qXg;f4Lq!Q#N>dmvJQHR6UFwrH#6y$s zOfVwzLnZxPluA^{rO7-GhSWEF3woIl+E|EB2S37JZWP-NgsQK$D@>KlYL?&mzuZg? zF?~%dcniU$tVC*fGg-cHm1{rM`ujd@^CQC+JN^%p9Snuz&Jm679)|vrUxn7iz6#M5 z%mkSC{&MNUh98U~|Fw6D^4!Q|FLf-~I|0QmmgLf9cDZl|-_l~HGv5V63#?`TzEjwu zQ!PfoGLFVoaQVr_{WUDLrOv-VzHt z6D(f3(3ik7->sMV8%%@_!W)kCDy%y`Hv|CK6+3 z99GGLd8exT$(+zK-hS0#F3E*yV+)Au4>27?NY{S%g12l@n}fE<^&xyN;uADNh&Cp*MDLR&f+(%7o6Er>>W?b}7wYZ2*3 zNN6-P^j9|u@J4u+<3S`lCQMx&k~^+Wn$f%(Q9^^l}C_c#&rp?F)@$Hzs7n954^yM!zX_%x13VND4B|H zihWxMSl#l~#)UnmS*!_sx*RJYFd&igPa#7-y9Loy1;cXwVz_8VwG-t2`k91Oe6HVV z)`956PA!rfh-x_Udb%HFvl)meHy;GL>IjVn<*dlYdgPqSW!(b<=VF5|b*`gBz*xj-+9HjEsPctwI5diTEd-be zkB5kOOY&NkGiwjxfq6Q4zQ01g1t~Rg@YT1zrz>Oqr=W~ZA=~VmV3%7tPO6Pus0G3I zgf}SXvtH?%Nn&nUuAq%q=A^$%S2T~SD@A2L)wvRzs~d%R_oDs?KOOO)#rrucW4--U z6V`@{q|nX()-b3*X?+eNsS$xouZ~iP4fZBS2oD76j21oU@{f&g)bO1~GCaO@aDeHU z5xirNVEXUIq14^AO$}mB9_* zd7w8}SwkgLee05Asxzxvyec+h@U3cEnDhp3M+k+tyq?@hal113Ux&?EgajzzIctRi z6y@$BgJNwMtg6iBs$Fw;wQ52lAJlVJX05nQ*A&*ljm6Nlf&Y!?*5*93g7Gmn0#wH{ zQhVFiG+7i5TnNC`-P<=eKK;e-d3ibm$fpv6{A!is1UpJzK?Zwlf7P}#wJI561BW_Z3>W36qu$bemTUU3_o?Xp;J;4_1S4&)1(Q!J zfc@<)&@SZVWdo- zxnus1HAZk_n=}b*q%8y5sahT|kaE28Xmyn9JopK=kJysJYiCi>sxNq;$wNU(b=N9K z(A#4w#17n5dEL*A28Z?yCnF+-mZ)*+J55aguFdk!&0?#H#d#ZZISpDLPyav|xcp|K z6gysBG*#ruXML8#Sj!-XqY2;8;Smr8M@lUQZKB<)GQ1x`_Xqjk;UOIxc^{vG~oArC@_q(Lijj?k^+5y>-29xcuyc?biS%$i{SqB-H1 zNL#Z&^;M1nveK_o*`V6RiH`86WH;!9-ELOB(bn07Z;rLXhtnL~9o{xfviPtk@=oUs z5A5_a&QK1b;SYz$VV#@KM-6`>EzSglL z*i)U~#Z=&D(~ka)FrTUtXCF%;4Ye;x{ZvWuu`qg9DNalV@`YtH$8vyio{TV|zfQbo zGImDTx3_iQALej9_|m)3sqyYB!NuL?tTC-T#)`x5y72kz{8n~NWABX<+z7)uOtEuo~ z{Sa|eA$hSl5pd1lb616r^*pjsZGv>Z{r2Bwt5(k8=j|!UyRr&D^461Hzl4Qo;%?AtQ1Fjg|Ey4z$3wG6)= z6VM6NF{lZSo=5tkVt~ieVjK4r^((e#1cQx^!$BBF`3_5HBS|L^Ed7&M&Qq-$WHoE) zI~lh1R5aWHk++tNT{^+}?&zZ=75mq;U<(XN!sH-DvCvL#91kE<0C=hvYNsG|;ZqQI zg<~M7reO?ne{Y{qJjor~EQ$Ay%UP(f=4h0y^8{5cNQO*17ZgMzoc^FKRsx1E|lKE;$yGwn zssQ{0IcmsgBBMw050BQQ?3+^9sM@JkK`l~H3GPh4Qy^u`G4F6>QFUUw?%>$Pq`LE&(fu zKmN2yL?NSXsj_jK>eET)=p||iL$O(Dv%SZe2*b&s|D0(HLg9%GVkT(IL}ncw_RD{r zoCz@k%U2&|N@vxa(9FrfZh)pTU6S=5-J^VL80vgL5NgZ&FGg-+-4cS7N}-*oq0w0q z9K};IR_WhAKwOv|pa+hOE&H{W*dp4*aUdZq1z+`y{f1mQ6W4FL3biB#k7_B)SXjMH zGmc~QsV{o`@g315i9KF5>f|&MxHrCiLs?l1%B5J!HlWOSbz1AD?3ZU9?f(l_aik`GopjhHIab;O}q0w zNLuR3IvHww@;Ml9Ld>oI&HbmpEEo;8J7bjOgg;lGl9H2#ExxjK9lGV)@H^p7lnNZ4 zrq@NHOEr)zojCwV)kT`-W^j8Si{3@Yzo~Yfwqg%mVkN?8#e)b071nqsaxFn|b6g5S z+yDO6^M#y@ScLS@;wwz28+!-O@XrV>a0=*7A6d%wO2!I_zK5rK1arrJS{?TEf(jOu zGc0CvAamR;$9X023`3$UEbW4ur^XRkh7-m8)_~j}K3|9y4u^}IjU-lT!jwH=ZnUe9 zvG`(yYr!!Nk)6AK6dPspvJSJ)uUM+pKR~(vR}GaJzP^d%kIUkh+o%FZ)zpZOH_4HG zfA@o5akBYa^(4;>g_EFnaZ*efEFBMi0fohAsm9?Pch zRpy|W5t+A2LU0(gFK>uCXR#TGL=6CB;tT<9G+uwLg=sL=I}pT2nI0&i(yJLDtj=x` zZI?aoviWjxN+zQ+q!qZ+7=)LsZ2!d=I5ly^(U;2kIVSBBZEd5OKgh=Q6lm_E|9}QJ z$_@QGv1f7!ySvQj4HkQ4;N;7Us(r^J$1TKx#9?dh+p!O zSMi1U2^EnE*>W+FlB{#bb98nQMZs-t5dkYL?R zJ8a|NrBrvBd2UpFyFU{U6zzpgm+NSqU+oY-b`2}}Xscn2o#KrLiS=>g8K`NYVohQq zWQ3iTgp)zDe<6gJdqCPaTy1PlH)uJs%gZ)mENb=G1N)gFA5{IVk)l=m)v?6FZBR%N z0D!hDF*!a`QNpgPX&fSF-n?)(ZA{p0a&$j0YPj&jCsh7*o%!|N09wg&M9DzOhdIe_ zo}J=(Yu?5aSGgt1xkds>=^@;IcL^cFc?)I}&hGk)i;=&SIm~5FhobLt94!PAz zUT`3XQ-ABB!s-T0L@dL@lXP8hsbVYb=K zWF=3p0ko;u4C_6vY1(z{$qj|c-8SjPIQ!?#DZ!1t!H9(KEp=YQN^^h1zlvR}qW&xx zPQ0-R$?;nzn^F&Dwz}rV8EyJG^WNF<BXP;wX;XW*Sbay|(a-`162Zro`n*E=jAnnxvil9lTRxDNqC>*?v6QthS@N8to6+{2AB!wyv^(! zcK&FKbuw7nXuv=96fbuoF_DC-9*?*D;sxL7?PMBaEm#j}#~KzH3AKXdeg!%hi+a<} zqg_3s8{kv;Sh=EPamt=aaKBLz)Ax716|Yew;s@mkP}t7RTI`6J99MzM|XT zKlf`iq4}>w$pi0WSFYNht-WJc-D|WsA}``LYGQJIujgmBf!w$W66n+84y|G`^ovbC ztH`K$?~{MR#=pFPD3iM|lRyk2y&8-f-Ld`fw;LWq>Ms&Laj5FE1V1EY3F;CZg8a65 z*M#6R>Qb97Lff=2J1+BM1mZ4k*K&G&2@b0_z zz;?p=0R@7D2NC@>isg1U(fIl91=*U7*@xu}Ye+rCP#E7XjRH=w{EpN^4h@Toe-)(xbk;F2v zN~fl_xi$84t7kGdb$CU{RuJIJG-8+Z;?Eqm76v~?l}%fsFh5+&Bis)*PhsdUqUILp zYuePjWh!SkXT%TH*>!9f=ZPmg?2u0%0z%m&me`NKKTCvaBP0vSE#9&$?fq(M3jQg} zM^Xo`eQ)vx%Gf5ihKHxOOI-DL5aeS_H$!mjsaRV>5csX}6r^cps2t@b;THAO2#{qe zkJ5F_r4i{F_2lEBICtc8W?uQs?oJ6-#(0YON%ACsd~?}151}hH*I#Kt$_*p8GScAV z$9nHffi<{`&I+~+c;>u))wn_n-#16Z1PAoo98gH(0g54&of8@9!2e3@o2PH60L6oB zMApggC>QChrD#mPL8ZdYXDNYSm?5+aWIsJHGm=jFxKXhHE%A%XYvAaEMEOz(zXDNm zcH0q3f!C|{hGQij;O!r7grgLu;b)g^1NL|q%?L|pSJJa5^%=KtEy_KD-Ut+!+>bAA z9{=H7ai?&IlKR14$p&UEj=V3|)Nv`<_KvlKc%fHVjt?SruHo3F!~N^~J0Rhm6Xd#^ zGK8c9xibA~;9)WYH4NbfHiucv$wKkXma5U>Ph?DQt|m`0fPvmtmMziqGdoUA17BTp}|i}kF_CphM`ytCadiF~g z@WaOyx;l7b<@BMSFqUH} zm}-GE?~gBMv>5&G7^@HO+H4T@G$}sq@fBQrE6*YMvZGW8&mI;degEO*^ry-@2b089 zZK+rM0THz~=*GQO@q2T z8}v8})%3@DAxb0!8Y8EqG9o_BIu&=nGh+2XtM9~Q%wSHgSAqaHSVs9LwtVl9R;b0C znK8+60yY47Pft2|^7N9LyWtK;vo*sjWEmAdczzP~{%fl`e#~vz`7Xxh)TGeKw+}qX z&kzN{+6j$m#$eMK9ZVdHBZ;s$8GEHgR5%&6*-(vvWEOaILUZJSEdB~ufF*pssjQ}& z?Dg>cKQF*lmuWW1YOk-lyqzizA#nDY`iShnIzAS>=LPKlUa`f_1-H<0YhaS-y{1jz ztgebIVyFoZ#1~K1&VX7wP8E0^ zO38|h;qSa7B&{6OgZhJC+OL$Qxc-RMJUZw>H*3eBRcJ-Wb{R*!v$hl#%^lq^$rlY# zG~Q)#1#jMg9s8-}Go6tCS)f6%%bP+TZr7uzAja z`h+J=$=f4QD}H)lJO_>;?+AgxO534CW%wuP#xwjC^ zX~$cQ89OTGm&ffpxxLrNpSDJ`;wN|VE8b2co-ayF@iozz&NGTFse?2?;%~$xh%d!t zC2_mfg?KUcSFY|$?`TNsl3ac&;Av7N8Xx@1a}r?o^-}y!NMKr=k9ZMG*C#fWKMAb4 z4?CpuZSp6jQ#F^5_I-ekBfQE!(P5#)`S!moraVH77xzY}g-5GU8;8zq*wjv5U=%i6W2E@Az+TX`|+t2ESJs4m)dU?Mp zDWA@NOTx)heBnj6p@^)1-1dB=sT7$#1kS3O`Q-;}tSVwX$6Z;83tunyj5vJm4i{Ya zCM@_jNh|9R=hb~=nkvxMzEgfp;k##psNmIX2B z@xzjs|CHLH1ok~$xk1Q9P>Hh{Sgb8N*QC(^G#NJzVlbW5_yskN;~MP^(s%o6LfaB? zRuNS~i3gOI1Tt)J5Gj%TmQmBTkb>4OQ2RbgEpm>dzawOxPx@)m%deH0K~)|~2ho{* zw4NMGf?_a`A)aY(_Zd|o6>_HgFb&k>e+DE3y#n7}oaC7y=i*e+$ zPj)3!A^62NK9T^5suhxp`Hgkqxb!i?%Y`mYC`o`S3ahq_^o>sQ0x!L4Q%LEJ#R^$S zRLOX1uR3}pVb$2T4?Z@;`5%ndWK^UawnknC_WfwFO`|k-sQ7Bbm_26w@=~v|rQK0m zM2qu~@mPA+frj65I_+MQ?e3Cb<1ZU;*DaNV^pR1&D{4i4lP?B+kC7%~)%f1|tBJ!* zljcp2kT3;+f6@T4Zz%FmkpWXWh1!;;GhkX$Bk_IWW)IS`ip>( z-!9pdLZnnV+A6E@fJ{EU;dkwDbt&RjV|lQIR3HD76Ox7UYm7jQ!C~`UYj>lBsgBDC zD6Y1h2>0nN_GPZ)X&t_SKI3vdGhHbgk2+tnQ0Q0if-Nm_A`{OS9wA9)scB)ZH*=$G z@yIJ{G{fLqt}_r_-|P~CZqhc;S@|v1E^8>2eB+kkbY0j66BZ)4(Ium0xunBL;mHZS z#qq$Uyz?mX*;^2tMh+BM`km~fzX=fFt*stt9zO$0I8H_d_?68K&*Fh^2~ZnfA&EAo z9zE8tEs4TuRy|N(CPXRYQ&_tB2Al(i?9*gNLBFe^IbITIr1H`5+}SUdIeBI1h}{T3 zpfb8?+{1+&e8&l2^*=*-U?~ywtiGS?Z}F0G=C6u&w9JY+$Jjx@cr)S`X`mr~?TG?N zut^3xh|{`+;EBo$(~WOIZ7$<9xFvH`ZzgK!UtT;9Rh9wqT9z7De+`!^Mz zum{LuP~z2Qkkw;k#qYLpK$-q~Z_FXX9QUa~%E%sx9_ERVMEZpzZ0P$lf<}db19EL- zA<>YRm7^ne1G3L87&?J;cv$tD3R{81GKNb{^=Q-Nnc5=rbi^sQ5r_laa_RfW_V~WH z=(p--WB!s@m5Hy_F$d`6v>1VL6I!ZFvgS}|%uS?4Mddsdttk%{;>|;dzOp<#s-6<= z*@AKmE;INu5Pd4xv7Vx69#2)3L*jLs3uN+ss>PU*o&V8zxp>d(h1kb8v#OX2&9n~c z%#f>Z7#>({7{v|-f&1o91AX4Pc(w%LSu(%Of9{Hx^vC>s_RFT1Sof=SFvWKdenAX9 zUvv-=JAM(Zf~DP?QW{qDT#I57SdjKc5yU4Dc!*whI6F@}y3L3h;3FMD!WOEhrHQsMS1nDpODpk4o>lLx^x<3V)QQ_OiiIP&bfXZEE2xgZB z-p4eJcK`Mw2=o5*^@@iR%&(VNVK|x#a%im5^ZwMW_?68RhW<$?*>{-x4I06?67@(_ z^tv|CZcTMGtw1>t84XP-h0J4aC(GBXfrDbPQ#_hO7Wn;I={0w% z{Z!L@CXifYo0ks?D^AwML=Z|BdLEcy+NKgaQ5gkZ~Y)tkhgc+QWSjg?N|2v zINxzUkZ3k2f%m|QI9Qzf2DT4B#sIRJ>nykANHLl=QU(x+7B3}Di{q1P_5J9;Ss;_0dx zqk+VSB&B%nU2cKyK|~VK92OJ5n1;1o@KaBC3yN-5$*8sz+VSmf&*kKkDloG4>e@+O zFhX%>KzT_`!^6jSB2f!eTGKR)Y98{E#4V+yy&;-qK=uruUUz`thXUP>9MjuQbvlde2-kfwBlDSfvYPGkqR~t*L;Vo$ z5Bh=Rlm5?}dD$lMcW)XqDj_b%`SM}k8&c&><@)>5kJqpt3m;t;tX4Z8;qPSC?E@;F zQ}F^_|84w0R7P4AuafcD*n-e*qpfcnqXluJ%^t?zh^B920`4Ly9$CRWHfQjZOkjQp z{rgL9tnUek<#3sFt4Q;SXpOMMTOa2Q9N?3qrq%>2JDB3xo9$BpBeKz;;9RG2JK#p@ zsxaO>-cj_Fhg-HwvHGV=WrsF2Ui)#P5oLGKANk6MX82@f)yi1nH68Eym8Pz%DKuJq z|C0DxGDxrVbn1$TD<^jvE}je>2GFNqsoe9PiEGp`Uw%(Yyxo@H523=p;glsjrjAUMsZzND3~SU6KV|PTwx-sF&3u z^2goD%~=(4!y!B+ucVVAOLBu{|L{8X6n*TceMD&D80_}Fb@B0uvdQ;BIrAP71?p5m z-2Z53a#8xGP5Eyio_t!-djVdb$Aji3xhV=%v^XFlH4<$O~QW? z(2MI;)ZeL4Kl)80u2qTgyurP&Vyxk$Q^6TN4HBjZR9A&4$o)eRttOFhS4#40?&H3S zB_B1keyvcsZMfS@RG_SsCvn;)BqU4kXhk~v?&cq)2G)?~3iKr1Yje=>riL8EbKK=CuIy|gSJN~_ z2>(Q(fh~R7ISyiI?%XY)i#as5ly>8ZHmML~B$~-Ait2*4X9`&;AnL7{GAoBwqB#8o{pG~J(RB4$&-f6hp0XBBti4P}#s z!VUGi_G3pqP{3RRV|5A6_0bl;7b#p-3=1<|w$KdUH3u@`**ZjHmZ1%gr688u$&6WA zDWfPaAA5F-XjI-5=V_ws2l{_2Isp2ZY+?f6}RnDe?wx#TX6$OG5wY zcIEhge+r&iA15~c85!ml6x`S2X|nxYBt{|_#`~oLgXD^)U@voFzM|7)J3sZDMpgyo zm)<8Od7=J|9)!ph3LG}KfrhmTKk9d6hP~qnT>?EH= zTT?mv%DT{b)m`+;0)MamrT_?92dG2Jp-}p;H%a@sl6A8#LGJmiqMfuTOZoi#z^rd* zr)DI#)6<-t7FQ9Af%-hA*wpiGlw^~hq`M(n#L^?l4V+o@Raz_6a5AchG;Zn_c`AmB z5S6AbyN+&H@u*on{{Rc*{Ya-*H#HZ`9nr%mg}^skbB~pFDOEoq%q*~YREi5H$)-pY z^F6zg4+>hY6I)x!vS+|K>`*?PJ|5!!G1Mrcb5<3|8m4fpPSaP1S>P$AGV~lE>*|`r zNcd0sFnkM-P)q{d?C*86ELuOC9gle?sA6d>>4|s%3hpC4nzs-uwRMXL5t?jMp@(pW zU<@;J7zTS|T5y2EL8q|rp2QpSATk3|P8Z=bF!hvvxn8kg3_zsz2NqA@Se=!6&`13FENNv7XLAkUHI` z?_>AP&KoIHYbi~amP;{CBm-9Y^yBbIeZHCvrj~KP8p=3$3mPgr4q}v*al?wB(j1bN zv?YZT$6>kI4{}h8h}!mO%}r_HzcLnWCHh%U#9(eIs)*WjHZ_sKN0uaUvK#V<#h6Y8PYbeR5)hcrz+v zA#9%h7G8GlYr;}WCIdi#veP410FUkJS^klzbI2HUrQw(_ik909@IatUV&-v6WNETf|O->yFc0}S2W&Cm!) z!%z~^4bqLokC3jRyOEMkK^j5nE|C)HEvxx;iC!lM}MO zu_ewus#rCu-GSk*RBDWdn(?#Q2866r#0@4FuP+X^OGMay31N%h$nES=M-|E43JA1SO)`n-uIVrm@pOIFV~zxFLi;Y$g0%=X28j%+`OP7;iuk zRXSI*P_(Y_Ez07%sorl@qQ%|rVRej0tFu_WV}pzRAn(ru!m1^QVxOHAn80Wh7hPx| zn7wSQgWFr{SczgmpB%dZr5)WyO~ukk8+w!=vcax(Lpx@!e8?SeThC*6uoBoWlgMkH zJq`1osar86S{XPNlA^XTA`SL(qvL?0l8Hk4PCsn5V?h=q#a$cFQC~pC?@C8t?n;Vn zQL}F&XrIr!3GkXzGM*T{qmphObV* z@|pkA2F?rg@A>L`sH9S^?nDN>SjeeN=X_|=g@wQ(gPgwxGu;z?qCXVNS z59_wiw})>pE2I+GfJcqU$y#R|AiJr*e*M~WcPG-yS^sAdpOmE22Q60nA#8X5rD}MX z0KG;oHC-R?KygAr#TJ_kaEa91zxg|I*>(lTe%#-DvB^5&>y3}QVYe|-r=?_2bGJz0 zl~(xJgx6!+geqd@`8kQ)kHX(%FXYwwfAmF2zpWIarv&aAPJYp8xflHEbjW$&XG~6u z&I5__Vb%vd(=)d&-a`4y%#DGS-t&2WEBk|K_$!`oRf9w&Su}eT7QW9MF{bU`{a8$t zl>OVpcq{t&cepl9U=J-n88YRgvXvEMQQ-p-nrwHZ+e(N;Y5fTu)D&E)OK{uSr7Sg* zKDRVN_9gTCk@<#}3LJgF^e$N^M1~Z9ONtI9-G3d(fGa% z(7`>d=srA)j{zpHD?#jql63!pE+mK4loK218=0u^ zis78!={Y6<;wsJOYF6KExvQb3`>)WHHa78lU{S{!&M^uIw`Ku81l$}m|^JQAr~=e7)VPA&`(TCuAZI|S8aW?!N2$o zevvDs7CHlJ$A6R^YjmEp&?rT|VW)rp@%|>jjb-db!L~zo^d{Mk5zkW(8m4h>jYaif zT%$Zv3dn z*C;R~%q>g>O=lmYa-(t&Dz!P(Pq11wH+j#S!GJZV8?t&5Z6yo(nHR?&za1VsidR}} zLT3X_eQjj0+2gj2nQa;fR*(aYi2VF3!vhof=!(bYZlj^h2Wmy^gU<@~;2{0<54Kth zJHDH7DUx2uDnS|qQ#$cqv*&-~ocLKpV2RNRFRRvHfD97s<9o$bbBj3D3VNRfoKnz> z9(W7(zU}4t-r1v)1%-)_=_ zksPO-Z3q21y7lt4w!!O&XI_lX#|s|=JOv$l^|XaB(0$-|!~#f(3O}TRPAIE|x_*_q zzE)Z542BLvyw$aAm)QC|OjzwuGQ zgYIVwVcsG1-V9(m5`wFSS2<MW$MB=G#Cp;t7ds?kx)KXueAFZyz~@wb2*y zD`|N_zy0tS5sV$NdBi#DR9wzE`6fnF0c<;whx(PGzb)kju}4| z2Da3?dUnd@6E?7@$*@>ya=#dSHRvLW`3Ss`#&jiY0T%l};(X}uU)bXVqJyALMoeMMGsHH= z->#dt0nS)UEzD;^806_w9r|TYds{uxAh$*?)6cIMnA3@}Sd5;jzB+&XNb|>A8C6&! zJEgaQPJ;&I3I9IYXyoT9GOn*qfDBr3HK6Zt%(v@K0*l47F*n$s-AuQ!l?@1_SS}z_ z7+L-DoPeS`Fd0uYZ3fnRL?(AUx1v8x19n}6GDC}%qp#E+?A}Fyu-^p^ zm!e-lroA^i9BTxB2rz?8QPN{33Iz?tFM^bntsM^Xka9f|J^b*s=!lBY-p4>*79IOh zT?1W)LxqY1%0aQOUH6J?EWUup%o!$0&Eb5nwZof)w?j_hvFKk)uavAka!n$_yC&M?bXe|>wUpE?;Yf^;hQUhDGCYGC zy&cXTz1`3~Q-x&Ub8u-T<#NiS8H_ICB@=F9Vjw4mt$fE@Y@BK?$U9RCCjrj$7P_Ka zg_q$F@8@mdKC&T<_1C zYA+WiO|xJc7Ozow=N#2B;u`3w>Y+zg=={c-TqJhZ6B$;PmByYHemb9W(IfSBKRODY6?Rcfh# zs_gD5FDXDtn5Wk65B&TYJnP5eJOo`&P$X_je5dhb?mtqpvPYX-k}16946wb{R2G82 z^RQY&ky0SQTrsGV_7`>MPc_I$3Gs*xrVp)yFMEjxMZW{M<}N`h!^-AJ-Ht9<*8**! z1C)vp`Y&sa&dCGkgr1;L2+F}^j{pzW#2fqLXu+cmW@Zxpeu`LQS1Wl~%)k1A%?2`` z)Wk#N=d0lRrhMZwq32)geQ1(r7gK({0z9`*r_VtT&E404=Z6y|A;zf)t(8`Krot8r z`pTwhL}UapY`b1^ zH0!$wT)zQ>K0OM2cVa^mgq}4=;euaB0d7sUU@dP#+VgW&a&@&~G7I|Ou3=#{V=PA9 zG(05LWqLBUPda6=MKc^m(iCE=4peO^cfJG!iR16&24HV_q9zn6qN++mT>%t|DOmdA ztH)k$uSwY9F^S1M;6Up&)O%Kf%7Fx4!tH^++3?*RIWSN9)68-;p4t6Jw2!xEHxD!5 z;O2?=GmER31{i4~e5?`6P;CM-2W%xEGz^)gJiJ=sA7bRj61hrh3YdLWa_A4#emLYN zm!l(34gA27m5TLTW9mIG!;L(M@ zm5&{}Dwo4UU1Q)KClL4hJh*7P8~0|W5pFM87^mGp>?)GQjT#nty}EphON9B=bV1{zkmG^-7uq@kJc5jaAo>B{237S%IoOn7x#Lc^#%eCEY97 z8!OXQ&ssZ9oJrjPum5K9V(Jj%qN_(fY?(Cf)r68~PjfmFb=b>KvlxNv4QV6c;_45; z)C%j-u^zo4Y}V zb@(h--3MaU@~XipfJx!YWgp@yzh=g*xFd*hQSxbt*k9iELbtu zy4s9a{SX5Na*xKQYpyM5CkvPfp;Q-%>sfKNT;aP>6mwe&j?$Qy?Q4h z4+YFCHkMh-@1^)quvO(5SA=yjSU!@BWgunM=RkU>{P;lv5+XB?TWW44Z_>;TNUgK| zw{e`R4eb2f9csc->vXDw@!Jp>aa$t%VA{|(lYH)wp#2#C5gz-1P=ew>FhlW@>S&5N zG2Hn@s5IZB{4J7gvu9Fyu|R7Siwg32%Cg8niH!S-kk2O-p2J?MRmhc-+i|br@NYb6 znX{x(0I+ela-`esVKLMN!fKA#0E~V-)ft9FMu6;!27f3&{-^$oh#~dpg={fXnKm%< z5Y7br$j=$Ab`+3rgjinp6owh*wr6n1uyXn@MTe_k?}>Q?y=A<1t2})QNi(0giyhSg zN!&|dCROgxCp-~d0tL`d0cc08I7N?0OMFnxfY5Qy8If016p{zFD|kk)Op2o@|!+{(P; z*pE!F6%DI&fUngKoIWi%PIw%3$B&ANWQ8jIyB+pg6iXJVW?{%D$2Qzzqo!c>Nfsj{ zVt&V$#eJ+;Fik(VD#ci&kIovDA7a@k`9~8ghxlxWVqs9m5Ckr)My?(Go0tC>TFW{W zN%g7c9EYA@Lf1>8;6-mlK~6&1YEl!Qm#VUo9L^fQXcQ;fTK*bwjXt|ZdPxmYTW!B^ zyhe47IsrwdCY}uRH`hoWaq}-bYu{Rv46uVTpF^LK{n{i1U=UqgwLViGdU>u)8t^%N zE;sfvFkWjl*T_K#!PMlC;k<6|qm>n%Eib2Qflcs0F2>40TiAvDaAX8R|d_`#sX#k!8|Jkq3{L_BcEh9G8jz~oK{J1 zZbiMc)OXG3Tm6@gJ%Kr`%d0O=S< z?AT(utzKc@v$Q#DhKu;Zz-l>!4gF1M_+-8sSnWjeQVsBYmz#H%8on=_db_5WxCDA% zU*Z&+l8k%QY#bI!v{2HPUa~TDAor}^CfxcOf_yVlWK0S6#U|x&T>S$b(Z%Dpvue$N z7*bRtn@UJGCKw_e%@QXy(Z3NHO>$*U687S~RF6Mo*akAR3mLNF|5f91--0b1-64D2EF^fL8iWB&OH8Yg z(NaW9EJXoU>%3z>kiH!}3^KP(xXC1x8!*Q}}j1c4v_;pztoM;Ud2~~%Ke(i*o zj62jYpp}C|il2BB3IF7-2>;={s*P8YaWo=A<&-SUnqqTJ0pqw<+z6==65>_9qk_pw?M?(EdGb8kZVV#|(La7*gH`L%jN15B4-l+vDJ8p`dM{GySJ;m_fAHz_wkp zt()LyKwvzduisMM_Mk~_(7=l6dhQlmpO+g;B}&%2nH!S$iyns)0+AP(6P5I1(NUFQ z>N%d_WH*wT^4nIl_iU2)i<4U|5_xkHPeNZHVRh>Mn+^fLYr=Yk+&=w>j{0xR6!G7w z-+cQ&t1V!Mk@j5bzO~?9qytE=qJhMpA1-{Z7wv#eX2=0YRcao_`1OKdrUSS##=d29=<3jNgu?D-4@;X)m!%Fn`?>5BH#l$2-CB(D;Td z;F=jDaa3k^-}Eiwr8Re=g-NxPB3$+x7OVMG`OAG#12h>R)mL+Ch)en4SR?3zh0m6( zKEUDSkVHMw80O!XXlB@!irQ>=bW8Dqi2OB3>Ypwmm_9Al9)3*jMOlTz-Z{sm>t1@A z`0Gyb#^aHtl)_4h>~n@l*|9!385jM484n~p3@|B8;UZ5=PIex=g0UYkIfUBGjl^Nq zL#}}%i76(f9M;HrwIK!5V6|3?uRY~cCD^m06i|)x&HvB9SPRDy50xyE=CEqud_e{y z_MCM_I08aR$1QNdTQ$s+#^8#ag@O1lch9T2e) zO)?ou)xilSX)*|a-PW7d1 zJV{J;8eD9l2FTkXJ}eWV`uE-=Rk2WM_}m?0aMmkHP>g)v_Z(qE^;!?j-b~!>+kg5a z9ycl}=x56K`cq8HIu$O$yLj!EZM#n=xuV8O`R@1yOvqomJ*= z9IMXD*CPveeOILFUCFG!JI4};@PPki$et<*TkjJRw-iNT-$YM%ma6V;s4tbm(_Oke zDhwhPk7&{nBt)@YX*B>a9CTMK;+A&CEw+I>Llj~~m6QGf0qB;XWV* zFqG$kWMAWy`}8sc7>3W>P}rT&JkA{;NDXd7waleZZmoS z#f5<1MP-CVmd$3hU}4icJ1h9D7~cGiZyaK2W}GVxi(rG+FAD;fCAtqJuT~3@Phm)u ziJwu4aF@S$3&a>xM>uBxa00Ag=|chOx9H5&_W_uA?3WUT(@ERWHu?DS=o1rj0xYd$ zHAoDSrAJJ3Wv^0+J~}ooOGhJU*VJqaqg;b#Ze80-B^$Yj@-*(b95L0u!IW@xoE<^j$#B%hz6D|i{&dI1BLAI z2$%PE#%iQP2$ntw4Q)NGV%9xK%)V1+f_&-Lltx_TaK8F-PmwdK=0H*6Vg$fls?B}2 z+7@IAN7o8#Jb2{woXYQ_(ZK zk87&t%t{RLGgx3cRfg~o835Yivj1-YVP6M zk}<@KW-gN(&De2~0!9;C`=z(XZ8&>-c0?(C8^^-qXN#jGQz`-Pm=qL}`QvOU@A5}T z=Oj~F^O(?oz>7}(u&N)_Eg8C%nSo|#BvfQ7MOm){U?t)TSEE2LZ#?8B@6_w?-UzGE z&-%1t8v`jw4$hW0JS?Mcos&y1+vCuT>`SEY+d$jA|0r-Wqb4m%p+9-_!d2jWxH95b z!f7*+GackpRoU4_l7}9F%-?EJUI>byUVf0LN*K*I(yt?;ZU84bEl=RA2CC+iPI9px8Z@LtoRZ5Vr;Dv z??Lg*K!H*b!_u2^!aU7TxG(QwrSYe?34#Tzxo;r1fsq!_@8P*B7myOci3uSMt^B`e zQlEISI^IMwriB-6J@sU7k^m^D1BJHNop^ua4-qJFF&hA(A)0=6b$q28j(Bl1f%a?2 zbdF5HKFqrj9CjZl)zha{(71y$Eq3_up}>k-M8O9^B-6t?k`rDkn!niFduHgEV^>{8 z{Is@yuN3ff5ghsa7<|ulbmNcPHOw~-`?m7VsUGXco_$W_+|&>JD*MU(E$xMh|R z%KtimTaiCFsfbyI$mgisA-0PaFY@PlWKook09vkDZi%Bd7{%V1A}s28BjJJ4s8t2 zi%-70b~3UyeC0x?IbdfV3oecB_diPReH-LB{h2FW3))(sexVXBtCvCf8eZ++f`s(< zRR;oP&!4l6=)ixdPt90pb3aDjF)Q1$;c_e5Y3mgPN5q_snSKWb)U*7joni(1|%j5}%H8k)5|PVy#4r;FY!xo(MWj{bv^W zcYS3UGH?y4Y5QufVxTVNp8F>B?ox$%bkqQoLrv~m#Hv<$s>T*k84(-G*DNfrs8|LD z{J<^3f*#zb4YR@BUFNQ{2%g*f=OWs_xMvqq&lf@JrCC{u_~e&j|G05wI}v7ju9V`u z9yw)q?wrgB=)7jM&76iqpNmLj!Izz{q?@NRSJaMNK^H>77oSnrTmJL;hnOP@f|fGR zz3e9gPyN>no)3dBzY7WY-#Y-k3J2PM*S_esCn$V%{&LI{w0wH=&yEY)Q3!&7D%)IA zQGf}Pl5D2FsV@qEpi|`gpNN2Z#(25|UUPqSUQbtbOgKDrTxs_v9Wto?MEtp_WxL;x zDvj%QD#@Tm`I0&$EK)t1oA4c#0?>ife;zHM%IkKHCPSyH1)Q_RY-eb}6+x~q^Gw#Q z$WSMAS*OZR(RO?%su~tPnU+NB8ZDVOv-3@2F4c+=XTRT4S%%D!sa*8QtLb65x+%eW zGkQyZB^WegAV!fe&3G!mH}gDkb3mxJ`GKkuxLiKl^4RqDNpHFC4tsMBs>Ifd_1^6c2g;h+G-UZ_l%SKt@H8 z;2WZ|t*sBZKwj-!Co8SUj)E^|F-+D=YAG4;b(pDR%LcsK6{r+OUa%M9ZbwJyi?K1g z1?fpUhB@S>Fya3Nny~QMG>(oL@1h2@4&q%Sp`B#9R zOnO=s$;=?F1!kWQ!ARR-5iaOcv#3!m8Nu6?A?&E`c2g((*c|fhT&DRh&bP zrVtkp66$QzL`F;jrqD!HRm# z814zM#`ueh-_*%%lI4Bh-#A&+*N4_0jxKI(1tio`n%BtX4B@Tt)Iid8O#^=&@tG8v zz;mfcnMVF>)i{ag54rWtUWL5atE4zO_S}od7E`|rGx+J6Eb+mP#J?>qqp-I^+YJOl`fR{y>;2CF-a(#VN#3iwet95k#tIh zu+*DvSEoYqQupg;EhYEH29n_%r?;}ibcq0Bosguxbeg^Jk!kJxJ2Q>hv4#*A5HoCG zDPDh?qEliZk{>$Misw|zMRhy*F0mVBi{aH)_YTLBoipaXF3cd}o&@p1S*t)o=#|!)D8p%`j z1Zx5x9S~hRz8H>FYgd;hm;KR?UA?wVeS?F{U~DWcjibmRmv!^bs_C0cF(wF!ZjA3s z;0;K4xz-^O1_UlInojQ*thr;UFw0z>fJ5_Df+c;j{oqapmJA5EK`)w!(=Ujwn4%S} zZR5IV8TtO}ma-ht+VPF$d|fY<{G$2LzqE45t10$WRhMKZzxQ5USC{HT8n05aPIgl> zux@IoTOUS#BYaAg$~5R?>*M8|H53DNGU}yFigoTvV2w~I+ltQN@P~EV9pBNkodIIS{ z;1Ls*>GOH^*oRcPtf?|iQx|sZmBlDxamx6A5)!O+-_mjXF+J%Fy8s3-DO@du#(Nto zGPU@uHqYXe3|ScP*GND6P(AovlwqRXVyD?V{V)Hh{0JdR?g+|71b*9YnMip9shgBH z?5RhlfXNHuL9yWCX(&kq$6<3?-dJ$yNw{w(s(;>7M%2Ucu6Ot@_UtAHuGgaBP&=5Prlq0O~quM z+!j!E;8BPC??98fwvvjJy4#i-0&;o(Z5|w?TKysb>`b|6bQxupZRj4*ma9uVE2-u7 z-Q?BW>IK!Qoyk1eFg~ya-ABB*)^VlPBe9s1mls}O11r_pPXab2%jJ}^eR|Q=ziFx| zku#`BY-FdESX(dmidNyLr>YCqOnf6-;esaJ_ZthclGs2B1r`E(tbX`KlJiak9-rQ~ z9y(2Qu@5RK5BUx4(LX4ZqxYc%i06$`B4g|kPc`rZje#=|HQiQ>{MN|%#3^z%3#4yt z3@w`$3u`$*G(Z(KCq|;Bwv!l-I$bkC%6=i-`k~ype%0w~mzI4FY8(pwfh~W*9P?DG zGAv@;mT>+EZx6l`hJi~X4vc8dw)u?Yl!-?{^m=r{$lP!JXaxvs#MACe#aoXJr$j56 zu24e96kMx+C=W_PJEEpS8B98mS4IsPeg-r{O@6{^!xYdY|c0L3POiRXGAMHu}IB(@;XH5OX> z)76CL@}eoP388RMnstiiS=R<;&_SIh0~uvDVi-Fq`s&}Zj3 zV6V#Ix%YEP@a6g@&5*O<;Dvq`%oYtp4~@ee>ZVKE~D~AlROk6w$nM zwkPp}bGI$_M18*rLW+zg8D%h>lK=DOE^qyg>tV5A)zay|y|2WY!TQ4vxxw{MSwue{9qj=xfW*?#W#IUgk5?yl402)J%47_5-If(86jnSe9Z ze&v_&&nEE}onn1)h;9csnZbvLfR zNO4P{E)^)%SU(IH6F;7F$_E!0GiK%W4LIK#o0v#RKllW=h3r}?$>5DSB6A#2pZTn-FQsMs{7JkM5)GT9a z-Ehaz97}Qm(a|6g=!r#D9|s~7)9=#B^O@3Tb66p#4#*CzkF<; z{yXPCoKO)OLW{&OOTm)YQOkXmfmlsv8~DO84|G#M{d zksw4E30UYt=o$lD=p-(;|yZN zjDW=#sjYzaK0iZb;mRGMWx>C-XyJW;B`9Z~eNM4yqJacX)jge2!KgG}UlO2}zVF+1 z>g*|rb99<}JrPy<5x^79MQAymI^OyJQ-`(~e z;z8yUqnAj$X}z;9N#lMYk45su6(6y@CV;9D4ySoR0=?4CY}p1v=@ji2$9x-Lh6h9t z9I$}(eItknP@18d9L1>wH@CL|X9l7oi}Kryk2Viw?>C`I528VYyosbV#kWQxrGx2a zi8q>r8boj{D^6e}T0B~H<0EX@YFx+}2hCEAgbI~lT_yFyD?W!f6eoF_|J? z6iEVBS_B5l&0nop6AQm|W}>vOssG3U6o+Jg3lApUuNO2x1h{btIbV@!`8YN&-9E6U z3Q1pIOrS49tV610XLZS6LuiQA zGO)C|<7r6NX^vxO5#3((vrNWYCKa;tfRik{u^9BgD!ZODi)+aqBW5F}p%!iSOpIXZ^n|Uq=f=`f4J>X-rs(J@sUJ zZ|H}o-@kodCiW_!z|x>k+U5KrF2Z}lf1?m+JmO-=crak=2!kvG9_b9U4+S2#;?3q2 zG6CtaA5s*3mod@P8!B!w=m641;v4brwN|5?Bmq>*oDNE)MQl%m)vo=w0l3{N;kUUo z%ydSXT;-B2iKFI}_%XX%SG9tLYth^fpY;s5GqZlhP}5VT|8V-Gb|b^8B(9DwX%mke z(q@?R%F|N=U(9P5X+J>m;+2FOO3DsY(X&$bS(V2 zWvw(J_xkX6J0z38#*+!3jqPLn78V0yWFtN~q(?>0@a(RR@>S#I2^t7#*h z(j_LmYV8m!ptPN>^TJ`+AhvT_t8Y3pMozD6gh6t*DOrVxaDuu6`7iWgrT`P&N0BMi zvS;o2>1G=sPx|M(u5~*e?k2Yn{$R|A%ioAW&wPubZW47bk2VIGC_zMlTcgac9TVJ& zp}?OtRAY+1rg>3msY^hCp$ucNp%Ng|n{Rx-Ne1Va zD={6UFi;@)MlfUJOQ2BNL+i44?-rF85}1_;u^!b*^dPp{IpU4`XR zm0VRYgOfmi2tO8-RxGqLO&kCBCf>@6L6to0>Mb!fNjOuogs?(*TjUlTN+v;*WWSuT zeUKr?twKN~AM*GFKQz=$%X!1`&V<&40dIdepdkGRaHl)uY&|@1i{s@HAy11#Cwity)P?&|c;8^KsY7ZDg>ehphzMlWy>5&g;hHL#DblIkFU!Zm5dR_dp<^Y0 z8t6bmsxfS87qoH@ylm#7fOmS+JRGY9jym zDv}8tO(f)qFG{GyoPxL}7@ntQIO#)%a>JFC;7o3-*z?_{T#FI|a(@)bECRK)dX+J2 ze)A(cu-Y)BZcE~qf zht2M!e>1MW(}#)wh6C>aiv53q1fXN#h7X*PXImO?jR4w0yU{=$mp_KLMVaZ6OG8{E z*i?#}hG0+846m_M0su<1M$=E;HZ+Dj8ayL@U8f&K_#qri3<~+0+gl5t4QevJ`aEPcaaSrW zXC>wc$S?r+dX;7So2bT8+wh%N&KhnJ!Sl)oTQkS{fItaD#}Jj z9x`Lxh=$Zu=c%N0@(QL>02%-TLoY7C<(%~!l+WDyt`Y_Gel2xa7wTBOeD^$(m_{*j zA?y+K5}#`Art1btC1^j2kKKq4^6~>QK@iEBKR_#rPfmMME6{3`+pkX-M7_cXtJ-Dl zWg{{}DeTv8e+e1l8@$5vBV$qYWdHdomFy;N5J@Sghe9jS+BZbJ4b$Y(frarE4SC(7rC^#nXcOjJl9iNaK)KUv7#}VqDm#pubI(u+ScT8L?rD z`xqb3j*E*cJn+gFv@2^R!iEA$-sOBYMSzXFXsB+x&TN*Wr*6i6L{j&ky!P-BWOcJs;Cy@vvZO~uBJ6C_C;93JKT3N z36qD1$bt!kvBO_ITK)l7tF;@s{hRQCirr#cM~?(QP5RkO|llLD#A!Zv-pmaWbd)ElE1ZYjA}uVWLjGd=|ldgMBq87J50 zH4#|mf8zZ@R+oXpg>O*7xai<9c54{%#Fs;ReGH9@i<3JF8Rf+Eto5IVj6V?39-;)b zNCp!LjCK-q;zE029$-VBdC!eA6Y>ETNcU6^j87u{hMzV|L&AogAr)shdx_h=XM$E3v z#&pRr@cLz=l<-u33|z}MHAtXJ`5C#i@s4z|D84GSGNNjt`4JDJr1qem%_)Z0+C=gs zQVL2T3Z(M}Kbgzj`kof(CsWgi`FiM{qpfD>C;4;pYIqw}{gyxDt@Rm%Y&XOmRL;|y z7IQ{F08K+AaRix}{(9+2S+k^;oDTU2xG0D9^56rsc&-cf|0CFn3*DjCSJZa2yVK=)eD?>mjQEs zTkYPo7WTrSze!i7gi`=^J`=ttNBllA&L$$F&eg3oOb{n$mAu@o^jFsf(J=wVE=;iD zed@n%23PaSZ}ITLSqz!vx89wm#oQi8NzRZoOfL-(9(7;%zfCL%X zt?t4JfA8uH4oFf~SDI##`<}vAA^bW_bj=l~4J1HEl_Ja_GMySLd~^u5znZY1QsB&Z zu=U4vr24^7a_Wyf1=UoY!*7*+5tEt;@ljvr0lChJavorS7|`j)M}7roM2>H8r9fcE*pzMbryl~FHXBS3?`z)#Us>((zjBH9cZzfXzyb$Jvm>Zm}qk#^&(z@T8 z_Qx#njuUp2tel9CvC)K|DhYo=`{V#)=9t3{bETrpw0GC7C&^c04KZeTzjG*=hwgBi z>e`evsp&vGnzDIBqsXT`x?gTtBX*prC6|e8$2Ca3D`%UtM?RD)Lz|CS;Cx+l9P^!G zMKivE*DvzVyHny%X0k_WUunU{=~~hlerZf^Ji_^#Zumc!xAJg~_nw_ZeE+jS@vAx{ zIrYXhXH4p$|FnPD>@V%v-DG#X)Loj?An&`<@XS=n*BsUkAp)w?0$jntgQpsyadDVT z4zX2LZl0bfrxFL_6uP>|bW!nzT_^W6-V>92s)RWA$ln?V0NxfTj__)afuwGqNAFsO zERv}(wziO2O|@_xw4v&N+E5PKhOS)DY6zK%5~l>7%ZT=uNQTG&!P8Rq*ktFPYlG5t z4H3nC*aKUS#UaVAGq!Hp&I@3R2&w=(ek5wTwUjx(KH+$9f>P&FFjYYJofY=)%k zO64+MARYHE{_+tvZ#6Dv+dm?ZWF5lB=*3slA*|DTP4+Ln@w$MA8E7RfHU)kJPh_~M zU3Xrdv_+29%>-w?+aVDE^6R>vP)}BaW9LLqMQBdT)7~R~s1w)<4o^f(Vn8DCx~=0Q zwmJtzF;B%s9N3V?Ydk<=now}SEpzj@tqI-1jWA9Ul2(->cmi?mB9;M@_pgZvz{*jK90C%^N zsj`5xW7$r|QdLUCNrhZWzJ&n=>Qi~eZ; zsbd7YXJ9!l+?LK1V99`K=Pf4Pc)%Uk6Vm4ov=!Mg=m;$etv1D@kw5YI5p;dQbn(K6 zA7APcY4YO`4q5aGsEu5R6NJPu?D^A|z%8gM$T+M!c73a(t;Zihllm0Kgk?mE#n6yd zq0+5=Vz1N&oTfahQsq>pteTK_A-wdKb<6|m$&^5Qj7TeE_#TkDd*IlQ!U=wAmKttf ze-v`PIa&2F>z5?@iz9>a(D!_s1hg##0qtr8r*}m+ef1@p!pQzW(etS|3(F5V3rGOd zVsbx4nlZ>g_P=xwoTy)jf6)A3!P9R5aKGu>=YG1(Fh5%*pX{FPK0Br(6MugBFyXzj z@3M{WGJJg7MMjUbiD`C=L?iBlw~8hCCnf2jS?c+HT>uJC$JxK{A|`>>#ecHuR^O87 z->(Fb-#_92zN080O4g81sh7%kX6S7FVaGj}Kr7jZ_d7=G3Br0YAfto=g${B!5*~sCWJmSIyuE_GTfpee{SW`GZqQ zU0q!Y6O2RnBdl}L>1=;m7AU&jwj0xRUm$niVBVdZro z8uM!?{n`Gel@HyoX^arXZ)a;I&PFOT;Z?PTrLiLMV}mbJ`98XFY7qH;mQxWqD5~WE zfCAvL@1~vOWKp3V*6(k8dJRH|PfoR153XJz{|%|`oBZMkY=o&|Uu^SD065<`6vF~r z-&l(**PvH-OE;%^^qLf%)G6iU#CKmct@)b@{_x>TC@$0w@FrwD~`|qLJW;YJcdY!f|%cRF}LD8TAY4qUCG&b2UyehhJpTZdiQC`cp83=uIN8h#)_>lI$oQ>B1T~ z@PliRPTED-guLT>a08c@14wqejW7^X=TC?(8_UR z)N_Z-f8rG_j5x@wTKQBRUyXWg8D?xx52B=u+J^nxYb5en8Q^Fe7F{&-QE1FgM*2R? zNBh2Gfs5y4bL2V@qmB`0aXoa^3yW9<}Y+{=T+<}Ht4mr*Ow~^ zgWGW&0NHzgb869U+B=}4uSX6jy~ZIY&bAzRYzGeTO3sqx7SD$k@9OmONm$(%jTB>^7ngFuWe_1Rpa3*ji;_g z0B$tYx65Q$kVlnprL(E*o)M+G?7i;jSzfe`my>92)=W3I|coJShpFmjO_VMbi`NT6;@y6Q9 zgC6GdxI`)Cx=fj>7x5}~WPY)>48<>M(CE7*Ebfm!{4@Eg%i|_`mDkFD%xAVKK~b&ii}!-p~GmUpU?Ulta`kL?C_FsbHb* zu1a@o`vvelm4C}HCVZ4k^cz7#3X&FOWBPnrF8_xnQ zp}3>e&Ma2WFm=C`n*b{$;qaIaC<~dwBYIUJQZ=!bPN~fn#jF{%_3TsFPg-2oKU5Qj zjffY%o$}c%%D^Hx*twXjrGj%BhQnR`9{8$9eVg+atVA^J={7vjhxwi{*Gh%njvP+> zsinqHbr{KIkTE}53`~^*{N$g+NTpD)CDnmvCHLMef#6PJ_NAQR=F7E5q1-y69+#8j z74Uwp!vp@Bz==d_9M!YRub&o}{m2Hv-4yS6Y6l5^bqyD!0NHQNsNtIl1A3=Ygt7la ztZ>a@?u=I&(oIdgZONwSW~z;KYw-F)HZL+C3u|*~(l8Ug<)KwxdfPU*7u8&&7In}_ zQ~|J<>)x^0w8C(T-H|JUWpPAWl%(nB%mYFE;|{L0*+$}@&p#}%NZ(u-C2fu2?6lNW z5`09Mo<^+@dx_r?~BW+e2ekJsmCz~l>3?T%mjy>Q!YgzymExrG!O_>p7#Ig!ZJ5&%n7Bx*3MGsbM(Hb113^kmf8)cG*7NHGo6xh76&s8SoEKHd3?b46paDt_ZI zp+uJyG03|RI{2MJ;jJKxi$*T-KZ|<+Olf1I;If=W<_r@-b349vjdMTv?miD9v+n=+ z>hXp5yO4OF(xjxTqEnhyvpRe^GV`|~eyFp&hYQ^kQrjsh8#^DRJPu4xCHOPnJxLyS zK6QEhx1o}})_>}K2{5RB+5Z3N6i9Wt!{aaVxVR^I)uPCIUGnOd$@kbbuaBd;JqSRH zJj0{uhlc>IsIO3;tAdU;+5P+!adelP0vR**NIR!#L6WG6&Hv7Bx>Rd7g@@XU z_W9evfyAok7F1Zs7O=9#Z}D*6c7|(Xu7J=U%`BEFT~0E)Pov{o|Q$bG&pXHs~gV6X>3RD@ZLIep7pxS)h}>S3e_Ms-2m z1I&?EWvWV(jp-oJ`~HZ1?(SH~8==H6r)*gQFs&f%Fecs$Eugs=`K@~V7Fky4#YEy4 z`r=~dXI!VC9SXPE%6`To-?49*}aOgDVp3Ub^f1Ct5o(wCT;SC_viOD&LOkou` z9qrR}{URq{9O2(PhT|29p~nS)fT1t+rr2m}p@B7u>XLrwacbS$LmIdv&k@I|4FO`@ zY~A4HF__HWStCV1s{P~8DqlgH_XrR0`A31MONv5ofZvlU3m4es0C?Fx z-V0v6I4|ZMBQ2|DpU$2>g%_tFU?;gXD8$9szzs3`c`4B#1j%>Uu*>8tV@t_i@942; zS^r>G%1RD$lmd9_fGnlR=Ir%#YnZ@$ezMUXn3^K%k1+2(1Ov|zSX0$5QP&zLBR_aL z@Wn9P`T+>82(N>{d}l9*b@3X*Y9L$!v~~QB%GNA~z^OzX=2gH2;*AWig4v4K8iFB9X2lSCn1k9$YbPddY4Ak-vS54#e8 zRtFB+2$PRw;TX}a^k_{`r}tVf0K$Blp+ksGrP(_%`X9i1mWhpHzHd=xGd7$Q)r^eZ zZESGeL}M*>e7lo&`uzvpejBeS1iSH3l~$T{3=S)roH8VG3Y72O_zg?392kZ~?#B=j z2?PsAlt8JI{%+9m;v3-1GtQcdSi-^1PewsG!U$rpz@{-VX3)aaGpTb$#9Pi3u)D(4 zRN@q{S^=@&!XI8Z%x`?cMp5|7+cqcP&im)Qh^U-0IoI%ms!c^e4Y4r2Ld;jiWFnx{ znJl>KpvK?_swCfrS?(TqpUhq{@f*7>8}UvX*2rEX@}Q=!zFykJ)fg4hb%Gl0L`9%< z0u_Eh@K#$;A@ZfH*zFfqSp+dJ2R7^VIFGy$%+7 zw3kd`d+W0!Q7_pBgboQqh_F>z_*^O5ag%Pv4G?Q|Osk-i;#MRY!|;(7a53sv7m$b? zXy4JG3@lxEGBlx%ZI<*oW%J$tot{d#GIMbQYe-< z?dN=(bP(RR6%8m}pnFbi!tfy1P@5!$-b5s2<%=HqyghX?^5p7Xo0;77I?Kfoz_o7? zvZk;$(5FtgPH4+4i;5h^M+D_pXV_iL=fp&>79VtGtWm*K%-~!2_0GUV;F^tz5#^=u z(WC~d;e^&lVZT5WQNy;DzJ}t%20%d^(SyPnh^QnPHl49OD;a` zR!Y*|rTpu<_W!&9q4jR_?g*EVXMe z2#X{4jd-z*@&jHG?`PL5>J9SRY11R-T09o9l!}~&gKw!TOL6(sbt$n}Q)SpfqoY+S z^+)%O&A!A6+UM@6229egQ_STss+r%?Xk!AN|MoozsgSMO0s-Yh%UH&e5Z$PQG)*3_ zxL}{U$4v}^YJ3Pb7fW{R##s#SMww zW`?>JuY(uK=}S09?9o>Ib8KT!T0SrzW($uu?Bbz_a3zdVUuwxXD#oSy{yO~bR_{O* zxEwn3=yTp>Xusu0ZNV9GIxRBM^PJ=NI0in!E^2n!*Ll7(6wm;VS3g+QXh>rkt>B~8 z7*Ql%*VO>eCaK?sKQick#{aepI%$^^+BdQja`!iwvjw1Z$ItDGWeoCx*q%tk3JCu@_XF#ryoLZ({KQE-YWI1UZDsq2WyWP+JtHW zw(uDucRd9KkmYMnJkF0Qfc2{sI=TsDl72QuGlr!I^q>?#tqfU&4`qT)e3BSXm+wIV zW7f^>tuf?D)`t8&baL}rzI|`L7MDuwA@;Df@d1R-99$LX*x@Wqm6;EJElI2pEq596 zM*LrLoal%#G{I?58uQ!cxZqA>9HF5D=5zdK|HM5-=u{&$ptu0va>6fJ2IQ~r*D2^wuh&F^EOYVeigHLHMlPtmiK|HUiXZx-?x~b zcL-K^3)r!A<>JJr_lHC}byj#0;R#b9>=WPlMEcJM-gQ&kEHaqlF7$LZs4jRT=R`7` z)0aR7vTQ$&x9dCV!6iZ41AfvL{&!f<#*~E+VV&yM<{Lb`I+HHfMtP@@gynv$0L?V! z)8%1I)L1zaXID+Lrhn!*x@m$B^L|&Phh6->4b8Zw|Y7ZVL@Ypa`{#4S{j2C#&qY}Q^Y?jzf(+kenLZnvAK#t{Co zohgs}&`3$&Ee(#@8jF>UKR?0@67Vl?Q3tK<%;t76ly9m`_`e03FxVQXcP7``e9+kf z9%@5V_a}}^I5_}les`9^Rg@5ij(Sd{l->n*IL%*3 zQnqY2yHgz==`yU0bIUv%*&jQery8Gsvn`kCXHRSaCwPh?93S+u%{v|_+ndV*G{OLF zOtmHaayq8bS6_y$^Ep}nup&5sw3S zZ2<5w8R(ak0o;n*zoiw!Y{sDk`^F#sj2BynvD-lQEf>_a zlartMj69~O53tb@(t#s>iyWBPhXNy@32o*t5n$ruoiN}Wrk2JGT*=M-F!MM2RV6Pr zA&EPNr*TmD zPc%+J#NB1}XgN~EIV?6&Aci~ZOaT+A?sW1<^#wGJNN)KwrFM)Vwi31$u2U7FwN%g_ z5D~^swk%~~Ps1QD?&%jBrl(}DS)_{wRZ#v3XThai&PVO;2^wgTQH{26_RPNN^j@hF z!MtcxDP+3jxjjx#%c3$98F~~Z*l^kCGng4|r%F&L$WdDf+^5bWyxVDGq3DU1<8gMM zSBz0?DU7UyZ;dgzBR-n0Dt%sD#g2XhER69jrGs9g27s3X=kdvc7d2s_t}MiVF!o)h z$JH>ASaHh5QPL3WLF@a?2nCntbp5L_=XHa~QJt>2*4IlwtL?gt)J6SupVU1HKo);Q z`rAgGQ=1dZ{a#N`F2AF~UYp8>Ev7`&p~Dn_jw#f{IgAqK^g1y{K1(QJt5YpH5RI7$ zp`S!Tic!VJkX`~*QfL1LbwVwl7Gn#lq2`a(bN1<8rOgS9&kczZ(`9VlN8x|^jj5E$ zugFzE=(3ldemZq2(NS*%eNJ%FGM5?g18ux%pfJu}nNCe}Tv+~Dd}|f{G77-f;3vZ0 zT56QQM_k(gTeU%MT%{zskr6G1t%yECUe$FLk>>HlnB-Ens;Vk2J>qYL5s56tKgv8> z*i~GN*DF1v0yc()pi_XT=LiR2Ru3e87Ya`d*bFVR(~rZ8m#U1K+5-ZX5f|XK$T>l6 z?eOL*P1?{8&-tKYtsfCi+4f-l%5#1!`^Ap!LGP^_PBbw5*CI|pWbUDrldD=LP7Vh@ zvkzI^C|E0&aIy*H#`b%{O=zz-eX}I4oD3ba5;T$j z7pJ(uiAl^jk?%1&Na(W1fm2+87@a@r*->ndo)(8ueQHX2&|M5RpBTFCoU>H~9}9AO zse42OG;D=kkdD(ua?d9~saqs0aV~8t3v7jjkIVmvaKS)KK$f7W)n7Ccgk+Wr!#BU` zI>U54Nz|wOw6?t%>3Tyube$q6Yjsrz^I}8S7si~rWa5>+L2g+2#{QKq`rkJ_k~|)- zJ!qWHNIeK#m*+j&fdXpL39;NGI9WE@L(N$FooJMrJEhcqB~Q^uSk%EvS`PMCZb_du z^9l|`fte)Mduz&64ojEUNARug|a6y}HJwelNPo z@pQNL&*=mVGfQVr{QnW6?hfn!S;GI(H*Jn#cMmlGEKC2@OOC#Jba8|Kvp?OL7u!YU z-DKqT_^jR05P2c(NuX>Z-}ND#O7}=>EM1~Dj}Q{(V7`p5sH`!Vv(gaODhfGVE)SqB zOBSRWpj143@AIj<=CzYR&0hg#5zjpaPgnMz_{3Y}OLebK-eXs8*W#; zk}Lr04({Fh{Tp+_i%9PI`yY17m?!4_WAioujQ=XZIA57f3vhu3p=tuCd*?!9No{sb zU7%heVUpkCQU!knEs62Ds{{DLQcuk`0*zy8s$Dq=6);GU zl9DE97qCWoPR_ur+r}VR0iPfOgS}p~fi#ntKc-y4a_*pVr2GTLGo89ZE%2L~S@%%8 zT&+}MVHu)CQ4+!IbI+5zM-+!9k3vxuW#U=;K^OVL^}%Y0mKstBx{@vTdE2_dNN+&E z*J94}UA82^SW+2-d9%!K`jQOE6P!nwY1+rzKZu)17Ib^;hNBH;wDU#*(Ge&Qi=^>y zTjYYM)~zft(BB=eE^cOcJjGs<%M254bSJmN|6BLzmItzm9pUnjJnTn@fBF*)JG2AUQTdfKKwbj}6` zkJNH>9hBj(yJ0whDl?}^h}+6Nmq;C`b|o0mx)sF}i;SqYVp^HohYhp@%2 z>HI=9QDJvK5a;IM-ttwRAzHr-$~1D5l8-|vX!m}@jkBd#!O51m&&w0JJpG>f53H}_ z?uratY=0DvFPG~ayx5(NF$mxG`UbL%>#Gg?&c5qTo5hTbw3;l)-jV`0@SvYjR9ZY9 z+QJ8_ic|9tAz7*S z@mW>5H4_`N@BFZgKHG}Xrby2q5Y^%;TkSY%_n_mD7FwdZ8LNfY9}oY=);4>b(0ohk z{uLfy<#d%@`LWDSMr->}cbXt0ILqApEpj(+Omp*c5hvDrRBcw3Tc2>*;JPuO*(m4^ z%(nE)bh1A37|ygu^ASzto#ry0;Y!tu?LRUZEwGPa&czN}oh-yz9-7+bWTJ{0r@3tT zsfb}qfTFO95^kxIf6BYz&{imzmiJPR#B*x{EhOQrQ;`jDNv(Q%Vpw7WFZ-Z`WI*T^ zynq$VdOA^H=dCFBR$^7mg+>H6{GG^ViI}4<;uA3S%pDL{RlQ%JjWehoDQARP2p{}| zmL9w_w)kpf<_{-;_IzI!oLl#8Lzi~lJsSX=VfKxsB`sIiF5x?cyI)_@O#(R^oJv8! z^E732?m7mzo}4>P_!MC^gb6aai4ULoXd?9w7q)Abbd398lRyojo?cD;Xh7eYqVmiR z@0-r1ZFKCw)Lcc?whzI;y7AEok!#a#iUIfnpG%TS=h9CC zMkxg;Y`{zxd5l@l2dCO^yFzJU)MdiQ4Iv`C#RuN6ukP1g0f~&*^|2wx)`B&b+ij@Qt>$Vgm8r?c9zL6T-Lkl4MLQ9t`2rx<8nj?C9d z(!5Bp{EmR@fS;RLff&CqX;}W}RQ}-mn@-zVzen1uyj58%%A-EJ?KY?T@dHwKMuKq0@4@3TfYEzlIYgB zyTL#c^f7TD0+>yOnxqp;QkC`hoskso5JL!rH3~T_(o9B~j9Cjk;eDar+xXO3bNOibH!tpP7+?lUN6$wBtuEQo=$}TgE^5O@5QoqRk@dwJyYOIic?k0)y zd4ub=N;ZiR_3;JMt{o72nlc&!qm+CyRhc2IT|d01a@QNMO^19X32?QHke-FbwfO>d6L;UKFl-VG^YeUFbsy;Ntkud zi4Mg8LRZZ^Ewtb`(YbC=S*SjnOniin6w3_fg`eu>ReAC2aZ1&_q^h|@E6!h^Ay+XJdE zf*TpyZc~vd8;cu^@=wkWl-XfHSk}F$eD>6Y41(G9zH?9l2Ri$VMZ~Gt53C2LsBH$} zM%W+=+56yp#Z;ZKKt6P@%rlX#?Ffd9`wvld=Vv!zEp|Dvd9LTn6vs-C=OI2m1X6TK z#HfV4#gKHIBNg+9oYyWPcL3*r;_*i6$>w@|?OqLrlY=9ig#-A(@wQGLI`Dv~_1$zN zT_uOC)F}nsrU(}VZ2YNXAw!9S`s!Bm4rhyK%d)b>Z=pM66|g4E6OVI%fc>D#t6PG{ z5viLY4S4%#^+VQ9-OU%co%d$MbjW4&>@7xi+=kLx=d=%oAJVTa% zB~#PTKXTNh-`{#rz&qb9%CkwS%W{nk*StHbe-@>^Jb#+5zxEn`zI6UctzHMh4$<2o z|IFf^yBRkB$W(wkUFCY<)xBK%{hv|KjnF2C__tax~@hR5n$Z=z*_^Dqmw{RHR68((mKqJ5WCN>cL)~*9#r}e4yA3G#to)9GB!c z+VXz`mgCGy2g{$-S)N^Gc5y=KUbzL7=u~(LK-JF1@rqb;XD9P~K8=$SbtybAvS6P_3E3!K<5f*_$6L8x7x!Nx}u$1%X4Q?NH39t$x zmVqIczgC#|>JAB_AYdR=Zf)$dTKG958fB%4Iah9r$3Yx;;zD;RYnV1w5s{V%T+9^n zX>S*5(5XISVq^<28|2ol_}ex{Q5v?!>Eac%5LXJJ!7X|W8TlihOjbZ=;Nnsn2q-?E z9y^wGD36pPq+oHc*-rYKTy}~Gl|6pl2SWYe;4G+c)=p0v-zUfY6FO0zWjArUozMaY zg;eb#5YqPL>6{sb59()Q5Re#5d;vhP)+G`c0sM8*uq%LHv2z*z8l^VvOa-8^7%&v< zV@nzA{YTz^G~)Q7hk=xDeib+VM(OwK#vHu&DXWC*(&vep0doLm3qu?1Mh7W2Gn+RI zKYAVMmkuYKBV7M#IwkO(Vg{BZDv;K{FiYCLH`Ui+Gx*{^|+Q3h4}${yOrQ)2?AtO@r2)D!S$}jZOFC+ zfs`7Ce^;?!Tt^&oxdZYQpv3;(2jY8NbbCh-80%LzW0c23_sprZL%tH!+4*bVjmUT; z!ak<59aH}ri3+P2egfbH%y8He|8N#L*r>!d0gwkGG`f91E>dDdW})M=vB7+^*(+XE zpkGEVw}&h`G7`lu(~N?p@&zSpiBpFd-NxltTE(7K7}vyP6C7rBsaoM3j$qjjCz(Oy zi!|FAm7oyo0Bjb6?Z7@FT*>)JP*J)W-oJH z=j=LKeQaXa3w2(g)xied`kRGk6McMv$nWs5p)87>nA8UlBG!h|Y>`#8e84Uo2SpA- z9mf@?7S0HOD)4QV1XHvZDnBX`x-@%TTw{7A7F4=mKSU_R(*QE|4?QF%vqO<#HAcg>J@i*ynJ^sF2Axn73ANME4tAdtl^Wc}m0Hk=bx zXvZzFc%L?akzF6BXyXVJR=?)_sE0bzpuO)MRcA0K2t+4O{~6ce%!S+}Oe=(@I;@zH z$10hn2Hfn$c0tjj62UGFe;wzr5O=TaMc#dMtrD4_Gw@5^q{hzvZdi99iq1(0?3kss zXO)Zce8A;fUcj7TuZaKFaF$wk2#M@+RiQV20`?u~t1e9pp#&{J^31Nqu^>)>Zpa+0 z>>fwgX1%lJu<&g)2Xu#Esp%aQ2qrd{u+Dm8nV~34_j;wVQ3ZQR4hZxDYrrpEU zd?n??hfq{?@vV4{4Ap2-e+PBa=G?F*Q^+`BKU=g>QRuG$d5auOxl1G=itI$IsI6iY zTvioidSPl1=Pzkz)X1;uT_xFnmDwTam@fJtNN@L8pFXr0A!4R(pI(qUTQ$r%ui_;UuYw?9f zu0gwAmlno^5i-_Pc{*YC_|zah?xd7>H6VmWeo*Ko#1|&R9$8L1)xb6PnHXiB#YF{v zE~3KC7AQ|3Ed)g)$Uva+AT8!%3rnpo}qTV?{p$ zhR{%D3-8|mKJl_#Z_KB4+It%S1K4%t^Q!;pa)(D&DKdIgMRZG4;f)C!l!>sIAXcx% z>JNV+>|0?sJZ>2NI{3#BJ3&!BrzI(u_BR?_1tQsYkd?AznwM~?|}54c&Iq3ah_SE``n z90*b9$4`Xj43#|Gh4(^!k7G7jH9RV81*k3Bp2E(ImQH=Vevg7 zE(B{7(NLpbqUw8|1|B?^4MO9mFbXwFnXpk)IRGL<0Yt-fA@dni8cxo+i5w{E+`_7K z`1zh#qTvt`c!WoY=XWF-HaQK`C{Ge3Tbf=kGJpC^eDc2DOr)n@SW@BPc(j9iw5vw| z)9L0@gwXR;GMOvV{T-k|7Q0CBNmysih1AMcVZ|wNPK<*S z$tS$1;<@xWegi{G*sG_@S9|sAN7tql<4sSqTs`Y;0=YgM{)<`E>o+HHO&6mbIzwkK zo6f+1O6SWH|Bo<5dpi|gsJ#BqBMvfaTG~i`VH$~w60nT%uO0@}eYf`H2L!AB)yw?X zxHl#+38L%m_3ju9m%M=fo4ekPdbIwR!uzL+A%_Edq4&0Jahcb2f1NJwG&3p|%F>nku5a&?R_b{0U zOi)F36hv|uVD<%;#%ksg*YK2#OE#2uPk25jB=#@gr#U1nS@a=+L() zvcOnite~&X`L^e+LLxpGN>ZPqt+ldrDG?}YR8+x^Of||+BD?GLubwQkR2O?YD0MH{ z_Z#_S@ov%KRNR-Aj{|3I`IQ}p!$eU5os5z^-*%3E;?BUd#8DK4b*)3q$=E#fsw--$ zjy|RD4d)b;+Z$v}Q^wQ%pBDg;HDs50_Wh%2@5iotYrxF@a0V_>>{)^dzLZZsvYdCX zg`|`e>!%nmQpPWL^J1r$M*hh;ps-8pU)}*4Tbfms+bSvpAX6|wAxd^>j><$dWZfhI zq&;VOP3ae^4JS(q-olQHaTDBRS{L$XlojJuy{OmT6wsdYq24DDtN+Y zxyv5`Mp84$XFuPEe{ZA~jpJ0DanK8NDv&#@Ip>r!+-_c`#ZVNWAQp3#4%GdLZCYFo z&2lNRcv~JjX|(0`+Xtyx5VN{;H6 zKRz3#SxsVwC?=4x&~G+4hM%_#{BrBvq}utylMCc6E z#*3>YTC-UvX%G%ZR*no6yhRe6RIQecNmRd-&o-f?p2RdiHD4m;)v0y zwgIvB&vfuH@`XcIt4yK|U(v^1dFtpiNz~;v;JI&j@vG>(?_qWF_usa7im4k;&zHpq zZxRT^5KcITk3R6VHWJB&&6E#3I`w~9x^miEWhz}XZ~8Ltj4{l_@&-#nNNCqVA0V@7tRO$<~6SXHN zje=3)p>qv!7nN_-w4w1@JgIybAQP$nAgPqzhljvnugva8kT!;gV|*1YQVGL;Mk$G! z&W20Z5Zuj*Z6$f95mJh}jU7mjbG#x&SBoCM(i~R7Ug)Yc^JD5KFc!w?r6)48RVNb5 zfZ^G!GBW&2uUg!nS!Y0PPSHV2xzDnH;(Dd!mvb=xMf;%_T19JduMC=k5jRr)X7D&U z5_#Wk*0e%537^lNf9gJWUyE=4ut%_@hEqbs-H7v6+$HcR%%QbFU)row=FNq}XyxMg zI?`qC=HczS<=7AL@x#*k*9nv7RI^`!I0M=6pBIW>$Q5KF`Q0|g+@Y5EiV7lQx))^~ zbpfH9bNn$xVtfMY^o#2RS#&TD*XnXOcOZJ+>!xvgrfaCUSD~blg0haQDv1*MKsY=%uE2 zL-tEY+?&42=N{d74^2`rC|4#!6U1SY#oG2D=>q|&cZ)Aj4fl3B&?DckKaL(#0>9~= zsw;nDGf}{j$J;Fr|EniJ*WRFAH@_RSU&)d3{=&0y`MvWC`v9OZu z{8wCa+_L9%zN>b>`|gn$P(p_!|MLCs6n8&1d5`@M7Q!&;y4>mx41B$$fH#Y0{cMPK zNI~jW>mS}dGVh$1X2bmMwS(IyqZ&IQMS~mWs0q$-`kGl+k~&u!Lv=ZPD3+#VQ6w6k zHlbsJ0lV>AAxhP)h?&SA4Mqo_O7VS$84Ku}tZ2fdF{M$Fr&>Gx*QZ#XO*&^gi&JBq zX39rMm>Q<(g3q8NBfuqSJPG{Qo3;=zOx;tz)Zp=*`Y3L~ew~&6z>16Y({|f%Lcbmr zf|0-(x?NEL5&x{?lj)P9O+{-q9F#Px7KqoUr&y%q!8IlPcLP5X!1q35Zfk;UC_FO`W{Jm zUt%h=D{Adhqoo{Spn#rpreEplYg0RUFUvM4~SJpUl zl3K%D^Vxn;bGtw7P+wvW?*3zc>yLUgE4}G9VPn?Ob8Mwdi|xYiMe!1Wr9ecDE(-G| z8F!^JsJp_Oggy>J)xWESDXV*Z`a%)~e<64G7m|;uW^?mJsQ62~LcXnS;xYch8$n3^l!t z)eZ@yl*$V@)l2L?aKN9vJ+I!5yN|9_Up@I;ga6L02h*62F+=}oU-$`pC=A@<~;i&#P%?d9+kRfK}Z!n3EHVHP* z9;sUu;l%nZR~0~eAr4bOQeB``KZWMAV-_0%kLQaM;D7HMiH!rXQ=s%Isg9H=kL`B! z?UGmMmgf{Ku}$71M<)82*8SmIrH1p~G0iFuJZA!k;fm$}d`C4MOERUvH{=1s^{}7^ z5M3e_sIWeABQNy3)2jJ4r<=V1=V*+bDQ}z=Ikp@-6|yb~&>jaNQl4NU_A&N%_hr4I zi5?xj8?Mg=VbEYjVURj5K~)Ip?YOW2&wcyHF)d`S9ER`8gJv}e)nG^&{q3+&9Ta4z zJZZw2$#bP(1@zhbW`EpV&S#wb`Q`UfY46TP2n$UcO%9OxeQrVuZ<2WVEw88*HmMEp zKnm$Xz3R)I#IyOvk+!CKp0y6@eNjJyrs-)9>4aC%*Y({jTQ2DWe;feSnkTJgg2JK(*{JAJDOOSD8#B9GBKeE zpOq~lhiBXw8nZC%(l$Kv$zojr$xFrf7;pGHstGVbAqd9mV~BIM|GJ4b)nukjInEdD z-DpKUDJQmRTM&L@(BS<3qt`Z6O{dQ`w)4bOL!nBPZPI-1d$!o5KxwF=icGpvJ<(nx zOCd2~Ixr(TiGKwayOIf+)#V)0Y*e^hb-;mOm-P=e&sr;1kzivM#i-0(wA9^ZUQrc0 z#lbmpR>Dqm%mAa>+-6&mUkMrGc(qk%d>`tF1IPA^B7TX$kr)P*hu_y@QnP-(b-{60-3e_hd{pPr z-g9#IvDPZ+w|7WLKtw;M2oXZw*EqmF2u-*YHdtvf%EU^jj16>^eC@5HO0h}BcBX3) zzvdxPnppLjHEK3>ghHEIAmce-?Th8t+g@^46fN&o@zhj{T_<{&Nd^t{=RT83ZMP4> zv8SQZ!-aJUltUOY-)3JNZ&f76!%Oj}zWyz+HZA<>mdOlTizBj>7g-Iv<;Y8}MCi)2fRm!@ohD%7C-W-X8ZO0H18lBFwpq#fBJZ6|#^Kvy#}K_A)|y z6^%1j`e8sM4jF^*cAx#!(_QM<3MS@n+vn=aKSE`vn3jBAyZfy_#DA(sfiOraei#o4 zc)LzU7G;eI&6n_iHz6p5#c7$8g1Ro7Itkx>ICwdIB{8w5qdQHQUQvi9av3}u=5I)% zt0y;MXhTn@tLHUv+4supm5``A#7i<3ml)Bhv8Wg9MREVZWa-Q_VmNM86(4>MOlIQz z7#!v60X`;+^2@zT)x1boj8}6v4g!2#t3?gEDW&}0s6imActMi|q_6n(r9MoF3A@l7% z^BmmL5dSMpgyZ?t@w0a(Plns+#e5K5h#~rikEx6hWEzm!o^_t#T1p(qk>P?l&w=Q2`|8OM5#WHdz5B#*7^mS_?5X-s1~ z22rb9ms{0e$|TCInf>#3h;}N|+>Uw-hbHHw{%h3Z@jHwD*R<#Cd)M^jo^rU&%qKtEu9=Oe;6LasFTVHYJz4>?k239? zyWFE8*j+a`e{!UrQ`C-mZu6txFaLp$ofjqho98tjwi-&>f)(;^Fl>`M=05)Mw$1Z7 z!Gq;}5bWI7V<5ZV>=Kv2T5ox=GithbRI>I+YkHvKx$qd(z>?=n@UN{o6rgf$Kx-cI zrcHg%)r1_Lmv|329j?jrw(==?`u$L<5-{La8+)xN{^t_MIlycK`An1NH_ z{;Mc_3~yA!TRJGrQMZ9*p#x^7;d9O)Vw=X(GT)y9GITY*O$=xqFG;j{Y}KSuNS!}d zFb<@#)(e&!0KKYYLC(zf4svOmn9^F?25ID8TIfv~3+L=nzJruyzxbd?trmYZVu^|N)|GBs&y2v6TirwELdRDy5;fPa3YnGVp zfh!P}^o!MNR=XenRC8fB#XSRYId`d0wdE!{fKuO&W2;sSWO_99tXNdvkRrl7a&2rg zGl`>t`nn>=m&?s(;Fvjhj=EwJQ8a_x*RSaACW*+{#qj)WPv!(Cb2`rn|9OfTIK3s4 zO|Ff@gW9wCpb^Hx?}`M`g~R08uB@ZpgAK6f(CH1fi zY*OHx@1y`7s=nn8K>6qXLm!{E1r4!1DNm8tB3d}X0}^l(ceYaRl2huX0uSbC2i|%h zfoc_5SghE1BW9V)6F8p^-zcWve%*_2d*CO+Ey@A3zQQkLWW+TiJwh zJagSsg!<`?Gyay=ZufkAOFSzCfO}tHS!m%QWY9jJ1qpD3}w%3gzN=Jp~4>cwcmL^(?Hc#ahv$b{>d0-;X z2wn}W8;(rMF^yKRmjpQHFCTEKC^1Q@>Na@bW|hjDyfD~B%TkL~)9JBoSONdJj;Tl3tmtI z-s>;VUPPs@is`RV*RH%RM2SeS3A);6vPq9rm{F}TLrP!_HlQ2`@QyDW-Xi-}PgQn~ zamAy-8il=;3Z}ADj1-U2VI*+O#FS*E(y*bIu^Y9|k9%|auz}qKH$D`C=O_SdoDaIz zk$vTTrQBrc6JFG)$E$7qm-b@YhJ%>Y12-3eTj&Plhvlq5ujlW&kXnlKLrp!v&s`jm zOE0_hx7n|@ujRnW3vQzI6RkKh?gQO*fFG4eW3lv-R)3@*deez&nP)){h6GEv(Wc87pv*X zuXbrp)xfRU&oMfe8q;dR;59PCci2FG)K)(MIk3Lmx*do!LE-%QzWcST)n}h8Jk=zm zF!Se`I|gYOCEKoe3{jjYM3;FGE1ZnyRY)&Wm29a9-N3890Mi?j z>I9Zc6Ui=TzHdj!i`Z++Rg7sSJo~nU0V0~8|KL}X;DNh+ewcd0uE$EmA{U(IW&8ct zYN)xUI_4kc=>^Imw&U;!s-&}JTXJ8O^= zfmBoGECULpL*>M`#rLEpQ*d!f3g0C+U>~IqdMz{OHo>6s%bPg(fIPXq)Gnqw1mriJ z7!X-f_Y8TmU_xwclq&L>5gTxe9&aoV@iA01q?GPM<_rNs1j`K z#&}7c40d1cG2LY;He;Q9Ag=zf1-BscejhdE%)@vWoAKQBgep*MLJsXx&w3jkcRF$I zsa88CP+8*KHiq>*))>0hz86{*wNi zPB6K7|2ydUF`f$J0#_XUYQGlUsSPUB;k<21`7GBsr3*8zM*``^suCOVT1TajQ=N_K9Ta}*r;*4f`Cf8kuu zO^koWmxYrngR~5cvTX#DI=Y_Tz}4E71S3Hyr%H3^-})#eDU3YI(Cz1Umej--GNz<^ zNKhd?Yx28fh@_&qx+OUX|D+0Gt!Nbl8hT;*eOrT`H!(T;>t_NZ$v&g#twalgQahvP zx-8Blc5aUN$f~`reyB(tHa|ruBSxxX2a+HscpIM{CEyzp=`5 z%y1IWIIrM+fpGZSBjDxe4s3MsB2}EkrBr4zBaG}ayKSTW%zCXd>BfP(P5m6dmwtUz zZq*_Mq26-lRgp{-ab3sPhRGyFiVP1#_C`+p-6BkdUP(BYjbWJcOvI&;uI7O~(9{CA z+fq_A$bf?x3~;~w32M=f%Vfa#^k5N`|Doxu2Z>1H~Pw!?HDcG!{AHQlC7 z$6K538q=m{x~4m)$1vT;w3!&g@3qhE_x(@YaGb;IbzRTv@wnf=iRlhOE^*06HG;P; zD2{UngcL?7_~kWn!|jQC?2)y)Qqv_8Sae?5x!^X~i9piqYU83ySTmKo1pJ<@3YZ%;vIIox2Z1Oc=` zA=zPqwOE!<@d1UB`Dg9<4}yV*;p>2HB>?WY{-G-HZ?{a~`GU#en2%&*#@ZeF#OFfF zKp||*DYTY975+aCTXMT^?N;vkUIbM=-!}K7`|>ZN1%$xn%e^#4{> z|8nsE)H*;k>nVNc+T)Am;TI3C|2}n7eR|8&@n_;KCdmJH5yK#_y6$gYynp)T_*Lh~ zVTK^u$bK}Dw`&8jz>I6jk) zpiM^UHwGJVV@q?DBMK^Z@xBI4D;DY1DxVr`I&@y`|8%os^6JWaiK-h@TQN|XJwio`7}XKV*nGS ztrOpW9=v@XR?l@lu$|Z|mI(Zo?cS%odSgi9dJ=|VVqo4u%ihSXuM^Yoj)(&iw|?R! znm?uR65zt@pFT6Y_f2bq$=!5N`TGnM`eFZ5YvR)bBrw zG8xW+vGQ8{w`QqpsJJbpAg-oA!&UVy*T53BG?A86YfRkc-=HW60Etu1u3L&N%-gfk_R) z0)y+vw=BL4)&s|Wc(a0AC!OeyDU9aR!YVLe0DvZYEebFtbKD>HnV*g<&J-NVJ09Rf zZc{l)Fe<_>M+MD)ArTAs01^gw862x3+;WDAS-ETMP&GZr8j}NylKiaoXI+w-$VE!c9s87fBi*ORjLf--*~T7f15=V$^VhTRBJ=FqEJeJG zyYGSCR-ZivgLTr`M7`1DbZ368+j8yXPSI5xJC-YqD%IVa6JqqRVFSluW_cM{m^MJh zmno@ZL|~;G-s6`z_UfQt21zr7z3fE(y=z{R!cptB<8D`hvr43@GZEQAtJ z!r*t2+nGa!nhLOqO8FI^9q}LEcm(QU{i5;Oi(d4oX8GkyATTD`P7gqVx+IuY z+^K{ez2QX_IC%Yd4xf5f1X-(ceIuF~%<;)n58L8`$2(vOBwzv|vWg0`!NO2Y`Z4~Z zPYy61^|T@WZ6Et&8)R4xipqGM$wjKI36g%c?c*Y<2p)#BnrZK z_i~UiOqW_euS#spK%gg8rZBoRItoh$C%cR)h5z}zj6zCyOXs*2L8?rNDJ^l~9kFo5mqyAf?lx#1ouHGXC@^j^agI8_?CW0Mibd%XI_6f18qr*U$}mvP)wKHImpq%_!O z5cL_ig7}04EcM_1943_|Qx+tj#!-b{PhS_XsBAUMWPcZX3A(hSrXqU^-lTp@4k(~f z-t!>&pcGt_(KennedI*M$yB|pYJ)sVvHY2mCiix4&GdKn>^ zka<(@5rvnX!TZ&jx{+#C1|>Vp@vxN^t^?~Ai(UbZ^-paunEbhw`5AN62mQ`EP{b*v zmLkunESWY!gtVzInMp^})`-uj{Ck=l7S4~B^9H@U?~iMRdso}9ZS%*i=zhHB#tR$k zDysmjoK-?Y)KUVjzv)j`@g>v-1B}v(Mt&-1SnqV~N*-f}W7Ucyru9CFCKSNNMCl9r z3~K7^UvFa#{CN5BoX6|e>Ab=3d!jqfJR8cz&X*xqM!4-c)0x4yX(}n@9nWLHc3Jh= z^b!kpfHkJyW-%>V<~MyQ(10PMj6m}~S(D9T;}}bcKB1Gig(>S5P-3^*Xuz34lh|0a zNu}EIH@`BvLxFttA-b!eTWQKj9p(Baq?S#nW%Gs~;>D=JMbd|{Q+iRFVEJpsYvdP< z#F6&Y)p{*T-q?#5ixwTRLpNdXUisBm*V9H{38^VYBi=o!GX9O?ETB^kTvg`#pBWD` zZ$Nw-t_i|VTn+1nhkzj=nh|+>=1P}gQ%@46Y(!e6vgJ-38j`e~<2|Dx7sbBP#N>=2 zqZG>{h~>{ykU!(U>Q>{%aBeonB8B!Vyc{zax(ijbi{?ulN|_}QdrFi%`6SUU%PxN^ zAC@dAT$jATJV3y-T%}5>>}CjWM?3RPn_^&s#0Z-6Ct$Jd&_@gQ6!QfRH7*qRCKyq? zWN~{AJDQf0kECMyZ^XSofCl<0_JIeuIutA73{LW0pyLFQ=L%PgQ?CJMUynBokIcZ< zBGLbMK2(k?WQ6;1`0+vQ{I2`a&j%&(NWXTT;Emu^$seB|7Q_arIL26xGrdQ(5*Ij2pTYtZ+b|07JP z1>Mg292&02eCa%P@>#!Ii)8qd%+TAucFE(v|B|8a`QN_h8>v96&>~eSmWKtG>rURZgP#(ovV`d37%!yC zI@T|>Uj`(?rW7&>8!gJ%^MK9o>R+PHZV$%7D^{?2>^R@rv(;pSsV zjcELwA9%8eW?F6hXA1H>_N>CvCOaCOvbw#vhIdyj-j5_PI&ghC)h9b92;t9wL-UD8 z%kLaRF?mE5&Sxo#suUKc<=*Cad(vzc$geX`lZmj23)-?-z9qbG<}+rLks~?RQX4*S zFjLYP8tP@rt|vH{pc}BDM-EtE`3{JERZZU-YLy%gh3sm7YoE{;Qx$v1(`FL49o5ET zX=0wjQdvoJHbA-_3V;6RY--RRGk({mhN4hcJy2(HwD+D%-z<-F3%VKl*}sb{kv>iY zpWjxo+hIkIQx2KxF;Q@Rf(d_**VvqW$}SUZ??%g$)6 zUOWKGBAXpH3(DTXTHD0Ue}o63ydT~I+SL5vs^u?dHbJ*GH^3_UTJ-4JXLtUY&!64b z)6F&>#<9&#uA)b15F-nsD z<;4F)Jsm=lxUJl}9328-fZ>u)O`!yEbSX_IGOE9Zk`2oySfBrem+w=|86-*MOe$!_ zf_Oi10$s$kKh>V0g=T(=oma!IIsaBMswkd{&6vL8*T;x_Uc zWn{?L2VA1*WHP_v9uWR7hhok%1Xfpmh~xB%%fXFItXNfr!Xw z)6Vd`i?mqipdhzK9aq4ALGYLIXPG^3ivZ5-fU}_%OSljvdu0D+a9cI+b6jB+j4B~u zMdbqbBxCKhQ-Y_mwVd5O-$1S*6i{BkDgQU>JOmn*nL+3Z49zL6WL7bmHurbXM}4!K6DBB^Xb zPYKy$g7(?Q$HG3Ijy8?jcFm&=YYoo`;0{F(8K)Ejvu*#AJG6GEcW?lu(9{tjG2ZZU zR{O&cP-O(@2*KM9tEO>v zTG;Sln^qiQ-xl3|c!(P0R<2g$yO89V7Rw+@nHw=N02)&BM=U8w-o*LC?-uzM4RX-V z5Ct4CL_xQ8{N3vXt1&;xs!{zRens8+dH9%F4U$$&o>&@fE*7zA?!)9lvd40$?h$DAwEF=X44vZ_2>aP8&2Tg{r=Myr8 zDmKZw+Z%&AU19d6;&2aaLr(T<57w`m~{v8Xq*FT{J4so*SW&0nJ zKqW3xxl{^r5SMTW(Fa;?MB6vOsA zTklRs><66t&d$;POp^ar(sB_$EB?YOAQ8BKyM(Dy4~GsYjQZuGsDK`G`!R)%;vJ6o z+p3e$Ea|r~6NXcg7UXKz2vn0blTCz3$0mOHVa#1kh)|X>cT^M==-)7MO@=IflB;80 zv-zH^hz&1Q0Qm`@u?=VB4<6hmmKn^DUeFlR3?Q}T-GWJZgW@v_&y$e#DMV#GHe1ms z`m8Sj9(kmX48?Kqm?lCX)5h&`_(d$c5_S>+fAK+da> z*q!b2|5*{6nnWHxRlZ?wu9yQ5YU7S&_ zsb30VAMZ@D?RBx9$E={N;V?LfSJTQ0sT+WNz)?8cl3)&iHI>F$q(fV~S1^Ihh^XUHf z;q;y!K#B)qO?6yW9nEc6N=g^P1~e2V(>#D|L&C?_DL=0h68_K`hn-2Ahl%dqn#Wkv z;fG%&gv%n%TA=Fg-ELoC)^s^d|2P=rd;8=10de8^8f&@c`l*rK`UO|u!eR5J_v3z3 zS6Jk+=bF@=evHkJ)9Zge88GM{;GB~CZugX-`LVHi{S?^SpZ&d<+Rn7e>vjGT8+858 zT=Q?t?E*y+VeiSrv>sc0@@wa8tFSy1r*@GUunVZb~zj9vht#*ym8DG z^(^hWUT}q0#;01}(K$JsWR$Afs$IqNi6hYF**IQ-ecP&^AY}WiPm@tpv<(MMOizM~ zVJ_lLymFT9KajOur%$wXfP}aL+O|Io$zFN2pfvpQGsl-v%u-)qk?6lqNZf${9klfU{I2)qlfFB* zLO`%X8|FoDA!6+5&I^^;r9A0mrZMxcxSQu@0n;(U|a$c}=uccP7;y zcP^_>dg}TDxELGqFz4Yw{JJcP_mf$dT(ZGE&J1-06hyIa=GZ|T0~TV|1zC&FW$`i9 zL-eZgU*mu^)%D3Y?OBnKfvM!Fl&vsP+NjHtIGPfnP)&qOFwV4|0CNdvm3aer4Bod0 z(KkUh>y|vyBM=L-J?EE1GHj?X|aRQ8Yt(z!m^KRc&M`WzIeO&AWOSmDL2$kvpge zCCqcYlEokQ-LX!t!gzh^dUr*~Vi)1Qj0PHVMd*{A98RB6%*g>h9-?Ii(yI4>djngFsn!$X&OWkDm$BC|`dZutS|p zg||GOH%V9O3dE*8{<}t#u4_jy4*F=Q`$sonW~)r#m_pGNaz^3qUY`idD*!SGapWwO zlGfbU^EnOJS3$HhV&$KdIaX9m0B|(80#?{r2CA6f-#@Bf7XI+`tI*p667^z4@eLaJ zdnavJQCE=E(I>3Rp70XuiJ#w@z%&qo=e6l+QrMp@o}z%cj5Zw@Vb8tfo>({zZE@XB z#-$}-SDvM%6D%M*XbTpl24d#PsAp#=A7>0$1;34TxtxV!_*&iffOO)0cX+eg0r^K*Uqc)hu+3ddF8fmo4B1Ov4uWu^D^~XvXHmV4(J_Y|Aq#Im~b{GQ0Dyne0_*{fv518 zPYg%Q1CRn6xZE!ZS2Xfm%O5qXXj3{k@lFs-a?>`Y@N;5Tj$kC_vs2pq1O!Tq&r9Gca$O;MwO|RhT{Ya^kOLPT& zSjUSJazSMeMAE%#AD6R(CyR5+U77_6<;0(U(O-d6!=0)gdDGPTO2vjtuRiY+l#=DX zdXw-QxXq*eU;(ENQRCeQ!=~y+q*9DS_v|7Bih1aLUO2a&vME;!;N>a3FrdE?ZL==lB-8(Yu3?(7#y=lygM>G73QCo;45ilG5EzTK|2^y;t0`JTA#9$X}37T^glQ0Av z@pW80S&R1eKb1Hu3%V-1S$MqF;x*U?3~i7$1DfGJ-h{>D<{9FmL%GFbguaez5PU)l zqCePe57DAN^yeVW6 zY$}<}pU1kd<0xFASJmCPSL|Q|mHLKiaN8FD3z0O+2M*k;9KY-sAqIk=V`B7XqK6FDdgIw(kn_&mJ2=dE-4>51DaRT~;TAH~*+c={ zGR#aS-|+=W)%nwRZHc?euJWLy(9vCe_<}w@6ueJ7jA@AzJvGO_ocKtWjPel1gd9A1aWL7v1b%gQpzaq;%k4YEb%?j&N_PBJ)%t%bfvp#Fl7SvEZ;R zdJK->G_5|_R-ow~JJVazWa#D%F1k|`7Hb%%K`c->LBD~gS|eN7GG0M1lVjs7Qqm%l zNM+1OU@{)XAfju$S4I+cCPGI`ECFg=`4+~DKe-_sdC$TWIKuEP_g6MMZ8SghJ%9Z5 z937bEEHB#{&qPec2n1ff4#H64?6}AcB3!68jy<%=vKN)#sSCQQOO)meKMfeZt`fpz zo1HOu6(C&4nQxuAC@A#e-TTTS9-o0k}tAYrx>jK@>Z}0m}UN_G1@9*mYKt|o%FZWBf$lI-dNCv5!UP3@^d;^jC z2Wjx@LizopY|WmZGKf?DEo=IhuKL$1JZpGy*KkAFI{d-$9eek&%1uMib>z)i4`~#?yNGLHiaeuSYJQ18jOwS#(HNavyG#PnQ7b#8 z=DV0Q3H>a-<-FkPY8ntkb65YBnFK@1SAHAAzdBAr&l6T~{Cnz?+(N6vwGZ47z<@_b zhiR;#+^ZBmK%m5l*}CwOpOZaZ@55!~hm0fh5^`n6l5!ymXIGcJIj{g~)fz8BHlm$v zFxqmQgQJ(pMe&=2+E(Jf24=%velJ(MiBfVw0y`4pSXH z4PT;a(4PWm)$0UYuFCPy;NE8&Xb=wd^|Li*4)SgWqO&)w0t0YMo||duwE@?{_d}xi z&wBa}%9?7M4D4epTrr}xVJny_`spFKz6gX1ftI($WkQGwKS!s@XH&KoU#P@1V+9`< z&b&(eD_vRz4Fv^WaH%HWz;+4HHq34Jc0FG5AWmWoXJ-&vPux$u|@4ks&33~PTlyNJ?m>i^Vv&r0t3^hs{H z-UhL?(iweBth=3snKJRPq_GVeijF_kMPs;!>ZgGA&Os#hESzbKq*!sZb%feCy|)#k zS3=kO&CDCJ7#y2rmHr=_kp0ClBYGg)Mr#AD-|yFKA%q#Jh06ez;M~`vWgQMDH+!X(HJstwI}px{LaSPw z%-6|{z~-GX(Z;SD?5(|QzDDG+11{a{QV6)vK+Zwd>KO{)PQL2}blc1-^P-_JwPcrM zZFAP$;Mn)eDgm;8K3N#aLHqiVrKuw9~R8lUF85FMa@|-~(`5*NV74|dJ z&!I*-Ec52B1lveP^Zs)Rs|z)*p2A|ApgN~QF0NOkq71x=xIA7oK5D0)CbVvtBLdAX zs{dknNoAa+zMG+D2yg0E(a&{u_S)oP&=Gk3S<8}>Nb(KTeuik|kHwcyGla|$A+!o! z+0@rOglB7;$?`nBzey8FIoBeAdQiL(q|BT3z}Htkx@pl__?*s*t`#bZs$CY=b{URx z_Zuqx1Q^jmjwiMJ<+7MnV6w6>+-|M-QV!tTeucg>grAtuFXowENC00=t>D})`YcMw zVVzLgiKM%_6FJXZlTl%wt*^y@q_l1amBUQF;lZc3xsKC1{%z(tDYX`EFQtqzahE2_H9Zy8-UP4RY>MkqV2L=QIo6%WWQk2qm!=`Ez~Ih zC)-y#1lsk9apB<;N8!)2L+6Wq+zFO+w5J&y2AsjLR-1$+j$d)3Xh>TYS)m_cY8P?! z92}DfPA|8aat9hk<4G~7gWHjAU-8uE1VqTfD+V};CG&>Dp?(xn@lS5rqvWem@;AUd zeKuez!W(*3>fMKk z%y7^~%1y^qHpdGEm!2~J;yOm7C4IgFRQ2EAG_cD*(MT0=+4HF(k%{uU;m_w%=V{$h zpt01Cw}Wml;n)mTcw5@ys~gDH4&4PSk)<6)$@(<}hlePksi3T-EdU#HI1%MOK5-IN z1Rn{nf?Y>wq6|O%ujS<2*+*~vrD;PD0Z@*1D@E6 zkq7s@r$B~Ikt^^eQXJzetr}%disY(}ga;OrG^glEyZFASP4ahfF+zYinkyc9T?;o6 zT3(o4#6A4;md!0070AQb(PAF9u?ZL5d&M-7Lg~b-hLlokz77EM8*WIbO!4=Q zvUI;+SQh}S zlfDxVSq;YLI8b3@SE9xh`7&R*-n$*UtiqJMy~D7a;~O}4@FC6?37wcCsn-v1MMWGR zF8|4-Q|z%DGa)wxd$+u%CVFj zR4o0nY{aL`;xGAWJ&WH*U?yV^s<413;gR^W3NhC`VQx~(oHdL0BYhk+(nb!j_*XBt zzsWA-UmCHoB!tn`kVWMXloUu;%P|r0Negh`CA|yZeAw%V* z57z#lor+(H>ECcu5XgT6ogvEENHBla_c!6ghC2|zDLh$z_#&!Io14Y9lf|z3 z4#3oVaMi4P zz5C6=?Zjf9|1U*ag2;Wm^QYM~i8ovMe+~T)wDS7|rrD^N_-65 z1cw!&fHZI$+tb)pdV-N#0GI*+jGy=wA}+Q6%L3?g_n1#!`tNV>Fn#_4#Pa(k$xU%de z$Dfj{5?89UoZ0C%Eej6*g#!SL&7`BIpBL@bk#(3(%W}(#qZ1u|*Cug-M6&Rm^tjMTJe+5m zjak4^0lT+xZakn#jxn&)vTL3BR%knGyB1t;haHMTo>DYXEGpZ}6 z6q1!;jTRPsxKIPc%vM_6pL)&$Q9b&>A`$wKI!qn?!U`_U|89Y;u*F(+Q}I&TxB@4P z%F@N@%R55)e#+@K!dFSh8&s63Ml9OccRxnzwM?zp z_ha70@&33-B`}K(fPqRiXLE;c_0^bz^3X^TAFGvMlMP^R8C@&*I=hA>OK_Z~!_4c4 z3T9fKNFQ0Dm~Yv0MOHp$Wqj%PQfp zSFZ48;IVj_{M1ON>JYNM%ZphtDz0t-qGf%yK%sF4AL5)i8yCCECSK^HoBHaZV^J%% ze^gKtPeF%5lvcGidQg;P(dXVG*4K4El32J7K-oK=FG{va_hq(S)FURS4U)6c=l8>g zlG*((&2wC&yc>to#eiSZg0&KXb0GiL2x+KOAKgqT4;H&M@7r|QvW*N~rKWKEz5#Wc zO#_+_Dzh6dD=!_jMN|NVd${R{#b1jry{*U7bL0aQ%@sJX$<2pd?5FLR`f}9_z`x_} zF7eZL?ii?bQ^4rq_4o{Cv4>Qy-`B@C?M7APleDjsti^_+3sr&5L`8k@4E45xl7R-Y zY~@KOVR-|Kfu8p&5qVNs^OKI@c$x(wu>LbG^IX{Mb1xd`GK2@fQjz^Qwr3OCG4d%B z>f~_CLWk6Dwu-C3yxQ@Tw|xR&U$eGzz$;tC;15TN15Euf&4nYIz!VCKWI4J`#-i#6 z##);%dw#AIRs6zQ(}ca-77Lfkuiq3ZP#82!$4K`b66EF>i&H4PkGjiv0>9e#1Q1;# z69L&v6eb3T)K(fI-%xlL#>P09=K#(pCW8jBkSU+mVKkygTfNJG;gNJL89I zv;;+aC1UHh`sw9*M{NYM99TCP1s@B!=&=+?yfnVySnCgnVKE*$xrhJdB!I{uNw)H} zaIi_hHjO5|cN{MFuA;hJ{NJ?v^Lx}LZtRr05;Y2g4vu zTyJw@88uT_TwjQ*krKbS`7!eFZslpzB1bi(P;Oxf3V|+-U)XmlZzS{z#_t=teN1vZ zv&%~w_hO~0<=0(l|CLi1yz@hqbeM

    1fFo%q)I0K%lT8`DnOce%wQItp-GtY^eDo z^rPKD3o7f4D+zN?K&Bl7i`ate3-h1ije9nQ*tG9`Aazzx`SEhCYfrd$yJxo(Ay{s_ zhS>bzp;3uhgSw^My-agTALsY9Z{2V;4C=CRR=d9;ZT0uUuZX@8w)kpnDw%#$TtUa` z)w!ykOnvoXC12%;yibhuBY46%;r%&NurXH@nG^n{>{Fl40UX=a7FTq@v;0VxKDc?2 z|H$mWWf}lRkq#2<>PHZp?fx1!^NBf%nRr3=>~1NBvFYHR=xyZV7936 zyYGcZfCCtlRhmLjMe#`)EV_uU1<^=W2<=s*f=~Hp5@{MyA2B!cHyO_- zh?(7lna=X(y`mYToavS7&?$~Ht(6tSqUQBbMBL36bCHAZ$NKvz!&yduPzCP^eG1W& zJ)y*H7w+RGR=8G%q}@^cqHN{mb>(i-m{99rV3-Q!4~$CMWuPQ2{QIOjsfQ%i+H2-d zXs`vHF?$@}G@`N1`>T9t()f00jl&vhw!?w>{QcE!&wmuV0-}$3$X_=-WlV#b2}BkQ z>6Dm*7qqJ{a&z(XWjn6bk5(9WSlC^$;igIxa-101waekc{t4da)@MA!= zAg3SWTR53czUY=kfLN=g3ohLooOlzMm#S?FMRSRZ2_rT{33{3LpA|wrv7W(Wi4dl; zscqk=v3R;fO2`JkmDm|Y0z;}m3;>$&Ht25Ib$clO*WFZO5-lRe7AUD!>%W?qQ8m3^ zjfA}G&hfhVev<;c^|o+cGEUxSv1{^pls$hyUg{Sy{9;_dXQ6#9{9hVfP3jNu(>|5u z^|8PBqX>WedqKE(`@-?@{PIe5}8Au4{g46R`Mp<>A`b(BZfvO$R}5Wm<64Df0)Cw*Pf&lWOZ;+e;6C|CoAK7ao95t>1c6xa)T`2M>Fj)$ z2G%h~6a6tOfywbc&2du!^mAf@TSy~LS|iEr=EOO&9tP<1oSmKd>bKH@UC^okR^o<{ zcH7@w@t2Jo4iz|)5V)YnSF(Uq`RCrS{3G z3kZl%{Q_b#&1no@xkhcfDc`Gx&@{!$zVpo@>X6rX4?u{}C6EK~5hD1?K=G3*V({lr zvL4S1_Pn(daDu<1ARe+3HXvml&^yIsSdZ^#tWUk9*=r9bTB2NG7PC-c)xx`w>$%Eb z$m>WehyI&}I%!%R^>c|1sHR9%T?{BHFpYsfdK36Bhz-gXN%gLnAZc))T>kSt6zqjksgof#@{(wrLLjwb_NJg@e5p7f|}R!I>| zPQu}YkO7i;0wT>qj(UhLa)D5xc<8kwFR8jBLitV9$~QsQL3w2XuRDrZS#*?~wsk}) z4&_5@qxWt*to@?YRD!p+0g0f`-$M(fC_x8z#QnT1Np~)kbw6Nr zFB(N(7#6`ez80LyD>uj*ll$BrVag_#G&CGOp-rI6(+0S=3CDSPccPn%SGETv*%Krn zmoKZ9Guj+uv>6NDEuy9kI^2>|<2x;_tDF7}1ENz%&>4OEJu%Z9rJNhsWsO+`Q$?#! zEOvD>_+!2vt4<*ot{0LQ7-p@k7y+EPglBrJ1;!4V{~71hm?=kua9>B77ycLCJGls} zssQ(kn$N%}K~Q#rR4U3fW)HcG@E%izkVCg5)^W6Kl8W z@}kXj6`Dn-pRSUWEM~Ni5R8nhwOdgct5*r{|8RxaqlIEq5HKmYh2b!LYEk4q(rZ$T zKW1wygn(mU?RPmV(crJ}Ct|1Sozj2CuEc`Fx{5O2=X#isj2=P`t{iDjWLV6SSHFOc zQL-kC0#wCN{#WC=1RYY$H|Z81U_aL7vk$R85Cmj{R5>~Q9$XwXT<3x}8sJMp!_)?L zgNzgloJRc^x+6nv5ob||Q?)#|;@lUU+1qPs#k_>QQ*(Zq!PyG?>M335Pr${oP_>wq z9u5XEo_&ak+=je>22-0X-gZvU>#yl$SkFs1*w=g$k4%&i@aNciin};6j3`_NcxA&B zC#U7aMgU_jhB%xJ_i;Y(=a(2{4?8$Fcz zYqD8Jj8*SOrq>*ttf8V4O_bIwkWY=DRK*63F&I*yA|xWkX_OJs3MwIiW!?noXf0&k z?9pl1Y}YbKUVSq!Bo^CQM$~s#m0KdSv;o0Z)WOBRlFf1S$lauOAWhe$VK@Gy0TAhV zl=@#WEhA%UKhsu4L-k>2$$fnnILH9N7sWlRyT&mFAD0%*>A7WTcE!Ym&N>nfE6uLC znIJ>vJ}1}S#u-suOUP%g8!n>iVVJ47#c3Z1o|t4)PwE41Hy<@(95#WY#WypalAWe` zYRTi-=XVL+&*dTjS75c_$izpOT3BU^Dsv0X`x&J6Tj_IS@noy*`!Fn&_LPxP&bANS zf|lKXb)kx{L?A@_J|#Nr(;M)Hli8P0CSt?FwgAdVWR~CWeOe%uTonHiMbC^=q$$M< zQu94)WQZU#<7bm|-BHVF;3IfL$wp@VutK+l8@Un9NNZdRwcCKK&E7v>>KzuMg0@Qg zfRw58*f8soPs~HFH9wK%T&m;LGO5#%SnOc6TIit`BVM#s@wUF4q0^M<`!8QX%Pui- zz#R>W@8c#oCrA2+f3=Cb*sAb-R05d3H&9*D^5ORZ(7?Y&uG~ZS+$0o@^H}rX&Ai#fxa24glzA88_D-pSES_xD zaD;gH%!YJ_g9zK>0Md+tZi}&MuD_K1mIe|V;;So%;rvFIwZN91!8UOCFQVZUi(YR> zt&fPur1VpkwqSRUwXYm92hYD^^PA1btw=t7ik~bNsvg>+#4{Eu6^nm*>v2;rg^$AxH1Qy@;;Pr&!WEG9(%w}{U;ahRzYqEV{+-9YuF=SIUizWe6QcBqH{LkS9*v#{kH+~}tWyB`ro zraBc~r*(f74#z^XL1hp0owfn&dOk*N&Dn3v`fSw;4uI*ff3xQ+Mg2OA+RckHk~sAP zh)A!~pvKkPJJv3%+_glo6ZXlr)~_JM_T#>yx>^PjmhI~R$fxr4D~|v| zCNkZzEbb%Acl$edXzC4}6-sWuf)RPCI&YV~rZ{PUAtD(`z`9my7}^G9zO)j1MijHB z@up94$0<>W3DqhLi-`Ydp6N%QYY=1M%%NKT*32MPn{zNxk6UYxC;gm({I|8L-<7Q8 zlHH&Z{3=Veo#b+AeuE+gIp8q^54K}>RO~=pIDga*GjvkZ9I`hrjU7_KqwyMpr{=^Z zuvun-5K`XIrv=m|YxkE3YC3Mo)_;q16DTP*Iwi`ZXs`m;kZ%rMJp&?3Kb;>qr~$`> zJd+}#%dk2VQsRxjjw;BoMZ|NrG}(m1Y;N>Ml0+WioyuONzstvYIg%@J)$HuyT?`s~ zRB5G{M=8S*2`@uV{=+R+++r;Uc1jH7@O|y^%d$lT?$!G`1?I zDoW9@4MGv-ecvygpb}p9Y1$?#4FhnAMq|P%G6JW_2K;2A$dD+a*~aiu9MSdqiqC-h zE*i%C{qFmBV9gqS|8da%I|4VkvJcyZ@fYs#rH3vsnl}FsT|RK(`Q>e$iAYrQ5Xi-S zd27o*{`d-nk`zAtr&bp<%=!XKn_sMqssu@2wb^8o=NYf{h)06wM!w9SuRYUvEel|! z4cHgbV9aNQTn@B^cc_);UqcJ2>*FS)iKbvowYK(FHkd$d^HA=0KS3hTr1}D@vvV_Y z&y7I#jf-D9dRWho|3cc2=@WV8&!k+CLs1Qv{6Yn%&3;go4H>wG(Wxt8_wV4N{z^WnfDv0jDQk*%S`Wq6#?6{}KE*V>xvbMwFF0*H zyd`y&O&SdJsMAnldWH)W(N24>{im+Y^0=k$f2wT)T*-dGNCK~M8~1t>DG|TCECIL* z08NH38;N1Z=fQSWqkJj}O4(2?4_PrWgnGcMi?9>pA<8@n?a#VLCprzWfUWG@Crq15 z_P>2)fS9sfH)!9f6m}+BlU?e|a}s=jbb}f3WEgGho=Fv)8ve)Qn|G3#k@5PUY^Bi2 z5Lm7~&@m?~ekjBku| zeZil)<4(5S7b>D*0E_93H>jQ1CDW2AzR-;F2s&3jXsVP^yH@ccjPhIO#S?t=NgVej zq>y10$Wn|!N=30aR*n301_0e9e_*6PrI?DtEb6^Hn9kSuqW6pIMGOR{CyUGcc032I zFb*&VB}LXkeqMx(N@^-{5ZOuNL^ImG#m9;crt(9dlb`;1LUTw=43_wdOrghy2ui46 zd$tjxvoFwBdAh|!c{|bgYu@7~bi`PYGC?Ae?XSwuu9*<4?grCxmizKuPX_c}F1hbt zFzEmDFIO_3F#1|K^o}>0qI^OfA{m9`OWYj1MDn!@B6vWIp=k5GJZrH-&7s{?3YrQ zz*_y6w;E$3<6@c37n6SH2UHLMNx%n1DAP&O0ES&U)pj*p{ zAmz+X(#MMJWw`ndhwt}eU;pdwM?$I77>zY^|3C3qDVLc}6)Tr%-`X!29wv;WZxlMB zZ?c6&Hg8R&|1HFU9u|c!0u=FeVNw&XK4jJ!_R-jyV0KBuRh*`f*S#P z7LZHJT-|zi1&nIl*A6r*eoM>C>%a9(i-(I**9(mS&&t`*bAXGEVk!%7RLuCbiFx~L zK5wdlj1}?tO`sh4l_k%ZhXW54dUy8UoJVn+8_$5GwgIj8*0ojIh8r6jwBOpVs1y5{ z{_hxJ=f&r9mtx=dmKZONOb!6Pdq)uKW%i_xP;#ELXfwMCHs!xtLJr3rBdxLP|(DUqR zT4?%h`P)Q2Q$PIw*s|5eJadLdpV{P0^njKXpA2@^EfF=V_hTTH{2hQXrj5GKn$9Ke zd^((3X(PEfJQjnety8jI@35 zC_as&&|_gylj-ubmH+JXxP~wrAzr|+otsy%d3Hv!Ryyxck63I#q_1P%3MMKmdrHus z9-NT~Hwt_IiTkz|2c&Dq?*7@HP?%oh`tMB@^s!5wa{8Z<7WDK#UT6T9ygy07zw@#G zD(^K4qyTLVI9FZ9>5VSrq5^ko77zLG&=;ycH8Voc#1F(aa{EOH?DqCbL^j6&d(n_Y z)MP4r3tm`wN#8B9?$i!9$plc8GozYqiRl~L^ytP>mWpNfzgRY8Aw=n=LTTqx${sHi zm|X?5q6ObXlq_9Ki~%RRL~C1@g^a_wPrjDk^xNYWa%sV{agb>7TX6H zR(Nu<%Eq2eoV*D?Re!fwRJ%hn=l^>FI*v8TfU=&>OS-R9`(+57CxDQ3d!KT3`pc}j zf;hDQ&m~=Xw!}<1X1}E(*BN)WaNzyyPrsYnDT%rdBfom`gGYR0%77gi{b{eBsp1%; zvd(+J0Pl(U0rt6&v>==6-OYG$sYe3Lj`Zwv-rp#K!H(U>(TeA~3 zS)G@yhiDnh6h-?3f+J8Updj7K#YwQkfB6=E#kDf%n_wgbRAArVWRl}rqra*ek)@;BjT}?rY%7j(j;v-@7a?Z9zMs*F7@4Q) zkKpjq)U=mW6y`=g_#wc2qDPu!*%NG%t-E3&L`_w)wT1xyr@1z`OL1hsfWk(5eklE*8#71LF^5liFDF@JuBx0MQM87+w9Rae6lV+_G+d?d*)I zF9g(UPMPK_ImWN=hz+O3{*tLm&N&>qeCY3MgFfbL$-jcD3L{r6`hC9;4|HhxmnN!$ znf1{7{X#(F?*d|f`TqH>S8bQ`HZyU8*liR9$>@iMlyNoZ=M{J?f?Z=tEIt#7G2?oD zEWFOW_A9awB~dRz*NeYBT`_MExJNm;d3r|txUYJbH^bJiDnXI=1mzTjZ0v7VC5TG2 z43u?mNdwO@Bt`QP`{XlC{Dzq`r4CorajFL^eG_bF={M~O3o|aa z%kQ0w@}9+^eYO^$gj%wPY4tkoyp7Z}CMA+UKZ~hG+;$I47&bMQ%83}<%DJ}1li81A zdrh2$Y#1n!xx351yu_7_{YX4ki7)17M@Jm<^OSyz?hxNlnOq5R8Mr2-0tO$;y5q)M ztu{SxMNEr`jv=1-#rwzFI;Ke(}JY>f4(F+$|t zkHxO9j+q2e)Exnu%zxt}#X1Rlyq}{Wl91k@;>M8osSikM;aN9UDslV7;_{|(`dACc zC;!u>*}p&n(4JyRZF) zbLM<~kNBHPJKV>PZdGiukXh=+#@XvnrZ?=~m%sH+c{|)AX;30T{e*IVhJ|k{{e|K+ z?yrM7uDgZLFgj=nFpnSj+xqnGU8m5d9^&3yEqYT1CG@>~-X2b2>Q4+RJY#)GGJP~X zoqYLxy_g|DPFaI+Q;qgN@ag56<|*$=IjX^YDZHa)R zE?uYB;p6`*8G(9DzI>_Hp0xg?W^9TN@0bj}jC!f7mCr>>Hqd3fM9!*`3KeC>VFEq6 znWUEE91+Wb|1}Fep`h6LD$2ZjM~y>gw=?Y;W?Xs|_vdUdt$jbR4_61*#9xR)*O3Ioayk+NydNZYzzB z`~{9uT~=A>^}&u5fS)+sI<*9fL>Cv0f@uI|qgwGF_mEjrzt|C*yqp<%EtWM;T1=Nw zU%RiQ)lZzY>XDil)<#GdVWF;a;9$&0lVw@FG0#Pks)!_&?|<0Y&Z{T4HYh25;Ke)1 z=N{ht^u0nwmz{V(T-{2b-LR5(4AKBH1NCc?8a^GRc>=`Wka-qp2!~q4)Baa!=UZGv zG_N27jGRW>^Pftqag}0af~grt^Y}k)9)otra$1yCh%5gI$txv%NPkNE%!!9$alqH&xnJ)pT8na&!#=!x3m;U{lIT&#yU@^ zF{N6?#rS7(NBYs{zg_&QJ*1G^`eX0*6gqNt|M<2os4=!pSdED zB_5lul@DMee^uqPhGz#R>$hq($zW{|ANnTk8m0rZO6nQtC<~?SU<{S9*b-T4>Q3W* z?qdk?U0mi7DtOa)n=bj%tXS=cXhuw12e7%xn=l2F8Aw6Cz+*?JKun8K&q zm_2Dy!qb@wJsRIkOtXe8=!A5C?6%MXyo?7)bU9@`^SzGOa$mWy3>F(bYa<@@4I0WUkPGS*Lf0g=A(E3tR$GCKuDXLlB!n#uZ{m-kyY z0!L*vLeLn`n_USPhb&dg<}XZoxWMz?p5s`uEj1vC3qGEIFzIB*{KvpUC{%_0?5n}b{7-?8^1W}UlgWiPXa}^ZT8AS;> zrF||zg+81Z;(?T6nQa;@{0;{Wc$?v6+(*RycB4smEui@l>Gn1mohM()a--=JulT_k zkfR1H_o^&537_vF=_DG@-_$q_q*z*=>Da#&>nBi*wb;82AsbM!XkP((wJqvdY%wdJ z6n(DI29JVmKd^pF3cml??O>2*;%@`E_gnIfUk}xW(<&OjUIirWFXgb5w4)<}rY8N( z`p6DTE7OAr?3_hQEk0g2x z6gFDlDb z>|i_yQiGfnMYQuViQYpn-<-jAJZ9M#hie@{^V(Pt*5n<7p_M+7QZa#WQad_88bMX( zAAHZNkJh5Eq36x+>I@g#Q5K3P%387|Zreira8s3(q;vi{J2og5$X`?~p4I_Hg3 zK0D&4{aw}ZZ15>9D+O-B=rg~u&^yso2hedj+E3yE7KnUy#DxK*%_D{=3rZjb=jd9q z|Ne}knh_Sw%T6@mkj9luwbEmdSY4%SENXx)MW2)z zM}pK_7Fr$Z(SD5f9s+aA4Nh*`$?quk_L3hLOr_`0O=9l8ZvLYcKp!KidZMZF6Q@iq z;Dl45gnM{rKn|(&YxGPa!!;u&X(OM8#we*^&w>!nXSVyX9>|X^Hm=jH%Kn?o9OD5V z;O?lTu4<%}A^6a)HK~!o?sa(hzj&qd(PlwKP|GU?nw!m#<%UqjRgE#?qsn>!w7s)q z3xG7eozU{9W=OPH#XvKjd3#;wbpj$@Wq{_y8(F-4jZ)zRzyUzvto?{S?k9+%!GvJ~ z%Oa(+J{fD8z5-N63!e!TuxehTU&M`z5Kb)O$Y-X?-L5wy5?|ZfBUwF{JjU!?>+rB2 z5q-#}EH3^I>umt>r}3fT@#buNA!}tBh+mFqdf;UfbL0~_LX+pCuG zQzO~Q^FgbOZB1hesboLhrFUIB`YafK4ElP`NRy8$)M|v>o~P}7|19rrWc=#XXGm~I zUMwgg)in|Inn4-k`=hNw+HVp_(PmoS;FISqhdoV73o4L4`z<@=`z1dm$UpC-OZIn| zj3omI!lcdu_PJMx?tr4gbpGY9wPfY+9q*RgsHr^Bl}9?1c%QvRC{aq*W8|`nMf-PuAeIh~@#7`ohC2@5K zOg6_4M?d0%Zr?oOgVq4NeCE`|-SePx(+!%(ZDEUioBw%Zq;G8>Jz#?WA#typ3vQ43 z#@LZ+Z+{I7biYF;dT4Gre65evCi|>K&YFglc$@$EhKaF{6J)Zw0hsoa0F2U=tv98q z&*sSQo^K)qWg62nmZiEyZ_;PHLi7Tv}OPpDK7r@;=+*1Bmk&xz01*`?$}|ek^{D zGh0P*7T<1fV|p&LfUJHdEC+ zWgL-t+SbbW2Y&cv4U$CzaV5b5k=k}zqHmV|6j)xY~eHz_T^@_R7*+@`LE#a3PJ_kl* z2fJngnnkft2{LO3J3!+_M-3nKdou$kG5sSiP*eLN%;pPF(a9ooI8+vn5*04OuEs{I zh|B;E5T6V=2M2f6O~|o7_~=WGYB-VOvxSBT6q1prQF{I#Orz4|UMg5yZrE@q&uU@l+jE$aI7 z+p|`bUEZ#5)m~}8qfDjeZUboko?m7zOD$U99HZnoE#dY%te^e**YVk2iw&srQ|U(! z#2WCvX%t8T{maVXF+TZ)^-MpB%kv=Wh5Adw+x8oCggK5>-}1~Ulc^Gx1IPXin)O~o zqrXUeZ)$ISIZA_sHfZTcWGZE6{1F|UaYXo;b?*n(&9fje;cDfuu^Q3EWQ@ueZPI*1 zW4c*Ld{PPpzKx_q@d8jKz`? zlM6=NTu>-wF|Rtk@H@X;=M4L2#wLIuCiMM>iaXuhVbXv{n5yHix`+wPb6y~3KKie; z&peD|w$Uh%+={A9=xYO)?tEJ4%4VdFa=CR_!y!{ikNd>^nnAA=h~ zz@)=!(CBqPz(Yb%I`K88JRQj9S=4+<9)WPFPsO)znN=2FN6l{xrr}o14qu3$am(p! zbNZGz58m9nv?}KB%sG*dt9)d@G|sK$^vHS^6v0?+nPbbSPliGK=Rh_1iEO7$d*||1 z@NdAQjX#(wjcnjXw@jZna&48=l!!_N{QtHebZW~?1fR5%Lydvm4q)bjcX|c&*tD-5 zzx;Ttxa2|zEYdXSO$!IUe&UaR6$=oS<)l?LQ;mIcT5M9Wh+Q`x@S-6iz1;ugO<1E? zIWca`5hhQjjT2C7_-CJ`fM5ScTOM9HL$>MfErd2iQ>*5A-S zZxhqPQ~l-Xce+Y+XcT+W=vuqnY|?mz?=SweQBH8ZP(v&Bj_p$@lUw65(=Z;eZ8FL? zHp{1LUGkorV5^P_CK=hGC+1C0cU@V(a~gr;9-;w5V?}X$dPUcuh15dUyZh+NTA5kG zEqzUzi|zrIrwOg%vA=jL@{?wEM*Wl&wEEmskCbKdM`xQd#diwb-v?*ca=h9KBSgz6 zZYsjBMdC~;c~XX$3W&RLfDuhKZv@deC-7easjCR0F=EsAGuVu|rPzSy?#WaI#QJ^5 z3=olJ92T(h$>1NXp9J1jfckY04_>$Wdk-Er$N)WI)%GPvsu<@M)RhOT+B(1iE(^95 zs>_1b*5ydNjF~Y@e_vVWLtIIRh7c5;T6>t&TNxf_Wx)u^x*$SU%1XcF0iQ0F>;`xC zyug&4mt>sbmL)3Od2glD66HZ2*9$wO0wX9%WlQw2VYaU1?@lzwlYdI1sM=6guSRSQ zDun%^P`vP$GPX&RIN5_)+{lvilmUzj3FVK}Ka9lUEE2M!G5tRRRk**`5O_?TnO%OE zHn9>Ko=k^APf}jW1>3^oay7ra$SZx79?T&=8rBIr!!6~*$Z;TLW@ctgymRxB5f3Mh4JGC^QMJAxLTN*k)^U{b z9Z{RcR!I>DsgD4OXOi;=s7?(%u0Ol!x7h>ZFoXj|Os78>Y5Dyn3)k4Wzk8;|~;k4%v1 zj)Y*?88P1HF^g2{g}7i<8c5{?Vds|JF-JKVIbapVaC}3tV|#j{Uf7bJI>4(S7Xfvu zlatHOQ*v~AFB48TxV7m`xaIee5t&^^mbN&ANXCJF8A{dOSJihtz@$VKugQT;^E}D0 ziG%pYNMhgPw&?+W)snhA*JIFivIP#=*iMrTZP=vYL`S*LarJ2471GC@GzAGu)26^k z6!^uD&Z%ukI$^+;+O`qx0^ut&vr*4RA$Fr7@HGSn0b^t2+B0z?O*N|H@)W$V?+!(a z(XdIOFApd5V<`k1QpB=ryArX)13DQqUl|poz?~jECG7%vrV<5q0R!L3x9!y-57!=% z%ow>z#6J||B$`6>C{oM2c@q@Kx~m&-Nh|c59`KlgndQV^5^mHoer?2~qd?!oN#jCIy`<#or z3eP#0K~W}~0UQ^R6r{4`XH@}1X2g^9yyFp_6rLNtRpA!_7K!Zh0ykEV^v|d_eG8os zEUiYIRzofqE8RX=e2TVcj4Il>b;_0GPozHENExZOBv*uN`WDqI;?r8ft`VI)Bl0eG z@}4G!aaMkus(}tO*|e}hWjlgdwSd~_Y3eej2p_0aFCi^~B4u%nK9Avzd~FT%rt4rxu5;$tj_Ir&0#t965Fm3n6*5yggm9~U##j9eCiD0E_ztTowxKdmBG z+`8YjE>E3rw(Wi?j8{vs!>)WUyXeU=Ok%Bk{({jJ4-JSvYLSWVwR8we+tVo&;erFc zE!Y9(I%q0QIT9zmm*2XkOx2uL0hx|{<5H4L*&mYg&p=_Oa}>B@bQ9=OpX`XFgcjsX zf|>MbTM0ISc|+i>i3TXS_{S=}kzgEkl$_!*%DYDd572ZC)MLkLxlbdW`{!3wTC)%k zR}&5DY8hlwSpB%)-2nTfFpu#A?!cC>-akkO)tH9)YkxiGppGo!kw8}}N&LHz?=<+{ zraCyMQKMiP)Meg4V4adeC!w+CZNpfpSL;`h6;0v~*CD6;oSp7JYF_u6t#{ptE+dY* z->XN2z?BECq&s1d3A&r|+3{IpX1(MOi-#f3 zT6A}m)yCS%$RY;J#K>yEW)8TcurJt1plC-SboQn83X7K|JhG4n%3rkvMd<_e2phaI zuAS?6>=}cDD}-(uuvTRoKmuA7BV)}xk(P{Oj9XC_`VP0M!s@Bu*siFJMe~=z>@9y_ z4@K8s9ULT8^%P7YNII0NQ!~S1kRTb)Odf|xT;jY)Km6(E!?;DA3m`XYkyG_ez#y>~ z(GGP)V6R)|?NC@UnQ&a*Iq-pPy{DfU)faqOD_h{4Gs^^l=POxQ;i`>je8lkf+iKg{ znCAW?u}K-?F$80q?6;EabL;zOgUy7|;-YlEgifg#*TR)1f90;_@vMl~C<>6>&sX3C zSOx3;o zL<6*zj@PBs&a~|AxXN1Ez$m5o>c67uVe5zn8rKe{C}K;&(cve#=OVO=kQs%I7}T@a zpDeCklnS-@FEBIE6k-cE?7+G;zB^3mh`#J@EuU692O{O*oKvsTW~(eKcnOZ*!f^!r z`){_j9I4`S`YusCU@-!GI} z+dgcIcFOR70cL_Er?luk*!~&R_aY^AK~|Yj_Boo>0vR3z_i#rU`-FKTcd!TGm@h-` zmfSyv{}AW;xhY+8z;@!2!!BZ*WglIH~4HDzcs!$B7=hO350&O7JziX(=1~qY&0i%Kno7-eAI;PS`HQ78L4P0oR64gwy#7YF&t7UglH>PiFxxc z<4sp%$9dlFEgIlvKUw^7AGAJSXUp-@tA69AqRP>(QY(Y?Y^^!5*rNns!FRhNH{zhY zab(Vb6~V@9HQL4b)W1%3EyhpL0C_cu| zVz52r;hlRyoZiP4whjH&%W47Q>Jpflf5VH)IPd4RiANrZ*h`^0=PEc>Vo^I{b7Gkr z7#5WTD;mWwb5VRlYtKa!d9y_kvdQNF99ceF&hh;Ktt?b^YS5)%$x$M_WHx$>WxEU_ z`u|=4CXn0njh-wec%fghr9~EsK5O&t3VRwqU&=JLM}Uji?%wH@8akANmC?<;<5a4% zJM16v-zrLJ)1_~W>U_9N2o#C?@ALf8tr$xu^)2)4?FLWnG=&to=v5C9Vw_ME>MGn0 z%u4dF8z>lRdcH2XydHhGH~&6Cs=Pk2n7z1Lx#BQ-T8Zb?!Q%$HqMp7NHd2{eW-NFk z9%gXZq0iLvJ=p^d*k2O`lV4D$6^VT4^b5Mnw$D#t1s(c1{O10!jX>&>_p0^t;l#+RT^m2?gemN3=JOE#LY( zg=`KCDAlyGM*X&onY(fGX>yhm1`^Z^-qZe^d>50fRI(;;@c57yl#mp3w+XC_vNul{ z8y=7ejqUsFrhcc=cg2l?4+*{@!s%uwRR#Xe_-l)+1GCrr{PeVVfcFXbi6Nj=?eyr~ z4;rA{2KHY!vt|2hbjIz!w<{>AyN%}$FsYLe!nOaX5CFaX6V}hJZtp3DHpnN5pU>BK zTaLcnodaEp-x671Y|ZKp8$gE7T2u(5mNu?86sV!BnRgoZ0??A-ND_^FiLT$jg*vt! z^Vg;xPsdI-;@-&V=*%5@QT7vSm*mmaLC~M4aW9D9k|KW9NyNO zXi&Vi@sfiI;`QNoN7r&|346BiCRWS<7IkZ_lHux^5h3k0W?qVW%un4K@}dQIqbD&opVW!HV*@nOS7+5eO<(Dv*Nmh3fA z;+&uxm@#yW7#@BK{AnZzuejS+XRQ;0Z7q1ly|dk`OsC-B?C=X6NbwW&H^^&|0R}Jm z{B>7}pN2@?(O=1La)8<^WE5S$57SPtP-EQ z7cbj79i$Y4gmi2(TsS;y!#?jueCa8)ar-sYc5DM; zKw|CQe;R}9HY0SiOS8`pg<3lL#|b5lZ+77Ec8==v6`?wE@~}S;MuQq)Q{j_u)|4%r z$Xv@^T)&210zj#hEkRa0`(MoKT?BLUgo`3%gV5A0^LKfT3+Ik6_1EWtuQ8dVw zLsSXq+YnbTC#4I~^GsZhPZQj=(`y;I?+taHw0Z1WJn#y?6hh}*;L_cWDJebj^Zg;^ z?Vyj6tn97o7M#dsS449#Q#?ySN%g*jJWMj{1F$X8XRbX%ym&wjBk=4kEZhiq=dj>I z$6weIAfE?C-v&exfnDAJ+njHFYRnckc3NbBpsPHRZ%susF!TF_zDb`Oh*6mFqgOK5 zJOz`H?~hRHWzOnzQ)KN>$!l#~U6E%`=<`ri6b=9NvnG+t-(g>znV-zp%3RVeEp-J5 zp&ntesF`3;C2MS3m&nL?>VX*mo_cWYao4JoNWegQeluT1V#W2~HLICcw=Q^y4^tBGENA;uLaT~2_f1Euxg0Rn%3kBLlF?|Nc$ z-0Os=C4Ia@O9ulX@AxjC4k(k3g~{nW!K==&f5Yt_w%pMxD7ve{N`bSl^i?{Z^o+Ax zWMq!P5d2XnkHTbjbHk!nO+QwV7iaedfU~f=+GHt+>?hlbwj@H;E@|^cKgIuxfzT1c*pwW z^Tm5OSm{}J`Tg#JNJf0ARdv&9%K*B+9hwZ&ZQ|{fn>IR#0}~0Xw07cyMdu({j`E2-Y$+TXJ0E7)0S&VOm4v+tV+*M4IT;i1nV&Kf(HFz8qG6wVt{3MOruKax|LAS+p# z{yOTKzb7&XGOs}6Z!k@YJ^YeG>s!6V~Q;-(Oy!i)1GRg{T~1({*Rha&O!n<98+ZW6M*Uth;d z3*({FwvrQ@dBb#5d*4Rx0-|37Rw5!T)RHx~ShTw**glu&TA-g8ZQVY%dZl9Elg!tW z@9{!C6hCo7kV_!_uT(m1vMRr3K7M_Q$1Go+a8P7Z8KE7k1Ogo$xd1C{ z;F!TBy@4w5y zsxFV*T>4#){vCF2MS<*(hCQv?QK82iDJc&8dD^{(T={YyutmFKJ~eG-J)P{O0`4^9 zNH>6*-gmXBJ-yZkNN(m0NTdKVfe=Ys^d} zI>Jg((D^R@zs`~CQ-()uKtjIR|F*u#a4RBp`By{6@w|;D+S8SGdG=D0cJ@6hsU33+ z>k4{TJ)7PVf`d>S)puOCKWC5>GpeRG5dc))1QZmJ>khLX9UT$DA=6vm!@i6@-_^!p zx2PqC9MH&>^j7Vs>>xVIhEg|d+WOaBJLl&yWd{&@Y$&d@y)S^T2K7*fD*1;6O_v{i zN5JNf<-QpV%Dqfhfpd7}Mnm2(5s``7AxPjXC~I2NPwz`|;GFu3;ps|CNfX9zdwN7w zO1zk|e;sPDfOxCvWVJ7bORm}fG`*}sLn`ZcL}{7At2eVZ{f5$y{t+Rh-i`vBgQO7~ zA6S7O40rtB$PqCUNqJ1$2PN}^Eha>8#`nh*Qmj;t&F}s4wW7U)6U{0F#C#h}sUB^O zcdx<0uj0`(LXn)_QPKHO-mm!fMoc-O5C>2-T!ckZlyF?~=F|DTK&)3^Rx8u-pnU=kwS zEVsK`BYa?#I!j3cfdUU_1M!c89&b-mlKdgkSC-O||CQKyAN#Gwp*m3Q*B=>fK4Q58 z;}E3;3XKkBqaAtiaf>q6?k%#Mm)LPLH8-G;8=~2+@U=aUFO$Wq_a&V=>Yt z-&Rm9p>1HTA}r6gLiee$iOFZSo?ld#DMXqXtiXvOR0!8?GIVrmY=yMp)8bBCN^WQ8 zk{7A9*YN~Ic6@F^-=VvTLca-wL(vuw$pZ?QZCd;K{uVLWhLv%kKM%(Zeb3qK*(h{R;#D{lo z0c#gNmds{Hgql>G7hip3=ll3@Gu$}>ka{nbv&Wdly+sspmgZB7dj-{<#-7$meEw#%x>r4Dx2n%c1J#hX;k{CpCicb-VhrB0$NuLDu5VT1QCZ3aH_`^DS3THp(d3Q2hZ^oaxM;liKp7I za@_M-#xQH7xsqAsjyD15#H$auzrx@b5&xdUk8qvNpF(E#g@lVF_sSwY$pJ$?;2#*M zqy5%#gCj0R;S1V{Ddz3o#Ho1hVZKDkip%P{-r_icwub{8`F!Rv!M8eQKi+(d|GDf%cr2OI zqN+Aq#SjhpOy$a;2)KwaH$z&ufD4PDpWs|@(^Uc{Rza5C=THv>Z2%cM$iSa9hrpT(;9eoYjg7zp=M5w4q?Gr&)_&ji z;NVWdv>Wk-wYs^4gWh`Ok{n9>X+lzdm+GgV#uL!dnIK>~f@iwr7$Ffzi?uBFVj;Ff z^DkUCRk68O`Orxlh0VWpFP$3w;-|v+PFZlt1x^=qPa z0mB!zgAU?w6*1fQnDOj|>gS@^nz@RQXYnydLLLjlxvY#E-ga6U*5JdqBGubeB+k`Jzc zJA}`$u9g%#`1Igys`VC^4!K|y^8g9u+esubwp|P1R`}c3`ATU@WnP1wM4YT>-CM!e zC=jnVsbeRaSHpp!8Pqu6-dSAk5-s4}MV;DI$%11J2iHL47wuAcZ`d5;Z))d7reT5j ziZuf0VAo*Ft`~ePBE3P$Gc8yNWCJ2;ejy-+2JH8Kb+K-^YR9ZL{zV0B8 zY;LkR#~#sdD}E(*)sSiauHFTSX6E3*wyi!eTUEsLXUGXTKTPz+AH)F8MvwfK0Mn-y zdy7wE{p=^J9BPhuhmC+(cJ7avkwydk;o-(q+|Ec$8o~Xvig$zmlTeCDzAx&P_ukjz zpQ|@U(%1|Vul??Y?yeqB7rp(jqM7%DJB}v=_}-7&UPyiosujmip#~FYScLOgyT1^n zPqHId6Eo#-Gd`7Se!P_IU6^<4`Rx@aF*Z^EY^e69Z@c={k>I2CUpiCv>VtRUAYcZg zI$CNDo0@t>DUkMIO>&5}*Y6@A>e4r_^UgkJyy00bcmIFDC2;S&Icwj)1AMKAs7@|# z7{@iAY-al3{CVyXgIWS2KDLs3-hgAMKKh6oADgIQGub(ND3ln}4uVLS&J-lA@4ZLV ziO~|P{!H_kJ*So_F+G+@Va?KB_f8b_3jDE=sN@G*88+(HBAI;DhTZKnvqhn?2}KgU zItT;p#>S}GcU%gbE*rW#F%}lwykYCH_j1-$?Ho_R_EEKXW!R-w_cZ*MbtE0_mMtIh z*YcL}o`#%svVdvy>O>Lg?GxILWQ%`u;}rS^Go>;HB~^S1EVBJtud)SZD#vDufWn9kO0%w$KVPP7zlu>} zDpKmJVO#k}M#nMBqb1Yd@RCm~kb4Y)Q^^kML zpyrph=sDSWe~UVuND3qa^|CJgkoM@Nm+(H>@wXN}EN%D5p=J99h^3MhUIJ((RBL7RRns98Y9q2$F{+*bGZHkNh&SHTnkSkQr{IcozJKci;0 znwJ@1^;Fg2t$9)T7hL(tI5eXS6`&#N#iHMVc>YOXcM7W<~ zYbRTvDpbZR*goz?!F$svQ}KBN@?B@ONPM=9>am^P>2-t@X{NcLAdU|^LJbKl%aW$McRtAYx%RhOW znx$!{Fy0x{9^9g-z4~l>SgJI1|DRY78Hz;`75xN#*ZXSr+f&j#@$KBv6~`-uO7)1z zma5Z{Hvwq}55pwRi>y0gR0BznnQ##!23x8liBkx@lz(^;x2AB3F@b6WQ>VD%8mwc; z#!r`%1&hILjsZycnSJlFm@uPe=gy&?u{-d>Lax}mxAJBLch$wc)Ygf)big={nKKu> zl#X#o0SlAyCJ+GOuHoNc`PXK&SgOWtCOqWnhfa774F{i{cJXv{Ug0TdShiNE00Yuy zC*^-7cGMs1W%3=v&8k-!2JAm_4R9@sXDMy2o$Zk%F%+2RKu=zOn+1@NcC9>|cjR#x zPw$$V`g)t(a#PRY@tuP)3I=2{^^C}T01SC>uX{+;H|g*Zj!Xc331HBe6gr!+ z4Qv48_-mib*uIuY@B4{O1hl*?hZ%DYd;Ja^SK75jtFG}vgx1$v_@e>$7gKKPwuc*L zfWP3>h($}_r>zr4$yTAu4uDF47k;_Fe3Xon$fRj=yG5JWpK+@Q*U|Ofn2CJmimk-j z>S*|GuQYVzOLU+_1IOH{oTHp*H%`;Sk?4&b+Og#5^G3mA`H0#Q)I@_~Zf@?{-5qWJ zl@d$zGX16q|9aH+O2_fXC$4Tj02*vwrWkH8*|O|Km*xyx5?uR}Y1-$va&BVRni2Px zSWnN$D!X?bzWVQEf_bUKGxnFwE)@%He+pc=m``3|{ zd_Exm3XX*GJ2F>p>gZ^O2xB_E7$*C0v9SLQNMho2i^%@POB&r=;LK9Rt4(x)xJ^L1XozJ5XaQ1jZf; z&#(t%{|en<2-{Y6ga@g`2~-9!>$!csxJNWv&a4d` zIMPk2r`C;S7Mlq_9Ny`6f=04zHaFs6=IJ=Vuw$xUd7Hn_atB_MP^{<5&7!v4)5uo7YmgXux~XW&a#Dmdt>yZkx zpzT9gKA>#}&zc6&HM*?+^sSFWXM7kj$xg1V8$4VLbf*f&0=DV>-j@Y->m zAlcxglrdF2Sm?{_UGZ>BXlB*lg+(PKwnPA9D~7f?uEM!-*{GoBrX5l9I4IvzbS<2O+12{zA7b&T8) z3hC6|Q>-_T=sq_~znpPe@YD1F#>+^*$nGfq}cw$8;Ntg0AIxJPxifZH= zmqHVf4Sy68v9?iHgA|}*ss4a4lYMVXBHAnwE-dm#b2TXjBzH*#UiI^O)_f!(a~l-v zMwMO2l86t=;;7(DOq53_2Hf@6OFL3npU47_b{=Q|yFJJfL`1Asv|*M1q?R$AZ3BHZ zE}7&b%Ot6N;OjbZW2;aiQ60@KlaqtF!3_e@Zv>lJ+pjw(sk;=z489( z<5i^D$@cf8j`s|Ka=h0s#~12o`hKgm+6y0!IFCu3qtVgP8snSYX6HT!R?<9zv;(O^Q^=~JZ$)ua_)4~RJ!>DMhvEm_>Trh z%{^|58brrZvszZmo)O9?e9>lk>7|Q_!>jE+VX$J_^1^xTPF0(jC|n7%E_LIkl_G*) zut`a*{I!jal2U+NCx&Z?Hi(21Q^nk{W0(@1l-VEr@&xn4*nFzDmsT+NsR&dR*4hh# z*9t55VhGs^;SkFf$qd!56)9TjoEYaOKTwG5n{d|tcmj$bo56~1f2)%LkSTz+!1Paa zA-~=KJ4A^%^b9#8`jZ$w=PvZRcVV;y-#;jsl`_>kXl+;QYP-@8oYAJ8=Thu{Bzxjj zUz@cAK|~a3<01d>MlK;npY!lm%Qp#;%WLsQ|CvDbm)K1iByQHIonrU@A5CWg6y^7K z@ufQ!7Fb~=mM&>wY3Xhd5R`6^l9aAx=|(`n6-2tETe?dLkw#Ej>5}*H_n&u$VPM#0 zW_R{^?!Di0&gYyXPfmyc)+OKq@p)L0tM}xOpJZyK%uWP1VCgSuj(}nuarow@hi9%j zYhWXJCiS|eqQCG9${4;PaV0(vM6v&7lErEK!Kbc~*4xx|N0{?L_01rVQ(S0-%zoZQ z^W=VQ2xJq|Ff&NCN?kaoCsoGO`9s{cOwFE4`N>?pah5n8xvLx%y7^m$(a}~Q!AAX2 zS$}KUf|WjN+n;WkRV~WW&zGIZDVsFzsI3=iulS(&OcKFIA9Zd<%Bwe~H=*)gU%GO$#)JeTYT79xk`V zR5@cfNCsSzTix)iS(-q^q@;Rix-J#>&+%aA|2EDvz!>(NQhTkR=EcCKa+3b~74WRW z+a226GuqxMd08V}Lwo;3Ag-xQ#vtb$bruj|SqO~;iZM2(-zy_hKGFWa7XZ*%Wq|{W z(ki8+L)$VCZ~^ixTo{BUB_(1K63n0RBTN7k47RaT)Q?modny61mo;0|E9Ib%t`fw( z$=gZLu&n0+4@#P}9L+c~tfBzp*S{76N$EfhkZ?pUfJN(CdO{Zw=zHXzD2l+ToadH& zeTiRE!VY|f!kf#0yZZNzK)hMu4fPk-aG>H`*GTx0me%8%IjgRJMH`Z5hwL7~9*IDA z^u@$O;!WB9KwZ9iqU80imRA9&mmQbz-JCf|OlqFiD*0Jq&Oqr&ue`T!*Ut}@e%{c> zDfX@zCw{0Bh?mdlsvH+c#44-nV+cA?1hyLhVeY8p3Ri&hWjSgkYs;Ao>ujgZH^2L; zABQ@Q75GfL-^^8RVKY0)JM%<)eEv7UI17jZ25L|&z(3p|6(24@ZN9{Ik(ZXH40 zPM-3R9Ht(Id!qkvXo0n1d(2~?LZCP(n*(k8BH0$3n!;qFXwr+aA3?mCZ54_c@qM(8 zQHN!eynXPm`&tK^B9rY^MPWW0UaTkWpg;--SW%a&WjXrcpkN{$6Qj|&|Aa)kA%Q~C zrNFNfLX@s){1WXpYis082U zp%&>2W2&c?FM4G@+Xp%VJ`!o>9n5%5!xGuh6dJ_i_P>-syYoGY9#6>!33Zj? z9(LwY3MQgvfez@8hw`B~7(u76v7(2W`2<^K*mQU@i2z+Am|W%tyww%I!Ae7WP=J-MXStmi=Hh& zQ|ot#BGmS0Yoe;=7JdEVl=Rvz3K;}pcF@fLB(Qj(S<}YqQHS$4lMXhU1GzD8I`b$XQZxVMKEH^A*u3! z;ne1VkK4?1)+Rdts=5yiu1Wo9T)FOA20v2e9R1Mjfr_z7Z(P)TJ`K75Bsue%WWSwp z@3aDp1oDnT0JZxdai?!FR(4JbvE;0IH)yKf5Igh*!pef3*gs7RjAF_bSv8mnxd@?& z%8bgGIYjcrrzcx=g~_&`s_s7X-C}~)N++^KTfR3#JeJYli~ zo*t-;zuQd+?2#zawYgmlY2({`J0*Q-6#Q>|<9E&b_qL1TV4!F1!}6!xbGs&BIPfps zpF56AMlabtt1XjIaJN{{Uw!wjdc7wCZ^7m9<)5ssTb~!(|LubAmDA)oKoe_0);IME z;z+7;n<}-&<_28N`hS4K&A}w{_n*TbVgNl`mCu?~t}eehgSw5*ia1DDuqygOe*MV$ z-Fa~*f|3K72&nb2_8|e~d-(t`c5vK$3l%DH)$?d_&Fa=W8b(Pf6&`%+Yb;oBYdi?> zJJK;^O&m-VA~!LyS_s{@oA zLvNj?=r~140ppP}iuUwAf(n_L-vE@I;u}at>#5>o|7BB9NWNB;R&&mPKm}4g$7+@o zgi}d&uP%(ue{#yhVAgAkBdOApK(fHVa6GhFHIfEIti*BY0fd^19yLT$`I&e*h^!-I+`$bY}I3~?eELq4^ZtE{E=Tw5Hu?Fd4xdm1Tz?x4l+hDyKXRcm$orqI+p2&IMls^#*H136U_WPf;R~{}MOKY^U9MBZ%IB`5+ zybrTCG}BHHiwf%|tin>h$X7i@4Aa^%vH`} zC+mS5J_FP-Vg^j3a;k7&ci2~OxUyje{z_UKRz!>NB%iy7M~@A2z#y8UqqQ|$;2+p? z>ELlC6+mBC!wQnw*!c5LS{n$hs{oX~Iv!?tzZm)`M&Yuhz5R1=7juRLB}Kb$g&6Wa?$nO>&v?w*7v? zVF7La8l8S)%6X|`kV>vPlh zpWs|-6M8o0W! zD$o2$WJT8g@e`KcJfjo@k+SwtABF4kket|a6Fa8ww*^@E#Nig6`n2rP<~5RSlT*ei zdr!$rFfl!1D|9k(5Ht?$Px>FJ=c;SLq|bzyqGo}`fDKL~w(~EhWo$)^l$LvtyY2B{ z=Z(UN0D)Y7Te#Y9Hi}$9Eq(ZWm%>`C6NNT25qgBL`V~@7b(jmf3{91P#LM>u?rO`O zzY{TKQu2gB2f&J2_V%V1k}bK%-(i@A;7ikfL#AWZUxyHGf{grZPp8E}StabR5aSn~0nl+>&N4(5y}qPY~dg zTi-gxzTYpno29!5_f=_&jSo5brY!w;SGntSR6F=@<>h`;yv1=!Qdhve_I+jUxxM4f z)4$_OK?HzCwEW3eWy$5S-}W2(<1wMh|KW}9=0l|JL_N6tu78#MKAjbk+27qIEV$dZ z2Y6FwJ3%e~Jx^vZ6IC06iCEWmn(z6uhmyuvAe=aPFBV4iOx=Frs0nD9I zetfwv0Gw8{LZhmV3LARdnt-5g9=Ak~XJ>`gS)85=7@-G#U+RR*39;?O6Bmn-4b{rD z6_Z-F$Qhb@Jn7j-UTeBt^Tt+v2YDAf*oVSxX>g#`OYja#a)j@>VbJG9yKqopsi3jJ z?nZ=#R!zg&d4`N$)Gl0Bjv_Q(pvDbhq#EHS7nSqS`Ip|nTEe_#EFkzdXot{q^KA7=Lvd};GO7t@LW1%9p3H;aQQ69>83}Mo3zySrT$}5@VtEy7 zWXyxVB}p&7FlN=ZyaDhoe_)zq9t!=~p~cx5YHYWoGxq$HUGuzB2ZAWK5!8F-wLTu0 z^wlY2qZAqjafB3_wW(mEJ##NLoxnA;Bae~IASl9GFd0L>;*s+6Au#87lGqf zxSjs|&oR!Y5|XE+buK+SQmn2510nx;Cvi35~G%%*hPtr?Bh_&yDcFJ zo3fcrvUS4=g>qX%)@+kdS>mwtq6!uukpJlCP2$&qqT~`^@j6#ql_-HTg=vc z^3yhuHydcjDIck>Rj})PZ5&2R41iQZ4q@ZQv_6_XljoYTpOX_6p^jr)tbasfvskcW z^A)IOB0dc&|3R^|Od7=*ihsHp+K*;(c1vb$B18?7WImC@DpotZ&)nh4g$qN<)7hE4 zpeS<3#W$8e@!|tCs%V+WFXw8APzz=SE^|=!7+^O{P%ZO1@s#M z+Vt`*g~g%Nb^eg}0AN)nir-8hh~aoz>=5W#_rW->lU<~c-8WfslJjE8X#uT;GaZ%@ zu_*@U^W5@}24DzrabEiuG1!NBP6=gPX>Iu9<=A7WZ{HCk3DtXq<%VG=Cvn0hT*d#! z6p{h2ql15@*nWAD6Rqme!#wKQI8EZ7ramD9+L7PXZ)i0NAR}3QFvGaDm5BIeR;Q5oAh4h>K|J z97H>&&ML$gs$_h5I&8@@Syx2ZIA8(1Ucup#O=OIO_IEaJKOfdzwt#I-{rCSh_@q-I z#`?$se;Z&t)3q^vl;!x=W1@Z&TnPrU!0j)FYStET1|O{Ezn1}!s4`fg<)hq%JPXni z_Mel~EJzZRvk12VQtNw7LJtgH%%!S0bx@FWFP=s_a|66`b8aFL|1ophD@?Y}8XL$k z$WnWLpNh|Zj^TSfmie3wdX|V*U#aT*XloKAr0_(NGjG_)6b)suHr=3sNtE-0nWkD_ zdVX7SXq?i1`~&^Y22Ksq*i_jKFxpS$ZI1Aj9vAxLTiB(Wb78476epPw!olcnR3F;2 z1)-!UO-H_9Th2Q1GQ$r0r9wTwvCU}VXCqhi@%M=t>pX*rS4Bf;?5`b=o}|`lTCVDV zbL75Ax}MIPVrdOJDDJKmDxJK0F%V_LAvVJ?S+B57scyd`MQEKy3vCx2sUtSYWY6_G zk{W5(I0T1b*f5oTF&xJx#55bQ)R>HrW}c!yr>&ua8bi7TM;#8RL@9T3y&|K;Uh4>t zhXNBf;DY*WM~xb0O`%#x5dh~*sj%3(r)eVk-Rhq8Yn^lpQJ-(V#8_jSx&QK=`8$or zA<;$SY@dbCB!FM4t%CmM!02JYV!d1|F<$}t5HcgJ4%B;@B;GLci(Mvn@oIH0*c47=p)@@mnw}L;ZWXK%!$l{)5g{y5*x8i+UV#4@tk*d+x zeF3r7h*V{|a;O9b5|o!qAvYx;1z4i;>%H97&oo`9iu>805MfqMf6ySv0Zo(zJkeDE zfOTY?CrMAWJo!$Vu2=88ELQhbay;q5PJLSTVh#zuA`R1-4 zSNk0F(ot5Yh<^4y&bNFd7cZ_}Ta)DVso6YEcv)&_Y@O_pp5BMk4}Axp$u4#-3gUb# zY)eWM5+BM})Z+9U3nGDaT%Qj`HYo`?+U3jit+ROwC-)&Z6a#bpNzrfA{^oCc6HUS~ z-`m5H$$GIrA>>qRY(-~oc^?#1-gg2963*xpRbCW9SpH4SnEs!TI+@hRb?TF62<;&p z(6NvV0KfqPO2LFr+&fXN=x`>>j zw?t6H_=$6!&F5Y4g@(syW5d9rL-if4?VpMG+TAywACo#SFFw^>4!&OsdT_jL3OWk>{ck$}Od&4U@MMtMK#Q&4->V(K zVh~IT%qu|0@5qAiFOF8V-Ee{Lga1q@SCb)s4>~RZ?Zxfei;q6b0_zDLq<00^O=vXv z=quf9h+-I;W2UFB%9$r?)W9!fzU@$eKlvSpxM!?TpF{~?;0O=g zerY($Da@C85PFZATt^xGGeMUKE~bbE+`TidFe>Z{Do7juxSIESP9HSKuv60>saT8R zWOxOAKPEXRkqI}>C`;tfu1l$3QMf2%2ZGW|=w`i(hOwjWE`{!QUJpj|cfRpwZyAI}ECFU6#F-KuirT!y5R^m2 zH@fWuyk?xo){N`Ag^a26Z^uP8#CFVXU#t+)!s}o?)uJU{Tv`2pe4Qwi(LEHn2J5B*Nq&xxny9&|#!{dqNM0 z3&5+4b)P*`fTd`>&;?lEPe^godeNmG{tb%wV8s-`M(ZHLonvztpR%tex+hZA_$>I* zmL1SR|9FoIK6D*qC5RJh#DByHu@meIzAi3VJkq)Tvn&BdXb$cZ#Z%Ey2V5< zg-^-sx!bzQ+oKNqI=TKTJZ8Z|2}47x22&QrCIIoM%fhc^Mw55Z3=9q$6eze+a83)7 zr2!*DRcre0b$0+dJ@hAUXYQXl1tti5WG|DXgyHRi8m+b%UkoLj`!#b zU~J^n0LO$$Xd>%o9eNf20LphvYiZ#kt$1W;e|S0?nEssOHLvMXLDV5ueLii>;W$fP z^RN1UlSu*iJCVnw88mS?2nYT*_AO>|UY6pXOvZExoqGbm5E89b9Bzs*t%`;Pt!MFA zi*$TBxcOh}3{9*W%r^FK!>{kqcJ_&wicj3A6~>su3md2}4m*f|$>n_Vj9QF%zuQKqhe^ zaEAhn3|Z5@+Og7ugf)9CDwNC(9fJ>U@_U#~pO)A4ZGERR2p7O6-gjqC#8aq|*E=E- z=>D_t?T8H6p+VZVUVFYGCzs88jNknLjCH2W&&U>J%uNCr>q2*ZHv z4*tFcs6Q~N_jfY>6EJwN7o0OpiftxQCld{7RuIhDWC9&IN^|(Z64K;PF&<5=aM|lr za1mi{e05RPe*Bl-(7gBph^FtTc2|95#8H67q*$3|%L)pbB+qGhJ`-$TrMt!mBVd~k zgXF@gx36S3sD>)p&^&~gk8`uFf?bMKn4M!ezFtV}ez21*I43|;(EN$Qg6wVm1w`- zEpHCodGwf_E`Vm@cW2I^hG&uv_LgS>VbA*`+;qdRG51J<2&bacxoo-SZO}FaBY}=^ z+DCm>J#ILrE}zP z+~1P;brdH|72L@w2KlFgZ9TnKi=_-w2Hsj*9f_rsE9=gzUX#!4I3;Wact2c=V*=2r zo|J5&tf`S?TW(5Vn$TQia;gx11qs5=q1Y}t`=VnGij4A~KLa+oe)nYU3?X-SA#aB& zl{R;s;$FVqy!Z_)LTeivdH8{Li39?-4+Qk~Rdn@Ek-2Q1rFHd7sASopSBZH|fO9qF zZ8Z?=hyTFmP%laZ;_j5<+MZvM=4csi*McN}_fa0Nlysye_o*eOkXuDP_O79r$HS0d z&4k0@AG6V7g6j7YqzY3arj%23nCPZT3jpf};DCWrp%9ri`h!-HTw;mlnBaplZdkfn(mKH_qwjmN2Hs*$) zh4zdnzuw3ua;#{dZmUJWP4JXF*Cuw9(<6a!=7d@N9V_v@xQIM^ck@n4jhyhD zYQ^8tz+ibeFmWHXU-ej^W$r^@4#D4O81f5ocbt6pnV0xi+GgtHb14$(vr_GK{eo)< z;0VkN%*~cy&MizA0%MnL0z%$c;UwRou6HGI>iJ``MJ4JTS z?_N1M2t^WCZR4{z^9nkveBsyq()SaV#vx33&XPD>(h+t+Z)mt)aDNgqGVLyU@OI|B z`Zkv?yeD^7`r0Vy_?aqyvj<>G|CT^C^gnBd%RlV{XuQV)HHX|wOJ5CZZvfdJpaA9H zuYj2~bn^AK(7&Ibzy7T#d9z>t@(5@36R^uzNzo)dK}%+xm!wd3{>i8=>aFDXl+LF9 z{okF!=u2O<)a!?~x&Vtz^6X37dc@%7;7&GMOm7&7fnSHyC9pPoqCP$yZAPwj70zVU zwgl%>v&pOrQ8a%osrTr$MMfsbh`=4GLMT!sQvsr&+Pxj4^)W0K7bHObZVkpT4RbKQDbkOAvbWBWU#`=y-)yT~D{rQL&|~ zXaJ=;%pGM@Dbg?DKq4?mH9LG7%KwZ(ZaV0B*GtcY!h1<~Hcr|8QosW73J9GjFcsEv zY~pJ6t39%6a3wl|?MA29W7duC5R}RpC|V&N70Tn&KdwiHRm8ArZPI>HSnTXY9{8vi zx@pQrC@=yguIaWth(oGB-|JAxUnFgH-A99yX8+#{V1Q4RmTE4xGo%-mo`(g$c<<=> z3&Diht8z6_)W|GieN3+<(H$yS{zTR|KV>AV!tmGf4}Y!4tpbAlKT_4iJTaEMrepRs zR1s-3{&gT<$}lGX{GOjUa>PHs(c7q-zLTOT%u{R~w3|M@d1_ph=|D|H9F){ZiR1GI z6(Uzgj&t8VfxUDi6&DZrA2KWxh|2#!-s z6RafwvD%Y}BDl8M2Gf(%PXwR0dwndUqO5(bXY`1gkdG>obv_d{jI{X5Fy27b<_)|*yG#~ctLyFyLM?VNWn~^7 z{!z<+lLusMyLJE_6JMZ$kR}G#S;*#%CiN(AcCT*#!v$Ctitso0sOJG%dm2_Ze>^}P zHCGm3BQ&u2e&~ar;+f6*tf5Rzn8a4LEmqL|?RzU{Y@Mf6XU;|xbegqfrcIof5gS_g zL#5@kgXj1)rrx#2g%w=T%G%YV)H=2FkzRhd!tOn}g;4lIWhAJ{l$Qcw+qRs7r7eR= zs4CFB=wfHsKF+U2*-`JYaj^=}`eNg|Glvzm%I@$ndHd#`I(tHZp1k*Lb^XC1Dv$fO zJfDE6fO%b&O_$bu0S!)cFsS=bn6(9_FcC?wtXIdIN%ALed(NjxbI(;E(P3A-pXAIu z#u7Rc!Y~*%XpqQra@kQGMB;BZTwGW+P5;cy_2L(O=?n5H<1GkDtqcqa643lOB4}&D zm%}!Wxn)&^u?6zBoKY*y2I*z)w{I{n1#?5655g#=-E%g_dNE`r5hymxn`b;6f|Ub zj8AbS(=?-Ww!$}qK38O)hry}Yo{u_wS7MXtQ+VA_IE1nI)b}nlZ}4khA|4YiHqKV` z`3vvmPZzUFJ>Mh|>06l-WIeMY1uNqHF{l)=9>$RK(V3YQ7R20ULe+j96aN7xe@}LQdcfI zY388Nl}WLkwbyI)G=pgZoWowE9Ris>CZ=f}`XI`;2Jn|t*@gZz8r@7(&9&5S&{RSh z&-+o=O#C_QPUmJZiHf0xjF!;9ygM@D+OZ9h4Y=kq#T~7BpR^6yvs`j$d+;<0>x*o= zO*dwg5|hI5@|f+5;FDMFk1r?@60E670u}oO%eZQ60r)1O@d9DJvs(-OF=#@I&?|9E2r9QTv)Zz`lSSqVd7RyV`GcgEH34IbluCvm*IU zX1w6EliEMJaSz-j$iR`5WmnC z#fL(W)a3FEhn}UhIwqm?SPCdDcMm%ShlcI_$)_0}Nq(*r?)bTVH_Dk{Wq28o(|ZJB zO3)qs9c40bh<`g)A(G8@O=?Y2AjM26(f0(t#vZ&O^I7}0Pul{fEP3(W3#b9=Oy2I? zg1m!NRXzG0*L5iaA3*k7g>~Kd-V@yp0$l{g)ySVWcp=9mw;f#j%!qW#ZH zkDZA7um77@WLlnylH!K+EUmNAum3lppl+})2%?^pxt9#ywhzXA@%K;G@BRA8jc2RZ z)cL{JjxJ403JT4DaTIuTmkO_m`g3OX_==pndSMSuP_p1U4l>iqV>Wq4XaG4oO9>Eq zt$8LUVDYv8PBn)s9iy_QQE6!;fMgGJS4HfCDo})I$q^oSxsyT*%Nky2x<3PEX`LLg z*~fxqyscHeq7QKP!e*#le2-gTEKS#0%*ze^5bMCzi`O!r1o74KsEjSc`ODp_8usQZ z86Tj%qU%2zLP9~qdif`Od#%wTw4+~XLyi+(GLCwE?+l6~U_4#65;Cc2XzlZ1Ohx|z z#21qCTpHUjC~@BS6g_8Ja~T&2+`cZm*7&aWji zNQN9of;LHCnX`A740!?W?4j-&P{1!={33fy_TFU)!g&EaWaD}TQ8D&d1; z^FldvpAi(4!&bLvU#?TP#QKBn$2^ua#qbmEC`El{OaR?fi>luxwINbJ@2fxw3z&@I z<$DcyDCFC6mML;)Kx)=JBmm7F)0~F}8xsfXNL(+zw!a}+tfKfP=Ri-ys60GwfY5%2 zhChdAZK+Bd$HL=StZo($jE0@x1l4u(p)fV|-yOvmoX(p9z6F37+kQHuZd^V0agTzq zyCcw-5`#%ekM~BlkEr)(*v{)w^N-s#4;YBtq|lKT=<@m(Me!f>&+nziDVll|dQj`y z;-JMCOHR|*6Mp?{;;2E(dgJyM4yNbfc45s0XpA=1FXIP%0yFADD~o?~V)J3<76}8{ODB&_~n<)bdt7JoQu-r2W z*LiE0a@~~?VT!7ptw{~lS@w5)Ep1W$xwRrw_NW#;+O%AqEd+q*ZU~up1QY+^K@>XY z!TC?`VVfXwx}pXBF2pcwk!)j`a$LTlL=hG!IAIGC;Iqd%RI&{Fak;4o)Uk4 zu71TU6RKb_`l(kzIY%d!k&neWpUrmE)EPL}ZsD3ShNn$`(FS7YHtfSc=n;H~@ZhK1 zsHRZNY784JQoi#=dQ?w?V~(B%YA)yNCNU%+sn=42RP~R>XkF2m(~&MTqMb43fwKmj zfna!m7OQ4i3LG><{VYtDon!Z|H*K}mW{}kVGfqXWm$=l!uT+s?d8;JfXkwQr zmRI*VSWjpmg-@IlE%`?ruxuS+KCp4QNhHq&Rq_V=)`NhZ*&IHf^)w<$cG@k)=z(+v z(mHJ8SnD_Y&!RqxYcjVzC6A3$VWd@3X2j*l7eY$n8fYja8y5@(Zg(=Iq9pmB@J!ls z2b$Pd3aDbdUF3Ny63;rw%5*|F#BtIX%XTn6{3P!Dk&>hAv|ns{2(=z9c!c`0>L`Ga z;j$Z#vDtI=LQFT_J#h5mqR8vtfv0aR;NjzaIxMMQz-r0`3)gYW*en zsNikF#XZUE3*QjYoDWRLZ^E9wA(ASum72U))AiQIXG+;fM;nJh1th4OlVO~FmU1t0 zt@~5t^CQOQw2HI4~8&zgM@`486i<3&$o&bJSRwhIS~qsRc!fDlqBn zC!Ms@AQcv{x^0A6LSG=GW>zCFnWnimDp>Ed;4EzUqE)Qs{L^8pyau!kZ)zPAMPm&x zgUP}Ol23f;=+;YGj=0=y;zcwL^&I)qZ69dUpCv&wn{&%e@@;~Fj z^>fgXKezNvwW%}1Dlz&$iQw7nzr+1bejsVV)tEg9)O8uxh5ToS{Krqr4?IKwIo1!= zi2v5`-1Ek!y*_MR?;i$4wo>3b`Ef(yEuTHVgnpUHpH60cAwnIShXLfpF zGw$!kp6tN{CXA8=C_>A=(w)%$IKkYJz(n&fbxY$uf&{Y<+<#~sdUNPWGNJjaMP*tG z<)LRLWVTN@|46HrPn;?^Yz+n}?}dLX)2r)n#mBX`w;zJKOUZO;FgDv*s2?5?|HaXm zw*tLB{uqbil_0>5*83TQ(NMmyZ3OTrcxd8^#47d(AC{A2;TQVkSC(gdw(DSfMMWcJ zowtk&iu&qA;7pvOn1(X1C$UWcin)*Jhep~tRLsqvQgOErd02KyfCz~{Df?_V)Ea;B z=8eOh6@x3m1&rC?_zPm1`gMOZU1lt^Q{`B~3IF!Wf+{a;=BqN4M15krQ>h+=myA8N z#aH1S#Z32=?#>qZR;B*Zzs14sW~B&sQa6*TstTA7hgE6`O?WpM5xN(-%%fb&%j*>8 zebd9SiJ>MC#a!OXEvDV8gGTq`1C1R%l071Q%_% z;`Xwn47WgXt)L1jYe@|?1L%WR0}C0LT~q@w3IZ&0R%96c+S-o`FA4Z-d)ai}?TKTO zz0rYV)7Ii;eYXgxK0N{oYJUyW_VT~u@bosn$Hj||8|8**xSI%*d@=&W0)966e1Ka4 zSgAc;H7LrQ0tW#A!J(L6@-dsIzPa^VvAxO>Q=y4)dgX}4v-uQxJX=-nPrPCMduJ$F zmkBBcT+aqZoKKoumU@p;1p}tPgz5odge_xAI1-1!LP$@ml^j?vcU$42sLuCt=VI^5 zoNVUMJSSW2j8VTVVFIUE@dAEVOREFj78$uPpj-<>u@||SB76Oz6oWj>5jLPuQ(A`N z31q$tsxRDWGv%Fb#I6y2m4PY>JNZ@O`1$vOZoXeUN4enHboXTFej)*X{)bqvJxySJ z5AECoKT-4jwe$xTK{iwtPt=k(`{<&70vFipGqG&|4P=dlk`7fV)}E9m&d*TUZ?b>N z7jeQZ9ptAuu$wa^6E#pPpwN@J(bK;uLHi8~jJN*J3lBI<6;)V46ejAj--b0gP;ddd3J}pNHa^6+@XH`AdLwBG!OcdKxj(%s;HeUIR>9( zR&4s@5fQO#Qtvuo)gkNObI8{QJh-NGxc-KEvT^T2jcE0~hg&;%yo@%SAOnnyn3m6X z`fF8#W6)*ZdaV)WiSV{Dh=1k^Zz%TnxTVmsUrLmVY@XlaEPV+$boVAKz+tOGeyZJ& zVb9`8<*~+7fe9~|t&h6d00Z7DDl9gI5dbe3ST#@*Klk zARF{AcXO}=jIN-S{srSksB)38Zk7B`@Hf*9s7KQWA@Yqpv|$i zadTqsQYF~xE)c4~tQG8daD7;pj>z^^o;X|RZVhW%`*{B5_+!O33St!Ej{-It98BX; zD$cvYtq@nr_842tk7T&tI95huJ~a`AsTf;nzx3uE?1=v6^?%n|8K$QY<#?FMw8z}9|;}2AND(O zXxgj>UaUj`H1?yY=5~y3U`;;1k?K6Fe7Sx$|AKj*AMo16jN7G6@aYidjuQak9`no2 zqnlvQkr6MHS50Qd0T)8Z+}Atpw^7Ym$9_lU1%LaXkdprDhJDHq?{mn}yy1_Nzj7dF z7T?DK-D==cwQG&|`4v&hr$afb%%ehVtl0V0Q5FwPTC}RHh3{)d7u}LPpp>!NNI$Rm z;r(m?3>}@a6XH|Kzh8&WHY=)LZW>Dvz>VZrj(A|L7eY~onW87RE7N?=qrYnFsYC3C z^?r`MgSI!BX6|xqr%n5Thd)8DX@g;PUUABGu_On8sjK(xz(L*I`d?Nex+@aqHJ ze0m@DzWM0yZuMWTbiK=IhCAK%qo7r+;?Nh@#V-I%&hbVZ-$uy&{Cy5HL96KNm+d|b zpyOZKAvtp&Q_iJvqi-_Acy(6KZebN3u@eRRUH*GHfg`SM! z!6^WH_|_cwVDsP8g zNUQqS6ry8m803hj3ehyp$2^6i{cKZ0HJJu{rkuo^$jxq4gk( zscgb$n(`z3qfX|S{VMNv7nEiZNmb15!L=OgZ?pcemnHK|960rX ztrA^c!VW;yAe>7*Xb%OnmEIg${}ham4)L;tZM+!56CRQZ8j3Ep8jlAUYXqx#h=BN{ zi*F$2d<9OO3N{i-i7%N5xCmaMemJy|0O*5{NSsH&wu#h?WP*lw;Vrw)ifCJVl%+Or|wugO!17VYl;}hh-=v z)T%(+ixNz#V3}k4;9Fy_SVHO0i>H7N!N~Yrcm4UkckEALn)TwL0vs3>f_%y`@MzClN zdYI|f$=E4p7fqaEb8SD42#4=b6{kLwOvz)bBigB@dM`hSSQ94o4w#qwi~?=+5t{mN zPASPd!rP!2q787?ri)Wi^i;e>Lk)(dRD~N}sYs=OZ2qjNgX4E<#YA;c) zg8@fDT6xH3kC!U}vMsiY&}2e_nwoT5rp3Bi5|SpfOtl3P!g7{%Ja?7l~J2aIcm$IwseVD{e_mzG1Uw%xqA`nHs$+Yk)c#FaCsGy*(QWceJh? z1%Y<@@mb{Ds0F5NX4FrEKm3k6@(pK+s1Flj@fUC{a74usoJh__zM!9gnByrQ5;@vVX7GkGf-LW*)xgX;ku0`je^O*$+-fo!5-iUEb*Ck}E za{F^DhZ*cv+FvNJ>fFOlve#117D*jFO8kY6BM^PxAF=(DdT&a+vikDu$|aDuEf&Q6 zJ}p_GQqvkIIo)1?oo`t$SFA*d7Y-cYO8PIxSZUeQrlk8`hUdAwJ4RgXr~GL7QSMqr z{e<4^kh&-8P zVsf#=aoM8F=f)POaIYI2QcEc-yVMw>dxFW|-}f$BS$aqQYOJzg9fgqRCVU5BS|ht( zmkCemIu{5&I=Tt^xOFr>8V&_~xH0$pGWUGP40nU~1l#_fW$sGuq4#?)ZsYv!t_`om z`JT6T-`~dF69wvsr{ms%4K78_hod(mGXa?^Di+!fCd{X4_q{6$93+TM%l`MVU_`GCm1=ES|rvcZCD z{gB;zMXt;8uG6l~`TO6#o!Zqu#j7@fFT4;I0nl-B4yO1dCUN^KR#lFj)ggo{UR<-v z#e-+0FXPuJ&d5~*^SqQiF1fk*cS6pb1NmfLz*8^l_H@zYKaz#}j8lyR9ExxW@2*l| z#3eP|P$F&uGpkhBU#p~HG2ekOYXn*TXpfFukQX-|kz^#`Hk15Big6@H`*Whv z5ipnCME`IMn4fCc*ma*J3l4060<&4P&o*GD!n%KE!6)T7Fv+C&uc( zdu0+;lsq-uV`pxNoXG4wwKW&u6Uu2#k#95W>vham$Mc-USCbe>#g%@jZH%SAoRoyO zk)~*)j2mr!uNCfWjwSGAjItDP;b4*s^Z{EAn9GsB+7pLl@; z>-CS?3iV$dll}uN8Q6X7fjtvxBNhogs_}H1z4_NQxE0(4_z*@FUY*)cP|i8375$-r zyK9oxs-Bm(^{cY07trf`#~|?O1h7f^9obqob@7mLtg{!mrn&=@ETL0A2}rVi(hnwu z+$SLmBpPBwYPoS3_eZbkr-iA2>*UH?X@uZrnUUiT02Io;tNKIgx`cLhLgZ--2=IOQ ze=k5b8!gmes*Ed1qypc$`?vS!`VwDT&6dSw$frN+ep~}oIo_nmRIQs!X9f!Oy@!c| zl!u4;7O*R48+^_}rDfsb&y2;9jC)^mMPC9cwj;mEoD~#^_2+-^B%=)JD*k@c+4~p0 zdHb54uSz$Gh_7llA+`K3Jb6+PF&nht#%XIM_vGM=QdF3k$SS zR3Q28BXt%BCai5>F9(-RlZy^4yW%8sopVFfpe3nulpp(|6 z2urxwhM%~#33XK*JQ}w}8)Ks!V`8s&T_<^XvOuceAC{u`dELEleEjcQZxglHKCIE| zrm?sph)^o*@5HE{d$X`E&(Ah$e%00`6J~(~%ES^%DQ|4}I(n}(u8GS< zIY4C|Dk~^KZ8?0_g9TsnD`~D{54RE1%SgX#Tg!|@)HS47==G1aF{5W|?J?sV1_Y>~ zCp!1feuUG^hEEuV;wFv+68eWz%!wzv9)*Tm`OHyaMxjIy0=$)z8{`gfoll6gWf80S z4R7gQwQqExr*5;K>_B5DBVU+wrk2P9;{K1Uw~T754ci5wxD%|w-Jy7kI}~?^Ai<$H z6e#ZQF2xEIC@!VAyA}x)in|ndo&BC~&YU$ftSo-bd#25(z*(L}+3WI=^%)L3>VPr`@P+HcS) zPRv@EQ&BxvpB!etm8Y`|1 zEgkz3mJ?<_?VFOz-n|iEI~e2vIo}?EfJPSoDHlm75DzlXvrv`9e!^3Vqz^l84{PE} z*_UkOmP{>hu8_q?|D0_#fhH*(2p)L@;}d^@Unq{YJ^N|vESv|lm9?tiE+uU`s}QGD zPU+|UjxOqwcFf?TR;Y>)Hqj^o-=2AOPkUN&C`xIxa|SzC+bM%=adH-|LlGr{vuLYV zlNGi*K1$-9!iRY&E50?G2WzdST~7`B7Q00Ikni2K23O)d)OFj?iCS|7eA@h^ga&H= zX;)pB&S#`wAqb7loaAwI{2VD+0C;lTzQkz|o8g+jJNn@voA`)^tz*LvCBQxR!^Rk) z8!kCfnDG1($2!#kIxUG!d=m@W$i_#5p*c{6Yj~Q*NhEtHeZC#=MLpxmL0IUi9ZWvf z4awvx#SKXJka^!iH_i92W=f;V$vN++UFrA59`CawFDYNZ zk&8FtXI$p|FV8U*mLJ{Tn1E3g&LWPHIA-edr^DIVnVypH&8Ge|FILKtBn2AOh_4{h zc;5%AHNlMWn~nWQJApAqTxJl3(l_w+3g?-6{4&@ZGRiZf;LyYSk(vYi zl(%;2bFTX`x)7!zK3iII2xZ|8Y=0NSwoS_?xgT6t$*WxZV8v4UtM5Ei1=FyVQc<2Y zg6Js)*sh-e2mb4`3V2)4|JUH%;d1x9>6z%@LRU1$7e4S45yk&GeY+}rp1|ScxQ!iSq7&^g48#m1If& zM>&Nu$^PPW5fkN=Hs^YeKngi9k!Z(-#^UOFNd>XzU@}H1f4|goE@Wop^$01o1!5X8 z4ASKZl{8G)-|77E&BJ1{ngc4wIQN4b!> zc;1F;VVI8=dMu8Rr07IaSYT_p%j+2v*kRq7UrpE{Q&@%X{G_v@I5;qPgLk4V zholXXU>WD-#lPt;SY&TVmcS_N_vK@Ib0kqjAN(y&0;;{~GqS6^T)XQidATSS}G$|E<^!z;u4?55<{9sd|?6R1MU|6d9=Z|naEpV%Z@i(5` z`JLlHNs%l22#$_7^n?=vat(3|KMh9}unp5b)n;6oMQhO0ZZg4W=1riUm zcWfWzlq$&+hA#e|K~w8AFgPb-=Ik2j>#U%`m!(vG9qz535JMZduUgPDrgRNS0wv$s zIgPIk9v|=_Ut@kzNTx2mF|qrs<&GA-d1IV!emteqXT;%77`>i*J1fUBRG-XkS}8+> zpifH(GJNYJ`NPCP4_C`iGUO_#V z4r3z}%zaXQRSL*+$;E}Px6%aU$$U~n(48c1n3fKXbeuE*{BCu;b%MQU4-h2jDwE%* zVa5nG9BO%xK{)5`H_`E{=WE2&NU^i1_WZhh_d?3}olh5h zFpmLXlm=|>GQyz0l_MIA)K*{XZ>6|`7wQ^)_zkdLleswmlsej?_1mN&T5lBK15mxCv60VM2|}h5@hf zM>%;bUc?fb6LsF51@Uquxnww42Y#R=!R#pE*Q19ggN49q2hcw&UM%WJv#3E^Fl{3@ z!z+7gZ~6zkK+{#fgTg&O^V<2&Pq!j^TU4n96?o=BGdQlYxDxskV2W-M1SRC`Y;Ag= zh%zOJ9a=|{p`ijzY#hQ z2-$}k&A^4bnT$}&<`oJklEb-^6J1ud2egJ;!7fv+v)Z>$GM1RKvEJ%Yf0C7e@T9FbCQ0x&$F3;(NtAI82ioR%+OQ%g zDx_=4G5(lA6jzWelpAiH$k!CJUY5kwm+Ee1?srd(J-%SK`m2U7XH4FJNeVba;}@pKm7#~1qC zIq39wU~+fW{QBH=b}r_VZ*uj68~jvVvw!p=7suMO{y*UJ|AwGWsoBAme#r#M%#!o2 zrsRn5)yz!dLV@&`-4=QY;bPZc8XDAa zP*hWYCis!=d8~Rm&aao^@x#nL3w}LHc~i9Eg+u(x1oJz%HR+BkVA}MwH&W~!Yslii zaOsO8-yd_{9*?Kjv0+qNMh8F;Cbv-SF%L^+m-&^VXnrpPDI9U^y-)=-*$Nr_l)gt^pOM#v`E`>Qu9N3W3#es^=%Wx{%H--Q3rqzUW3xA-`I_w?m6#Sl;S zPrywDSuQ#f1WvoYE!x;7o1F08K)R9aR))`R^gYn5w-#_8KKKBrbxJyptRKgNJ;Fk1 zx2cVsf|8;DvK;*>exwl8|Dy@nX;pah%~x*x2j%NIX1 zD})j?2p$)Ze={5T%dVCUfG)qUo1I~sfFLL}MA%{#Dl%P_NqSUNfY#7{xvb#^xiKl|KXpQKHf8N)@Fb5`CTWd`vDVag&gh&3%nzL(S)<&)w$YKb|0ksCXbDP2KWqi^3i-cIL7{c~ ztwdYHyqbClH*FFuEMAGqWC9a3a4FV9vyotVjDtsPKj4CzDYxmY;x~xJ0~3kza)G_! z@n@-)g_Pn+7Wt7~Om}vfP1|e*rwjkCkD~+vQ+o|mzsN;jpD;=vcaAQtNia0l1R^~2 z>$F(I^QI68-P}g+jxRa-;bs)S^U1U2`(6OKC@C{Xcxq9c>fTe=>dZtmz4reG>npv4 z$u=s@N0)rqf*n3kr47U^PLD2mdk?>CkKk{o0)=nJonL^qhF=W2l{N>(7;WYD@_S2A zL9fdj3cs~)g1b+Y%G&SJ0@zDDANb z_=FWb`QJocDi1cwKidcLduzE`ufmJ&T2nks9P>VwP7b335J>G~#$9&`jKy#q@WerTKBw zXkVP0hLuK3HS65GPFg)1 zhRR;b@$$G87?P-0S98;By=K#1~2VVW_D*b5FEQ2HxX}l#wl&`^ne*zD>xb zTx|JVy-kyzQcH1_2Zi2I^l($PZ~84{Z2PVqYMg#yPuTyXf+cDjmxc^(kG%c(>({?y z0@iFatB1aB>CZc`Wrx!iHM$>m99mg=oQFDL9Oer2p>?v=VKBu+8dId8sqITytlFJx zIxZ@VWJv!#+lbRj$WZEf+ITWu2}jOnYvuEigEv)L7~GTjm~n+(T~$G|9DN`PLdC?d^{}fd=CJYBf1i55 znl~z6P6`T9U;fbKAFwFxp)oTaf9^OYm7h5XJ1KgMF0G0gp$Uy#a(hP_0^Qa$n4s~A zW_on|+6H&qbTsh$#V{I>I&-S^0FZK=$8;ao~!aA8f>2;2Gk$J%Me|6oi2X8y0&t60S5S_7FRLM7cZ`fzFlBn$10axoZ8R~G1m`1(_ngd%B!DzdF!l7-UZxyBwD`Tl3t(JrIr; zeu^RBj6}C;b^d^;L>DU4(uwV_#sIvCjgN2~ z>QVINeQf7ZNo$W{NuSp6TjgcRUT-+=UXn=PcxmZ`U{{;QBmlt?A1-}S%wd~C7 zT@Z&!NB@EEpnvnw)&>YbvsPXB2n_`mit4^E@>c+*-kj*_;zJs3$Be3_OQiyNbcyui6AZz7`mK zTVG_Bmia4omVFvtNS6Yug+d$-=szHP`Md_^26fs?5O^_!d*msubn{N})|QFeU@euh zmy0q?*cV$88idiY?}e3SC&J;o2>7pd{UXsSn2X+ImC z9S@5yBnz(7VR;FD<;3JAU>gg5c0@U1%M%GO(8yBPs4FIR&t!<^qy}Os7>iTSZvG+Q zxXbXv`m1QRq)^YaA(&tTZ?o7Q?_7W)_@OFYc0O5{R1vt96uic-LO`5@%5m> zDg90MZ6;v|E6M^hUQV^&9`lam{q!FBf|BO$!MQsN$~m)Tqk}R{e2P|8F$&I*xxSG8 z(WbL#0s(<`dmiIl@M;NecC_9}uFP^`ulhXSLp*XlP);UcledsO%{N%9(F?M!VIBnQ zEx?;|s%Xk1XcX@iddJJzPe$15i%G5pQY6j;eZoVBhK4k>zYU`3wn;{)345Z#Hxx@gcD}`z zj$7##B&|{a-tUp11~1zJv?O^>8FFaf?qNyJi9F1yw-8pGB`*9cT2sIpQ%V<6if}9q zx&B(ksUP{-iHdfBX-YMkRDrt=1||DW1A7}yKs7HrgW*&KzU797s%0^?t6j|zFrJD< zx=2m1v(VW2rIoHnbaGrH2#UdH6X?mPxveNEasMcc>}~f(IUh%COuA=&V?Lf~Eo!*< z>|mk1^E69$U0=B`eVkav#bwIAnd>Na; zVFD!mFXtHQ?bVKB3>eF|9Ip0(Lo#VfEhSKs5UJ%=OiF_|M#Sy74HvLN{)N(MLgvQL z{tSCaBYD`feQtwyu<0kmwVY@G4<&h^N(RDbZhC&E6{WlXpiplhB~FieqCKAV&{@k6 z7-gnoNv~z)CvT-=K$j9zC|~oIz#$;1bRo6LLnnDk zBZo?|>{ewQ1v>>7wJ1?WlB!82zr;c65G#(s8Xzj}SNW4UvMZoS=&8Ql_bCf-r$*F% zdLN7Af`iT_7vM)kD_J(&B(W$nQV}OZqw`#O%L!T=Kdwc`F@7rrP1r<^#m+ z*6uE{S)B7~bivpmHc73X<@C?!HBVA58su>vR)^1Rot3l?pQdlYaQXR?=8G?w&RMeX zN7tf?z&D#{%SgpH@1b;%)7>|~qFOsoI@eNvAa~#q=b}XlYw~aNxjvkEVj_rEIpQx0 z(*56oDU#eaLv$0YRJ*dPG*;xO`d82_;fRL{EOUok6V_Vkd&*OCLSTO1+M3{Pt(<@c zYSpbRafB)!UiwwGr|{X*UMCTl;?hpwEnj}x*h^XI7OCSJ09uL@)Ric?t-nSt{qhpE zNlQ-2XGA73(b#>_3p-E6ha#dz7TFHS`ALlD9CSJuikiQ}G*c~>VRapjDeDytXi*IDQ zKlYKgisVAQ|CG}vFmu;KTF9&oQi zk59oSNdHl&Jqu4sq(eVi{@+N|)n+M?HY48r$cri>QL**Y4^=oerZ1JOn%BpR?Q)+4 z46*Uy(eDk^O?PTT0<2!>YYv~|;t~^g#Jio!C)w7z%DkS$Xtj}9ux+87gWA~li$Zx9 zpNF4;m74DsX#lz3N9vT7bspgH81HR-wta)#H@)?5+2^lF2WzsIbpI-*`>w9_VP^#{nZtmxjaDQ!sK29 z*_H0_q}hinrMoW?F1ZSa-d)Q*dQ^-93k>7d+3=2t@HK?sFSWD0!u%$RA6X7?f2$L? ztoG-B+{a1=4vy02g#i6Q6Yq_>1`&IB8R>Av9cO&gGV zRa<0h_gS?W>wJe5r*6Z$^dmX1ncQ%js@E3o$fnjsoQv)KGb0IZ7_` zG=x_m?aMOn_boXE1*M|c#SdMRUfsOXxYFH)(coyJ!tzst(Ao<)RXJ*|daEArKc){f zqgRXnkaOw&QPODYRrd0)zr0Yit;EYY6rz%Cp{?4YTv!!c#LM64C(GJS0NOcvV!JBl zk*n5SiSq;ZUFz~kCMB_Nk(xK2quHLy?ge<>eBVM-ZkUhkPo4Il^KbX|NdN-V zl`k3o!Wr(>7xQ|sHv)~DtP~oCx;Bh}Gj}KUQh$}UurZWx{r=LL-qM?&>^F-?vAIYz z{OA;_+O$!6npNc`F=UyD=k50CAef%qz$LDsREzLRL>bP`qBg$hffohX4wK;d>LTXJ zU~+HW$5y0Ue9hFCTztq@pDTh*JwjIvc-DNiLdY)lF+L(k3id(?-gXr&HS^h-1v*uh4tV<+%lOQ$iKa z(l`!mX$SH6o+^)`t*7z|PunCZrcXZ89x2MEFGVT;nn&TUJ8fzISfvG5E}(UUq2s;F z`nj#5Lc?^9s~}43w7BR^fEjR6O=%peRrdGtkorcshcxR#z;N! zzqJ5mGRX3pmoztzG@{p z$m89OTi+Z&w5VE+<(=#$)&04}Y&jDh%3@X(!BsqVwp0Nh+&Hku5O8vK=_C;P*qhYb~Dxm&=g2WGktAg<^7rSqeq> zg;~qbF$)ceVMQgVjMr?fr@GN&)1LI|4zU}zh>6_FD<0a^k4ARbbM41#S#89S1;QDn z^v5o`*|;z_-#oyZ_$-R%F=3i0a>VjTk3egIfrq7`aPi5(CePN8pG%VXn-+%Xg1p3r z@Ohp)(sS&`FNg}db(ecGPP;{gHimj|+C>i&>%&ex_i><+`cjF47$%sLgLYnl z1eDKLFV#`OT|+zwFU^Fmeg4f-+CJU^@1xCBcz-gp%cJqx?Oqrkrf;vFJgV5GbL%Z{ zo-w{|=l6f;JP$};C|pB;6MeqYeEK7HDYoJC`p=~2z*ja>(&)SzSJ9?c(aXyV&_(1i zELJo7yy@&B)>pzhY9$JhMp{LA38v{0sbC+(7yXXkc^>Dq4g`k;h;L1JJWVI`F?In= zXM6tn_3blK4RXjDp!RrJ{{N#;1}U6N*Drf&e}$mJ4Ghx72pZ>Q(bY|Z9d5&g`&!~2 zJ~B}k-QxJ>8Iiwho<62(_FxSR&r&FFS>6i?!%dt8lC375n6f3NBk5r0D_HZuZHHop zocs2QJ$&rC;dp-el30Xd(og?08CTwB`9J6Q$qBY{ANC`T*b}Y?WCOr_fEsA+ah1^~ zo2YLZFfwj323#-#qrcbv1!3n6z{tI4Pq*v=p1?RNrKfq4WTh8H9_!9${kT5&|O<=tP;1|&X~*;DunsrI+t_B&5qV*WE* z!wM-Dm6F%$0eel|T4q@rJDr{Va1io+xqmzTvRlY_vrG~LBr^);aVhTfw<2TqsfC7k z2z;wx1vPMIw@R!e$`;7?E4swEag7}1j7j8_MqYohD-mCQ-*2LlvOcX_oT)ZXIQgBY zz4(~-U|1nMaD|hAx(|I)q(3sF#<=L{3t0jId7EQ`ElJcyfcv9m8 z4N5x!EOQW@q2M<7t1%O{Dv$c%C3i+k%i8Jon)R4=by6g!;R%=6Vp zwQHw^P^)EL{;$BKC)BgFu%nj8kV7otUv;qk(-wWzJ;^SL3FXIFD-k!^?;)a9U8tj( zgOs-RzEK45lMFqLfCpmMAPeVbI@oLQ6r6^AkIbQwvsr_|-q4S3+S)eRKv%0-_Wf#E z7DL~bJ+H z2>}icKq9k^#quFeiVfKzcCVkGt4W*hkpT!LBvGO9N45toF%Tzydy8XP<$rU`EE6f| zqo<}#(fr|2^4%id6>^&y)7{G@zr;JiUE9F}-(3TGTgR%w`}KRb+$qLJ<(Ss$S~d(j zO{a+2Z zqp5I;{xsKgxY_!(zOpQ*^~pb4sq*krabXLn+xjS6JC9IiGp%sj1_~Jx<}k`v^ax=M z|6W@DNAq2|=Zeo6A2GF5S+^X>C?#gkB{WE4*@HU(EA`4uhTpI++6+vGRI~OL${z#% zj<)Je*NpaUcxK_94>AG*m=zI)b~}bW3oNZ>cCq#b8m#^X+2XZe9>I?3Jnf_A2fQB> zwXizfl{23?W%`9RqTiNzZ~y*1fd}^#Iz4aJ68+ZGqq{RWMBHAjsL$9Nd=oJ-zEK&L z<`+q*5loVid%Tvr^-#?Bp|!NUc3``PU6S22v0m7Tqu+AnRy%Juwc?_LaYdk7Y}Lu{ zjF;&hRQ7OGxH1&4oA;Ll-bPjW$ph2KAzQEkD*S)^R6X0>{sQWA z7-g2k7M?Q=0-XwXr&a8?7`M$J0VhII0n1-YXvmO$9WLT<+?}QwOzFCLqB?FV&Qn;j z8ho~1yPI<-o}E0?z8iV#ny2HkR7s|p#mcZij~)u`quZi`lk%LPvZ{hj5SO$12uk(1 zrg^Q|_)gyR1FJcEE*M;otC>50$Vo_j{rsj&ch!ba786hAY8(x_GS{^!8}348X{A?x z2GJc786?Z8-Z$1UfY>54Z1?kU`%wyJ(&FOw4%&F~O{+s&Fm%MgvNo#>J{#?7$@zp~ zvAycGGTk{0Y#Q2L;N!4I?s$xC-~%#enu6QQu0N?cie{5l;OnRwi(YYL+PzH0i(SUd zm~Ag`=(n&`Dm1l#Gb@p2q3-ET%MQ#n=K>R(*H*HUn8STq5VKCbFR_n|en=Fstdg+w zC<)2jR*lKpcsT3o8K4Sf^TarJf1xkAFTHg(%mW8t$n?x{O<0A7S zSi^Np`^j}AS0Jg}axdhRCVSTs!_D=pPZDo0Sy6DE{bAT;ErBl=5EsjTKF@#k_Px~Y z(!b%P^t%E90!pWsU8m8evAfxThk)%b1o*I2E=-Yj+9;_0{XM%hUO}VP_tQt$T^D&k zCLErR5DQi}SGs6~(;&d_I-bo5UpPHK2LWKeZSDD8_0~u8T7{Q@yZ=F$ZL7C$pI9)F zyB=BZvc+7t6gUBa?*H?;>meI->@C01KiqKaaW(uWG1ndpBeP&w8iS9~VJ&vWMc(fj zN4fwpMMRRCt^Xi~35M1ZC4C6f!ux22(XU>6q4W&}aZ%~hx4Le3LCHt*G5fb%RD){R z1FzarDOM~uz^b-ylK8ZMfUm~5Ls9_^fI_|25Db65^%wV2 zn^_znd{bmg92g*O4% zHimb0=hfe^r}|qU#+HODUQ<3v=rl1*5`-A?a(uwk{^dDa8^!gM<(+Ze&L9}*XUOs) zf~=X7O?h2xW80(hcY22afFjd6Sq}MNX65u&#DF{fCl?C}6|nx5+w)Y2Dvq=4nebQDYAZha?gEgMjGj9QU>vvdfU+ZW$dq(T zb-WEu z7b~)=`V)OP1w(B{*g@@oe{tZ24EOi%v6&KH3I_g@k_U`_qLUOErfEU(_YKRLMxf90 z4ry`j*_POgx!3hWQ|7b{n;NYQyUpg-ITPBRS|oMWf*7US35pL0Lm z9bz6IeSm+ZghocwOG&?GEO^$t{~y-rkQvxZOpB0$GGTv-1h|3uj9w-^kFBU=+3i|A z7&NJSxq-*h7Lp*IG$KU)?eWyR>092nVC5?kIz_1j&{l-bXqlHLv8Kjy{{y2|8Y{|K zPItZb-|g`^)-Wd)OuN5}GbIFeUzcs*Dih^syxz$izY|Nj;`CWdYpSkhJq|BK{fN6^ z^>`nb*+T=flv#c+b6k2a(Z7IMX%?o4U0VIKh7rxw-U0MAmJjL2Ke_`W-A*m^PrYp* zc$3)!B1Hom3)~dr)c%0-OwQyY<-dj{nYgaFpefo?y-;s!h__A!e+^<`#RZMmnSIh> zV)XB_jH`OWx}^*2<_Rg+E_Q?J(YdnAl1EqrkFI|2)=%3D2ltRFDc z4Jkz9y;K`ZX-w6#JXyh0%Nj5~5SSvrnQ@pHvt7l7yy5%qlFPcfJWY#?`MF0Z;)ByF zRcIiNm~YUE05s+#wj8bL_5O#Ye6RcL9i4pk6ggTntAj~UMJ`GMFBWB%J5}N_FVgr|Q@rJN-n43gY`Oyjhk#oT16o;Kr*D_N-7Zl^4+B3%y}qcf zpZZ^(7TJafRY_W9lhZYuGtY#`|S_wtq@ddpln@ z4IEgX$?@}E{m{H}z&m$TSlcydRmfNpRY6pK=F?02m$LZ(ua?MjAH`gK;?FHJY&+S)PuMq^VSsT-@0T%Ff=`2d}O z=+jvk)!cU)mX$TJbzu26%Uk!}H1=1(uaC35{CO&8t6KnqRGuw3BGI$vQslk|cDwCf z=fT5!Y0TH}H1&kZRS9agvkxVfTanxSpGo{wF-7rX2@+Dah^K8?$Nci3r__>_14l7RyTeToz|WX+V?YS6Cv*z!jts%;kT3D z9WMQ(GhjM<&-=C!t9>iThS38pZJKg&i@3(5t49L!&ErboPy_;ww|PH*e6i7XsJFrN zPaqTvzcqd2Y&L412oMj!b>9o8huY50LFLM$6Kjgm_k>07xA8Z#9*wazvu3jPh`*{) zaYvrNR}P7YKmi&%MtvCKkP?>Wu-cY)R=vEok8~TkObiDP#$OHqq_c*VS*nkHYZVJb z zJt_aGvtXVgr60!|NmTePxi4W{*v*fmOz%3b8VqR}varmYDkE-vtDM$Ww{C7qwel+K zMYTN!n&kGuN0QuqoL728MQb^wpavWh#RU(562J*;L^8K=F8czjYe{UW18`^%-ddu|JCqlX6=p;5G3}{q*8Sbu+Ga zo^PWg#kqon$eNWP-7ymJvo#_pF3A}-QVN-G4y-Mjw{lW zie@MU0b|{d6`3p1WjV7#0r_9oD_iR()z`c97~9?C(jjw`$?0a~VcvvraHY2qd8J{g z`Z3U2VtRNgYFftb7OnA&QOB%|64a=HP{I#e#pp3j<70Fl#LV=K%B)i#VE2_=y;kyQ z5upk&CqCCOT=n_(Y64~!UaV6}<#@q8Tqu(dKR84?Z||Mrh1kV&99R3L|8FtbAsg*^ z=XYt=-$>-Yx}7nb#UKBGEjaZ{f4`=GpwQLUj@8W;j%QX_`oh$4o)Ju~EKD@kdsL+@ zni1tgc#)P~Y{e%tW$zckRURqNiEIXO2?$8Q)$zUChyaGg>P$QBPrQqm^-2%nl8+h) zg{6mSzf#8@mA?#IcDyn90dliT|B@^FQjH&!=YzKQtP_S8)xik)E~8L5jwZg(>^Eht zqEd;YmJ(7Y$-v`^MWb;s?2SJ@?_L*W$JhU54XS zlLaGuwxZ%(tmm!tT&B|&WYF&VQVpcvXn*!x*)3%f!0g+68G?~9*O~*Lk~P#s5qhGN z(3jO_Q=0;-Sms>5G4mg-$zSLa9(C2z?G4#(8Vfa8QOEo`>X2Id{KN*PE%n~zVYUSS z@qth5q8#{}h;c0|mau=B$D4gM*)RadxeBjy0RKedFq`V}ci39}xl#e%kg>X{tpUO+cr2UYOF*;~ya$ zFdB*$1%u-}k{}Ko!jXWg)MD%8W}x4Q)s znOQt*<~mQ)N{!1{JA0lQ9TszRs4+G(UG68YYmzCWfKt=p>4M{x8#otUU~3PS05vtP z5ZIUh=oWwtcQ)kz0uY&|6H_0V>Am*O8^j(>HWvKci2k``PclRyDkfX@`_jQaq;X>_6xpe7T$pWiBz#b7` zHoyq&)*oFWK~8HL?aTj=g+(duR*OSz6?Ukco0rYdh}%}EuFwpz$u(nb3@BEAB>wdz zA1Lr9V(T*f2p?KoWG~e2eTfWFo%22=q9vH6&@7H*8pMib zLR;m$J`mBov!|jqgCNA#@#onPO!L~Td4i{C+ugigo`};e2ZU1;)Vy^OU&f@G0js9j zhg5VVdp1Btyho-X5o9eN?E})}cD(TcoiKA6NNFAL$Jf#TyG7bg-%I4Q+x6)exZQ!sM(1!x}cknzSld#Y(MLLW4KiU zK@94j(MSFXd_W*uA0a}o1wlDo)Q$5PxaTdR{KAlZRJeX{UE5K?%$+}FO_pE{AX}2D zJduF~(J$)N)HPgKbUOXlw%H&l=@l*4iL7?a`P22dAP z6EmzIbGg#xh#PCR%caGZd{tgPZkmYr^wesZ8y-x9ZzWC)taq%(2qIx&`^Ra|vu!JI zRrTdRTAz*u6vHqPOLD2@N9ao5Mq|4o>e+x|!jfEbiBaYLPV{isR5)WieB2qd=c3$3; z(B_uPFqTHOXHiSjokvf92(BlpQxDs!e`S)_%*LpgA?(!PMM4+p^;vC$*(vBuAJbeU z%@sgaA42~m*M;RFX0Ntei*(<+ho>B3;(=KBw+fhHmil9S!4ie^W&5^>whsO7DLW6w zGsv!!a)IC$l49_N5k$HcHjrt?i=N6<&@otf9wH&Dbaduycbw%(j< zs${U>SC7nHVuOgf-#m2ken}Rc1n_)SWZ?_c5#Hp}_=? zzcJ4mqQehZ7)=Sa#N;fKgKFB9{54^33F|k=jV8;4Z$lpZBqPg&CotP}(6U7rJQS2s z(&paj9bwo?4~V?9ybXy%;B#w1@i5k#Vc|C9>Jnx^j zo^&)A_b*b&phM-R|zj4-~xfffoJ;T z&utgaRUSa(0pH6m&~yZ-B<}v?Ki9;ZM+{1>9(A3QcEOut`VVzI3fbUQ&Im0i>}8WQ zU+4XV^$veYw0J3xVje_2`o%GOZLUE4`jr3b_SDpMqg!(oOxfddx1FOK((_1c5|D3l z>_>`OeT{l*W|TzvKPuS&`7O2>5&;)TQBp#Ovg6n%e1!5$cfdtql^G+tq4>nrMTDac z5%8LpGNaIwm7w!)LPijwyLH{q)_B9F*7oHHNp=t>WIt+;vVE=y#*{@Bn9iLaeOPe*E`hd~`OKpF@#}f5AhmVC1H;c%>i=yNx zI|GoBe6tQfKhk4Ie4{GPf_@!rC|1SG{@Jtq=tG9{5y;GE^lY9P`HJ{#yM4_$Z;aSA z-v41htn_fXRARaD?%L$l15gBoyxm}@Z4i_Y)Kc98ZSm9Yg?1jwUbyr+}W(;dgm zcKw0KS5bC{`(|=WACsTpKibnD)5QNCd8`%MMVk4P5S95dEP7CJC}X4)hxfm=0A7~p zwGJfZdV2I(xd1~cQ``(l?ne9$NKoKRw7q6LfW70;mi)|7SdF~DruSWiwIy~~Jc4#N+syjM{Pk9Smp@vLc-Q#NrDPyh=< z$DDucRwy50wlq|FnU51@DxAMTAA}9UjxZC4EL2jTQP>+7`gJ*-QYOkQZtDx}tsil$ zrQ0P?tqp;bNn_2@K4QRpfa4Ze2ZA3cl%=G`>e+;AO%ODUr)zRCCJics=E(qRgVKi6 z+ZTu}!1K~4;^LwMV0zFr{u^L#x{-Eh%5Eor>3ymn#2F9%9z}pOTX+9K1boP1YMo0djOG>1>I z(dNk8ITdT3FpX_{z(Y!tglCax44 zlh<&NZ#c~q^OewEjGRtuNu9??jV*f-GXDKJjrQp2zegLM;mfwm^66Usz0PF29xBmvPbE729Oj?RXG$5{_hNJ$Lw%cQ4-+C2EJsgKAK z08LfpL?l;HH47f%A^N3oMrb>OXCF!8j{lCa1A8#}j~{nzu^7xqW{@yhyfGen8RKu3 z`WPhS>jvr=Sly9aTKTqi1W1wCAH>VS>bXB(+L;+Fjx0nNWPP#VslzouTvI&CRIFI~ zvr1YXYqvC4`rW9>9n}~;wjd}X(lBvgPpe98d^oShr;22LkIA0*l^>$0X=nfkRg|zB zHw9(OEwF{akwY7KE9tHSN_(vWcHJ$-F+oO{#8wY#u$-J!xB%(6?>N;A1Yo@&}k(K8OzMlWFmdEi<7yWNpS7{?9^;x+NAo z>auZW4PSKk(1K;9Or~`q%Y>u^O_qHAkboun2}?Ix%Mc0rPtDlH(=Sv`vS3e%sz~+2 z#bSTyg&O7cZ%o8A%q$u1NT-lLJTzP6_$krr527v!PSI-l@LVnO70aJC`79=w4&464 z95l>;4Q=E*rgP@Jc7=~*h1QQudMr~u>T~wS#&+gc)8FqVM)G zbF(?i^XM%f36_b@AD0P&w^LJa@Diasb_tUuliVzNVV++jjpn6 zf;D(`GagM>=3rKTd&*B^W<2<-O!6+idR6D33%#wG$~-R1<89%-T#gA-z(CEGXEeu1 zeMF=tUgBrw1>%u0*8iQrM)^3Q-g1cxMcGG5$aUPP+=FEZRtDn>$YSR~6ow9({vTYl zRYLMT6fb%c#hVI*BnzEV>2SDd0EzqGb3Pt(7U$i?MZ2z-`{_F6?S=_$@tAYRf(uAxkRBX~!!zeC(O&kwb-rh+QN-egyLU zZ*a2K+v~&ZhO5nskhj|}cbQMmrI4heCl<4(`q#Vv*9HbIT{a*@Y=>I~d7IKT{Kx$f zexbbEV%KXqtH*n+Tki|X_EOXJ?rtL8o8-ciQ=x0OM!~?Ec!rZ!qA@0picZiV;Twj) zeRZMmlX0c+Yh&liR>YZ!d@CzTgwKP+DZooihCwAY7D4TU)#u&5zNG7Y5|kZm*e?3S z`N%2*eV6U9|MHTybXe_m*WTZ|V&?Sw^}?s#tKifm)L5CMY*{$Op$*i*T|kJfSqopo z#JHxWd(HIAV6ib>V#V?H;rmWXg1!}ug`+?9uy%nVpHD}b+1VmSLFa8Ni3^3y6LVr% zyBRyNIw{dIqU*+C{~7)kU*_5}CDlMS+iHLP!;(}zEl3w*MQOSG;KSU$M9%|F5Hb^e zDGY5c>%Ov1cNKN@5vl!00m31ya2RtJ9daLbXj$8Vpl>*rc^Nn8*Gi%S zp!pwFzq<&xugKNYZyo6_zdsgZusGHVD>D2FXdUBHvo9FFQp9_ zRi|0Z&RkoW&hM_IeHxGzd;Qu;FcA`wRil~alcbALv&T6T!yW`3#PS@d25VAVt4U+r zx-a-K&VV$92*SUeJ3J(y6Es=u%GF(7MqK18bs_Pw{@J+wd$)IZIGVO?9iwf%74E_- z!4ZDTr_P9!apn*CIN)Ju8b)IN%gNccN}1$5ndjcJPK%ISQ=<&ng72KhKWY4(6Y}i6qYj8T;f6|k8Pf#Eq#qJVrpt;ZvA!r z7H~JxYR&ArN3QW$pbY?7O6%)s(+`KEQ8P}`8mVLV7DVn%o8~YEIQj?$EBJ&~2t{&Z zlH?$foeLBEz;M18fBx}b1eJ-L;}~Q8Z1)*pQTgVSNqWGbw27!y&&Q+@Sv8{GWfFyE z;cvYjYZ4K7xuy_$J`80}H@#n4LNrP`^z(a8fxhAuBZDZ!dj_xkB3l49Qqwi8ww(S{ zgl|zij@zQ}T>)e~rrY--EpW<1a>ci?U`Y|K3CvJDVnO!Kf?W-1M(7W@7;TBq*^jIZ z;iGrI1NX`11=uS@wXNT|02P|=`?JfsUZy`Yqn+tMiae znNVSA9J5#w1b7!yy{Ez|3ke>15M`03{YaTuzWWg(p}P|8__GXN<|N{rNqVc6&7C9L z=*<_Xki4@1>GZZ)o$#h$3|d+)t)b4%mf~3v8Xm>UDLOma5E}N08aC<@f-h>x=0dtBEUW8=6?5QzC0TbAQdm z8e{1r?xC`jAUH^zt`K@E$Q-)q8comupEXJCRp?K?joV~Smg+eK!Oa~CH1hIfxCPMi z&P%_6Ik~3NsN>Q?j;&myR}wiXDhCHg&X=)z<3Xz&c|hQ>59Bz0>9IwmZv?m=RAa>I zqE~bR`K{rV)j5aCyR{3?MNN8AhG49yFD#+&9Y3M_(#{YgF)Mf`gG_ndvc<}46WK2k zk8%~QnHfL0zz+;u_xY2_>*)M3joyQVM89LHEV>Yr!<^6X>gEIo?CWUsQJ!`BQkOaKEoi&1pi73-`>bEplZK@j4aSVP8$&HUP6;3E^ zA#Vp#3(?@N=>%vQ@{S$o5m={DdUSboK2I!hY0Q>|Yc~>p;H+R~NgeaA4E&z)(@1T& z_Qqg$f{%!1qg9paEe$qK6tcg9iK!_I^Ab_1Q)DZCgpQN$&?j!xIv%Lo{N+C>y0;|S z+IheoW-J!@L%GwuyEAzzRdZT*-p-QL$G+}_I_V2DMp=9RdoaR|S-m_D@xEITh~aLE0EbO-X_WNx zyZX5 z7dA!|oCL|3YyIRuN?Q?QK@xkAjw`Jsi{$=A4PG`z2pvA%9uo4c5c|cCtrep)^s^H+ zUYw=UAGNT!Hk1Ru5g@q~lj`iO^;@^JwZR?uTiN{SpTO6hKV{Qa?V zz9$%ZBMA7plYoGH~NAa))<9l1Rrfp#AIUmw@#qmQ;^C^8Vt23=X7)}+7F-p3SQ z)EyAEj1*1qh6X=_T-NuNm)M`i+=BMb%q|(~yvm-eYQFmRT^!oI?AUGJMJMl@CnuU; z&fNDt`GR_$J;*PnO}eu~?i0nM{wt2h!YiFK-t}J3uWaCI*>asY=wYU=OIo=ysE0d~ zbWMIqHr^BT<4Fe(ucAIy-1*mmUOiWCuA_4xZ=<}cT%gcY%VSWmpgb<2188CMb|FFvKI{`Q+_SVzx zda3mfT(vvCNzegoxV0xic4@rJ&e>oJ_26~ws!Wn1%Xgc6@rQO?NLX$@?lZU=2VWj-4Q2ankf#~nRi(*@7_#FDqaC} z!DHU*#RBFd&KPRYafn*SG$vNL^&j%J*QEWJBygt*Y7c+y(fi#)eY1J{WFyu);K{a# zb4=?3otH^fR04iIs!dv$D(pCZU7pCVA05soZBuNs&$$F%9)Ru*3mONP+kSD0*nBBY zd3+RW3+!Gyk*v5-NF3N#1LnQyI|2@77qVbWy@OSmbM zrD^WO>Y34BwM@0tI%KwqY#}Kc{L$vbl>o1$g3mpVQ1G>&g(>Pt-k)Nk!k8wFkW0Bx zThp!3R#YPIlgnbRB!12qQSAz=$$JU9$JgBYnllNemrqs3QzfhHDj%vz6r}E^5tkty zJ1IFE8jd!`_Hj%x+@BmsO-!8UeG70$^lH??Qt~$oH=WU8SoYEb06-3#UhR&If7n0y zw{66&W7NI}RXF;rF~X5nkhFFFB@ykB(2zm#sc?7->!B-Nqe?1ZIHr0l9GZJC){X5q zGeP*(>q1O;W&WR6$-`Us!g~EVZ)x;O1Q4Bw1Du^_mOW`iqY=(pRbyg*OJi1HRBln- zND{p&o<>DD@O)Y1VI#ycdqJ3w5%ttA3qJ!mL6zLrUpYX}mNu#g=vL@I>g6PEW5~2| zu|IHXD(PKIGyA%G`;VU34d~u8DNb8yKn=h*i0-9NKL0eGL>&{)zDY?e34j+y2+ve> zaElGk(S$_53Hwx=D5Js25JOaBEqfx*vewF-z;DPuT9iB#W6vQZn<$!YdOc|*;EY>9 zeJR8{qS)XXN#Pd#=Pz=oX{}lb zrnOr-q?wwYW)Q zQ-{8Xq(wH$@06d)T2 zV4$ED8f8U-9_mKC-b(mG!l2>4RF8%k<(GLq)2)d)79S3It<9YOJ{)BgbT@m{?`PJMrQjyCn@oco^>#WUTa0tg2L-wuL~{UXP;{I@J1 zEgt_Bwg0VeFUwhcuZjm2FDAU0Aj{g?KGq+NR6IkUox-5-6w3iF8tDsz-!)PyLTqf7 z1fL#>LC$!}pC!&rs`j*c{nQC2BGeQ6Xao1SS#?-{wV3br-X&~a1^n

    CkpC)%vb(a>fL;4A0MFp^_5Ib`kS#Q(hwF>bA8R$9`dT z-j8_hF2HFIgj?__*f_Fmo!y;)s8s*@CmGb~b#$)b6x-3cWtYg%$q4ctSbLJm181Qw z^;R23%|BiR;sh=vKuE)FOOF%tz5BZV-5)vY^$?l?bS^5V_mhtVjmOv5(ig|B?Ft-- z(WlWWJx#S=%Kokz#4{nJ_Z>Se550k7#z5!bXd~gr30GLTRTQ!!QE-MZ?72fq;OyaX z*ntI|ZHrBK%HZK>me)QleB8kBsgrZN@d2#ygh}3_oBq2Lav__$6ef<4-H3xUdu9X5 z8kO%^nuoVP*ory36Zj-1D*(a2?Yk56gnK&DIB?d1;;Lm7P6&V6F+t!OZu(li-umE@ zvX(5E9GQgjzU;X1ZLh!@JxO>*ZYDVsx+}#N3~D52O5WuXz3GZY1b4#py-bs!l!Y|6 zV^?ggH@f0e42{(e&#?(9csT}r{*gkJbk4WeXfp6vlN?MMMsOXxjl$6my-qzl*Pgjl zDaNbB27{J_*F^FJEyvDiNGKPnKe>=1qAqH^jJy~~E#Rf)LL`{3p!d|d_@qGwp;0&KKde?zBp7&19>ATpqXaWyg^%PYgn}s ziZd#iixvcFn5mOxj2MW%lT$+RJ>SqIsQHX!ndxF6XKX0NVZQlU$xPC{>%3WzPdEwO z)wgU!SNNLk>{T;^26vF9)I^?$b{0Okay#NOZYV4>OT_`oP{Dlj3FV1bHp@fBvl^tr z{qsi>RD*NCPcs_n#}8b4$Al)OO$FDITP|D(>K zcU;DKWu%-FMt{-IW=v=d?#BY*7&b||7_GHQs<**!8gVikB-lW2vUEj2obPbHSc26P`AU;@p-DiB{Pk@zBIzofI3T@>lob-yZ%5{*_f~ zqs8Fex9h7#KHF12o?|Z7$vJ{dpMi6!zArIGtg7r))3KwwC1WUa@nxAvHfjEIX9)?# zIEj}fh2d9>Vh%x)as5wMsPy{5mCTtYVm&Pru~vkB;;BufYoEuwM3b8^mqCpOLDW}@ zJU)XBCz+*eFfV}EPiW+!WBG>AXu;n8iwnFHVRnwzsEbvnTkd{7YX8l64%c|@MeE47 zITN}-TPyffv|9Q!8a%yN^ng8FuWQ3fS$M13E^yF`SJC)=@b>-Hg@(%9e>2dq4YZff z6f#LgUW2bs62a&o;7aLnx=g;w3EGK){0yeOM-OPHc|*@Ywq`Rc%}w+~;fTHmYc#CO zF|fRBcv-rr>fY|$g0%+zTIjebdTn?6;}FEUXf=FIY4_%OZQQR`&;`R+;zqt`=zp54 zf>XD5Vn7rM2#OW@Fzj}j3;VC}Vs{vdxBPTejSAMSZ_NDMQWC-n^D-k)bYDizYp5n` z5HLnJdZB=WtegKS-qc;T4vFhL_2{~@ zPv{hXPHPBdf`6COQzb>1eiJzcNm6&)k{2Cxx@7eG8O44BG-h7N09;!K>Wte#DKf)L zO9b#D2qn`C32(3{c79d%lXpK;tpEP_4nm6#4ZJ_!Jy~XNZ7O6K9{>xgCN8m^d5~Q# zHKctn!XH4g%I(BCC!jj*!ffdE!CK(6Xa(9UV44*5RDxRv0(f*0_(}N@n7@6{hF4O^ z(5f`WlJLeHq*nx1otK%)t4pO;TK(K#!TjQ0V?N#Ge$l$gM%f$d`?~{Fa-~XsaNTfY z9%CLvP20ag+G|~{atXXOCoFC2{1j%}Ra1qMw#_}WvA?f~|ExOeDROH+NikO!CZ^&) zA|VY!iZkNs*GmYein9`|a}~6dL@8o`NDoV`(`=Xrge=$jdwSgqpT$yxdrSXdK(9PI z;^3PylN8Tz<+8nn2{6*^=P=Bk!%0T-f?+NodmJ-(MUzar4nm<|;w-r8Du{Z5jlDV~ z5^cb&&~+h_us_k(gDEqz!xcsr%U1p62Hr?jU!KcE+ zE*VPTwrrQE>Xx>|t~m7IOXP)DA~?NOn#9Yo1L?X{$~pLmQsAuaJuKn6Wu7w@(+*zO}kArk+oa7KM2JZM{224}; zlf7nv!UB?sGbhp6=VZQ-cS|C8Yt-@vRw&3ng$vb@=V&yl%*pJ?k`xl9e+7D~;nW0! zXAmJxsCo0xGb(c+gR2=wmA|hyWV%;sQ*($gwlhg8C2RR<`*RBg8lsj1fzq@z_d){M zQZ^s0lsH@*D#>w!n&Wt*KQ|~E6JFk5S zu9K}da$AP+Vn)tYm5AEqDQhb!Zt>3Ltz7|5k2i>Kz~)5qNz7A{hJ5uS5KB=p&Z{}OW#4q2nR}zF1!F^o=s^Y zOp^LwMXd7%$6n{tZ#JRfGL=YGz0`$3JoqmTu?EWY9%Zu$&$}_VT?$SP@Aqrv>J7I$ zBmF#2hBQ_Sq$lB`G;HWSj-=~}6H_kH69WHiMrCZo_6w4$jOEmREho&rlKuIAS^xtB zALdV;d+snuv#n+eTC5a|HUS43lxsDTwMCVJ8P+6iP>K(dI|fBx!^C?3?qE zzgGSi=2oakKhcyvZBKSK8mDUd7U44+jZAjwN12d&!}K~7K>pN|ryWXv{>qYYiyj*v zp!*YQ=Yd*dNz<1xhsOv{zm z-lSt-;D`Mn(8J%NSHv=W?(wc#%BL4MKTgR5urN~U-m2EnTo4w#cRKcUj!8qdSpZ7W z<3`aQZ;{Zxt=k>R`AguA3YQ<*?b*KYT(0@0s$O@t`1Ak2{`4M;U4Y#gh=9_w?R*Hc z8K4>#N@iAtO|nsmJa6oon0HJ%gRzm9Jhiclk#rI&*S^W;*Ot+w+G=YaP6*yT3KuJSSARKB_wWGBZzm)`E~h`>1qb*`PMVZ`DP#n&|cO0FzU`7(tlpO!oR7 zO}&!qt??({h5THD>Q`6+t$clrecrm`4X4lHR(iR|dYiq7RupB@n_7KVS4nM|CQuA> zse@5-hAq7#GT5t(;b?jq16bO~ueT*v>3FHBxLR@v**Uk90&9&7ULe?1uZBQ_^$1d$ z5qBG)O2x&h7<@_eF%=nOtMs=K`u>FfsVoc07@-ubO$lg3P&%zu#!-Y) zYeox1d{dO=FTv$$aQdJIt@26L9oH2BKvg$Q)@XQN8&C@Kn|k940DIE;?sASN?sIuZ zli`6xlW}+;w$F9DYsjf#)2hT|XxIWO0;vUDp)kW|$ft`y6Em|tARCTrt&tX#7zpP} zz9+hG+s=r{4SzbmKTuEb&Wd%+188IEETs~hC1CTB(3SHo0P6mZzeO0aRW$;J8{7b~ zB4bp6)ddGXV{Zj+ba|IkaWG>FO))XHkudCiwX9U%be$q=cQzKs$ zBcKtnQKSgOg9F9NTgLAjO;Y57(-{y9j^|p*?Ia>HE01u-;hMPKn#ba|BV3lt)>B87 zf)YH0x9poE;o4-8E%WV>EQ68pi@vv2MVY(@-pW1L#8eJ@!?DAWf0$0JDxM!@3zHL~ z>;znoBpGfDwoK|=38LO2uB?i;iUPgk#BY&={z_pQlc{ex8v`h&E3FW+ z7!5q)49ZHBs)O&;vK48(aoqMlvUFSKn)IEhl|zvBne=QIk@KgvzXp!W_T-XdK-z}m z@-_yEJoy#5nRg|fC)Ts--Q1;C6m%NBB}|Vi9Lzy~YF=c^)ry?{<`(ZNgl_%z$vGx& zciRT;Hp>@O68bD__chJS00NhOH;slIiHR2vah02HwCoW@Q#SrY?5GxKR>fexN)sv1 zF=CqkP=yqhB`?TPYc^uBL1vGWh!JO7b*`6nhL%=~&&4S+*ukz#uZBKs>Hc(wvSlFk z5gGVWOfl@eB>n&dyR4k%sS!G^D`_&Fn6rHgwlLo>^#tA@CR7a4kP}g)ydfK7-1A>hjth54Crt{0H5WWObZed%^=N zITKch3?%e6?|RgaV$#3a`(GBu(&Qe?S3NFWzqCWl44iHQBF3e-sc^B=`7G)5%Z0vo z#z!Qrc$j7?YUeC!s1<5bA7STUt-Fw#x zha|0Lq$sBpDYIl(UE)bLz30dHC}4$NhbOc^Mm6KV)0C=#c*9evG$L~- zl!h$!)ecokZN~Tr>mnC6fY4$PIoFZ$VqK8^ESf-ljNNzscAZ_q>%*({ONl?l$ppR<9|L-{g%F}VHs7+Mtj1!)xD8x<~wiw=R+Xg01(P{#=5*LUo{ z4VwAhWy|(^4aoMrbn3rzI+66P7j!EqJ)|`5eJ;2N{Cn{IoWIo3_PO z-?Lbg|J(937y|d9hhd2zw$yk3ZJ8*%Qm+NHZA(q_FiVy>M~j!yoqDSiCvpeem)os3 z2|;@K!i!Jk738-hpMTM1g)izeg|2<>Juf+Ov8BIDWACY&REukW{LTY4TgXnmb7?&m^7Jw|8~*%D z#p5l-%@;oRl~V%#>9sr7lhZS;AgolXP!$0ZJI3g~pLQdp`$=2HwnNS$1w$_@uI zf_sJ|Hu;nJwN!jf73MKZ#=anZxF$jAr^`YR~WP>fEi7j{$?VKs<7&bH62BElsWESX$m_-Ts*dJc}m`*%YX=yC9tn< zt~vIvfSnraS8p_A*6!<{QmC$&lQ7Z`5SbyFc2~`2rr2XRx7H4ng-RgO@V$UEG*p+W z(4FU3t!?P+(PwYIA*3kEqEKeQth&{Xi3lkRnRa?v3?r~m$&jlY@R<-1e&VK>De{yP zX6U47huguWGNpL2SLI4F{!I#RFC)_Z^p0gwkqT|SUSE6Oo7}P_kSmF{E32@x;*;3u zZAgDd;z(pgdBWM08nfj)Q%~EJEiZ(Rpq)SOJtqdFUEQ-lu1FaQ3{!?q-0Hk|3h3Rf zUr@7_j5M`mS2Pn6Ow=#LmRSRmvI3<7#k^O{2NWfPiPNnTPB2@H>Zs=7Qzzxi*{Gb? zeI|q~U`%aRp{ulGF~FCjAXK^BuVC6%1|iR1Xd5x7Jz#6b6CvF2?8Rn7o&lrx-$_k} z*Q0<X{eA2Ec3Yd!1Qon<2aU^L%RGW*sSZ5-Nca=IWU zeKx8NAR^3im2gjmI-@h~!xW!6N!s-WN>^_p-#!#7zbJe`DDOV8H{lcF^@91(vp z@UZAtw!&gGmx%_1VQ^hM0T}QPi<$G_he}XmqfSB^%uY;a@PU@6bbX!$*qOp%czyWlyPY; zzvD-H(qFp4MjsYxx+_Eff z0D{Xk?E!S5f(;BlI=GOXd`}>n$$<4)hNUJxvaGRcl}_;f3-w(hOH&!0B?2=}nG`rh zx0WwqWZ9EUp;k{!@Iv;NTwE)UdaWf8;;p^5^_TQXZ07dp^8(Ww^Ck<#OUlgsUodSE zVDSowgme<^3Pydpb#2HbB^Q4i>$^LaZ<~|Jw`mJLJOQE1E^dLW=bNEWk#@ITcdFya zk=z;Juw1%Pk+fDaB=`!5vVeUEF}gSUls4_3y*;>w-aC>AW3#Z2OV#6mj_e+oHkcDB z5b20+{PqCu&&$FeOb0{(+wj^TQAB(^yRnyc$QeY92ubVPR-YGXIbp&uh*A`GW1kOw z-W_1E)%r5;FXBR2fq!*LEk{(A0Wdk%xS@FufIT>P8;@#E;NeG&uZO>XtQHz(H$2P> zxIZq)mO+2}3{UH8Q8(zZigvt$9_P3kQ4zLl(gN}r7PSCp^5oREVIs-|x5Y?IzW-RE z75{{MK1su1Ao?)Ki4F5nEU#kJv31DA7BQirfwI{sw{HcAGdjcPn&$1nit(~Ob#{~l zIx_O~F(MN)XAcO4y~+oSh>r?%dXw7wxdVOpc(_bfKaAq_-}lB(+eW!PwpE%ZjE01o z4>0U+^*;76=$`qC7&rlnLw7QyNJ+_WqUw!E)^9J!Jk>ga9|e560XMZ+7l(OX%$(Qj zAU}nu9~4L)b5R$IGS+|F@w!8um@8!2zFz8N{3loe6JsHg0U=?b3?UN0k0-&0je?RC z9A(uP&~xHyzABqY1jRH#T_WrNfy&PAaP*0=MV)SIiRgAi$ZwAGjlL)?phpdc)*Is} z=F$A?djm?00Ie2=FYFb8w5|o!c;1(H8#nXS`PMjf#cT5jMcH$e8`w}V5 zRMwfe*oqr0i-TN=!0}PS;0le_Rn?FnZYz);;qz3HdM?OC%ipOsoZmgHgdxGugicN3 zI|-UWG5){K`qLdYxverHZnc9p>H%6XYlil@qi*rC;g4u^+Eg=*u$-Trj@?<%A8e5s z-&W?S>8F?*qBfAVl+e58gR`0$w^@&69X*kF5a&*b&Q=tC#ux#SuUlcHvXQrGtkEpVMrVZ^k@G*zm81rJ!B!pF zJ;|W5LdQNPe&7AbKk_Bzt_NE2^!PPTb-X!i=@A`t3raKL|Yx|zvQp`7xd|SZ|*oTL0LsZl}cJ;HM%RkjHPmN0X#eOj^yUu-Odz1i>@fQln)<&AOkBTGYUpK0J&>r-=)+n!u^b zilPEg8aO52Cm-2BK0PIWwZ`gwU1N_yiKP_|e|o6AaA(P(^TA4W1ek=QY54;Itu%~b zM&@x#$I*9iD%Dn6(A%(kIs#RyH?+A{4rScbXpDi#)Q^jYG#eTVj+k6A&3$W z5fU**tU#9@a_<}ZwpH(G+3nfQ@87TXL8EBS(7(zLOYfg`|J#~_aCAc-+e1n7r}O$H z?wQRkzDZmAABZJP(pKIlDSGiyu(36`7(P;|;$2=PzcwhPh^=(qaR!s*SN0z#iYNY$ zYJkz~LW&|gVz4Fo7sTy^#O!fj@E`vFY6rGuZ->x0chKHHz=_{AC4)hQ!FPs1XI7NM z>wpMeA>>?!@*g&6$2a8I_wv6#)Gqpm58CNGE*$=^8XXsfzPMd~nf0z04Axz2&`yDq zrBmEs^R2eWR@l+zk75#@NDFHE_+|OCW!>`7lz`S|49zDV=v88U`6oHU?C`}_wtM72@y-ioS1agL2H{Pm`ERUM{jGIo*Rs2OmKzC+ zLR8~11kB!pw))%k^7?B-3h5{Wz|f39N>5{cwi>!YjXXptfMS)oXxpI~;^ifSNzl0y z%Xq$1^FEjWP}c*&z1LIvSH&)uJA*Q1Fl_1nZYH9B?uneChyT-?jzi*ayHustv~hfYLS_V_1b%@d?>z4f)o3HE&4&a+wO4=*~cE*0ZAGSEt(PyrC9vWRIHERvVNGZFdL3L z-TlL@)O0Fus=Z&XcGQH17AnvIC{HK*%iUDparx{{`JeUUk9p#K8n%b{dQ)r5``fET47~}bp zk9k;1#=yueKZR~P3n&TTAv!0d_9sW(XW`d~9>H32*4UvYf+Wp9>J7m?Z4Nj(ay<|V zwoo5X*6I5-f-tt)bhtw}qBv8(Nd&Vj6Dr~35uwwx1v7BM!nZ(`mT$`C#YU5Z3<|_h ziy#Kr&OuiZoHd^yn>AVSNifD>jZ)4G|F0Z=AMk*+YtPzmZq)<6s}Vf)D&c?ggCFrc zRdtI65gHD1r0pBbj15cew^UI{^vS#BmsYEvT9GP95?_mvaXspwY4Hivt)T@DZh5Qo z(IqS-N4GiyxJ(qHo$IoQ3hJ?h9|zoIW>t_22PH`K;fTK8o^)e!%O`fH{FR5P*fPA} z+M9x85hv6O)U4H%gt)QK%*oa(y$%-nreQ^xV)|Bp|C%zu>F8`?=_02pGRc2Dru}J@qbk(-d7ohJwKG_$`>7!0%1XK@B$TPx7ft6X(Pz zZ~1ZELvDF)j@rfSP~I~p{mD#4lTY@phLT!NKmXR96?#;2_%4HA@GmoqKH0gUkX9)j z;OG;ObgPYjkquSU2}@BwsC&2U=^4ih{e0=;0gDw)o@mKXW=JC(*zwoYf0HQ8{WZ@? z9Yw0g4m%syYC@G7k_@w>F~2sVgy<>3(h{P(a8Oc0P6TM^_=vjXmko{HCjznxY7&SY zcM>n&@2s?+kua+%xSPW0ocTBvdL1@Wh{yO0`>yv#Je)Vo$cmEI*(32AsnCfWj6G=;VO4F2?6H?T=9p+QajEecZ+ZJxnNwhaVRPVqOHS zbYD)Yhu~5^47_po_Kv~|xs3Slx7QyFUOQ)QZR=n>g1&5PDyLsN?E7AeF`tY6q&#w4Qq3 zA#S1_{6;I8fRb9kF``9jz?O`-k!=vY;Drd)k{v~T*%-y_Ta-S4SH?l$Wxue}Q2T%L>JT4fClQINxLkd90CYEc-3OY@HI% zos^gloDn8>1*+#V6_LTWvF3(q8(2SAYx)#E6EHKPkAu1J$>Bis3>iwYbuip92iYm& zeG7p8Chv|(K0Yu(!G2s@EEHA^hxxtNd7bb^v?XG4wW;F*Zjz8~5_;(@LQk-Kkj734X>(lbFok}G(h+oX_ zdFn?hddtEsSrZI-ern3aVtT`<+M}vxtqz-5=Vj5jFhU9wtJ5oEP13NzQ4l0ze62yx2I2h=!v*4yoBha88dbsNo5Qy{)C>=l+a+x`b+~9+?W* za@t&oI@pOSi5JK;uK^yk9O0d1q8al`X`}L+&3VL~bYXhraTN}9hPNOauv;QEDC3>% z-U)t>1o$X7W>D6_j&OxQhXxNAi{0HzuJa4e`rEC6Kf(x$U1{g*X<1qihr*cm0@ zmVi8rxKC;k`i?O*GR45PXKk8sX+55wkqb+M(fzi{e8oM2cQfUVdo74EGjzdUROj~R z`Kg*?Ww$0C3q%`|Q?w&{tPXwA^7(~?APx5{jGl+szLMZan{OcbO&tw~jopzeMub^RJOXCUc`Pm@ zf-G`*#ls7+-e`Gh(!9}Dtjs$&K1Nc8bR2Um2Et4wC&Ie;%*l2Y+mcRO`0P32aX=Z9vEqeJ?G=|360|F^=`Mvx-z5>#<_M_gK4ZM+fkb3@$1-yiZ%V>!w!H_Lr z#-HB{I4gv#);!2S{J+`PJAcRt8N{;$JC-MWvw)OjgiqVn=#38j%pS|NSkkV2w?rk? zMEF7Q|Fi&SD(ZQl?HCqIZIdwnLaqcv)Ab>vrcjk)XAMV?k*-@aO~P+I3v^E?f-eZb^Sm--q%SenXj@tZS;Abiet+}2Q^pj{BBFV`?2B_6#ldGWV2B_-8uqAv+bjfd)~FMn*I< zHBy^Iy&+3QOOyh>m7lDZwJe0Y+TzRo#lTCbmNau64kU10Ry1$f6^aW|1bS~y{^8Pw z?IQT#{gjP_V{lruNhYCXZgu(;sLm3gMVy|Fyc!~2&0-+QUR_Ov7aa1v&h#?OG64PZ zq~^mnV9r$Q&DGe`K3#=wuS6FCtz@?2BXfge)1+ATK*(m!u_JLq*obfamnMXT|D%-G zVcckV=jD1Ma*pd=gbDY+@@;N|`icOVMI&e?{%g)WclSgoipd+~Z`uA}bTVMPocga2 zX~YlavEx@7Ehu=oD*%J)ylyr$$f6#>5lyY;D?M(RUg z+6@x;yBYG?^(L`~V1iarmurSrs`8=%3h}IR|^PJHgaiQc;G3UCDu_G-el_lJ<*e%cC};^~1KsD$2O@ zPb%DUYDuAI{XHVW=vbOrP7(M+Eim;d)4SMMKT!o1=6RAuX)Aq8!?H+Orq`tlZB$Rf zH0VNW9IVK`5Zjlwm}4GW_+Ik3%#yGjIk9fwI`3uZ>?v!oo?k!(PeP`sMFg7(-aKbDS~Z)qDXs z^NL>j#S=sCFJ3Mr6h1&!^1G87o*#i`yU*t2zir~0#KT&9@X0ONzBeBF*5AJDBCz}4 zfMl=wn_-Xtr{w>4bK8_0e1;P~czb&rx_D6th$#Q%b6SBpfKCI-Mt>usL)`Skju7Ct zFzhC5`zrpw=jN%mejUJ*fg6}4&lj@d z{oJ@0`)$LsZLADcz@|}Lu_XKHTfk^8#>I3&R5jzT_ZEG)xG7wwICx>#Pj=iD2^E`A zlkV*|4_ou{syyuy161SJ_fmtvX256pFFeH$FYBP z#`*yvsYQrR>=h0SC9&M7mh8u9!5ohCDH7$iRz1t%88z~HfLI4x)NnOo{4;gFC)_?^ zG`uFQvGU!Sd#ykl<`O5={OEYy%O_yhqh?mZW#cbNb3tEtfVl#8fL#@{Mc%J}7{dTr zZOj93uDpF~3_2j37m$j@_`{~hXBr>-P761l`d;UqdMnio-;As#+iddxN7GdXMHy)A zU1F&PmR`EMrF$g=0ZBo+B?ak5mK2cg6eI*`q`SMNI|U>JL>lpXz2Chv{9%?DhS~F; z^Ca7Pe-J7gRjc!%9s}KxtgvhB&ks!+?w_}=(KS^=g4CBUSXuOoq0F#ZS{g2PG{yBWH)|3`xuOO6grf}PCS5zff{|Go4TKLSkLPLFGe?NrenB3S5y2!2wAKsB_Yh8nx z-*VD_DZx=zQ~eyI`6O+}!{Q^B^L00WhP=`fYkCJgpW*<)@Ty-A%w}#QVM?wOTcT9v z+%a39?VLRnrltkQ5AI_Zpzo*7{Acu4FI1NF{vbM^{05II3>M>J%oqPl!; z(~*GDn39xwmg9nv^ci-Xc?|I<|Aa7vhV9SE40#N(*EdNA#PkcvvJR_+L~>}9`XSN$ z)nn`l2f>kR?pBpeEiGZEw;xY~u4#7UC(XWJ(Af}!G9n^d2F{m10%vF#*i|jU#bp5r zOS3TYCD1WSwN*Ed>30#`4*XlOA^w9Ekifn4Y3V*&rY#8EZe2gnzSS+U0s8~9XVXO# zp1ngrBRAe!W!7=~i!y-XzXsX2Uwwh~2Mh}Qtr!^U1rT2USglYX)&7d$7gChE?Z|l7 z>32WxJA$`?_bcbCZj(9GP+&O`$t$n1KM%Aw_FlGPxHZxF&H&O0R0=OR4Q`QO_xST94=>kMI&jI@jLX0DzjnQ zw!kG_&!+{nMY8Gf?FR*q{RG@bqaX(fo76ufB&VaRVACtAp%Fu+ri01k=t;ka@l6t; zHmO;{KzV#WCiSAsG6$Xq8G*l988e4HjCoF}zT7;m+n}EEr24}*nawy^>K9+%pchGL zNt_KUvS3G-hBallS@X@JH1m-s2B9#M#3zNwYuQ5FDq8~C>UnNg=6>uKs@iYZD`l`> z^P?3b34^AIi4baFoFFDw8XrusqvB8037>|u;(LEln(6Cylqn#{k|i@ad&^hr$WVnx z1w;VQ;t{=lS1aY>JSp2WvR$IFqEwi(*Xw|B79LI@t>Le`;Ss@4U#s&V8e=QlJAYgBa9wW+WL0N=P4pN`|{`)Iwr_Mk|ux zr2FDQY{SRWvR(voi?S;EDb?mhrJ$M2M7K~f5H*E{eii|L%7jneYLSKyK44l$1JeC= zWOrmZmcB`-@5anLcw0sr+}~^HY*AZoKe$a6_e?U&C}vPgh4MYkxN?6Bm~HpOY7Eo0 zr`$7vBmtb$rCZd(#8jK4H#6UGFLMZPZiX=V9P`R`csFXgg3x6{U<(gk+uhSLa}08j#K%X?>v|t%yGwmQm8Xm8ocpA?J%TfIZ0;KlTahiXA|}m@vt)4LKbw0A6$ead}l z$%NUThGgk!&Yh>vx!sE5SM6iYCJKlng9IhhrfWs;3R;T1_YWR$%-VnB*%~QxX{$bG zB;dpjY|_V+uisv8_q%D|xNp2U&h;nV5#0t>p1bAt->o*m-8)|vVoqf6f&uPg3;yp7!x4R9Sk3NvjhtbYxug?25@9Wl$3Ym+e&c~y>ecHz@+5xhTGj#u7 zNx70l{~1*!Y>G(~hbl9Hniuz*TjhqceyjdF8=nUlKs8pxm$`zBIH+XwXilHGg@^VE z&AS6X&42#p&&(X5xKO`Z0%A%N4t+L9<0`3%NjPja%wH591k^kIX`LBB4PfrY^#N@{ z4JQ5&6QW|#ld33c=4X3g|97+w>R6=6s0-lTqu%MnL8gv(*`K)^e=vtnc}VGFQic#S zBC%I4#ASEHw)EC^VSL6EuRR}~E%vnOZ; zM-2}hZh&p0TWr{u)wxex>lz#R98Eq78+dm=0qvG6%m^dFm9*0G8`o@56zt(C10XEc zcHEjU6j_;YQKCZs9^gR$_0_f;;~D2b39=Zu5T-MQjdD@%2;XG|N$^aohktEk-=^zL zchY<_uRKA(%#k2_#Sws+zL#-4m-F7#kA(v!`aD)^*Mjcw3eFhrBER8vpu3BPsKGD+ zdm3`JT^xwtnd}In>ODD*>s8Xee5PiAW6Sg6f+yz2BuD2A#Of16&O@%DT4Ejm*#T%q0R<4J zAnxm?edWUgi{}Yh?9LBrM8yQg#JVliGq#=%J*Xka~|}D>?Y0XBc(593vnpKu1c_K z!TsP()XdNH3a-W$dgZX-jO^+aTHDw|gE#Y>ATw6vYo5gG3mF~v7{dYvT<=o#*TB@yMBC| z`8nt!wz40q8KI;!aCXr*@=mLRES*6f1Al+G=x4P|o^~VE=p=JLpL@VyrP~9v+7Pkp z0|RNPitaMbAJNpm^rnqhv9>{}UfxKskWTt#V!<8y@H8(_Axf3hjzTwK^rkc-GD2HS zr=1lv%a5iSOqZDPij|z2(ucmIAlTS^sGe>=`j0uX_IF$OJm=FFn7=_uirybzu-AS7 z_4|V4*^=t{1$-EoTgYAzZKm&T=JaMW?qzf&l_xxr!PFe`i(?#2(qk?3F4#!JJlEL| zGx*S==lxCuPg=vsjGL_{+aD6cA9?8#Ypj#JtCzB=wdArxAOassFWTqMLK&^3uV)JV zOivbJ@H;bEwI)3G58&~ed>EVDR55)dw21aT{8D@t_m~wJN_!JT+eM@<{pB7`KR+eW zGS*5uL8KXOOCkw05r#^~Y_ez3(<0E9$Ss1Z=`z zzIc@~&TrB8j38MK6Du1-fw466L@9g^5@P2 z)OE7bcs?bEzZSx1V*jP+r4;0=Ls1O4H|qW8EU6R$2<|E2*htq5>3g(qs1@U}kUA{P zkwtXJCqoc4I@0kve!=fcpBqZKEi`q2$0!QYlJa1yqXF`^!r=9{&$X}fL*g06%EOm1WD&!%4*F6Y9%K<3VdkBjER@8rXjkF*H69y&H6SfPpOs2)!{; zquJd&`MwlNSORGy9(YWn{wQEGD73F}>w8NGk3!K;>Mz^(9onuz zAgXn3wZ?MBO{x(!6JLV`~DhavL@*>8j~yWLh^)N-`Ip=EOqQu$Nw*}md}vn%K?#HS5H>^O#) zw~sRdAe_`?uepOsE*n8fCNiAZzs%vY)-*^IHFNnC z7nj9$$D-%zSoZX3j$Q?T9aI_SfaUFyH0ZRb$Vvhlmd(uJX5&g?0vXstH6_~N$UOGf zKjrXx?aeGcbVDB#GXvn5@=h`LffKuDQ`Z;i{fOH>tLziePe&-iS=_D@qJCFgs&8RN z2wpr}f81B~ za-g%xp!jg>+lL2PP^*qj=1`x*=mhCUYA&Tq{NL1TaxTFkK?7(S?%2P@MKIa32i8tJ z3*UX;^9~V=l{9@?buo2a9e_bZwN^&m_3qs};xHNT05h4O3bJ`%wHb26Et(TYb$7F* zYb4!Lx#MPr_;_l$;c?6a@&qX_$3`>1qR5o9A)^78*u8;irE70f)Sm=vM;pv#(1jR3=Dvg^!&ud}~@xn&4H#PoLL)!CKKowwm50k#W;Q3{6HpiPkGvQ{;YHJ1p##ZPdC{l*!yhUe^BeCBCr3R32l$of9Bdo zfyc$(3lMRb^X;$Kf38*1c(!`NaBgOcrP0kiB}649`(h|X1fQ4#6UEm-MYt(D#NY>Z zwL13S{D#`E2}Ta)b5U=CDJH%b9>1!2_9lCSBef=9nt$SO01dPzT3Y`j-2L^@cJ_zm zWrL%aQfzowj)S@hG&cfeTuggG!>Fne@iEp*O`k8m`umf_7(ZLb)YQ*2Q6G0y!C)Nk$_lT1UCMRUwLx>JC`}zs z&7EhTfdBSv_+?V13ql$;o^Fn12p|eJ80hq8qtS##9p;2Upy*FKJQY2}C{ZET&g=98 zp>_-y*x=adyu6Nj(yZ~+xTMFMcBy0ok`ksliHf%)cyxviy)W4o+H|$NwB&qJAA+UQR4(<}ab6o1;L@!pvhNi(|}|s-65vHH%?}K#*6R zhB<31&o|HoERc`7z>0Y!aythYC5R&XE$++11)ApFYQ3U9S+ZRlpo2JwRF7^CBI95peE9Q5mYePt8=T z@jy4i-&Exd|hIQ55BQnn+ z6Zi7;K_OHfIN=o+!^T}dkw4a5n1Y3qii(4x zqJE^TGokYo^G75KPJH0lJHh7MV?s}@i8C7UkD7sR(pjXfRpiNmVjX9wUedk7H~ud2 z(NH+UH!M4zedugB`?DCSJe$|9BJ?8A_m}pFEzblo-J*HODbzk|keUI5AQFe2Q+<6I zNnFt3Rl9WP-PYI`?y=1S*Kl}B#wC7Aa$Hppp3mb;$lbGHXk2Y}3++)OCkDfBnpfxt zB9fAD$I;iKa+5MdU$K9d9a5oC)E-`A_Kq7u6B3iLr>tenGk;akRfFRWbu)#fC1)gC zlP{9Ff(hUzzPHQ|Hh(v15A-37x!Iu{u7+t{+@cWOxC2l-U0|Y9eX6telt{L(@t?V82B*g{i7(Y zBW7+*Yom(f)F1u)pzL6x?Z||7WaSeNN|Oj0D%VeRuOekhgEvzD_Mf8EyU#7oTPPr) zOZ-DiO|9XpDwDZukSIxx^Zk`0sH@p+-}z|1;`FYD2iWl3gmmLUI&-9G>9xV&WTBNQ z*bdshBxu>Ya9q0TC!|m};gOf}YjzGtLv-5~OC`i&luJL2{k8X7!HsFOuNKKo=$d3v zqg~mpS?+EX$BPCH^Rqp*HPnS1y%e()IQd**KxNIv%RRr`U=pf-aSNAr5oD+KEp-lk$% zk97e;U8Sy`IzSfbfu9!cMN0vn86yuSJM-5pjFo2s$TiO{G1fj57xV+HpK)w^q*3l1A6=TN8caeHoX^8cHHt86(?sV&ECBA(P(;*`T_#_@ zk`;=LruO`si$4PQY+=Y1!0Xjy#6(rXLl(@d$1^vdiM+zjM9 zg_+|LU1?z=XqkIlQC@UKnD8-d>lyY%-^T|r)fs@g)eX@}3?Xio9pkYiJej@*(~D{) z)UHG%a^CpMEx72m?py{UMf0%IUpU4je|L%6W!sAMKF&e?O+j?SHHoo}pmX8i3mt&4 z@J19wEslR^jSA{cW>BcDK0>QEMTtX4FrCd*U*MRLo0(QXX0^Z~jcX(PnDpK(t9r!5 z#}%&*tzee2#yTE^Fz0nad(+lfUQp0j*va8sjoF|kf@}Rdh1NylKDFi;rG1hti^ccm zj|B~iHN6-X#Agd*p#mV=+QaNUC7tuu-}mUWS&Z~cFie+?qxF5_wukKu8H@x@Ifqof+dyXyBPi-@OeGWUYsp-lhZwyY1sSySfHX2K;op zIoWu0^blU8zL&WjR^R@|lKyrB^3EP;TP6-rE8g34JI4+Oj5Z1%=RLnJ1Y+&dSJ zQd)4o8!Zlp@0IXAemC9z>-!ikZo*YR+ga97_0TWN*CgSA)iv|>cP~!&re9tI@86B< zJJ^3m8BM9fLgf}P$qo_D&dwmvKShSi&H%1alQS3ySo1qSD2O|>`RMmkY_-it+catN z-#gO#XY;nN_%10OIh0meFq{bIyT@E7Jf!Ir|OU)(oYdhZ-Zhp{4u>;i5)*#n7_1i z$7;r`fxXBw0hfOGYceh$SaVnE_r|ssq7>VbJN!~V0@@EmebfR+^uJ5`ZG%1YrsnJy z3=A7lZRyRMT{IxGDX1RLc!9AN{a$c7yUhT%^a_%9HT*>6H1RCE{$QRH{VltfKJl!e zdQ?`BD2flQS-Ll!3yPJO+U95ERF`Dj0NhTyBT@imN$3OfIS(BV9jYTBtkX4AI2cNx zuSM0`-cc6o_4zhopfZ@(e7No1SNgnu%7)?D#^u3;m%ZHjHFX1{0`u?nZi%>TY^U~j zls5PibQ&50ou=EVYE@vgZ2bzz>fhM=1eJlkU3ro$F&h*kxx7mlr=kiw_UC%pJXI1L zceqE^;>N~~-^A^~IwPy=i-^coHVb98B32vJQ=wQ{~=t zdzZP_64N>w@hQa1H0Ed6`3>`Ihm2!}gZZT-u=RT}hCX;KC3q-t&A`LVc^wtH_dSt6 zhR6&FYzbuoh=!HU!Z<2gTFWSc{mC5GuhE~RiHe^`mhBMhpBrr%fj2=BhC$`r;8Ce) zqrS-M9gtHiYEN@4CQ9n^IB+r#82mOyTEcGTPb3ys49m2GU|{(#D%4g^t@DH>YVxLZ zYDD(6h^zuJ>o9?(IimQ{O_8z?6?W)6d2)6}1VfaC!CONJCDEWQFtMP;Gfg|~+E4hR zpK_zGoJ1595M_(Cs-KgV`<_Zfxxg^K8tg~=w#bkGd%3C7n5z8OfqeeKFRq2d_Cm0x zu|IybYhN#LV#q$>EWT;{-Fn=!nf@T}n3lttDG!+nAhyA+Ud~lwP#CmCB7E=uHW0n; zLJP77zfCqGkX&=Pb%b}-g&QSuOgfYu$RaNBgr1{)G)EDZN#Y;kDLgm8%Jy1!lLQfo z4PXhOF&{#unu+3ZsKhGuEQ$G2Jzp*{GcE+TUsA~No^#44!d{WlN?tDo7Zfl8iK8GX zj=}8eo^^NtV7*wNK)DEeknO{FU9~i6NvyP$B*vgF5y*voFN)JxIoVt!kzY=3$}P;U zS$gB*d<7k_v)DE@@A*chkmxob`a)D}NlRk?Xl`l>9e-ak37aYjJH2V0gJO_=R(Gia z$t8u|id7`32ulTa^0CJ+S9MFVi%yCR^Dcj-q}S=Z@h2V7UH&G#tC(!Ers1`78uW+0 z*u!M-nbS%cdX=%uuv6fLS3gcbWOj|S&o#)M02KP*{#{XgBxA;Zs13Yw@ZPvzSG1z` zr1GEiTMsFFRkeL&`d9ov=8Vou!_F|GkCt9o82B;|)#8Gpr?wLpYFGdm@bnz3jwio9 z?v)J=p*ry|lBaV0_Il=K`7~4JQ3Qc^fsgDa-dpIv;4^)tX!=K+>S1Vd^{CfdVzx-+ zVoT&m!uR~eyLaqd8T9{u_vP@oPy=dMX(T|ol7h|vdG^1JuF3T~HXc5H=MRDR@8AFX zgvYogl=Y)G3h3;(c5)k)_6GD%$?LX1(VkLVJ*%~`z^vQ-U<%5kwBUMa?gjq(>QXxI z)UObzUq{_%o}lcsn8DKhd83_CkzYv={B&kqZPat1i1YmH85l=nT4bMb3^Wb z?^h2IWl$1K5(znN3(iFw5iJh~y8uUx)Lkqh9e~xqKY@ZmFKh@(ZIlTT^|YPi5;{na z<*X2;=WE)9a31BExkp|0r=3h@Gvc+n> z4%Z{{bwT9DADjtb-<=;^{mbN?vu{;0Ad+jK<%r>Cj4js@uKZd!a!7rD178TbrV^aHb~` zPfq%aMt$DDJE%6nrEsC^G9*J$u*bBs8e9Y6LiJ`^7JcIEl!00vCA0@>i#c8<6Bmwz zBNnqt57K(!H^PQ7jzg~aPl9fNxjn>w6wu~&kLRl9t4Z(Po8DpTur7_vKHV%Amf8gDyd$WONQ@<>)rTxEm>OeY#CAHHBG?6Ou#(9 z&g@338rh3MOrJeI|C3A@*3H>$Ow6!ZzHQY5O_X{D<16K@8*(JmE^HsJHPU%?c(kjl z#rY)g)fb&%xUELK!8U$07_iert-p8j%V+16fPG0vsj3(PURD;v*vgqfOX7;t1d<)F zGs%_pB;}7ru$IbR`#Cp1YlU`_1#lG_3OVO(_~F~pHV7Q}V^vkZ@A*nF;JD}Kc!JtBUO!p*Qk|>1A3}w*l_*v*N$FJe;;=zFHoDiEq{L?VOEzf11I$k0> z|3L!OqGeF?D=8fWTh0JpJe%Z6(pUvS)Euw>(}M0zcvpi zoqxP;40P{ugyZ=C<1sV6D>Cird`QdfwvoOdf4HmqD^BCR36{DFe29}NVUi|~vwbWO zQklqzHC>sc`crchY|E7(W~Ex^$)f#m1V}w5scCqAqN@ZL*2_<9)cc;T(fXg`hCtrV zcW<`8{dJ)N7Bvy?Z8T2fG43f+Nh2ls32Z-?4V9d)Di1c^uD3;AcmDm;$(K2ppB!$!a;e60#s|P*c&vL!PKQIm`zz)Elu=rBc5vcO= zPdJ}tG1gXAZ-?Miy=FMcYtnU)@uN=24KDw}845 zo|A5rUNL$0Kz!Ag2RzVPe9_ws9T^>0&vw>1d?F04GUk_&HdX~+f>w#KT{EpoQ9wt* zkB#-&3Z)6y7x(|aiW(e_&y`ag%f9DutGc%LIBx6pefy#doUYO3c~qR@FVMsmh@AxL zi(091(2P!q2&(^-KJxP!X+l913*=X8<;;IYA{$=FrC%K;8p z_%t6L5>gAL5oZ>i@=0QNb-bs-?Mpoj`3O?bJl|KnTBoTkYFaJ6T&I{fI6gVCdn1ea zw7V}GXa4A2F>hT?0}i@^hZLK`c=qCpPd^_%D^y}J+Z3j2*gu`@+-dJUKgWvZ2l8?Y zU;Yi3Rzk8jYbr^Q48rsUeAV|&a1`iDe8vB{%gRK(Dgmgm7L%TC027=OHfve&Nr)*V zqQ8ZB9txo*`cwk%h?-6C-RqSe0+Miy%Tdz<;ym~ zH5t_SnU2_mMAM(Ya7LE52VlBOhYvlcNBbQx#pNg106hF}%&R?&&>j5}AVpITu!xe-s1S(Mc?q3$>^3X^QVb_vd{!wDxR};D{@xHN2xBS$2n^)me}wX7u7yJdZMWVe-C@N~K!` zdgR>SiQ}tg&%>o};vvfie^RRE?BReKgM9NgWQfvTx=0tO-x(ZaEvdJE(;M~N#r;v| zIX+YmhSIUvl)1i8*ZFwXJksi%a$Xp1>gmnI$38WolWxeSkla9MT z?WEm)$*A^Jwp)_4XM=&wcUMFxf$(zQ1SnvVhYdz0TTa4 z*jx+R<{jnjCM65J?LLIp#J3>V_|V-kb>i%=AsLTRSN{jARF{)wA)T$L;A=y6pR|7f z+d7X2a9sXVn#4)|!mKpyj6GVY+S%L$nLhqX`}fr#c_r_&ZVZ>pLmi`LS9A;v4DVmV ztZC;iUy6QeM%wqdURkieLDi$==u5q><6zzwV70BMx&=68!5-$T{_ei z?(4tO7ItsTwS@MCYZ5aSjX+YUI_E5jJkZ(cUJIy45ZNg*Z!bc$BcNZ!m`QxMtB&{XtBfPm^Mr3WDa;EkFpjY`%WXx`719?mCmb zg=PbV9NOH-;lUUp*-|TfmGx8#nxrSrVvp&~MCZA=>Pa6cDD4#GWed~}u1h>NHlG;C z;ZYX7RCVd$gU+tozb1UvBTDd;<)#Y{R6COPYdh=XhH#q8@Ul z1~#V;p3OY_rou~K6zaA=Y1wW<|2GrJ|-;0ENO6VmjsuNC0acnPKd?1_99yQu7 zonBg(?4H_!2X%SCAW!x=Dz=iar^zCCQJcXAV$)7&TP{SUP8g)Bd<=^?K!cpkJ)tfS zwdvBjtF^S~B_4KRN*lWt=@E-_vzaUv0DQEa`Ak5Ds4S*)xbZhG{a%$ve~UC!R5Q45 zI$}_+bT>Txn`)jt+KnMR0wW{3mTSBCYLu?Rh79e;h4F%UCX48PhLVN;$y-g=aPxhX zy9wpeM*{*l=EU*l*Q{GSax0wEJ~W{T($9C@B4K=~!)keMWkvZd02_`wL7)#1 zP@7WEKEAbTOWjvxm`_j{6Cs?pa*E-X&G#}Zp%vYC-nd1rgFrzh-sgXd&L?2bJPG0x z;xAbXaT%-&Rj27DDBP*Vnx__33$xM*mu}wYInGMdT<1RhInak5uYN-)5@5hK)PYvirfL$fVsygQeHOMCqHOgMS1venQHxPqy8sf*4q9o-%=<0P6cps1qZ^B~HbxAAQwOY388-e@bYAA3wG;v^ zm<9rUC3w#)Gl#xcKgB|rxx$)gM^?A9*IdS6+mQN5z%)>xN@ZyO5caBU&X*{ z6WRfQG1#hLfp5OB7T{8-5BPq;Hk0EQ0N9A_cXqk_)@=NAhu@2^&GXDf9PX`}fybt?TODtyOr4 z?!i+@H3DnBgp-P#6U*0f8s+h?wNr%iOG_8~g7vus`q#CO$(iLe?I*6nmeEF!u;r_R z2V33}C5mhNNA3$lhw8B8z0FfuhZb|0>JjZ@T=@7R1Vf=QX4q#FC>Ha;{O zWh=iV73yMuI?k^?F-?KMBq`ix8np!@T&;^b=51@ zagZe+7781=Znm!`4JDKAClOGy(8M#5T>}k{XnF^Glm%|o&1Yaj{lVv|Dg3*AW=Z{1 zNz7vUqlS<=c87qs?GVJ@7wL3Fs^oOU2o4ql%GDI#KQB(Yv?Kn__rUu+E4*w<+xs7;>&JTM>~j*8$0~&v?VQ&&` z9+xZBK%^u}tvaOnsQ9%g?}98usLFOmD-&sCDOif?6UoxgEQ6?jx$8K1C=c4QK@M8; z2HVOwSV`JNr`SD8Uql<{aSJZV@RSdcH5l5@nU$c(g^Zbk00B zDM}&cGtrK~Uu-OWZ*E)bY;35NdEntDkvQ}4D7dY>?U$lFF$O}W*!zRlu9I0dOr8^z zm{r@p%clcSGnP}){doSQO>ptPSaXs-ei#Xc-%*-D)<2D9w*g>SaAexn)!4|bV-6Qh(*1##|5B^n^oW`macUT1zG%0~gj3S--+l!Pxks02$xG_3_ zSS&D{*MAFV!yc<~R_pJCxB(`_t8ATb=*}7wg7ejn%zhaA_UZ_T6OlmwxCWeuBEZeq zi1Bawa9@(n0_p9}KfW>ln^XT5FHklE@$vk>+>w6(-F$`N+e`C*l%`Rl&!W5As3qLH zASH$WcSmUyhL5Y4L_^92%hW@AibzznP_^TNU0%NMGFn@}y$97=b43=UwUhvvB6z6l zyv$}cv4$qEIkTL-^(ML-|Ib<6*kO?Y5V=wAanRyZ@ZsHPiGUoYMfaOq{2 z4SiClZLQ;nilD1NHd+MXnL+;Ozc%G&|BEWYsn^hmAu5-(KRQp*u#(`q=QRzc3sChO_8hXXLXJAH|RRy0=R$!8o+jfxuLikFj+Q~#8Qz?hl$*Tvv+`g=P{K;Tp3xEaL!DfA8!cdHwnNR0K3 zFe7IxWq8NJ4JyhHF4+YjgN4pJiubHr4(96;Nr*5ZUSikRSk^eRZp` z6A&G|MWOJ5%ID~-xeEms?Moi@@t4j3p6;^iMtA0)$>RUV!L;}G;@bS}TinUppE;Kj z@{k(N;)b1;ygc19#5XvY=tZ3!K`y@}oVtvbo>KjA~FnWlZ>2 zJ*l8`?p6&t2sHtL8Wb-kf{+476NYiybos@Kjz(gNq{MY5N83e-ii>yK>i_~n(QSIO zw}CO{2L!UkOgP{;?UBV;MgW!>8}fQWvu3xo~X9UtMQl=qw=JuIafCHD$|RZ30mf9R5-LK#A8k= z!;0a?%H^@GuUR=5ZK4=HMUanL)hZ#llbAp(nY+;(^7+YF2nt*1)HK2;aF6TUU1ItJ{@sp{{7tQk^`03i4`jf}wX{sv=P z-U0N3qBheWtpvflzlm=BbFv04dJkHfUMo?a-aC2f*@1psgL`*T9H=tE*>(|;1Hwnv zzk)=+XuPCbyhX+qr$Z(~QKE3ts~l1L*N0Xa+yZ&fjT?)nNoBoZ8XE?8l|4He4j1)g zibM?dXrBF>X^ZvDY0+Ag6Cb5M%u{sy`u_L*9p&K{VYwQ(s_G&=p&-lVm)@uWx3OKC zNT$-5iH)V^6AIFoQ<8_bkF{O&WJ)#!4B!9BSf}HpTbszZE~&{BCjXAKOGh`#wO_}) zb9Uit8mzYpd${!Y@vTT(4IS8dBzcUQ08a8BUUjlukFEqPTt(|w9!K-sR5Uc(zrK(D zL$AVc$Y#e8O0WKbVq05VPgr=0m>n&?G&aafG2(ywO0F7(RWJemr6IHbJTVx$IXqGBx%Q8O4dgG#r+oTBY`f54l{nAs5uo*8$KJe8x2c) zs%!AZQUu*#XgHPPlv9KpCpj+i_2{d!y~+P4AXV04u!Dl;Tx2ml6x&tZk}haycID~p z}IFAWLYFj2XzDIE8O1ynrwQqAR2Ov2&Ow=jE>=Vu(F1=U9#bJq{+r;6eK< zXB!IEI^7xz5G36)0<%jAo6D~gr;Zfe$m#@P=B5ezP^nFKrr349gAp;zZ?j zV=SB*!JwKkI+Pdt`N`|uyteE6RQm(iuIN%-c>-ljF(r=ucKL$L(!!PiqeBkF&%QDV zKv(qoNw=>`x|p}iGnK~O!T4R=slvvVtoK`mwwV%3Ezh0EFBJ$S_N>Cd7%1$r0~tZvD@6yvt4 z$WA^bEQI=wuoE$VChMAhA9npw2@Ew^uzzW1B%0KIq%=+wtcc7#8C<%{o*kOKYFy!# zJpee6iWEb+VXSpARc(uU?i>jPp7_@R(FwDsu^<)j9noNH+ub2orp9$tEztYdap zP2XTOCA#(Oz>42{qX>Am54VBx)2(bbjN;AoUcDx}|7ii_@rIU-yIlD+USKQ`zjVMY z<#=V*O7KT%b`forR8MgdL(B$p1h2y@Y+w<=rRNt3s2pN0b8KC$owG+ai5#Dvvil6f zdwFQxJHM|3wVKZgvA!B&5InmJq85dUA*vm~1oTl?PeErBC5N3tdHCSr_@3okz?x^c zH|aPfUUn2vGs3Esh~XJA{mt|VQFO!u{j{ru69hV7@&2Hll9P4tIN3^J=9yRkJ4($Ao)sJj$>H zKS#dSJh)}Nwr*l#%dOB|D=dy;FrPSfs-#)7E!>UDW#nc?4~w_6GL{z$y!IEPkhJE!HecW*T{eUA6NarQOrLu%bmcPTK>CxJ-QuMJ7b zPZ$)#XAK0uDn?-jy1AoW4u`7;-l?CF1)lo=CzqFj%I}A@GOxh1ewExmF%{8YR`((|-6i)GaWj82ph6burHBZBe4; z*{BmG$~&Tv&%biSY*c6Zl&!_AGygIgs!QwxQuOzK{se@=syiEX!|DKg97R2;s`hG) zBB{{NH{@!{>Z4{V+dCO4C1zg{Wr(Oq%=nlt<49@P(TVZOaW;;cu;HB)Bo`COLLvy} ze9_6s+(If_&E>y_dBA`ip{Yfz znQ>+5(Q*(NTINVV2XwTgfDxjqCde)`qK#NUOLbQLbEMnRr`yx;wH~W-_+WwsM+?&Y z;KxT|3NKI;BB80?I3G8`BDg_he)Hn8_*`lBQdU(X-)&eqn(mvDX08{tiq?R&MB)WX zYf(IKZss;Yl2y@ylS|@WXutfW{@Oy|k`~_*P=P2oVVFtW4$0lQdZLJ4l$;U`(%?eEHlTZ+oCNHJ zZN=|)n;k#k43t%Ms7;8kuH(?Usgdu99=@G^o79Sn&;-JRKC32R9tnkiVzeNcWZfY) zkKStNV#?xpL+^@lAdzW`nOxlQf+_fx257uGUS~f0o~=oLE&1c3q&7D96;8uWpIh#3 zRy<{xsA$9}9h9#>;zZOuGck65+m;F02Cm+=O&;m%>WRfXq#I(YNaj?wrZZVV@mx+f zw+NCHpQ#T#t{FTdk~#M}15ok}^T0q_{$~$ye|rNvYgwn$7vZxy2qVOAzomdd1Vc>T zAJ*@M*S-2>l|Yf$+M5hB7jY9gWBx9F#+Z3&c9w^UQ-5N9HQ*jPts8O2Sb0V2I$~U^ z@^)A5?QFN%(w7b#lDLj2?|sheJHC#6m98h6-`9b2FHZW7jpp5r`D&BPjtTAhe-;-* zt$#RtcQ?4wxb=$Lly`<2Xi1*&-c3++1~mJx{f(3(Sw0l>x3d*AWK@7BW+2gew%>X^ zEh*PZvz)DV*gz61%m#{hn9q{!fcZa{_{KS5X>l(|pf_zCrdEjn4aFMHPVWeQ!U=kl$*I7ZP%GO%{9J2u+TcT`K;`f~svHrIr`3@C99NW9DwM#t)Q^AS9Z|UJ7xeF*9p& zjt(#J93D4g`C9jkPO9F#5w)6tuWDZhTXx}-8j+&;o267kld6Mzwa!;a<$dbG!1&<6 zOcwNw@NUBA?wPQi)Rfwwisgz@YjY$ZUHsE7R9{S(AkZw+mpp}?pw(w!YQf|iOHV$i z8T4f*iD;ar5t^(llVwrZV93cN|7kb4NBD}j?To>s(*sB5rVF3JJ*bK{Xbv|fg5m#o zI_tP5!}jfOba#xDhJhd{-6uJbsL<9k5S5-)W(O%jTQ&rz%&zlFSNIv+2|{|lb3^Twvn{=zIsKA0X+ z@%Y$!D7I9aCOKYA=)3G#3-8fK+uoIxgeUarR;x;|RXzBJ`iou!@;J3)No6h1iw zF*a~e`a-Pp)Z?{|X*{Y+wCS{^%OnKDm**!MsN$480W~9eXA8iNT5&6^>>Ba{no}&% zMWA0ZkWEdMw=ppjfr+rqJ!2y#xf3S+_voCw$X}tY^VEd^l^AM?x7kVY!}aH(Y;%iL zWFuqagfEkpNX28^$}T4Xp5UB^vSr8q_<{&89J4-&XG`N4W;iOoR(wh0mg*ZdF2$#b z&`&?U0`_T!I2Bhd(Z_>vBuo#b1EUnuAW1o-`dV{zPOy zOUregC?u>HnHQ4OGvfEAdm~vU?E9+Z>y(}6^y=|4vu2TKDOo>o8^he;gJ6_jvZ8ZF zoXCt68w_8s&d>xM&+?p565j`$_QWF4d{5Ko)xKk~op79L zeG5%Z(^>Vri+*n4B355M@!|D`?@6yi-Rq&S;9Am+1Kn46f5VEfBA>oG@_u?SMUirJ z@PUjF%S2@65q#ucs0uL>cVD_F#qEAo)z{b8btZd%+41j6WQ~BkPQ-a7JT#PDWHsB= z8kPL|QK{OfSmk50?GtF==RYA0p3tV$lc2)jg0Tl7ad!e4%X+qxX!9rqUS4!gg`3pa zB~~R7lQUn{+MYGP+e{X-hUZiCu`GvNPrFbf@;?{7d-uQoM_-pG)hpR3Q@G-+!C>pw zzS9ogQIbKFH;Iro);e`|S(!w^%;5WBES^CX1x35=_C2X$j{IOFxN-Lbmxr1{d6rANBKujhddgv9?=H59tfJcePvmFq0#V#3e!SPXl{TG_S5$bML3QPJi z!7J{bw@V?emfAw(N&;B+i)hOuMctyBzeLFjMm-JoPFgioNB)fLlz50xwCH44mfb|K z!4MXPD{ocaDj&_dvd$iWqPeW;o9#Rk>xYmVC|Nf|!La>M*uYZK_f?WRH-&A7`XmS= zUm8tDuc`~rI87U28-%1I=GpQTc);WI?+ie%Lm&_N0yan{u*vE;0)Ns#$rbHv8x+>% z`xMehlfY#VD4(S*{X=_mcX-wB4sQubN$`ajIwzt~39IB5WOwWDX{`bE4wVdd*qhdz zo*hh$5HF2dlet{6ZeyBewy^!|Tm(a+9PeDJd+NW2OZXUZxq>z`(=s{OHzAzAr=C!s zcPF1p5P3ZTW_A)yl!X7S+J^C{{%-&j8)AiTDR)1{%T2*-Xsa>pq5G0;`)*2td{^yyss*mCx z2EsQxEB9%^4!+2{9A~$CBRW^oVjT*V&v_2(YXUxfD6Ln^tAlh@_@oGv13V^({xOxv zk|&KK6vxNKJT(PTZ;hlPhv?-E2q=a+U5D_Yv_!J92L0)V`~r3u@kXf{l-4*_l;-t8EJ%W`~K9Ay2{9XENvusPzgf<1{=WvT_aEf zFn_r^10qZGfrQsJ3r7-W*y;1IXk6w1kk#GgERugz9-G^rK1Jc90v9$bGgy3^)JvXmtAF&tQFu3I+H@-#V?_E{2zOuYVeomy zac3eA-^-2Wg777W9oXDhscUtwX#RH8HYUi+r4H2>%UownT_8{eY9u52uY0Ohnv<>v zgZ{m~^*l}I8CQ+bi!JB9vE2%NV0eCCKYiDKM3vfi1vG9o{^WA|_8d)ojZwA%^0?Iz)Hl zl96xuDn2y|FGUQ;*>h=7`DOjed}y5*4x@l+kwdvL`keb#R^)E`{5vVF?iOb8%5^r^ ztg8oJ%aSP!D4?h|h}5PNI``JvxdC_=jvyr^52k5)xsU4R9pWbj99AqEk|}y~nf!Sj8OQIf6kUtMx&OECZE1KHh4NW8wv?c8QB! z<>ch_)&~(YB%NqtKnV`-__kK4`~ai+iVG}+A3}NM{^($(MN%y?tPjdFXZVbW%#@{s zXy|Nj1tj@SQ^tpBz^uPK-~Qze2Dl6CrJwmz**felu>uwE@pC?5i3i*(U7JRLk}l4S z+w2<+8VX6N`qkJ(?rB2i+sxB0f_aUR`SfFzmX{~05*C?AT0%3G{`(6rxJZcehM1M= zv)aF-%_eI-zEgiT(}~uWy@#43C4{8f5-9cz>7ak$k`KRDtLI<(B7Q-h6U z-QwU^UW`KqKLYfxAaj?Wx0-vw2^pE}AeI_|U46y$gf*t7jp9jeVRsYE4w~=sfuvW(5k z6TZ8xtOs&CRipmwnqDrMg6dcltfdn!KEw!QUGmh`E{jc7E7nA&#s*IK3e{@rpC!NN zmD+h$Puv8?meQ*9HtrE~4CbfY9uQcPW8`$J(w06euT#VPyfRoBU@FpZnQEb>ntYh_0S#%(&fYq(3%=J;9hd_Cef$a`0+XS8-E)V_I zu*%q)jwJu4zV%ZzO%;iWP(41NQv}E+Qs!MqbRI*gyQ?p2>sQnm47ni%dnOm4%nQ=A|Qd-(8`=JnmINAN7!k6O$r+6^CPoKR^?|im14)!EBykbOp=Ax4 zx!q3svgqpPCbhFiJ$wq9)(~)Yxc3Bjw4o*%OoW3OC!^r}v|hcTD&Ggi8W3;gSk)dQ zg_)Xj?V1(l)eZ(>Z@O?!U|vf;z^Gy+^Z6BoJx;mvQb(wP9*7q%R((HP`GH&khN%iIXwP3q&Z^r!6-XoF{z!RZ2^66PKfvFozXSuAZPK5BPNg7! z0>oHgV!EOj;Mcm+J{S#{gK0}pnMl4t`h9e@=iSY@4U&G2Sa}A3QgytfaIDT~9D0Wl zMm5=k(qZ{t!uS*b`&_-qVe#S;Y-?EfQD7{=xBr5k_y+s`@CzVZS;|yzyICk4g-JPNOC%9&;+i zSUJV!7xe@mMN9YI?i$dWqq`sVRyKfX46BGt76CWWMXvG zD)M_VIX4-BHz~|Tp!oFtwk7SafMDHO5SuC45$`#3lC5fbu^rrue&~w?a`D4$rx~$H zEshDRR&(k3h#7A4yWh+P3#=tye%Nt4MP}3he@eWS%52MJ;f51EwoocRhoW+L#Re)y zWNRyX?BB_heG+(RY0SDY&Bct6lHakN{$ESA&@o0*jb$Y<5N~}@XGZ+1l|*^f32V%+ zZL3~fDBm@s?k8lw88sP5Pwzh&x5f%;5)wTm2plshT5I2$9av@;nXfi#{SZGC!8OS* zWGkHvxdc2%x@fo>R-h9CCW^lPc+i!NSGa2wP8Z)v`?SLV;!(Q9{o|NK;_?I|K8eSj5*1faq@fG@I&HOK>8V-u&#!rOZwQRvm#?%<^ag9o-Pza{o9&5Y_S z3Sg0<0Rw0*vN~l21MJaiPK6I{e}2y~A^bCKRW$YZ(cU8j%zg#Rzaq>=-dyP=6eoT_ zw}o7h0ID#QJ8`2QE24iEgZ?*=#j#D?4IneHzY1zDa?J(58BJC}8Y3xi=lnVhN1c;Z zYCLAxurMZMcg$z?@yl)3s+$thMM^Vuvkb`$j8oeP6^(v5vS9PxP_tqIc|`v;+}p?p z`3P@6uDbW|^$BbvWW=nfoUT@{sH#ta0o+}TNJ2uQ8^GJk6IB$ya^=tUOaAm2<2L|y z0i5{6cqeo*iWw-|E^Rk~^WN z&f+;rC&?Lr^Y=2e+ZkzFhG+VS0%D4i(aCW=M6#}S#EeiWhu)6(8&=?y#wNxG7GFp;%tOFcB> zOqF}8g;VV$P1Q1IQzWb}et0)Dgms&So3-ftEXKNSwXmNmOZR&Gka zXK_Nie>o&q6*e3kgZX#MmGT9fm-SEN)ct-P$++`;iXPfa7dFFASyp8iBf#v3a{Ah& z#u3K9OU-2L^A0DAfS1-%ru9Z%kS-b152!$3Uk>aK^N3OR#c>nkZqGYEprCr`x*wNS zifh&UO39DRHOK~0QHt>GlY1{s`IwO(Cyx@Gd=}G1)V(jr3-eeh&Vxoswdy%0Bjt@< zVnKa+P1(1wmGRPb;nHnGAGrf1>$j<}G$nnnnA8?K#>V7rUHD*_OAabFh6!9<51_&V zKzF|$+)$8^-a)#q+PY$`Zl>?!O8I%i~|>)f{jhh29}QmcecE{xm=##gEH1w7ol zxSMl=>WFmx0F;a7_p}SL>~RL5Oz7qH2ynpV-Cai{0q2i%k15*B@={y=NDa7E$@E&5 zZw$2FA5*VC&J4Vv^*m;KM!kc|=>yU;No9GV^!MsIkQ_9U4LMwDQI+ffj=aMAsNmNR zk2XfQ^ZJ8UuU>$<@BLK3cft(zdw%|8y$=`O8{I*Y^fLc8-vQB`UGvbT)ko8Fz6y-k z_g&t=3%RU6gaK-;KMb+{I$g@}07+x?^jiYK!b4|Qm}D}$gLI=2$F@cU+L&(TVZ6|H z9A-X26*nRCB2Beg1J3BJF{@?4osAmK$R=b`?%jWntf$M>6|T~#LbC;;otE-Cr5TZc zRbR#Fh(%A8pNQ>_4p|8tG*dMYVbE9t5E&Tt@;|V{bYg{PVo6uryNH zIAM(D37pZ{Q11eb3@l9ZCkSdaBeQ;^_xP^sNe~d9!_cHYpHfM}CT|-?0w>>F%_qcc z0K7{xvw&^XugZgGq8OX=f=bXk7BA6^`Z`a&mPB zJ@u^>L4u=&XTiDeJlLrF=iHljGg%~0b`9&!1>c?LhGVT!NBfUrtr0r9w;YVf@;cMp zh`yBhGhFnax|LEVvX5%~6YRJu3}gX5J^}Z&7yXoed4EHvL{by z8(-e`H|^XAvb?pOIaFQkGk9>1r= zd-Zu|+Zy7?Xfnd@yxM>8kYK};{Q$?F@1=s6=2Hj1K`YI`rpBX1v^>e1+qqt|0 z&}R~|9g)wiLR9hPDP$E{?)tl58&{r~@x_F)h({}dvh%;%zUrKJ7sF7gvFv`uO7|3} zB{7AqhJ+FMmLk0QPmA@$lvHcVv&H-!xwlXC1Xlw|(K!@Oc3Rlzx)=U&&!R|A{vvo@ z^u@w!4knuT7n)u+ywUS*SlEUoCuf$%=N%7(M^8_d2XPSox)ymRT01$%-Y~o!tPES4 z=wk21Z>i6a)ioIA8#Lim08`aZBC%u)7`zxkl%#RG6eluKOO~1icsRM zHxZ)Ge#J6DE4?QraC1_?oSDNi{N5J)zD-vS-EvV1+SGx`*km5_kjTG(y^}`LLLd6w zQ2;TSdYfq}%%MW&4`FgohN?G-fr z_+gbktt}2Y6PI!08%%9Q=x3bEwaL%Kz;h=d(=#wZ- zRiooaoJu40O-|+{ue>s-lPDbFu-#Nnt(92WO7r}1v9P;&#+Ffy&7|%ME=Hp)Pd3@} zL?(QQ!;XQA39seral2qLWeX49zl0HE%CJ{>Q*soI8y!FXYVX<`ioI2U8J9-&))4(6 zVi^}59KJ&Kq}({RTK;i8hL{(*KU( z3=ItdrFvJ?Y_Whik6F%{a2r0o)qF*IEiS*gc=xvCHkf~&<^KBAhKw@w05U!ITSp05 z*#Te<{g1i^@F#$H9b1h>O9X%q`|WxEZ1amNm7J8Y>kZ(+8}I&b0J78$)Z|@U49VBX zQ?gCylXg1xq3YdA!bx)w?3n>g zryd?~eFBs?10xfY-upmJ$LtvKE9|&z50ARiFjtQ6%|X;$%0w7q$*{5 zXm+8TC!b>bp?F8C3YH3qX+4tqlg(~V`?39$fNLYDP~fv5=w(lk&NzlvrVlV4;1(l1 zgMFgDNzQ~%|1J@pz*_tDE7h$MpP9lXxIU`3-g)~Asfr(2+Z{qU`&X)gt*~-Ruivji z7Husb3HjA-$Qv#-Mn*;;#Pa;MFRc6DHe-n~Q5zEpDai@_NBd5Dm_te1PN%{lh4=d_ z_vSwLHg?@+3|RJIBmIZCNC z)r0Br6r!`p#g_;!#s^GLn;-Q9t==TDxVUzb!Y_#}kgFC>La-$Dh2L89$*$XHbW0NP+y zJGF(0?2Uy_zb*k;jY}R42JZVwx8E+f-1lOooc3ftT<&NaSM4@c&qCt>CPH0mq{9%Q zzB8?agQrKG@tT>&6C?*LaCjnZlt~{|P z7k|8F$fle%5jnWEMj1+{uC6Zgfv{ziy(UgZd9w+tPrx5XVezq4+2?1)8g!jsg}!$n zxY#Jg(w2zZxt~+I5IJ+{D^aqC(3GPI-aOl$ZgQGk|^m|3XDM~LyTwD-~C5M z`odS_J6@g_YI0nsi(H0V;MjG10%@=KSN*lYW5&S;93mPZRO3^n-b-s@luG`Y(FY|q zE~cvIo5gDnwW29L^F}03nh_$XpOfJHt`7HqG3yVB9CIH+F-&E>?4ZSn{z7Z$r~mJs ztO^|HK=fxa<(6A81`j}M{%FKY)yJM!pRhpa-?Li7{=x33bA$h&*Y@`@^M!s9UYa#90a=m<|N`KPdeDv!5WsH=S)Xn|!QlR=i%eXsTc|X~Lb+xZg_hvl- zKkGej2WY9Jy&rb}ci7z%>|A0Ir|8dD4u5`S) zM^pe#j({@ln`O)QhJ?{pnZ%ClRq*a zCa#GJ>K^Xwfm#pY=60mV5F2u0i*AXiq;ODh@my5tCle!VwZ%~z7iSnFrJ3k-qaSVA zIR$brBT$+}XH1p=jKAF#8t9ISQ}!WBm1JWN)Z0J4j7FSHk~jr>Ku%d6m@bjV)9lb? zy6yxl{r5_Hf1Hs@vrSrcEMn5&ZP^%4>!W~vzs4TH6Xy}e2#2+ZnTs`9#z<~k+Lit| z3t`lF^KhW?{7|>)FQP*H3kOp%-Yit{XYQ?{a54h=e#k_fW!NV>qrMLTR`uW3M zmw}!hdi7Y`{9kw}r_Ryn+gx=p=1k7RIhER@EL>HYcL+BogXad$|08Ur&27Y~2+&@jRnLh5V&i`#P46>9!377WNhTA8GjE9 z?*#1(bcg>)yj;VK{9IhK?Ak0LE#EhB4&kZ~@b^Fj<>~`}QX&jm*CuI@-S5N9O(l?Q z%g1yr63#0<8o`OoG#dzBRW8p$u~T*y-nUtuV`hpTMdyof>RF^A0>KFDFk{^*t^p|- z;^2`r%{W=aC$1j&mAyYIgq*MN4KJSGFf05z2~lPwLU3A3d2px!t0qBxA`P~nbDQj8 z&jDPl2WvUXb`hlENbiSAtLJfY`7Y)GXphc$TSjgpzpw2KN_M&*mO+`B>>t;}*i7_gfdf zJ>S?hMk47ch_rfLK-Pxhx#M(o`Zt;g^+i!&DEJ{=w#%$&8MX3&AM?+OsgGr)i|P+7 z3B8i%Y>z~R*h>2U65Is2sprJT$&}Ve#c1#$Y5Ynd@x`$64)&ocyl~JUOMf{zkC&x^ z=C2{}d;Whp{w5+&m2S^?+0^4lhx`;`jf=-lb@= zA$(8F%(wlP6E{T=hOcY>#kbqC@(Y?i9dYE+b>?!p|9MKEwD5gg6t3BaRaDQbuRUw9yo-g!%cGLpKMMjm zq4&cv?Q90$^LrE`0)bcq7O0v6UjqMf-Fsdig&w~F=4kz=vhcT_9C{p}qjjLf{&?uY zEG#)C#WOgV2o$iL<#6;{Cyf5yl-4*d_XZ$atO4b47s+|&Z5_k8X&PABAHSN`S#x8! zIQ3~z*{w)7v0=Y_AYB`UsfU%y7V-GWOXWofOF!HRVW^t!{coH5pPOOz=OP!iV6q>H9P&3~5tP;v!V%w!!6*%6jB7a5tf9N*)qtbhe~-A5+jS{GAk79EmIf< z{4#C$aQ&FF#t6~y`@~0vq`^3U|T`A>u z8kH9{K@{~|v8>2yo8FfKss|HE^%V$W*8KNM6~ksDOkjnh+s-(AwCpDv;;FYX0V($# zdyd&S=Z7m>0rB5Fji!wI6cpN1IX)dwmZ~VwW~#8AM-Ss_<8$VMbJOxRyr7wbP>rQ# z_1}3!+GPl6B*MFovrrNB0Q69rJ#LgCV?m3m7W4dBOBt()@r8jj#i#HEmXdFpzVr@A znqq`t68qNcMsp==@j67~8O(tRGdlQ{H}FdILGse8K*;; z!rC{3rVAaI-(CTt-aTe49}<^!FQhrg5!4q#JUm)7Cv+KCDaiLQrc9pRJNs-3+c<)D z&8q}u6(}9&^CtST@f11d#7H4K5gkyiL$5BpzXJmC<*c8nV1V;9Q4YB!QmQ^3{`aI^ zVZgORd(uG_%?U0np2+1#6I4~gZkwf{=B=V>%FY-;tAE9qBc%Q>l_3Xdd-p2MApEcKPOMY5XlQ})VOz#v?9RVQ zVa0FseNi}U#~RmhYJ`H4ig7;QhZ47tZ|`1sN7px$Dn1FC8dT8-b*aC1p7-qyx4`%v zVu9d_tAcl&Iy9Zr3WrrkKcQ04rl5S6`B3$|a8HV}_lZ^235K+EOn!rM_mXdt82ycq zHaj`|!Xir7NH0xu`*gmWPTdaE?;}q}VQ{}&_$4rWu~WnPFk?655UL||NYp0Qlw@JC zNBehC@{#XCP_@g*FV!Y6Yu+)J0vD%mM+jpVRmzS10R75AseMA0n9zQ7=V z2q`Ph{>!^zCXxHYjy`c}XV?{nH@k}8_-#FV^WhM)e0k4GiTSYOM;Wk`0B&RxK=VLu zFW}j@XH^3PyA6O;eLsi-65s!?raV4Aww>$*4!?4MMnM9P!vP#6%R|qE<|hHR zyZ32L*)MFBp8D$kOwhALv0n=`v9Y*Etf|Cag{N<*7Hz{2PeSl8#5%kkKgM*=5{#PU zabbiAf5KMRiAPLQpI#?d{8SOt^ zWF#c4UpDQ?=}iw5HduC058L=}{Qv#@DoIS9C^Lgpq54I2n) zZQ&BK@NoH2X6{}kyyCfxPQHz74g9}{Vx?F89 z*Jf~aU?p*XG6z#6qNr~VOPz*gdxNlcvSbW1zA10KVY3t-SG`=aigva3Ni0ZsgOM%@ zyi^8U+U9<`EM;#Y>g}a7w+}%v@}kZUlA`L)8zl&JWYr2PCv1mtaci zJP2RpgNh?=>zO|xlwO$R?!y@JdL71)4(}F#DG@HaVw^Z#DE=puRQz;-Sm}G=A-#Yh0eT|qzb3Wi7456&HsR+c zTuu1%D^Q!5nJsyOWi1?Z7`FGKb$qBQG=?HbU9Rxxc3j zIrVomdUJ3Y25^x|J$0%5Y@}&ABIHe_rZ}RcmSrgukvF1}HG==gBDJ)bgu#a)E8igA z)i|?VL7QC3q)6;VF6Hgu>cz*uub+>Id93QO{(UX{F7ROrvT##ULk8ls-`{3#yMyG){f=U+I5!J@{%#JP#0nVd0-!J=50mIF^bz7+VF;H zC@mbn>FXwO*=PkNjMyTsE;(KBGk&J80r}}qDWU(9$yPq~f+}1QVH?|R5=W^_Ue<7 zlfHaV9T{~F(m9avY$}h!AU&f_7dWMiE2*oHz!EYa{ZRE_F(sK~vW`<&!KDq(y&>`Q za5;!7OOPnwbo%-6;Kx@yP<_1Eworv5aCuA*55^?6$&(*gu>6@>EXP!A@7bm}A^l`2 zje4etA?N9ypp?=AnIK?bu0Z&qZ0WhR4A`il-2__Bn4^>1M859L_q2G-%F#&ssIdF0 zi6$g8< z6xw4}#{23kDBy>R#9^CIDql?EWF#irSX`pTV6iuiKYFEaeqQo2bmA;g$hloj6Myl5 zrnc*h{_&1O@wG$cX}U0?-s8R3a860*%HuSVy-&oz`a%h>!Z{_aVVHErMPhG4G|duk zt_O}UJd-*Qrm4b66HD5n&Z^O#X;7Btq`9e~Path&NVJg;)5@(JA@7IskiZ851vJawFu)BQRomtQWMA?h)FlxJtSU(Ip7)Nswt=Xx)-$O*}(R7t@fB!(m%=BNAf4S96= zR0=xL)GUt&|ICRKeK(eqe~tT85_9^foiGXTg|Mro)VNKGrfn~Ks{DBDxG=n9H|G{U zI3=nb@D~MbT4ZYBI9mFdX$P9POWBADg^(*1xAc0t4lxI`FCTzjJZ}X$c}2*y&+{xj z6Ky7BY&*<)q{lreMeXB2?#P2dPp&AupNg02cq+*a_FQbhM@ZFCTF}J zIenoN;kD9Zl0Z%NJnP%dY*32PVz+c8L0 z#PWw%uoBRKZE}p@PUZ&sjcV6qtJD0obtca-2c7gOa?Z7PI@2jSPf8wbtlqRef-w$t zT^0cIQ)jdp+wTV^vd4ZTp=~QgA6B=IpWa|2?IP|E2lUJWH|f3FHCtoZ2Sm63KX*0c z>M;;ODs4KvM^U|a{kw!y0Fawj>@7Qk>40f);`j{Uuim!6VqCQAH*RyO%0)>O1 z9QIhOe4cVvQ>3%db*kp$O4Sygk3C`^t{$@!FG|0C8aXHZNA1C#_7qQlAB$2<`8JJF z-+wo!q!mQnfrrek#{$|4RW)1_PpD$m!jtp~vbhTDkL4EE^x>s$f=QGl5?!Wl{paa$ zTOCW60q1GO?teCrZQoqQgC;jBj=WO*q|KDs1W%6C$)MV^{qP)G9)bLdr}{a(GmJ*o ziK_L5qa`jBLA!v&%tKPpBSF!9ARB&d7erJnYQrcCEMH!PY#D8)LsC-|uxBbs0L;FE zgOL|6HYca?;N$GyTCBE5{Vn8q^MokCn=xmh#4LAsN@Rvc;s<#=~V<0da_ z#mn)2GK?LBniW~53-GB;LezD@K?M44KZ;!~3#`|-V)*ZXRA+B_kE&fQ4v_wD1 z&#iL2bFF^Cm;dx13Q8wYrga`VDj{Rx!rbmn)AQPB?+3!*r|cM|Pp85Lqh>WECe3hw zwN5qgC*xHX)!IK3^h2#gpjH|c$4c>Q$c~EMT;!7i+;lf==@sIK)@#g$E?R%`qktxB z+eFsqEWCZyc;zxfVSnI{x zw@ZO+$7J(w5d7sGIY16Xb%+ykO7&z3}Gp})mcl=pe+&ytJ zx!BYKaVD`5DME#NW;Y=yz~Zf!n44uymI1Y??s+{;(b8vF|CYTu#|G|C0*nqST=B=9 z5F&_iCBqv?l~ns2K~7i_D=pO{Pm%cW14O-?iBL-t3+K-8w8E7@n|(1t56rbRDSarB z+)g5@60zt#u;>r^Ci7^&a`zMZkA$fARCp!H^vpjK^9%(Ra+RJS!_Gsa+27vqWb?R) zu;hbD2V7q!tXh7hw?eIQ<0K&yp;~{B#U(;L!jgn~rP&;}(ve+~F9@R~xHd?F5$)oQ zdRU0_i&LwAdB*_1OMd;{OtE?ubVn@rH_NJD{&wgN6ZmR;?W*%U2<&E_VCK{A0K!yZ zkZg$G3FYGbM2JxjfotBdawqJ0Y8|FJq(B&|W?hP%zUL)v^cNRlz!v}K1xT*?o8V0{ zTicZg?7dGJ9!vrkuka~~CwFVR_d?g!y|8Z;#y8aY5;rm>WZi`p#2D7N@&0lfIp_P| z!>!ftfd1apk$3w$Z}9k7Nbcsh&c?|JRr9OW!KaTpqJWju*@5rJtQ-!|lg-h~@R>+16vmUM|2QDG<&fU-)X(oT#jq($ zr^*k$1K8i{%z;=!Y7N{DYcFoA$UI)DcDIoqrG|EzRRfzY4*3^U(=!y1X;H=a`x)C& z;=K(--Dvzxp9(+r_Y2%TvC|YOKD`0rNcgMEQ1DH^q%ulpm>jz}|HFn7UZV?!{SdAs zx`v%QDQ2Ukzn5{a&gDI<8|5j`Vblx?6kv=2_X!^7_2ug4z$JEF?7Rgw(y7pjU~x|j z%8wxlGI#`o_;Wn@wzEjGA*{ND)<5;@0W7ehLfhuW^`u#=p&V)dx{Xk|5-iL|O%2@FQ5C!fa-3Z$x zHGEzW*>G{#__3y)nb$toYZLVs|ZwMFjM?V54bakw^1C-!Nmh{pe!^nZ+z zvb9jWI@&VsEqEh~MH)Ys>iI~U-;MHT)epIi_E=vEY=wloZcm=g89;sV#C#iCRIeg~ zOUso-$f|@2AFKq{eyv=T1>xPHp78vy1ufd!(Oi#xR@$}Wid3qp`y|MR$5mp}ic+Jx zCq$Dd9EVHty{tH%GadN9w*YB=(yZd~_4^Hqvv^d4#VWz6^+cX~oz1fG#I0-A-zKx_ zC!?&$5##ar?Y#Ve=(CHl)$3=$+ag_fAjl9n><)d`9B>Hy$4}RWX6%r7Kgd$X6V`9= zOQ>WU8@mp+d+934g+99T#v)<*01zA|0rl@VbC~__Py5E6uaE8?-;Q1oMo&N9nQ*+4*ZDu~OINdM&I(}W-5V?-a6Je%~ zC^21Mr+URi_W3Q@PFDj=w&*-;JW*D*=(z)P<7+9=$+i7!M$1{Y$Hcaj0IBmYNgxMO zUhC;;0wE?4nC?UU0*vQLs1m4dfR=Mc%}iJboh|v!E_O?3F->j`f?DVl5UM63NcKq&TpV+m&wVHw6zM6Pyvi z-5jE4s;bE{H91M1D0DB#VRAHn|A<%k{wkrRHVkYHba86@W>&*4d{RCB{*r|3kAi$+ zro_6!)PSw`BPh(x$; z8x;`qK%)^4f3+CLi55EIbZ-c)didH4NWX0VlPg6`s`!n7rncSYc(vDmm3Bz3Q2cV4>#$FGSnB7x#2sq`0LOBlz@Xf7!j%&)Tjvb7 z?+h2bu{5^O6g#QAjHRsPHUpG`gk1SQB+fOj(*knzg=0JwDA_HgE7T6A%;GZ(UC2Lu z?SS<%U@pb%P7ycv}Sz?oX(@siR|P3<|FvZ2<2F z@@`SCsu>j(-j+IVotMvX6DqUx)kg7McD}edB~T49>;HM~E1A|3F-R}Xe>Cn`(QPy*$geGR`@J%~pA+DcqJnMyr- z@v{BPpf=OK7t7;e%(We7^uSHbW@bJwgn9WYY%NDF$zR#>btSFj^0y)k8H;+04R?)Q(ynWn%$Y&<{}lA?sCM^Hd~s{^SVtqqLCqG}hHGKBLf;;@6-e z>&xQs$t2_X{>OvehHoGTu1!v$I;04Q>%q5=xulheX{Am-Fv6ebPcKMs396v;2<+zMDWJ$G&Pcqrbx596;vK&jvwo z9Qh&xy+u>ci}$ODRMM42XfPu1 z@E&ES+?>{iF{LE4GY4*xH{G0RX~h9{(_jC%3|_R_eDwiea~ZdbKkFMO&f4#m%m$Z` zIl2%h?wktBW zm4Ls#oS_s#-=XkU(iqG}`YE$FO>UXN>r}-$PRYo(w_?ffq?BF7&AlQW&AUZR_BzhU zVHmsw^Reb-Q54`A{>9naSw1#1$eVW?>?rAGTV0*`)la|vW^d1kXmG793KE&rKEHHr zk>`pyPnUO3+zw)Jq58aVDjWW#%DS2bG-on$NkU{1F+!M?$I4$N0`bG#=6NgW^$j|i7JjT4-nT)kq&!lwPC@i8vmZm&t6yb=E`xu4;8_U_ zDFq!Tc7?(@g=58HG_cM`W*k5%k8VM9pr7Y!}1@8wal7*jQ9{1YA19#G2q-Dt2;9v%-?{hx*?%UU{mkBb&06nz<0vNzOfQ@i zvW_ixj-zvSH%q%Wh%zT{q9=QXZg#(N9Q0q^74TEY_&TQG8uKaqgAW)ZS@zR) zu0^-hszvpanTV6GJ9H~m{egT6-K_(;v(DBpwwl(VPBi}!RpCD(@S_EuTC_&8gNr9V ztUqFz0n+(qu1_b}FE7w5M(N4nbdAajxTHWa{db-8D9mkE%(8|5@V969@mw?bwb_64 z-mX1$ue)NOxDii@MF72mHu#_Wy@<36!;?tri8K2oIsljz!$8jN2jA2vqt7=iBai>) zMfg8H)7teN#pH_66OQP;$aUEKS`1vrzMQaTS$$R#erZ+O#dj%EbhZ@M`Zvru=N37d zOYseRHuO0RYiW7aZz)qwdrLmxSX1A38L0K6q0m0NjQPKvWTs=ba?ZAXO|e1|u0HUO zYWv1JYm;!myCb~{G|(N_TVvm<906}cAh+D(>1O|!sW2Wdo7n1bpd{@)PCO{}c}vQ* z_b|rM+efhVZaaDgwr3%KXZF$^4JV!=I$LyCg7LXZZ#pZQ_1RlzJoaD2 zynB*B;fgPhdFrz``N6T#&#`!8HkxK?ZZ5Z&r2`$Q6~CBOTi7nYz?swUx{@V{<|}SM zmgy%1Hyb2syHS!N^6Z?v7&D?H{J&wU$16|Qq_Tu!EH?JT?pQ<8?@o|_Epbl;Txhwr z{cSiT(+Jti1%lQRXE$5lOxDkP@O!jL7a6rcH>ar@#fWD4$RCLI+7k^|M$z5vfU?ar z7CTddq}TC{yl9e|rQwJ2^J^~>kOt={yM?v6*B5lHwsd zf!Pdz!px{t7m@d>37D^E5@ghWOIjuH zQD?zZ2xQSl{bnS?P28^zB?S12c~fLTK3Oj#YOJL3Shh&`AG;ftqZiKS9sNv+*!OGX z>Wqi;l4;8Y8j13hm$t~{u!3W_3!Tcl?G|HX(r;xOJSLph1tXmg6ST=ObexF!YSLp{ z63$(0?OmjyJDWte^c9fLcaJn>{=zCvxC1 z9;o*A5R-O}`8DgEPe<#|L;W~o`T>a&aYadF^1yF?ZBC9W(tZ>M_i^^Nith=q!{VRY zJ!41j+X{aUsHQRziCR?hB!Un@F zHPYu%1BEkt7Y`%CMC4f3_Ny3cMI@p}Scrh0E7y&?hs~q@;H#tu!qF#hC<46>f`nhEE=|66K6olAge~u zIAGX)N(%7W0ooRTWA)duWCMH1lP5Ck%brJ1x`*<;AFcAd*9&aj-bjdz)xs)5{@*$>~E9Nx*j|io;Hdf`O{HP%(7fJ5 zbF@MqDuR+6_{m5>s`EK-xko(sQJ$2@;=37k;Z8ZdGm6MeuF9Z2P0f|GU_+JL!invd ziVQOBu>ZRE(5hkj%KH7(mPz`A8{T4|BSA#S%deG1*eOhbf;z8E z^A}^RmUPYIP=qtjlKrT=wAlL&uyBBKN-NJj;OWC_OF zxq;dV;D#v7kYm8Uz5T@v!>s&3jAK-`Pd&FUXchm}=ZN-jwd3WsO1lvf{o=-JWlq)N zts_3Hx#(G;3l>pyo&2NaJKYt%*#MPD7F|&@%c2hn5>42IKe^yfB`!{Oo;@NYJeZ5)JifQ^f5>dIb>U5jKd*Dc-e3# z?)%`|BE_mJcj_Pb5H01Y;Os|T$_iKv+DOjNE~T# zIFlW`y!o|TenA`xdVlbw=R{}=Z{|EjGRm{e{FbRjQRXDoiS2D68Y_n8ap`iuC(ddx{XU*=|HO%MTDC zf_iEb_#lylB5wjU)qt2cH=JYaU+RCf+~t*_{i&<8SKt^ccX+y%h^@3KY=`=f7hut? zQ>~aXf;%qK@BY5`J&k8@;eHIj>~ml=q+_TjNldFK`zhKxK_zd*7jQ^+_BH*iGUJbL z!*WuMSj4D;z&cUPx)^>YmXk8bV!>T*#e}&I1X5tw$$n{FnO+l)!H|RbEA$qn!`Q7f zMwo6^;-?ZfiOTa1>WM8Z#@$IimY+U2^{o>o@8^M)QNh2_;OPGxEFs4oJ;0ErTX0JP z)TNBOp)3EcA^iIv_)}NxDRPXC6-QP_w7oj#aReseV;_C-9IY0peB^f;B3E32y&vU} z`vAajI-oqdho1VPk>juL>iP-Iuz>I*Ent8%PsnUvvGG%z#0i9IjNgGYDis6)ttEap z^M@^fZu-^tgz*W+8r2Lsous)M+og!QHi+vND*IKrW+}W+Uduz#!BvZP5sF+T0N}B91aRw zsB=ielBR5hHDWZ%E#`#~hDG_~{s+(z!2Q>()g zdBcn*?Wy`ijpX2vJTJokb-jZzCk8hjfFwU}LmCm$sCieqgHm6pUK?SS{nh!UHi0_a z$32n=q$O<%&Ty>DuKe4ngqo~7xBXdw&mCEVsnVhdWKxOhVD)3#1RfxM8G=tg6fFjj zSA^pOq}eNTMM^Go#NH{q&&tk`aNezl~V!j)C8m8l)FEAk+@YS7C4P>$5B+>~-mC^2AO z(zussedE{N3^yFQJ~K3{^Jq} zGYYdIN}8<-^xr{0xCJ}UbI1UR!Q2+Q-|RDaQ~1a68)I;Se)@I=_{Rp#Zw4lHYTnhq z@5$E{R23&GPD&)^OyQJ?_$HwA<0d*TYT>S**H1X^ISp1fWipKvjzcq>fgie5Qa}tt z@+H)-C6Zk1{fOV$d-}jCn~AI_c^0>DRH^9#*NIuP0h4NXJoRZ%#ny+7XKk3ingjHD z`g|`t^g!j5EXC0;WdUTF*MsUz(1P8*k=%;{$^{w!cqtfRKh7D+g(YwFt%+ zo~mc~3_DjCGNFH1qJkhl0OC0t;*z_$*nv@GqaoIOLH<>dTeJ02d zMl%-HkSSC4qYna#ot|4rU^A0ZM~!WL+m4Y;#3jD*75gPzwh!=R&pZtW zOlHNExOgM2B5;x(u^2zx_y>oBE{go(r;?iLSY%^U*Y9*@RbZwT(I72t!m#<4Tuf}V ziJ$K^`GPk>@atxk zHI6vTA7N7qkKwD(jc6j1x@CH#c$lWU(H3?(iQst;?s?enNd&UA(Sm-F2gxjRYi31} zEgDzEVbC-PX>?Agtcm3h$6tPQ&lZp@Hn3<~MVR032Pg0Z?!J6-Q`O6RT-qP|myeh6Cf#s7BD{}FG*_EdR2%AG` zu%A~WaN--?4*!-GcHLJ6P{~zfJXiG#TNJ6My0)1bt&+A&`5CTblp%6?td4Fc@od?$ z4>Dkz;J%<0un_S-ONub4HO4iOe)9wM7oVU8N%)N|@;9<0K8-XEBGh9vj&0JkCHL&q zs@6e`Eb7RbhdlVFPzUO%h72(<1`1BJPFHcCURd2eFHTq}WpVVU1?I4nrV^?akNooR zuZiyyA}584jsoBiU-bLLAPDIUPc!}3!nutM{SBYVLxyl^tmT2p=e^KEkTh7W5pO-$ zb%Bz$!EW1kwiB4xX#>x-QMH!Ki#mN?AN5ulfxA#`1S6$=bYPkRg;^{}Xv&r*##7uV zi6%6ihEy!+xfiAqQsnyHDan(>RQ~z|A445-3Br=0wuYEa&wwu@1P~b@P6IG7L=zz& zfDp*SFyNSPi3MF4i!qTK$_z>!!mmO|w^1tMz6pIYt_8mIhY-I^(F_F+DQR6Z84$G9 zw7S=mR~}==S-~TmxUsiHCR4z+J$c&8$*Vr;{$aB^T0j*>Du%A-UB1yxKly1wkEpeDoSP=;_1V-P#prt=-SUu!Te3!e>6`;Aj)ip0n3=Yd{lBWf`9Ub7P zPt#vZJ9=7=6fxO(*C0mf5MZ?N))kitW0o_WfRio<#>k>!00{?M;{g9(UjOXSYzH+= z^|rFpxc8j&CL#(p2gA?#%lf#<{vC9q14)ph;81I$9ad&>on-!y0j7??F`wSgcBW++wlggwLTMj z0W9bS)D|$TZgKvBkNox>5mCQ5_LYPcRrmlpJYeRIQ`+Vc8DAcB90hxLr0=we$;=#i(ifw(#tE zo+dYHZ`xT1KCR&N&A~0L`ZOF8|Ou17}M`S14kBKI>N?_~s0oHl@_z-?FKHpdy0&+UL zUwQL)jKg@)DNzz?)hwo06-mBcA|q`Tn^A9&I!Hu-kt~Q;7N>!FQ)vpdp~)%k3J*FR zu*16f<9}R$x5QMj$QDug4&QL{k>|9f(!7ue*eE~0|{&%){Lda)ls}0?OAufTgE$IF>u;(#v{jSFi2pN0Q zNxziuldJni2%aNq;EttllqG3cjgqEfo`W~wmi!B7H2Q#xy{Jd;^it>Lj40<;I9z(M z@i&i16S^TE+M3blQmri~?)Tka+T447;tjz?lgfAPmp^!hC3phnW*mbNWV$_VlMg@y z<9`eZyYqgk`?SEX)*4Ny9Gh023){!b{82wQ{Yd zQD-p#wQ|5JU;2e4&luJl=(YswT0C83i1PbLQxZk(mH_;H=>BUAV(6Q2-Y~+l)Zwo- zZ|G=i_!5ajUWza@A^#MPuj+Qqj%Iy{^0l$P2?_;aK=Bl>I ziPBc1&#r2Ml2S&{K7hrHJe)D|KQEw)lb?nTSXVl(Bxm$AqOpu4=oQTLGTZI4c%&IH z1PX*B8Q2)Vrt28pm}GqAKnR0cpaq%oCJ<`!j~wh^nWiDm6qb>3n6lu6h>KKM(;4nk zONd?0B>__I)iGS?y{$pU^U5#$czAOoI0!P<);{SNk{LAIFx}jKPP#9K@6do^1ofU z;L;_+LL+`teh~e4$Trh1wGn6fq(39fWS&PubUi|n@SLZmNBIoacor0#kGjDMt3;8O zaDYEP43Hf5zNWU6U570yMEub^Hr?YZ1(zAHsu~KYYw?;dp=;c7{+`1&qO!I@M`DK- z&Bca=367I{CuXPJc;vFOQl4~i8*k%yB*odBxsHps&S6Ja$oT}5Z^_lSb)`tg)JQ?aO`Cy<9xOk0?b1-;Edor- zM~RMDKXl^DXQp1fYi?>G}0;GaDM+F{DvfWFM6AJ!>MRhnz* zROaq*c^H!`HIg-aa!-!*y*n))TDW)RW!t3OT?lgMzxDuuLSQWO$(Tj*dcauH3S?YRl1?I8; z1#y+Fm9Y$j_SBrZ9r46-8SnLyTcU5hCg?2iBsBgThV?n(O^%K>%c0$~!!)#X-ohSq zm`GaIizUU?0Yc8nDDS||QEnoJW^*#mKdIXLHA^YuR|p5D#Rz4p&N9YN;r7%j!8pz) zqE40_|Nj9iHhmFAfC#Q)1Jb^Y`8I#nzUoB-h;BhT-+Y`u!F~u3Hn4s8-p>oDN%fu6 zK4lD0mT&45NA8A4Pr_W%Mn$Ra+@d?HR=>efb+ru`u(d zX0Xm&B*CJFxOK;J>c%`lw2tGTFpgvOGi@SAU^9Fq9w}OtZT##9s=Z^jqH}IuN$vq4 zF~{kL4bukTI4`@uBD-G!EHFggyfgdm_zvCmvSx|m?L?N|W&Ucad;)i2f)`#^OlHJ# zy57GnBZgtr#FXce(TtnI?r*`>@mT~!Ru-h6VLw)4u5+!TpM1;+WZ?kSNACm^w5bOv zw03&;>VkFva#_=ZDP8Y}Mp-K?mk~2EZwaRSh`L$(uLG0`}60mRbhATO+YcGsCu+3@josn&5IZxuF5bkmc#5^kvtatiW1n#09y`CSHON zOx+rwifK0AXW~)ewpN+#Z_da0%~o4$-o!Fb_jgT&hb1O^hJB>|eDABhG^Fh8=XRgB zQ?p3q1BI^Pe=`WJems1BU9UHoTyRbioe#H#Z zD~H$ai6mWZTAktUGwU^Zt1>8^&)N!)&{-{n_d0A1WRfc(_Bbbf4 zcv^tP zN$PWyR}^!u!FmFu9mIZ>Ac(2uor*amf3QI`)7MfH8lzi!{I~l%z`NkOcKvqzZmAa%CiSo>H6(Sz)&m1PPX;bd zM%Z*CF;UckIMia&BTLFB%wz;pVc^at$dJ4Z5$m?Y3VN)f=fSWZB;OZj@=d}0fgSl( zsE@JPpOINt5`p{2O0twIpbdM^Mw%Oo3u-;&? zT0aUhI%k@GT4umVI0WL?#`8H2feURz>=UtGfZNBI;zA|U7`V@6_z(ycq1G^S3wGS5-= z!G^y+i~*03nD||4kK$Z!J1$dViev08G)pdzQH+0WOzUjTkM+{TuMTc$99dASQ6w=e z8Ny*7xE4{}(jH}T_WB4GID#P2dO#YArErvlZ&Ep6@!434^x|L5l0Z6(#;}0>654&8 zVT2pTYn5k6Z~v%mp^or#T`7Ti6IhySF1OX-x$>^c>9QKctSw%XB24O~IOPj|QLH-h za!^#W`Ksd8I|>N7VYEB-FF8emQqMkkVyx}*OD%qw_T(dUt9*nw z5!U?93@x>=f}#elH+hLFL<>0gYtZpql4pRrAtjek+s`Tl!!c?%gcccmD zgVg1k;Gg#MXZRiY(pOnQWd8#S+qr~Dik_pOtJinNlMWK|yL)>}8<+xp3d7_jDv=640tsWuEtImi z_6ddi5agE=UnOW&UJ!+x>co-kVjl%O6D)&Cx!7?Zw{eq!!zbl4DqRVL9(P~l9X zi26b6KP)%o&xt3vo>09j%{0P10q+QuPZnn(6PRzWVz$bME?Kl|vig(pd-KC~4T#4` zS;w^*eGRsymW5z-QIz+*16@dNBYur99zBB(rTQ-}E*95pQLmaG?s~4t`O3om@*B3s zyav+F!LO8}#=~Ah-PVlXCj`wiSjRCZbDzCK-=aNPDg17<_vd}-6eh5~Mn8$sd~3BV zBqwn(qx&`ZQSylc-gy*w^dE}SC%|{`>PUCt0no;DPZ(a`?cd(uZ=O0W!g(@9Q<#81SBt6fZ3<6w9W zsRxw8T1!G~U@nKF7p73Nn!=BUR-QRl3y(?DR@39F(v@xq3}>I>F>HvD&Z_GH`y855 zel0^Ro%n|1({}hpG0Vds;wxKfA>Xbj$>IvD0HZBW<80PY<1}HKu?~t7U4=S03P@BC zT>S9*7$|HTK)@UG+uX%()mSDn*N5mH<$|5ISvj+pZnhM)hnkLFb@gJC2o1aW)d7kS z<5?8n_ZS$uP6bQTw^c|jj)UssK4>ms&Orj5mk(<9KG&D4P7ZQ!>m{a$6>^_^{ zCv2{L5IbH&|2+<2Z}necUe(?~OWC7@6kLzsoRxj>8qX1o!#SUk6mce=g>~&K9?Ljq z8ILBKX!z`VD6myUc;?kR*1o%qmN`YBdrTO4D5_0aVWu_M&7DD!iD-SL;y=okZz%a?OgKOzpE8*CG4FA@75?VRTF z`VYHt#`r3me)BL%w)%2YjSY6yRjMJ8p$TQ&2%o+GV7{rkY z`r`X7dx#lBkbWUIztH`?Z`!i;3}uI*&J|A^bh3sn8!qC(4#SO6!;p;5!J^$G-@Z3c zad_JkHL6hNmKyL2MogD3hs@>`}c@2iK~lmPU_Ibt3+8V?bPtl_6}pX|E|8- z2JFi?buQs&fBa)fdQ3hj#MnyNMoW+!BTr5cNqXCi4G&rMo7-CdzGuysoHLo*@07vC z1N1blx2|#TC}?Ds^yjTTpM!*h7yN~IMVZ)U{G?T`MDZP8$qaEdyp9_*PLJH9dha2e zbUWQ9DPOmLyHd*>m_TK@qQa{b11YIZ`ZSGsCSEZ95}CzN82!MTzx}JKbkKTLG8tk@ z#v|x2O*4sm3+N&4@lH_u56{W`!;<-M!43Z--*5|Z&`wkk2HowCsN?(f$9q{1 zckc|R(&xc74Y zFIiH+%l}TK?4?YYpk$%7@#os_ zUDM8=(nArL;&gZc&%XEVfVBS(f2sNuc7??FMt6|IVl!81pLBQ{6B71hFJjSr6=gJe z^@YPX&vPWzyuNKNt)fnUoF?p#E`I!!8niwDX=##}TKBs<>Z0cNP>w@fER)5c(zA;= z0uB?VXd{o5+&%kPS5$6DFT6$jI2XkJ7-UQag4;=+QLL=2Y)mQ9q1uLywk4ZZcpqDW zx}D~l3AiGjEjl(;U8f8QHR-4!>mc(lNa#H9mKV0^r6G2(LWqRdMiQC9^w333W z4dxUj-6lY`M-p}Q^?ZsiBDjYL8k$PVAV%g6&9p$y&p;NJ_$Emm z43F>m&oCII!4K&~s-q~sBS6HuvaZ#F*Pm@FXaWgXI*A2?opH;E1oWKzKu!V?K1Lod za^51n;U%rVjNtfoIOUMhbGaI1t9$4iU!Go3GYoey#>qX(3#?4HxV%yn2ZQU%c>cYg zybfCvb8&I8ALhZjn#x-&Lx!i9M@5S^_bC&;oKPgNN6K|rk*h?$I$DqNl#ah5u!0@o z1SX*plb<i&mJ|4yG?7*7CD0n$WQ~(PhmeDJb@(j$uyDxT zDc7nG4PrU^Yf87r?wQ?%Ob8yv%g_1`TLvd*5;dBV&%dy+7)3Q3nZFeQ#aBcd4e;Yq%rd6{a+**GE~DI-b*(woDt{xaFnT^E?RAA3nf zW9QFRW)SBwC89-os$nH_-lkoE-o=LLdJgsl$=cwbsu{g9E3pZuMr(a&^`uoVzVt1a zm$X|q$9TJ>QCs)7f=`qIg_`^F#ic-%bU|;%7xy6bs-N@MSY{CaBU4=@Grl2+Fg4yz zf{PFnM$zlJlw52TK8;bG+?+l{*OzW5ZV6-{_;lXgGcdvR@zQlT>2cuhYmmx1CFJ@z zN(yJ2dhP!3u~!+AIE??by?sbmGZ6i0+4JvP{l9N=%=Mn1KNx&hxFm}|82K%ZW~=;O zwxP%F-Os(_w2!Dgr`3}Pz;Yha;_o?ge|PnlE7=(XsV`9`lIIU9d(mC1uS>@LoeM7t z86;8a>_Oiz7oqbRDtdnWMq+?CLQhRRlZ13>Rm=ycl)bD^ME^$nq&TX#%D&X3bg`F@ z8s81PP(;)-Ngzo7!?72l*E1;4@0YYjsW{)la0A*m-ub^12{dl5t3)pGnkia<(;H2N zUvG;OeC00qfO;n0FOnocc>d(q6p3KU4#l(btlL}ecfoI_PLe224_)3&nLA%An&XZ& zuS>yNTWQBnT7u_8qP%N zwMF&QHop*XCNc&s!dld}MhV4tLwdc-YB^$8B?l`^VaCH4?e{~+KNO_53HQtX z0c8_n1m&h`kqj_Xl*P3hT?u6iNoSOM@rplOZ)R>&01xYMD&|2H1h>#rW4RMsdCmZ) zdoVit+8mQ}+k1;3&K2qXN^rB{ry7Eiil`go)>fslj;uQ4I&78Rm@s6|o?nKukDr0+ zW6`tT9}wk-htXU-!P6QMs&0 z&G|Qb4`ZfnxBFrev9c7u^6f=g;8ixEhMQmXh3`JDu`)@sJ~bXXvTz1UiRwD*o$;5% zH4)aA6A*gLidb3TP4}tfafG{ph!mwm?ZLG$P*{AsmTa0Q-XTu9E_`-{Px>b=itqVP z7yD#(;vuy3TtX|}fF0=7?Pzo=+NeLH!_5q4-EN}`37(; zS;FS$2!^C5OyA35Y~W1SCfU!#T+w!UsB4$C5zmw6xe97Xs}O=>P?zRCQoIzD-!Xt{ zan<-Ysb`*>V~VZ?r0STE3q`c2vJZ^Qj+!m4QybVJDF(q@7`vECqvwQOy%=Q1n+Se` zEZ&`$mtr``<@rpS;!n&AAb&Od)^Wl2SCdmE)>?fOMwx`@l!L3vHXd=`FQdC&y?^Ib zt93=eP3j-`XKO<|a+6vv3d_|6@1XxD_bHm_I+vf9v>R=-WS>uxPBmev6^`#QLSOvs zdr$oL?=Sx?B;BKUa4(FnDSJts@k@pAp*@_MKS(lgeWU&xs{&o!Zw zinu)!jZ4t_tWCawy4?$xh!{g}*Vr{Bv>upz3=6i{>Z^S?o=?-1jA1Ky|5F*&d~e$| z{HeZl_|FGOUCg+4KJFLX$o4!IqlEc%UFm8fU6;>aXRoDtUHpqOKYF?FzoDsRX|Gxf znKF<-tr^w+u!1%^)@V{I+G@j45{b|H9*Pb;n2~ma2r*zsMR1%v6C{y#BUZ4 zZuaKFEm?h6dN`s>i3_E=9LlgAx}QUJNSaITbm&rbv%l}8`%M%bFqdX3CSa)`>s0bV zkxVo1wPJfjk0$k`v$9inV~YgtJVDx6i!c2I{j5siiHM|!95cDgXIPNR?Ac!2U`4F5 z?4}FWBXyXda1`_2;uF|@CJxZ@%@tj79kSH|j}$aiiC|3+TVedgXz;Paeg%0V`0HMF zj!{gH6q0Ez>=-r&g4~N@`c=A1y{Rki!mprrXq5F>+sm7^mGHLtcR!3UkJ>ATJ`$IZ z>#dqQlDYx;(0`FbCRfF$LnTm3bq4VE0JmGhkRe6#EmEN(n>cMo>uynFH3X$;W!%6W;4*;&Cq4w1;b<7pS45E8M; zNO)1$?i@v2w-@8hpc&Gu!_|KAqXi*H1v+(VFovWdgK92kG)2H8$8?uGjy>JRy@3Z`8G@zHl7Kh=*|%|ukUkNmDB`SrN3IHI zhQ=|#7zfT=yI-g4q?YGFQRr`?5Ht^HRuz6D@h)^$tOm$O%h?dnnvNU zw3w7uh$lfpW)Y!q8sPTgU^YCyjOgN zQJvF|-@ilTYX^j3OB@+zlJJ1kt*(-nN@?!sZuinYki5w#RS#jq?t-u-kj=_*kl5rM zdfP{W)A=15h!G}KBhM!H0t%ZP!^*Ahi2vyK(Fxu^UszhkaMt~?tsq>eUG?A(O@UWQ z9SvNZt*$<7LZ%;D6mDIX?pR9ZRS(gi!B1yC`mwqvu!%sJ!Qx!>?+ON=)euJQd@}zZ z7l8EjoXW!ceh5+2)%}1b5LyQi9ecRKX%qf35dJy(msb$!i5I-fbFT^M?-l9x!6BRg zKW@=IT7%#LYiG1f$gWKA>Y@re(&<1h-N@ix9-Lq)*=o+ z8Pv3R1Olcny3?O9A2`4H&PVfay@<;BQ`NPq*;CTfu=T($9_#- zy*xeS3_~shmffK;IJ_rGKbHs#A+q(_qrWVu;wB7G6B(;CQz6?AA(F2|-A17CJ`?jV zY)1Oh&VkzcU)*W$dktUaZ(3RA3SRolqw4W@)wsY7A`L@Yy838Bpp+^M&b+^em{Lur zH@J%F!a1)wzh{Sh|MW(Ni?nN!8T2KQ?{*s|Fc$cliLgRa$_JhP>nq+18Mo#$m{ghl zK2M0P*|dZsmy@_Iy>PP5^FkgJ9+0&VeV_$mV*_UT*(ik#NjC8=b{0<}H-sDI<11H; zDeKWi*fUfgr&^;A#QDJwelsQ~3)V?7x4zBA28Fy>$z_EVNZs4sa}&}dUarNkgdrjJ z5YPA!G>mI3r&p*;ywrOXAv*fww)ktLo#$3pnlK(LON*XmhO%&nY`4dUz!?)DL<~`e z|1+=D)J^@q3cBbU|ydvRtkA*SrD*W+*zESDTvhcxg~H`!@pO#lny zK)x|yDqg%l(50cPX|WEQ9=Gw~YHjm$BNS_i??6m=TOp=f^o^iv9rXDQ4^#$Y$iU>j=kHD@|p*mq2~R5#|FD9U_MHm8%Ap|edZU3(){bmLK&_7vyyAO~uTk9W>M=tfTg zk&kE|h0O#7g8#XVOT_ubRU#QpJ#;{OmuamAO*ms@$_V-6d$lDW)dKu>vjQ?vz0C2}OZ=)z> z2`xZEgAZnRDILgA7ganzlN{-)Vyd+ zRFy@qK^Jj1(R}{@6%{d`L&U71xrA;5ve{_@X}Zd2&aF-fzD5>oeXzGAAgPnu-Q69m zZ{#uV+A`F-mh9T3K((7qEejXdR8FxV1kIQe-*&tA3&<6a5|C3@m1_hV3l8ghIveyKt6zx^%tm0dpP_UC$6N3_^e-6H!@>)u+J$|8 z6xGbh5+$BT5rigd^~rI#^Qa!vCo(j@aL3ZBzM54ps|XZ>39Nz(YcF6DAFf6^iK^Ry)u>tqrCTT}6kp{%o ztpYSXU=t~LdYjdo(L`0bhB`_FA6r6Lc$f`F{kJ3@CAZ^$b$;#X{ll(5Tun6qiJ$p# z!5Q13#HGJNJ~tAfs4zQBkX6tA^Cp?6r46s2s=AP>G(QLQea(3T;6 zSo4dMwU=G`wOOUBA(1VNdBLakyL%{8xE4?O3!RFN%#diX!}?#1~5&f9aSP)?U0=w6(ZQGdreLTlik8I$)TnsxR9i#q&f^-7Ej# z;xPwNHbvpDi@)B9E^UvUz1{Dc)4ZS21cM&_6+F6Xt16IO#m=?SY3biUkdwqu*{wYW zXcSdUG*-yYYoznks?NFCPMG%?OXa2S4ks*y5qo>!hu=N_FeEPQ4s_);7d$lci1xr=oAp;LZ~p@n{}(ORuevxk zcJ{vjSxMl$I`E`RlJl)SATqmCXU);kc3d~%OsnOrNl8;8Tuq^L4_%~heIx)T-vo0>h$UpxUG>yZd} z+7RKp(GP~ane+~WmOVli{-{M^A!Asu%5Ubgjm;!alGhQDO=s5tDggYCU#Os85Lwmo z+`QYaaNtT+4U%dH$!a(kOGLu-AjoIp+9@2`dR1Ds;v`p$P(>RCuk$tfKe)x=nCBwHm&zSfM;P_EjXSCLT`e&SC z%rD&p6d!en{&xo*z>$@^8x}yR9{*g%^?SM`R0C8xK^QjKO_^2gvor(XsC!ya(Uu8k zY8pGu%;=Jm(jnR9iLJ*cRqOiD6p) zYg_SMm2}p}dHgUbmHio!;@K{rTYHyGb}D;j2vl7<3f$B1FuaXSl$@Q=GbgIbed$jp zei<};qY1L0(G?PEb(^s4S&!MsIU5vL-zfgM=o7WDjjz@97j4F*Tac(4DB8JAgPzAG z`h=4ryuJ*HI0?pDM6L4qIH~WvJ1Cf61$c_lYnP;i>+M(+%5wqv7~8yMD9xV$gO6$G zvhYuPw7i^Wtdo8?QsF4Sapdc3DJXJEKcfzBVkYwy?xX5o9;DU!Y_Tj$FtpWT8k<@( z(BG$P;LZxV$Nai>Z0=>V(_nxqw6o)|_~KSAT!`Q{JleU4fn1W}(TX|yRFRkpxjnZ) zGb7Bg{pO@vG!Td^iiZdOYzDk?Gc-Q#jWNmrTJBZ+hh5XjbQ``xn_|JeK|h`&sRACB%?!iW3bEjiAIUNJif3(|C}Ir9qv@C*1MXJNoXo!=wJwkP)4iRT z_47 zJb9H#6+7MBCRhASY`;UMMk+mgtJC^?JS(g?RWw`J`d?SiRg>LaaqZgM3&0^f zOp(L)CPK4o!tkujDXu1Xd~dB|?XHq7c=O);ab^4NH#sw;bHA&=9|c};t!g&=s`3ST z*#EaOZ`FWu*F_!iwMR9anqcc>k1>BAReHDf6N@kvj)EZTixg0=B?l4@mtXVT?@)ViHUDE zlE-T`3GC!_a$TUw>k}YMHu&8(M3Z&9DzY^O30 z;JozpbFAx4zkJ2}L^SEU^|n%fNti)SKSx`MZT^XTF=D#SrW+JV5U<5IPAssW^=%a= z!RBX|`UJ(K)T8*5UBOCQ0J=6Kt_joklDPC%OjsS(glEomaX1PCReU19#Zb(*YtXfIBS+76(MLeM%c(l^34JJr?-=*CNq} ztS^qd;kj=TFw^krOTRTH3stZhRaZ)gbeVumq|a0HyzA8ZVTcI^ASYjO#&Fo?$w)w; zxMg-KG!wHzb0_1Qv3|7^wL-LZ_y5DzTSY|~xckC0gT+FOB>wVtm`Q;PQj^DnhT^pTc{Iion z(pf2U$Ns%W(AV&5)}68WWI;w8m3N}tzOG*AJIYD=D2bs>Frf=6KCOnMHvtGFZ68B4 zC5RjwHhE-?ACpX#`}C~`XJ(of3OEfVqH$!SfPm}U*f{pKPYUHTPn4+ZW6=Z12qz|% zazJe>s;t<*?d&_;bhXMG@j`mKNIo&j+GJ)9CNxHTT|j;U$bWVwTh^${nE^Ht=N2v6 z3RR+O#oQ5-5FvoW>D+=mPNwmoW)InHlBu%R)nW z;Mu;>et{$mlIN&x_)JpVnGSKm<&U0}2cuI)l z5OPek^*_I8>fLcuOzW=6)pq|Z;S(zr@;G&c7h$dC6nA=*Zbr4ixIQN^?du^C+n+yS zaa79Tib;O&-qS;if%+qvb#1?jN$Zw=enKvh*pxjrYt8D__jL8&{Im+=6$c8u)T6_T zNf(}!cMa#v^t&tj)ebzNYaYcUOeE0)P2TEL{=DNmUwP(c(#l87>b^ie2d_~+6aGdq(p1FNK8qw6mr~kMiG6glU+GZiv!<1Mh7I(-}4xE$$mQSfM=e)EiVJyuS{IW@@`w! z4l;KrHr2iPUzrbFY=(nixueX#$VdNCM5kBc-XC530-!*!{4R4;j+~CgYg#cqJxng0 zOR0%>X096XqyH;|13le#05gR)*4Nf=M7@}zNkE2iP%kEnDBIkGyTfZo(TtVq&zPKJ zDMvP-D4>qIcZ0!&tO3aW<)8{DI@EYo(YH&VQXOW0H=0;eo`jiJ#{KS{AJwh7Wvc-vVC70 zbByYp-bN#+BqV!RMlT0_CGM%DcD1?pZg%oj7T0e}_|c@l5{YcMkDeUIyrILJya3P@ zb(^TXc{jBFdjf86zc2?GSs-PJwJ0~*7bVPE)_1Fz$crijw%k`mfgOJ&*Hd^NrJ^X`yz&}jE{ z6j6#ePc?Cd08jO+AO?A@4HaYBOs02k8f&qnscRBh2md^|Ip;THcG9S<1@5UL(3#Lc zOC$0|(!bs4zFFHUJwf`-cBrZvqOkB^0>n@c{LCrayC&Tq3zx7}vrQIPjL>F9{pwH? zY*%ia-n*QJkYZz)*H#X_yCPc&-?7YXU1nE+824LD=?MX2m$#Cu#>}E`2y2~T>$lqm zdb5ViEdEO5OHV9o^AH8cnX4(nNbYzl50s3&42635n>e1>%S(QSf%pjBSW(Qw>wqiq zzvDV1&7LG9px#Z-3bu5QkyGCR3B&-M#mx70#-@Ncy#y_r7i8j)`k3Rn%dSM3!6&A< zikLIXeg`{*fulD{0sQbb4Dc5oK%=FXC#N?*3g(y($b4z3#%TpstXr+o-@rrL9qeHV zI=uHlY9)+0=~{gfi$Oa3Q|a<%yvkR<+zKZ6WsV+Rz1SFam1ANGo&OVH?xHUka5Pso z6-tRp?nnOXTlL3l-6DbV?YDcEB+5Ql=KTD5Ht(c5*;-~88J@R3$z~Z9y~bEBz!^RD zlvO2)O(NA3TIFEgF?fM_*eN)~s`6|%Xt(nj5UGkXb}5Gy`dp#z&~}WW!-Q}di8N&8 zwKK7VEqPcKMqFUR?T^Ns!+6kRPjj;({WOpeAXXbo);46vbeSv(!v?brdb?OdyUPO! z2x2`YUjYSdL)T~uuT33|<+wY(F-+t+%(DhZFgjEF!x**SYYC&mQ4ut2lF@p{lLsVjEZ55P1m0F7?(J*;`zIxvBQ}GH?uB=yRVe zeTFxy^@OY=usAJ}zO`}1zd6!+eEDB_xY4Y6J;K4~!X`_zL!d7qA=e!{!9$d&2)~H{ zzHq}bypnM&8|84_18@8_;FfMuX5R2&DQ@x=uL~_RYU&`t)Ps z`u~*`N`B;p@SWr%BJF}3XEKe3DWp&RE&d-`-oRqeJ#QbtTR~IPl~hhT9nz|qeTA=e|Qfqa+Q z%{Djc>gk48Gzu=IVtyINFS?v0wEH%=<`A>2MksNlCjG!Hn+4 zRpntTDb(Z83%jn5Adx>tsrCCi*8gEb@?*KBz6SC!JVw@B{KBkf(^TVTd1h&t5D1Ik z>V=ervBW6vbO3ugeU|B5P6P7);!551;do|>EVYL#|KS7p@+N3ZI=OII6&b<~%sJ(^ z=QsgICQ3YSz%k)$P@K`!A|H>hBOA`^D{VWc@J%GLUH*RKj|+=)FAW(6ZY{cUV@FF% z&(i9nw<)|;PJ29{O+}{cI+*V ze9;~n1JEg&GztOhwC2@zs#vK5MO8WsavQqj(+2Tqf*Jy&!u^a`ZhctDjwC|0fW_uY zPI-#hixmkE_5B=eoQxdqw^sT(2fl<&-!2H6Qs;vFREZcdmRmdI;{tIa*`P8-5y7{Haq-?I(-#;;8q>Lon-<8Xd+R?I*sHI0J`+kj|NKmiyK*z^`coN} z&IorS0#Odb(Q%G{TTX0NaBdZ+V{H^F66o5+`Fk6i=2@~SjpjvA(HP@)AY;vpADe-II&i6VEQexWt z`OIsXt9Qc{ObNT?cJN> zAP}%Lmxxv@P}%qXl$CF&r{-a?W?kvSRrvO*M!asJrU&pG}0DvaM>=m&`)LS7#7<)y$jtU)R*Jo*VmzpZ#cvnGY-N5{^%Nt2xVDn z22eiU+II)cF59IVec&t5O>_gqglw)Njv(w*UxjoRHf6jxl8eGpV&As}zd|cbJ3)q; zr^+*R{GddkHh6ZOM!d;*+jDu@G=K`AplFzXIG3`Io3%GW0z`r({LuparW63i?>Qup zl8KK!2Z*qJJ>G|J&CW4yDMFSGZ(?uV>G;uX?VowovXw;r{*-~x7!heQFf}zVXx6lZ zc@4-l9!y@n0Jjs&AHCzHC*o7goR6`*gY%P5FV=F!$!XWCe_ckT7*0*zjhcSXMcpQ> z9zU5KHR1ygc6{BE>|1{7gsHvxxJhb`kh9Inm!0z&aNy%SJ6*hd174qGLD1R zz$xeeQ4vt(c}^9v%DdxKT)r#WhV$}ifKr>|?$@a@dN8i+)d}4X_EZ+;f!Hbgx)Ds! zY2kH(U!MA}>InnJ`uBT_5Z!cQG*gc=|AKUH#S=z;MW9=PnpBbR1izwP9E%QUu*dWB zBxQ&IMiIV0<}Ks^&m-$kmwzigp3cxh+LowF-sj!gr1j-}&}(s(cUe}50wRy`5gM2` z7xR)wL5iaLI7BSg!HuDn6(g40zUfN{8eP7`)m`UhHaz?1*F~SpRd~&~{~^wShZ*8t z0@G01xciBaI7~P_5Jbl)LMpQNDiGsPw!9zU?2;%;9>WRj_uvvYN}Sj+Gpo5f0Xc)) zeWJ~Fn_$jZ@XxRCW$vvvXGUpCi{pgELUqEWe2G~H(rc8{h6PK~dvq%m7?SQGc0ItW zN;c;p)lVTw*QQxxLMo%do-toM7<1$(QU6)b61q<)9>tNAm|FLR+D#MUUehDkZ&)1O zyK^&O7>%qs+&O)`etOT0_OSePdF>{aODLNr687EhsH-}=(lJ^r%C~q++oZ|+ms{^A z@~dp!3ei{h=N9+qreH!{INSEdMI?gOkZGQ* z$lXx8(meny=$XNtPS1;%exNz|(SCsh9u79hw6{hT)1O)yTEd+2NUr^!Ui<*SPcY9} z!%W6}09Y4fWeFiQtE}v$?AaxQ|15=s(Cz<6Yu$w0&5$O8e{MaE`^exkEo&sIfINGC zO3qFAWnmqPp{Nj4SJy86Z1k>aY{k#3p~uG%j3gXT^>3Pa&LHd6iDFi9vl5$Sj1|pD_mt@;a~h~n5-7AbLDuMw!79p%_pV{I^-`- zJNd1~yWuIee&yS@@wz}u1yyePF7lxlF#4yFu)|%}HrK$83-=$LIQXGk7^!pK9ltew z9}md9=49O9>gtK5ZGG&_Jjg1IKE+SI`^64++s7^)^BG41V!t&5vf}Qu)D#GJP@%Ti znZ(w3B6*tRcG_>$f1W$pF6+KfM9lv@_tygB_a7tcxv$R7WFdSTL6Hym&BH}ad#Ap| zID_jD?bkG@LzJ?hw*eFFRC9B}A~aVSyjneipKQ>U;)T0o&lO-ZJ^Ec`0_j(RS}2R& zaU7@U^{-2d=JzGmB}Yjdl54ItRmj+3*FU4P+Abqf#VFK0&j>N<3~N0IYV@%~cHtsE zq<#iKfJkJDR?<g+-5g?Fj z(9z+&w!NJJxLIq!={2RKtRg?h_CI)VhbGJTyPWV?LWWFFlnedoDWha)gu;7dg+VAo z!!|Yp*^T0~WXcuCFEYa^2_b7;q<+td^>6;w$T!P5#+C1N{>W(#{i({MjTw?wXuGTw zAi2c7;cL9>N`yq~NUY;Nz2U*L0izXD?!8FHDfR2KADu_MjRuBDN>>!2B#Ckv+ zeu{sOjOp)QuX&uIudBnUop{)jekgPG^Rut!Y1=MIJ0U^bsr*yP8D?-DL`I&Eg76lf z)L_I#y{k={8>?xvYZ zZduPg%hf{Y&|t$ny#a#Se<@Ip4D#=U^9Q;gR(86qR}oqdN~>0DA3yL)2D*-$9HJJ? zW@15yq;MOAnhq@`wL>Bi5_)bnlDJF%7x=+|{tMC;p-cSd*&{@W4(dnx_^3Z2%mRdd z*jfHGGqCKqPT+u&bN`*=+SSFbXR{EphUzHl1y^hcC@!WaO1ZkZF=D&$l z0VFM-v0-}vE&D$Zh*Yq5T7<06a+p5b?Pb1YbMR(mp!3MU;{yTl8@o$&$-gOb-W0q% zaArC!Xo_KB_;Gm|Z*+(787oWt?F=A0xO>3IN0ZMXq@Q^JIDf*<%Q#2lA>~2?6-YeY zcPlu$^cN*c#cX{7n?JjjgbC?{yrSA4a#*cVoq~(!5VF%k2*<9t(cCZ?_=)Ax5HnE> z6(X-sEP7qh6@E3XFnm9l(WF7LcbX6m^kVC%mH-5ub=<$6P|$vKz1|Y-@8LiT{msKy z(Lr;5X*%i}72S#K(ReK_c*>>}*JT|OGKaNIFh0t4qLTM>2)qN%9%{)iMCR0=0RXr% zFUit~=;D`1s0!e#Ab5M$=4V0vZ!`prg9|8(;oCFo^J6j7Hvxv&+BxL%2seDOy@ET^MRo@7^g&ML(CQ{^cEw{G7>YAS+{-w_0Vf|| zgJi>>1x*>~BM@`QZ-6k#gQ(=hL7W~f5ccswiy1vlPwp(H!44DsQ+v`g-8kYoSK?X{ z$k$J$EER!NnDQ;Z9GXulz_-1TP!`(~rfcOp+VJ4XffaB`RJ+gdq%nP*)GK$O&1>bH zNyBgaVjg=7b>m(1&!i*XP2e!{Vaw2pd|zADU^h~ad`y@yr8%dz+Z2rGo4TUKSC*Ci z?Mv;5vp0M$K~)!XJ-`S~G^ix%iWF%zx{HlRdRVa5p{5pTyENcXk=Qnmah2?3+X6Q) zmUPkLkvdVW)Un+0DE#5gWci|x*xtO3-+O9XK0inhP1B1#OTGAr&!C9r>p3@;D>tkZ z=Ok{1DYz(m^zdb^Yb=afB@8$~`qQZ2k7H{=S_PXbYzu3gOmjOD-xparym@MS5YnbE zXm0{u+YMr3kN5cM6L&r(^n?2R*I(-C* zNL}Ga?ixrEcE~;F$nC@B>tJ-=juWGQ2Uy)prz;_t&jx`iUk`cWN!HAnWyAXaDxdv1 z(@_cZ9H(-A8C8+8zTzAakdQrTX>CpK7?0u?bEy1uKY&`f`15;%PhH4hZT}GCzBsZn z9rbPg-}DOONo$X6t@y0)lL-=NA68e{QL*Nqz#q>Owt#PyBTg&XNG0`6r%l|Vw z+J|~7Yr0~P0bf*!!7FpHjC&g-NOzXP4@k=aOH2MjS@!#pZ@{OhUrL0d0WE8IQT&Z*MC{qU#Ui)PC|962xjTtv1V}r`H!8eNPoG-wO8Vlv!ntu zVR=ysN9D}h{9^3UWdqVNzgJ#mqmg*FdDWX>p7Y&F4u}&b!HFsen^1(cZ ztB<;Atz6KY{3_((L*!J-uK<}7x^s!CJ_&U7SJsN1t)ghAW-B9~ScpP--gq8O222gY zdh=VA+4fLmB^;WND{0ZoiVtKg7zUBNLzKQObs04nZ&6}W{1Jzbg8Ig>4d3f+J8t(; z2T0wn$HBB}-r_f-OTK(KevBG3a8MLS4<2~&#OULL0v6!FG{b}F#KM|rfB!AH4PT}Z z^Y>jt8r8G(N>c=Ks|~}Du%QZ z&C{aQVv1!Mt({Y41bqShQk(-Laxa1+DRT*>TDsolGbBp^fNv*OKY9u%W+H@KNt=_6 zIiE-GV#$te-j5nGg4N@tCe4(h=sNL?C?bQLF?Ymq-87Q@MnPim{=d#{V3{bQ#mJdn z87yCgC}|c z0LU0c`aXe)`xo%1$Lr01T^Y%^rS^S3_pGZShzI&^iq%`#Dn=BJTt-Ve+kpct$4>49 z#Nby7<>AnYN*otu%=S`eEbu-S(v35{8}QmfYDxQ)q|S%}x0vbqUuXW?SZ4oMwv4o@ zOJ4r{(1N_C`kLx&{~zAU_>Y9l$K8$3A1(R3Kn0Oe_bXQ2kpyu3XC|;+M(Y?Ad;_X% z!q6}e3AEy(5Q<83V}J-|%kGioE~oz8gE^^ETtIocK{fnP@oQXBC@wk07YFvmhO;$l zxB9S7#$kO2*4F<f<-5 z*ahI_Y*DXaEE^VatU(R__@{@nJ51|xDi(QNBcTavRgqkBj&AUj>HC?#G8|z;hAC$)MDS3sfEAJZaJ{>0Fjo5t@qYB^t2Ls?m$RM)eZrg9D9KA`ejeKCH)slT-gmUK% zS`#J zOnVEBf^D)~{pFYc@K#-W<`T)@J=WU6+k6xmRQRpKtqhLYMHvZ%8Zp{ke%OC;SQe$> z!QbAnOa`HZb4-54etKSwy8rFPEnhRrgOZGjh@A&&&wSV-)-geyr!=cK8YB0*lN7^V zUpDgqVW?heONKFL$Xho7HFj&&RFR_SN=Tujf*Zbvr5<$gG?MUF7TbbS7)kAggj|IE(ZJ(MQ z%q3gDcJ9pgCz$xfZ@}8UQBK5*OImreiGamBfJDB)QC>pb5EYfZg^FNc9zK7TT1Zj~404b1d5H z{dZGl6z+sOf2G8Zms?|lFKZs@{{b z?cZ#$n*V=XTc+mtO4Hw_@N@e=$5`N(l|Ls&8qys@X(TGag^RrzzqxqR3WA#D$n}4< z2oU$buHaId4`_cY>AC)eEd3c&kyVdQIku@ZXYEtrq?46RaiJzR{plS+^#4eZpIk2C zr>BX*G^;o9t5Gg@-&`7&{hR*K7nFF8FF;5^Abo}R;u<8nxGi0+;G5@=l&PsV_sfn~W`c#pCPNK)Txk2K{fRh>QP(t?Mg@>9n!yB)ACR|F)8s?@$ctoC>>F|m!$4{j4$K|1r)kqHo$@`0M`&P$apSB`PAucD;&YKDA?*JSge* zMbz3d!nd4kY~e>q9*Vf|#n-u5nylkQD+H~I<3*0k(Zea(K}yUozrN{=)2f*8!_(X@ zmlE4IdKnal_O^2%&o@^XMFv61yzRFwFky)G8(%X=%9iFUw%IZo1E4l#ffS&{&u52* zkNm#u&r#2sEG}p3mL>uTfDN5x&)`0v}Vh-zwg0j*> zov@EE-_8&AqwjR#qiH77aJLw33!5#yCgnkb{2Rz#9C$TTYPdwhEusvJ536$L-6cAwz1>yGwQMqO>}mw&8!{EM_^8 zQez-GFw{QA&Y+*TX!2PofwJ|v_&`>@H^&>_0-0Kd9R+-$G9i56I9KNDruCbSeb`*R zo}>^T%eetTjvu7PC?0@2Nl97wyO_JdW34xmw(T5(XQ(gyKPFG(IacYvOP^TgZap0` z%vCaszdlx2I=(E>~E8cKVz=@p9 zGX{G;veY2tNQ=+lIPdQ0WFc(~$qd*GFQQ1IUr6LFSdfV1>`;LzhREU)jIpL+e%pHK zJ7Bf(jtX5YXJ3S?mjtmy)z7Z(uH%hyFj9cm=!UU2wi1$nfnqB+{R3umVZHWqJYbm) z>w@Ekykl5<(#dn{O)m~_2XvMi*;~sAh!?@M)VJWYs+-Z|ypc(NKc$Y4Au9{bR@H53 z>l$KCTxRZ}-Td4xOH!L|`Gz6@!ML^|QIgKW9{y`F>x4EZWH9yhixRe6M{ogVBoc-` zfu|}nV(*d}s(JIqiZZg*?%~}#7a1-0)Z3bO?{qZ?p;x!k|0wAZ{|1CzcM<}Wm&;+j zIG^@A8{#fz#bjN-)#z(eFJ3nxyp4yZ1}ir`3pX-Vty2`=ZEDui^nOl}M&sq7rFlIi zL1nMFsjA9e*pV>;9d99AdDc9;#%u#oMEv{OGC3_d=Y}utcxYTj4(qt6*cIy_W!ccs zD2LHwNP!-0TiSH8^*{>MOaaR#!GNZyO-1~%zM4O5_WTY?o_qQ35Y@lB5+|o zaeW{x%a?N@#+=)JFF$&Z4jyiJ9lo=`pcyWcmzuwf)y;P1V`1le5i%!GGO9c)w&R9d zi&v=VyUSHEz_hmsgRRwJ#+f4J>nf;thPH4|{CSnMxNEe4CCe=oh_wQtb=o+;&TU~^ z90ckbln8%auazpLZ6YU@omu1JQk!ju>f@#93SZ|#9Db;K_x?@X7 zm)kus88HAVd10Mj_iUobiIh>K4|n#NH#?L-w|7ds!b( z%N)WDCQ4QfZykKuq_9D?WEtAWw`s!S5YKBho+CPUy%GT1StNM+v1qpu(KvQGI#$(f z8*y%a)y^|HA{8(xIG)4_n+QK7LIM6iC=A(Y_O+vw}6v8aw{`a{zulZHTwX z^(+G9ILcvIC1C~FVcQYpBj$f&u5D-@SIE1%t=Dq)4M@z-+p^2z5&2jer!$FN(v7qTf>jeP&aRT_`dhLQ40 zV{XtemXi79<_NS=pQ*sMYnYI7;7H_<0Ij$I+jIn#Gze0sJ!D8ziq+{=oP*Tdq9B^| z(@bku5y?30yr`TJgQaFUV9-1mye|@0-ejHi{9oPnzgGqS1c^I`zf@sC6HPNqPoca% z`VLX3TpVzg(s!qhO36vFeqz<>rR}vd_mG>swsvQ|nIsWy;E5rFv2MhHn+e7utzXzH z%~l&Gm44WiKu+E-K$9LQ4Z0QgT^X$AOhji~t{UDHqzZwS>vh z6e`LcdOtI5aSc(XNdPs=gV=FxrR->?!HV+rvwH!a9m5%jGjkd_?Vil(lb*c=Di#;1 z8)zDFDp~lh%-l7fMtS-Ojfe5sp~n{=1d{jZ(?l(P$K&elR?C1cTv-(Vt5wS;HK8mc zreAPxHI0A3iq2_j+?gYHdxTG(_8D9>N7^UUjgqg9S^`a%HDBB(VP?13nJ2Ith|&wD zwql%s$lT&Hv4xCsN+qGny~jhg3J=3f%2XpLBR~_*EV5%GZ|ZFFMYGLp@DsLE>?}=& z{1EbbUv?AKza7t>bW*UQy1!EP=(EaF0k38svJuLywLmM@8buOlmJXgVzh2m_6Wswt zy|JTa!X&JvRahXfq``D*e)etU`Xph<*(Q`aSu_sicYR`NKw_8tGkNp&=xH6c>W@3& zb&Aa1#zkzDz)Dz?Ag}nEEzIV{kX4~bH6q zAfg)f(eU9{-w#cHr$eWx2c-0U z+&Y>0L#!E#Ce5h}>}Y%m_C)Hnu2RQIfM2I$vYR#CMAXYmdV1Jo!nT{PD#jFi=<6zbAH&Zd1}5f2|gG;iPj1< z-Qo1TmqM01``#@DV-rZ<^C97!;DNckF0IXviRf!PF@G-mPj71H<4|8_<6)7B#OQ$R z@}e2`_4>~Z&~S$+V`!}$!&mR)SJ&+NjU6A#%py6pmXG9o`Dd6X9{Pl1lnpnD^2&@C z`2TCJ{MR4e&J;y9hO0XK9%4Ifqn|pQ!u_M|M1aaB2L)AuikIxb7>3#^RervRX>#j) zW$C$=WN*6=KT$fMaXDkwx}=wg`>0bh8&!6S%vc@fa@30gj1Iw)jQb6Yp1!K*82|Yk z$q9YcUJ|W)qOP5QE==C1Z<#h?>YqxZk0QS$prRY}EXFA3}%`WDYL=EgMf3)z2uz|7Za?jKN;+mXn-wss?-KaX-D=MMU@vI~L+- zBG+^rdLM^?y#a=H$-3KYK$PbMQ}PBoaMbiD^b`UY+yxhLt&9UkG+h4uCL&8!NW3n# zrl#gDoqH9s4(4^Wsf;QX(utegFw@HcA40>|#Z>wh%zE$?s*5d)%g1+;*YiNx|GpY) zSW|b_*xi0NKE18VI6ck>2klv!NT{>640eEfw4#})=n+$lk1{LUICwN?h{Dhwz}_AR{ZRMGM| zaE^G;iprDO{bR4Un!%pC*6s>SfE|EME^LthLvs0jv%2rs*cGXzLlY(WwC{jY{s?Q~ zPf@S15mYHJ9YJaZ`z4@gms8cF1(!An4V!fJ5_V>}10VUK6`SZzW zV^YwLUj@WJ^mv%^BY%NJ`h`}8a?a=^?g6VlqewmCZ%ef9Uq{%#{x&s5lSpN9w+cmx zN+Qg$yG|K#W2gP*qkf0ADY9QDg5Yyj)Qvs&q9|#Gb~9oF-~c(O&7V!e$^f9Lea$cA z^L6;#%I|&QU$4^*N!2xx1P?+c&97wKcBDUwscc*?7rh1u2^Wm4+!S{AvvfY+>#54b z0r_!p%I(Gcg-4>5EptcdI$z~U8XY${ET5PU1TZ!G)?6p$OmX;2KexFq5^Cu+u0dmF zw3wd#M5764CX9+>Jn#?jltfWlEHI+vl&@xfovvz22ZaA6T$fpeVxsIqa?l4~@>If5q-MWVkJ&khLz zxz%5H{B|ZkO)}$SCPa%8|8zgL9iA)NdtBI?2V2Kg#n)rNTijCf^bcRMSayiWD|3Za zC6fNIp8hjpsFqAxaytKK=h?)2M?6*Tn||qgVc#Dn@G}JPN_IN=l=(96y5m{!31%?# zx)TvpUQ#Fypqa2*dEpH{R+12}D%r`9H*Ogx0wo;#*(i~I!pCvbx0)lMQ@eYh%l~^( z_OHr^&JlJgTV8M7IAJGww#-|FkKt2`Um4c>pVi{uAW*9=_T!F8v>`(UGzp|R%^3`) z_qfUpXu}!H89Dc(2mVf2*RlOXEIoNom446V(xqBg2ET2MmMO-pUw{8D5MCJG0u$}~ z&WQ3%Y+_+c$NAJ_8s$?y!(IQ&)CQ>A3E>RYV;e&QrA$sh{g7*O{0PX^tiJedeGPR{?o#KxGaEcbm-O)Zjyp9CptcanA z!M<=EjlW#IZyqSkfk!IG<3K`Q11POongVfgH$>zO3MbCv?6YRZ^XeNiL8Y_QniHCC zm-|BhLPA6&#oweq7D7tyl=po{-B=+r{XJa!t`OL0Zc|`Tmhs$=PPbY6x2?nq4C5$@ zA)9F=Bf4}aRRyd`8OQJ6SeN7|Z92aB>u;il7WbdFBef{T7kecY?p?DL)w&zzYn^jZ zs0azB)R*q#>P(ag*7%fx)&WO0ClzOQ0O++r$czF|vjPsz!wHNJBPJct?e?+EdRy$b zefMlSFQC=ChYvSL+{JUu7qOo6dP6=gnd|^faY%XYP1f@mqjG(j_t7V+>^6BMSCLqZ zzRPW1-)%CZsEb)JO8bk?2l#GW79MlBHhvOo0Ql;lL)BvlHyX>_!5rf4&uKTgqcSNf zyaS8IdvwG`R)$r3GRMSCzx+u)2a?EY>nbD6xF=NfHL3~RC&J@c7+U28L=c}mUtKQZ z>+`vEM}{{0S6LSe3id#^nTOC@e@Ag%97yd7Ye|#7{;P~ zo){wI9cKT&&v?A_^Qn>3QIU!!oi2&gSD=}%O}#yh@ZBMUzcAskLkxxk zQ0>54R5n0ib`o(l`&WR9&8`fEmH%ZRf+_3=l0TDN&z~wM@ecn~O2w{2(>Hd&Lu4Ux zT;SuCWUqez>n2y#G08*IjO1O=wQ3di;SIx_)m!4Y7MG~h_?FKjaINXPA5IcvHBQ8`*7hs|=FANjyERhvv}4l$D9T_f9sC?;9=lsjdIyK#O#^|BIO@1HZ@ffjDr$paB@pM12*;Eq*dqmE*{M%`po6q@w zEfz|YX3GZCSxN@+bU+@t?=upx`17I_U%VXo67gYHAVhmvpUt6gZSKR-oWXTylQ~}# zavnIE`TjKNe$4%M;h=@R4)#d+Gic$}<{mVn_n5ja5`qziV{;dp$!}x5QTc&>I&Qx0WeU6rwJ^`oS!H4Ky<(GA^>W6 zB7f*jnn(zeWrp1>Ged^}k>xaBp1Rpg)Sm0tO4yhnlZSC2&v!^=p>_o#6etGH%N+^{ z=y#Ir8-ER<)oYna*w|sA7e>iWE6nU3V0u~%v=0C_^)}B05Dq*5{MuN_^69Mrag_52 z7}*mspnQxU!OWP~8b~EvZDA*jSxy|l4n)CnVkQ$J5drz>x=x5P*-`olujdONsxyw` zqvR|wYv-n25X}-pcr00f{fAWy4u+Fn<$*_H?UGoQ)UrL2$P(DcJNlkctUswg_;Ze~ z_sIbOu$}r;amK|**u9l9qmyWi4B+0)lyqZLq{2q#ARaN;^OV}*7hwAao=z#ZIYArG zT$F%&miH_Y;zkW;z9~SXs!wUY_kcoeP{_p*l<%&wA*!Vhr+0qAc+d5h z9zX>X-1+5J%m&TNL$MdQsK~w=@8(`UTx|I%V;eS(@R_;79{dnMFk{(Pju48%Q1~?+ zBL?~#aq)stJ}B)j`h9AaNmP0;Z-Zjh?xoQL`p55r8DnTzIu7 z(fjxB?R`!#(ajZBKaUdye~)vy_}ip!Xp=t8{03%4jHf^i8dWPKw8ouxQbg|trxenE zUGh4T%sQ8tv8Rz;rbi+9xQmFV;b%I3rL48q&26JLOV&zJNPL|aMY_?>c&=03YSm21 zNO7U)Mhg@2eGEWJibRg$ivq_p5nN=+gin1@P4$!13-A5?IJgIi4vJtB3|Fro`vS&S$VE?_g^wq2 zZIrS(t00A@77vxd(G$Us9)`$8!My%*3=?f9_Z(6svRKmYwC@1+ZV zAWsjr8xF-lpzGas6Mn8&)lL<-&w_?Eb-rS-V185wf6W8fB#dCElpWVotk}FHJd0WA1BX4$oXdtRS#UL z+Fx8@ZBsxs{Cl}39UxejB)mP63zg~loM@Euar^W1Qwb^Z!bLX^Z&ao_Pv=^6e1)v) z{BHje`nEYg=g^Q_({Du%xA=Ejhr>5J`UqfT{{V*_lkoH`vRuZwz2CbbL?|OMIW4)Uf?bJ)^%ziHoHywW->IM#JrpwnL8Yc@C~XoJ^eE%(n#=+%YSpNPY4EtB zE&-hR9Np(@Q$*zw3Cv8X)@(81h}Q@at0euyW%LofohV()c$qk&$o}xL&zJHjU+(_J z08uF!%8erjXH(&Xgc5X|=h@bWja;@6iX@%wsw7;+JeLb2h4*`~x)Juxi$mOW6-t=b z7`qh>Q@5kQ=g+H8a-iK^5WJEz`W`N*5g2EQf(_#oOhg%Yqi!mdlj@6FS#UEV%~?&^ z`RW2hRK>Dgu(wKt5}m{xP73*afg$X?+&AMmw>E#ZN*UH~RoIEzmO{SmhvB*<--k4l z8S36+q=uz6zW0*gs(2{yXz(HI8Mnnb*=P7gJTxh#W~TWmuz*L%;3Wqsn9=#U*~-eU zoRT+goi}5QmOvtJLUb(u{=@*Gw(8K{9{Y-#H#ML7ZpPiz!r+(s+q~@{>!hq4FAmNF zpC#@H#y4!PfdEL6MtFo;8!{G!RCL)h4Dej>lAtws(jlSHt1isBDJjNvtkCL$?nRBKIm1M7`f#e1459q zTp+&|#?I$&F21G{uT`epvsfRp1Yu~}Mu#4Mvs^vos^svN^kU@X>|8_KjW`>Zn*SS} z^(jE^5|1YYPk5G4w1l9r}EL z%dH;@wP6A(VNxo<(8rchQ`HAa*_l*zIg$WsE7Kpmn-$p6+m8%n4*c?F+~t zSqCO~-2Q2TmNxsm#?)y_^NDbvSnzDZ_!IhU->Js~1}8|4KyC8BfgTCpye zH3c|m{{@v1!*Hi|<>-W)Kq@MLcct>$rJd^YuB<#ZwHjKr3Tb)^AL+M7b>BP*kPEsFtlh-;K(gPuAN;xSm&)tr>!pl&mkNqB)WDY4fc-JJr&W;>_{6 zgiQn0OfRzk=*SsoCl}?ggn0M)nzKu;jWkM5vpUAtTb^JiftrlJ64Y4G%)<-CbHhh` zdIVwrSp-<5Ai#{A*m$Jqgz5{F5@X-;2?>#$7QE0h0@6C8=Q=Ff!rl zRog<;i(Bjhx{lYZDdQ}u_Ib%3>vzv}h#O}O!`{%_aubVh5$=UmpF21IAEw?qDC)L- zA6}M}ZWdT#=?(#DC6-1?x=T`!Zei(eP{0Kd>5_1zyHS?zlyH$wLCW9W_j7;eeP{TC zVFs32_*~a<9_JCW2pfz)x$vG~RZo*ggi9of6P|Bh3_2(hgU{}kUMUA?+tqF-m^$UZ z7pbA|NH>cl0V9#3Qjm-;-y#kqgK}gVQxqbr>N^WM zP~0e2WJV?3FJhp1=Yy}!s9s5qTYtYdANQ%+Rrr;*qU}>=mwZ-=ri0)b1KNKtv@rn> zLrv}2e;30ZtYC-yGdnhc0>K@fo}iP&uIt3sqo=KlI7dcD*?5Vb}ppQAzpJA1g?M&V^#2mqA!?Hgp1f$eLY#36U>CaDw|8^k% zLjWDu>U3w4)5`0TpAB25^wZYRA)<%ScYId5?*JN+6FJ?_)lSA?HBT6-R1%g7*PQ?S z%_vbHbF(A5+8}z>B*a+mI|AF$!9toHxnS=1#TkkOxq7T&=F?pZAGkNtTl@zzq;<7r zFDW}O1_U<^J_k|ln2n2|+tg*oh4QJ&s*%_LrU(ZWRF*3C8n<>Z#=5Ktgg!BI^^xlA zit)?NX8O3t=_`qR(hyR-3=L(0tO@~pCD;5xycwRtT9bn`dBDrp3~Pa*hSK-up2mPe ztEMN3g0lU+RtGIR&shfJh8K^E8<3z_vg{E6GD9pxT+WA>o#uMua(~-}RKAcg92GBb ze=NH=LO)6_XlJ9dUPqVL{S@*<0aIC!yhXR^W)bST zvY$+wc-dLw;<)m6m=84H(d#Ib!<>;OIXKwiH70OO9u<{SY=gSQl;w|e5iZmoju0jx z<2;e@)*joiuPW9a8r{Nro5ammYZ`UP&CzV$;;)y~{04Aof8uG;o*>L2xz_&Y{iFub z`FaXq9AHno%IjqPiSV94J0W*2^1|@$!)U0Si+!Mx#R}ansLXk;z9~sONc<96;oYlH zVA0(L7Xh~s4j*#~H^r~E&jvCV{_*S#awyaUKZ?>3dQPEU6F2$sJJq>pPyKs2ekz+{ z*TekCM;H+0yk)R6M{&G!-mp@5JRwwzTSiN2xF;WvrJVW1L|(h>%B*^|!+$rq`=Z5x zA+=;ehNq=G!pxkQ?Wf`}R>AQ{VbRj)GUvSBXpUFc ze=nA@zeKq&L}RP-p|ga3i_UEby@YZU8oOp~03H^Jh6?d2O6L+XGZ{*qi{c3Ooz^#G zP1zgL^^r<;81_~+$M`~Z79Sb#`P$f7@G;- z7n@w$f8W)+SECCiwM2|pNK>+JfaFZm<nqD|G_cj6<*Kp z>5lo|o`4rLsaQZ;L zjEZ>in&vDD)b|W|G@{6f#Z@4=wmen>JlyJUvel3%KTG7li&vA+p=jzNbi6C{s>u@f z;Y~!3;`#>7e>eYsPx0U34CM-M#?>drhNZqfE`va=b8(thl>1t@}e=WKaIn z`2P(&mS?``zH)RG0Mn1`&mrtd2!gcPk9%r%!zm^(vUnn)w`p9i+#JjSpABb`8R}LA zKZ=G6UMLV^FvL`6)F>&*b7K|zu(PDS5nrUpOpM@C`UP5){21@j36>-_#=$>yOHo4x zVz2fS$#ol{9uhwkg`CQZ-K|w)ha$IYxN6@YOsPe`L~BiNLkeM^o!yw z&-FJ~KYF9jUp>=ySi3TW7h2!4hnuVSfJ#MxjRMo&PnDF590)UZlE9vP>L zZ?fHyrVBCy3u6H?7qE_HpDZWyTxwJha_KS83MDlMoU$n3HHZ9poN0kK%or1{R->~V zB#Bekup~8vWgKhDLm|h;^zLoreqFp6ZI7n z>RnPN~R3k0^h{<0AeJ{ zy;`y&Aj*hKaUnX9A03hCvU?mAcU;dnC%7;P2URgV8&ID{0B?;0$cg)eV4`Q8?RY*) z;MgZo&h3o!pHZ3KoEJ?}9d`5_LrL#gz>M;iaui9)xXLY2vO0?|%gm=1>jEVTgZ z!o5csNdY0W-zEaXS=qZtEE#xs2qiu1_`8zU^+q@M^uQ|16M1+XSZbOvP%`7iOq0a# zg$QW$w)qBM%ew&7kDZ8c{@=lhC{HID6@_6Djo%^djs{owCr`7EK$1o$jcO}8Pu`Qg zJ#K0hk&trq>NSR4^pjCR(p+P=S_Jm-0lsQ58|w}VdBtIUuf*WjPT7OH8*jMZD9em^aN{ zLw`nyc>UN#RrkRiLk^mrC2)QS0RFSzsJ_qU^gKH|Zd;B$wXKW=+!1>~h5ltXNnr&3 zzhIU=zBdT%^+Uz~kF7A>7s%2bU~K_SJR{QMDYkT-={KgUP!@k+n8|wPC!FTxuB)s2 zDPG@t${Y~)m01ASztT1-?=w$wBgpvUq_p}-NcGIFHn;0}3}0}?rM`xIMLebIV7GT< z?G?U{v-bZ@Ir$Z9(oe5i#(x-mzG1Pv-;0&-?&t{w+7RE$RwLs2U~8)R9jor>MJh;i zSRINNUVRg*y10jC1RU2uiKNv_S{f^I0)L*gg+XW~P}Hzh8KYlX`1al4aNeRMs+R!+ zS&zTck0zD9+Nq>n14uH>nv%t;T8mOZuzl2Qa~UEEwn({$ZZ0kep9Y|L4b5q2VKD-$ zR_fc=-x5+`@)mg8M8ei_nCkp-Le0MWlmJTm^PZ}KulDxA$NC2R-8RPrq;5$)er=G# zIu$P4)WF_X=}qc@7hg+Z7?-zg4tibv-i0%f)~xH3NZVlTqIB_t)~ z@i2@E0?}K$0(}J7$n$)TKS_~IFGd&*W8ji{AK&8dgYhY( z%n6}`6;uUR7BQdb?Z3xkhj80tSZVaga2gcjcA^yUs%lsyNJMc^v`)vG0!}sjwPF@U z0Q=72C6tdH*iMy7m!wu1wOJr~CBub7LbUrZ<7 ze-HLLI7jwLd+ndhou0oPEZFIQ+$d<$N!$#alW1DL{68&#cgquIWfHrH4A}Off_rEP zLr}EaW`Nxv6E%DKz!X}=6kJM0dC#YV6O2YHky1{{auw?2-fPaHsnsNa9P<$>ineoilFB6x3-?oX!f)!xW`m*q4IpJ z?G2vb*C4EMc96BN;Q#Mvajkjgt=k9F_b=kYET?6(n^CUy&hS)IFV*LPz!b62N10_Mgmnr2uuthjZfP zF&uVfg94+k?3}jwFDHh9PL)2-a9Z#qt6L}yf4`{xQ?!YAg?N69FX@O-5rm(@y$z|j zE4Y5W#vhiCOV@qx4txjHw5aaDC&<8~*cH`<5bDP{yisTx^ojY z#M(%2lNT`PY0z^7vQ5%jQ?+@g8cL(S(YFeu?0k3dtY)d}${1+&&-=BiZuj23ey=Qt zXd0HuASrC#7DOcOZmx0&bs&N>g)T6O23u_6#@NU$Bsn1}^vvMAQQsA6A8ApIZ0cdB z5k!+>1szLhQgH7Mk%>sN;2Fyjk}+88EcJm{3PG--sI}m6yLZ*IZ9D#30+X0n!)nEE z?It=58wB44;IntrNv(ayN{}2A65?XF6G=hqgGwcBz$ymNL}1r>M`3w*%o>p?uY|0u z;xQ4oqkdeaTW{+QE&v#O;T%6;p?F1{mJrpvgCi# zL>5o3rl>^ORLIMC?o4^L#(y7(0%w#r4kd_5z4UBQRCa`;KLAWD`F6GwtNhlV{Zlrj zlSt!Qm3i^v616r&EuQ&ZIzgp!T_c(-#|^TUM9bO+ZHFIvOiaCTI7R?yR+=;xwt*Rx zRGDQoF*6*B)hhVW*T<7P&DC7J)YF7O2M_Q81r;VaV3Y%hPta{(qSJBX<%;;)&z)j0 zLbRW;VtJYly&D#HCA7{bH)X^5j7R}ty70^R^C@+Fsnw#{1Ux3x9dX@caipcBHX`Rv zh-7ANJr({Iv@V^l?Q(+dRLG-PXD73%&W z)E8KG&da1C=@AmWRh~UK|7FgPvPFJecb_kvB4>E^W|LIMRlx&#qXurAx|V$B&G8sk zf09!0k&cKJD#r2T%i2Y*nYsaI{C6#!-@74Z$Gai?&I~1v2i+-j2>td$x4$9+R-H*# z9e>~8K{kfM?uJf>S)aj-+Bc~#g4-SF>^u&a5X(Px#q%xc7q~0D?V)zDIdgOm=s*Ha z^whJxjdisa{6Trq*mXm;CKXEjIOO$i(6=Rldg*QRz9UW{r-Qob9QaO$yw)T1F1HL# zf_%6o>C*WJJP4NP354G(Tbchi&irrYc=($w+B2Y@O+=(W&4a1YYZAL$)*4NrA8Ipzc~lXYf^|@0 z2T2QWTnIKoPZ14crB|6jJ~Gk#vowX{!Krife#;EJ7j07P7i*qDK{4=#3_-NVBA@D{ zI)mm!L5|E(O-w2YbI{Y;V|Al|fMx?6-s`m@>8N?GxuNZP;3CK4`zHiqJY$-s=fM6X zyzU$d9h{R!B9R`Kdj=twu2$&PA$Q~mk#NwAVYb9n@C$NP_2Ta;W%Y$FCUW7WrucMF zs^>`T;$qHk&f}g~3_eeRP9%LE^v?1#R{%0e4elF+9>I`vy1LPko4vt z-H03-88LKg$Bf)Y=rh=5ak^i~o=UKGJhtY{U4NX~e)TF_Th53ZTja0!PLdZT)h1k# zkkUH$Hl>-xbn@V2F+oBJ98-Qi6jH#7`nuM4>J@uzE?BwQbn2= zObr@yT=_A48syt9&dT7~rB?}t#g74}#wGV#Is21{F%EcxT#FOlmg8Gu_Ww{A*1_t3 z@@g>s@Mff>H?XW9tK}~Q%ZnLLG-cZ{j=3&reT^>DATOm1PC%#PunoV=(NovN`bFrG z$%8IQKlH=2b7Hau+~@ZSQ#8E87$O23czJ!X((M&XJ!B`h^Q=t2|JYv%9$LUlS1x*a zVOb|K_UjidzVtkv2_Rq2-P1BHxD3i8H;*+wucP|>y=Sqo*+S1J`z$@(1{n$ohffTd zVy)!TQoLsaZe@*%iBKgSc*Gv)ly?mZ}Y*DJVz4t9$@efKaG7T?r$Uv?5b9>&Pf{eJC&1D>D%<5$^V=zRT}RArjN zwbZzGkt0||D`W%nFWw-i9j)(r83BtUua@ev_oK)_CB>25q)TU{&|A9hI<_i59a*~n z)^+zSr?gKzDEc4mmStXvdBkjw_5TeT|9q`r=y8(??G-D6#cg7M<3$6wWRa&Ox4VdR z^5?ryju}gXEdCOGKdLnI4e5PrIW`>37w;V0?Fek@t9)L?^NtbN6^?bT(N~`X%=}D8 zA`$jI3qi9n_x~xyR)6hvY@MQm?3==Fo3>_2WRt>IW0D{MH2_P4DrZ}OBY%YoW`(I) zO&yY_MJo=&UVL@ZI62wWhREcx;CSG}0R*j=&}$f!m*>=FP{vu=wg^AlQj_PE3kTp9 z#T@6uBDzOWrtg;+%p50q%syR}CKw~ej=LW`3h}U0D23)W(Nj$LBWf(JNl)0i^PndT zLA@nGDu)D|3lVB2;bp}mQ}7@HDF8)qniq=)CDyg(bP_3eFdX)LTo)LlhGVKC)Bn9DiMK~>Bq(IQqHBg5k+I_9N(=RvjlX;S#?dQQ!N6HtM{VY{ zO&ttSzubJ^Sv}sc5kbXKFzc7oteMJKq$OOqUY|fQ z;aiwEmKq-PLQAQzJw0A@rCs8>n>hT^^4EiKz1$r3_|+^(!s+jb~{iE%s|WCFhXEsrKb#X-n|WmU@$)ASg$U;tqvi!ycH zl@XMpVCKpL%EZb7mlr=_mips#ye}9RPE)r}eVJb_CVa9)Elz2<9DOnqI7TCmcXL;} zcVvev1xYY=gzPp~cPQjgdzo@aQyy!Q&+lURu?edf-quV>@!7MrGSlS@jmbj6urr7!b-Zp%k` zI4DGZM~yjrBEx;Wu5`E_Xpz=s;$qMco0W}@0Ao#1iY8s8JFeP!It}`GYd|lJ@vGIr zC+s;?=+EtQlxl_2NF=$NJR4`iZaV5M9?;(WV$Qmb)Jp)~h5NT}{l4v*^Y1m&*1-Yc zcui{9-PUzK=hN^tX#vZ2EI`2d`}L&MHwSico`r}U28Lm!l3(YurioowS8F(cfIj*) zSS(Yh@q8vJ+|tT*I9=suY??*fg#7-KAXI0#t~^#!csT2%93%rB=l?X}+0Cb+*TDk+ zf`&ggDf8`@`&W1S{$cxu@28Gee~gOoAWfms8dh=*|BWe&X&Ynr*MHZ}ttUWY&54?H0s3XoD`LlQ1@rHq#ir27De3GN=K9 zhSCiXRAr8ibus$qDUHZ{vR)kSTsyYS{u;9;IP4OX=XB( z9|LyaoZas*tnEB~lHzApJ3eyg%_%cobj~i3+Ue+3z;;?FuQv=J0z)s8+Qe&I{y=+s_fU93L=6&;0fg z@_mbo1&50aKeHs}Ee7#LPGUDj=0pZ zz<|u=ox1i`Rma0u-Mh3sDdh$TK2NCrW3no zzd!xM#vgV4#klJWyAIo30J1$U*_X1ore#0IX?U0&bVmz7!hY?WsQ;4Zh8Y4_zyTX$0#v(vjv>EVQGn#^3^CW32E{j}G3lGvuhc4DVwtq98 zU_CCkRZnMr@P(bABmUAq6YNV6Y@bUkmtFaF5xdToYTvyr9FbVlkikUdGxnH&!)aC-OGIif74b!iu~gN7F@(ZY)hiL>G@ z()kB06=MwHY9*BRU(YNXz9;ikVyphjpQ)J^ojxTZ6UOp`RieeObm*QR^tc$`3~<7V z0*E}Qit!J*fi7x8_;)OK;KGD`oAw@Am`o-+L}|P@bULpLJZ6K-o@~|0eS=#6()>#K zvSEc4l-8Cl46x~OdaGI>OdPO?DTscQx!u>=E9?-nF$trmralZcjd4$SB)AtZhWfEE zN9{knP^d7-zIi@UgI%My*78zFYw)Q4?0p;<%i(7~j486?tW)Fd6?nP3o>drXFd>Z= zlDyJ45a=gEf$5lD3q;SfgrvM5i_@!G>LIvpUUf%T@n#72(|$Arwmho)G@kpDwnm%~ zGS%z~#lnb7li%ug)laCWR`jW46qn&p{~-};o}E@reN%DlvX)YKL+Cl> zbMoAk{&_LZrD;;#$ltoq-zVT(!^>-IpX^{&B$4$dNivmZ$q3;qGrv}onUk0ysT#g6QsfF@lDS)WAfzjyz!{-&9 zqWvRw!oazb-)I>yxptj|9q1{Cos?AAbJcUYogdXw2aBIhOFW6&9SeS9*(FEZkzX=P z1)H4j1afQ{4@>JM$7^3)0R&XS%(hA(N;jY#HF!k3nWzUj_n8LvS>}Educ(a36!cFmT0G;OojKhfy zzl{pomt)ZkW?1RX*}JYJ|Bii&fcdsH-zJimHP1=}%$s4ji~)eKhw&~2@j(EFNkfGS zr**=aJg@j$8KAhHsPlXuvUBLlwmHDW)PM6rWoLAJT2bFHf<9{z&XXD7TQKoZ_O_xwuHF8 zt$K;nc)CMUo`9#m7lVyc2XnoP%$W%kKaD9ZQqnstqu|_$X|s$StHq6fxN!+XXMEy1HC22Qk#F^S4Cfc(I@NukThvOYd0iSP8iRAaNeh`6| zINLy!sn(j!PM1Sy0$r(kLDl5XmaCLQ)(YqLaxp2w@{g>ZcArg#N`O)k_32Fgajn6#>eVxM9dDpMZUYN%KfYJQOpW8 zTPgRu2${Ip+}tVQ*+X58TF6nUB3Gq zURupQzbp@+vu2N{;KN9;T$2Vh!kaodtO-r@n^0~7`{^V}zUCaqgd)4^mgabbXd>pX z`EEj4XT_>YxVIPqUFU(v6E5>P(a2p_yLXW?jt72b=#^T)vFFwx5jJcfwDYv!Spcv$ zvdnWg;PYCriY?Wb^Di`4b48cv_-Wx3Ow&dXOZXJPY?r=pPV-hp?h1bKbXV84MV`-pQo{&WS%I{EI)!%LAslHr_ zosfNYjCxe}rS8eOEc;2zT!JS!g+&0YKC;A{;R)UNtDx{UaLMG6dyUf0Lb6_5F)J3? zO>j6^cj2(mD+wls1A!*Lq|l3ml7l+mb%?QtO_-t}>AsJL?DJ>Wa)h^YdWN*RUO-L> zhEhmNF_E#XkD=%`OXWdD~;s&`Enis@VDi9unqvgq1d{PklUfDlQHXS-PJSftHTRP@rpyqccx5Iz2Fy#?P6FM2EayroJjs*)$@hSClD)L|M5=)l zpm?%PJ+ABEk=hT_p6 zKg`R1{Y~^ows-kuh>soF4oFf@X>J@O)4`fEprkbTT6~*H$S0!q zKh&^*Z^#^Dg4IRH2o*M}J<90SMgUk&ji#;;GwsknN7dJHirZtBj$Z{UxSlLCyw=2T zCsB3omBDoo7Ka}o&mHX02|azy5YlCVN(xnxLF1$?oC12w8bgrAT)^#pF5{-6_KIno2~GXg=FMQUn9QJf)~IB=pMo`O24(tRW1^OkeuNtRRQaMiR$A-Y~m9 zw$srt^sDn`e2QiGHH};mk8s+@T5JsP4T`JFPKhjg)d7i#o1_03s7IyXMwG|RlN5x^ zE8c%HHOQH+z%wS2ufl>oE|hcvu`VE90W(ukB-xnFSO4DGm5U=2ZZIt|h*P>vrk@wJ zn((x%ysD+GLf_PLLheth=Qf@Tq$>RZqhuB00I=7$-eJT{x4SB*um2vt(|?1$vINVe z^s3b|Kb?iCVgD3*j;lExm6_>H>N+w9CF*74b}uD^RJcY)%!tOkm!7#G)qp|-(H;k# zfpcLx4Yr~bVo~RIj6}@vALp)#cHt1*n6;B)Yer{DGCi8H; zg(h^tmRI+mhy2=XNWcFOdahZC&>TkK#WYMsmR))3_NrsSV8wEd)?M5tGzq-q%v&-$ zoZ9D6aJ+WVP|TQvH&lk1)IQI#U&7kH>a5prv4+e#S0l!sQ4tLA+17ONUG!gV^(5GG zh-y!y5dP@JA&v2P(gcf1$HhiTGCitIxDw7Tjv@8LQ(yw@4jZ1$<*V!PJ_!-*q(b@7KeEToXw$(+G?^WX7o!(Y71bregS6 zZ{;h!kL0S*bV^YHmkK^EYg-I-O=Qjs2ao!7VyD1VjjOdpQr24YmWV9!HayXextQ6S zLAlS4HP5fsiY+-EBZIIm2(0<=?`%MEg}qlvK?IoX6s|rHtqD*fdeUCxrX4(cYT3yY zF(gDP^q~~dQpc*h`fA@Z?#+U5_iyb&ws1{0 z%?_S&WVZZt7mMwyn? z&$=isU|o}TGh*QDUs-}eN}7o=CW#15Kku$WPFoG}2PzndaS5xZo)xej#c`$4>c88K z-cW01Mv~U}L$&9P!Tb~4g9D(*{wToEee4|H=O6tOq^Rt`f?q5k&!>fJScg@F;X5*% zaiTBYqLi&Ry%g~7+GZjnOT=Ehy4VT&c8oIDQ6E5a@Pm*_yA)+0Woy|g-zkv~AJO2W zAIY{Z{rR8X_IB{Fd+b)B?ovWS-LN4(rrMcoIVFd`-$!KJhx?hlTCcz+1? zN>=$t2k@}I2eF2Ls<}4*osJ3W(6nD1uH|n4zR0RH<`goxUx=9)(*a3WT~ny_Fx#ObA|#ZZ14 z7gG~IkF=jrfQ=bOJf5X~(x@HF_jHA(iQ6)B!2I=T<0?CHxL@f%n? z1(ahFgz?@5iFr^S(uy9z zK$J?M0=G#IJ@$L-4LoR2r^gQOq8!>pVQI5r{10tCxXH|LZyEW_h;Qwi-6V|;7y1sHR)VGw_ZlGiNQ zd*y%6_ux`Ln+SFuRqN>jVe$??+7@&0WG$}82N@D&wqaIGV6>vpAa?fbxdp!6#a{Jf z&=7}mv#Id78Y}4QGCv!+eV9afW{e#$RNzsD;0JF9k9M0R)+B^P*h70~S1Htf*`wiw zKSeTDqrKTt-_$x+i9j)ih5+T7*{Zk37w9oj$|r!S>%uD)mKPVbcF*D8TwHTV8rMi% z`C1RrTn>Xa(wkA5K+dm?hz+M$d=E370A}Nn6{malhBmUr{*^yHdWWAMjS;VE`m4$0 zl49{CMuY}8Wle8zo+SH`5haf0$1AbHIQV0AWSl2+y$Vv@{B#W>Qb-KqAQH9w;B*N` zc%0Q(&8UDn;U?y}?KEzpZ~@F}=H}QO^}4M+TPJy@N}&My#&|BBsg^`Gf8! z#K;t6D zb=%?FxoaDpsR)!K#l#QmN$Gr=fp>KxkEqWwTNOP1j+>NSF*1Ca3miHhv<8(AaS@Yk zW4XM$3{hXfJfK^r=wAio!-bk-xje=4w}`v#%v23FWhR3ae;gYMX6+$CC7rSsu2tMDe?i$(i=TwiI<``9sBI&O=N_O zt%!IJg=+#@9N= z*yM=$FBpp%rXQ>}^Urq?-Gx<|Fwt*(A_2+2?jBa_*FO~bqmO&Hy&x5CEM#KzcK2KO zq^@F(SkPn%(W{-o#BkgJ8RPxyoVX5YZHl1R3(X8b6@hK|B#}r-%}cLvyXfeJBC-t& z7sEtP$qx?v-x59FXZDPYNEXZ3Nr9Q?LXg3RL=vl%-!A3Gcj3nlEt1x9@A;UDDl^}% z$k|qo+U6_Y&xN!HrW( za~PX$JGXG8qym%Zdp{d_k*2duu6o)gAvGZ@TdAH-iS8c)4aG7=_AF+E-lR_)H!I@B z*o+^LO*Pk6irg~~_*Dxzx+9c9WT_C0i%eMl0$en3n-7#b9C-t>mP09~{8xi`}X6np9@9W^o2{D>{O z^XjdEvEiXI`x9nwEQLlYvD0(ch0*$q{e-5sj}(>OOYenlvc0=(z~AEaOL?A0M}(s_ zYdCe1?nK?Eg+0^E{0>tOljB~J)sqidh^}$5TQ%B|A>I=D_k&l2F=!X^Z@k$Bnq9+u zc7lmc?C8Ae_~$>%l3X}sT68nA>rO)mz!H{DQEuC%qX};0k7t|3W+(?(J|1mi{jD?oZAT8s$AX|jZ@WSC$ z8lR`+)A31n2-bzHBseb8w16Xk#-L&?N1|>oI3a#Q^Li8@#O=o(4E{9f%4uDB=bR)z zN-Iphumx91Qo!OYky>mulh|MU`P3H9vC{d59vNJ1RP_gyTh16FXXpPFgxLz3tu%M* zpN_hB|9pkkDwwzVJ-?F5=n??T_0#@BjJ=%$ta|VBsmCZkzj*UGMhih{aHEkmlYzwo zoiXJpg;QRzP00 z@dG3Bq`^pRg)>KwMTn1P?5Gs%Q#sqSXAzH+-l8!+X?xUg%NTw~v?U>bFi}#P{ib$B z1%q9KTd2c^COl>}G}akjC%a_Z44P!Rj1x|KA)j=Sy8-rfP1DnzZ82Vz)*vGRa(z1& zOQwjYq{CAcr<7$LZ(Q+)lu2mp4+M4m^!6v*n0&ArW}eFk#;X`*@WMeN1%`>&km@^G zPV0iq)>^a>oMdh?gpV81v_$wu}sxZC6A4K#}jcm79O-&%)M*K zp%D$^dT_I*>P%iQSP0i`<%Bm8zfcPrcTh=>5x|m)*}X8)AdE=e8U|8uJPpM4{Pz7N zHA`GyWV0Jyd>_c1T-8{+_K~O{rZlJADkmRcIu8Cq=STj|d35dT$A4wpCX2Zt?+A4l zakYz!Gt}Y~1Tq@i;BhK?weRLE;ss8TkmN^>G&E4?DVF-xD*jVau6185O-%A4mHC;z zij&wm6&BHvl^QUH+>p%Bhi+O)LgH+Z%jj7u{-IY6040GZ!tOiY&$qJyt?Ca22Wix!05 zI9pi#?52$_jeX7fLLeWZ5Oo@38?e&nhJq7YHin_RX1$y{uk2 zAa9ehBZ^?%7?MmieN6YdVB{ga+fInK$Hb*GiGnKP-lc^8UhlEYGG78!ex-l}V|aDj z>Z`C_a5Xt2+q6izSwv%hKx+LbprHXnWDjnyGKAM0H?j;)X z;?qP;m5apC0UJN>+JFZ&UW>XvCOfeLi|!KXbW508_C12)3N(YvtU3%52pI#!!$GMFKArp58B)7K1EF7gcV3z}NE znMZ#xGYM_y>)&IfleE?v$-V4a&rCF@G4NDFP<4F3Ua3UQmxfC34htch~B2-?O_ZqQR5o#w?!6OXseryLIsOol7 zoIHPjWvYdiSLZh=^H>=!WXyH(EHdvveW`d#vo+ zJ>}emKYoSykPGt&@ri0Lz5j)%GNKw@c7MW!*!=yA_Q`v(Y6NJIEL#3SYi7CHBQ}?6 zZ91#2ZGn5S>|+BD2o#(CVL7VvIN;fMEd(LFDEC;qT-zg_3*t^X==8JQ92W*A5=q1$ z9Ow5e^l+;^_A}|olX^}bTXAJnwY3ttzJZA zY^u-152%U4CRGVM+jLImB){mDuc6M}lZOEavC+8H^a2c5!R49rW9#~#>1jn6?kPV> zGgKX3HoG?NnLf15@aPQ zd8<+$#(Z`|(pu0wI`N~n_=Km98F@HK9Y4R=nFtFfZy8o%wI%h(;U&ZJ7VQpwM!FtL zBPBH+Q=!LiVw@}(1vnlNL*_|_D#xvh^3%c`-iJYmRP$RGs~7(i3mp7LiM&NuTuok*(5=LJZssIF#~MegAE<5Fm zC;7g9bk#b}85}nnu<&1x{&%%^{lovqIa&$%xfw+TwRY0?HygSos_om6eQ|9;VOQu_ zE(U1Vb|QK^pKaU52@l&)+bBSL2R*}XnbeD zbo}Nx_>|(=DFxa%)N{E%e;Om+j)6uM0SEO%C;b%K8%AN5MyCgjVG5p&`UC^T>YKWLHd_cj3sw2z(dgmWUDy+_ccMA z8v$nDoIP4iZl>hgu8ZP8JK_!Yi_o4q@TX)EnpbGYLR`IyItA6exsUPM#uJ^Vuii%J-*g{)#kbd7mL>3EgK zC0>T55dWwQigecgr3`|>UR`Xi88{c*&4|`VbdZH4k_Xy;zBG}Mq@;U`XZFmoL4b|d zXo&E&)7pCk@f+=f0MC9d$&VO&mU06jmQXuYMQyq_+dAo9KaFFnyMO(2OnZLM&4@Mt z&)^kI9i*`AJK5A(&`H!JFxXFz7nzSY=;%qf!wnFAC4=BJ@7~EtDlmh^B-*@~z!?u| zNUolZ5nv`NuN)(Cwx;VV#*~}qLmepSvL=W0J-26R9tqkFc=L7;f1p@LWcCki@#R3# zPeRsXj<+LtYX5<3AP$Wxh`sk7{DV%bDp)8|lw;#P*1>V6&B1Vb&9AEhnEBdTuhE+@ z`-hxK?vipA2$a&Ms0ci6-51!_RJTW|(zdlN^wqJ4+2cw;KtrI(36I;0C#C7=4FdGl zoNKXjME{o_K%WHKw14SR;-XTg-i{a?Jzji1qVWZOfa?-%v*SNXw0uZiqYl^C>AkIE zn($=^9~P89(o~=de$`Sc*i=Kf_@=SbqX64;b zyqe709g-Hv5Y-2dDVw<+&fY!}Q}8t-`Uh~dC+7&0Ma^yv)s;H?u5+^THYFY^nauWRv`JHjdo>ExfnYZ^IF|LgzqMMAv=B(hAIgeLnHM*u2F!K)nVRCwJP} z3rckNoLo~f3=f}*Q*ooJh+Ahdx|YSj9Zl#z1R4s{q{XJ9`#Jv+pRv=#i)yGHpe{`v z>*TF)lXr}xm1dE4J|45Z>hkue#W~&Zj(`|U-@_NA6=5Nis^$D7Cz1KU(?FXL5MKP8 zFn}9$BuBmdhKOnq41BH*z}}t6om=w;(O`ccw*4~ykdAjn{C*PZymuRkLI*$!RnSi1 z`UQKgFIjz$z9Z8$<(UY+pxjB5)28a;h~iUPu8)XrXW-bMwN3gHZM-}Mq5}YA_Q$L4 zXOnGU?VS*$_fq*H@6Ug4IEjVdqry7Yw)tmN+vwArUIY=3k+r3Xtkt@r!)vxo<5;?HLZJFS3}iG6|;an?k-^04k#j=i-ftolgyavdl-KnwKXk4WSR z;`fYs-uon?(CeN2X8>xt8G^n2uNs74i=&u&2zhNsF`S-wc9X%pCw)(^Te~U#{gunp z{gsSmUw(*Lu3T*x|Mh}xF{4MSi@U;Twwj*dts^C}!%5W5x(s?S=8H+N|oe9o14CBG?#I_us9F&G;M%zGH;~ICq1lR5& z9yhD9^j7%?Ih9yj@GIWTiRJ~Y>Yolo zWnFy~8ybuKK6tR(K$tQIA`0So&}mq_WDbzJ61Y5k60BxMR1y=xaXEN8D-dQ!=60$Y z!8$W?CSinyJ`#ayH@h(Gq?qBiWE?#?3@nmWyLd{Xa!R`>Qu!&}qzThNozK5ZEGu1l z4v|7RAm6N6PMMiR!-1oF4F+4%6HIkC3l|43{<m|OolO5rpX{;w-PEQ|mSTkt`46DcY9z|qR)bDwgQ4PbIVW9dGp_PcJ* zAM^}3@ZA10U#(mF0UQp;MCZUyHZ}l223e7{hHRyYX{$NJggrROkTvl76J>IirpRPW zb?m2vhwp@pQ8-U~-Nf%pKp~zbvV6G}jhNP}zH>?&K&{%$k=gK639WOk(=4@uYW>{J z;d-Y!lW!G|X_&7%CX8b+e2GOj7{5WQSxfp$hGq<4e^5dIpSwbu+?b|5#-QnaA{PYxyc1C2_-pvg|Cv?!#zmD~{k4PepkZ?0_qdv*;jj#KA(0;6k1*W-zQz%|Bl`2;6s~*X>eEt#&5lN-O zgVDOr0MN>uxUx$Cx%x^8W|phyEnXT`{KPsefSBrHxYS{w!ejxV`2sK>KfkLDgWfu311-QMMe;;p2T zPTl@IcF_tO4g1*rI&rGu&xevfR-0lTQbuUIzsf8)NKtn>WlrCGv3bl@o{q(->Yc21 zkGIE-!3jwgA(bevXjU8$>bEza3y5e#B{P(8lV%9OYZDa#p=cN&b9YXB*8hDFML8GP2i5V&k{z|A#hGR>*pa7Nru(Z1!=*mHx zLvdtPqIcUHBC#T(L};JP%c7AeLev&qG|Lsb^?7{r`5#p!H{{#g=&YF!ne~wGaTo)! z+(HI~??uf-lxeANC3`qo>^pCqS0yiUXus(@;z+-;XT6`#iiY9nr2)&SjhN6Byk1xQ zLGOflyRaS?)MRCaKbT`ZDOP>FCwweZLiHPb*10nC&vBW{MXsY!#~l7BIoA7D?#MxP zChF{2<@WgI3Q&*-bdzAg-IQ+1Zw+2LQrD6H4}GF;oVvlDbY}EwDn2eT(FUEKXVG#L z`IF>AMLMi=xM9QoY(M9~moXj<`N=M<&ZKePL~?RbI|rY91L0?AVor+wwz?)y!O;iK zoJQtd{2%cu<_*B6lj#zSkGSDTM|L>~#{#85rRFeQMZSqR2gDnS)7^(X1>DvTR=NzT z2wJNK%J#+l#^0%#lz25-4WS%q@+Fqb-{kG{O<_=ddNRcm_Lt6!X6A6R#bCF0a3MY4 zvX*(z@XSmJrVgd&tTmpyTrXM(;@i1&9Q{g}zz84Lqh}C;sxbDfKiAeEZQ77d;Oy

    nSc{P-P2)EnT+k=Xj#LeQG;`@3HjAq4;L1-Mp1 z$)SZCz>Q1IZ?XOqlb>?WI#h6#SmDx{PZ4MS##AlHkEVVWrX4>J!$n0*!-k^!U8~+e zA;>&7SQ4C=tP?p1!sXw^%-7J^F6BZ#us+CGda8qo@P4CV5OGldo0S>VD~SreO!3j} zv7SWyX$B@ZOsjEkth#mx4DkCLJ6~1qkAsh(#3U%z88$m>P*p;FATW7A%Z>!WJxuu( z-`x<_`sfKmxUWN48e3ZuDmHRlV}UE}=WM7>IsRL5f`=3M?U3FR6|TJ&G7=Vf0rl== z_upvz``EJ!mr%{X@cl-+zVGaeYw_yBAG^0-q+I9_eoW7Pu1$61TvG}7j3aK({SpVt z(83jL&ojrCHL6whQ=!7Sk%0RxdxtG^(R5UltdF$YlAenmr=C128fiJ}l4J1^UTu`b zmmc|TF7vQmu1xoz>3ZQfRr2zrdl0KQIKl<_LUUo#sTLSd<>bDNhCc^btTl3Gi|_|l zG;$xE)mA4{2YTyJw`FPgzKj#QM5JZ~bQ;g{Ipe)ngGdy)VAY(b2ZSY}9zKr3eN@7) zRlry%nh-`3+*?Y58`5B^+>X4H?88)ZuIXtf@MSC5UaVARG$E@ zqNC!xa?rNx#7)0solD2iI1I<Cbpy(cyZ+ zYN##Sz{NjqbWfOmcU-92o3t6@*sAuxHmr?!RFOup1KaZk+=NPU1=N z2UhX>>4a^}PhJTBk!%15SJ!O$DRIDR;LFqD4=fN^<@$#dfn4Z~i%zR=y_~mdRPSdR z1hD-Qjjt6`e`IdDdV@(cOXFTiUnYOPQMX2V^OBWvZlS;l$KzOw2rL)4u_8ofaK1|! zqEHM@a=&;N_8Dj2Jw!hq{X!4qJ8Ga}OGBu#_?s^so`i}>m=9dDpHC)(i^*AHS|IAy zq)(UKmv>@~uk1Qn-^_!aPbh7Uc|eXUhVk0KKF*c=?tVf4Kzl#vDT2`0o z7z=4!E*Q(yThp=n_=S;GQkjb{e3xV!GOQOT59*n8n};YoccrS-(LIW}mAuo2^sU|& zdcJjZ#Esw)a4U6T8>X`7!5E~A#K+{ccGs{NK58@Sbd7C4=^BC&3+o&quv$m`S^mQ+ zeij7`y8`w;bomIJ{9iZytTMziDH?+9e<<@0?7jYc-MRxXUk7diU^m}9K~zgRBFPM8ulxM)1d4J1;cu79r!Ef) z#h8)1G_II6|6-()u{$68b6*fTmBSNmhJ7IVg<)8*GRbNYL<5doLEuaQ$5JO-BM8FU zf9EMV{2WECYTDK%C|9YmR)D8|L6~|f-YpdXHAu3(gMGs78TE}0+8mK>yUB}s1nG{d zu#;Z4hbjIw{Ar+!MT{UqsTJRKy6!R{74glPBxm&KLR8E7=j3keUOs$089j}l{Z?+d z7#)JIlO9hDh2W$SjN)Y{4I`w|gCh4U2P#e7mg`ensY(K3#iX7i$-Qa1iD5UUs z5X;$f1G2eM|5|)4_$F&ILTNHGj5kkx5Eu~9D@F#-PuHcsFCoMZ&dE1vnCbX{W0C{6 z*TqbQQCz?*lm?~~zeS1^i@zjC%PidewQZDoxGT@-mRCpi>s(WmeoAfWdcAS210dmu zl#$R#38)#-h-LSc#Fegm8Tc;95+u@QqG%!&DJivT*rAE!MU0T+;;^&9srvSau<@?d zZ*t&C=48>8E$5(i{P(X)OCdab)yrSoZ5+{laL$=>V)gxgPSTV&e$R166kjLRN5g2j z4)007{VdEQ#{J|9C0(J4b?**!W zi(jL%^#81K4`|qu_AyIQBrTt8E;~3@?@G$)H?)bI5T)VqU*TqMY$M8)kfMY8lPH>( zP1eX-JnEDZ6Az^GM1CicX12%OfA)~VAse=(rZEL==mQ5pzsVavY(O#qUfux-vV7-t zyGIw5@BPu0Q>*rizq`EaH0eD*U`21MC0 zt8ng0_UcQo*`xPs1_lPNN#FGl0IRq9-38&lN56x5{+pH1{j0A}ZJ(YNJ|Thr4KS-@ z@48?Q;x#%fq5v$_^Y9Q`X6Wf^u^2eOH2-qgpVPYWdB?OlC;m^;BSuH%b;Lcq4R9t9cK=x zpCD6*qU{(gEjIlk#xW+vNd7H924+&RB9nnt1~r~Ek(Tf^9mH}`4dq3mF0Z=&Q2)B0 z=axq(t{yDrY!R2`Mn2gS)a?xb=H z*Y`t_O8z4rEW8m~OLieSRAvxo?$kU!M?>&?Z}k9p}n;qg^x&z;=1>OqMle)y95 zlBEklw&rR{feMnGbbOqW3m|$rk@yt!KR)!31jdiUX4|BtRYhX1pM&|3t*s9T+SOv< zPk$bJyD(9aIaH(F&~4HmAb^O8eFwk*#a#Za{0H_ z)FkAIcx<|h&A4gEa?ZfN`AFgThd0yv!iAR_YcIxA}X^j zAX{{g_ReGuY14w-BT^R$PUIL!-#8Xyx_zKa$7f|TC7q9*6?J6oLg|LijVr+5*j8e+ zxzA)_dHGKZJp))|uBwPtDT=ZS2*Luw8#rH}%3=aCyD8&bUPBX;*7k806t_!pVFztN z@&iQ!NhP&X8%gJ#bRV2aqn7yUQREWd^?dG4ZC@&F^2X#KSs}LJ{`zmzWcS*7)Yf;>2|Aql(Y7 zpMEQY`TT?03z z+eJ|Cn2`@~O2q7^T(^d9W^d}TyG9;5JUmmitqS~@IAg7(u=ko@h?|WnXJE{HQGVn zT}@)n=Fl6I7>)g*dt!kExlS{-pS>XMf%&XyQUo?z%a2X$-?mx1r=7f)aDw+*`PFt;S=Z=tH3TU&_5e# zsb!j@p{*=wvUgOy3=YP3mvh7UL-eQDd-dVh?pQpDeN|>7&A?kB)>Hu=T2yLj$XI#1A$he?5Rh!;s4tF3F7>K@kzn zp1IHJ!6P`27sQ+P(Aw*QIXOmv2At{;(;dtLBrT_)aH z!nIw)TTTZgjP6@~3wy;lYjAu?78IYL4eDKBbm|*}fLhjRzIgWxIwi!!hyl(rpUytO zTqfqZ5qA-TJ|HOz1oODEU+SetA`F4aDJZDJgNTj&aA$d^`K&kn!3t~5@I8ZrSVqL^ z%E3oPCu9i;-zw5-&Xw87Q5(S+@OZbxf{VF39I<-3USzdVY$=YO?VUsK4Lg0lAUCv| zZV4%;Ult`32d%bMy#XOKGy}ncPOTAVz<&|D6Z#a8kcy`eEsLi;Lis}nW2XWOKn;=} zUFjd}`E*(-NSiJtRMl{V(J&6?_L0O`v54Zk10NI_y7(47PTl35&e_G_PPkYX=Xgo8 zsOQsTyCvpd1CwX3jFgnQO+)q)A*8K#+51mM)BSBKlwzLj>3I&AK-%fUAA2M=#o-4M3Y_Pmor3EnZcn zezC$ROV#qDK2TA{eMyKy_Hoqj2bhqM$*W(#oCM|~lrm9iK6e-q&$$dVampy-x^7f>%5Dh7NI_Jq zF)KZSV<+<`c!6H$x~Uzm0+m)BYe@H>s`q_(W`YWF%%er++Y%*3aeB1bl4h~<=xr^b zCS94cJ!XSiQ4p{BknPmtkOsPeF257IbCP~Ap@4BscIIDcf*$*f2iHy)yKSt*(~H&(K0rXkd%wP9}bm*qfCJ-Jd1t(VM=h z%q6JU78Lqq9DI`YwULc7qX>ZhzOuX{knjXQB_?9J54~$NsSdJU+oY2NL@O?kR>bq(-}>v_ zZyrX+SScVcK~8A6Z+Dp3_!fT1c3?imUbbL&Bq)inayFIo4s}?;0C7EqWQSt{(*nbk z4fc|8%cNxOQHIx}E6&4xXj`jo4w4iL&S^eD|4>b7v}o3>r|Ad6M`umh$&_ePJH%Hv zgBb6ugU_~OIJS=;9mG{-di<2|<&mk}*b&29!~a?pTQ27e7CJ$3J`4&=h@?*%T!%@A z6Bbo3?Q+oeSJbTmY)SAC__NUf@4H8GI%Hom0D^7NlNxjx6GLH6j4Ly>gk>Lxhd-bb z(5%NJMKf`M5*HPt9U&gDR=jXy1eou`o$+JzWevsFeA5GuB%$00$G6NPvYp~NeVr) z<~B9z(eJQkdibX`wkn{J{#c-42*66TZ36UGL8VqLR-s5i@*}vTW#uW)^$Z?e*Z|^b)gbo zt_NZ6i!A;iflq6)O8AbEy+I&FJ@sncq3JRXk4~aG<-Koic|Ec?x&Q$z%xyY!UbX5n zimD&-rs$C-v2bT82BWR7~M_qO#)cpiX3J8^V0ot^TLoi#{aU= z_Ym}S0-wp#N^uaor!wyQ1369dQOVmAkAdn#lqB;HCn4*#)G|@(+lpU_JA#{+*Gylm z%lJxuf7GI&LXyN#7g!QfFJ?uLSp|Qqc+>Y~>6^PzLJm*!ecRb=h44resKyY@nhfgp z-7E<<5|&I98q-(bP@27D5sstvH_=VU^OZfyVg3-VrjljKkel+kxSSa^zqhTD*C2~= zFBHd^EW{>`|2UkS{>Ks#sN+#-N$J02-XtzGi=H8 z+1Qs<9xf=RKYx&$|Rm$J-1bI zkZh&uX0vWRe^)$oW+RCubeQ*@zMALw7YVUWOmIl?Uwv&!*O!4#cq(pXs2sY6ZK`da z1=C#Wwp#|FL^EA&(8{@A&AsZaG|mCKhUOdb?(m%7t2MMpW2-H>i#@4mWxSPWb)!6H zl5y?|adpN2EN@)8us$2+kG$*=4?!CnBfayG`#GE$Ri}-S!qkipQz6m(ReEUt>WqCWkvd{+p$N9fq;j z7P{`0m{ach%v1JOI0Kw9Qt2CA;-H01i-;`igUB3YU4$#*T|-!tUc0@@LaOG(h!6AnaJ&7_uUd*`$r25 zog+e@02tegkg)iW$@9Jd4WbV=SwKR%#=%{kse)W3W;|K;%QP=O=tW^_lB777g&mL; z%c>dq=3|bYX!h-lPpwC5?bh`#$H$|w*kMgI1Dp;fb)v5UA_BMQ}j-i;4di(EE z3lh16iAHo;%aT~H%5ufCpP^^^#7F6Em*SOSJ%a!{OzF@!+A5OF?7Gct-dq=z0~q0>XX`(Ym-c5?Hi&cTdQ}oQe*& z9CjcD)w_{d7XmmnPYyp}2-Nk00tkV!c?>;o!%!i>+|pzK$N}XlMUA(g2hPe(RM@yX zf_?h%A+?Ytr^VCt9RRs%^!g5Ft!A);8QZq2wYdL*0PluPr`q_Yy@=eTYv=2tWp}yH z_tY_U68JAO?%m!OM7R!K@u)p3H@Q_)a)htp2U*5lzy$MBSa4C2f$K6qbIzf~M$SJ_`S0K z?*&MuAvsSwqS0m|YfygGR@5`zS(l0joE8;_M{`O zxK3t2&zUcIN-}-PjcLu+{n++G?TV5q+IsM|UI*08`vmE-KJFgNH6e79-hNha=Et%- zE`&c$zy-Q>dCAXw^Kawf%^!1m7hZq<)nvn&iffh*{vvIEVm4Yz(hUx8Vs!$zNm6PE zTUQ8uO0XscB8tmBR-t z;`YuTZIKq!R-N#%X6Fc}+Y_2OhC&Mgzmf@PpFoxQVTz1Jk+!5~%H5YgZ%6YVUvtIp ze9eIY2R)9fv$&V}7Z>N87qmDT*}f0X|8x_V>&%4z6{35lr*YSBhXl6g>jU_BAZ@mp z=-koV_F+$~N=M72Xaby-qY~1aT1*ums?&&gG%UejjDA(U8F8-~9eX6tqc0SH{0rn` z+!TT6MMp1I1l08u%&mY{1gbEmBot870C7XCq>M&_a(`M6q%7=%BPIkz*Pie*finC3 zc!Bq6qVzgD>-DXhrJGG{FR=PI$;-18E|DjDTKfE=A?6e}zbZ1E?Gqe1z|DHlH)tWn zhEbLce-PD@%#6q`pb8F7yn?GI+#!bn1dbuFiw*V|J75g zt~vSuf+4t$qMd*E<}QQqXje-WY<-&CHOYn+G{lam3MWN-yh{YZ<(hn5?BRj9G!{ye z+{1YciL(5~{61ju>_F2>bOP6!qTO7Li@_t(@=57HdH_^^;pwC$V5*j_f^yxW$)BSy|tS#YH37?D}w>=J(JA3 zp8tB!hFI+9)jA>VC6rrsM8;9^RLFa&{^bVadV)8On17zty&R*t4B>ePp$XWU?T*Cl z=s5t!Wo)v}@KuwxgYFeYeXEM$X4%-3m0Ws3XjgGup~zmiREOYy=?Xy1MM z@B;B!PuRmwb?7h?#3!)ad!cRa_T>gpKj*Z9E0nAF_1n8-Mv+#EF}VfIkPy@4IkI-0 zgvG3W9+fr|^>Y@OTv^hJeWarRixX43eAE$1`ia2z%HE#SNA;q!bO`6y`*Jf=npXz; z-@@x)o43EBdyVuN!j>A}_(%HiTyTBW0HMduM*j6E9^OBG3`n{f(Je^N?3g0G?E<$9 zz0-k<#jMq9BUn=6FVA}Kh?z2B<$GKhE8Fn1nXQh8D2{BOqMkwe8?OB(V8sXae=+NU zzBa7|9%TDn@^FDsNUFvc6T^^7vSha;l&3K+J=~ND^`jJ;elml#5C-5f*{jbg z1LJ8ZVVcQHt0<*s;83q2LNlaq+no*~mN!kJ;C@8%jdR8Yq z;=nX4VfjTNwdQ*!E?l#3eD$@qoyzt? zf8A;!hYyrHvJbC@zNH?6;gcX8o(+SHdaUK4#KvB5Pj+$I-O}tNi* zxw}~g3yU{_N#~6KykCk;I51|RyCtHBFW}m=$Ba*C)oN`CcOkb;K%#n=9<0#p+)?1q z@M}_8Oc~<5=&t3aTP0vE5Lz%WGhby*Bi)}$-?aTn%>{7z_n5>B+Y@CBp#qc~C48VK zMm!{=F}N@=(AX|mwqWgtd-Q}) z958zEZSL{7Y_hgdsriH%7}`Z=3#E}BBc>YIF29hbhL;TxomYCIR4z)t-e z)()zs+8eAkOF<$%Fzqz96m$C-XhT}i~e{RZU|iSfyEt5w^ng(igZo6t!%MQ zBR1i6}Kq{Kgm}q#SNQ|EXWNuSNs0H zRZRavf0{EEAOCgDHI;b@#A*FO^Y44ag17eFIPljGaQ+*!T!@oSLU}^xvP~Hp+y2b< zc7m$N=}-WxZON)1f_F_`Ed|5Jp^g~EZYm>#WmfQ|V1%oLQr>x**|!L%U=%TMNAV#K zO-g6b?`9(Btcmw~v=kK)&`VAV?U0mpJ-pGAiO+|MxSBE&=2=9A0(l&5T!=6( zI@j0BZma4W_>G0yG#6w+b+{5S(gbBUzM9;`xX0dgdd?gx+wEOP?We)mexONzAUWa6 z-y|gJz+P4FEjVwDM7YkjmhZdA)o$`m+#F>SmRdqcT}0$$jhj*`;K9fjO+?4q`6#Ay z<2Rct9{Tm~DX4DacgTMVef_G}(~(KSr~9%O3}7eeAMy4_K-iT}$Vz#um!^(-Pr9}? zYbU%N9PCW0>iin;n%H|aXdYDF@^R|oy$MD==X8M$sH&YN-N1X6wb zHF8;zu3Rg!JbKx+sRqX<9Fd%6LJtwFCtL{N z4q5E0ZER;Y@U6qguD#MJX!Y$Q7nrG5KIDKn_aTPCf^}f>GvDG9(sKpb=Z5azo9>4%Kz++e1fiMnv38=96G| zMhtQ@){eB9LF~xMRD1_t9z-b_S7cj6AIc>kTo*o6hiIITpTkNn&t5||vOkg9XX+dh zJUrlpQ#WCX988Sg#wplnolD5rSCAKsWp~`8zsp-lH0HvK9JvFhVtBEC(;PbuCWVKuS+XP4#a~%Atm233$RCx35S3_M zcCa4sv*%*$@^pBfLW}N%Qh*S%u`^+XPik(=XZL@WqQ4zJ5i|f;o~tT_v7!-X6}+J5 z8b%O`VsXtPPGpM)%ibTnL?Vb#nLQbC>bfr?(lAC1q3?SH?R8;z^UBI&FhMKh$1dX{ z2ZpdvL*hpLz1S)JEyF1}7y5$nU#T;f6k*qAI}eFMB0D@Y(Q zfJnLvK!W|kOWKbMN}PGYbr)xvrNK=s%N#MQ+B$$XaYv+qAccAXpY+k4-K?R4ACFAv znzXfXDWz}N>r9-udn0=ewsF$YOu1A#h<+k=y}~{+nb9`a|O$RzaBD9$XuqD zSINQZ(k4)nB(hc`;xtaJwkVZ2{o&nEjNuZTe!XlVVni6hEr*|p9lrS@H|3DqIL=z2 zi(leU^LLpNCZhkg%g(W?VUNoOI?~)uA zTSQc8qG#1bnK=2Kc}H_6jwm&6E3GSVzZYB4AcHk-V5gRk`{D&HaKprEw>sz{;bBN@ zCg@H@=$mpd)IDT+qqQZDBmU)D5vmr?kn|g-r^W*DGKq2~di9-#_6>&;E0} z``xMA50;BxG3Dgv@7x5w+?=g#Jgo_~`DkzKMD?D4!_+KOzyHv~_g1>bRmMx{;Mk8W zsoGuY3)&V;j&_6m*}|M(M&u=Q-w+a^rHbrwlRl>To1N)Lc>5hX$#E&R2EP57sZ*^H zlT7>&Pq2~)N2OP2?d~*x^Q&ig@ejs6((Ab>Q;2cWj{ag}oKOhSI z-2ze1j73j45x3DpnF!>=#-EKN#_zvcBY=*L z`+ZY~7OwgQiv%c4j=Uw1P(mm$CGJ4qOg_&n<0I&g(JSo)b&HIm?sj*Ps9XyV>H8du_ z7M0LsZ|UYi{!nMAUZDSHv5`P*Vcd6eXcsaNpS0W!BLgm=azZRdXQZu&>sDOEB3;8>f~^r{CI&^ERZ)a6 zXvck)eP4QhS!x8aWs-TlNqv?di_T}*&rO7a$V2$bhn~&{>Q;p@(w4%k1hhT85>Gh zY-+@Me+HHQg ziUG8<+Qj9==F7s0sm|cv*`oAgKGlbd!H<+yC4_4=28ugFWXRxSlv|;ig4$_Oi+8 zc^!hO8lu&Lj^LIV_W9OcaL&5uVExN|{m#zo7r}q_6lniou?Uc^xUvP;ajp7#;HUe* z&LZg5tC0ThAv?fs&@BsgM-=He#I$pL2HBo`D@TDz4^C12NOMT+sf$3Tsq)VQVRIp- z10+MYlj)r{6OMGGEDEC@`sc}>$h~9XJ0S#D85HUQZ7SliuMFDME0^Wt1t!vqSIZp? zWY52>riH7|u-^5qj4;n;isk;IF$&Uim*`m)B+`(njuS5?P?=R6clb7i#${(A70~Kp zKL}dov14X3U{-nlF5gjcqNum6Rz3e^=phqG4oa1u2pN|Xmm{8%?}mM7xpRu?Xx3Ll zBUH0oTPxHZYoyio*F4Qh-5?x7Eagav&YvsVrh*ec7$RHIN2|(qjEr;e3CZ|a2fkCknUa9l*&qI(w*AJcYW#gNP z(}KwAHW(_=N&B?~mLM&-<=bT|C&YS^8v8z$UYdk&I=c>O?(a<)y^0pi)=idDu=f zj=j>KD762?j#RB(j=85HI}e>qgOo__`)V7=Rr=LAAVun^lWiWW>}zP_Yye|qDAZ{i zoueZ%g=M&;%RQcryz*_!1~#JW#RV3!g;8-hV^2__eH9pgFKDUIpo`t@*=au9JozSy zZeCHB_wBIDOgN6$yJl#iXP&m~+k>qpl4B%Eq$M4RDvg4L@lYIvDoW$wD8X0sz1rV~ zS}?>#e#F3(j z5F^*_%CtF-mPO9xB{+<5GgH1yxxMfzVP;;}r3yb2H>M8aGrt55>qsJkRNy5&OraM| zSwzpp=V}j~a~OLYgzB-9F^d+Kex(7!vey3kGG!8ext*{ z=q>F7#WTCDABjEg1Dii~{f2ZX2%`gN7&^YD+&%AgA>b(Ql_ADu&dEx^G8E~C*)Xlt zKeFZT{50WD;j-GMt@ZYQud~&@CV5>m^WBjUe?!><1AYbh=vn@nG$^^XqLNK=`-=^# z`dpJEH>@&LR%QY^9;yIsveNhsEa^FWW52;dl@%|7+`bAteRYQ3efs_^bJA}=!Ep9J zX(46!Vp1Xjhzr~P7m4sZwBaQJC=GSR{4~#>{mT)LQt>*LUJP8^zATgdOmvqw{Q8Cl zs*gSwU1?QieMCM=1N%MFHeJi7AukdEET=92?unoryoGGc+N6cTBh)1z96hoU%FUE~ zZA|xp9$vOaM-0I?ei2)5kp*_4#|Ayh%G4c4)bmJtkQflqL1X~9J^vy)2EYWasQH5%_`8>D02oYNZ>i(a#6IczA1A!O= zd$KSNjf95a6qtZLtfB&hX=!a85MM+)^9VyL@yQ`fjFOMMJnDqcFtti?@T3B?#z zzNB<?htoSLLwOn z^kYF6q2Dh5KBMJg?J-&Wn>p(zmrHi_!}F_Pi0-#SNn@n;e2h2t*&MIO*~~8L2T}Y_ zpfrVlao5oAr5R1hE>XxZU?mZYZAL$$u3 z*(oA)fdx~KgXh7Pvw++!VjaSVCI&PA4rxk zQGKXu8^J_Cf%c13*6vc(t}!@t{3ndbR5VY9gRK9wAF_%5kD#(XG+rFt$pTo=*wgp} zGy6vI2>CL95~g#MhoUqBJL;OCjM~~sw-FNc#!SyoO}#zv7z#)&jAsHIgWJKFq?bgf z=IJ>?kU0hph)U~U1@r86d}@)TGKHQb{2Ypdyz3s^W{m@_ot8X(_8A^3_R|Or6jw-u z0_v#;1AbILZ98Mn&t~%*q21?`(MYw`uY>r^yDo;-HJ~sBy@ncuWNwOCxI?u7?6}ia z-4~7@5I}^y^hBOIPXA}M9?Ae#bsTsvhpb=Fhhy=FQ~5ca^ilHC_0*-vnZItmf$R?= zGT+{A@)+=k;F?&HD2fUTwX9BlFoMY8D?I3{%_#%AxQl0*$eH`04g2Ru=Y8P6xCf{) z4Fwv(wXd)<;a48+c3#{!PxkZ_7n!cthn#Hq5CgDDh5dtvlE@Se*!F^`ld7=dAjDVO ziY&l)DKVV(4}Pah)*flOjR3^o$NqB;wt1()OBn=XP)h|P_*9{2`{@6^KT!Uf?;*LM zjud0D%nRB78)y3w@N*~zDm#Vn@hCR6$^t8+9*wv&_aTF8u%~$5QW=Wl`oh*+e4`%1 zgbvk{M|jS&I|I?e-%y+o!GjVgkJFE)ZbG_oKyg?iapw*QbN> zA3s{Px?Zox9^k@WcHbY}i21GjuQp$a_JUqTcb(oRKCm_)L!59HDDbpt>_D?xBcN5( zizSkEHxGwc0Xdu6fOxo@nUhYBb)6-Y5PSe<`2K1Gm?&F7BnB1Qt|i!pc*54`G*28s z3gk>WlmcgpXcO3pZjvTf-4yOd&4B+j!_Q53#oYrbFXpC3>mxsWPPnP| zOdi8;NO##ybhZC(Y)~FTSlJf=Ep2VQSoj2E?75-g>Q+tkh<|48Q@L*on3Qty{mG_n z{q-ja*0MR`<;~LiO($hPsd-oQ@x@Elix4CvDgy#kF`R=9xa^ZqXPJhEkLuIp02BOF z3!T`LiT@4-QcR7B?wJPupBF&ogj_L?@RncYnpxn`xz(W7BFP3vy3XtKO@)huW^|_S zX6N!nQlE)S^oh|=^OP(~TUJO^iIwnr!~GMqIXk#6$uOpxdjHMqX0{z9D81h5SAqlf z!jB9W_@YsgBHiX@nQmn0r)89sPd0@OKbeWDtX@DeDF9jo!Ub=3iYTbACDQ~n+*NCIzeG@iANS$hFApAhm}XYXP2BBL>Tks-m0Np z;aC8)De8?8uAFA$nsB?a-wGVRu|4IR3VRSO4fo0a$%>@5_!qO4caiZ5?i2y{qQ4N} z(u1TV&iwrHGI*of8(@d)L*-MsbfHz=KQbausPn+y5g8Ryc7gQ#Qh z0~79j>mi72^D?swI;t;a%A+txHkC(rWWI~1r5upD5cmM;3ZE)$iv07MX)L24-imYJ zsCJ@_o%F=gMfh#;1szDm4Jj7)i*gu)^umfJecXJsd9k&KZmbVoMK}ePscaht{KZDw z7~IV#aSQ7BIuwS8aT)S)nbYP_$W5!qT)$#6m!{qeR5a;_iu%^a4g)p?SE9YeLA^nh z5X>X^ukmt2;Csc~amnJ;L}yv4987K_(b3ka9!65)+6LnKcxb!yw(YhjEbx?rbM%X; zmFP90I)3{Juyjtpca;fSVog3<$15OFm>F7`N@Bw;8aTnvhoM>u*N{hpB$h02X>a?* zNlKFECgDk5S74`nt!K()*Kk{23N&RpJ|C|BJ0e#ksO=bpy-)#LPnzP(d~LQ;W3h!k z55VMc`hD}4n@vAQr_~Ea8``-jas2a$Sh5-PG~ydne?_Qd5hj%(j4hY6U#mftJk8^r zI9aIh2vnYwF>XX z4CBu3iQ$>1m#Q93ZuU?QKjxm-`6jwDPP6wOt~alKfYTqCy)h0KEc2;&#nq(%tI6Z^ zsKcXuewCIARMP7Pd+rmnJN)P_gVD{=V z_8KT#Pa5;|!Uj9;CPH20q?FC`i~B;VQ=V%BbhYP;o;udE(?`i@Ufkonnzj;SF1FR8 zwc|Cncow7c#v-nG0xvD`kXsjVrmS z|6+hAL@Mk{pF$?z?HqLi%Buk_YKY(N9lH?&8t)9KjkT9d53SEe4rL7mf%rhuRxc6% z$KXAXRNPvcZ`D9OR)0sA0E7_P%FL8F1iN|sW2w>{{*qD86mII+9R{l5Poi1V$enf5 zsufNdH2o17g^H#f$il{{S|h7iJU|Xja#W^X z-TMT+=DJOIP`s695T&sV`>4zs(t5TE@_-+zWUI_9%onDMG3?uyYKD2;{joD^YR)Nhh7M&BZGgz)-7@ce5uI#)syC- zz&_jQ^#{PKOBPCZ{O|P7`>9LNU$Tdxf{XIft^az=E^kCXR4#?jowi{&9}^&}qqWk) zji9#ZDPKcMez4J8XR9%D>6U-%Kaq(Q6M@5c7AJ4#H!)wlrl$iD(FE*BZX{?ZUQBz; zokC#M5jo43j<9MM_5Bgl%beqQ^HJ%Bd=`+}eh;bClL#;@Ks71Jh{jI-a zT;~gfC%noPTUjJPF@D4B0Vf}z&|ePT88d$3+#;^7sg5r{vsgY9rlRXCPnnQb{4ILn zn;UZPsXJV!QA3+n-z_+3QX1lM%ndji?y0tN2v9{_!ZbLN8lot2sP7YG^Hxpb`|8y~ z+c^bkz6>|TzZxWR%6e|uJUtibPc1yV*YX*pSsk^35RKHz%{muj=eD6dlyHaMH%RNO z+9GDG+#|DBetGIvrbW-O_uhjJpI^c4UyLaEVKSV?+Rc=50S2PRvYAy%r^*3U+mAu7 zUvkDMaesHGjdO=eWUaR_)9Qki|J}VMny(pB`*e}6X(bG&eBmvEf})};!A$TTd1w>- z@slUMA}&)w&7f$Luj{)IMyKdWBLbu;A}DKld2tt0zFU({O<+{%J6hDf@cqvk#8s!4 z?s9CJVf&mNjLD5%<-iE^UQKR}SoU$bPb|X$ZuD4rg!4+|Qu;QTa=$ZDD1XPdfa#$4>@c4kntw^Qfr7b36U7^z4gy=*Kc{|f;Ke-swpet zej59=df=by*G||-8*Vh(oTcrqArJJz6Pk#>Va#8cx5 zwHbcmUoCz5!vEDCKpzqt`5x1}cK&&Qg(M#y0mMnNhK}Byp39YONxm1CPsXo8j!sU{ z?B^{Hyl=i3Hc;@?VV!seS2zawEtSn%N8yDSkS=&{fH!f(S)%!~n^LPqK^xmgK+#P+33Yo~JsOcQpmJtKzV zAmTdtOGoRo1I}mA=WQrN3C?=)>4(8&nyGMe9VJ&N1MfpN~-cmFQ5=Jy^yUwFLm)uYU zqy4wKp^SqS1N03kT5qPE?)S&Jcj0ac)rL9fP;T4Z1t>jizcxiQ&hqk6oQ#839?+;w zoc>l5|K%sJni`6Vg?+`inwB;q-Dc$|RERRPFt&li&;2+ZgD|}s3ksnlu`#6aYm}>i(M>#<&Z^|?KZ)$Wz8-&q$v<0IHo=|QRuG9W&#WDcMy}G!fWCvujA@T z+nJqSw5PkX;?B7j&gv1aNCy*kedGKa3b1UG7QuxVw(^yOJ$MQw9}m3X`RGtjSy+x{ z8)IAvAstgJ1jU%f={@bU?0RR_R_CBeA`2NDL#A#0aWT{|XsRa1YZ16M5-{jQZcg`s5QhhXii;Ysd0XZ2a{(y)TAz{Nv!YY(rht04sy*~%; zxC^X4*cD=r{I-Z`E5A2b&u6o&^bsj=3GkqSLshGVXY~8spnjx;5knr26*sxLzs@9P;D<}p`95;4igv$hY#RyDX-x?(rg z)q*=z6z{5bXVhInhnHUL2**^ew{&w_5wi4nv^dhcn@cfzquRo65wm1MPXmJ z74hiZE`d->`$Zcm?_lg%7WLq+R|J@Y!;(8aPgqwfJG+)!^mp+ox?OZWMp1F>tEQU4XsoraStKfo@}@)s)jYn%sHPe;a=TSt-uz#>E?{$Q#B7Mb~jo z7xLzf@MhRh(x#-V`k5nqFdEg@opxhuRCJ85f+y3c$s0g8=2Kb#+<9W9O6&+i7qi_w zdcxs8RNU;$&24+vIDCQtX!cvQj##u2Xmx)Tn!we;`~Dw+U-oW@S~%yc>VDZhK7)+? zX)G;@+uMbJm^m2&QGJvcqEu7l!5s`jMRS{=hITdE5A#R*CQE2`B`U~I^Xw^p_sRs8 z8DM$bFGUIe!m!Q;_$I+xh1(=D5*s9C#N^>+ayI$rBb_aXz-R69XogB{+lvpyqjgqT zT$HcW{L1L0{?|*sUV&4k6tyqX6NR38n9(<*C=8<?g*OsyT#_t6FWMXlRR;a24dGAeU#l;tdS#pP90&=T#n=?83fS73fqXQs zl`m-mLflX5Q1NLe*~RM}%=u&Wvnw<*)MN<;Ur~4a6~NJ)uMeS2kUIHEXhJ4aP!I); zwaT2H+7mqC2tPrvXRfW_&Ifl}Ak$-iED;Ne-KufgnuKjdOC z#FDHu%Or-|P42p0$?oL=)_`f?{DF%A$)|7K(tp1xc91V=4PYrK>MU+B2^ym2cCfvY zSNpWTmB#K?edj42)mzn*{=0C#A*eB>*PKDhU>*wRQ?BPAle_rbhLT@;Rl4xkOdtjP zJF?)p;9d5mqsD)q>G37#;}4|tDDV{@LP!z~cKWz?8iI^>(Tf5;OhByIpf}?;rdLQo zC^^*DH?kM}Jw*{p&mmG{Gz#+Isk55bQMO&apc}qFCx;i1 zf7QAt@wru_)2WLJyEjqNc29s*@7vYK+tutBwrxnn38Q;ltL`fGR~tW_?OCiT;rSl- zSK)&hy-#If%zc3_!q&vJmQCqi09^JAzsa0^!x~iF#T=XoW_KEWRDiSDw)p$P-7LbQWTjU`tqNUc*G@huV zVCot?KxZ{rPV)nHJhI68>xH^kf;BN<3qEkJyWf{#Fa4(5^v!wd%9$@&$)yg05k-4r zR)6ri>84Hh%(FLgVF=VYilu@o}=bb8JwL=_vQ_TWa zGsJ-p7lws)!A5o@zt>vReTOU*BGAoWftw!>$-xP`6Fi)##h9E>fg%m< z$j=uf)Quby3R}qtg2NXkyL;RIlD9M6@|v%(n3+kWJ%#-Mc>gV8+iK6C6)ts_!a|Cu z<$&cmLRD1F&m0g2uvj{`2ES^AuI)fQ`;>m`FjKn{{6f2e9}K?jF4`-kf|;ayFs`~&qzda`!}C0Yw(k;)kW^m!omnKIt0Qv z_{ott*-Q5a%IIE(i-$+33@*FpFFD0t6S3hrE33a7Mwj_RN#j^uzhnEvnU_eQc_uV8 z5@e)%Aa4P{5Ud*?QTl{!Wea2qX@?=93@w&^OIAF)knAR>&pSZ2Rj#gozZtZ0#VSK; z3!^4TRwwx$?+yzq;jTNrgSjJ?T*eDZU3BP!RN{vYaeFKbLLOPWBVR?RN==NO5)qq1 z(>C+^i&7z1WCivKSmlkCrV_ngXp`IEhu7A%H7>nMATb6$+?L^zy;#x>>6~dlM3Iwc z8jIwX(qCIjFX?n4R;>q0A(0O@6(dfEW7aaqF@#E>$sh^l0m{?&C}=Jow<^@X3ll3N zqff{g2x#0&oH+Ny9Kdzx0K`l6j04E+-m`#_hKc zT527dtX2N*cCdvZ2O69YYo@LNHX~%SN2nvyVpjvJEOm@DXkPt$Vo|ACOp}iHP(ZfO8?do zyb8BshDGDYg5)SRL6lqE{*{F&TSg%rjV#ry*8j6dVNI|*OT4h2)nl^f=k>P0b&_ZO z04g}pB4gxnG$x{TqcT&33%Z_P(a*gBTXeG2PgFSE?{g;=wANO3aE&$9%G6F-jNg~+ zb@|{3crQtjm#g*=-a4JcbB{g>3QEJuw}fw$;2Zb+ig}Ox-xn2J|IvGH!MT~E40T1=s%h+>X#P_TYAY{*s@q-Q-$UZe4$xcAC+1Rdkb$8^^!-)V z4!x%Ho-kj?Cv?d;h~(pL^GWcrt>#4lD%gvYds)|`(l#K6FZF8LeydV=h}~JKK*kA9 z<3bn(B{HP%`f$q0xlKUNJ{aI3iKd?O`8|J8k>W36yU}8PAoHQ@V&z8tN zMfJlg?~-fJ^_FE(u?J63RAZ zp~|B9h^m~XyZn2~lATpn-sRcO<-fm(<68oMSjF!K%gaT@BgHkIdfHY_wl$jXAc&|9 z7l!RFZF-Y5X$b{ReOr93#<26itn}ctiwVtrGE`t_5jJKA#3W)|3+g&)C+oAFyBqEJ ziv11M`rEJdTahxBR5QAC!)Hf`v(eV9b;I15?Awvlr$aS^^en}sx#RFOtbAd=*qbMN zI2f?L!*KhM4CDHNdV)LgrFi{Z&O8s*fzM!r)s%}zK&my%#vfhE@Lx9JOkO0R0(CuO zLzjYv2P?K5B+I{7RSl(CUf;(gw!_*~C&tEoH4U+#-KH9?I^=N5492+8{*^%Hj1yklAA?=gbE`%UZ|%UaGd{ZPXt2K)6*YcV6SY~= z%M=Hs{pN3)y>afYSM{e*lhc>0VW*K4v=oBy?T5?e@j%u{fZ4dXTJa@A ze!5|SJas9YqI$ra(sDZL_!brF|3&1_qU^rI4)qYJv=ZQSbo-aV;{=J&!W)n^s(et&YkvJT<@M~P_NjdX{|aTk-jfif@mq>!sz^A&#e$1KDj@Gx}# z9~L@1(>U-yytCEj@mC-Hr2l-4yg=1LzL+;{aO%=tm_-SCpPYx^k!~-T7tq+rhe{9J za^?SWMIAP&g@$8-K*F+e>n0iR96{nc0>7Zy($k}<`HuydR}HnZe?-A+hu6}4Fwmk!;632pALtI58kTqVYtqeho~|<(*5+x->th{wz?@2 z5Q&VKfV~&8g71{*AlwyaB#xg8p&q5r)qC-n#UX~~1E@KIs%peSIi8v!r&{R9kc{ji z8r53d+?=kexJoon(PG*GA_JxQ;yet|xH)lEieP0nc-_91H;oF@)`=sE`mD2)Bzk^4 zcFKF3{CZ)Wu!d5t12c7?{@NHZ!vGpv)(r>}nv`XHSi2h*VvEt4*q?@CVrN+V+P6_? zF|dZNu=fP<@#-_(5~!BSJA3804PS!HQ=_kC_@Zry<+Ct}G(Bu$CP#vQT=eX7dQo=w z6F)*O&8ObLX~r4NsxeDYavG(2QPcC?g8Vf{Ww~2+3P~hKA?-mA#;!@9heKABDf^`@ z@l$)8PO&T;5kR<8D6?ssJgJ4t3}tCE))Z}VkMHmwKWhXeBI3_cDZWkym@{w9!c^^@ ztm8%dCS^^0UCi;BJVwdJ0oMb&DaMVYW%fa~yT%mXT!nFvcDOXzV5hTu61kq>k$STN z2gJ#G6S})i-i@?0ut?sICel7uzvG>i{H3lZ55^lLaozPjL*s0FE7>mPL1%$)a(fOUwY2Y2rx*E*4V#>IMGdV5`s%WMDX`t&K`=|Y?nSK*nu8M zeQ1Z}u_SO%jjQ?l#M1X~#?WP;$vYp0Pi?dUtO~yZ@aP>`?^r9H=MY^ii>1aurw;9O~81pSK1v^fjgBiJal)5o4J7R z;DDH$5`y;XphV2;3u#ubDEPnn!41jU@9j9_SIWSHxq`tV(RY`Q$DJ>hXG&(Et~jDu z_P;UOCn?UgzS%D38)3r}rTjZ{tw?36R|4`Uu{%U05e6XA&DJh}}Yo?{w+ zDp5oa?d@V7+^Lu(hBtmsv;@lrycD!X0{1yPK8jVU1(U@k;h|D3vKkz5T`BZVvpvE25SbLw(q+r1

    K^LJa~B-$9u;t&K4MKQBO^fHw^}Z;aeYiY}N3 z4k#9>Kkt$Js>c=7d>#sM#X@RYyXVTLF8{53rHG+zS9zgevQ2uhP5?%=IaDaD`>b|U z=6xIp{tT5=b*fffC9(x;#5S~rNgkL5s9=?$(YU2W2+KLPq9SuoPWy~|gfNcl5=}GM z6U(C6h#|u}x^;@Oz*9({(mjdb_&J7QP>z-xYsS&X)I}Go)+kjjBr9uN4DCYia$o&5 zCx5o&OTni~ETcL=B^iLY3e**V#I#gG?7rOkEQJ?B>(f}H^=9k5xrwr7_LS7KM8^7D zh}10`+D>bc>YQc@)WycR=$0(MdK;{eDKmb^2x!X)Df$Jbp4a@^>N6zxqSAUN(~I@~7&7bqUVgsF>#Jv$kwND$5m5YHP3Fmg zuFr5VEQ8iear_Pj+$Z9b!5;qXx{+x1g zoq^ghb*U6MbiTnKe8o&DHsf*TR`6mB@qJtp{kaO-YAASP4t&ZCdaBGX%gG^n-BWqr z)8FX<^FX-YuW*S&#SR0s_14#&+ss-j?LX77s>mF?ifx{`&dvmlSh)iCwF3!^AA9l6 zZ+RYu-mV;l2VV%z)_nhS4;<`X_VVps4?TEteFOoG0-r4WZ;QzSmax%q?Ad1R=U8JB zzQ+F-Jk{3*a*r8RHJM<(@Mu=T*8XCr(fiKkld_#0ybI$ia40=7x;-vrjNh{*<~{nw&VW7#iXX5GH;ZYeTJXg=@)lGGGM^JeDIBseUmp)Q3ergBuMx4q&~D;=W` zu`$xNp9OuJ>Lz?7v78N7D!~wqbNFYiIn49c1mlKgQ}j7#H{j2Gw;0b@p~fXWkA=^f&u-zINX*_+4cMefEV{K6woF5 za!8CUEMSdQIHld@Qyx(a*s6Swhl&^z%8~A53{e0hHO0WRBVAIre&^2#>#a9nPehan z40b>w*pu|4`Q%JnD*jGdEaN_`bsZUMSlsz?NC}GMj*llz=_$AwZ?0}yR&~_%?b63& znk3&M2q7n6j%$xy9f;~4?Fc?aQp*Wnq?*$xUc?gDFt;Q=R-hkR0O?K zGE;yt!D{%q{(Q(q>=wm28cS^QtId6B?Um-2aff0Uhc0FzE0z6^eaqjE-zm|aQ&HtL zizKqCCAO=J6v1t+2=TkaUX-`55@VcIxD@vWBARXGX13|j#}M@!`!3CmbXRWr!W$?z zH-40BfI_^g%mC{r8b;rjXYfMXAJ2S_x(f_NdkHlNVelA&hPo_tFts*&X#RTjFWqQd zIUK4BPjOcY3iI#K7PUm7Eh{@abr1yLUH{qox8>yqj&r?^c#ODmKK5ZY179jk7kI>X z!M^Zc_}@9go*#_CqC!#OYuP_hP&Jvqr!|O)cFF&uT_T_%!9g=?s44Wb8_>|RZOZY; zV(`PAt{Hq>7>>=q-mE&|QXRwXzbN<_giHEUeU`|P@so@VT3rkRU1iUV-c>Xq7f1n^5zUi=Du<(C9WnAQ!i z?zWjPjp~00Cl5;2kTkv96y`CXFG~9YnlLYy-jv+RJV^HQk?l|6H)OGY`N-NC(uI`) z+yi+C#E{_xaw!Jo$Q^M_^8U;b#F#mKdbgzPdH1fIsuvx5@+m{%F+zlST7Q!&K%elT z*~~RH%D86=XB+uz- z;XgGK;tC{%+z9R=Z7hK&Wq~L`Z#5ryk6VbMNQdPIR!P#F51dmP(tb&d=dhjcZW24Y zf}QgJ$ZqPxz@_i8aAg)o&aLCrluk_bm}Gf=R6$P)Ua{yiOVi_($4GY)$q{u&IL8F>95uqCmxbOsc6)+fIc~`SdZ) zAb_=uP!F#zdnCiRAdUeQXFtCC}K0!bR)_5-^UCw{wDpZXGjf z%yM6_g@x7&L=1o|l<-jM7+_Uxj$m^YO)7|G@a~_`6mKI_Q?lan(e%&5tq$2(hDE*C+2Rf1TNa$7#pe&YaTDD9bJc&KiirC9zBxALw`w62f>)PNE z8yWtOMX}H^`n$BY8U8~so2|q@w$g0aLIH`aV(G9Hw8>^Gh~9Q0lzX~tNLK}N!wFX; z23xvHJc{He4(ku<@!ChsIE^VtT%EOMyD5wi=pyVYm+d((eqo~cQs9P5G(D1du`9&( z`RRaI8qk&MEZq?ca9JIzSc@G%FC-wy;bH%SSC>9KOzM+yk1yr*Cwaqn?0WqAX{3pe z0^(0Z#Hc>&f_1M8aigE5lNoq1fASy~;h~053JYc7C{~k$ll}asew!M)B_%o}A4v^w ztZb1}w=kav|Mi*ISYw)-459ja?Lrb$R-dCdk-#>Wp&HwV4T8w@x`*5RRm=nFnIeiTGc74v_G2E4*GbbQabP!65WiZ{SRPG= zBWHe%Lpv)^b%Yx1HZ7`~W^zNXSX3`ft5x@sv^Ht@dB~oqDk#bg+RIzz(n>{D7`Z$r z2iXBo-CItDM$no-G&!rnl46@Fm2{_&|bvPN0-e_p_nTZL*4$vgmF4n zs3FB5a2F=ads<&wScf1l`7(ypLtmAVGp~)oN#21HBBw3_G1Q+jUHvgA8$&B7^Po(< zT8GM3O)-?SG$hNbRdeVH3Xn`4Y9*-AUaQc_hi0bGT{DkYXPmV9p1GnSxK&}8Yv5HD zqzk1s8rv&W+C%u@pnqY|rw24(ZK9NMl8Qj+u5eW)OsA|yZgji&;m%85i8~qRVKiAp zN{(EZW*@tv7hBunMc~I@9DRxy#csr@lA}8|SLA&>RrEJ14Pj)Qihfs;9V($Koh&T${f(Zd_PjNvEX*Nv&WE@a9he(8mm8f@CmtB;4yZ7*3a)oZOf93oIe(6cj&wmVRB*xLn(>LF^RiIudbWNUYk z0hykLV{lEu=;*k+llM-zrziA>EzI`aq07Xe9Qp76B;kV_b=@~O$~2+Y4$@frym(sp zK2h36U>EgM#wK*A8G;!pnshY9AkI~##m~kldZ(v#Ffr5(CWz4*YRH=AHq@F=pwZj6 z7u5zpatE}*20yoo^fPy&a~C#uOP8})g^3teQxm|-&fz{#N_Jm3=Ul{ETi=( zzSAu@s_M<`>uHCiyZ8<#V-bdqHVo-ay$SVbe4l&wHhYYK+`oyQ=qz%SPW4JOP@K-G zXAxFWW)EXQ9;0nC&UYwcgQA62*@dtT?XfWJ966vGQQwMl`(C`q_bg<%wF`1;E)f+F z{^xz2;|JVe24BEjw8K7Tj}I0`HvNlj7(ZK@-lurQNWrOIBc+<4#G^zJ-**%#rfuc{ zbLW>fM`uBpFaf|3VI_dP%@|r~gDbWD-YyZ84Va^b4TRaYGn$yNT;qgjk*t{z0b%-% zo_3HS>jWkFPOe+?;>>XI5DcA~K4xXD`#FA>+)r=>LxD1EcZ(lwM$F(ax1R{7q&KMG z%O?}A=@6M=QUTzS-C0C8mSNgY*b#XL_z+(t%stO@g;IQi*#2Dmhj(v*;nfYd(7QkI zWcJ|O4JxNJRhKvN7%YHw_19gA=)V{q<<(QM|6134WsvGs_HpgnP4JV{y~_1xs;kvZ z+SfhUw}N(7w@TjCwW;X}y>VUPqX25>x%7@{>@6S3qWf;-!K-=9+H}=4Mb~oz(hnGi zCUvY%w0IpqRHvcEvs~#PO{Ay{VH>Laev`>f@J_|8{5fezb(6uK<~_7O8uiI8R;k5$2RmFOJd z$uOSw9JB(5$C(DIQm{q8#dtWl?E%F40yJ# zM@qm{I2!YOb#S@pfrlt0I+ zvtOijssZ^R(|UUj>;ipX%^1kTx( z*XU-lk@RKYcPE(*j9t9CX8!VLlC(=!IRcY;BiT-|;pP;Of_s{sQc~8j8(X-CMiFOI zqK_8)oyRS3W>qoj1q#9skzMd zO;h}uregKPw^f`uu{;BVw$c@hW<+z^CCA$08~APk)%^OIoxnt(Zu_A{%0qINB6P4% zUA5#($y?hLVfMp|>yJ`C9L@lTN2Z{C(cYx@qmSUAON>CApj+9X@Ts8pg5CcJBL4$O zKwZ8+{2?oN?0?vX)Csgy>F0T?Rez0|FwB=e2*o~g1VV5IM>;{_CJ$d4C%`~F$78>k!{7K|*efv!P? z(Py$%9{Nw~q`mst=-|hRJMi17TQKqn!Bj?&)|Z}NP;JYp$D&b37Q;qL`v)DC-{cXB zbH$cwhKg+X_DsWoTWk8gjXcqNqx z4-qb~1>E%P!%LH{CQX6F7OJOec0K#92Nw~0SNoO<9!(R9eI}wc1OAt!5G|`!tbslb zlTvSGT$db4?As(%aELsB{F`nxoh~!K19>eGfRBK+JXEVZY~!|RgMPe5 zuc^P&doEg0rQ2Y=imM?Hn-ReWTnzB@PZ(Y~Aw*H8!>U(|24}Y;&kPx7=T-BomAj2y ze?M4F8Z?(=uc&@B_#X%(WSaGnjI!U84P7S-31D$|bqU?S7D*ub_8?mfS32hSbr5d-Q!asT!hXk#v# zq~$;M=O^m!d5E@+vk};G?ZQPwd}q$(G8;Ip`4f`MRb5j9XC1u%T(Mwr*#m{38JMQ< zqRN=p!2pQdQd-#|VKHaB33V8=v{S*=YHi8MJb}#LiF*1G7D}F&(0l9)u}Tc0O!Vm^lh*20W!P9 zlZONx-in;`%`Y9edY+MLP^fAr$txjS#UYj1XBDxuNy@G>euY}4TW6`mm{uqq_|i%R za`x97eP8bDH@<0Z`W<4zCmsU*rOds~V?n zi95KtOE9JLVAn)%`5`ZjnzyS06S)y$sl*{Ffu5AUYx=Mlkk8myEaX}aa~RyWP5w!A zQtTL?D*FK`cp0m2IP8S_C()nP73H~TAESSyNqxaSx&k8>4-H_)a+5PG*eJZu7nD%B zb}*#2=p}JVbJ^h+zcF5z&w^JQ2c043QIkr0VuQ5bu0iNU?o3QjGR!O8oj(snFQBx+ z4z~ebB9NMg4`VH{DEUMdWgPt3&JH#O!2v99UgO{Kgr2OhYObM-|=W}}VE1WLrNO*~lf|eVq$Hk;1 zMXoKMXolG;9N*casI(4XX7BLbFqO9pdQ!6;K|0vJN&oEUo>zlt7YRK zQa8ruhf-@guQ%Z@Tw2*T4Ij7;gDqB)&7g8qV@V|Tvbhqe{ER5%&=)sH#28$G=LTdZ z{1sF>Yy*ZE69RKS7@LF#WAUcM1OW}qmnoC>fPOefr>Ty}`pp}I#zXLLywm538CR$h zHV0m){X;irveG4cbchq^-YUTuDwuD>8-n@}@_&@GrB}-$19)j%j@46!2Uj9uPd4Kj zOyWVN%AK%C3;nuk!oDWcbuGoY@M*#fp8UICS}Hf1yjSNCcZ*H zL!|IY&MASpPE)~d_=qwGBmhL0_i0o2THnOPu#I6f8HHO&6i*QmagTI@)*D-Fe4BF$ z;#8Eua)Qd<`U;70{7Yv?BW4`x7w{mKJ?)8f+3LE;U0BNfh!xE7x?CU_l;D)YEGiu` zr3~@Y{hTH-G(`cZ`a&et-Kdk7-On0`JuZ)UTsDWCc>_OHAl!WTe`q?ZsJ7ZJS_gNE zyGwDG;_gt~-Mz)#p*R$GcXxsYD^j3Xiv)Lv5?l+MeE&J;c4v&-?ET7GYtH$U^*}}L zT(fA6joEwx1$S3x!EIyWX&!Q4#3-z1&NgfOf?*sJMNa>8LZ?4eho+~B}9TbZ;ptn zwzeX!yb;u8pd|kB38y$S5}QqN9OV~?2xVEpTe2)Fx8dm7*v9Qs9vDHIWXkR6{*a(* zeh4}Erjs=z<_YX3=`4Prbee8SipSY7_;< zL&E_--^RW2CC)rKejwvJ4aJwGYzv1*C}U&XVN%Z)5+nWlH~XHp$+8Kx1oi$C=)atX z+%kdAlAw)-wLs&L;gG11ch#a1@b=YzEX)5|4Z$Z_!6<4)Vxv$*q0e3!l^)#$X+20QbQqtfq*vhu!J5 zCYJPRu{g5!&*bDzQkHf{Hro_acS_X?3;3FbnZY{?>m?oboQT%2j`P)G_Ooyzi&6mYP>D80ZA$5B>AEN6ftn|j?g zVlnEmbUe^AS_ZI=(CHO=YYQ6|cJ3m{?)rxjf@CPfI`33qDOH2;A3@0Z5o`zzUilN+ z)>5+SIoe@MmehVvLN9MxMD+SKK&Lod;ik3O&D*4;wqtWs5b8U&G|3X4jw%#3LE%=i zY6R8})V-|;l8)zLba%->?dQ`65$jUZUh^LVh!7pr={{{ZSZ%6*VI&M&TG{#Hqg9G` z1m8{vKVX#tl&2JMD&gdi{6`#0ENybZnR_#1aSo=^~&d*3mL@O`MX58%KkYaq6%5 z&C*R%N%i{!MTCs>2;N`fBlYBnL9b~kL(6hBMQRvg34>lCNifIJi2E8#HB4_|hr+~w z@^=|-SXH<-xzU3k0f!5jnyx|=>XF(z+jM1}B<8JO;KkZY7Q=Fw98K_Cvm+o4j-ciXq88ZaOX~Ecs8SGMLm9`NXHbM#znHw1J}|+<(4pd+3@5Wvgca>MiyA<&EQgnQ%2`#w;oHltPsU4<7-5fi`;v;NV(M>4>j|CE zaoy3+Lt2Uze2Yf7XwPpRM{R&MA|I^ITtt}6KIlSR<0oaJTf6+=?V_dB)h+5{lW{)( z@_uqNZ;0zvcV_N)ut`iSu7y%O_sMKs_f`}k-FFO9xnGy`u17ii;opWHK)zy4{GIR} zcHq(J9q0X}>6Ik-#_av9i6-zrljG}^oiNl*KsfLyi*q&~3bkPwMaCF^NzTkqzKWc~ zgDYqO`AA(y7?{?zCG|hd3k+#rG?Z%VbC@f={6Uhj4f`^~p}K1b8^ycqnhUIyVgHWM z+1VMxWtlrB2I5$WN=%{i z{SeWNZ2#^l+pQ0Sfk5?e52~CkXDNH|NeHN-zur&Duf`%LnSqPPuz)r(Rv5TwFTB45|$!+>3saDat z&zxJyES?YU{5jyZDzu};qQFd(W%s8K>O{qxb~<{v9U?7R$Zz)Ehhs3f117W9up{?1 z{rzr7heijw{i6)!T0vXO7J;T#x4U_6n188zQM*>&xK(LMj@_XMKeTfatzGpX69U&_ z7EIG+SuNP}r;!@f0Fey{X=pCawSajc@s()WpDnbNbwQk>+h(s3 zk77_`-d&ktCtTOwQn{lKz3$1Xkz-h$l2G5-H{x&2!#&Mu`G8$*db_D#AHVzkD>$X%Ci$k#79lon}@-vE3c(UGu}F051G`Ny zo`8^(_j^rEid+R}qtrCVhb3R10>_TT9*F<_rhEeFa*lyKy4R=zw#l}+4U75%B@n`Lmwzg4HlJF|DMe@iZ} znGHez6Dx=}_V0*?{18aCkfhGiGNes?7%G>#$NSTjARnrsNl{YRpiRyTD+d)YA zR{WWmk>igPJKLPIcEnhx>V*6XFn}XE1|mm01@n0wet@>HFzi7EvUGup@3{G7fbA+c zqo}13jT9No_D~=zjt3{-y4;j@&WS9nO``6=uf&FY$*sQ0shXy*prKK6zros?$H*2@ z{l%~EqT21ie71!aYy0cRtGo$>I780izVW$OS%(CWu8uoaC)-}r+v2;Yk0~ch3(ce) z!$6k799&~ll6AAN-O}Gp!F1ivVTDrGVOu0$;aOorjcd^lOG9ZnB|;;{LTPjlq4MM2 zZs<5QKGdO9iSK9%R=oL%YPd6QFG|G8)fR|Y#lMzHYDP-+G}g}NTxqEraA9N6+-Y!D ztCIc7k&o-uxnKLMPZN=6k*lr`*YVDT)LEf1f{{G=>{5;=+hK#SzU9wHxv<1vPnJ)| zlIQPGslP?;HW?D`5M&Rjm2XtFF^yU7ezrK=tU?!hMVQk6mux4yC`qQ7u?d*mUKNan zN~B?twttzup>F!_F-1}Dh(i1lqLV0guZE);ftKm(+OXzI?)J7;`Ydf6TfW!Y+-(-9 zg?01T9~zso&%plDn4SkgGylDM`IwE59E!J+1h8-hC%>b9t48-dZ;@^-8r#24N(PVa zxB_mhcvOFub${aRp25Vd^q$T);x%MESO2+6Hlo0vvF!QX;>Za%7 z+!^Y7hDz078000Y%iX@r35W`l!8Q`S~Jm)YF#883IqVR z0jHv+)phvII?dL&I=ES`3`-3pCb;OHwLl`*Qt30S=WRc{DvAwCDoZ*G zzVX*JL~%_0tm*rDHaj@Jf--J8rQ699PYEV`Xq^L?(qB4DR{r?(Gru4o-5PH5<`MhP z;DfqHJ|9UniiE&8Nd?3X9cJ|2FXnR#H0a1R7z-=NfWX+Sz&aT>aa-zIK18l2iZWT5 z5+EB7U8bh^Hld9T)0Pa{T>AxCKGP+OuyQgO1V#~Z!Ujhfu0Ld@{xMp!8QLTTXiect z$RpS_%@+hQSC+gRtuVwN#v~!_-@zh`kOL?q8v0b1s9%HbgPDnE?=$)lBe&IAqE#X& z6Pk-3Cf*9`?*iOmF7kUr=8J?KlF#g=J%mC%`essr0r_%ro+w;)F%j5lQDL*+R^fS) z^kFU?2Zi&cV<^}@wQFjabgt|Ca^-Lo@G{c$GG)P#NG5^3uRjG08;IOicD% z-V+DH23|Y+3A63~xx8P4FKdcko<%8+c!OQ)o z9mFH>+}M5*cfrDvp@y8<=1->7YD#XkW2_bs)sYdk^gXdwGNKZBQo*8fICOzpHC`xP zHwGP!rYuSbj#mbG6h0=Uczg+7NQ3MrF@odyh+tOV!$Sjb^Vh#Ck%1$VHOySqs6&N& zQ>+!Stk(vY2A{q&zu;L&s>hg?nrLKtFgCbpD*_C<2Oip{yGt#I{#ht=8^s#OX|imfUe)4QrL6r6vCw_Ko%z0B9;6Gqa={a$Qi@vpLlRZo&L4Si&lFey_Sq z5O8t}9lmyhjUS`JBk9DI~tTGq^SB-6#H4gb6PBA?NH{^?IDCt;1KPj5jg zXf)UVI3SioA1A7RnD_4$6ce}ybyjw{AH=2Nm4Cm6F%%wK0!u`f802r$T{z77+uLhs zti~&lm4kj&Af^~b`yKvklXUvNi@F<^p9PrvSjbnN+;Jkeq_Crnbj12?!wKA2awfD6 z@|w4#(2s`Ww(bjh!Ngqfincb##aoE$r*!q)pDMA-wPs|K_MXPki){0OG1+P;72V%f z7dc9(P=dl@FuCN(D9B=?Mt111B8wsypi-=O&WRG zK}5R7Gv?QQ|Hju(e_oiot0`Akrz?uVd~@sYxSFb$!4dt0=ZSRI+9!&mW8$z_ZV3+~ zvZafl>Rmi6r)a+%4fmmP_H@}ZwV@k$kF>BxIbXq^Wxo+*uQwJFEy9fIKQ#RU$ZR^s zf0kXmgQCmIq+@b&7qmRNDk?vGzvCytemAY8i9H~ zGv;h{u4b1;5DA|(37U(EXXQ2?0&jG1BNOrx1*!c1&VKpJkhd&c^S*$Ozm*WN#WB!W;510BVX6aNJ zPAy^~f3?SfYahr<<>r?(w*#=7bS`Io%R%G9jEE{#G=a#}gYtH&flfaz$}ur;dI{_A zy(KUAVQWfcwe_e-y5suf&ULmN9}QW4%qcH?ZxrrVixscT536NIgBgE5Iz9|TWpx<( zTIA~M8@dskw717{Y#F_`NBggd@*k6@Np#5V>$`%9d|X^Be7Z*{7FEyTKTROg;me5Y zOmQO(-A04Il1KDBMfBDc{Z$(N?y(U|&m2>U>ShoF1H)s%))V=EoRN2ziira^KalhH zUn}P!&$OUJwym4~-XI)~BU*I5%k{K(R6aGI7j09wpR`FL;akrQTR)QijVEmf3_Ju} zJ%a}*p#SE(wze7dA^0-lf4&jW%LZf&N&Imr3t!;=8N8L0mR48!Ln*#FwPHd;7uagp z+c?bm{fBEkLXi0Kw#^p^qyV?>75~w!mDf%i2QbK)pk%0yW=g63cM5dyEh0i13U^jH zN$|^M*WZq7cnf!1Hz$&HJBM)3bljXn3lN{gvyte&1o9NqF=zuh4Mza^2L zV=#($Rb&9mUJH?QKYF<&e)3O4>3!MjhGFbXh$$7;Lj1tbGZ1?<%=To4)p`KLOF-vy zjK3BMJF`@^cHSYvyoiw&rPVL&I;@IdarEQf#u`oXTv<+YW+Ndqx@mH{x%5_a*^)?* zPvc6a-Wb0?TSBzQ7{Cs0Xvm_f!}!|A0>gW;G*1Mr+x|24xRbUc%W?#B{mQpkwo3G< zm&OP!;XsEubGYJ0LgDWE+ThfWBesTssPr2I7S*R-ZePZ3=&&51Zo|t1lT~g|reP~2 zbd1ee(GICQOOpl{19FE)$-Xwh$!jan9^^S@Ib{xv?R*GBu9|gNys?xso3&bov=ZF)TpT{aJht@lHGR_ikZ?KrMZyjihE3ti~d6hsZNjd2aZmkOBlK zlio6G4mLgFb;DLVBD|3lULVp=X)}vcnut|TAZq7QPI(cK zKv_Hq?Qt8AHfoFqW8CH(tw?a=nG*#77MDmf1c0?K2#aXnzv4_w6}A7+%sUI!!y$wL z=}IRTCu8gFGaQ-Apg@7mft&KYXbgb{3O_~WRTDKa&ef{K6M zn>(Fit@dZKg1PJBB@uL@{R=U3#n;Q0DrL~9&3lPIPoqdo=#4JK!7rh>e;NBdPT-l? z4Aa;stf7AbfyoRgP#!BDz5_BxMnKU<#;(u*`X68QF!U*-Oz|K+dfZZo)%G1_*MW&7 zPNV2{LHqFEXjkA9a{hSf;lLy?qciTQ1YT7#(7#;-R+(G))> zCUp9Ay8wZTi97g$5wGMBk^fquJ07zl9u~(g?-!S;vx0(xV{jitiUDpzps6qVI(4JE zSVZ?q$ko7ID1bZ!Wyl;OwEwYUvh(fP?5B^|KUHnY%cu8CO4p+qa$}0Dp9fcqlt5i5sTdaur79mmjtYgI zl3|$Kl59gKxpJ_-TUoPp`i$Bs;BslQUhq(6rN%vL!^PWzJ_soo6HI)v8zFGwT+(gj z(yPM&`4AK+*l{lL?{#6r7A^Gz0E5hkUU0&zJA}R9=`c$mX*LF&_OBC?W@|h)1C|^= zhdwS&JB@P8(frspFCXm3)eCbY`^ZNfv*_cwcYtSo ziwUmgTx=y{_poHtk_2BVB7oM86lUtzt0I#XQ9uI8I{?u8YU;SosEQabBsj82)rn2H z#>out0whr9_}5+Bchw_j`jyGl|0N5tOYiG;IwRj3sE?4vPP>=)M#5NADAu zPt4N*0|LCgl>c<0FF0Z=)O$JqJ>{7V_!t1+JjIilJ}29tQBUda-M6B~j~?D-ZbW-^16Uv0u+!bVPv|--X{Ftg<12 zJJ3fg7f>G5R+3uC^E~uM{IC@wF7|q&wkJ*bjJ5f^)VVvsP&6X&-S^CBD=sN;pVs#< z$L`|(k?zDIHImpFuaYk?!^>|NVZOtSRtjt$r_eT6IopsxGYVUlce@Zk|HkCT-R!{!E8RaXV=Ff23<-n&-nqYOCc3F_ZT zIi5YvLaw)(Oht$8&cF@Jh|MJ4_3?^H?1<<>Dp-rMT$!)c#EC8O+~4#~AhtJe-03i*Tj?$#uz={-~rLJEO4w*iiK%l&=O-;f# zDhpY>92~153u{_)SAiY8zz-?>cRN4s$bSwksi<3qfq|b9xN12M9ctu|YtBj;hk$jf z1rQZUEw9VHbmx@Cx1L&@JRTIo;6_p;Zjb}6!dRCciZGf2@$hk=R` z8=05$u>KH-@lA2r01|5q79^y9JbA+hF?ke2iv3LgyM=EXzO~=r5OdD9RcAg^4A1SE z_v+{sO8auW+y>`PnYt4p1{6NFHXD9)H<=8^i%16D&zCzsj5@O_`qpNEo7;jS;Z`J4 z6HEt)==KC-HP4AO zZeD{~Ye>d;hROa&Mpm@l^jb0SZQ%VoOH6OXiWv<& z3#)Vz%h-98^7rQGYcxe`d8mMIDi1TF3Ch0-msXnI&wE6&JA*q{P>IZDFbn3%aR3zDniyyRgMm|J(x&NUsO~S zpT08{^_z9gzIxwG6r^~uGC_=%UtJ^d@*|f5%LA>stdQ|yf{wyZI@v>&2j%XhVFB~D zmEwH@VRfaUX`@bOi8Y_TSK~U4yMSf}1bZj5bCcgi;tQ8_!gY%e{rj14on*(^ zj7LvX+vr317Zl0fWq_fsD{Ut8nQ!`bkQ^7`J4W6&@PLpDh5kn!RKD&kL+TA9CHUr>MWyUokurE(}Wm}L|V|7YOmdpU#z1AqiXvbz=Q)>37mHEfQDF}~RUm&TiO^cL9WquR&C((rS0o9npl+37R z8xt+L3`U`c+~8y-GpBfV&M_xvn6p**<{9;j{~+j%;Y0YRKgAhnqro*4x!>xUJsgrp zFIbBgMi&^!3>E7oWW6kbD`N7|POE@&`q)V-G%C*7cnn$_bNcVt?2NRa$w84Cj6CZq zC#@8t{&rqPHgVUbu`R)DsWHin1|h2Su_*(MsWYl=nLpHS_9;loh}~emPqXodL*rk|Gq2+@2r8vwinqlaS$lUnkn%H=CsHg`t(xB3PEST@%Fw{aU!#hI+0iq!g zxEUYeFWeOdIavryY+YVw{F;-{CL!`4W7P4s4JA;hnaH!)YI2(NVm*N;S?HW#7)A)# zC-a^80km?AglXs)CeJw-kLqWTHvP6JC>J3B2e5ByN~da@^8sY$FNF8VY9Tl4s<{0K zvKCiNmn4MCk4JoTBmYLk8*d6op|@kbVTIEMN7YN^lH?A{XBbQHhu(lfhb3`jN`<7y z=a{TC=eTN~^EF7|J&$a#IqR7%WO*(G$MM#NJH#te)iX;8YH(;J7NZTkaU>S(9Dh3v z2Pmyc33Nxz)9IcJ1tjbtL&)#voi7-;aIIE??65QNOPg2(q6kxUx^f4Q;X&tKtiLmp{zSc#iKtcV9f;$L&q>!?`SGyd zF0M@Jhl*sw(0w8h!+8dwM2j15i%C_{nLfT(Az`;tBTitLXhk_6U|pU4rCNayODJGm z$O$z$J+;eb3MD$)$S9-&xh8_YflFo?4#B`|ahx7@ELN7jP4eK0C8LGC=b?7=H8_{m zb}S$%;;)?cqkp2$OJ8-ayPQES)795a5XKStcgznOWuZAYAmn0#{a_!c6L3eN-=)KA z+J|QX3y7*gtG|(+c$w_p7D_J}5x@o>O|=d+Mtd+O9)Dm7#Sf*!kZ7>h!~R@hO$whT zGI|HgyPYuneH$*ybX`3EAtuLoIEIkL+RjL=7l80#x@W)Tg zy&-%!lzEUARokG0Ot=qQ1hLX1cUOG}LL1`1<5s)S7gbjHE{ko)-w#9n<^#-S>Se38F!L#BQZRvCEB>y~!XnR>?QvbgefN#Q?9k-yC z7d%KSdDjYi8Y#ob_shGioS5DX^`oj?_&Tz!>86+Ebl;~ROeSgq+I6V8s%`s{S_h7F z<5-a@b6&f~oL@s`t^ zfMRW0E=u(@;U_hT88SW{1>c`fNWcVs^!47j=GpvRlo>^`qFV-(dETAL3|iptLszqJ zh^-H3rpe0Pmrf3f3eRHor|s!F)8gNuD>7j8gSJh5K(95B!BdFyFm$6C<)TkRd&~2S zRidl6w=I11YjEo(oicFw9bD2tGKLaLiYo=mH8Npg5$%YkRTHiKRj4 z-wI`LWzMJ{eTdWAi)?AzvNXNsX71)K*)7jqA$MoU)Z0r9M$3=~fqr*{quv5+@+IbD ztkQ1Q3H83(vPu~ZMLLD{+@h91MWh_MQ&@E!j#1?608dn9!=EYYlTPhggemzWqgR)g z05p%8MNxAie;uG5DI(8Oqi*aCZ3q0|QmD*WqQKVQeQ<_3krkG+eDu1;neBq(NOXM= zB~@cwnP8xLx`u1Nu%2aIm;0(%acG1dk}y&+9X=zx-I1@SulqL9`<{f^FtR}+t;=mCj4#|Z!36Zw z^T2izuKH}OnBQJ_&EtjCdin5Gue^Mz5%)pWyNqcmiGabLPja#9SbcT}c*;{(E?=X0&c*rG?2|Kbr40RL{) z-rFtVC|+LSdpa+_1x4hyuqqA|b^RTj@cKlZRTfZ@dfy&Wkc9v>M#w`Yj;}?h*&cqz z6io?M0k0T7FLiH@6yLi1Xkis z?T{#<#0=5f2#lOm9N0M9&u)Vwhp{Pe_!8pi%LzuD@qcnXQ|ac28pPnyhv&x8P18fZ z7dOAD@c+P19RfeVJvV}>m)^pksqKg_FMC^RJXG_k^KVi!K$b(P`h(&=VG`S`%a5Z8 zx^H8PX}IeiuN1^eCk%gd0HI8m!a}(44(<8eJ}7weUSX$*nEI--Gc9X>KXd6R4SnV4 z@G7WPsuoJ5jydg6x|tMFV@9myr)kflRn8|!#pfIa8u96dWxAQN&O-7FEXvSd_~1VI zGGjQxftaIP+)>w_lzUvM!c!Z z^3%1e*?IssronQt9eJDphbodFnu8q~V!EN*%RTu7A6W8ZI}CdTl{dF1rer#$2pISR zi{x}eGnuT&V-dhif;Y9@S8)a?K2_N|e<-*S5EcJfAY5h15m&jrFJx&&%rDzVs`H)&*S$|M4a}rYxLPzfLvU=9jA;NqC&jBG&IEKyR?V+oW)Uj z02jDx-6(0=wjJ0F{XQSeoxJ;&+hBjvIjH|7p`leINoM_)(2-?Ar64G0I_|Xt*zmKP zHQMqy+@x~qSPfm>6mLwyb7$}JI{KcvR%%#jtCf67P6O9E+Fxdh9Kc`>L>lksfJD`! z=B<9s#q_lqQ1VZ*|8fF?qRPAFFmB~!sIaC2Brg>U#bKVDiJUTXu2Z<{@hmaI~Q`Uwvmeh)D{KqLPrwdXDufm;xcP#Rbe z=V=&oNo9MIWN4XjT*K8JUY9PBK4MJ4SKV;1z;~9#@<7ZpoZw6|$gt8_O8&woB9ZhK zbw$Ejry7hrr^$>7-$ChUNdZkRcl{Bp@?*qjfS>vojp;z&sK*3=gj#cxK0-{_k3ClE_^d>E=vx{8f zt$}SZ-ahMD@u_GBr1<^Uulj*X=_khf1~D0+6y|0BfuZ>QvK3=SBRS#XE5{qekY)4V z;itXF{be#C$A)TpGz+^N_-K#j*Fx!N@tL9Rq?ddaz3*3pa1WiY>nOi%HFQYX(ju!F zT8si`-w$2h4jq@T{>&P^8#ds(`0wSpdLAgzW*qk(o;yd=qwLtsiBhrnp(cw%&5J8f zGxvI=xxTeb1=wl6qSmiti#J+qsIuI{Fm3k@b!3JcMF%9>9-x$?Mv@70fa}2{Q8pnp z;koyqEv+?NDq4>!GV3pNPx3~y-DRxFO*O&$;;GNk`lRJn4iEXp`M2ZKhArTuz{W%PJ&%V zL05ege<0zXm0CUFi+r9+2Pm-iP+#H`s2}pXrc6hx^AD4QO?=bv&_=MG7bTU8AI?~n z0rF7q1}5}??Gw(|dI{Nh5l}$q3T0QTH&LWwfd&JZp-cS}UjAAUWt8$`6efv1dDTe3 z1q=m|zIM-xm1-f;d+Cl7D=X>RjX&}0us^7!?%Ql1EOOB>hFSg{%l72(IXyo9dt?Y{ zBXMnbp_CE~)N2>}?Tk41`~+oU3jhiCmhR)?&XpUS-Tg@k80{5Mxt_5d=KmnCJ!6(eL}spJz&Jf!$W z9#*HimN1PCc1BEd?VlvL*v<}y*ed(073rL6Z5UUO{LOAGhh0wvMz}@u@2D;Dx^Ub* zNw3vdp$f(sUVR6vi$Hm)vTjUWoJo!`MJ3)`t)D3b8p!t6W+k*yslS2!2ZK4USdOGi z_d!XhCk(A|TJ8j}F9Nr96b|?+HaTFmnYIxvGv2ALN^GuA09~}wP zxBV(~dXU`U7N#f0iZ4!{+-1wpN1M1dh{Z=*W9wlz?rJjK&;b;zG+nX-4oj5?o9{Qw zmk|aS6zM^grdu4!h6#@ne=dt#0)e{p=w~ljI9ve-kEs9E_ppG?%dtfmjp;NpVl2c_*=!h7-EE1>Sir%43v z-dB^+9Nie6d=CN9z6dBpmFKa-?0Hlf=knkxPUxcheM8{6XTY^nZO77`H!ojj6u{hFCU$_6qWc}~qe{g7ufO9U9$L$DTaPMZMJY^7G zlGyX{hUkg-khH{BG2A+%l1v-i1?#WwGa=TS1XHA*3cPb~yVO|yRnC&b%F={dP5Qi^ zGyn5>V$g?iJ|K)M8&;hOd7-uiIF9^FI0R(Pw-k2{7v)BKDvnfcBZrJ_S5-v>r4&Q| zj0B;0R!rH#SvfDWf6w3iOqw6{za?p_wP{pp{RVm0JlXE0SNX^ zsQQ-}Rhu2}wiMfp?oG_PGv@a~t;_&8e#zBPCrOj>ai4bmdVV{4EW$<9t@8>uHwE=N zUI^KGBk`;b3MIT5k$g%+tW&*bxVE#3gU*=k_h}`ofgMQ37nYY4kDZ>@hb)~c!%{JcKuqd8?UKvG;6mIeK)A(Y%L4t=))me=5@D6 zM^;w{B}+@$FD0!*vZGD#j?*m~hM{pRbm?~LxsUm+^^nP*tJMAoN(GD*06W3VvyV$K zu0vLB8$^mR^}e;?rOf7H3_3`3y!-hrzb(GNaiy#5h!&f-dK}PupRXs?=VYL8 z3Cx+uf4F?QGEJYFTOs|jJ-ur}SO*s?zpG%$jDR$ydRyc7y5LLg&O7fLwd1Wq-|~{vq-GrDOL3PAV=U-;PvadfQe*Li^wlgM!~XEv z?~^uV2Bq4T_R#nqO#>qb5B&#~B);e2HGnn|Gb7x;3(v7nw&G(7o9u0>A$Gx~UcrOPEVJJ}-IafZiObpUno zS3HuF)YN1%x>Tj5LgV3k5#%RYWBnokRxicPn>OSioZVSKN4+$TCxehzY6KZML5Y)) zjvlX(RsQMxW>ZV?Wj9RZ-QOmdCzKbWp^T^_tP|#UDcbkZW0_d{W!;Nyar0z!A;%Pw zlzajTZ&D9!r-`cEPo4vpNdu0M&H)}?7b^y_%}G|R(Z+mAkE)mha3 z=9&HR>Adj_{hXoYXYai;($>0~La0Z{sH|e8-=baZ;y#c-`?$YUm0X=$SBbb_Otx!# zv8I@iA>uFMvf7|6JOMrV6fRcyzW~+29qQ(_9pSgltzpvlHt~4Kzn|~4Vs}s>QL2+K zv`oqR8L|!?eE#RV0=>UNe*Tw9zc=j?%=2~Kmt2Y7LFs-ocuvgV<&P#yZQXHTyAQ>K zbKBYjMQ@uHbar}qss4PTsR#Kbr+##q0mM>IAfg(M@96yPfPjf33w~JsJ2Ps+Xp>)9 zU`2+6K5YJNgilacVOJA3<)2QS97;Jle8YS@m^cdNrWL9Z?)M8TAM|Ow*`*sKLUJ>~ zvXnIm63g#$gh}@CM9#j)g*NwqnK4T*EpMo`-gh%)#UT5E`$I8$?5J)g>pPFpC+e~# zd%h^f0YU-D)hI_0HWLFGxhWSzr76n&>ztJa!>|{f3~Bzv9WPEUD%ZbS-IOkFJ4od= zoYc=%wTppmSa*#|ziaA znN*dL7Uh{B@(qJCRLZ$K5G&gEMluxau@^KA#krR>tzJFNE#b%QP;`$goFAHUmzZ;Q zVpw}xsbTY`SwTDj3d2iev}zy>$5F{IEroiVq;6H_>jihC6;#JPN9uVrw5G~6J-#LbmPG< z#p)odNVya5Z10$8IPb}_GtA+T2j;K!p>8UJqIMboM95d|p&i|41Iv`SQG1a!wQ2loPL+dweX^F0M>A+Q^`hZ|*r>w+? zFR=VI(R@!trDb+lFnZF-m-YR6;lz z;3D%e_3`m5YsGE>B#`L+M*N8Z`u;+mODKPEyzO$VJU@>xh=oB@mMO>DX2k+_{=vA- zK28+n^MW%B7cpmPCy zPvcayetvoQOFux!;n$+^Ur)%d*!0XCYif_2z(LnIcK7vo`us3|qZ1ZawF%>d2D0+**Q0q*Mr z2}^fzSHg1q?$Qldd9)SzS1;_buF9*!s#Q+Kj;N4O)QxIAg|cKq!K(5!|M5f{-lMZj zk1EkTcW6G>Y+5o#d-GW|wji73kPdT{Tl&pCMSnG_X8eBR*)&B`IRZcSX25?3DJA$04+iz`k&7yhDP7pj3Koc zeq4xO&P#2fYbM6m6)QuNfARG1S`}1|v~3Chb@K7MGiG~=SqkTp zxy}qqw{GGuESu4#<@vv+&D{-HOM$s4<2=7W7^S{!$}_OvVLA}~)Es&_;3F$l5r(i| zU#33nLq(H@H9|6Yq(}CrCE=^t`$EYnURn);yL{C^%ia~D>K`RlBl5iT;Q;!@C>m8r zQ*sKyc@@gqUxMi9KFmNK=*H8s^8Fe8gd|}qQB^-PVHt&rL4ttiHJ>RNCDV;9Cr_$D zfzPVY*14mMZ_#wS{o?6^S-1y;OJ8{6Zi-I|U%a3D++hIL?erUET0FYC9`v zcY13$94YCE3_~%KdoTOfzz@&lXM1%6e)dD@;L6ue9sLS4lLonN;e;ExL~vi?SQczM zz{rV+e;vA0RZ5ugkJPD)P1!zgD8nLt zrI#iFPdqrUsYF{KW>@Cpdh9hgtcA8(=L>nojt{C*8a)3jtQ0o-QK5`Ptp*}IU6n_y zhboFI>cvSYcJ*iCa(Kdv$o2+$fNV7CiZDrRXyZM6iqZ@!Hy>3?dZ{X^=fPZ{mCj7X z!uivelgo`$*^^J-rQz`I$O7mcv8&x?h{KZU1Rx06>uNYT%^P3mK1_)=2#5%!Kcw|U zQ^DW%g&rYreu9DIwKl9iEE1vd{=}gGEeYC{(^ESe=EH?-jib1;*Y$$ zA8w}GdO_5;$qfSr1qCcBiV3>khB{TWArakV+JgWy%m)}M86*`;mcRc-hXgk&wnvC7 z)6tXh08|nR2#4Oq0eNPxWCHD739AdH#^UQN&Rv5n>ZB+rz?xRjhnUwGLp1l)n7VDa z+FpH~h6fwie`jIh9~xi!A?1e{e}%4}Y&?Io7mdh%Z1>H(v&%5tK2;*G+DD|21Utw^ z(ylQ1qN55O8FOL|EezdLMC_BQWlM7F{i#M=S;H};=wR+`r=Y4yVb*Wzn3W=_&Fuc= zL@&+Qm|dxz`J$76ObkR!7JyGwT(0pL`ikVK@kR`r+$P6>K3K3exPyK9&*O0{dNU#E zb?+Sp@>=zdK5%`N^#3OP7tmGuU#u_`NYk{PGbu6AJ%ccw%%~2WyEhy z)J#9b?c_{^o6@7=VcClTjhmJ3cYM*GUTW>$JE@tpi8vm^{P^6_HbL-h$QN!NzntSy% zm^%}eavZb&ZG4?Tpq;4Y`hRFT$LP4;_v=q=+qT)*R%4ruZB5j;F&eY6oyJb1CTVO= zZ1b7#?^*vh^KRBUYv!DD-}k=u-XHzZMF~S1CXA93c9TWeVkGb1-O{E4HICh3+p|ML zxnXd~VHGWuON(Sn>MU-mQVs;OkuoING`GKS+Z@YM|dn2bq*A3l?=N(C;>d>|gr&kYcy(D0He)LKfT($&u>d9V% z7v#&UiQcyfw*C-^ZIVkLxSreYt?19U`#POS&gT`BEiH#eNN{!Sb(+@W40_HE5AE_e zQhm(rb}Y4xFWTow-KW6Ed++CaM$W{4PX6@-#o5QDL-;!1iAN#i?U4NXNz~?5u z*W#`2wX*9N!91T`gswf3%f6JaA_xFJe*XTt_tm-`&pLk+(x4}^v&Yxp0pEjfMxh=> zfv#ML#Vv^uUopi;8Yj~)H}AWX&>i@YzOxcfOJ5OpX~IQDnb zuoNn3qYUy~=j1=XF?St&GR<-B1$d(taM%u3+9tzVC-2s_?xLe+mQ~>N0#WdO2Z>F~ zQ=)eoFV7%0&wXD%^)z#3D2cWfrL{W@O|>4P4|}b>#E|4pq|69c8%JRiF`jIGR{-PE zJ|@SmvnYJX~WsZppi&$7;^;>Iz@OHt)ayU=cg%z z2?P-qV0!3b{_^D{`cpnt1;wh%?)DBQ^TmBNc1DFfCP&v?Fv8w<{Ts(0zo45w{M{AW zHdz1~n(S`LQWqe`HCM&sY574U2h)&^&5i(j!9&x7I&im{WiSxCnAsknsUhHD=PI`p z7Id`pw~-wI;E_u|K|@Ep90w&4#gy&Y(EO-!5eqQdT>M_Kq6Ndv7RyLm3}E=tUB;a- z!Q5KrrBVffxqyzNn$`pehaQuYBUdZ0pj&;ssbog&{8h5D&#oobgP&Dnqy0BU>BHAOE!lTbm>?@!EW#X#HlQjk_l+mG<|E;n-^VcxYGI|po-KH(&k%+`$ zf3s>02#K)hlO9@t7$yPJfGP%KsfY5@9!eAeTODN>MEW9Jp4DJu^oR~6oT`aoE;f$S zJ>ue#3%+cBh}k<4RZlz}(;vD9yjJ}36u;i+iGOMQR7zH!h*B1iEAx-vA7-qt*oqKK zMRC^g&#e$RS#5}r)Ude~s?$4}=bjKb>*fyzo^JBYrBo!zImyc}0aiD$C5Yf7txeAU z8U`}1>NDZ^iNXL_JI;qaq9_U#9GtUn@=aDFd9Na&=915R_14~6y%WxCjNr*3E2VVQ^z|y&pC{i_q$v-#cJtWJ%P+qR1=XkSz|aaEuoR{FaM>xY8mLu_TuA3uC>Bya$SxthPRzITt3eNun3n6P-~XRAHly!-WK=juo<&7DxM z5JMidGx$`WD%!F;f8KgkFk#L6Lf5N9!~BQIIodiX3+HB-9%B_Z!|tEJE9;HKHyzSB^x(r3|a=rOZ1j(gb>5c@*OL1fWK1#42A@9JML)&4LzT}K<4eJ-9s;GVbuh{sKTlE-!TjUxD*2T$tz+T4MX zd^;(=hGvmA@wTgF>ZDseVLLume<=L9NhNigS_d*xQI<<`D=92zk3 zHiKoL}u}36dS^=tBkdNztCgvq_HC0q>^bZWlM08D&WB92En~TK< zJ{9? zr8xI^W?pjMb9w$O1#>8!v$iZ5qZL%|DY+Z{uVwoCBsQ(s_)m4B?x0qGD`pWA$1Fgnk4My*il zYy2m?aq6yNnHbd%H_>7!1kp%gLMk@Zkay#vX*q|#qcabJoreg#2N*?XP?DnX6duH2 zgZ+1{w}QLxZbs==4SA%kBkK`-Q`&UeHKWqaROVIRFpNU4>vhtFRh;|>S@(O4hHBhc zADFLvOB1bTLD8;+0PL^H_Q-J18(TiPAX^!Q;YAiz7RE4Ldv!`r?Z{^I&z)VB53=`?;-E}|O2R69u>z$_Sq(=ul8V^KqW0b)?Hm@hGC-duiE_5E6d7J!% z1w6%XJ$Zta`Fy?eZq)w_^g(B%LC9N=fm;c^FFGHJ>;7BaC?=|J2}z9VTN9f~>MQzJ zV%~GxT{3EX9%?5Lu7Qa*8JSD&Gs2N%uMNT9|JQo>-$I`JW9t6Pb`RX=$A(C}&X6lX z(iM-u53upC&;9Gi1lapm*S=Q>j_H7>@h*EKD6cK-h7f@N+BAm2Nj2p~lPP}RmeZKvSMwlQqI#5epssEo zs|kg%yaM0@@Vz!v-Mv|*;l43tbm zz6PBwhaq90cC?ryN)1Y32oUIN{{0*GZx4`m>%vZvdiSZI(k&%o;&S6*NT@4S%=<7K z*zPI@#c;+IwnSn0FW_&<;8tt{4iH%kP)sp#4)8QNMj3U$&@uZ!{tf9EIB&H?B zk%YPw(cw5G=Z#o6gq4R=c?-uAipM{SS|D~-WTijc63G%90(U=LyYb@n%8Cm9T~DZm z3K=9g+)RU)bNK+@UwoN$Px|O&%h%0wgDPfJ;rAq}f2P5Z?-r^^8f47=Lz0TK{TCu9 zB`~xkKm>wbzNY+SfXE`qv4Mfya71`XWxER<7Cz@`dqHpLCu6oNzfAb-4m}CN_rg&= zWQn=IHuA9UEU)hPengCz+=vw9Lz~tgDod6%$`tt;BSmBCXHq+AI(C-$K;~B?uqE+I z|8}!lo^@J~*?oZTq0=j-f+lD0TSF_zu4OUI*{hK{TQbvJxkDp$00`49%+@f$A=Yh3+==n7lD}G+Fco=bV%y!0Ty*U)TL^16#Y~<9 z6Rd)NB;y6rp^yE6uj2P*Krs5UteS1dbxmOeQBK}aeY2ZO1<>XU2?y7AJ42CYI4t`9d+Ymas{y#Mb81NIhr8{M1WItWb;0prEk8}wGiTg=hFFkkjin; z!4Ii#!YY}#4Hc6ibYYwI*VY-jIV(r)o1(&%_z5zqd-v*gY#$)mfDE$hGEJ%<6HK)^vR`)RsRQbZgM^A$Go@SYpCLa~|`~XS$ugYJX1gbjqh?+FxBk0-R z#9ndgS{AdaW0p@ilG$p0!A+K4F4knz0=Idpv=%+}<-9Ia$(Me{h}ctSAy2f-nCC() z*XK`5xH%HA>}VdC)UTam+oz08*@(pze{l+Ku32FwJc4|6m0)}*5M!Z~VUh;wCx#EB zDhINJe~CWF^^R_y&AF29tqDC*Xti@2z*oCwu2$ z!CIr=a4j)n1O5sA7aeeQehXFL7KmWW;76@GKc0^r(KqM+8TJR+mz(6O!(Vx#DLv4p zI!yEE_~PlOX`|+&GExbzbw!!*Ty17!d1SYjoENe5h=A_eT8S^L{kaJ|tjl-toWvK{pfVwuMgu9)Cm)e@uY6IN26o z#wryx6C_VacDc}_h~%qPmlQ767UF-5wUtW(LSVIHP^PxaOhrXQO z*_t!m@^}Z`z{=U;xLVEcDaLUO&>;=hWR(iXArykA3u*>MwdH+&t6AjttAL1w*G#YsjP3r8|7g zUzh4R(x~0~acTv*XNuhYFuE{SCASSnOt1zhIof}C0WdISGL4mm3Kp;yna3WTu zX?iBe(iw&t&Et%M12%RnkcF;Fzj$31NJ3i2dLvpwsFE|{Z&Qb7VkqjfPo)@T+xC)6 z1^1^fpQ872)zkb`ge2mFxTmT$4%Y<{h|C`X&n)J$MslXsux=@*-tZZrKYMhH(RWpoN0jMn( zke;$MLtwBS3luBTgEvssKB8h{g{r{$pT3R-LN~-CEphuq^^u*zefSG6e`=EDhiM3b zZ-RWwS*vlCv;vSGM%dYl6#7l@%?_{VU}y?@3~=WnbGHg|!MY{AdCwMK#sGd3QwvN+L{$P3qg&BDYAf6b;Hi59J%w(GZM z@MT@wC?LX|7@%eADUrcY6LqK%+fB4hBoQoB)xTnwO_0G1P@0(ugXGYmz73C&haaYHTk|s! z#{t!tnPb$oe&(Qvw$MUvC=GNtr9pAH5PD?W-4XK%fg|AO?8EjH+yddKX$1+HrKRc7 zpfM+96mr-PV1J%<+vK+bOWNNCUk?F=RF{<;2m&nLE-#N*F`G;~A3mu$+Zg>%m6fMc zQ9zX@eKj>V^#$7oVYHDdvl_TH=MEj$a+X?#O8rSB)kdS@<%CW;Tp0CS6otjntZm;} z3dx7rR3yI*E&@Dt%?KV;DBkQ@hic#R80-91n}r9Go;jN|$R-06W4k|V-YP^C2z}2T zLm3S{w6+Z4fUSuj5oOM|HBtwTyW9#=cQ3n9eSOqZO3AXWKhRDk8jKIC{^9vQ6=!V> zjKno*XfBjvS2<7pdGIK(_9^#6Q$q?ff`34<&)l50KypM?g?LM_0=B=_7L`DIzl*$i zUq1hS3S;X920wF&#{Pe2-wPEet}H)@knE`s?n-&jdMCIjg4%(4Iy{fKi?l8NNra`5f!6{gQSFz~nO1_rUjbq3P z&4;e;x#V%qbqX}L_btb1g{MlFUJnn~WB~uH)?xTiojqKqAL@*)*)`pgIC6k(se|K% zLNV9G$}rE^-1*B4O+%r?cu}^?XhVSmvQMC)?r>B8FKJa|oi&F-fhX|#b$6xF_ z$Pc%>Y0NU-RV#3;^s3pyiY2uN6Du(XFw7X8J5iV?%!i`zcVUnM8Jk93f%ymBK_Ztt zh-wzdU9vTds{s3OMpkgh(cGN>zR(BJ^_&uzB*n^b z{yWr8bmujs16fjr>bK;dnNp*7Y{3{EX}4>tNk0y+j`}AA;X}u=x0Sd-Y*~9nELvOg%vEENpN^!n+n< zqakw2+g>|tzC9W3BFza?GITFKcG6)voEExpO*t8I?+d_ouYsRl3leXW-Az#;C_$~4 zlkJ?>Q`A5&LCNc)Py)UyN}vuEwA542ks=p3U$w zmAeL%=`M?}0_9aDm?eenhdZ;l+2{13bT!%1E~$TgUCVNR2^&9lE`e3K{2mu4fXnTn z@_(2lwkN#L-O+{(r|Z1O0KxzC^{$tNI+xryJ;QPqwg4Z&6IR&9=d+ErxU=XS3+TqA+MmU%=x9h}-)(r^*Lxs(fTZ$=? zimy2-mJ^J>1-(dKjF-nJr92YNl(o~XYsb&(%;Sz;HoqS^low?{EOD|Oy+E+CDEO6U zJ_xE>P0>=1s9>9xR#IZf`EuBcCL>EkMcF-%nl%Ce#}Ydotm(dnPnWB@e@%`bSNI|d zsF4Az&2JXCTS6nQ&DK+6_yXaW4?#phhp7!4KNQgE9S6Rhj#5=L7N2a5o~$2*Z(}3t zan%j8s(*ixT(Zam%L!gEA~AmaL-a}53VwRQaDOY+BE^V{mQ9ycQd0=6%1`-mX#DTO z)?dTUqts2IXspfZf<@Anx4Y*reBu0m5`%-$E0;*RMR_20$<(e2wc7T?YxT_$Rt?X@ zx)Z_H+IQ=vtO81^Y7N;ED~NJ zB4t`Exv{7Z+Vf(X*s(|qE!!@F0F`k9L&=r_S+vv`{bXH3frO)MM^g8@fqp<`fmF2N zcCk)mYI%VK`$7o4qxtW$(##^M+Cf}d=mmw@+dB9xZ+>K`oZE8Wkw#I;V3&nOd`E68 z*ZxHl9zd(PCa`FwRbr_>v@5E!I{~AG`RD}&5E+EOt!-a~QO0SfQtl!*5!ZkPw2C6> zB6A?mQXH{fCJ#q#IQ4u|QKctm!!krBFD9!3$zl_s(kFxHUvmbvA1lwjs8F%w-A>)J z(CtF%G(Tzm^NQSE%pA>FPbsA8USXS)GQ3m4^7P;4wYy&zKR6&GuAxa}VC-m4zc4-3 z%rw-&a*zFD@%L}TxG{ug_lV=J;4M$+PK@~;2EkzCgLh`MpOdVYDnw1*r2m-_GbIE2 zpt&|iI183_m*b%S+7o3x#+T1k2#h=KuZ(L(A8+xyi5Yh%l(#ZMXQ^`B%^uG23S5SWudDIC!-~ih2)LIg6^8TOsg}wOW2VIldG~1NY)UpUc&X!Q(R|gE z0t@q|@<_FL#7GVCmn=Q?j4aGcD$sTvKXnG}#1LZo{tBK=e}x$HAC81z{cFulIVHHC zy6vIbJlQnFeGgSjOcLtV0KIfzJZ2+bTUo6K7wMFk8E#F0%vaaZzn$fd*Cz$({Lt#< zv3_;)L#wP(U+Y;z{*0m!9+q*{UnLSX&OJFZ8i+5D=?|~Zf^8&r578nswA^;u4jHh- zga27uJr$+1;awMy&;07XxZ2h&`jq4IJgusz|GIeof_~(PTOII4=Pp;)rLzZMD7XpP zJPphKgEI;*R?m}%5s3fO2U`aN?Lb&*lpF-?Vg_O=4qM5jb_RZl8g{;u!Ns7d2~C@Y zSjZ0L@`>d0z#qk0Av2be8Rv(Bs~XG5u_8=sQI(h9w}|ajW|tMBDX=uHz%1P!<}c%m zbPJ*_2@`CCAiElC3na?(dvSjPR}}nTPr(1V2R=^fcF{hs(5`F1Wo7M`Jz$tfqL*OR zDc|}Z0heE^m}$_HB`S7B3Z*gKm;SzR%1BSf^$_`}k$QtJeJyKW6OUSf=hpMP3*4|Z z^y5C~*i>F8SP%ZbOZV@lf7WYHcXASue%Z?83lNi5N^~P8*?9;3a7uy?H^Wc-C;W8` z9>?Xzm^R6|ZB6f-YN*i^(W$BEv1SzCgMCOiILmsUvlzQ#C4+{-mN~Q)RiP7Vq)=8o zVqTmVZuhnkzrys$Kj+d5>@nL(Hl;S&I=zgI#gsR-0SRi^_zQgwgUdd+E;>M@fzAWF z2xoa!dkbCEvB7^@0HyK05P*v1*Z4C~3cuEVN$!&%Mg8Qru@dJ@EF&|f@;@WpP@5t-W)(kU+*;(o=m-~unoC1mi< z?2Lz27=4@rQxV+m+{5wn{`is;s0=Is;Fc0Bg%H_lgd$Fh!IrBn+_j}(9W$~!I z__M1b&d3NRlGD~Hcs_&L{>xYCbLkK}v|Z)OPOVGguj%YmMWWqw+;-_ALw}GxZ1OBN z-U^}l_pIsLU%C@bt8&t;S)Bl4>M&{mJ>`w^L*J_SoVb-|0Wdk?!E+`oe_F+6_hnf| zy8$Tr=uyG#9IA3I7>Z7+6B$Fyss_b~u*m;@$o!yO16n3Uuqa~FzSY+We zdhT@H4l?y`VrlT2j?O%#X#b@dP6e?ILxY}#lq50JV4TCT;I`L#-v$3OC1T%pZF>iS zysywccRoYE2JB+hP4Lv#)?UqvzN7u`Lrm&_)kD2^8A149e;YVi^SerzmDNdZN~;mE zA^)GXm?Nv+A#(|oMA9>^wgQa2ooQCFU)c~x?u3x6+xTBvXml`W6s`A~s5j)lXhd)_ z`rb=t&nEZM@t2^_;+}}MKc2phNmrg-(>>SSOVDAbr>AZ(Nee7ANJj%=L2(#d=NR+k z!>9d_AnrI_()G4oDB>!(>fi8L9_dqD{{BpBUO#OR+D()DrNU{&KLYqn@t2E*hv}IW zS>^VVS&|kWuQx4->H07aquwtRI{mVJN^MlknGvvTd$l8K6y(&Ej+np6nNRfV+N0De zTz4V58|rTQIRjkH=X7864lbJ8F(UiH*j%2dg4~Qz4=CM2UBOyG__AImV2QU2(=Ke- zSbwM*Od=GFzbK~I$g7H>DX&WySr^P*%K{Eyfdv7U4SAP7!rjT9J(!Kv@~#N7=`fqR zo_d(!0=d~q9)zr_$Px2anoK5;dAQpUAC3&uYYbEYm-H_WK+0eO-Pe7O`@*3phxj;o z#9{=fx0Ivtv!Wg$r5+EeTPS^D`uM>dGprlVVvM>lv*oC>9JrHEiR$)5bukvpVJf=Z zg$+i?D(Zfc_Z9yOh5Oyois-Ogv8zGEzjRRP=z>r7c3AN5uSHlIQSj8si_G`!0L|@p z%W6-$kLV;_0x8h!s{N*IWUr8*#f##=)Tz3h@=>yv3#wdwXlAIZ68di7$b^jmC{bn3 zj<^#s$_vT9RUu@l1T86LY!w~mXh#nppNRn}XYT?}alK2nzGH1$4*t?5ef#<`qvKyE zPN)}eTJo%R2|8`N%iOtin4zN%q7_6UWqQ|gyVQASl6fuKdd=`{54p_dyayUNrOz>H zQ@BpdpM8XXUD%1Z&5d^)?hYhH!~eb;7tD4$u9%pu=K-#)DI}8r6|pK|F6U9Aq~Opj z8LedjBo{TR#HI}cel4QIu{QgT4sYPMtEQTZ#X;rRNF*m4I<5l{LLTWWVHi|^NXsT#)RzGG=Md zzsP(zXALcROG`nTS_00Km!^sRYvo-v02wI}>N_0ddZj2|IcC?Z6 zFrN*G7Op8v4X*h!x)v@UOC3d%@(mH>Mv=ykc%-%&wf3C>u3L>pi-XHFg zy**r?@VgmgiWw3;w1y1@=3D{xYM4)`AYi{kESoZ)DUtshu6EvdNS90zkj$+X9Ub;Z z1-Y2Pe8GGx@w2Q3FT6uOI@TIpoWx%&9+=*hf+;w1noU60phwUTv`?E)hL5S~r>8G3I=%nB8vmoxJYH^%f{AoND^a5-OE5^Q5NR_Tct7K+^{psTeaCjq zv{Aba#VF<@vlwuQNkV|cTx(kAURxkRjmFu61aZ8+=Up~&JN!ZcD;5S^z7IKdp8Y%Q zd;9y)42?G%+;%BYW^HTHfl|$ZA|t?6%A3Y0$WV_pT-ZKv2}aVAdQ2v0C6yrLyS^Ta z7{nJq6hqXo*&~-t6@+d)^iY1FpPzZFmg01KSC{47p2ZivehMjme?Aezl58@7L1W8z ztLdmB$_#hh*r@NBn0Dif@eYi!K!`HGJQhV6F9#6ZPohZQ5&9BrktV$n!4c|o`|xf5 zr9cHELc>vFsq&#pm@lOM$Q00qo4-dFolB!*EE}KOMTv*>e^|_K3ylnQlq93w*dc3D z4Dh5Eibnm>x*{#3D_h)9ByXzLc#TvOc<^;}jT9#K-YCP@O9I4BQcO=-#L;(Tp6~Ct z)bm-%A@EzJ>a&v_rqOJNE_O}%(|jI3UTsoojO?&mFqOPB=I$#1g^0bX!5m1{%aRZ6 zS-WA@OFvN8k=iNFusQBogeQn9xF?KuYtb6&K|R zPlGbb0`9(jUG0s%ZhK=~;~7*w{*_QdaD5BrcW%@1TMYa>cQeIl?gHLgao4VYw-f-# z9=qz*QC`|w5=*@aTe&W_ePp+A>XM(Uh?tb1h;99l!$Pgj;|iWcp)V~0?!bkOm}Mxt zDcSL^U)HpqO0@e?2gLGCl6xGJGErs+qS`<9{PmU)0#Ao5w7Pe*kiImPWOjCMCQj~p z5X1eOvn0;OKmn&@<1ik{46lPIUzgdbkGq_4dtb*aRP7Sn6&IJ#T6^nbRMJ2V%g@Es z9$Jvl7^smy5nAT(K_pf3KW>7=33CJBRmE{z+M)PxoonPaBBDE{J*7o!3zN@^Njapu zPK_=Hw%&h#@|Yt(t%F1(1-&n}i^-nhy?$?~oiFl7{#ROH!2!b8Qv#F5QHoAt9sJc%`YbSF5yFm z7 z+Gt4I>U9W~FukJ)L!o}neOE;9JT1++0WN}5tDXtR;|VB_)qdG=DipY$TL-qe)LbkYT8BF6{bzOgXh zxsSzmsRAGYT*fY6H^owwM0yu<9PWcx)lpTY43jUP0DW_P^R$pgMlF{rREX*?gc4v9 zo9Aa)hC)H5pheduR0(Nmu_OjSTtNRdY6x5safK}(?>*>pd8|Oo{8b~D#6KCyB&|a2 zYRyhJ!zCxqW+&TdjaC6G)^iEhuq?hW;QS zuJ83jv0ddXkgB&K!+PBy`bN7~Vnj|`)&WTodYQK!xONQO9~{qw2zFvoyg;Tu^PbM| znmp1Symx}Qcv*Ef6X4Hm0{d_iNn)?bzzpom!7^>Hd`SQ?b(&@423 z-ZI|AY5peEW6tI`f*RcBE=l6nMcYMv=_;7#dPzB`UnyMS?Ck7iGya~zT^9+01s(21 z^(?X2a2`&#L5BzLB^IM_Yr)Zk<L>pRh^HVxcjmY^hSfSLvrSnxA$%ST9q#H)q}$~8N%gN{kovSfJY}Xa+v9? z!jBXMNZm`O7n}2cd;WNsBc~71JmQux>%1qY%PR;@91@OtZI*R9 zka6=Z)NO?kDm2d?Jh;9eHHrf#!hd1_DU8~S!~rR?!>2s>)rfLR%-t8-jTZWBv z9s056P3so8Mj!Mx;B;;+1Fh{J7dn?K{HK%gDAJ|l_GAPWh0=XTUnfq4a~^dMp|<_R z6>NGhW)(&>ZFOj9zwwNAqG07S^uAQ}+P&uW^v=UUEWe%@ z1wH!r5aHqBd3iNWY4QCq(cju5#`k&tuMTh~@WVZL(tkJM9gJsp-mUN!wc>~mO82^} z3I4j2lb6){P}OVQ(DyR=f)}``v2~x@?t5!}Ie=xmwyJwg5o^=pu&^}BuzUwp3SH#Dv4f2s?9 zavy7ip9$e{)UHD5FfMruC<^`0+&deW0dPUj`9X-k-#n0pX7OVrFJdPqZ{4V}UF8F$4j-j#KV$?Y`{@WmOe`|%Lnk;B&<~e=? z&b9iV!bD@tlVVDT7TZ-=AAnX~muZ5rT&}9SdM)&@$lFGCm;B`O_)-^CGRXXcK|c1M z{#I?j(vcCHIefN$194Kdce95tx0h*0zHOYUO-pE5s;at-$CA7fo>nU7;$6DG_sCb1 zdG=268%RPKs0gG)IV9))BtGC(!yfG2LZ<8c2(awy!=i{A8j6MVA5eNR?LsK*r{Tmde_!}Xlq+$y%q}q&T+Im8CsMz`xg-eSvB?jk z{VbxTor{CtPWr3FD1NUoAb0~!X`Bo8Ie>x)NnQig?XJYm@Uy1oX{*a~=J74UB@^vN zm~YFBGi*6|xYqQbTQXf(YAHoThmFGt0}>)^HFkdChH1RVcF6VT?}9Qd-lHc_A1uZN&k~+WcQ8~T4(Zk^%FHHz`#6uniKl&`2mhF2h zVGBGlHd2ap6OOy}g(FQ*$LzS!a*f1q-g$Ng1edZ6a+v!e{{^T-t3nfFVP|pUMK!{J zTDws-6#J3bx`6qg&!3J~*FJ%P-L?5I75R`r`_O)>F4E8G-XAG+o44i8do^x>|Db%X z)wYHW4g}suE@km&$nG5tO`LD4TEF}L4N@oHZ?NmKnyHz zfuK8*F0ryukhAUMbE;p-tDghH_!}m61>D;kawh^Cq9gI)T8YcGppa4<$Y7q}aW(A+ z1lgKG+|Fob8lxFdDVausZHmMbUu^n?$P$NjzQUP$--E$gcqUvb_4YfcF;+iaGgsCU zLzYS5y$gPbACeEF2PKedl0sk|NuLJKmVQ25ot_06e(jw4YP`RJ-~nBG>Rs{+*p8hv zn-a%L)(y#sBW4m<>y`V!arC(8+G(wHYh0k#H*7#DRs}TbO`w&lsqg#_J7ZYRxJ#qs ze_e^4p1DZAb>^Iw{8x6+1(C6h78>SI86da2#KUcfqzl+rZQDlqs^SERL`0&s$j~>?MU^R4o*- zZqXs4$w#M;hTc)6qVueUAge7?(*$PUdDkzAsXVqabB#|3>AZm zp^!~X?CKCq=b^KTDO^nYf12h8lKyBgMn^BjV6UF>Sdw&6)Zc^IlBYX*Qw(yLB+$g3 zus41)d13n44dIKPTVft__Tc4@FYJOtLM<}8zB87{G$stua>ft_fjVXETDj*A$}0(|JYS(Z!VhJp=!3YwE}(bT!OHQGbiD3gdG*=VU_!%`eD36&uS$|J;> zk}SSSPIkvH=@%!iIqglq8{Q4Dud-QA_zt_lOz4cBJK6Tf)oxacgggyS`i1Ijd|-t% zv*O6Y0_ts7!O!=Cr>?e({@R&r3 zkM%;0^DNR_@xN2=o6(sHR#{Kp2CR2n=*pYx;r7X|O9$kYrMiGm?)J`kHdKg{6Of=~ zQp<*piAQc^`NPo4(+FdWq{qdV%!6Ka0}aZUl|(66otEEzB9p?T9J_D{E;k%xAEUwy~N6lJ0~={!FEyfacz%36Y3YoNK7!a^6q<(3k%CDoc>&LjG>dPWK=GA}YsD_$9ahd~;FCs+RNG)UDA z!!2Vl3{Iy@rCg7=!ZI3MN}H48V3pwXi?*J0!tjRi>mEnE-3B?23ZM3$5G-~1ZN9YB zYDOLS4H5NIQ;uk>+Wkm}1S%<*2DN|PVhB76LO=@|aYw!;{a*o_d@6wc!`ekmPZUge z8xY=;_vcA(WboTpa=gUKP=Xsy2vc~fnK}}qd;1?$XJa2FX!LEGqL;Au*n1S7!hWa! zBP%$~e+^z=Sptoi@B;$t;J0towuTIj|2x-?>I8%Ihqqt+_G%Xy?aX??J$v0LFzDr_ z1^dh-W5nT%P3ckX?2I?IA&}qA26pPX?n6^C>0*+gdMRPX@G&_#yT*z}QdQk>MOo?c z_exEt+^m#CJGY^-EIw^mcm1ia^KJUvSr%lYC`?x!`rV9T>zkpVbb&Nf6PyNRWKmZ0 zRnXBbJWy-oK>2ZksaPRPdt^i?SbFd?VoAqHIk3l)i!CcnxFqg}BC!Pgc=0@)00ss{ z;D8bY8f&<+3a&aJkxJ@jXSkkSo^i_DrQZMPoS7W+YU|l{P(h8~8EZ!s<1~_J=eFKV z-hC)@>O*MPxQqv$`X4VXN+3svH;{W3XhX;|cHMS!;Q|PeOSDHigDznql;x<$EgnY} z{V5Y0?s$?8`00!yBbmZo*Yx%WqtMmK0x4CkN|EokZ}XOry=D9_dP)(W!f~K2q;ove z!5&QA5bMBYU(%O6z9cH9-Q!0f6mf;Dpr{6m3j=U)m;rK|Ly7KeJWl1?EVRC$XPoOz z=WCL`)>kb8XJz`9Bk?qWLMU{8pL3Vs?&J{21>}Ng(MqTvCF43bIZC9*GulhhUZHkn z^_w0n(u>V095@w16fz7H68(Ng#aWiTxfw?h^ryJAtcMJl4!N|OgA)NdqN=`7^4OAe zz_IQd|Hu621zjG!-`dql7c55J`{B@-l&zpI=Yh?pCpnTX{hgGd9`BK6;b=*t-I~}0 zO?+{x*>E&3^tQ4fX8wk6uB7`yCvLz51m8`nc&ssgZaOar$RIrq%Tm+r9E(f+D32if zD_3^)NZelRJKB{xV(tA@9MhP^ZL4ZW$kTPenojw;a91SOJ@y9EJu;^`Fu++0Uj66& z62>25pI#SKE4{wP>rR`2Y2{OWTpBD8RH*y6_|LpKYX6oenO_(zWPhU`Wdduvys`qn zqGh6l-DE>qd&TT-Mw~)NYihQNo4w;bxb28K|ZFl=8 z{6$GFO{yR(MRaI_T{94&zT93w?6x1&Hg99>hNGv%TNHoSZqzeUvzXI|Pdd-ffs6JG zLy86!iPCZ&;WzR`=IKnC1AL5nmDw#>k8AL#_9n zsXSWl2)LG|(fX4oL}L<1o7$|X?W}svrA><; z!m^tVQqNmR6SEE5()ccW(=LnX8o^Y0?2Y@{2J4`U<>3$m4KqFJMFE5GLOuW`Di>b_ zht@v($IJkiPo8Gif#4hGPlKl?kVvG-^FE!)m$usfFIfNX0lV>bY=RDLu7tO4g`alF zJ|@5kN9zNx;GUVD^Ef_1(J=SE z9rh+iU6^$Jh7AX?q1^RBKDWm%pG`DycsO*>Ow`~lcyA;kq@YGSZhnY2p>QH7ql-Ml z9M`Ib%Oi;ag{(wIMF-RV6e8~ZV>4&3$`9eenv!i()F{or?bg|Cf z&$-Z|4PIbsIrwHCR4J?KI_C9RVjzqY)O~WW%Lzvz{=w_~h6x&cz2#P3&pj7bu@;M5f#`_z9Z!x0(9sd0lT*V=xcgZz8+lpr zYE2`OHvQ8yk6L#6A`z$Kk8;tIKEG*4sgSN+pDwshkfcX|OuC2OUmwAFEk5M(G;tZ>t*S(`yP0{uRd;0u1lJJ@J>0IFg*vmQpX{jX)oz(K zO7qZ|5+`0wW~zGd8v8({X20?^{b zY8w0p)_T!QQx-U;+e|iO4JH=pIwb;Eg?dhDiHw|u=u#4qg$}L6nP51;yd*)V#bnx2 z&u)cm1U_7rIqJR!>$s%Tx;#gl%Z=X&>WoesT@ZZaYz~9{b*|PO5~ef+AfJThWiq8y zhSF_2@4n}iiZh+*F;os1!xAo!gO2a3e(}iDh3bR$b;4o{Fl|mEBd<->pH|~C#vF=y zi|E_KdBxGW$o25gzb_?^c$9y7+d0qa9|W#5qxm@Ao)Rr3Ml1RDoy5f_4ii$u{E=o* zdP>~IToZ~Kj;l=rgKn8unDL`Bp><+&@-f@c27zQgTWH&Gn~!1iG<)EltIq+p_c^xz z?EL$Z_eR?{H<(**b%9t*lYv9}g>hmxM#89EShBDcu^9u;!6K8HBM_xAp+EnzW)Iym zK$H7)-TYyC`d9YBAo99mAA9lTrqgu~mX(by;p5}1X=WGP6!l-zAOP@H_#Rv2p&?-h zjQ9C_YW(}-_5Qxh-;wka71?I%?!R-n$3}GT{o|JJBiq}kNx;7^H|ZU<2(U{_M1i*Q zI#?aaw}`k$5k@Mgq2nzF10n(0X0h*1qw=S2rjX*qB}Z$MYv5>Gamd^rH^mcBoip9{ zuzmrJRkY|4@(e)H#!E44yn;8jUe5U(%l_OcaD&dEgSFY$E+ARY4&Ao}-(au;sDb-m1wg*1Y1o^EKOOXw*0UQRN%d=Clyxp6zEe&LoC$4Ak;%Y9R?(d?lds5u*mkwK1=`u0!Un0u=!fI>d_wV))6Vb+@O5J zawlI(w9oTLRB*BIa&3bIDwf@#a>HD=ca^DcFD$_Q&@{CjEM1 zY!LBXHF~xTMLM?}lU(a39|X~1jdWyON5ow!Lg`mFoHi3Tp(%k8&0@}k<*|Ga;DOk7|b2h@CJCYh4`@!U)AZ4J-4RC>Cb4qu;(0{TxF}$GDdN0YFcdB$j&Q(@keqWHO8>=8N;_@V*BLq(A$j)*B z91G~>&*J(4N;GBbf@Y{viHZP+Uk_&&L+V|f z?20Rbm}GbT#6nxal9 z^_|&t9atr6xre?t=tAT@)m#+ zR}!OKEno9zF<`4#33YD|meB=TX~+Dl5E5~{Mdy9=|6Tx`x3ItKTwhn)F$4c7pEfyv z4ccKR6MXTA7jogUF%MtsbGm{5v+5wE@f;@ulE-@l!o)P_N=NkRa{6`*{`gX8;2=P+ ztpnIPcIIRS+TAi%;xYGb`<$d4>VxaYN`|JRWzp7#IIj(#Sz*9JJ-!{=($_9#BO?lY z?3V#ISt6U)$3NFqQoTBIbF(;cnUsuAWIpX=Rm>YW-~RZ6#FdZ#zdIZsD+z z(|14oe3iCcnIr3X2MPld$rH07yo(Xq@(bKAqi7WZh?6AGIQGeU2-MB`^nsg8{}bvB zyeo2!!g;Or!>FyaQnJW*kK{VpBW#wM^gN$vajfQ{PaqkJiRhzF2v7Rh3%Dp2@ryDx zzXyx1%%<0`Dv6v@Ciqw*tb{N3v%xMqd;2ZTyYG3>RHo5hxwvP0`N31x&2s%z6gPQt zx4Hweb83X6U>**Kuz5Sn#AS&g;xHu=D$ zHnZRt%xT-7NodB$-lw@+#iQOodF_Bwe7kj9U zRx8GX8PIsCu6e&?SjB836XJ^f}upHS078l$IpXBwOO&KSQkE4`K*ovu)Nbb+@p;5+*BCo!I08*WQROo@;bB zvWzsR&VkbE$MTP|?Q_W+zKFOX`Ij2z!i&$c1V6bkB|W5ran~^L#)O+`Bm5yQ{Q&ED zQk#Vz_|oU6W%sxn)ywbzwOyfIr}Ma5;pzfxO2j9ZhyG}cgm`-`5)qD#sTGTNdsu%% zEk323v5nF=l2*}~6uI5yJW=5}d*;WVO6p~zMNnbp0LgI+`K!;W?pkZ??Rbds{N{mU z6eFpI`BK+W*O6{Cp>w9XZO`rPKnNn>r|EevB)a(*J7**5Y$i*M=+_0is_{IAhzv3$ zrT3O)wAR=1gS`#$si|6zE8|Zq4gTFP0)vjMX#S)4|04qaYY(39_S_J+%dCG}H*Y1L z_{DF#@%}Xq%?MH9WThpX)GQFc$;GT~wo79k@fP!cQyfK1kxsV@+mjJCyZd-}&`gtS zP{&Z!MJ#r<*$Nct9YwVpSS)6w)*rRZh1<tu<#appL@0od9n8}-M%##Ci zm%c6B$ir)I)|7Ajx$^C$-<0`Pcw|OcPm~x&rJ5b>!dv{f*HxUJNIw2X=6#-%i}G!bO_H5e`#UXl z#TXgvL&R(N##VGTX@pQd|I2L@a*!4kc-+uL4~(QZiapiLqlpB!%Q?3UV9>7A&1(rZ zJFfM*7TF#Qw2w*yKs;DmhWz?LLqDo)x#%2xX8l!aZ^Ofy%S4JI!02m)lK@hDLL;;^ z(Yk@M<2&edm?Oq1#Qm%f{Z{C-Ww90HA5H&@Zo{5JT}ghTW;&rTy)>fIMC?xa%^%|fS;}BFkf%~|rPLVS z{5bKQzE(A@G-y&Sok^0@h$x!5BThIKovp-XMv3ejjzrH6)UbKEDvzB5n@U;~sltnn zT-dH5a_PXJ!YW@LhZSW;rkgwG+*Iq!g0O3{JtYDrSy8}&zE-H$D`aZNeHa6#Gpsm` z8JLMBc$>7@2<)d=XW=QJN`*;s>!69(<#c$Ph2GSGx`-pM|8g0U$;3S zG`F(OW86lf3&TFKuks@kMQ`OzHkD`7Ctkh^_WXM>24T3Cw?!?qU5!>P;xi>}awy-` zu2AsdVA9fo1PC$zV&H-Fhr*@z8bHmt>`D|YEm(JwB74nNia;?xY^EiYL^2d@2NY&l zR&EFdv$v)jGiiyVa_UcyWRJe>N}Hn`4;3;D>P%8y8X-z3ZBaOxYz5THkqAO5+Ki<3 zHdN0{PDBD7p^w|Ya_J7aVz=Mhvp2gZaP>wD+_8CVY3joH+l}`m_xP6P0oB+HF(0`4 z?t_mXeB%>B8r1__Ll-^kCA1A1G-r-^+i`-28^I(y>1^{VA^a|gom-I>QG6EPf$BYQ z7joaV?quTak{@>rICt57AsaAxX#HOElWrcTw&aD%m?CLNBywtvW5o*2N-O2FP@H}( zpmurzbD{Df!>A6rG}h}nGyCF0S~0;L1@oUd7c8xYZdAO2t%WK9)ad3iiN3*rA3Nq# zvx#ip7L);zVDN8Q-W+x1@V9Fiuq-V^Qla=})->E(1laaD9|mn4U~vq%2!yd$1tQL$ zYrTK|u!e6-H&UZPc!k8ZuEacE0(d6M#;q%3Lro|ODf@20wQT5CqCQ2jraIiw?E)Mu z7^aR*CDV3&ZcM4Qg@>P9h3$xHMnCdwBC>(V`ti-~ehmX6MAb^!6h!;Qp)6Kp1Rs;s zeP1T-ri-f>J;s{tv(64Q4nb51tsYEKg-90oaxZQ>WhSfln(ful_x8{cR(aiywAY^! zQp1bnVCC@-0Q%B%(QxJls9rE|4I?wL$+9iZy{eG{LxEt{e z)iE@gOAGidZx|ed8qSQJiz$yki$?V^sb61iEH-Yhbp+h*7@%x;6^G}%aMn-iKYyV6i)9@Dwr z%Ki1jNp>AkkRNDH?pzbA^R`a{FtPJAhk7h)oIxRk+d~-RRl={ypKkAO^d>43qLw zrFL6ctTb7ID*5>UB7tnSN_$U1MWd|X6fgls3&&>2DAc+_u2t)UIxW-~LybtH0C*{E zhcbRKf*O?%Ljk652X_$4MVeA_OG?6of^wY&9Eiy7w^|oEM)053uw=zoevFLIEgpX1 z?jeR+!kV}>q=5%>t=qML!^1J_J$-`O%DK7A!nxn6D@P_OV&T=Ihx;DY-_rK+f_+$79U^-zQ2{<*mv4mt zN5Z9=b-0F}n<01*LxpPpy0XV&?-lOfAFQ3x>VJ{QN^N_XYhqxa>dwK`pmS z)MLUcPLiBbq%Nu(A=0kDHXP$k!!jE3PtGUt@O& z%ezTwF`wQppTRw|`7G6tza5?oZub$2MoLjYHtaJEbhV0e)vg%{c-Q#d-pea;_?E?C z3L40|c92`jK)*+s@|NY{;mtG&!zW6R5;r;bx88M3uLkE9jCg?TK)_K_W|8iTvN+!X zIgVUH>x;f?r1e-2B?KdQ-6mszo?EL zAz}FZ*@Nu+OK#Go>IL6Pg0HTmh z=&(D~)ANkbFHKO1N90?dcI4we(#f@J@8^f*waDx9Vf$sy35<|E^bi0|$3=|O=ZSw# zd#z5#irc64zd?^jZ^H{__>vnX&YQrUbUk%m z!k<;%0SH+GUmE7z^@=yV(`EeYovHFm+t~@j9^Dy;k_F~-YAT^_TWR?(o(gSrehPER z+(SiBNS+6eLZ|F16B~$j|7ZL2fR{1nBF2IK~qA&5DN_HVOP7*mIgDv?ghkCxPGiSF>gE zuqH%v;}mXdM-V-<6!UQ5vzIRTNtO2R#W75I5a&KLxN61RsPJZGkS~v-?UC*+z^|iu z5P#a1G3wSS8w_d&hS0N1qMjtzOgk|C^P|s`pK#M_Dd~Cs2~2m@XeQZ|o?qFykr7YN zv<>3ADi=lTU-v-Y?d)#%6(quXexGv1fDt`G{Nc%Jn=fMB^uKx!aNQfD68-ylfmq_` zO?}JT>+k0mvzHe_{ohRCG!$=Rh&iv9Z(Q`BQgDX9cK79hVyuh&%RtwY#(F=(fq?Fb z8r}xT4feb_pKE>jze5FIFF+zPgKBP?S7l$|^#xAOF+4zhYUhZomlq)Ij+lhQpoXj`$;4o; z13QOE%Kxnlb$q|#RU(Ic;%`Iyap&Q+{ZjWc?#APA?rfGy{*V#ZPr?$fMBg^9b{TX+;>)SMACg+giJ>GB_1K^H5`T#V zsCy{Doji1Bh!^5aVwi(Oa}XjU6{F|%s@H00aep}W_46d z^Nl$8FeW!jj!3bR8%7Bpu(iGGG6DN8MA>@YnxG<(+zky%+NEkz_n3CSaz6G|*xbY2 zc3ee7JI#1A9Q*S}Uy;=R2i*Dt7l6Ig1-Muk7r9cdQ(}ZFO068|!4r^zxiAJ2DPD@FV4EEKdB*%+ zI-t)4C&p1ZEp5g-Ip2ujej|PQz5P<^AkWEPTLxx@sHR`IdcV&YB4R}Okgr;*9_Ico z?=2kvF-A`qOAM}rVWl08W1n7+T>8vetYi&-hjsMlP+MBi?P299XreGCyf5t)QQ2qs z^1xH`US(`C4b@iyjs19Vky5T;@hB=9J4vIpQ@dCprbF!&@}iyg=TPia2C8^5`Du^! zfW$29RO~Q#QCRq+PnTU=1Ueqnp@&8Tn-G^;6!7vTRIdwdrS-#gR0sxwSMF-|NVk7B z5Grv`=X&VI^ul-rCgQRJGkfZU_x*kR`Sxfpw%=N-SBJ!!xB@`6k^|3%&+Vj)iC zoY-DWmMj?w)xr9t}l8Fm6^pVVJ`b?9GXjGZa$*y>o$j(Y1xoFDPzB7g0r`mqz9MbcDj{xykDZ0N*7pHB%NkA_x%iH&sP;e97^U>V&zmr z-@h}L6faVo$_hz{2(W{6=1}kh<7`_dBObqwzv{O?lX!*9LpF9*{qy4cn^iiuLRrAx zczo%MKBePUrqaBp(`c^PKrHnaoDeRZ1bbOQc*=r|P}{)ZHEXeCB*^iVAgFMbfkW{9+(<>vwUc7z*Y1j$E47E4sf`kWzx@7XqMgmWZ^EDcEXi zzUwBugb{nlsbOiErFl}ckcE`v0jLZSZ)jzYJWgz-oRF3PtF+pZ^J|FYq4!o&oI29L z$D;Oe2l|XCJY+%~Uc$Xs)6ou;Ny>7@$%JzcM;bVK7aHgqF9AxnwMy@Cg5}mmi=&aO zlPEbQ(**$4Hkt1RDzqUU_Nu8WPgVqBS#u7U3<2#U$^^wD>BW*mazy+Ld$gvBYD5?A zrVGzfb61B69dA>AL~MF$M^32t*Q_a1|$Gi_?puFn zzY5QPh@vCZ+}sR91Qo^N1)qi|o_t&1p099ua!R}>S#z8>$tMI=8liP2{Cn)?3_b6$ zN_}sh`l~ z18po+w!cMbYNw;;cQtKscUTbPyX~nqZtW}(fh2`_EgNi^rlGkqzXn=R_T5`Wp7xp1 z#T-@PE899YcMGgdO=SYt{^=>|X;R?#Jj<#`2kS{e`2`Tdz;0-dWG^}W(K!DDG1@Zd z5V?VEDEI#D>x<=YOpd!MFPn8H()zCfgpUSfyFp68voUTer>^zzqn zuda|vNL!j1R$su+L*BLEQL7GKEANJRxRd+2{-ulXOQt0o!An- z`Kor~-~TqQ zej2#Lc)RLkd}CkUXqZD^Dr^2w-QJb4$%NQj1H@;^M6U?*ybA-SR@5RTVjqMqwV~_F zg}LN@$H$v!7DG)RfxXuX122orX!h>fA@3niuvt?0(m3?ZIh+C^IO=U^HV9nR%(#}O zblL1~JYiY7VXUXp;TljMX!eq8d^I#(5#tcoHE8bqL34Xjq1Z`xPp+<}NIa_K%*TG^ ziH6PyR56}jXva#Ln8Q-B|2tm1>0#XbCNk2LWm?R*$YCCS{9EOxX`7tq3c2}UBSP<* zY3o?7wIhELYIlxHJ8jant`Q@uH?%{Fd^hfk+wyFE{yr^>Vodn4e5TM(&> zXobhH^VsE;Hd?COh${NwZ+<`lx6h(iU9H}wzI2JxgPpAxxi_-wR$O10%QA-tB?L)z z$NR-w;XJKPKjg*?&!h&T*FhUwq0bT_xC~>pbqWoFtpzo=G2 zB)GmD!PSIl@Jl`O1A=n#FgE}EVpFCb#mX&L*#H1Zek%R`kgk~~TIN1P(Q{z%t)`+5 z-t%F>Yi03$lRrM?1~j*gRXCvrcW{G)s~zkAy#S$d<#^Wt5b~o?Fmx67H1s_YE+2P1 zY?e3`yYtazqaWv%D;WRyMJ}N86m_D)2uAY=biH7D%;*})YikRWpgg4!yWkf;kNHd3 z=2W%Nbb0l7F~0TLF4ym0b#MP<)6FdIhR)UXXcGv(38GoMScP|UyXL;IO6%xE_DQk| zMx65ex`TZ-PTb%I7MK9ZH$&LX28g-{fF2L&!iX?v#~w~Ba$At^VZ8Un+8Qwg%RiQG zRTQkeUXEXzp=%H?9pfS_^1{A}BF)&@p~VaSqF+1^Hb~1Pp1rWA-%vl>GB#-O8jYwg z6d_qxrbjOsbM{Fx(J^6Grvv8E>cjmh6oOYZ!CD0B)x!n|=T|o{>M4#13q{2k4`a<> zAV_KGbxe$JVxqe($8Z=U7vkCqz_&M8nUQS={}S* z=%z!>5R6IV)-SV5<3xCrWhxO9Loa0`5WNkE^|w=1FizEK0FD^{??+e4Md`v%Vf>(X zUh`=}aDZp^H8%}drkDSH5*lZ6&*q@b@8(V{U|V#BLY2W{%7!0@-=VSXp{HOhcnII> zi0unoY^CJyS`K+MS~^fqv>}`K1M(gbQt3~Fblpq}nG3E!xdAnN90j}6F5rf17 zskgmz1dfClplzT2xr>jrY&-ADNyBiGOCgvjUI*ESC)da7yA#49hE4ZBlsDdX_LJy z1ar=*(xHw#RUQ}{yDu4OMlZt1=p&^zhjnlmBWVG_sey8i`IYmD9P$j3t#T2MJ${oZ zq*_o70llgNo?MT8h6v)l8E=x)bAKd4Bi!Mif{|0uR1Y*tZcP1kr^#$R`=CtNHVT}| zcwaZMCvyYV%N-=R6lXDNTR70p0UA>_5$(k&ZP#NGMiwST25=RbGg(lp|RowlwalA|+VY?zFF<6F7mgEdvx$pbbJh{=E{14nBd_X2I#FuOOvf5w>K z6zKN93OFJDBW^EPRj>5|1-XZ~yez%=N0}!h)W4|+TZ-XABsxE3H4qQzkO`o{x3o-p z?K!T>Np|{Z!n`e2G_$yAfummD);bT38Qq$#tDj77f#aB`RjQYFhl|r(J;ltp_YN7l z4tOK)JFV`5c)I&{OFWp^?MqSge?+_?jrF$J53G4`tFD=!=Pj8OQAz|j_aypOI1uQ` zEqUPlT-N`U&0f2{*b&Z{-{CnaDXER-DLMtCQg0tu9C)*Hf{@(p2@Xs$q6I=^YN#jv z65PM$o>=g@n|O(;H1}cchK+fA@vFhSK!~@lIwImGE#m7|TVpmiOe2p}Kucd8&oE~| z){;?6_t5%@(yP6K1rU*>9wT`QjXkx1;vrAf%TWkoKS zjtu<8Vz)g;3qHKIuWXc9>L|0ux>m+H&(1lLtLE8+SD_xzHe%pI5>DNq9zc~}Td^_k z%gq7I)Sm=NMK^Y?+=FKgHDV?(SddWo3}S|Y-N^7aVSOL?xxsMc-JaaGVn<+u<8s4E zmnsp-efC~}y=9I0IHp?Bi{fcjEIdkK8-vib zKD2?oIFg#H&#b>CZ;IQk=}DVs?ff;=4VYt^eV^ zZuY9Il(9nN2Ftmul0=NunyPGsTLQT;Su>Um&?ugh2u%{@WI}p3=1ZebtT0AQL$@9~ z?Z?HC+K-aZZhaUSw)K+h&0|Awg3>PEW_%^%{1BbDyt+jAWxKWcYl;@s+KfNcnnq2A z`lx^^dU-0~jlb^Tv*Y-38@**(TvA8I=nsUQ-PZ4E4>m@uvnlkkP4{b5ir8zOBDmMw zpT*ahC%?y$7A%#lhzJ0YW?MWesYf_+oAGp0GsRtMH_VWek`EvI#VG;~{l1PX&9Y{{ zBe{2Bb6H(->?$|ugTm9*hv|5re4kh6*wkO7VmkuAA@=jgnDcea>vrxwq3QA^CD?2u zi6V}dnUlG`NWRC^r=#nj5HHmBiyYW2@&rPC--R}cg-VF^wf!CGO1KHW(Q58o^Pj&M zmq`3~u<$uq>7ITo5&w_xf$$jJE)0lYm$)3O{u|=MZ-VjinlCT|fA?{1aMOS?Ej}OR zbIC?ay#bInD4|zC4O*-(3g>WxpiZEzl18M!>ra{*5!;73Y;3i?ouy2rX*aJsb?H1= zL8nRCT|Dw=r9TK0uT(PoyRYTN!o9e>UG?4jotvzFHf?*Bi-R*^^9x92I>2P7zTgm8 zJIC!(Srr9~tv5#PdWIo5kb9?IV1v?%-*pI^OhFb&K2*e@dkSF_x={-eQ@=vceYemC zoGN(i+0V>bQK$Jo`)>=ygKU-KG?lt%pU`~~!g(f?_U1=X8^hEt&t-z&XS8UD`>U4S ztPQtuVI%P#$t-^A+Y=yObeQZuEz>feYbOtvauvG+wc4tGU0zk`;IvgR8Vz}1hu0wq z!a3-miURSyNU@WCy?(=s@D#>nw;gpQd?gT0(HHS0ek zo&ZyFg`gEd6jhb_6?T1i!QCQNo--d4>3bLS*r(4vT`)*Jf5GgKBLCS|0ve}Qg-+{ zOWdrH%T;jA)Ez5_jKnJ{Gc=>>JMUn2ejC!a5cJEY%X@p!0y$7gQ1TE1c9rX(4O%|7)$Y;Z1CZ$ z5W>9Y%hmZEW`xJy$HdrpV=PDHpTz!8Nq-x1KMjEXyH^P540;em%-h{=PE6V#R^h>E zO^@F?1rtNiBkNrJ5v{Opn<+|bSa)pVk>Favf9G)oujcXpcs0HT8%iDYqehY^BT*R` zBq}1TrcTu*60tmPleNhmRbIEixk>D#>Yr`j*#q9q7LIwMg|gA<3o45|K>N>kPMTS8 z?JabRQ`#8vYYp_)DLZ;{-=l&&iSvJ8E>zp*J9!yMN&h^=CaG}C$j^{Prjr`EAqkkw zeO*(qu7kdSi86l{XPVz%<1Yn|K8ygvMc9q72bDfT@9kc&v?Ims^iZG7ZU6KUa1ZtR zC~`d?Yx+8k%ICxWv4aMrxQOSJ&B9QuP9EyH5}>Fne0Q9ZMEjGryBUd-qFH25Klf|Q zNZ&2<9i;2#p{+c%x0Y?p1^Lxn~t7}$l(7&AafdbMuSnjb0=Y@@h5Tp)kO zP=<36gTVBoWVW@BqHXHJw{$A>`-^!?2ISCg04rd3v@*t4{qv;G_wot>11?u<&GdV} zC%zWspMg|P=)6X#81ET1Mz^$nxQ7;boqFQrzeeX6<_OR+H~%sSpvo1*AJaP_U_y)b zGU*57RM#OTK|jsi?dWe_VhCyRhK=B8c!H<7?*4i%h zKbh)T9tLE4oOIxmlYcfS>di2i=`FH=qAIH9TOi9RCskZWydz6OeXEVaLB>5{izRkC z!to4^#F`i({3w=;j-;>M_8vJU&T{!Yyw*^z2_oaD$dN)|z);3!hL5;Ztq+Gc+&rrh zVZK0nW9y?6h@|s5`SVTgz|BHHRm1%G)Q{yzG(GMUsiF@ez`M4*-nJk<6vN&-?Feay1i_r7o`Vn zH^wN=TUKyc2OCcE7NTE0{v_#*-roj;zs&UtDR9`A>$kMzX6x=ao~}ArXw4;c-?@7?>W(^h-@(GPH`WLX z!eqvBn}QSB4Brg_?T-k&5(LQ!WXbkTof>?~KS+KbcYUFtjkL|wRpn&br7%~NYj?lr zU8xA1)wW)_!Zk#7y(GWZFRZ$%6a{Kg?0;ymbqWkv1?8YD44McRGI2Jh_}+V?etZvV zZ_szV7B6mNm9<~Nj&6;Qg$^TuOAg`{Dw3QV+4fYKM+JqQuCk;tyj53*Mef{`g&YYo ze1`cNx|1%Vo(&tD=2Lzf$#~;}#=J2^xUo&- zd!f2j&zOw$V_uj`wV!swJK=p z|A#T~>CkL|wCh$5a9Q;BI3!%pInc0!6$nm)G~4M z3p70dlz5+ZePU0C{UtU-N2VHaP&g}-+Vsqg+hUK>P|55UtmXPI3})wKXfCU3tjvgg zGVk_AG-j+=9$Y9rs}neujDCQ^O=&!+f3ydjjBp%JJCb+^lm2mJ)-RsAhWJLnLaOp7 z+d1Yft5*5HriD2aX%+_SR?Na6>2@v+rmdhP1Nll46&Wp#RtxWkjE@8 zbE*HF=QaVla<``W4XM`vvNdugU%R6;#*OfJwSg zB!uA2+@1jFn?1^zB{N1Yrx~>Z8`9BDK$`Ta?#_0H=mV|wY)TvBvfy|J!bvW&)xnG@ z30*OK@gBw6bAz1ZuM=rdg?7oH@YdxV>r_^`n&2^0y5sEgbpUcTuvdn#&3gy zL=;3)=b%r{E*I~~+VSV=pYsKJms)M46T6M{e#J~ivo#1B=G3pTY;`CQejpAGDKeBF ztH(z=wse2l$aU2BvM-uPbzKHEKZ0|v4p4f4n|$cqmC<74FQ$CMZ=%qS-kC>+{E{ni z;h0I|smwT0Q_t)ZdDq{Eu0-ayxf`~R*8LviUhbE%T%FPXS_OIP=8(VQh;Hnxm@5dA z=I`ym*+E&==1zuLzf)C5Bw}R$>|k;(65M{%VivNLaq3K21(4>xOm+f5*ZHJf zwYw^)CUNS+lN*F_xaA^ttlUBludYe=(Md9GbAK532N*iSJ9S7Ts)6y+vZa@v%cT(R zuLrpiOUE{$6@#y5OR4sdtlt4xRm~d!ZG`HQQkZBX@sKr-K#kT1l;_SYN@F$yC>AHi4Io(}HDUo7Ymmit?YFuow+-^i5>0DUGOplI+f&2b z{twO}8?a(GZa#2K;0#W8ODw}J=nJX|5HIWwACe;UibeA~VT4ri5n`j#NqxRG#0sN1 zerViy1?>1J75KA^yQx8D_CyiuwwUNJbIXG`(LcG$iu4^i@)dbw>8dBxJ8#!G6EsXY zV-4Af%O;3L0|ZjOhBYdxHz4;5LR%gq+k|u`1=6*6^78l3xO(7e~yvlT)KT*spW9&Dom7K2B4Vx|1E|B9^ zEoh`(z=f(u+~Sjl^GE&i5oluc7Ons%g9J$J9cAmg5~m#NG`{0k zmsAVc*O%Y5HIb}y9o_nN0ci|dRinboX4W+Ekn6A_hVxcI+M8Jv4!kI>5xuwERL*YV zgIQG#O99Re1?7B(L(yBgP8j5sij%`I6;4+#o#^BH36F2~lj=;e)3PCTe;emQ7fPYd zjL^~t_R!|3GRVFhq!}u71h$kJMgDY0;Fg5sjsc#@o9Ec8C82mbeu7lnsz~tXFcp;` zo$KZ@R$w!fh_|Ko_wR~{DnTZ|Yat^8aACQ9yp?QKh zKCAO@iXy?8X<)>w+|xx!f+dZX-{>T|_V<+1gDuuQ|8#*8Sba7rhdQajw8lrTP&gaz zd^8cGokljaqQNOo$8UVuqgWEFAl?zh(3sw@OoCI)>WaJv^9NQb!?cRDo>a1K8tvRf zJGx-l4#h@NMMUsH&U27m9x z8zZoSm=Q2;QzVwW;|+%XupfZ4kxpu5Bjf73mrr~`gKH?h10IUw#Hd}>E#A2UD^W7h zWRYvh^MHD#VQd{@X&L5#A@ZUCHb*!Sy_>R?R<2wzKYi|`vJpa8$1l3V691T@WD4D! zjL3KTNCr_Cu%ZaHDGuvy1w4qk`T;{0_-v`r%(LDUw0WTGlWcTIpc;z;#ZQ4LxWV^9 zurDsKuD{5z!*!r@USTEn;~&=N!nc7)e`o(*D%^f?S)XB8Q{7s$%j?VdC*Gf@=Jg_C zS1tZojQ+#?AasIj2eTy+@A|pZ{ueGAI~iRO@Zg)a+hVhO#_a5Db&5`b8DpNfaIg7g zQ+r1_HObdXS%eeJCBmTa&`DC#4A(IWRfQGtws>w|4bgoQI0I`EhsZdEh_40_nA|m) z03Es&$UpSF%5PAK&)f8OLmNWnm;RSR#dB1v^e5y z4ue$Z{SdwHn8_|wTS=d!lm`@^1hB?s<@weSxs~i~e&EIj+ni__&}WthN8@k3S(emknE0D= zD)}G;?@i#8kD~|L5-ho6JL{>Yga#7sERQ`EshnTZ z2LA;fyj|=Cvs;SNos+1MQnyh2pmI&+Jw)?!;SV&9b!J-r<)|f3}Kyx|IW2@;ZEn}#$CW``ETtfAiW;79z5YM+|A#ovRT+eRi0u4fNeI{98!z%JJ;2 zO*@(=Dl*^}3;Kd$^sVd4!+zC0Yx!O>u;SszMxf^<=8H+j&BJgoJoXU7q#U?*XayrhNoy8`zujQr#IH1y+1ftN?ty?c`o*PkLY-Rwob~>+2DB2 zH~b7e(D_|LAwxa;bsN=^yG1YbWkw0q7q!~k)i6a7b;n)p`iO`hv-@iUok#EQ$v(ok zX>(0a!#6{Wbq{nO+b!G#tN19xu-|+J01)BVExt3a^XGuVz+<5==V2*Ep5oghMLGFF zZ~4=N3MJK9XIuS0dC8qpKRi)8InTomzQHL*KVm@a>0VMtzNE9uCrR8n$AH@@=eA{` zscYZCGb&9UvH4lp1Xu^`W$It^vv7A-f@L!G&-f3>1qrrY`TYp1w z*oVuCSeHM@%$X=Drfh}{$0}!M=SH{t*4vGF@#PDOztFcxneQ3mzxbB0Nz>xAi!1}PKIlJRL|l6xtX2Xks+u5KQx_VcpPlkwI^odq;WE_ z(b#rl+l_6rvC%ZP+1R#iv*ARI@y-2w$NPKmV~&}*_O{Znp=w)9?vy%HQE=ZfIL@4(xSs?&8 zRn3YS{{n+Px^!jUg@Vw{r=`>DBU4TY9i6;>E+k{pUUR3oN%;3OVS@No+UuDdnI8zZ zy^6BhA!B_qQz`-nHHuRIHD5ltO@m9>u6!&tQWl{Da0@P7Qu0z8gu5*&x980iZ??$~ zkxA&nNMCyI9t;>JYNT^&KyUgvWnZd7>Gz$a$THhna?GQBX`Qs>~Ja5<&FH z$BZ+>PGW$n(nRW5p5DtR%W5hjJ_t{#b4G*WJ{>|+f)u?!1&!+@q4SsBk^K$ zfrqO3Q^{5sHtm$CsBwP%ad6fT@S;B);oNtO4V$>Q>f(bZ3pl7xeK&^JM49MTpTia$ zG$e)Lu_PK?kfd|F^j#(G5f(9&d%bhft8_rxfWR4=u49u}(9`ng+{6UEYG`ErN=L~d z!Y(&6{I;ofGPYYSj62#t99yg^0b%X`^8%pL?fj^K`066Th@dIgEFel1$)EPY!>{^^ zH~K^lxYjx`8?w|#1qk#uB_Q`sV+A_7r8KCCP&NLTVHt)8x1jB}))wjQ3Xj=>Ab(NH zO|I1`(#t@}R%BqNw`isz2gXa~X)IDJKAqP=e*IeZ3I#p^G0?U>p}6^=x^M8`J^;Sw znZ1o-@5fw$Ua&PafpDlwX)x5N+xDpXkGArkvY+!{-fcS4Uh`z}c|rdKP7*{Le)t5Sf;)^G_-l38 z>G`)pa0{uTL!8H#+w^43#ex;x4VWjQtTL3Whx}Wpjj}>$<;Xn22H81g0bfe)^E7re@8})=954 zhoF^GDu_a$ymn=yD)WZ7Sc_@-BNRtF#-kp3gF;Q6HJzCMtyH>8)H2lq6BYq*kd znFmQjuZ-GSr?shzhOIJiC!UPF0@eWuFVE9_i<8e8%h(cpg-6~xmAFF&)y;GOX1=49 zRMwxtw+HOTxUk93sEHt2WC|j%%(7*l^i04gS*@-vS}}wyOYtpmBjO91++rwnxYc}n ze#;MBN`ujmC&2`ErUT=-P2M{iXqv6P@y1vbz~Ri#8R9y3-C%?kd90^Q<$gS!?CM!3R#?z@!X1oN`4PAUU-5z;q;00)~^Pot1pVD?$j(6E7UH ztaZ>i2ha<(4XeRSEw!GMvx7r(LcYVzaj2f5K&@1sU@{=pDD5z2&VyS4^W(Ah!{O=U zvF9@+{C(;vG5!^d@o>p~CG5UUt=*j~lmhqBathw1&+IN~8o~hHPIEtK!M*~!fKPIg z=ZHj%?(3h-|2^%0p@Ov;f1KRUx09RwXlB7;J}-+{ACgyW@JPDQ9pka#c~9N*?_&k9 zWWMkD?^JK1!(;PxwU+-IB;T#bx#PKAdtSY? z)AQa^vgz`*!rhoxHcdR-sV~KHQE4F~byIUEy{TSh zVl1CwBlen+W@6djKc978EBMZv3x=ZcmeCjC!tA*)4M&t78vdP;@0EfPYk?7EpPsP7 z4b|#r*5tsT98`NIJRy2`l}WM~$5L1b9Pnob8_iEz9PZXl(_TozR{2y3`1+de$UPaw zVeW3!ezi~y=@97^6?~x`|&YV(OV6XFhfYPOwT|l%U(l9@}um zgkXKo^y*V(O1blsN08wSa1}Csl&Z6sY}=*4E6FW~Y;K=!aQ#%^-GRjkD**Ux^Chl2 zbkQ$~a6pEAcyPtepB6Vl+q2!F&_T?fIG2OfJ+b8Rh(VUaGf3X33{1-eE+KA zd0X?USC3grhQiRRr$6nn-gs%C= zx#)!Tglnf7C$o{ejSd3QkY_UvPilG zk{#yf$?y7!lW}j*G7iHg~6UWXQ1`m3Y|Akn~|Q%{?8xg_>K=g=&^f z&9Oj_)4ib%c(*;#%h!+5bQS@&>5i#wrO93TAFPZ50J2s}1zFxGl`}Pu^{|IC z*?I$H`c*ngHK{+x=!63+9BGtCeVClzQ7#>)=Jj<4<6E5|?*g`=4usRgtRS=CP{Kb9 zK|#q-EOEW|WNqLW;hhV(y?t6=4e&4h5diEJx+8wF3hsGC2I~`!ubi8Efw=+4c$+aE zE1svtY1h|#V!qE4hOol9>$Sc|^bdELHwQ%39B=J&J+$=1f@S2oVTfUdrdt7TDd)$dqhfR(4&u8wXcrqY zh)k`x5j_7wic)Af|K{}{w}Royy$!IFcXWRm7mY%F%g!K&Okg5|4vgA@zMBD~m9($Y zEw)2CJg$@y0mAU;3-zC`mj1|qk%PqE(!=SDa2x#}iTH3?2l(S_&Jx4$zW$A5<+mQ=9Als0krNms ze&OK*Zf=2_;lD!$UwNIpz3G-ID%1cFqB1dmo>manw58v^=pbDXJ*eSXX)X1u?Ng>6 z%&bc=yOSMoN5F*AsJ$4?-#rliOfmhUCJH~VqgE>;8i56Ko-qfQoCvP0eAcn+gJVV{ zzmTqN7dnb*RJn=y$AO`^nAGpE?4Hmzkrm{Wym1&jy>R>U85*0jDFWG3f z#;I;Sq$0r!^k)Zzc63*H5i;eesbC`N5o=bPYb73Dg5$5xYL5#${_izsgwJaQUlZ&z z0Bv-1OIdbSi^uC|Daz39ag$J%FeC*e!`B41UcqpB$o=63v9K@;5?iPW8lwmbBPbWM zl)`Uko)s;t%b61?J?i*;s*tSYvvyuZPqf?L4xG=-!l^$Vtd))XWW<+L;a~{#5ENfA zZeo)sH%@(?XwPFC+7#pWF+68)qxSL^bJ|!A$d|)7bly;Xj0nAny^#dGjYxiL#}nHA z@09N630L&LP5$q90Z3qf1#cBHD*FBt@1pI5-cJ<|z=uAE+|U1J0x-vrBFlyAFqmYo z^>L0M<{vHc0mdN7!$9UuGTuQo>i(OBKOXAmOMvHknlszBi0OIuNtU|=PqLLMph{v_ z0YeFGkT2X#-@9*(zOG_dt3iR8=#7tHXq;WHQ7Z>$af{AxHf?6{TcLZX9r9f>Ofia2j zfsY*`N8LTq|JX0C7P6k?1SU;W>idCfwh^Rs3%C#g4jxcVYm7grIIFx=@RMq&zdp(}MVR zLPy7(^33!zDQH1BPc>H_j*_pgM*kU{cvE(G)bg&xfwvm*SX(JsA(hZo7t6N`OUN`y z`?lz@ffy~?=aV8CInP*Lf&l1*-_<0j%Z2UuNJ-LmN*O$l73`OwEc*km&}R6Xr2T6& z7W?W4rkJ=Bi~`cnZ(R8n$(@=0U0rJfv~Cr8}3_|dMCv=DWxymo;e8n_D$Kxjog zMN8@#Hy*Do>L{%#=rs%2YybKzOpSZ^K15c9<(wQBKSOJRywp$jm0;4HQ?LzjbaTJ^ z_hq*;6TBtvf$%j1gGM>E-4e*1%n-l*q~;2a6DbMj@dYO7RA-1C4OtRXCE?Nb14kXfPf}#LQw3RT zG?`6Lml>;fWmKm;Ha^zj-phhZt((vb%Q3eloUJA zIFGhes=~OP@6w5P{Lrx%7+sIv@s85O@trDiGPpD+Ujjj+e%kx-bmPkEPXFZ{KcFHi zY*@7&wG#jL&;n22M4O(C*m&fjJZe#60mRm?ArIOgFj&?$Wjt~WSGGcg{CtwBoe@;o z>6usD`eU*eOYhD3dvgcWo(EGc*B9YJgO3?V2^#CVPo*+)YDD83gX8t^Cw2nYe!FX&z*;0(23Bq%-S2x<<6nr1g$AJ zh~M%j1*1S19b_L-k#cM#-z&lFHQ8+HlR@XpIm%iBPs@gkh2rpsot9+=AD5B721d-*@V?Bb+g+#8x;!*>Hrswf z;&_T}$*eS>KV8(FgC@kl@}_o@4g-UTQMBz>Uae6)P9`#I8Itv(?XW~v)`ABCpoyk z$CvF_uHdhu{7%D8(@f*$uj!Z)o7Lk=vPF+Kr4Ba>uqGJ~^CwI2L7qWN`nar9Q6Uz+JiYG1PUsdy?hfB6f#u9OJ4E2CXmBOe$AbK6X z*(ZP8f+Lu1K28!C%6m_8R<+ohEGZZ;RH?)%h5K9oGo71>awuB=_r#3qV?79wivjkU zV*_oB6-*bA;p^-Rv7-pwGIzKW7L-P(jf!4?fEx{MByTW?GX^bbsf2VSA0BAQAQe(cjy(hny$`9trr zTuP?sIeK{wu2rl0cLOjDifc2yJ2=EwkY;sem&xX6db_s`Qfel28WN#kPdlf~o7%*l zcPz63K-amEtUE9f`hc4(x+mTJ=&)bmdDjnA^gw}6qg49+mEq!Oiygtm3yZlaM#l@i zm_L@7&8dc7vHRb(v0%6krDux6PM)gF2G4>yK~eQV$wa&uVKx!f87 z_J-HY=83}_i6J{~p?<5pjkpVRQ1h^yn!a)}@>p)KlB~fmMYqvu^$@Z1<3#|L#yG_s zn<8P+|KPH;NP#K>lrKXI5AZXq9pDC|W2!JY*8HxQ6$`<1@P>I&u1tWRegCdJr1{N` z!BWjUbVe=`pnN2u3#BLKDw?6fms26j%m53HE1`vGBPgkGM^hr6v|kl2a7Sq}<_>Vj zeM`-hd7uK0&VkzY(|t~$@j@q6b;(&ODp=Y`%`v{JkGF9+WV7oCL$#lUt?#|?WMmf)`wPBr!*g|Q$Oef zuKr8QH)uhElAVu}H_Ad;;mvmynud&WkOE=$cOt;THm1s5`*9y@Pm5f?d%vSgKE`enuH!c`f_$ z)4H$3NwQj^*95Yks*nh3{Chzb9jhCpCp84`iIU4Nwmg;8vdGl*($MA#Iih$r_t)$} z$fST+D7`Rrc=lr+!Ux#nOZPXf%0u3Yx>T3GrJIOwRO0=M2gc#hwqAl&#rk7=E<0Ps z>~a}B{`Mx_Pbp{{8y*K>D4WT`4w!XlTj8-h&GP~JkL0Pr4 z=2YNy18oAwl+DjLgshtic#hFUY|llnTYXMYzyl6=UEyUbqxUTu|L1Ume0w$?p8^Gj z+A=@D094NaeZUn8X(#IR?em{sZ2>Ga+UCFQ14r)P-}07??6bEaXKizw8F?q~OvLBV zAdk(PexP6^<8`EweIW<)pSY#%LT<7!*4rL5Dwym?uUW-)cdYZB&hH1$OfuM9RXPVK zn#;}gS>v)oViv4kAD?b8v$D4^dsX=CyAmv{-EDVD*=MEhykfe&sK;nf(ET;5s?sic;N|yXAZ)sXSxnhqMwWP63T5xtqgrzS% z&v1)mm85gvUH0gl6tnA|Yg(`&Nmxg)5$Pa$Of=?-P%*7uUjo8GY^%;)@5RSr=tF?koPL7$0kw*9*) z?oMMQx+c2YPqEcSk@{hauWsr9?G z;W~p+wBq-DLIbBIN^i#LYj=?hpCADhU&|0zG`nxH|7RPT+If@zZ@vIm1ox|Uu6ta0 z?ofa1Ep&%^oIi=cga|!XKlZ%1eC}?<12#YMKM#MrX$@b-zrp=Cas0b!$$2OS>wcq3 zYuYe6SY^w>rQQZSpsHx5j8LD)e(;x1I2jQ}nX~FjCq`s~B8(#F+^B1j5}Pm>%ankR zuyJ-e4^<;&rJxlyciQd}^WLQ+tHpf*YIRiGBPj&7ZbRJBCpJZhnar(PKX)k*{zCw= z75}@7-Y4i6x1(KStX|vsR_?=e4LZ`Hg^}=v(G(suGli8B$<4ONO6XA4?F#g1m=hM> zMc^61!)v5|MfJqad59yR6NxnJcoL;hnzVKY%p0e?J4$Cdhg6TmH7ycqeHzHlA)&Z_Zk#;?PsODvi(T8Z?Y3#g zlz1VWcYA+m1S)Q(YliDvo*XlFn90zGgH%9T6`N`KAw&=cF=CD$<{~z+{^e9D#g5S$ zP6F`x?9K??aEYr{l-Yi>W>-? zv{pQclA0yDEnKwP>wM~`ZR3~_WFwg{kbHlkrEoWQ~^XrnI2w)*Ltt+t>@`&El zs1$+pZpA}r4lTruvIW+Y1%i0ULgnPeUTBRt?_8r8aV2F>FS#Gm{2|;}cueN^-DZG# zn0m4=JLzCVW7OtnJ?o51c7%np1I1z^5sC-Gf5Es48U@GLx|*h13n;Usry}d9RG*m^ zj5w3G#f{H89U*yOG-RB7?ONBPium{*Js}4kttBgNh_7{G-06B~=~&8?+EDz$DqVvT zYv*bbZ&tU&zAc=NAw)u@o~WoPDic$33#=7R@Ns&sS-9HQ<)Pa$a&cFspLYg9lfbmQ zRlmwB(_0v6$8k%iC0|YHHX-_P8t^tg#}!{w{50amb*#FrbL^#qVLDmoAo&hwq>V|% zxQ~DbD+`;@;Gfa%U>^f9kyMmG@ePDgI(s&VkRS1jn+`%xm#tq52W{XYGc>k{$V8T* zym(ccFXGT%p)1-Jw_u8`>9DN2k0Vv!i%A&e>6icW0$ld`S?I56A8=YQ<~m>#U#OrFRPac^hbq2#zHF zLVgO=IJ(OcqsJ?zxZi@FRS3YK8f23A41>~h5p6%r86h$i6D`{hN208Uj?Ta3ePmuA z6vW1^;ZZAnV3^L)wz1CLpXw&_jQ7%(LA)iN<{-~bRVk87vF4`A@5^ie)vwO-y(+*w zo95}O%3l21q7ym#9u22(4gmq9EZVK|*XH+=oJA!KwG`|;QF2-5%$lH56VB-5y za8{6)Bx8C294Q{qV%Jkbsmg2+6hK1K?ePe{1~CzADAWXeED7}^8NL^mda#1_=X3^= zsTHsP`$y#4@gnNE2Yq4)zRbnj7{;C8;+MgwRGw0tW5h7czE-A%K4kGHEAvnnU{)Ht&I?{lH@EQfg{T6maW- zA`?>`gIWTA7UAz5PfBaq&2@Z;S!tWf?dR_%8}?j4bBF_qt2s}xF&woufl3Et(AmZN`rt&?3QiT}0u!nwf`Kofa;ceo& z`I&lC?IL8_5Tcx#h?-l&GF_;}GK^@1Wt{kyQ-)ILYA|f2m*r%2YLyd~mDiM=xQe0Q zrMmM@1iinm#VJo<1+)r6pRx9;wx1inNzaCH&(0j=g3}l4n&R^+4fo_^+kw{9m9L2t zZZ=$7^uH+A-aNYL@u5%VLPw##PJUC90X9^X(mnj4r3B+58XDNNGhxz3$O!}A{iU$w z#$YB<>hxRsbsCaxJ4`A$J<8idFjbn5SgS{Vt1)2_FjNx(emGUO=_R+@Dx19hh(CIf zmi#F7mI&5iUp%YEfljCrLJ6ToaV@AAc{BUfC22F-hVDn)5+#W*PiI%SWIe0#pOz(5tV?9Vi>vJ`>Vcf*b*H1U5zUR6-gHxW~Vwb1}UPsuz zPXi>wrGo!x`N0O*^_}NouI`|d9G|PlWI%+&Ti-kQ(NCTKH8O&A3NG!T%(;>CooAHv)uxQaG^$m~$`yezzEADzE%$= z3rjrU7v$a6Sw4c3Xo!04kfZ!6{;ZCs5X-Zcalf_W#$gT-AvRIxIEkE!8qzLd4!?iQ zh6QzJS~Dd@-seSl0=)n3qx0v=C@w5yFNPZx^MffoF4 z7hvxMq4d62`PO{9e`o1i9#tk{=*s##mE5%B{GWA5}KnDKucYE5^ioG&7}%T z%|s1vZ@P~k!2`1+IE}-&C$k2dUPYFSb~<>7lxU1s)0ycwTwDB%Kg?*0HYKRavEZ-B zjwY@5D1UtuCcp1_4yef;EJ+YM*ldkbeXDg}FuRkgW_O)pr#(JgpEZkDMZ%;!q&ba} z@zK1U?UDoOBgq=1&@XZZflxAeM6hG1eo9gjHcGZhXVWuKdC5e{Jr<_66}*Pwc(+Pv zkT?A$t{kGK#L_2M8S@fOMe)yre0s_9y)My7V(ao<3mSNx6Nr{bHJTCsjCX$2CGl~0 zJ!QMyHWi#^P?8A>wBcA?FB6rX>l$pYHJ`G0?gU4EYU2P!03Z?Jxon#ur7H6L`|=^- zEE6K7fbepDqLOIcb9J6)Om{A=-e?3oO&mx#I=&d|rp=tSCn#G@jrnvC9;SA0Rr~XB zKX@F9l}sGRrZx_Ytwoi5x}7fc$}`JJ*Kz!^-Qb9{))3Q53f)qLQTr~?@M^%XBlq)> zV(d@dS&^Hb_HdJvJV6c)p8Ak?}2hRy+pP%%6v4C zqxm6+O&iU&W5VsZnevHfqs};OM#iLP%#2JTbx+cdSn7NkwZw+!#7N4~^DqgbrNZ

    =KA-hbrfpRK!?b-M zun`qT{mshAX$`9pP?Q9r#6vzx+*Trf8{g@HW6r}Bch}EUE@>W@!gg#vL`o`4yCyww zz%AP0ldWeO17XSHkLG&jq_jdFO@?IV2x)Er6>>?3r>Zwt4 zVzVEfdK!yc#{W3#c|%H3aa;x61flxRK8V<1Ic^t5+V%PJJA>e@{|)N&jv=T!gc*ZR z)CK!*^@ioCXR1j)4Cledl<+?QRv}q77l`WEgMD6&8OoL6bR;y!{`#8Hwdy6E9PS=1 zCDzI;`zvVVU>g8iND;y= zw#&A-Hd>sAjG(~@n8gUQAVUos_jdVsn18xE|6s-8F(5)W+2u+7R$>Lmy^c#mE7s?% z9^itKgoMgHEoG4FcFYz0b2^`q4ET8sBo^`x?s&X1Y1tUV!!BmyF(#A>b{eoe3`T=2 zVObSGIS|eaA754D`?VlzGO*+{%#DIO!em%OAut8Z4D`{Sc98AnqRSB}F|`rs#xSwJ zUf0$u?l4p*CIjy%!kq|jz-P#z7fx!o#BtWw`j|4?NNbYIiErSWg)EbnP5+Jc54cBe zvXdycVmI(xOLlT3baOWD#<0wZHw&~dr5VsyBf7|Of=;|dz|BbPDzP@WEDD&CrzM)^ z!6S-HxLk+!698^t0=G@V^rr_7cpYW*q_( zEV;S-6Cf=!P22B+%%$+fIK@$RTZ28{f`5{Ye)4zNprvWddiSyy$s|0NvxXCQ7)E3Vz{Y2E z)81-b>c)q~f`}|~`P;XYA(aw!^51NVOezZ(Us${RH|?}jpMoWCYjV`Pz0LmIFL;Z| zri-)jKyg^`2=IWFuoTin+UUc^h_kg9W=q0(NH> zsrG)n{RM9pK1SdVs{jAGA@)C!fWY+l5;{cFQHWAhSl@?uczJCPJw$C z1%HAQ6sO>MTx>Y^^Er2Kxy2!p!e)RwCc^1})^H>2X6)1aW|h8)v=p1Vv?V6hCeNuF z=Px%x{jxbw&SSx9O5}%srFu6(gi~FBCZ(nNnqZzWu4L7Du+t{+#4JV`(spY>P5`-M z5MM~HtL@*8x$(m=w-#3r?4{W-Vr5%-Os(g-xx1Lcfj9@$C2lf6UmeKsm!86frcXFr z0Ew2$X20Qm?K3kY=v({09qY%ivDAs&=4HPCY(NoV%ZQFzSfz<}RFD&*^rFrj^saR# zh^e}t<0eH8VWQrIOa2~m;gFieN{(Ro9u3ae*#~RHtbNH^xRjE$|B6z%m~_x+EdIra zEj@QP^v?tj&4=e%JVS3|u*0+rSq107LrmqAZZ95uNfG9U&hOFc^}95GeajXWq#Njj z74@Szy&mRMC1nmc!DM)8=f=rOh`6(Su8h!p8gENDD@WM-S=8jBcs<1N`7vVH`ftXag!?O(Kv0@BG9;S4)}pR@0$ow8UVYG}f;22G^<4^bVatBV%OeCsQqg4S z>7io+3UavRGNHQJOBOa_=A=2O66-wB2{%EXwLqK@`uBYBNQse&5mA;G52r=KZwM&^ zVL6PtsHZrW4{p$f#TS<1U^}ih!4{Q&-b7KWHLbAcyq7t5>JOsXnJlDA=2Ibn(gdG* z1$R$(TbjQzR085E-y&Sk1Ko<*t!S~;dXK+2DHcdqvhct^|(aZzugndmal>knwM1)bUHM$?z-^+ z4!>Y5n@^%>VXPTxQcnsW^Gbl1*Tm;E?{yfuARL4DNelw@XvBadxjXubNnIZuPQw! z_Bf6++HA=v?|f?^J}U(Z=1f;fHV9mWi=S2MYCnyHkPckmtoy6Lz@YU91-B&RUEA;x z&|Cx=yCwXJ{PFu7wI-h@o^C79v6GoZ5(ACYU0t5Rcz#_-PWtPMfJVg6D|MpA)taxV z4$E2!E2ni{;dh;@S%120@ANs@%;VYGuGYWPsXtoBYPw9j$4QaDWDBrBkKILt3Bun3{`c*O~~%OQ(QW|8xVqJ@Nw zXbqF(`evHOI_lBvg%GBF(=IPVB}odrUe=``?fl?9+XHky!`fkPKM}u;(Sie) zp5eUA6xD<9k1rnA28jV(cw7fR_`8&4`wZWg4EH_!Pdu(0gkBrKWp0W(AJsfPVfdsjqJWUHio$~^j;}Ci- zhP;U?ss1{CfMuFn5-!Ui7+2uv?QAmGZ&%pYUc=49)Ax;;rfIiM2-i6Mu-af^*I+sf zPF){~KwVJaH8n-4GJ%b2(rh`avQ85+H%VI&&lURI1{^^kzj>n5b*8>j(dU~1$_Uh{%TFa zAdl4PO)%wtwf+>^;xqFDVMFutHC^HcVD#{t;LU(t~%?=M#R!M%}>t2S76mgbVwVB@!KIOUpRJ^JwN-wtJ z#w{TA(o|R!lF@G2_)3l#C;@s!+Cje@2iP-?!XK*w#J$`zbRmer_QRM&HL(~I<~fSy zvK8U&b@=<8E|(2kP)Qw7G%d0hC-FwGi zCzI-sFEEt}MqP)+B3PVI>f>2j2Ryqs2VmHQ>W636P{AJ799*;;eZ`W9Yc>--i+qTH zlqv~U{qVuaSDGdxE_v`;KP7v|q7-L_5lKdxb>5py9JQrNEpm1^TF1%F4VrIJW?fHH zb}vnDH>_qb-%b79V?7UA_<^Yc;W%kd{77kR5eTj9y*hXqdzdbA%WB6t>#KYht2|or zLR5@HUii0jHAxmFJbUaTO|J}*R$id5@=GumM~_ZY0uQ%h86sJ;TkMo2@LrOQ`gx1O zEH;b|F?M=Ut?9VR>9Vs%>le1iRaP{l^&ka^IMxf~$e1Qd{l-gKV#)ZE12%R{T_V`M zWIb@;mA-BFD%+*u*%DhTsSK98B2+E%)up6=TTlrPvU;yCL`u>i;{@-3d;jer{eo}$ zN_k1Wf}O8%xo$&ov^)Zv0zn!GduZNQC>6h#HFA0yH1)M@w{-h8rfbAa+uR|(wLRnJ zICE#<^W7pK>_4vI=V!p^P7KMj=ibk+|2cg-@8{)&t}Tpt2mW&{{AXkw`fB(#X1K}c z3#KJ}-dh>=cer)dzfYl(yOe@}V+*JSp8l>niQk|gb6lqA@QY%#oi<3oulKkwxCLE}4(+Ed{ zuA6U*X&T8RI`p$Y#^GeSN?b@O1=33u=TCbcIJ=va(VL}?Mj^G+NEm9iNX}JT1BZ!FV0HU7 z$ASTU$%Z)W3cJ+*QMU==qluAbgYpTRT}9|+`R`EHvbZ_&3TA~0z1~rW)(XXKw**Ta z%4AuJt{pZp9W%}DFRJ@#ZAj@7HcU)&(utoYgm4X;q~u-FNlrdLT)3 z?N^Tvf4ZsF}xI`7d&QN>2~wzDC@nNa;+1$cNH5NujIbRe7nxk4(w4DyQS#2kM#ERIIib?6vt$KBAbs_Fqg|p;Ri_}%JQzb$*Ioxz)W>v{Oh+Uaf5c zzgA-GJnDkrk@XA=ZrH$dyropE%?Ec_;fGM5%4x5|gAAo`6YQXIokgX}9DgNuc_UhB zww1_sa?%WqeC^hSf?(xZ`vi~6XH64Zx@*m;hgUi(Z@~9cz(bZ>j#?s+s03jlO zyqnY^c%R${F*^*BqnZTz_rk&0B{3S>LppPEu^5$@;(rR4Ak~M4FoWNIuO4;+?@5fE`5s??sW|aZYk)BTo&7b~-hD;l1-+>WNXO})`kELB&Kfva0q*`N zz9$>KT^75a$GT;pciP>|9l+JL*!$Ia?;6kbHN=}exIm#34vpW@3BvbUY*onj9PW5w zsuesLPz!;3j+R@xf5M>>@A~X~3i|Kuyuxhy9OFU7uuCo61!PIaECd>xQFo_-DTfTg z-}(;T{T0!A7S91)!`6`)cN6ub)$}OT)CE}Ld}JqGiF6RInPQ+XjxN)z2IxvMk9HO0 z>K!>8%ESKnQj4DM+sa7fQI#gd ze)BR{@xVM28@4q^Z*LQdO%1P{OS zoOxLCf|MG>J8V*Qf0ZtrApUaBcm(y?@uw;#Yh}3tlYsV}^FgP8c z6;{Jw7&N+kcxV0XY8XaVx63?9mq&b2(CcN9oNysErbtDmRJ8nZE{YwU)ml@zTAfnB z(TVbgdO#Y*U?O%#IR1mthB!%`cA|3rV7VDcfY5Si%Sq#J+M>R;M(S2-&6!~%D|w}m zE)U+P@zGmOZSXpkDgSdOl#G@`eHAcO2QrqOm0;*LX7(IHek~p*l`U2~Lvv1FOmLZA zx$V=SCtc>{;X_U;#U5kU4#?xpL!$8V{7L~*Ru{$Sxd)dhteqkdOf}Zv4)N4VZxeWY56MaTz*H^pbowtd)|>5PD&F4} z%D@ts0ufL-MWLoz(l2adX7vpm;Ru|-P~tkwN>Bv{)97g?YFm15xD{4GibZJalx^8y zJj%U|iPDymGp9`Ra)m3qrs*zZg2E*k0xAPQq7c~&yH0xv1%5pBOIcwvDs(3hMh|B7 zUk8j+(!MLE1eEcBtWnLb9;!EyLeatamDAn1jnEE%EhEtQ^%2|=0?uRp*Kme}yB?(5 z#nW?oTYOS1y*d&!R)4+e{4SNRKiT4GcY!W0HH@4iUr}Z zSg92WmBC-0)rzCg*x;kBdHQh77B~N|_SWW}_$z2o<>`FZ{H@y2^rDxN4Z|x3!2S|3wG})JT7E+qSam}?mNNE>kI{ycTxXLtmN{~hEJ0!34 zy`tlUWT-!mLFWqCHz6W$#83I#C05!hpbcx;O0hL1hn(9TC8B)n~A{h_i$x*aL`Hl za8OlQNaa{i z(D4vdg*4f0Lfl*Oi8VjILLek)Q*uH&tTTyQ}dXVSMu7!s1lWfg3Unr@J z)u$Ke06~YLMyLyy)@T}QlJ+oj()k8w$dFxo_~5vtyC1_9v$RrPDHqxIvm8u4-MyJv zRjK+Uo(MZFLhWxSj!Y4^Ihb6tWAn zOASjLvC;3wOO+TI7RwW^4`1uFfBXsh-DN8;A*opZDKh_=NE@CYAchsZAgE8TW{vPu z=2vqv%ABwHINI_b;t`^jObzfCmlvPzPkhDs(SOcaoWqF=q?ju%l*F$D#dkjwtbI`5 zT~o)KKzUF9?bAM=*wHm`8>LeU3C6OCrb7jwD5|pNw2(fIRrx+&5E0k4^DN|qp+{v`a9&VBZMj>r60G+ z^^1l}8c!qV^j^$0yHl=b}LnHQeZaZqPdt2Wd(ms4l@v;g1Hc^!?;I=dR zw!HOSKWZXMgj!&(+a83VZwKYK3-X7Dl|dGS*DgO=cou!PJ_$zOkweg6k1a4yeeNfoFt0c+%;wc$6IP7n(d93CJxF;=t3NSWsN8Kcv8;ye{6OLVnN%;)C6{ezw9K_C<)xf* zI(|}fE*06Os}M{%EVxRsFL}XZa8hn+%JOahu!rW7Jqke4a~>RRuQCWr{hY--@7mgj zGLJQK^dMgd|0;r#=Y<)$j@NR2ZLP+!{r=MQZcsE8waC{ru0Rql`}&ZkZkSk=ro=E3 zrn2;&FrvfCE&@cTn;VG06_=R}^4mD`Syyv6{&|b$@09ee0(p!bPB%oQMe%3--#5Jt z@A5m!z@ZWE6#d1>ais5VI8X2Cj@yb1)Ow@iGjU@$&AT@o3+Y5!JSg?hXSs@#Bm&~# zlD?29*ik+n*`s=7;0-bmx7tzzqd#DVU(APlr9fhPFr>d&s-?3MZv%r2oK~Kf8W;1%!3#iZQ z@C@Jmj<&^M#o1^S*-@x61R!MWoAfaI*0q_hiE|TQ%RETH>p5dAXQzm6TPwk);sm!g zgfurseV!-iZz~*d>-qip>TA%P|Xk2Us@yMr@tY8j$ zIJbZsp+H^vp*GFg1%s+!#cB;E{`ziB9DnBYj!L}b%D6R_KgqFjxEaEWpET~(WD8iM z_1F7DY|Lic#CIQMj+I*5u1%%bRKBSnUyj}>ABTENa~77Xv=L5+dmB^tI*l!r*Dia; zdE2kw8E2%*$TPIMVxwU_M9n5WZ8UTElC}s%u}^tXnOox!io>DgQgG5@eR@~jf466# z&Gq5r91>;$gS+%mlLg6Pkhp9^=x)*z!?jLY_9ua#LH`@siuD+TPy4WuC z-F)aX3q7g(8nV68F#6VgMe(BdhPv+eSgy9~K=$?$dS_M?v=s{nxHmB#rG2iz6e!pp z*?KnUxeI+;%Mi_C5dGJhAOIzdG(fGseUD2GFwp6|H(|vrl+4b~?lJg3$Wq9IP0;Ig z@#x3C8@is?#}h#@vC$+Ff&ZXp&_BNKLu>Az8LE~N561-7;iN|C{sQ%+s(=hocbHS% z$hN_EU^)nZi4Dnu7FBR{$}qvAz#Ndc5H)0xGW{2ci(UT!wiDQ>Bw3x=M%OuE5XPcJ znF`&>bx0_qN@sCMBMzxVrSn9r!OO8K>3H+uyTB42l%wH(xyE=UFbBZ8C?Lb&T}>vQ zt(m~W-B-5_80j9iz!Odz_;)(@bXwLN=4+$STuu{x&(2h#>kV+}IbDP9wfat;>TkqbWn6Aa~pvxD{;@?o4mlHF|1 zX2Y=g6rc^~$*|pS+IyMiU_uSzzf3sl+Kxj|X1gH9*b)Ee2#9wffdCjq`=NQUa$+op zvBgM#-#U8Sz>kjRYeX8+j3|~M<-_)H=7lR<9u*q~JQwrsx_%@nYPhX^4rYQadb?~% zOe)J~zl(1MiP%Le@E1J+@_Qj#&0jXs}Tn_=w+?&F@M*aM~k@z80p;}eCL5R!i`pl zVT{GKYbpDSP|d5A$TcNgMW2CX0dtreXzEnqK+qxYnssVi{aevVf4}o5k`&D?Hj;8# z;NnV641yi2T@Js_Aus*KoR{0;jQTpByv0VGHkEz|IbwN^HdFf)s^b^Xhu8Ia!(#I( zC_2(_Hd?GsB`Mr4m;f?CY|wxeYu0b9reO4)1PO3Swp@q{SG^;V9U& z#y4V~OQ`cL?HIo6+`8Q>>p+4*0+21?nag2diLD#|;6dDgb-)dK1f{|cwjcf>|D=yt zMcbh%xYhB#Bu$%nF^4z?h+(Zm-1B+ph?IXp`Y!mg2XXA#px~WQYz9OShbWAcH{N!d z*oxDO6oskF;q0~mUu_s_TS3RtEdFsCKtCbBr&D+}(0!AG-U}3>BHU6*n6R{KgE)D)q}t&qlmG%` zG=AN9xji$0uJ;*84SSrX`anp6;h5-Nf%}y)Gdwh=P4~{z?@6QMc5A{8l%ewX zI?}d4^b^97QI-uC{SSz;cdTo-7KXh(AKJAb)fvVam_I5k~EoSQS11Ck~P7~51k#&`lk z3!9V!CFh=OT2_zxWB~_b>^k6u&6HPmPt%u@wm87c2%v3V$nETiPP`B?Z8f=_owABE@Ng1d)F$z>v*|CpQ$S$R_z`^3-%b zZm_VnZ#W8zHans~Kw5+CrPDU=ot?aPDb{TuMSL{5vF~j!+O1P!6JQ0sF1_2jT4$W5 zm8||4jbW(vZ=k_J7a!-y04ihO@duqgH}MpU#^)&*5z}~SO4&PTID9@rM&@V-aPg2^ z2z3{Z;NUKWD3^?ZTO#4+_>IoIho#HWo!A_$HL`HiTQo}DowPqBIzx#%X;E_Z&rT^OGPTbU>ZdJ?ZHdG5&yF^we6^YMM(P65C``zfRR}yAi8ycpPBe7 ze1}zj>ivXdJPefzP#i9d^*kG>VeC8_P9`k0DtAsN^A!)eE#F)anp^YA!Th0&n@E)( z`g@_qN}=xai23C&6#t=;1lYV!o3UKKCW2Uk*zBj>3)KNW#=F5@U&N!0%`62SMC$J5 zC|kO77YSzm3K9;n;(1)*HA_1sQQM*}It;!;HDYtd(vTo*!#}S;`BaRA+sf}+i42Y5 z8c=6$x)Y106c%tGFd4gqUKGy09zR(k4Mb?`izAg; z+bir@v^pYcS%jHWiN5;4hDuJlX^}1=t%@u~^AUDc`HD$g8+GugZG`$`6xNTyIv;hS zI>|pM(H0H0s(_ffdo*d6b)u*2tV%F8NZm;$9@UWz33i_W(;{k^4h=ROUnjoM(0jxd=bf;Ye3k}+_7A|5i}fn;$5wW%GaDnP{eiDXe2KP7gG3EeDOw!h=Ew9e>V zRgUFiMz(aZuuGIk9qiP$F(rXTa2#%)HUIjPXM1^e)=*RHP38faLPJaGb{etH5|1FG%t$5VMY_+Y_ezHv( z*4fk5_Fn5iB5c%%MJX3POXBcA8;fpcK!z}%@^Ud#c8ILuJka?K=UiUSgZa>d%}+!% zOX8U8KG_W===4k-zJl}DEZ#}2NGuP({DRb!%rv?sQYu1=68&ysyS1*cJBQq(QOkf8jth>^??*4R)+ki9;1l&!sx+?Uzrq?r$25)|N_fiBY$|n3UX`~o ztf3|hA(w50-ChA9x?IF(H9Rn9*tD?VGIuR<^v~h)4h|m!;39vQvrz-!7IRW@m?F9D zP!9FSep?bl|1XQ%hr4H(h=Paits9oPglJak)G;k4pBU~I5of)szs!zt+0gGuo^D~z z3GE&EDV1kuT0{j|JE&B*?cCoZF))lif``W|+Yt^>=ejInNjcHNMFXpYToRZeRuh*q z7Hf%JYVN8K>$n2T59svYiR4r`J&4Ab%DBNOB_rI9L$Bh+O@HhNBSr<$>=7<;WeWC; z^&A;=Szx4>xgfSe-Z*(c)&{p4PbQ)f%m8#7vw24#D{vb}hx#0^f_AZh(>YlkHBEjV zz@t2ft5K@NFyOwMN3yhbzZ=5_fca>ohb%evu`7hQJbI_aTCLJa>tx!))Zl&JcOGX- z3`2x4i)L#}%F6Z_ShH&nV(lzuNB*2jYe}o&HrSU=EnTF{^_F(B?30G;sKe-Y3WD7M zBRtu3&83<7qgj86cPRG?dr+T`O(aKA(R%C=1nnslX4Ih_7%NIeYL9M{?ITHBX+@Ui zmT=Jv>|uA1^K^Om6mp=PoHT8RKkgW^J&j4uq>_0zaE1b=stVG5QL@y z2tqvTJhV9PhhGmMkjHL!nX5!T>qT@IaNP+o{wE>`C^FqIh`ne%KQ_D(pRYgAzP5Zc zqt9ya?qT5WQNyWVJ)4h~pYwAeeD?S%pqdQ1lOwTk>k+2;Y<%@{|$*JOD|i-p;mfGG7&AOm+4sl z46w3xIXl-ab(}d>CNvnPihAsjrgK91{F8X;G&wlD zc=6DY9J(1;wX$KjmV!dHYCzx71~sR#N*CN3|0HcXyL)wqg!B*nbn8z#EDpqgsv_z} zLxONojo*f@y`a&!GoQ&FtS&2QPkeKt#%FdHbU+4El(Wjk-{mKrnZeGunI?5*OW)5{ zlIw>71v#;L{E zQ#&@$x4XLh1$L}xi*jVBsYBHLGW34128+~@<|+-#ZqHEOI1I2?dW4uEV%;|xf|FFR ztH=bM#Hg>mGrJ69={GZ^;v`ajroSS63()pqnZnYm$%~HCcp}d%X6wArtU^JSmvGlg zWd?`v^6Dd8StVXBd7+O7P7Riu)VrZ26ftu9hPUmNZ+Facair}47ON#o<$s%wW^xjj z6&q3a^myqV)GyX;-zHG+KMGl%xze0}T3k8rO_*x?aKl0;tE+(Co`AI+_-b2{?7IDs z=M~N*LfjZW$#uS~xkb;z#8K8hD2+dqOv~Fp;$hB(_|pB8!dwN1A0BYL+b%UE_Exwx zLh&-c^0t0)apEEJ`Y!pS*$V3APH_Q>OX+1bg`8;YeVHAMI|C8>+gD0@{@0?6ZiP;Kq*P{?RB!WRzIRLy8R*_uWOosq6Mt&@Vpwv>1aMkR3+r=@`{ zd!oEIGl}(~u%>F}p^0Ca9Xfx0-Rn6XVU)!w$`)(Qe%3p{skM2WJa*!MFa_4f+*tfd zLOcLg43J3{1ky384^O_;&p=vM6mY@Vc1-)~n$Ds>S2FRVZQ7beCI1qJ_&^z;c3IRs zpvl22ZGs}DJ9|x<#b%;-KwWM;jz=;IeI6OXm+yxVSwW{~%?Zb9vVxU{tO71HV8Ys8 zGx*eUBqZ2X%MlPZ0_IOv1hwgKo46mY{BW@e`xLZJ8-pZ~gYlReuHP?g=kDFNZH4CW z@VwWI1x4Qtx`wK=Si3}V&Y3z&xG!FQq+a;)u28}cfqE{sQ{`bF&M|2>wyX?$5@+c# zbc3}eNe%`An$F0iUwm~BYg<&GJ8aOTQ8MP* zTjfyv1E{os+ScOIwd9#5T*;O#H_675w+zwHgasO9s19-B<3~V^(;|G-TI0jRhqujQ z*XlA-R(6<81Swo~VT_K-X&Vm`D^$P%Pxjhn1jW*rBF5d6ly=3MG=Fqc20(kTHFe4z zxqzDptcMFQ3{1bsZPmR2!04SHwB|5aUp8oL^9bp*`1wAhy|xMT0h`G?P}2qLvcT{F z=_HXq2cWCPxjF)N#3(9IZ_&zwEw?W9&#)XJrRiz842hh_d<@b(%nZ^os<_RNs}nhw z$on-Up2Xlu^NG*4yU_mJYedc6tB)9C^bmdK|H?M5OS3HjSND45W75v47Xlz zTXdjrlRnWr3{^Op$UyN+F)W5dJ&mQHn;Dc%=y!$8JaUHvu?jvQ>xO%^z9wRdG9vZ6 zUo*m`Oiq$P-x7I?E~GI&A^hY`Hi;V&x0|sZAQA?5?@7-vl)hqrPugpY|FhBZMR^AP z+Je5Vz&qzqCS2QLCpNIAz-s3{dv}*cv#mU_Lt0yX;d10R)87KC@l=)|O1`8XTt|mi z1W(=i(_+OmVcVjoy5HR?o4?Qr35AsN9d7F{%>9_)W#m7u=NMa-kKAl~>~-z;@<_LO zJg*~ZObR8$EoJ3ys9BrLD$lgWZ02nmLIm~29B<-*+SBZ6FxYTBwfKP{Rc1UhC0S?} zuqb9uCtZ;mz7r84w!mLbHUc^H*BSk7x_dU5g!G`vc{-;ez*}+w0q@U-+dN3vk{3(h zXBKPNh5WcuQ64N`Iv7F}xvAK?FV-s)f%ToBdX>9- ztkn?PzoAuEZQNZMqs*=-uTwIlhBVZ=PKTk|kR_1qmedB8bNkl~Ppws=HE%sCb3e^e zdz&sb2r2H`y@bL~xeY)rvLiMdcl)&}7Pg=W29sPJZP2$*N);jWubs3!6lka+fIIbd zlYZ{kGnKnw$spiDBrNz9e(|C&0s4roAH_WU+_rP}b!%kk!=a#9Xl(IA?i=aXqTXsJ z_d0wiL*+0cLCKTGAX^6iS#q!3uy=5%+Fo4#Bg`DK#Dqbz%NKY)4Rl#-Bj`upt5;!T z;rVYN!Rq+>3|i|5xj9wa(m~Q6K?8_Wlcgn_SK@L?rPmJbM4+4&g}0%ST-7!Fu%^XQFG!P9SkIkN1|#$PL6osh z`M25kUA_)|fEGeZAKYRz^O^W5q`PlP*21kln(di_1DqXK8q>}+p3363Y ze}T9>%c~s8gD^tmX@px^4P2uB^1xmX2etud6J{A&@mqj}#D=f`3lL=~K=crx9?Dj!Ep_cb5=#h35)>yT<5T?hr{}eARIq2T=w!x z>_+4?vxT~O&d&4nM&p)PeM)x!Fr|Rmf><*iG$IjA(_D12+;hv=mC3WR8WWfozWhh` zSDltcN~~-|RuOzR6R&w(Lgw+}$+l?9FVWJDX4c8l@)rkEogddm{kOBN#oo~Kz96U? za#Q8;TqgGNZ>>RoCwfmvK@AGpPoQ`@R(lz$sS-`N7JFgK+`sy_ z-gx)V_3&@XfR;z~{qY6-OBowKc)joeI(#oSwUpQapqztJhAJc{GP_|qgjxDw8x5uR z&FGV@xd*mPouEwDEQSYXIxA8J{X z(_Z5G8ya5ZNqn4b0_$Jii2%He-Gkl_`&?(b=qk~rMue9Skv8qi!rK%gBPpPNSPnb$ zkxWG9qHF6E6v)G5Rd9kgu5p3EIR>jR*&Z{7NrT2eGkFk7%_ zitWqlUOFuHme9-)s7czBBvl@%3Aldt7Y@h23O?#HYF))qB(!<8Ah6wd*D^Ym0G-K> zl){Zq4J#`aC6j1{ms$c7F!c8dBaq%e5Fs7~R+~xV@1CpN9?fX3D>osHTv^ZEWkH_0 z{SVjQq~-bq%a6hwAVf`;G;eEZ+d!Y@TiW~u5RFLxNC{sgI;@p1(FD-FK2o8L&pD;tnZps^nI$XpsgxRNvy3P*o0xwA4rKW)r9g%`5)Tu<4o_zv zL04PJwAX^a-@9j-z)Vwpxj`gV*fx~x<8IARwd;c zF;WP*6jVo zds7ya9^3kaC5yVfSgH0d^cjttap9IEHZiyFl<{eclW8XK!~(VUMgBT41P-Z@B(vEE zelB}KoGKaodf&or`-^oRNVOt%5tJsm@2Wp#{E1K0&y6bmTZ?TcpsFvUHSerfJy|3{ ztj#^jSX03S!TM1I?X$OL?CR$U-2gor#2GW?lIF}%h*a9rpslJHmen**IB8i*=J0NQ z1pn#EB08<8d>oV}w}J-BTgk_`2KdKfh=;S{JOSYMa2JbzbCE<$RA}CcHUw>`(a&rQ z%VK;IH7<&W-Q`=fGCdZ}*^VxJnnkm`^$OWL6j)SL;xy-f5ID6_*|~h>ZR>fn2N+4L z6xA8>L_Uya%;}a0TwK+r0`G&XpFp}lZ$z*F3ppJy!Q{W$Z2Z(@X?dJJlhWZEh5A^a z1?8x7W3$ZF8-9yF8AL=bsF^TJbB*$=NfT2!^-AMN77L38 zEqu`$T&7FCO}ohupw{%x%nl{fs9E|W{0_zBVZ#dJn~At+Srcib9;%$#JNWiO z8uJzZlmeUs8!E|yvt!!}Qq8j9uCOEPRg;@uFdD3)g`I#>)EXYHPj|3y4@@u3Am{e{ z?kL>i3=g@;yHOmPkiBR^Xo_(p9H}>dI%=ACUKHLKk;?(oTmWdLLqw`o`k?s*=Aexq zq~x6}&21>fzl*bLm-uU~jj5x$UQ{_fLlD(NkCxlLOi);>LzV~SV8yU$gM2_gK`w>- z6JP33Ay+NLCx;);3(Cjcl@3*1_-qXV9G8?};E;}6C((Uvk!{-$RDTNxs8n5qYFsFZ z*yZ3^)P@TbId6CN>0emQ{a|yo##W!Pu4c!^*Iy};OsTVKP*+9v{lSRY`6;(Iv z{D5}&IaoL~p`coD4Qef6UE1E;gWHv#aoXkd>~*>KdjC<9?wmMbWX4;QW}(GJFZkOC zgnN6HPr~YJVu$1Rf)WtHs0T{xA>mw(u?|Z{1zIS57roSF@Wsq5Qm484-tsT;G`QTm zzU(-1NpqAUOHzw~;jj*}F|Z8&I4=RQN022Yw&o>{0<{y%=)xbc;&UROv^CcEtkfRs znKIzDuobDCXWPEtum>rh;ZnpgH#XB)VC(_rO~+0I^L1%A-uF&-?BSJ2GVDko&SG^* zMo8_9TBmPwF+XLg_b=0m+UY&W&$#L24fNq~SyJn^5$hiHQ{dvrpe_C2n;K5F%~G_q)NSp-e9!iI^d zxv4E3n;*O+eCoEORG7L_&BemP!WTFga*BP`OO36TS2rs(*Ucb=S+Tbs{&X2+BlyHR z^tk+SPnQb6tFB*%&$f>UE^G23pBgLi#oTMh4o~zv^~4hXs4ap%_}h|*H{2;NU9TV6 zw>c0L>AzKEcFb@5AgFB)rU~~1L{?3;6R6v{z_L1fzoVFZIJ{|t)c8>k*3s1Pz3`$D%%ti1muq0(AA1H0`+t5R=4`6Q|Fu_KGPGcy7ab90mv z?T0fzTuxT$ig}S8ypk5JPK$9u>%`fzq+uA0QyPwm(|9**B22mElAsDrE!PhUsBtn_?F+jVv7qw8+qexy6mojxs#*CQDNR_GN?3~^;P%rY-wUX;5x$Wu7jwG}uB60^%l zY2CgP4RwBgHXz>jQRM2?jW$wJ zPp(Ie2?s6g80b(XPxIEmGlMc!bFtugSy2V*q8o=*2!MI}#swF}Ql$Fj4mW)07|{>2ef|wd{-|- zEl)Z;r9lDXI!PMA1!C~@#)^pewad!&r|qum948lY1cxr%xEdC7N&O7p(8Ue*>3O~k46-MuiZBy-)6=Aq~xQ>qJayt*<=l4iTU z3=3rQ#Oj{XY|(vkcacfs`8%fHuhW6es4s<~uR>UNS(waE(IuZwT7aUr6rm^rMV$(4 zdrK{S2xsuEOzYCFZQFHEZy2F}7`E<#qn%wU>nFl8$Kn%FqV?mXC> z)E;u1;Pvi14!w)45VTHH3gJz)*Ny&!-3+VXi`x7mzz^?1O9LFovwAQWeSoT>#6hK_ z%{OXrHCl}@Z;z{dt#W2>HJ6FZ*og#ECI#y-Ovz8Jsse2tunHbg_K$s~1G^t*?uIC- z+^N)QsEVJ&K1P$Gd(z)UY|uH6Lv}|wXMkHz{UoXQlC7MFa|pao`Bvqhdt zH2LYs>r-Ge5G0X$ zFiYP_9apv0`CFqtK5&+4Q&nA&=ijA*8S0WqN-lomWz_to0uVz0<%LX2o-lyb zZ^ASo<3;&m4^rr}nrOtLq}MQV6SbN`=D}rdJgiRF+Q)#Fn@8?@(~HQharp>$SEvmF z4PfYQ;kRiQE(I`b2M)fK0Af&|;H4{ZzATN69>r-6LX5)VOu~gOB`!}}zCuGD@fo|g zq{XCKnAVh<^2!Q_se%S`!WEl2Q{c5jx_C={D1Sd`B68$XBQz0UenHlgl?M@z4PWEf zeNeq_E^)Mu9j@eiCHJID6@mKUZHc=hkhl!QU8>C*W=y&ewd1wUsQCJ@maA2dRDo)iLOB_5y~X%tD{|&Ycu4B##L?*=L9g ziV9K}43GFkz=j?hikSJ!!J1YC=Nyihst4*BNO+zc>Yfs~8tLu2aat6a zlxO}NV=&$+F0*<>q&~XEX*fy#ejzO62+5%+;Q+Il zQGQ8Hu4fv}>p!7NY;vvy(sJpW9~WD8hCkmD-!*Dg`r`SC`pHEl6*PgLX7dsjoos=_&IhLBe?wgJLbbBL$`gHsZN9!ow{MR3wibKCwUGb(g z1pm_mu!e?07JYYUYBB0Z%{KjBXE-29RcepCMMwXxY|+=NlwBvYC+JG9Gm<0tw-Vrg z$!>;7|*Ujv&8LaA0`4ct~x(ej%Wsjd7A?9ffJu0mCk|8siY$wWz120LtRal>f+Q* z;EV_;`Y8xNnx-ay`*r3O{vZV2gJZ|ZMLsw0HjeGm3ID{AS)W2I z1iHjPCB+D|W*^285`utSAwE9`FsvJ=eX^$NYf2z;X~@fOTTAX8e|%3YrTOPdr5Urd z2eQtVhkZf~vRP&Tr4fAXJa+Sdg*=$qRs({Pe#Wp$XD9Kcc9;TQ-HEuJ@1V$xU8^;D zFAwT`v)sTeR2e3M-n)V;+bl{-_yoL1Fd^wdv^bW7BB;sm1kDk~nmICP>hGbI!;mN) z0)G;Lr3)Wn5+B+lkI`0IVNpvt_1)&c^##7=V3z~kcFr(W5LS8fb6{)g!AZK81tsyu zyOah2vIVBkl+kmJrJVMP=F;Yr#__L%@YPtDw0d{|#c`zP9$sD_9djF`mhuY53^9R) zSO?Ohb?{Ga5#5U&^(8)Gf-_e5M8hAC=^zi7!2tToiOCyAbBm}Y5gpyP9?oChLK0t}%ewkOx= zu-)(HevaN`f+?MNr|i|~NTWtf_45p&6ORrJ$wN7r<3fZA(||<-Wa`4bWVrPAbCgXS z%DSSKlrgLI+2XCuQfp?LvAhGAP-pgQyXRN&*}s`+nh#{9mY16rq>=Tg-$B{NW=$Dc z-tM4C+r{jHRpN!;JRGCAmhgPB#727jF6PDtDWIsVS!7r439rSKGRS?)l5bzn$K>Sp zo=ORlan(?<-j@B<@lLFx8EiZ$B?yotMM5_0tvAB#yOS&Qr4Z~cnm zAaTASh}CGsT(|3qZaJkGLY-RDK;@Zqzb}9CJb^89suj(t{@^9!6Ifm02!}1M`vL>w z3*T$Z@w3d*{2sG~`d3|E{?V~i*9E@#zATv#0S z>rQU80DsTXPOvCQWngHP=X@pF!w!(ttNnU?}0z2 z?psSehcxB5qH9~%Y{iy_k`DLeT9?jWi$4V;nN7n{!xN3^UvN-7nVwtrByqKNf=%f3 zV0a&Sut2dMcAtNN>sY`Ufd-#)$}K>x zwzXM*{a~`IKuz7W7Qbpu=V%W z#I4*ppFjdTj?lY`%v8%^9GYx@i7!caHOUIAi16?fX2#oB-{9xOnf)%7G*nMpgOM6f zvAq2|hoDP|9~XC6rG@DY;E+LZ)o^kF4?DZBAnE73=G9cKf!5r{RprZpT~FUQx8Nru zs5&pth0P@9m$*=p`}>BS?(p;21?9W?c_fNzg}vZbPJf`G)}OvbpL98f_r5ZHr!;ZO zVOeE%%d^_64t0M*v^J>?98d3h6L5dw4qtjD*O846^LF!}b2QTKulpU*4kcC9KoD=K8P~yukK-j^{ zFU|#FXZ4-tyP}oE#c&%b{G^vu$5d~EB!JTt<2|euEXUN27 zCg~a0!%$a-FvnUxWmR(+27_iYz66KtekTQLRhg> z9>>#0(YYOsFJ|Xm1>PRx%2x-n<#DwyA%~AtT)e(*Rr4j16dn^(>-{BmRM7Owc_h!q zl6Sw@Hs>s7j5NeO_i#=c7hGrB(M_2k^Z{O4|&iNMR!j zZ^B)&gj!U2iiB*t4F2icmzC7RuA2?UF|JcN@~|Mkv}K8 z&eDn7SK|*L`cdfb%jR3mGW)nZ|3Rp4JZlS!FK0I=@o-w@3oAf`6VAwiZ<3<{d~qBJ zjz{jqf`TI00Xi5c`mTus%~ST2I_=gNN&{&-k}@~|3kYrpO?yD^@ zGt_ekoHf#+@B6&&OGpTKC*S1iYDR^ZlQq38m-ywlzp_TFsep!BR>~o3i4=`gw_QYb zR<7ZTZ47^>0n;fOEGbisN`)~6%v1qEa5M@1gtpz2{~_b7V6#;?qjX)FaR(J#+aE+? zG*(BxAIdb)!^vV)O&Q1ZX}^*voR`Aj%B?OP6)A^)>6Q}%izUdeTMBY)=`~`g(dK0Y zY^>v>#}cH&cn?Uy|7%ctk_+yc338GxL^{e7Fb?z)L*-oFJkN~wo`Qvr-m)8eSlODY0AHFEw4Ly3STjGT+H( zQ*+6t*-JB#Zz0?K^Hs!LY;R1KV%P^8(Oo0)z0h-1IYXb+9N7w_}rK|-*P zMsnSGO!JxtMP%Y2%rLhFg?_7!MB;ugvj4(6%fp`^r@(~Qod$L1lEGD;oN8}y&zf9O z>L%*ptKJYzt^D=~8XGefwGe%B+${ax%hA7RaNbhyx?fXKmoES);{iM4ZIE*UP?LSq@N>q zr}s2oa>NTeFtp`pIjZs+(S~R3pBAf}x(JU0F=sCbU{dO?ACprljJGoI>;%Oi?;5wf8Hzl9Dcgm8gnVyHLIq+0iMwSq6WKn69W=!X zklb*Ru}c2!mpg}nUq`g8X|H1JkaHZ{IQuJ;oFO#U3qUs+=PYC&KJOax%_;{g?4@Wq z8*!^_xAzTTTV#QOxHy_(PA-NpvxSIZB>dw-?7d6Fe;I_HvdoC5yRAW}L{Bd47ZwV| zA|>$n{4EPk8t@dnB+ojYq#MC7gaO593^3VMHvnD@l{F;3+T?;qLl(PaPFE__B%Exc z0O0128QwXheWaQ@egH6eNuUOh96e*rW?GHO$xLP}3M@dNqTV0=7dtnu(769kNEoR< z+Ni0F$$-81*|UNDV&>he_H|Upz8+zo&#pM$9*NlC z1wQZ;&oCR?NG#rX*W0fLaP`gVH#a!!ZA-dr(xu0g=TzteDtj%5=E;P`&)<(_0hWoQ%95PS%HONYdoJj=aORVUnmzF zE7lIVA9h6d^|fhcaZJ=|xXP=5@-Ay8$}9Q}@FYZvX`a+0qk;*EA5~;yXLq?gS1n^b{ zN*Iv5g!AMflK$H_;`zc*ZXAG1_CJ*GZX&aVF78XiNd1g+bG}Z)4!KF{4-w}h3@03op88x+BW*J$1<7f%fr?HQvVqW{&8KVIh%7-w zbu;P{@AWly(zFvitI`JtK?F8Bc{P${D4me5?W1A!$H6EMgQr3-`BUNVjziElqPxV7 z@y~&UR8=Wk_oHSb!W6H<4F~_OZNp^fwQYdL5W1^SJhC8q9=vE4LOZa{V)p#w;otiH zjXmt+8}%$yfq#SU?_Uvn?rzPbf}YskbMn-hO{mC017s^x(T6B3oHPRs#+qCQUrvt za0s^`CDC`w&|ck^c$)%%I!tN90F1+!V^U4`oR;f|tmkDVMl7?3%>C z0D?h#7dzpHl^D)Xkk~fX#wjR6+1z+hAqb4*AY)D6nZA2k`V1i*0TLV$M3n4^I&sPB zt}lbi6^T+7Cs6%0e-UN|E$eCma5OE3Q08ygG zgIzHDjn)JR#=K7NTd28=!ph-Rinz-*woS-u$kjZa!mHE zUeN!%FuYFJL@kjIG#c)?V6<=`RUM5gL*0(_E4*kH&}6~O>AW%%6*h>@+-fRLjCxUh zdA(_s`^_SnN0dZYB`%Ck1IS#WHIp?!GGX32!<0imfud39caftlIpx*#$j}`2!wuI$ zya>@D06CTRT5=^_6FAw#-W_W=j^mjpE5e{D>y1bN_#B-{zk5WfXvd(4@1%~i5jqZL zi>AivIiV$Y2)H$tV&4AU3n{MT=Vj_}njdj_V@0bss>;sdc7qR!q8bG?O*nr+$iE{P zxj*kq=c!D?^Q_|^9xTUj5RYi+K3k4*I*i3wC-DY;KlsGE?5H#N3kmK2ya0N*Kv(3B z6KuMZk-}Pw3f)9l;L?Yo2ua$ zP2zDwGa-4_y@~>wf)g*ZgLuY@W&XNlMW2RfObolKDoO#6BY?k2uCA3_r51y52Qx8s zJm=n$wU*~IDQ2doW)acfIslBOz0Y^Q z=V5E`>4|)2cktornpr$d#eWZ*V}yz=PH4Dg1V*~{3}#1x@!!^h;E%Qa7(}&}*z1L= z?*+VgGBVgTv^x$2aGIY?T2H6LJyZ>(CY7|>Z2~?hk5UMBY8BO!MUDOheBRrFxRnVa zK`nBX&tg0yCNbP+`w0>@65E&saul9JOw+ z%Ch#3`d!SEU94Fb4nv?7Ipx|GbZ04{s6^@2SjCgn3AAa zIrl^8zQ*AORgyQN&TIX#vR|_tBaNy4BlGjE#u}pmD1j>LO9ibQi2AZQ`y3S*GS4JX z$5;b(!sM8hRDZ3nPBC!4e})~~%Gsl_Kwl(E*8~~6cln7 zJo4PhXuIE5cmCH=X@MlSE9>Pno zsheyH`;8%Mn8DS7So5W1c_#OOXTA;^WUsFrbFa1e?R!T~{cne6GKUO9nj@bOVK3%U z6=*JW>TlStw`rc11=h5oqq54x_}_$CCgT^`mL*(p!KauhTSrKDHnb+T4~EJ|-{U}1 zot1iSm5eR^8n)2WjnQCFyV9c$(WNkl5*}lNd~vGvzdd&|hYyF&u{)w65_E)LaBC}aw*Riv``AzyxQO3d7zPBf!L7iA z(F?qXecT2O^}S7h9765|*o2ZCkDEtgQU9qHb$Y#C?j8R_4R}XDVCIlE%ztTl%Zky< z+^l%QAcJ2{Fe16gGLwtCYaG@(BZG;eb376U>yAA3i@q(JL3Qkx#@uth-jerUP-Ll3 zba=Z`TB(qlXki8k$TsrV6Tu=9kGU^fQ6L_iaXSdNzoN;wcn5|835=GAAn=_?XzNzq zT|ZGnewYJc^%P;q3b&$@v3ct>qePKt|3j>Cpi_d?oCwM(k96{@3HT?5$rwSHK9+hO zWcdjNxBI)h&G*%gm0A-Rz`~f7F0$|7gU0GjsS`?wruQ!r{M@YpPiuq)rjY@SrZw+c z9TFM4IZ!zF@5v#t(CgJN1Gru>VwCgJPwVp4yCoY{O7)<`U^}2OhqP45l(?^bBq(2st!G!A((u2*GLj)IHlZz}R?wOgL!z3EO4Ok#^c+?> z#dNo{8XI;Buk6wyfF^4qfeSfH+XMu=`7Ww4SCZABu=mP#Mxx?#k!B9NZ?tL)oUOx1qCt|*(ckfl>>ZhG zsqid=v93?gp(EVlcaQ`LAETO>!-?YCO4^n)k9=^nd3D<)-As zNUuq9xcR5`XEsXPBe+&xj z$QXHtAd>!>5Hou#;2imHa7l7Xca~Xn8$FN?R43Zesp%j+>Q2(^wH^sRdU9Zym9ew> zWmt0Kk*c?ugJl#?%m1BIQ9iv0jvdT-fO0s;2W=8>^r_#3q=Higjc&7>536oo0&eZw zxKT&UK049VXduqxejRiRR1*1u5EgY6WC;-K61e&$b#Nvy>3*gy_?i{_0Vz!%2t_}B zFKoKwjZca6Iq`nof$o@kD4YXBjd}PpoBgXFQ4W?jJsf+)WknG+N+`O#NxBeCcs~sP zx<;o7Cwo&WiUD;LOBy#xU)@8L=!oe-Z~U;pFF*SNd|LSt0yzPI+hvaRghOFD;^^oo z(ikCN8DN^FiVVDe8I*VcI~l7pM5>|3?P|fZ z?Kt+Ob2aDs3QnHO)>N4BQoS4u>E%SrK=L26eTum$4PO4k(kbo(NW#2f>A-(*cXljwe95lVrucBqz z2R@Jmp~S%3nfce?2;T0#Yc$W=F$&3^{hqm>NFKK8u|K=7n&{>=8B>YPO(?^s5M6`P z+kwGjP+Z1xj>@w=BBNLmE!!7&1Sea@m%tf*l6!72Jkj((sj*Q(DSwW;*)Jr4f{e|9 z<(Hl_uQ2V9n;RKf!TmJ@e#kascQ*9H?UVU`n#%@K==1YcIXy z&kltJOFzYr3j1o{sI~VEB|T^5JZg@Ro6oFTLbfdZ=OQ}mwhA`=u=~s!X`x7P)Uiu#A(OKN<&e)QH~q>jo)~9c!USt zCcW#Bpsk$4uI&FKWe+@Vav2;?6HE9J(Eaq*dwBtY3%`GSxOb2RZMoi)zeDG}{#DuE zGx#``E1WQ%_>bw=dl|vLGm|g;_&6$F8x-_k5&mx305X(M_CH#7e*W%F;e`f-y#Mc; z3*;)W*&ASBj{P5O0HPw@huk)p{-YE@76jicgYxJFDzc5_wKk4Zk)2nec*QypekkSh z$O6~0{7yRL*w_GY;6Kc$7XMCvT~K&#>~cUx5R*eyYoHj{K^f*V_ILug07D0ti%h=d zl0~|VE(Q}(=Gu_*1Sg`!WH1sEA6y%33>+8#V3`RXpCIqNZ5sP<2`8LuB7!Mo7rW6g z+mcBtYE^-mS%2p5L`&!M9j{H-`xftf(U&K|wV}Eo_Mp0k%faY8yv00|{3v8d%~K?XNmNgJ$iBeX72pEi?x4uvCgqqDK*!XMCR@-wRbAj(YXPK7{%d^@ zjWjD&yGu;bPo095x6UY}Z4vuyD1qcrL>MU+W62L=_ZeVfA4DmHp!R8Lv}PRxgWXbF zjGqcamIdlACTBgBScU^OWC}Jyq8I{6<(okvK(JwPmq|ajr_e-_pU`fSpL1OvAmU)? z?N`D!*Mm_XveXL+|C<@sQc_&vvOgmTzYtGW-GX!iHT*4{Ok6d)z33+77yb*)VI{rd zqc*WT^SU>Nf*>#s#~ZUB0d87Xb6@pPA$&TfR>qBWi0^l3f4`v{`+6L}*WOErf>dTa z9tU~21vw@USri-ACh{5$=wvt6g9ZAssll{C>Lw<7v}&-h0@Lw%`Ads#>E5ynbYySa zr4UOB7q~%-ieK8B>T7VEglK5PaA%4${AeDEscP~&(pVeRup8#`+sEKm*X?>{{)*{- zZc@v#Sdt$*Ii_OHPcTistb-~FG^X7c3n-Sh9WyhT;tO6#yIgqmJ77OB8EI9P8l>r_ z&xO$rlO}COLjg^LWf`K5IX6g$aFywRJMO!AB$%;!FklHCG`tyxO%%;r32CIfK(|I4 zKvizvK@A}ZiPf(OG$z4i+*slAj=o2VOT!kv_U3ody9Ljkbrzfr0;*glCf6Y$JGIa$ zym9b;e`otzk*We_DY}wsYfY-~XFRFCiM(K6C(}eC9N!)9NFMMO)9_&IHSf2u)y+M7 zfY}fippL$ScjqR2Dr)Q`^&he}X+etKH_~_j|Ey$gowS%hh`GA45JzBk2nImPfUjyw za#Pb=l3}2H9(R;^PQL$KWzx;0d)omm@GJJ`LTt4@AVc!J6ov?^`^%Xu@GL#8Qchq^ zf%EiV`5{NLy`3p;NhTAd71f<&(`YS4$P6&u(AL-}9_aib*Fsxof84XNbJO^f)73&d0vq7Us#{uJR~4s!^lMnoat&^quBS+AUR# zT| z!8rEm($a^jpq~Zc87((ZbPE2_KzLX(P^bFTmCcpz6|wC{GcoR$NZpc;m1V?nDJ31 z@cighV05WysCUE7sZu?lP+bzIg+{iPVg&IfpHOFIrJ}_w*1@?MOe}fO^wQ~+Rc_OY zoI|}suzb^@a*fHPP=_RCAP>ispMSP0vmvtv4G5`S6g{}fqe3f9+InH3qp?6vsdTs zhEJTk6Aiw76AOBxiaHDPzK9jf!sY zab>5S{r>zkDp(;@!9;lZqzUj;yE5PV=?mp#|2`zl&R6U^JDn~n+yB^1J6Wfc0xr<> znPNJpRapw3OHto5{1TSTLBaIRe@i1yJT5yTnjmb1TjZT7{dQuuK17ZS%u9kMqqsnG zgyKWi;nCQ~ppuNCx1`K1>)HE&ri`TeoK0R5o>KhTXvPta5pS1ZRxrw^Kq@0d4$co-E>H)LU>`ZZpm5r16Hd)Z%1ySLXjL!1WIc&iH7ex!wg;TxB>_{$ zSAtuMcYXVgI2mDdMXkw_WHb`o6IU1@0Kcl{-S);U%p`U#0fsUY=+OX)46M>)a)813 za5SrB1MS&~bw&%VH~M3+Pl1aeKSslytBcfL2;4+m@pw`HttfX3Q9V@M{ z-zWjA^8(YxAHfFc1?x=x!BhI$SNsjEqv-LGUxhXPRYPa-J0e6?dYU%G=G&=F2`y9> zX;1!K%*GfF@89&3TjPI=5X+6lB^=_=Q+xmGUJ=l!Q!4yEqPJC@QIIAn*ovm5j*MxF z&HO7BJMhE4FG>6Q}3O13fIv0A0lbAgWH;I4^WJzQqqgKjh7bIc?6 z%H%181r}f_e?OARCDdo#88*H0cCDL_Wr~JvYR;c3KM;d@RR~o3gM~llK!7W&hXYhy z)j3q~i+b8gkzmqSr6FWfiC`BviEN&J6P=Wz9zBo>Ry!u0xxGOjbEh5AR?4zI;p+*KNOcn55e{Gkf zSausL&%~x@Vu{IP9@}_-_C@HzA+Jis0)8Bz`l)(oNB<8Dn;B24v?FSQ_Zu_Uy`7w7 zErq7cPhu03PTsxQa6r@0zFIYfqG?Dvs6R##_6q0o!imnD4p0WRFWsL*o8aWx!af{a z)@?QXn|3=XxJyj>pnH8wcJYsqXTJME@_<-T&Xhe57Mb^#r8~tJEeUa>K@V#J2Y=~a z<&)GOir&=$38{r`BUR)Mzl+6g6CeH^hI7ovbChrOezrT3XjSGKwO;+6wFX7nD`zan^%?)na6yuWLX@VT>aBjV_F2xy z_jhaE7`Ig%#x`@H{}9hKS2>J#9js})_?Wj9C^#m>=-yH5d3+<5&%KOiZ zNx90c2S;D}Qzys{1X8MLv<3g>#MdZFK6T}R!X5g0=xI=B z|9PaAYa?-uXW2m;1))~pp37O%#|@HY;cJs;S?`RSH+#Z<`2uZVwiN0pB}}IG+hikn zH0iOiK*aPeteU=J0Y)Tn>KHzWyx57j9{d>ekelD*ybcNAL4F2c+@Plk=KtYKoC9xi zAMcDm;M>~;j@~M<@KIDTi`I8t1R$v5e885z6!<99i1r*KOx9Py^3thIcd7;+yd&yw zQq4df_D2Y(UA>D-rY8Q6wHSYR|F)oC(#eT^&1k5Pm6rIOr8xFUFq7*!j}qLeFS+Uj zT!v^8W$Z9 zjz)3uo8{Vkc?06(A3?4AHmOdP^&^jmYQYl%_{KdN*!Sff-kX-qEF`Nj=)@+c7c2x* z^s{j~98spWIz5RgOtR^Po3vv*S6ZUapfBn=EEEeuw4hY=A-)4x9c2Y4(4WP-*CNiU z!$6)DNYP?QN`%Zyn9hg;xTp|6VI97lGrr0^M)qk(Bu4gxdo6Fj*|79d3bfEnCv5%q z=_hiB#yF+gSyCQ!j23k@iL#fN$AMziw%;rhRB;;06Us?P(NLw9bwf!3K?KSUBIH|e zHiEUo@a6$GBCg$R@_K3jHNkXAEl>wSm^*!$%ey_6fg;>O&#Dm*^y-pt<2hbpQ_m-` zLjobJrWMvy%_!Na4&-A7c3&41O*>d6Y{+KK)Gsy1n-Rl&GGsl}WL#l{n)5k*Y)c#h zU@?x^hv3D~GHXBf+ImA-cpi7*U|i^?)G~_^yzY|)JZ*)+jOt#7=Z4FP`bh1FJ{V%( zv01V$m~9%eflTb!wO>586QWDYx!+zP^SR9ew!+jsjI^84|PdOB+d z7_$5-d(j#R%BG)G6TlyC4F@CQGOTQ)HXdSyfW=yLqCutZivyNeaWi9lUki{0a?Gz6 z8>h5iOYXnrbS;y7y{t){N2tkzZ6r`Yqyblk{mySTbw}lIUCsZlA;&oTJ6-P$`$yE* z7xnj^w*PoPdJUq0;Qt2m3ZJH|AiP;%g@2d%-;n1o1@>Ky!e_{j z{WQA~1li;tX0GcF#W(iH1f-#F*@KrbO&;Ky?RSJ5yE1-@gbos6Fk`nx50Sv2Gz^Kt zEM|n|pi6*?W?Z&fi(?7w6jYU=cwyJm!*@1OY)aPNX`n^(-Lp!uG%lphNi3qF2mCTx z@axz8D&ZWVq_v^92^r4%wt-QBzvcYlamT7v`#3D8e{f1U2GopiG(4Z>Grf$II>STB zm_h07l;G~qU{+iei_8cwrlutN0Z`|woNW<$kqnt7wRfuYXfvAO-sAO?+o1ikKw>2; z=}?r40k1e6)-vin(>paf9P^%xj<9V4-e=|zzYsH#0JDK^n6#*kJ%v?KuJ+#?x6tPn z#3F~H8~{cH8uV=AlpfwjZ z`W{YbS^&QOGQdJizxd}J*Ww6i6qVKyPT<7fgKJdwuo)@`ti5RH_m5?eAt&j>Z4+-#k4Ct=J!*X9Z{*2Qtxc@dvRDh*G^4gUJ`>XubK9TBCV>R34p|t zgdg@RCHcR_SUMN3PX`mbLOWW_^tfY;G1Oxh|EvXowH0Buzdmwc=ETG+>oXK4X$e8d zl#cNy3AMY1650tCB@e?~cVw(Oi>bTRe)H5684?S;BCn0$uPsy%f_^6R!>f_gaG zf&@PNq0iJ^7gu8Q)h$ZE@A*tKHrvSzYL_STOjeIR74j-gcaoNfxHWA@?Dlbq{L~of z?{CV{e*VVYWQ@oq4;th;HKANH3Ozb>Uj+i-lsutL`s|UrYW)_^&>T=5*9))X3dJel z|NksNBmMEC!=Ucplg8lO>4E9j-y2s%MUh1rTa9$kLv{>e0CV!$5{Ct%5^uma4~twF z{9U_`yk#hZIE-SvR9A{4%(^PdMtltVueo39CSDYCn*+DJ6)T z%X81+cz>{;d`@71c5kB6k&C>FBQ;F86-psJiMx4=(TJ>OO=T~a!gMQJZdRdSQdO?F z+b(VS1TW@JX$HCPi4Q!dD%7@%(JDhk6dhg}Vee~-e=BUISd}#cZXfbCn=mG9(jOhA z0i0CTClq>)QqhI=Pf(!L2}{tALv&|O~m)^qE^oVKO?u3_4{VU}@q@#eaV zywUqk>&4oWKKz)SKOFuqY%_1Xy*ymW1l`I&OzgnGvz0(nh@4P-5;RQ{oK%x0_gbF7 zLw^uT@v;sHrZp!_{k+&rU#*1~^&6(R)n^>U>2~t9TOcr?T3$LMKFB#~z(PaWyuMfWo+&e#nAUd3WugBW93E_A!{&x-_;Tpn0A!Oq$P8Cz&VUSzjRLN zoxTTF{dvy=1qswjm6VRe)nY@@G)z9N&LP$7?h_S>8NY99It{#*S2!b;aWVv|(?frA z4f;i(B%FpCix zMt2M|v@pP2IEpZ ziNOZhD{ zYe~ZD%YbWdf4Q}=g2YJbqn{nHJ?EDxd^D3NTJ!Y+gA~Tk!|WKL&&~se(mfZy0K^lN(og?Rqm2cT4p55ppZ67N-Q!=;)G@bLqS4_B$zIq8!cD zJJzp!rlwQQ{5&F^T2)e_G zLkGIH#BSq0NVi^fK43QXgKnIRCz4tM{xbpm7m!tgo)^5YhVhkRb|UbN`Uj)XuOis} zfyPf0I{!!+qD1gRD{z@;4AdM)W~_T8|h7*p5wYu!ep)` zY=zoFQ_r2M)+{Y2L)&p`mp@w)bJ-Sx8=bUhz8>k(?8IOfBmGUlH5Bao(%4qQYyD7? z>Y|Tppzy8JK1Y|&$`b7l-&e1K|-M1jSN0-K-1HHpiE4##6aj+qZ|*G{2$;9}xss4yb-TdIWd2&uqq zHtGStflbC`ty~83Maa+T;rehlHR_WP6ls!2%M{O*O4(ZEODt-+{ydE~UJE+9R0u!{ zhAk$PlFX2rz>^4|1llHI8J8$0Sb+^DT~pOvNRC9X@|C59Lg?z%f@aiT@y^IB51>{$ z_rk-W`?_(rtCJG=^+1+b+27?V_<_1Vx;Y@gu>3^kew3f8Q?ojj8IJCs_0+RIH3gqAx%s?gD zOoR>cBg*4a!6N3wMTb<&aQPh2K(9IFGv#;(DwEu5ljJY&I% zz~bVxQey-&8<=G@$u|h5Tn30e%OMk{h%CyII0|++usKl|i-Lm|ki{a*5n$UTI-lu- z&%8l-h?l0Tliu41uF`g>yq2mS_iL{tdU$PUg=H|swHSL2eV~(=9@p+fzuG{)bx^5f z-95a?QHGisc`zoAW(N?p+>H~9gNIYkJ}gNDO@oy}?Mc<;slAqkng~k#p_vj_dtP-9 zGz0H#*IM`YCfXEOJSmWLVoAPW;hy)95uM|MPCgC%NseM(m5p@JAd}Ik7fM( zVDU}Pxrbg$$c(Bmin_N+AGv$sX$f$oc8!GPiTOLN`FUKh)r!zE*&waOsCO2=cIZzE zI}*J7dvcG|kyv;U;Kxm9Au%?g$Il1u%mQfHBhAYG_ndLSDD~|A8!t8jnFy$>8%DGp z-G3)ck%VG&2+FNUUDY@U)dtu5jknncuJ?t>B@ozsFS_$a4j}7B^iFEs{;tG*U$%qZ z7jVHkdk-o6<=(e-m8D;Todb|N{0W0T#6MpCO97_P%3C6R3Q*#;a$)GQd4btbt&ZHk zc6VJkS_s%Jytah3U=w=Ie~eLVXJYAuI-Ze*2Q`~a<0*Gs1mtO%!*2CzzL;5f zMlkJ^XfFtja=mm0x^LFlnOUTsDN-O%93OemabFkk#>n_%fRIeIBAAe**aS3q=iF)1 zh-UP%DJ|FR2M(Zs@ZT(3j}25Tv<4+!I4_NghG{kO2%>LArBOMl91%Nkp!<37e}+Sn zb)Spjm7cw;eHmHX!F=Jb^(?|7zK^TtXD%XK1Y}S-tAdIP4po_!s#%K!^vKD_FsjOo zoPd8Mt&R}7gi!Q)`zqX!pFfRtD?kFU&NN{%HhldF1`A{m({6Z2Dzd>$V!;AM$oUx# z%5t+sUrkPS&`r#QtNasftpj?dyZLYo29(a9$$)CA5Nd0a=ESrekt&ES5el>rp1O9d ze4}k!v07`EEsqUd_Dn`A1TV-;Cpw5+a!yll*q~IAL3<$TDJAr#g6u|e*F@bf19z04 zpjPXI{+FquzGLvFwUH>xodK0W2JX}xC0gSY2IC^6=!nNek08C}=ECKS1pV4qRbgP) zdx&cma?$}@%t*^!wUe*xA1H#auDm~E(uS!cvCXhQ3MxAA9`4z4#vjhOndNq=H!}Xh zZ3yx#L1=fZ@v78%fuS?C{qSSIk3~Zm>Z?PFdF>7xwo;Po1yjbf*k6)Cp8m9=h}W!_ z@OyxoQ)Nq5XT>2ZrR%R5+#9YzL`sTE2=vz~ELl`GMnm1>Cmzf% zbVhTmlU7#8F?&;W9Sp3`&}bSf zNviD?r!Nn7>64a2kF3?QQL*Vz+1ro)wan4A+_yywqTVH zS@wVBZ^CWXfq#OA_&@#y-9f^2Qj4hnBgU-Q3(J4%o;~iur}#I+CB*-|`H!OeUqRcT zZ&)O2Ht@db@mQztna%J_MOmW-3XMWjzpEHWu6fxks-WRoK1?1}zNen{xnbKJbR$4-r@E&*c5b1D7fkix_^=dDDEqC(cZFGZ$ z?`z)MZ{}Hl(A-!~PCL`PxgvNuYl_&QUtSUOJ|pZIi^gMCBEWvmgcv4cX1lRC4MBN5 zW0zmu24$!I_Tz+UYlRwsm@wf=B18Cze*Tv)9`#A>~>ci3ng~1vUwc8nUXP4?^ z--7NKlboQpgm%i+BZ+8qQh2FDG3+!mNiGw_zZO`fd=<}Em~lWPa4D&xu^*Si4vr-6(j{d`j99O8KdRooDsf1 zDmsUIubBdQ;|(S~6cAK}U<&Y5X)lswV)q5rm`9Hj5Gy#yhsub;X?+>$h>nF>jEAa) zn}1(?0M;MGhL(O0h)Kmr=lSkl?6)R!CH(-Jj=n(y(;S>JjKc#>hi8g_E~b*x#MrPy zaRn=IXyr1O)-_ucR5#0u+nAOY1-BTf!00)7i8OiGi$Opu;%d|auLTV=;hMtpn=MDd zhmA^#l_V*`X7{`6T70rPi4kRg5+_2Gn^_hH zh@4yY%pJ+jP|gSs35ESR#hzpOdH(acC+9l+wRei}eAJ1&cmg`}pwYtaLm4GTgh$J2 zr?73}Iz@=zC+L#iTs_1x`VD#V$?xwlp_;XB&|T1Lqyr2$f=}?0L!>Js4AnIYsqGNn zRl(Op=6NVrtrSRWHZf&i{8O|GAW4`~f)P~nEGICnus`*Avoy$T0nK6qc>U2Q`#5q{VU*nwO>pvV~HdrDmj` zTA1SCz|4#&)61|x+vE*aV7 z`!%ZCMc1y#)9rehaS#rvLaS9mVcC8lMGK)#(Y83?Z-U3!X_amn z2c--mm2@Y`H_f-&^2XI1v@>%GMQj7AwavY!l9vc~^^6RxpFB;4;8SL#!3EKg1gGrx6%zCn)I0KKXNL_26?k zsY{6YLArO{XKcyNC&@sY+;f*m(yra#!-43sq`FhgDz zOQ(2Q9y3=>`3dtZhZb(R_zII`I@mF((6*6>pudKzAVqTU>s3yeJCe8Glu)sh@SX=W@+Z1mDRyxfk712TSc*z0^N+0}Y zbr+G^$1TWI@jZA$Kv)=BVT}H~S{;*`P(mHdt}qQ9lQG*_=7t-P;XNT`EyXJDq7+lT zmcdXVMMa3=S4jhE8_KnlIa;KuFUCwWa${UwPFNzhlL8J1YES95p@KPmA|7-_=_j(i z#(;tss$3UKisidkX&RBp12Y59Mxx}}YKug(^1dT0H--~>2(cuC_18dbDiY4sW1^!m zfp5#o1Ll+i0%lm_3>!1@Dyarn@*EhD`Ymr2!&%Q-dcc~i9mG$!%C+-5`8ZOY2@ReO9%2|3AyGDa zV5J?JJF;I8-0+^ValkbL;r;rA)fFWG8<(%sK*qq8skH|Exz$U6GAr#u-g?H5C*b$L zj>I7Nx5-J2${4OYB3?eP!a3l~q%2=T`-@qY66UGkjJ zssD1|miwu?UV!+Q-i>dr3&GC*Z*kU}`iRH*L_bZ_kbHRO>Bc9cy1^riIAA zQauSbr*=_h3e#(VK6TJv{jdO3IDRmD1K41g>{O8;2!Q#0+EOMzc<$VFqJyY6n#bEXmn{lY)#W{IdwlyFnxbjW)^o zO@0W>-Dl3JZ9oU8RO9~hcC=@-5N$Fsc##L1V>Fj6cTk*+(U@efZ$2vfrdoV&r2_UD zlFqf;nTejd-aTUKi(R%Se=cTEklZGTN61w+0-wS{5~Vv zRxs+u(3afd3sc0yDAQKCbY{a)1xD@c(nCFk(&ev(P;x%XPtd5`i@Bw8h`Nh`og1& zEr8;N_KN|u(xr|OH^7DNeNhU>&f25F>QWCd-agcepWU~Z zcBbF{Va-$hDEX~XOAxY$MC&=)@S!~0`%w{uuhu3$7f=>!%mKKMp=}jW3#K0l7Eoy& zu`l~p;Oxm7&q+m}BIZ?qD7^Trr;hc}DPEr5o};5_t3DCk@Ite)%TgDl0~$CKCEDBt zj0LgLw!=S!sE5cTWs|snpf=|PS2LSz?9|roK%%NVkWBQz`laUrY5}VI{fla}&Gri# z2GsGsOp$&Hx?hd$@JE62%m1aj3ri3J%w*rI!t41(Z}@+ZD(}ag;UcI)zm)SDnJq=K07w=X(&c~HLXO*wb zJkP{Yg;wBI20&q7_`XYKVBEggoBt%a=o*%V9o=X0Lq+MXlk{rh-ZxQ@`&=>y04OmH zKl$&xRr=cE(H*T?Db^0t7Hx)3n-g|Oc5sZ;y-Nh@Kfo>vPbh$baN}*vBYmM zZ^;p_hz!6dRunu3r$?5jf7dv|0oOCHYcZPOYB|GdYv~Mc{0%t5y0Y6A!GQdvT?A@;Tj+Y+)9wCkBP${D@HD7oWZ zF8iu8v^DIPZmK17*UEg7O5JV{7@gVfA*j(dVvapXSe5_mCaTU;Hj$eXr!I`n zuFX&64AY>Z3MJp*S(5b}!BhvV+1s;VNswauZWn=-O`5W59e;&#w>r3opK$ebR0XAO z(F;SF629Ze25ojFiPpg}UR=CJLSNs4P{F)ddlG4zbLrRj@Ufe~?=;rNf7Y{h{wmX# zxbd-D*YjUEZSQ#u+qw*6!MeO-4}2_B@jqXZ0XTgy)c!4hyW5Bod&>2GJp0%ewa&PN zXzurS2cx_nFDd_1%o#sM82`88ef4*q+V57irfs5K0|lE;Q#3#^DPM+dqJKuPRokc>_Il;s;+82<7Ml($a`p2ziAiVUgIe#?}~V-Rv{ynafn zC^Qb%=~X*i9y*kpyUCawJ}f=#Y3fzBd?YjM<>DWid}uAM%M=N$6z=pu{>YwQ8El7^ zhc1eCQVV>pV6E1w8Yl$QoCebSB1`L&(SMtzWMeT?6{%4;$z;{Ew-;4TMOwfapCT;* z9#s^$Lt88bphL#ovPCKSe3iexc_SkIAK&XAI%|U?jUIv|vZbh9w|&n&g%#un;TZJ5 zqAsQAR3wxp-j%U}3lrA=n0*>rB)}>B5rZ8mc%$n)y-WdyQ2L7Qbeed9EkB=ZQfpABM+$vC zTbC8Rbe?pz4)ti|c2qB_w3#Qr@dFke*q1(|r|a^JsT_MAH)+Qq8s%!z{SGX~eG8~NJ&t=Gz)FUF7!iP=9xAE@W&$*Ljl+#+yX^(nBT3JO5arwip2ec;9F zsY*lLRaj+$nxAMZZ0}=jk|!4CD*$K#%zSrZX8)|C5=@|4R~sxa@WuGM4}9tLGR|pT zh(Vhg`6j&6HV`tx)!vON;tMc@qZ?mvLD@#_Ko)qLTHPxE@cBXQy=wbx`QWG=^nae$Z7U_6`lF?iD>>F{-=6AVBg zeD%GlN;KOJ94j9;q@9*&A;I8mYH{T=EyiDIf~OaW?xr-WLn}#7msgOkwq~o6*UUPWvsC{M zU!xz?*RuQ;Rl-c$zuSV3vdmUBVCTp#FW%-#3+Wh>>?Ni-xYn@jOvloG3Z$JB9xe3_ zV0C;*QU3{PP3IvGfMy%PKu$Nq0y}86i~uk;Vheh{yUom?pkQAm68R%aITMs1K1|(2 zj;NPnRJ>)uqrZMm$PgzCOvR>1VfN!%rFei;tDRqO;^1yH(`PZNoy|h5PdRx{g5<-T zT9;(7HOV`9O`N|0!Yc;;Q9uGV(pUIZdZXSk*-%DnO_wcYiNLyWYt~W#3psE+fHSIC zj>PEHFCqO@)Akc0(BjCJ){I#qGgOtZsMR zGOmIcWV2}sSh6llco~uNIK!}1RP~9m2y=+hUba^U=t$M#uq!e`R|VYi%RBSR2Qb@d z`x+gUAVq<~!46}U(M$@QmVDG{pjg>(osuEugvvbXAx7OAb%$=mf1vbdfy4(%9uor~ z?Q~bU9pM+)MVwv_2iS(RWT;4O;#V9CO+Mnd=gwMcsWU6qzT$=`26~heHM~aTjZsf2 z$pmU`HEcp$v~mI({v)a3y0kI7O6lasCh-^U|A^&3xSj3NX-6<<$Tey2QE$?9AY9h>?@s3Z^LFM~*$q$12kiq~q`8U`)vYdZ0C# zERp^1Oj!UBu-r!riqs?AIkLb)S*HpT@Ml6Q2b6s+#EFy*a96KJJ#@ZZ(|}6@OZg$* z_TBm!mQZK8X#)&fJ?Za;0f1DX*9U}2B#r?)408gYgJ68GgFLZ~mGNE(4Z^Z*oGdSC zMXLpIxc~&fK~rFpf5#D_w1Or%!sJ(GavSbV0}!ovu)vPGOgukxpj9%kcN5@=KZe+bLS*%dfSa6fkP1T? zcOafM`Z?NIy`!Nty`ExfAFAk}K@wU6k%y17%uSxRI<~^RgI3}f^)mniS8or@5PXP8 z+W~QRX^9ynKIn5bHo5>1BhXF#FFY1qJLzWwkI<7)`g>ZLY9L3LP|^mPmi|0IC)LLK zr&ghk^T|1&nzVQKnbbaHhB(k_MyvVcGXY(Xc>H;(7B|ZXD6xtx(C@@0*m&rwC?=6Y2m$iEkR_@l5S$PE+|kFc_NUGf?FJE+zhEW?y8i%5`j88g z&*KE6UMy@pXi|~?}NNbG6z@4`aohb8P>idlV-`l`K$Eas?548P}2# z<}-|H2~Y2=Id~G-jDp9e~amZKZBYx{^vv|DmXXorrork?zXNgzV)qdA?Ji!w{GDh zANdHY{E)+z63W#TmSq8fE2LwHcJ`U3*a_m`v--AiwfLbNadCc*`EmxJ>Wdo36P{dM z0bt*BB`mAD5LdVd%R$5`BIknJx6e)hY9`kXXYp3CrGjl^^*JwR`_Y0=4|zmDBSMtw z*2j;ZAOu!LR4^W3Pxiwx3E;=z_LeqK1E!hpElaGgb_Gg+1{%_u%o0lX1~k5|T0M^I zirun2Sk_*=L zh*z(!@S(r+ci_Fp#rZk3z@aF())*L$k)Of3vYk^D09n<$$dTk@$cT|vC7qjCB6u8* zM=bMVK>B`v0MM+8UO~g0+2-(gT;;nnYOX_`19n!?v->RhwG>=kT_c8wv$LIzT_q;8R&hKYvCK2lmT+9zN@bcRpmj1c zkMSbvD3Rk`v4Le9g9<+{*zXUR=NVIsIIb1f*Lyx&dXJ#?Eu|oU)vi*`SmxPO8Z;N! zny9~-#i_$?C#qJGLs-`p(>&R=>3T%ObJ{z?wq>(oJ06b~S6p6RBF0WM;8>0G2#4ba zG$2kvY~(tTtCeO7BCIUQYAKf&=aw4fXWZ2i=6Pa81kDAT6#}pKT?K-yuXG>CqP7xa zG=hWn|GE|-hIP9fUdJJ}v7&+~Bwan5gLwQa$%v;)FT4RUfi8q#IS^epOD=;lW8Wuo zDfrsgejl&C`d7GVH|@RHZmbc0qS|kN{fi%d_=Dc`!x9W$zzxCRC!(oU!fW67U*7FY z`LVS-ckbXD-}uJck_!Of@W!9w#TQ@1GtWHpw105Z?h8f_g%8 z!m?U2yfrf5-np(Epumu_U_%IS=AU=!kKP&(r8-rASr57jECo{O`3w)Oy6VjB2Jy*4 z2VFYw+1?VU>3u0HTJ07X?5JGvAQiQQW|CcA>>c!xm343y1K^?_T)qf2#CX9q2=9~&3 zqrrd*27#JYLu!SmR<)7GTuG+^GqDd*sP z1W@3@gcv6q6SayLa#J8xXY3?k?cSn-rl+#%VLsfqeK#GJp_P^f@uZeXufs0z?j}aN@B`Pph(XT5UXrINN%n-|ZDp0kEdchzNuZIPn}mopEN7pw}d_ z;>9XNS=tb-p^5Z68To?~jjlKgHkGs`UuuCrT9vs-AlCsvBjE@T?#Nlc>SsLNM%hmN zzFZWnWXx*>0JV?QOO-(EQ!aAfMLpr=c{q3j$O%9Z5VHt4hSC9lo<~jAlqMC|WP}4v za)DUkqox(DB+xX&`>6w=0&^>=sy6QP5F#3S1ulEX3$9l)3IHN+Yl#A)w&rn;AICkx4z+$)oM#fM7O_P(o@{LmXv?^*js z{XiiMK*G%Wgr|J91ia(g`It_7nv65zYm!U?(Omv7bBJf>;MzAM?1iJ{uPPjJ%$NG0D0f|IP52KL(XD{_M(3F;vo!2Qw5FV$3s^!%a7s}gFovdR&A z`a%-zrY@rDO+r925{mZgAcLV}RQDYtIW(;hllg#7F3|U=tq^%uVMyx%EW6JDfzClv z@*{b%sL-(|9?-4W{potE^Vq@Jv$egD0PlGH+MQjZlw{We@?CkQwv)9Pa#jO5+ncpd z^t0dT%wu*QvVSxhh-o_hFcAKv($l~i4Cg@V^Z4o305}(z=qSW78s@Ir{HWTECL+-q zizYlpVtA)>94866T8=%AEj@m6H7rZ31b}AiOsz$%H6+2FHlP)xx9kN?yk_%YJN(3@|d zr374G0asV3A%dPf0?y8XhYwHzwAa21IFJ11>!=Ob?!SS5eZ9w*{?)y=eSSCXrrork z-d1bDy?giY7+wk|Bo0-$v%a1v57fGJK^1-+%s&bm#c!@T#X#DH!VDfQZTFVTu>K-2-8 z!*N}4aei*`w1VA4T*Sfh{<1gbf}9foGQgN1XV=o>0)VUj4X~AaF0~-Wh*=aMcFSV@ zcs#DywiQpVo*;yP-Li21766`P-*#pv!N&|PjA&>=PVLXB$2}a_TVJC4shdh-V^I41 zY{&nu4QpOm`NHxqUF}oP!F>Hv)huydm5OEO9M-g97GPF)e9K#h+6VyHq-XoQYWtriV!YnWUmvg~xSu7qIa}TD1Qi`bxLh~(Cu(iMnM+l;hP~=%xvyRlh z7z+ogDAlQ5K+eSo0cdLXrIr58a#N!XZ3wC=z~fSL)JbeQ)^)?Y%+hai<|SYgVow_E zF?EcQjAbH7|KsEy0geGdU0v4}58^@-GzduoHcyKvGdRo35>jEM$KABpTv62)B0_M^ zNZ=fvcAJHJ_wL~a_`%?y1Eiz zmYLWr2`$xX12`2Y4urJoFXv4pg8?Er=vDEaZ`CR;NkCja1gd;rPiD3@B=v~_Yfg&y z%E%Ek(PD_{a41(SHp-;WIdj#$v=Jm3VFU&?2vqqeUdSaHBowJ0QE6%r;DP|3-dUms zU|=cdY*LjF3Bv+H2s2vaV21CN$2teMgjBL6<*TSM1ka56oDVqc_c*`214SXT$gicG zcucv$`a+(&B~AnggU&?>*cH%fG6$T1M9M%1IJr;npm~%IAUTn@K0mE+3N{Czz%fLXqwyG0 z@4(i&B)pDSeLh~Qnc0Ju;6t!#R~x(LX?Y528ks|$`w0Qbu{BD`8KqW4xuzb2_qnW< z9ttp*Tu@MK%_VY}mUHBEM3YMPoQr^y&Sb!~f}Ed|gY%NCh!dJ4w3-BDlf`D~x6El>=s7RZ*G+xFjcO20_dlE@^Qy@EYU094!l$+hR2dZ1 zPDnjky*{ofN)pn0o`oap4f2qa1=LZq2y;PE41w*wA)8Bb!f zG)1__4^b~Kfo%m{d;smi15k*7b0F`~<{4BglMJq};Lb0QuCEZzFVNN_{MiNmr$fc{ ze*cz!zG*k@rv3D{S}R_8c~ucB;*H(_ zlLs%gV%aT-A#%099Cp0KLtebGS+YMf5ZD@~i4_5qfW5BkiOmdSNc|cZ{Gt;}JhnxW z^GE2GNPs8|Xsjaf#UcP{6sc_8qm^VDypj_5nu_El^g5Uj&hI}+6>$jO&M-tAZz*vg zPEl0%JZ1q;0kE8YVX5-lM#CQ)9Heb9HpnyN|emIZ7Za6n3YZc(r{ z60pBM;QV|i$_EXP9zDb~MZEw0?-%8V#Mj_GHt2c0``f3KfY6H)_`9X=Y8BczpXcUj zGFfsb^6E?&DVXL7IWgGmG+!or=(Z)hC$@(uaGn86u43kRxK{peik>YGgltlz0-DL# zMaaVajG}52N}L}pHl`R)07Z>S2?X+lNMz#{0G4?ka$QYw3<1t{y8$hnD5aR3e-jD# z@me^}%FvhsB(HOXjpMq)krS0ucVd&JXLmGKLA6*Dge@hr!ZhUvIm>KP@vYZ?b$x{p z0#e%89zlrXOn~s1CyzKyAOP#OaUVIprVs-FuEHB6^WRv3Z(o zUE0k|GMHko)GzW(HP^=kRsq_Dkl(%z;g<#gdO+ zfI;=e_2N@Sj(zyHw4s!Ov$J!YonK%*9I$OilRQ;fsSpBu;EI54JtCK6O!S-+Uz?Wz zxpA^x0f6K2AS_P|p6U+s!qT@z0&n&}t0J@22?gGJTwdNrtp&&95y!(dT5CAJxOH;S zZ>`C-Wnr+g^m_0SAx==z#IieMiNI|I@D2n6ZIT=x0iV-oVtA__OdF(vPCzH|ZBxwE zz-Rfp4}J*fL;*n#y_$qz@BntG6>V(!A_24|QQc}qK3;=dz}c-^21RR-oO2ed3iT`| zyHA#f=D?akJ3jzl3=}zGE&~IxK@&F$Cdil>CC+OpKq;(=uPJ^7AA#c%RYr; z6|=MCh7y7_Xyh@`6Ccp=)kG@M#y%^e=-3>e7lFErqVp^PU8{j(?4>9&{Wdl^xGgy| zK z1Wdp{G$87h2c;B~<7}$u_l*c(V$idZqo1Gnc0 zbn6PmwIxxU4tz#gF5U;HHWotoNs^$cjY$R!-ibPKs<&aCf+}I)WKC&;;%m}U*FN>iWiY8HfyX105jAz}Q3w78~2lxk{lo^87yfWVkc9MgavE-!6&cRTCBeyV@=1s_iEkI`=|e&5a^1yBA2c{ z#dC^KQbLGPB$(y=1_d8D0cz*5#`7Sj5sYGh4NcXPm|&}~w_$MDzTzD4`uBhkfj3?U z;sorkQ9}R@dthBr*A?`=@1kuh>g(SF)+5^M-vb@4(R@HV?9qHcU5}_}s8>w>JM8x; zCF2iX{SJQT&%X86{=I28?WVn_+QWwr@%z8`d-%?GUd6{h{&9Tt=RXR7>^!)w8W*iPj0ij4LcrzBMhM%X&*7B4R18gB8=OmvK;E346+x7R= zTCpsP$cnS|z*ZCD6j3r)>*`sK$g#435Dj+Af^(70*FEQ03Rg#0mTD(*$jC<6R=NKu ziVi^IO6HvHY_lvgv_RzYf-Mi2WRP%9XLjBi0b>FKf{!0R2GH=n_r2fF9vpYVEEr0u z$a#}u0wvLFwRAO5TM4G)zRd(-FtFO#;(|a@{XFsWIu<+M@HvkaFt>G+xY=9(JBbUO zXJxw(0>_1<((GjY+nOo_L_WVuzNA)%;GF@g9DDY{n04FWg)|do95gvgI5#0BCY+>{ z8Soc^g%ae=Hj6M650T{rbPhFi-+EPw%3{}`1PpCWp0l3E<;aDi74edbr>9GHsTzLe1~&{ zZRN461rE-W-FuPzUa1Akyg&)pmlqe9=NVT|u8_8bo!EiY%xb5s>d+w+1@Ehnoya+q z#JSH!R8LAPI3A8hS{g~SP0oJ}4Xrd$0qF{OwKZ%qURCL;){1rAuut-yoqOv)r0R<#rrHv+tnGt>@{6(M8}PEk|`x-}^mP&mtxsJ&-ONr=<@S`al> z0>KBis!TZ}iLHygP3|otc+dUIY%QBZN~i@GoOeE=WU;Gh-f|iH1Lxv&Ug&%%rC_&P zY#wO5plZB2zR5egKUTfvB8ZeTd}F0sC6C3xaRMAzrC^ykPawHNfC)(RGGm$Nld;Pr znha0@(MTBPXR^!-zVy$&giS~^H|?gqm)d{)5B}F1YlNT56@Z5T03ZNKL_t)n_Jtqz zjXyNO;Ok%f@Qa`L+^b&zaQClqK{xG3+;$)Qd3@xT{}EpKziuk`Z`x_w(uPti*7b-f zP6(b^z?$6kAqa3Ge!385y|C-~uq%>RwPKzZY#YmuhZx}{2|3S;0kc_xUH|{H_b#!v ztyy{4_rKt!CiLEU)RN&aaYsRKK!7AV-U`6X!uJ=R z#?-l^ewr8b*03Co$azC81@m%%BM%QJY;+O%@Yk#nz^fgAJGTC3qz=OL1DePg(4w98 z3i!ys3B>;DuYGT)UC|y=oTi<$pd<7?0B#111JdEy4kWtlRODhwg-Vt|r0W5gx1M#> z`oKSH4IWNBBIS9=yis{V1&p*afj>_Zel8xhUQo7;$qwG5doLaDd~Z(4C2}tcyldC$ z9)xFBbQpe~Qq*_S2{?do!nU0mywffP;?MTM!}*L_H;@$X&!)=p9G=18DcKyl(flR}4c zEG@|7mSEiy3O;<$yjCj_y$%L!I?LZvhxeRx_1XuJ*%(J0e#M7SsDEEAR)6TseySC&QvaHZIWcdx`u%fH%Tl%il zuAt`C2yjl%6+JVx14tHbkmsq^Fk>HdQYclc1fKtUm7FexI|pD}Px6kLjMB6~>=UR} zj+vZv%$y$KeZ+FO0aQK62rEMws&R4r{UN;Kz+j8sU9Nxz*otSi? z_tJVB0KYz+eH^ppbfU1M~=!_MQ4=Bk^34&T|ca9Z1 z?A#)$tdqVrRZIUB<1HFvc=7w4UlgAjS%9#QGd73N^KO7DW$U29-Wd_Hpo^yoW7;MTV z&5auKVG7PyX61ejIj27o2@ z=Xt_;UGebnh}Jr8Z*PXpgj|yChB7Rtd?bAwS~%RjzN9wF-W-D z{Xb#`4y=v1AvFR1vDQDhsX*gLFK4)tY)et_o8wURk(bGXTA4_qL=h(TRxF1FB^RiL zg2pO(%^G*>^@gbGO8nk+o%tvY0i7fkVGF8KxlZ`__++3j1UOf6!nS5Se}0FjrxVh| z3M9cX=|Bm>rDV*a*x)5UPcgEje2l1VShR)^a6B9kf>@HsHLdH)bG&yrFQkMvVl{0{ zV2c7KmuNiC8+lVw z-t}G^85|CW8K?6KRnpOYD)@k~i`jKQubov+n&j=;xZ*vqt_A<-AN?wR>$iUMo1B!_ zaUK8uj!*vZ&*AX#?|;*maUEm40`SX!(qH~C3I+hH82rqK{G03eQyL%pkNu z*MIZxz3EH2j*rlA0M_%#K+JuYtg`Dd2>^s4A0AUeJu_K=6UdI|FWyFLm6@X6OJ{bq zgsrwZl6NAcd9lvlR+{V3rr|G7DrxK4i%dM_6nOT|Gw1`LF9B;XM zIKhS1?-H06gNU4{xqc9Bkxm`n=L>2r&T zy>f9`?ACXIU7=gY>&0s8E_`hmpfrAw3*kyGaHG&}#eFRd%jbIM?LDY8wU@wLpOGf2 zknh`rB=7^kq}_cC@DZq$yXmb^E+iG}s&u0ho-jJG4N!2ebqUhAe*H(Uhone@Fd=wW z5YX>(rpCZ>{iI-~%t1iGQtgr!|1*_bYr`9HbQWF$2ten~cjwqwb6QMpj^ulr<0L9X zR=d#o$q8d*c0UHNV;#5hUCOlP?sx549um+7BpXQq_B#p===;%owxJf~eX!=kG^3Xd zzIP~Gb z&SqOiYpG8R8$>lWVmzV^P8)dbo8<-@+fI0#1j4toW_x#k^gPXS=kv3i~( zkbIxm-PofgTT4uw(6bmr{le|+IAreXp3>VO#n_x6U4y*Oc4|9tcmSoqPJu)3o??6aw{U9%?6NCO-iej53 zX6Z4BZGRr>9MiRe#csCS_w6I#a z`!2;~9W?s=W6pL{UeLnhey`So+*rXob ztQ>#f-UkwyY6*eur*OH??1vH)d+Q*HMX|qBJzLntz^pJX;w!us``D!o5(N<I|SW5B`ykLt)ZY&08DOH6&U(XZK#O~hJG(AgA5WwCxVyH zQu2-}Tlub1)5Bs10Nn5Y9w+&;>f7HTGm6;| zE|dclFm0`)(xuwi?d=U1z+$eOKw}{ zJWpcRQY+5uhQr}t-R)5nnz##h1_|-Q0DA!E^NM+%%(wk`JR)xyuU@^v2!5;!LfJsWOsZeTGJ4blfI1aM5CaiPW%Rf&ND4g-Wzo1NWJi2Ws(U9F^p9Lw=L z2oXlefvtACzt%eDg`a!SJi>dN*A45ou_{7J*ve*q6JtcH&7L6%>7w;+bJy||$qPWl zBnt5J)_A40V%N?Z_C6rRj@lf8 z+bPZUjxA^2FQj?IIfvS%+g;aWVfBZ3o`s}2@-XKe&rh{pQQ3c~{mjb(?~;)YTIxh8~0#Q^}s1p!jRsgwVdH+1$iVz)$AbU)e^>aY04a+>i z2aidJG7xgiJWs4jDvF~qL~MD(x^8%Od&{}4D88{umgK=v;#t~R_6d2Q)PhFcy7p_W z$c3#9gX}T2HTc40r7kh82KXr@gcwAHfNO|37Z6Ak6C|JMJfF8*j0_fIMBXyzKAqRL z?z`T5YqqO(D9@#opz3p)N2ujY(uOz9i)8LI35@5JHpwZWSL-jqd$Ze^5;xI!C0EFt zvigQ4ysYe?=a7C!tre{`JUu<)SAOLmT-6J%6 zXsu$N4>;W1ASCvESGxv)rMGI~?t_@r7J;8zh>`Erd0`b-1CTzbt9wr#c%4-6&4&Gr zBysx=W9yogkJ7^OU_lQ+)4%~Y$OK-L1QhH6cEFV%UWROUAc>LF&U9GuUlU*=GEheg z4%(TxFTU%uabU?w?cUa6ymuq%*cbH~ycop~m2QU=>b;NfG08s@LgFrJZU*N$28_;J z{!UoJaq)f>494gR24N6oK$xb3%*%@N`E0}o?GT0nv?Qt=Az)k2XflsmuNU`cKJEMY z(lr^~0RubofdU_+bD$Xj$wdfn&rypK3K(d&t-TND;p2pDJ@4KXOt~S1WT3NMvveuT@BIcB4iJU>kso#P^(1A`~8CyIJKx-N8%scj6;=Pn-O ztdOGXS_?Rw=(1vleg+i3qRV;I1YoSK4v%!N(&}C2-5?3<2`joDoR`9<2g>;#Znt;z z)=+Cf*-oI=aJad{a(sr6X7=_riFP3xm~6UAa4X1Oja;A}kX}G=Rm;%MG3@|g0GU9& zGI2+W1lobCYZlHyiBQf51Jd?;Fm)!B_`uSJJ_NSyiQK`}dqHoRJ8vCH5sYj->N8b* zUx`J4GnsqczkTp_DiAfhR=plpOc_#`x&e`a?A`t;waC2X?&sc$5F;=MB5tf}U8~kP zE#woGf!AW7&L0D^U*Eeg&YyAKDCkWz3ZY#T8&olZK-OV4&MMd%hn_Wn_{MA3)Hsh6 zysxzm$zT0EwRZpzycT?5gh=N`NBIST&0!Q~`ygV0AhYkY^k;E|ktV43dkg zfY^J)nCE)Uug6pS^?pHU)%Zx>%YL5leC|Rjp)prp8-LVy=~~vJvc@aAA8&c%wJY7S zy0`7`*9R}>){r~ab4A~ihqE=UM7kzY)%p%QDbXd4_{U;MChce!rhENa*;)ta`E#IT z(DS!h-RS0q)d-dY+~Eks2;4s7x%B)kbnoHrUZ95n|LhJ(3I5p~+%&__Gt%LRFwgk) zFyn9h_P>1p1HO*yxQ=i8(OSbh@4SQm74N$)PB0!ZBB9Cy49LZcTzG)m1RO80a# zFnpdT1DcC8lW?c}P>Rc2z9f=Db5PAg2e~$cfFLy_$n(jWYf!aTZ0lw<9DAls0eeEu z1w|Ae^z1#I&v^Or6~6k_uj1i>a}WhDNr>GH@Ik=Rq5NlLaRGN*<8yEj3P!%*0|Ubv zGqD8)$D=U>&dcOH4+7vGj|U`CfZ!OG-=UI0^vs120k*t}{JOV%OBK*G#^*dCKvmN? zKZjjAXh^ZgC`8d6VWvwwQF38hK0in+8k;D&k#kLl6eEcET~p_K-`33tiU4=m7mc|E zY|XidmD3=58WE;dY@aNn=*dEb|YId)=rr zw8phj{eE3XIrH=1w#~>*+qNO+Y_TpAPk3))TNNgOvf>`kk5*a9B88xgvg`oj>#*LNhr=sZl**y{v0oP zjV4H{>Y#N3CDd0TmuOSOumAe5;a~iVEBW?1zP-lbP<&t81??;}kbDOqD9EFQ00q!$W9E7iX=>+p zU9p;k6Z?^KksJbuvtb!&*B~HC_OMj|AkTYrDjRMShSGq7P70E-#5B0`-VNf1f=!y3 zYLf4zOVBzWBpGEQix%5iEtuKw4)76gJ%0|so1EPg6S{8(D)9W0j)}7JXE#nbT=16Y z8H>6T7l2-yOTmZt`JlJn?7md?TJOKLYVwfwE-*fm!QLIQ0z5sqQZq&vg$Z#IJB=Oar*llLDww@5WSd%KUPVxk1}1w+ zz?E3z;F%!Q2~+YHa}*?Gj4%x#tP#}1T|r1b`=WI93_w$f8jx-@5G$N0>4%995y2%{ z?+sKtI*Cn)_h97!m`VqO$3`JA0A03TD_p_s4g@q8Ny(U^6dMR6stbSvNl~duF{(p} zStMN++|>mTQsRPnOiAWYh4P2_88xVM``8CBNf+7~rOQPLAt2)O25xlUxm~xo%tQ0A zq}_eXKL)hh2{i~1&T&yn&$=cZKdQE*9W&ZZW{9r<_S_K_M+d!}b-j*_O~G{qYDwh$ z_1+bD2MscS?lpTA0{xEtxw0o>@VdD?S3tY2J^9=qa-X$UKy0K+maZxv@YdZ6K*>1{ zCSA-V6Os3o?!8vn+c|F=+h56g*LM%__bkgY=Bxk|-gyKUj69|UQ9VzzlTs!0RqAuR z`eC)RCxvk>R-X$DnAs02tnCyZbk9=%Tyiwdc2Ve1ko^MG-;dpSzmKnmnih-{qVE`T zX43Bc@9lv0pR@nI*T0+RdpDvN(T@x8(o0TiRDj>woa75 z#dFiiwQ~X7k;FY9Ec3!Yb3-jbNdwLYwq5WZQLI2nt`maUl~RD#LI3LigO3UHjjw~| z8T9x7KQExi2VkDjPfu`gQ*hBola*Q4hvF>Sl3Og7&t!q#(UquVOfx-gjy=*WwQ7w35mcvjv;&N zoO{Uk3=6D)oHGuGgXHVn%^xGnpmW?N=XCFYA2pf~0uIZ88!JM5O@)U+Unb{9eC%Uy za~E>0W{UuTz0hOCJbUwGpQnUv-EcT8aL$>nh1Ov-cFH;9>tFvmdM7-8e#c;`AJzgy zthP{V!#r``91tvT>~D z*5JCsyv&%F8Lcw#=p(BlcIud9{%Jg{&yPrIbun^CB1BnM@$_hwkWzqnHd$RDV36Xy zci1*oK45~eM~Z{AIZu-*>j4h674*ij7Tbbkd;hFV>W89&C|@WbTw7yx0b)WxDQpj_ zHNU6RX>_+!$IJI#;pXNBK6sQ|uq-n_8>?-MW~1IaritI9Os)~TmLjU8WWanBqJ=gW zSkr=IkQR~W$KkM;)rrmrjpR}i`@Poj)>|*k(lZ2(Kb`kDpU;@m#Oef6hvYoE;&501 zIK&iXe_=qriP}Xniv(bvXPf)HPmLT<)ekh@)axMX$hjFI#fzGm^A4x;3B40;Z*Rav z6pkm)>uL=dN<8YdA?J!1$y8ZVjA%k4QNmSKwJX^tdndTIvs42aIf_86w!w*$+kQD+li#<}lfF3c(9$U5GI<2U*d}W6MmgZ}Jb?hv&Fn{o2EfN6WXK^JMe5A(o?34Juzx4C?(l7nxH+?DB@evrxsO$nH z)mm7^zti^b9(RRuVWdj2mx$nr3yniwmrNR*Dl z-oZM=LI_A{vV!P7IAn>kI66Q9bZQ1(dAU~VjU~CghjYyev!ra)PL_yv=^zIYe2hXs z;KC_`GqCQw5CdEv9>lfqbAxlZd;S*kwh9PK&`v`Jg+%rpuMq|$snq}YM^g{pKeVe; z!EHDp7YKV+L1+E$eOIY{hDf6ucq9dO4f3@c9tMUGAjAUpG9Lg!YX#l~OJ2PKWIhS7 z-7Q&VpoY7|HCR?w{Qzbl;M*uzSVx}BjTj=xX<}3ixaa_@RJ)yYyWSVx?<;S~B`KT# z5}Z&#WA7)efj@{qEu)f0ND(dsB){O0W+~n?0DxYR^ClhH{CP35`bCTht!!}A0UxD{ zK;`XOuA0{)gB?bu09i3%59$#OuwL&SN)&PX&QBpm2>7bq=|dKqKeGYSy)Ewr0`~f7 zAe(~5dR+=iYLc(d*hnA5L;{r})#t1v5A7(~CwF6>(1kR-u6qSj;Jg)1yml}PjybwE z7?f3ji^0DtkE$DRu3&!eB!2Y#Z{0IlN}cx^C8FqD)=m#}z$Fh4XLFfIfYYvEnyecs zV8A(eIP-^x?8hn}sPhA0sYLa+S7yB-*gCxuhhB?-ySldd{VI4zT;%}ZZLS)q2=358ukdlQ zeHqe4z-!hi7lqe00uX?t`-yZN^v-_h!N+06BP2J#35j6JFomhi} zAm=)-*%)PiaYE>k(W!}D44)Tj`%!xqB`1iaX0cd<=iacKF?%7e-|gW%D{oNSeK*Eg zWaK9))GMt*JCgvIO%$jhZv`pR znOLCDT?rQi%u^a?yj+nIk<1o@fDVr3Z0&dlYU2#jbH&~@x`5GS?{nXA#NXxZ%-I9- zdy<&`?@k0CU~>9ye2jHYGKh2eS^E5;?-}&|?~=bYd16veVd+S#6)s3YAF^d|z-RB` z_3yH?PFXoJYAqHU=*RGUbEcvLA($`;%*#8|xyo@s?;Rm>Jint#?0|~bR7FS$qCf}< zwhSThq;vAVBg!i_L|7r!k@&{kVbzH}FT*n_bPNx&T z@P+>ePft(y(I5R$eCku5;@Bqg1{X!CP(eynO`N7lI?S6$`**DCu2WVlg;Gi!Pp0X8 zUAjtw?!B2ELrO`yjw{aR73=woS}SgEZxI7`Ei0J;fkDOKC!`cjvVESl6Q0kaH1TID zLHT$%Fn|e%<*+bVC-GUQLDW{#wh|{gbsXmdO5y)L&6Ct~$W(LgA0F`R_7>BWF3yuy z+Q`o&-$^MM8Cuoy=4oPLfCCQ8!X4VJqn3(35uB(;%<}~AgMjJ5>Pkbv$500XxiAeo5prB;lwu2-1oDd^X8nj<`4L-d9%OQb?v=BU6W9d zk|x`q;YR;R--Ouc>|1B_WYXEV4rpUZ+mj8sme55goGTqh!!ezWrzgukrCADU@P_QJ z*EM5>z3e6TGQu$GZyAm(*6+iTphU)kfBSga+=@@~pIv zFkmgkt@`opr?t;;XLC!AYtToq^^}von`yOpwq&D8?>{Xi8UP=<9kgXs?@3ZGY>CEq zhI}o`-)Rs^k1FaiLLzP!pwQCjLOA1Fvk|#jKUPHz{N5KW!BC6>7ot?(3tInkzMAX_ zYGW8rYfX;P=PaAD%MH!*F2vkP}ku6DR(gcTU<#pU$ug zGLgFL(A657s?c;HEqN+EQe=r&IF7o1{E39#EKrt=I48{^0^6O{1XE(!+kjxN!Nbkx z$&64WaQQPwno~%W;{Y8p2@u$#SBivzk(dRJIhkh&am#r9XYrFxNpq*mrRBoTL`!O6 z$J>bcKs5TFvqC3+07y6v;LX79*e0i-X!U^E$qS9O1ixH;;9=#afS6Y$69d4$7Qylb zLKYyzkLzHOD7L_>auXNQEt6e8kvAd|k@vU%ZinA?B^4F?Z9@CNqAxMP_gB@ReF7I+ zB8WJj0pFzkucLy{dtMTQ4wOy*d3J7Zmx!Hy3M1o?vI1s=j*R%Fby6yGj`7EEJ!I&r z^g{!=>!i*mcXgn@T?m)@@PO!~?o)O1Z>h!uPhd0m9Qa8JQ+E9DTT;*))yg$|X#kZE z@&cy0o&Y9Sz%?%^v^fl7^q<_W=YwzJn>zH_jg{7F7g+~zQVv~7EqGA_STm|RNxBr& zgVC5c3Y!p?wUi^AW$_b(70NgkT@O!lBGX3*lrPc z08j0OfNLlF^IuH1b|?+%D_W+BD>BtZ2=(199IPV6d426ii1>HV$-+*@y6Oq`vb)AY zwwIb|3LDo|)1>PNNR^2=2j!9jiNXMi0N#xCOMrMg2uhE)%S#tM$--kBTdORfqAAv(a`KM4{0z1jG6A)U@ zxwsplyDdEvA%pm4NXVJs8nUL18oQ6I0sza->c>nYNr@!R7u|39SYp}_RJn-;>oezS z(3Gvg8nJ->;)-5z%g0W=z`spHgJx(*_Qv|Js|zPx1ndr&O*!s5)6-olf-L7AL)KrRj>d}PSs9xxIFP0tOa4HY!;_>;?%v_K(9VwRuvS_ zsi9C1EJa*JM@7g+;n0!}O9L}tjRg@})pi67dAzT@_V^6JhIDcfau6Q!_C3N^v!GKxU1ipnzi+M<=sR$WNxllCwCwYD~tM|+tGoiHa zxWNEHr($|M_yxT22jml4XP&1w2Yypwe5{nBP4QW^O$yA}Z8G1ZdE&*v`!>}E@E}c- z+zZ>1m;2{yzw!N?#y+3oMlMKZvQqNax#`eg48B=1+N;`oYLUn;bEiF}sFjb@Ure?~ z4S9N}R0KHvt{>O1k|r|k>gye|e;;vb!K{ir0t&j8N7gi=$e#@-M4E*AL6EQ@xdUrQ z)TMndyg4Cnn4cSG)^GVecNLa(0p{h7mk8_)ypX2dEE<2GUwWjp22zI>m#H>Zih8w-#aph zvt;X0fYCGU1r;nz)`BM*5BKq^XxjfjdYkWYyLmM!XgVzV8ubB~$`>601}p(X5K%29 zcPM@esA`6G;LV&4>+525Sg8!x|0#gqTlRX6rkY<#m(SPLr&@WTZ zb_|<*7@+N2-c*<-^mlqTWX)G58mnavmMZI07*;jMB-e2`{P`#FmMgUm0fm;mkWlMf z_X09DcEm&RxKQuejL>XEG{6oTRj_$K)tyt}v@TEAUaqa9gR{QyA;BI=9PhM(^<8|HW%`%9hzp8vOnC%FTrm`W0SAwpbQFH=}wqy>5gkM8(gxawK$<%pZn z#$m!_eCw~!#Q^ZJvPCSQb&~7A0oE7~8)jZfgXz&+NZALY2fjjK;n-Wm(MPy5H#3x_ zG{D>A7i?J5$3!8aDHX_%*l=JUb*QH_Kit0y0O&`7nc0_}3vCrmICMPp^0G^pCQwvT zPCDkYP$tD3@Tr~PPi38=Jq@p1-0Tu@5|^a`EXbuK@ZQu)fZp~hK4ydhj3Lo#mZU0O zO>xXSNyk-lTIJ;9s0Mqxl$@r;c={b-;DsuK@!)MaHi5McJ&WLVx;uKZ6pKbB;@vZV z?#~}b@v{{-HiVIKVyC3CN=+%_yDR}@B zGJLQ05Qv(;`v&11dGaC<%k*QS=b@BsUtkktlfKd_PSX^%uEQh0Kod9ldqg(l<~xpE zg-ufy7e3rhD0i|4ng#9%_hD&noRAh3Q~h|>=-`x^yzhMr3jDtf;UMCN8j~X2^L~e_ zuljnCXC8qPCnOI0jve&hVPIOzo4()}({#7;tk&hJrobYkbrvo%pT1dzJPEP6Oj28C z6dtGamUS9Clm4<&N4`Ylpc)RJn}f-@k;C~sR|5nGfG8NUI*hMA5{aZFHT=>x+ivtt z5VfACVyz3pa8qb)IfC`_aszupCyH-Uh^|h5F~eD%q8z4-1K|qIMytFU4SwhE#7`R2 zU@|ULyLB;-(if;-GE>&%IVKYwbaC@}G}c48WJQo}7)q~ArbxL*`NgH;a)*uz5FZ|r z77>#@P!y=Ibzz+8*yJ#WVde~YiBPie>daH}r5S++l59&LlkGqGFuK~5TTEC)=n!*> z3OLO;iq9LxFtTBido8DtByHU=0mCmxxVXJbiM4wwRpi)*ptDgY)Tbe zZV@r z(z!g`WLXZMC8>{}>T@U2WgDy{DM>kW`s6@Imr)z1sE^@R^ZBo0pDk%hiXz~qn4nER zTV6vaozTHReATzV-9a1+%1ZF)13=dq2BYeQpsH`|bOW=0YYz%bG9*Nz`rREMSV+&|-AJ3LAc7!;nyLo8&BnX1~Ok{dMjywxz@R_g{Bt?}O!#DNJxW zYX41n80bttRstPL;hMrQcJtH)H7@PLYU8vcOAK5ay87ZigedK`8Q1nFfH{#|#a?-55cQDe_?sD*+6aVT{Nl!6Y3lS>*(Lo1#=*0c+J=<F-d)1&;lAdD7$hG= zScDP&;M;~tb^jGxS#3Q&1_iz$`p6Xp1%13mRcrruDD^C8iu{jMp zgz*Ld-eyo0B;ml3^|$9if;t`o4QRR0s#Uy4Ho2|4dL>U72+gn{&N$2+*iC0`?t-sB zQ{;793^&E;xQJpz2czq$B^mqJVBxXu zI0>Vxyn2w+>~kh5Smi6bT;7KG$8msCnMN)mHJ5p`7r%Y_)95r^*Gpmzp-xo>gP1r# zG=ui=F8mj0$)kCRiK^c3ujq4w*V}6uRrpw;k_@#U#wa+vc4bA4)69X82)~IiM(x}A zIT65F0Y*e1Z5%m!E^WNNf+wT;Gp195Y?{X9qlft=hQExnVWhKNwzSJ7g(X7P%h!+LPZ;2+b;xttxLn}SQg10)7`$iw|a zr^_in9H0StJu^p%)=|Zz;KqraG|ET03q=*Om-1^fREiayB&HJyKt8JT#$j87>0H&C z`DXkdlev2#2Ng+$O4Z4CeFp`u3~;`#fl_H800-xzxqu42U@nq%kSfZnsiSTb|c7@_Xv7N0tG(N+#` zpXc<&X)#?mhe2^9jof(W`KdCF-2qz$!FpN$GnYIW=k;*Rh#TK2 zfRB!KeSH(M=_XtIcdaE!^&=#7@srz1B~D7%{6z3L*TfFOl9;h&LRWnu(dk!EEX-MZ zDl0W#j%p%6ue)mTyN?Mg;i#lURtI&9BX}&M3C!~?Jj_r-O z+>|iuV5vR~#Obnt6eEgH86?8_n7`pzCwYFmn{d!(EZ-y`30H9tlA237haV6MX-BrY zqo*VO(((Q=H(jED{KWV&9%Ga&+jn8mXH08zc}G+~-b^9!o!zuQx25ShcI`FIR;pg) z{({jvvGw8KTzEN7&YVijO7EvP5yY?ky-cV?_XZV@Q-U{$B!D!6V4WBS%OFvKUEza) zs$e@9*s!o*QRoCjG3X?ZRNRaRSSCYy#A^E(K=RRN<}oZax(>OBfeJi@mZlx4y!!c2 zAAQUmSw~Vjd1pBIqi4_486yAMBB(8FoQQit09J_e*h&`>I{YRMOuTjFJ+tz?tufdy z6oJ4WzHWDi=;EIEm{cEdl0_#~2S6g!VRBK*IQ)jgZW2R0Bg8mE^W-IY)aQpWh;(uU zW!siaW1J3+%vEOnaXo3ghfYC|ltBzxlzP;u8i+OncKjWMz>VI6I1xcrON^xN#cOgQ z!1UGIjhLyDWn|2kF*{w<=fm?Q)~_i6I-88XHO(S|Wq7jUi1N{RG{DUJ zB)LTxGj}??QKrPL#X!sAV$wh-@L1yC*a^|3v&+0#)%HTFq*i7Ar7FaFu-8T!zD2G6QMu->|3=~Pw6WhU8y;d2L zkj)-r_Og;t?I@*kj76ia0n>#GUsKP73I30<9D>jYOwWxiMscf5hxn8Fc0;4(|{o z*2yCCVZ1oGdJCJroVT7bF z&^XI!N>uoFTxr0uqZV~{ob3U+lW*@6?5R{WZ zSyQ2QAmj;HTWV(Nks!DMybEpOJ(9C_Y1EXRLZ$2WcD1hKT=L{ooA!3f`_WoB@wwEA z9{eCQ1(ODcNl!?*yFd0Y?Kcujz!n}yK!|vUu9;P^=;<&5Sl`^N-I1CE=zW7qsA6kG zG2MSRbhlx#(6`dLzae9An+t{h4FGBOtHJKP{52fD`fJ^SFb(&bNa-@E_nqDh_I4Eu z-?@&4#MBwr6QDgp?XuKNkS+)&MIY;X-R%O}NXbcXtv5T=bqvS2kN{I2GNxqI8Q!|K z-nyVBTOzf0LUxnI-yj-%2?-M2b?!j^GsxZ>+$$A9=;|)y=3r3q_b+E9d+<7QZ}%$l z^-DbTCh*t+4!hW+l8N7){?jE1QF-)FUM@GK`e zhV9aFiN9M>M!RTAV2&ZwHNb)`ZiLo^zqnEsrhT0#aMwLSE8%aM$MAT=@52jHpU%^;7d<(rx8!q&AlyGbIcf~Uq(1_|nbufdfNp}5W(`Is z=R`yims|zAkcQ>xJ)=sfijXZ;H^vWDJ$D|#PmU^wU8b0^IlK0A*5gyPoKL+WRq$zh z>L{gL`o^+n+UCe|nqN@T2ev7e{=I15Qak4Ylr$l}1M1Dd6P5;DmxPB7pFHUZs=9jE zV1xAK{%{f{&J-gYeU-g}y(-*d`d?m8`sq#F$1GLxbW8yURRh-x2H9^916R>K9}hwQ zvnb}-y}VN0o(g=HWV$pR>B+sa|IZEgy~cSTqemMK22^f-nN0Hkvr-WgGV<#vin~); zOPgyJh<&R-jbk#@DQP5$kOQuCG>bIp9*vm^ve%e9F zzw33N+`<;l2^ty-Q3sKct#m!8?=6{MS8H-SnvwNZ;S~^gi^j&4&`IRPsS)(bBd;sz zea+~G+U>B!4EBuk{ThgarGa_h^ElGy3jGH*dB$_SP9ztU3mxo=kf(EBooX$poa(V# zUgJ{RR+yV`f4FgI?y(0O916ufSqJ9g54A`05vC@~i}y>wiWMsE&I26F*_tC=V5%{F zIJ4lxGIT$J)W_gGLKBg?+-Jn|bIZ{PqY>`Lc9|Q)mef#Zz9S&>*#V`?#t(T#XN)CE z9vlHAsyt8yjrL>*qm>0|&|hFvstrDgeKr#-4OJ_~A+vZN^#m?Sn`25isTFus5>re6 z1v0Y#E=L!b(4I|;CbSty>bwsIxaC+r?^XRB${pYM%Rbjwun zt)Ygt8SC%R>W!a3sH7D<&yV^70CSK!skh)rC@IytgvEh#{tj$z6js`w-&3Rf_rMlb7v5+acuTKy5%v9?O=8~- zb~c1PjjG49fn|hBN#nn`8CO(Ilw^pKl0b8(20p&Ob?OpC-Q z&*KfqVQSLR>ACI`Xw2dpmV#!TKL-S&GLZ;N-fqbdrh!Tt?A<=cd8VFuMft9{%Y<L6lXppc`~`hUFuh~2QYjG%J~!4~V|Ze#Ao@&5&OZ4#YAw6>y#p+5m11slM;2?sR;FUBCl`)y;qQL? z3_o@Lq_t#~o;ML%bPNNc1A$6$&d^RngzCg=m$pjfbtGG4VFi@zhkvh-U?M*OrP@AE zutk1u4K9}wb3Pp8e{HX>RAEuX>RXL=@U`4XKwsv?v>{h=78)>z zbq*d^S#0Q}8MP7z5&aXDB86P45k<`SnXg}z5uu0`s=V)xY27AU+uFLK7Yr`E{r&ro zJm8}t4zPi300PAm4Gm1zPqFXny^8R8iY(C_6hqNId4ukO;4W4vOmb+ZxftQ445m^a zY)qVkvg$VHIA}RwzfO8I#J@G;?P|P&%nl15)&W>nc=vRHwsTY3G~kU;mdiUwERcbp z_cCXK)~V!Md#;1W{VG#`2EAmHVJpL0xk_L$*j}B=5&K@7 za`f2!ei``WRR)-AlWS12>=pOrREr~wAsPGEd6cJ;rpS>I*}<$NjkLQ-()S#}w&cVI zrzyt4=oFN^yu8cDTi9UtB%eIxH}QuE+k-dS;b`3AB>Ak~l$3KILJ2N&po6)t8nPis z;39l^{;Z=DBX~V1^JkU&MqVzXE9C9-UEsG~TjUrh z{{COwCXRSof6ea;?ok5i-+%Ez@<|S!RGI}gXi?vit?SJ42y#?%EOc#AV~dJ>MQWls z%=1bP3Ma@XV;H}4^&slY)`+{mV3w2>#{c|$By{!aP{Cy`?Z{PL4iX=5`rYtvwBzEP za?=Mq_P9gvF+}cpYCPik>c`pdA9e9`YmHfI?fk4!y&E<%6<87U$by4f%?MAv!6E!Y z(|y7ACe(ea81(etLv9F1G!&lg&ty)&k2>d1YF?wY(B2#}YWw}}6$>TVckZCzw5(i% z_UC7LU=h0oo`cIIy&ar9Z0Ti>DAUU zoLzspesj4-*=`ZonN8&hY$bL#{A>uWCXzzilvRt4wgngw0N~*dI}o%R`I%!bJxCzxHrG=EkiEXjW1P?X>=;>w{E zYyv3uw5dIU{7CD`fG<5;r>tbFa|HdWPbQ`Tk)2}s9Hz?BOPKFAepBn`g> z=x`*PfA_K$D;ayR2LzYNF9+@e&doE=eOaP!Nqyu#Hw4?LIItE3)C~rPF|YyWN!`i_b1Z&_a& zP;)wG0Gfa4I&|1NQ?>kds?Ik@WzC|0Pm`Blj$I&`KWaiLJ@uKmLv3U@9f8*R?&R!=t5~b7<&hm`vq-#aw(2{LB zR2WN%n+CSo{&=uZdz2^{u?ru*Yc~AuHvGw@m*2UyO`gw@$w{)8v1EJp)BBXp<(B^) zUf_ql>A?RSaC=6@r5^DLAU=-qCws}b{4raLqK1ck&Nf)IsHKY)dIfH>eKJRHr-PzQGwSUcZHaYEyBgpYO za{~N+SRX9|0npKWGH}6!eDB6f6LRzAwFsj<5{P1Im(zx)2c&*U_9NaYB&~bqPsD(e z!2HZ7s=)Y|baVrIZ(m=CR<(9?41DDe7K2Q$1G_lQp1Uu&(1To4_=^0zldiPtzTjz+ zx*ZA%WGDgNoS`MA?v6{R@9C5oqZs>RDSR`o~H0kK}LDmPA5r#p2T@&haINCA$4?ik7 zO=QC!G7N;I!I?J8YEh)GKICE8e1UYBi^}P2UCEz*dK|NjsgS<9X z*szoX>86x!IQ{5~yNj>bd*%u&;VRc6bsrx1awntdz*CH{H2ASUAABy7C8Stac08Ic zA+nsMRN_U)ys-5J=GjQ}h@!3%tqvvTA2G);R8H)z(~b4dlqAzgZ8)q#yk1TrnU!+#}~pETgDXHAhiPgN&#wi zP0Q;jwrhS-7mt${gQg!RA25^PxhMgc|L&Pdw{DK6K>u4lK`zw&?G74bs@ex=EhqH1 z9Ql8JPp^h#jI>iomfO%y_NZivy`~D{j(EoYBikf~*i!OVUZmq)+>NVZ0XS{IDQPb# zBwPmz+p0K1euhyW7)1|S#T>jpcUSA10F*cmIjCN)st1QAM)zn{g;cqIM*Wm5_ydrb1K=rjH|s43j7rAc zvtDR->Z-+`Z^%Lo|Fkv7(ia;eE=Y&XzKUIGh(nOiFGk*5;7E0EoJKVOis1w-&i{`4 z33Z}iHe;RCZ${4B)*Q|{hy>MR+lfLa!j37Eo8;F__0gS5=2Y8*c1m{yO+$M?l7<{? zvvkJtWC<+|cV{jg34$>~%xP68zhp%F1r3noF#By*I3=@1i{tLa2<-=`_2fe=loGcw zw^gKN|HIYr05cdlPRi!47~=0|DuM69<$%n*qERH)L8D|7Rau1ubue!J4V+$;?<1bj zM>a_L(u3SyXE2bIW@)B{tvNDPfvBz!3A2t2LibrFk#yhTTrR=f?`>@km3!^@W{3rjNavAj7rC8D2_%rY zju)?-`AWLrM04E-mm07RL_M5(?7Q-F5A>KP^a(jJ>P&>LML1fs3b zCVTW;lbmT`70b;Xo8Us{;ELY^j#`&UTbUvdH-i8K>i|(CiJva;?bjE>b%Dj!(&W60 zxgt0j2V44jhyG|#Gp^!o8OjI6e;9iQ3O`Y*EJ@0tfWG*C%Z4F|@}_ z0FKJBB(&|d74>9DW`LzMFmMD=)(RrXgC``(b~!$)$0Rd;4}{?)xxCNLv;cK-YxLCR zW2dTG>(11>GJKd!ozI{hf0A6TcAam>EAG~JXoURYqi_b5jztv3a>1S*Ckvy`OZE|| z=OS(0UDz^bMws6lmaV6q*fKmDwuxX-*A8UOtZ+-|l zIQE>H4A@Af?}>om`rIKe@s65L)B1PR(90^HrLJ<%Xp3sB+{c8a!dbI#!sOG6wpaG5bva zT$LSLO|JBA1GfSQ{$s-GWL|c&GJB~7VSHQ~kKe>~bQn50U}3Hz=%`OOsNKkAwAW&V2OhBa!mxU7vijGVh1xaS^`p4&2a@oHY3!gFCm3} zPCXfx;DBZ4jdHsS_x6|Zq~vj|Tq5a&Z9VwG=wJY~6*DyziCmyO#r_YBKw2f5py0^B z@mQIx%uczqGXnAYQ%YD^WQt`;`Lwd-)T9jh{!%y-8jVi06=86Fh26&W}-fk$yFIT`BPL;o)04Y8ILwI}#YgG2+tNAIgu z1adO>_!7nF49|8Ru*RkH$HjlS@;yPXa==}uPTCQ{z@4ChF!J{o)fcYw;p{{Vf8L%~ zV=UCcArJx7Yw^W_`}y#L)oX9!n`BP+y?p0;nW^9EZ#UlVL<>UMufJy9exk_$QEuUa zzY=ofJE1;mOH=nowuNS~B&A;naXxy4RW<)@vsA)aST=CUNFm||<=~dVowS>ge1<{i zLaDwF{YpqANHK)#2ZE)@@T`k}N`e?vsT-A<8YpRK#_@@RHu?rifQ4KNYw5uJDG-wu~fmY~&!&R21#d4@b-1@B=idbL7} zv{^mn)$&&^2@INf#Tob7^O*kJgu-tVZ&)GC$&3sIdDzAN2JcBqg<94ugyJHEiVMz$ zLks#k$EEGI__b%_`m4afR&;#|5lcj13;vF~uSKon8n=9!9JV}kWOTj!m!K>51dc~d zHXDGvcihGlEAj{kS7!NXo}w6#9a62FU^o>boJ3J4Ar9dO-*%HC0Pwm6J5<5muaV7~ zBF=ICj(^p@4N9!}LAwh~LFMKnA!-fQiq2M1EWK1HP?>3ZRy?-}(jxZdslIg!VBE^s z-H6vnw)ioiBW}V3!puPxRB%~_d-bxw)jn+Ynpsn z-w!5_e3U65ycxxQNqQOO$C=n2FCt{#s=P+H#al*8DySpFXYOQ+1U)6M*%nTcuuk7w4c9FpbJ`-F?s!zL)H zqM^X|;|P!0CNDuujhal8kvEsw@LiK)B(Y;qF`q1#4}qARNqA!!=1D?H1tF?~by($( z=h2^`D!BwXRocfzyScJwG=OV<`+9gMbTS#LWFO6MXY3IlPH3A`SDqq$(6Z)Mr$~4^X&%t z*5pD$omJmnf3004zFpmqtZY&nY8qeUR*NGeA8s9Wd>97&ehU%}WTurCAU`AR2vYfv zKc0&1rV9A=f}Oosp`l&8ChU~cP%_in0mj$kQ-|Hs*iqLMGSxTqt$7CVv z=hmxWI(rpQQdX%Pr)rJ_>Wwb|E!XW33x|;;_;H`1Cyzn$9Q@Y{{vF`Q;pFk1(|UZz z)fDq+4g4hd4cnAl&a%r{loD;iLD!7R* zd`sq6cM8nBcC}7u1wWhK@jsG#1FW!-dgd&2Sd+OVHMc&Ysrv-}Dy9uQQZ-#DD&vuM z*2{Vk!IiP;ye$h7ch;&>MuYdlzv(Bt55K)&B*72k8krbxZ$kLI?VVqe(r03{%rgy=75li*@vUVM z>dfj8svMEs=OgEABOhSh3@`Y|J`4HoVuP(^*D6l!2SGyZCzn-U8Sv(CgS(T*@A!V{ zP%6WW)vF23H9yKn1OKE(~fzb&_TPpPyyW3bh+7t1!)O61;UW+0QCA)TEwKB z|LO}C6cC_RP$q8TTz>}7Vwp?fQ9(lcp}+lg6c`AjuqL?EW~Hu7XAB1z1Jcrpq>_=L z4D9T42TuOk`|*(grib%BSXH9ydC5nhMh2kxt@+7CM*5zS*Se#WWSi2JiZY{cb6h`nVfJ3^dZde~=O^qS+|G(DFq{jzwKanO8}U{z1R+)O zUWzHTp+&+5-wE{ai%zXVNv!efn#r})KPpvI5LZ(7MU!}sr&&qs_nyx7PvNFmZn$_` z{5+FaaBk{eI$g=2uXMn&(c3A-XGwkDs8d&2F%&*DC}&E$o~PpRx2x3~;CZ{(S+mw; ze+-+EZ1hDofo_Xn*=}&tCw@DvptpTe(Iaf(%NHQSEj7oVy97$w*XNp#)hfi)4p-jI z^4*=DXY#9r{72LLd)xJRUhhqXK#G%ZD)n=%~AQ>xXGTNh0MjkOc89J6z8Vxw%_^Fv72$%TuE;! zLPzJ$@=+#<24^^X?&U-@hf299EX6od!EZ3T+gH+^SApK}AM{JnZbERb*2Ha|o9 z3p=UZ0i7_|d?@t6$-WU~8Z7oDc=Z^LtspItzN_#*(Gvwnxuh)|iV@E!Wc;gAD_m$v z)EVT?E@j$Sgg(}N`-z+WA`ZaD0H9vS)^Ka)FTQF_xxqh4wT@7Q`Ck&|ga%vlkaF0z z&<^Bgdg34q8eLavo2tS>Vtdo{@+wbvX*F|kJd|n75Ky00j6VW^Sl=4ViWz>`J8s8T zO{GPEX=ahfEfk!`qA2K{*z~Q}Rb{b#)AwF$qZo|>OrkJ%LfMG;HHiR3^@MgCg0;Izb$shy^MZKU93I~&?|**TaQ8Xwo)4|mYekbKPYS$)YR zzzH{w(@gmwjfXi5LvIm}fsSiBRLz(e@Hv?_JKmo=*b7Fcf@{=6nMwH~b!|d9id{)h zMVGLYv$t$k=4acnN^nBwID}EjpsdC%wCgMg60#e8Er&lAptQp+UmH5e7<+{$V+7de zBAdxN&H1S*Nmtd0SK$xJb*y4i*N}ft=Khl;4-kTwetkm1!cu{s@z5olG+R<8r^rj) zy{BZDv}K{t?L4=Vmhcu36_J}OzF9}f7>V_QG}EU^Kb+Q!bF+{m%B~Yn$wuc*QN3@MUse_TX<0nv0xv_4VIgAI*Vg-nuh?#tu zHwbJP-4~Q0uA#M_l&o>3rupKg44SIqm!ywZp>MF-OJKZ(&9$om#}{DRKmXR{fLot&Z(#X z5)~;~l^`r_G?KbRi09-Aiv)}fO=%;1uoOQwR;NGP3gurCHE1IQN%dQO$12L!v#O6r zZ%&P0fz3iliw+RJRdu}+kB^DLzF(+vNBnx-7VwM|{@w{5Hi9R#3Y#ts5$;K!+Pjq{ za{ub;QRL$4V$ct_75xPk+zj+R(OyiXVw4K_t@*T=%bUH?WGUc9bQH4K;8J@~o#NEa zN9og(EFdQW>$ZYe@@b&qb3wY1xFBx%Q9DA$J}mhkgG$r)FV$@1l+VE@Crl-nb$fU- z2$kvQU#oydxlWfqeEL4HE+Az*qxoO+S_1AjT8SYOfWPQ)d-da?Y!HU&+p+Ey@O?5U zs^@;`-M%|W7^+r%2j`YlL!qr{Y0=+lBaAb}sv=~u$=tZXG9Nha$sMe>RRdTu^Yn+L zZpFkFTiYzL?D^JnRAg}Ty#nGH0p4-z#b;Z(47BQJzJq_R(4Zf60`s$|W|K-DIOUyb zvtwxsN}M3I%ctJq7$I#(PGhMUAx$AETi@AaMAR@_9#pKwdlO*Ftnrp_CLPQD0Zy`e zBqLWDZynf6@ktEf8ZxHrqMJU>W`{pHyYHWuT=+;_yu4H%qE^|_k#_kg!h;96M)P7G zj71?KO#pPK;>MhG8JdGs7$zY~Z6(urZhj%YLG99FlI~=gYtbK>K4Up@bHbDuBrXLd zC62d_!EwPJEs=?@rF(wE|R#CO&^z?{-%6!&mO|2=xt}#{@r1L`1q_y(mB%E1A zP%kWtT$->OO|u7#hm@Moy9Kxp_z1=mM)d)X(Y0^=Vy976at|nYUXIo1tG~Oc8rUOp z^a~DiF>s_f5n`XfZ#W+zrM4z%q&z434b2G|cK-Du=hq$iifNWVl_2BkeWdv3xkqc0 z+H+_AY1eYf&@gqX=&gGg`_D1iG6|{n47p?)Vx`%Q(*#W^y5!E?wTC!A2^~Z)NYOh# zswguZ^wS> znY?-TN9*wy18QT=201Z5xA>XIhO>a}M-O>C9(JzGVs!$rHX(Jv)vyd`<2ranp$2P; zcb}WJ@cQP;TNKVaGtHTX!w(Qk%bGGd)et3Y3M43KomMqJ#jU8&aqW@~+t$n21I4g| zi!y!JG8DuBTA~4$FjQhW_zPo7Hm>h{6P1 zl-bbhXDu3kU&M9w@pLSp&W5SY5rCAlR&B@gR=Wt1Sj z+J1fxN9WN3)oQ}IkojEb4>m>GlAwaPUXB$e0yXEDnR1x$Sqj~o#vZJ$w9g3p zm~3D*>9XJQE%UO|vvHm5M#>b<>HZ!2=+As2W()mh@k!Qd7RjaDEC|zZqGE2G50wSr zHzLFaJ*~@Rv;P zaH$E@^>Z*jznw~}n`*_Ph(xlt6&xF;(~t50Yy(rBh8M_CwC8qc=4GBdoRv4QzrYLd<6+#*VpQ&#|rP>2We@pwk%FBRweIP3h(g8n9CIj;W~ixrEy_t$mDw4Gh=El3C$N4WvA`91UDv?FBG5Eo?%(2}1P|j#<*q+ELDESrA4j#I76WX4! z6UMR{q=}^4n6@# z-34>;Nib5mYJ<6_zF_#Ur3d#~$G(){c3ED1f$x*$VfA}(`9+mEH`&$)lQ5X{>W9Ijc{y58q~Zic(=V-{Y1+E1sdY7$f{4;jiOhx6s?HwJy1 zBV;L=7a}C~o`$?f!YDfJ=%CU{r5q~UxP*9_^?RKKKhNsdj}E=bN+OMw?%FPuDPMLU{o7w25`9FTeP!{7%H!a^0SglYStp;zeJt{@E z4_3+`i;p`gFC|aslEe~6??bCI%ApuN6#RIJ^)hnikGby#LW+rkVV?5>r{IJe; z@^X!BItg6lB$|)Fpg{e&|F!$|%PYA*c$*%bo(4Mefset*`vX6a4;d>f>(zpSN9+pS zCot5l@^P}Ly9zTa^1}PN`}K)QdsbDcH}RLdeO-wv!zN?!2Icw`MGaq@%ymC^oP>O} zjB0u*Mm%XxP}40}62^Csm>`jP_7N89B1D;2%ll-=%Y*a}B0CiXvA(wY<#WJ@$*%{Z z9Vnyf3q6J7Tn5?HwtJ$k@*14E4WaQ9f#+Qe4b%93*Z2bCj^H=y9jrj2QHVu;!ZrPx z<&+^E`H^c+?p2tk@SPkWcPwNn9e||fdvqZ@h4D0j2BuRdc9L8Pubc8ij9Y{%=HT)& zjzewxYDOu-AiJ@l4lx>B6_#yzxncjkU4+7 z%c1ju@#^>X^bGtmKztk)2ig+?WF6bf%;YkTKMFC~mHA8-2e4I~mxXLzs`;$ixvWBx z$4|0Qm4-N4$G1PO}ScW zLDj3Wr;15I#A9q*#K0Bzl%C^0V3kkjD2vO-EI#(kB+GqJBH1b7y7%W~OZRCQ5xYYI z8egcs#@qy*%iG%8S}?lscI*0UklG#pp?Z)XU(b>lP6pZSa&;u=4HZZXO96FEES$re z^rKco0Gu|4Wf}v%{NHj8@;Qe3jyPIl(~nPPV=iQ=UTZVRSfQD?`p>UBpCPf^NK-kQ zMac+Tbwlj>e~px@akxezDrdXK4IJt%KdZFNmPO`uTncg{hRarNTJi+9Lp$m+PjcZc z4UwY$tm$o>3=a{`t6B4|_h@k@#QL@>PAOD?SCeYB&x{9E>sWhj(0gal zx^nPum5!o{dAJ@>=?-Pz{0~#!_VvB`w@ROTyilkN^aJX;UpJ%wP4XSM-6y(hFOP%q zxV>$mYbw#VNid0XW0`kf@!uRrU)Bs5c&^bxvA>m!a4H|* zb|~za()_7_TNhkQB8CWY>l=)vV8w>ArEazOW2VcC8{G10VaXe&mTX4>%T$c8sqS6} zaKg}Ly&Y|1m_Cz8;BkAZEks`Q zB0Uq_@H$P!iJ5&zLbjb!DB6H?xC~FW!T?${?c{Luw>KPhS2Y)iW!cf8GB4+oeG&OfbY99Z^x+Dz*{wz|>?mE?LX z)0*dqHy6=GyTZYT8tbBd=#%3ZT7ZcjjlP%N`6zSj7ZyPY98&W!I9KF)>vC4OSQPm6 zS*>F9VFthgH(-Dra10&&$BUhu-cv)Q6kl)btobKMJ}oS40u5%0FfKpZwM#UZ!fwJy zi`9EQ?qPecQuh?;aZ17iy^~j2WLn4E)%;g!NDx6%jetBx)dXfY+e~yvn}czYBCCe) z7aRFW4O$61gAcsg3{7BO;bh1G;IAQcjyRi(HU`mO6sfK2maMMtdDDjzNJdODjr!N zXn&XIMST+tmwVC92$~p-^5x@}YU-B=Aba`$%HSUNE+$AR(GIO_8Ga^q2yED<>el83 z?V39_B^v$05Qw8%P0x9exgy1>EVd~XT$MRyblh_$u5Qpqlw)buZ1|B@Y7IY?-uwo$ zLt$8(D42~8Z@89xp>$AsxDK`9?dGKfQ;1Gg&A<}-O;Cp4hs~M`_eOs24sRgYhz#Jh z#>^kvr_L$S4i_;9Wi!@fe6>IoTq194&b@V(&`&?n=GILJwz34bI9W zwZkh<%`saXi%tpwoY& zcIIGzACj%>3ew1P??;&*qvM*I?XacDEx{`|8V}R|$kLxs^uG3EW&7(<(()4>;U~?K z-hw`sA86u$s~XaUZh1u_YjyFz+k}jQ6JIcbN1xURR=W0YZV!YwF zVoa#cn&U28(?z1;264%>zyXc3S!4YIkRK%XB5I@JT9RyMruUCoo*{98`dJRO&=|ME zNDQL;r>BU`yu!Cr!?;}Yo~R78N27VlPJq%1@gl;d`TUlstVIL?JY+B#iK2B**eZ5I zz2h8DYG^9RJ_2?@83_fS=}t1vKy69kO%7N^Wn~e8y}fZBT~OCfeV(9f>R@G^@a>L7 zO$|kAMKa=~_!T0J{N+NT;bl{NI9Cql=5+Y|*Hx#|;jWyZT{?f>swB}k^WF+K{Q8y4n^Gr~HjXs^CA}kp z8sbTXj}DVe*tUOA3bIdlR^}*{>rly+>3dvm>wrPtrqVA~TEk9$(4cD+5KGd>O zA|{D^OY6u-XppoW+?K`Exj~k8>4%ptv4c#haR~dg(=F+3g!A=jBJFxy^qJ~kep*NL z=Qbk8r~d}=;Ks+%q6nD0IXb`yq#N+|r-X(gAOl>nL^s)sOy)WYxF=}cS*vi>eHcR_8~~DRV{vfW*K&wC~PB0PC`*N2|^$KW+(M|^x3MPpTr5Y4b^ph zOcdy=vPw-WHlx-16EgO@%6ssGy(srV_e1P*UDnNZAbudF;$MBnFq1$JW?3)4?6+Fn z;9o_hNuHNTGqXkamjy9C`BW(Lea_9Y4{@=fzxh%I*r}~auO6_Ci%f$9B@@FQ6AFW- z^~Y99p%E;hVJbmC*J{G^TkLJ@buYZDGnDZ=o*X}Am5>qPBM9g)3A>~IT37Yv8Lq0D z@?4ToPkGZ^aLlh_oFoY)r$Dv@lH4ek#gUVzHS!kHD`_Htb&ELcrNc#ByE-Yg>$3Y_ zuo6ZWZRYxDGag7M?!$wM2(9}lnd|8<>VxHpgcjLVrB8`de-LDyHImDIr-Oi7CoiRc zDmg>!Bl>OeqYA(*7j;Pld|sZsprstqfC4dB)}u=3QU+ zMyu>!T=0Z~t!t!>;wJ@aSg_s?aTWysETl|GS>4nS!8Po-Z<)vXGlL>i6*d zwwktJYcjYfHC7%r<7cJO${8tu+L`9Wum;p#S_!TQOwpGf!^81nk?5F!B~)IdA7z6- z=qrumjmn{yf!@4@6!CcKSr=aWsCGrI^=j(o1{UbgR|cM;wzX#r*UoQz0ya@iuu)Ji zuYeo0z%QS6{p9reG1q@8r%bZi=YVA(f|p*QMs|LKr|GE8mrwBHicm{U6$MJmy&T7y zI5xt~RsVNjnoJQdq=7AeE(-o;>|r zS8tlnR#?BPmos++K|(F~5bklOxr~p__*4BA9>#hVlkD@(9hum zUWFW4rL0@OZZnC?86C^Gs7=}!+peoyz&36EF)|8@pYd8vX)E#J!8E9Kbl6oGL5stx zO(Xc~LfU%(>&qPX_%{1N&~wvVxA!08oHGh1as|y195rH$+LGE%i6h%J|Cdo)ahARymgqXYh zE-5I&I&k>9Ugl-Svm-D9AjBRIEKPVu{ zkr&K!aI_`q?)IB&B+Z7HiXaQOX49BQ;D!{tk7<67(6ULec%-37+3!z;VWE7iYz*tV zI?jhshA<_hr@QaonY2{!BiI~~`1G=5iaGpd^13+1p!&9uxZ_sBdZe|d3rC+7 zVt(=+3lWSiQgu`Nptysz{_JFR)33)ju?mWd=C!_?Z1!S4iMj$fkn{{anll%u({*(G zxiF7M?{@4dLJyv%24sBu?lm}*jbJa1YZ1OWr)exE>7yOreORe;w8c4!#UCSEsth>r zfBP}5pjA6Kqa{UCfz*#B^OuirSs8PBEpeWJ2JdfQhq<11a;0)UbbFcgezw4kKyOD! zKUh58(=&2?9)S*3DjPig#~OC-dgKqyP3HCaMs9xy+(Y{cya4XP$GE^ELZ4jsx|@p1 zg4G#G!D73ckv8#P;f{_cd*w_Da6nx_(ofG3F+9}^49B0Z%ju zzghT_oC%S8hP&hJDMZZ?%1Og2@GV4rx52|(-*0Xe=XQl)fIl0VuzHIEo z#ryv)dOX$Xea^e{?*wx?Y?GcqACU++(btFn2x>=Bk*oE|*-x)CqW3wYSXB63_cyL} zT`zB6U*Q9LUy4O;9fa4eTY9fu+nxtN2X`uO>x&{Oo!8yO14r)UotpNq2$$J%5Q0<@ zoSiGd6tSuO+B826kWkrpA4y0S_sGN1Cv72qhv;fB8F&%v5ihsc1Hu!(dm2R{uOhtK zVsXn)FqtO_Os~fZBRQg-h z$1=wZFvL@saYs%wE7|)&z;1v?2O>Ab zam_Iwr$T+NMnd5VBw3*V%CFkfK#5%?fNk@oPUlpm7@V%IO;0CoUre~u6jAcN6%<7m z#HUQAi=59h%;h=Q6wQ}QA=_)sd|CYTLYcRe3kUprIii0hoy1**^oVr?@IJLP z&ROTRnohr7Qh0U-FwjKP%snFI3~Od$?XtD&ivJPTLae+}{bP%rZ?S_NeJW286EHnw zJ_M<^?SvX|_W1*M0lfrc0e$!sQwR!I%ewL>oQhkPsNooY4WFQ!EUyjDa96E$2`@4f zaDrW#NN)^+r>S0hLr4pFcH8$tIm4v3GERbiLQG_8gH^d22-DWIDIUF+02D}L#NDt9 zUvFBmz6KIUN`98^};tTfdhqmLt>_96B^4$_Hvu5@btaTfl(i(tcxV zwGZ^XoJ3(DRZYS8DRYw^g75T)v0FY2GR}0zN-RRvp>q60$Yf@L$-Ro`?C#9b*w8AwVqx!sZ|KoR zTPtwzd?WwmYjQb2anTC8A_*xfqp|C&ULsWKrX4sM!;RR+`8 ztQ>JXFr#YgvPpO_3Bp^Ln3)!=i1`xGQcgtkL%`|M&NjJL52r=|j3mdDm&v=)#LelM z2fL!D#Pn?BBz$@@Qpba~uVh51PmM}wi~A0k`CQ8--lWacCFl{c800}(v%pb_>n-re zKekSV3bwu`snO*=`Dnw$jC+*s|qA=fr4MR03;brx=UXY8iZ$-TYJsND=6m9v)JZj_6wk*4?HB ziXg@&Z9vs$Sy=Dn%8wVz2l2fwKfo%nynx9w|Nq6bOVW%6>Ru=6cJci8@UHsN{O8_Z z_Xfis=fXuo(E=U^Jr09G^WbVZDzYc|p1&n*dzSD0qJ3ZefM2_tMPbR6gM73#v+%wB+aVOH_GD&5V3E_+ z@jTU+9Wco6jsW_^%1VkKdB8neO%+-6s9n>?s;+B*vmoowu*1z?Nnl5d!QUdDz zRnu~J{4cjD`xOFIbA-A#;tr(HIcJej!=aM7J3Kh&UeuUUKv_ue=fE5+oyd_0*cm9A zGlwC&)#CU?Evvq#!kKt^c@&OxWAdTCXM=l79zLl^hWQW2LiX?jXH1$-nL_E8jCDrk zTM0^kP`U~isc@U)e!V{5YK%G}=_hX};KR&((-KUa)FWzNGvYL{EC)eiArGe4l1W@Q z=aUhI6PvOek{nedDnkOPZ~cxtCvffrcU@Yw*j(TJZt-CIa?8yC+`=H<$y4h*Sl>=i z$<6?7eG6TZZOyT4k(JM~RF;MkKQ*g$XMoY`tv8tD4L33j^4ZzP_|3KQPNm3QP_xN!hdhbXW)#>LwNJkSU%bX}sITme`V`yD)qXWjG2$->Ok_9c-PzFn*7=_E9w~wBgOmFn=NIRSA7)N;8G(|n&IbV$ z7P*HbgVLPWmBT;DM{y#AE#|i)GBAN^-ELrQ65!#du)|*~;Q5iNCDQVLxd4D_wH{Wk z`<16=T;#!sbj-OE^ZAlU7vWrtC0xvb4%S}-SU7*4*8Ki%H`Km1SquIS`#Mf4ADoZ) z7?_@fPF?=@Z2<2b83?q5)O2g=T`2%;UOS;*O-2ud#sqZW)MxEyj|%50j{ANW-gnF7 zkgv^w)G=CO;*g4j!o%Ue{>#B<$#p5?6jIA`gbjWbc94`JF2 zTxF_;Y3<~p!o;a?;Tf0puSbf)p^v*P9a^UnsaMi9S2Pt}*toZ)ij>@X!q5}LAda_= zq8=bX{tulc;?g{_FcH%I1xUvy)V28!ux-Y}B>lZg7iNaJxoUCRQ$%aZ#ywi?WRl~`bSuK?dB;ycYFzjVNup%yrZl)fY#3x)H>de8 zvy2bq(7e09tebRZSM&o~ypuN73!xlfT5snonZ^3Vfir z!-MkDTzMrvJND6MWYusRd@N6gvf`r7#2SRkMlHMs0{#$PSL0Sb{58aO>vmSQlO*aw zl969Y{QSZ|iwo9MdngEQoVR5r}x_v(Fd~!;+^LHg#dW#x?m-`ZtFqT|j zx|4CX$s50Z>F4AsD1H%CMDM>#jJilpJ#QSlq|cO{B=BQS?=Yt=pm(Xquhq*i1^`Jh z+pK?1>Wvr3UAPSC7>AQ}Fvgy9A?x0i=GRI)hY`eqSC|J#@Gi16_69UBUFPTQcrx!ZS|<8t?faObbJZmJ;`$gw_6V_& z=jm+E+-{ukM%2&Quv43I$Xot%30CtSHD=ICDpa2-ZnQ`j=!(Yp#d4$Rw1-pfi$q#3 z%8t+G*E-XO-dZLI?It9=e3koCfSqGuUuACA<-F~*0ULyb8$5)#x4`INzbU~zz^6)i zTm1K_X2o=vbFyH+nW0V+=g52nVkM(8W)Ltt{9$WzazIQh&c^!ky+3q()7WHT< zYaRnnCd3*5HJttvl_1;Umnq8L<|sHcQe%8gdo;zxA#WjR#eM2>DY<{l~7W4FjY|Efe7vGxbH#~YXw2^ zz1($|Kkghu@ZQX8W`W9ngVcb^L9gyuzA1X<;7n2k`6kz;_dapigM{wtcFfSg6#($~Tn-p}L3*;uBH>0bic#iu^tR$p+ydO%Ml$^3 zB5hvcr<)U_1dk&;B6D7$&bIyK>wy{B3%*gn+Z|tk^A;F^PV*(+elG&AvhUabA=2R0 zwYe>z5IW@Fpl$lc3X8(;0`m@m+p%;)@6R8vM2|%QH(2G9ME|3+HU)9C>ihpo(>5MnoLKZUVUibkhcP%t3 z5uI&k_>R8tXfjX6I2Si-GvG9vK?p5dX%ZLvorpk!ceIu9ia8(jy{I3$d4h(T_pc!5MTMvELI0gGO5Y7?Ok>F;uA*v}3A>Hd}}=_EDY!E&4Jx z4PpsAj)9_?dZuM2L+r}%+h%%r5W<4`7wItE1%i1>N$Zv0PoxR@Z*^LuRw~O2^{oDm zm~pGgE~zv7Lj^)?ZbL{%V>BONu}k+iQc`1TeRuE(nU$KU`a@Y*wcNN-0r<04zLhC0 z=&jS-j42GQtB87Rkea2Z1=8eVhRrHRhox{pg6h=zds$x_Jq&AQcS}0m(Jf!7S+;!OaVH;-@ z(J$6@d&?!_(_d6T6&RIAnzg3bx{XYKo`Yzzji+U0yM$z!=<&)-_x;>`6~LV&4?0#_ z%~3irG8iUr$!Zm2i7cA`V@icu-!D-GvR5|zx+9kIn?ptnTmF{}TB%DAU^?L_{abCv zmUsE8=qyb5AVi5aa^pKaf;6~~^8!*9H7hfuGD>N<)>TyweqDIUU84@KkCrLGXm*;) zJ6_rat=X$s8w3qJ6gc0?B=&V^sn*k9!8E+vmj}R-y=WXhk zaRU=~7ri`FnIv3tW`ZLT)X?d1IWF`g)0mno%7%~z_N5Daz+m;nur{Ao_rJAOj;*fF zg(CCqrDqlTzt3J-^|sp?8s}-D$CEM1SN-vmriN{babg3mw@s#fKVqn;^pyF^F1EH? zBcK3DK*rQxFLz|}3)J)*^AKv>6`UB)84`A!jl~dWoIt5zPSinI31iC&5PqGBaab+F z%IkNTVD+RB-lpsjj9hSwmS=1imy58SULIoThz0(S4GwN$XV<(iqkvufJ_^OAy4>ltTs1nAgRyTF z^!Y64=J4RLeLoPmqK3g?6K@T*;Z6o59)~H>B#xiHw{6B1_I*SLUmma)Jo$72s~dv$ z(@S20@u6mBWb2umjWHTOSEa06dZk1J+1v#_7<4UkF=IAow7jQvO}di;D5%b&u<608xFt4-ifomicH&1C$)M)gvWX=5Z+8=3J*`S!~mWz zw(%i$SXL_FR)(o#$}zX>{Se>rv?<_!i})H2*Tgy)6ZRkHe0E=kmeDUtKT9hLNm-$e zPLOzdo$#n745_|=3joA3-C-m!>)#vW1x_;*K`rT%1tD5Itnbqpo)1F zUMCjJ`G%z*x;x+J-J2Xt++yaW{M{J}0aLGj`FbXoi$<}32>MGaK2<~QI+I0l*gf}M zN5#*g%M^{`A_XI^fwnu_`$KcrrnBmTYSb8mnA2^6kXto`Tca<`^va!Ej>oOf%KCNH zlN0>16!*A*0;mXs>MByWM0>O>{~7MI2~E1< z$(}O4%HUsq`j4CSf8Dob6MeX*dkRun?*{;kAajs&KS+J=w>%-KkRPsAKgxFc%KY!T z|951v2M|KK!TeQra+WRPwkPT+vY8iZ&f6h8aZ=9w+n-!qdh?(bI9%DxBOx2XK%f`c zP;bbawjCwJ3lhpsLJL01Z74?-w{PdQusF*y6c)pSgh5v@f~fd(_aGS)$d4`cq-TFD z^3w7FsgvdyK}jB>q<=&UYke%E#Tpu@UTls2lN;f_ztVOz2&E_$v{|3|P66fQBo7oMLEYocxv&t|sf(F`@3VSZFv6GI zr1eL`*dq)mF~jJ*epmg0Ucq@A588oJ(KRcC4i2>tfI)uD-!h+5KYhm$Gs#A!CYPNG zKN@W~)(jpPIj(Caj08A9Im&rreDB)H#G6{c?(ApA{XJ8F#9#fuM#FexYkRD04<#^4 zvZeXK}9{_9(NVlf~0jfq;DSk65M8zz>*ghq!%c`J8#Jm zNvUTBD-pBuyWxrD642qFtggz4q|1ivk^8}n0fF8u8B~RWa~i5vJa>OwK=p`{%vwT; zSF5ndU7xNfj92lq0yQNp4avY4Mx33O)HLc_Y#pNg8!6$P6Z)h)uw_K`421^|+A|ro z_;){zI;dUJgH#zpLCXoBqm)XTk);wU)r$wPl}t{7?={x1cU#&Xwaxdsb;-u}Vgz0Pn0c{!K3e5w-8+DD>bO;1-c-MpbdnrIG_hz2HlQ%iW`K zw_fox5{%OB+;HU7hPxA3J)J-Lkj$q>czp+vA*i9md;>Ztq>v`NsRdFb8g3@ zRPjeiyyU5HJ$d=bF;+$E7`o$NDP_Xb2pC4Wa$BjsF!B`?vu!;1m7VvHlIcPST0wVd9c;5YH$ZCgt#$k#qE6LrQlIDAi z4t0~H_9?|^D&jjpiXhX|VKRv$Hl#+w4fnv(?_iJWi|}pWY|KssWEQ5%=4kPgVBEM} zUaR}-^g|tZR)STT!rOPX9((`9$+-dVUcSeYWCL^}*9gKNueUOs|A1WRKn}#Zt{X%! zXR}=9GvK%f-ZSxfAEkx8|H8+Ub_YH5JaqFD$G4CUINOtjLv#opb5>bj)gB~&k*>gVQ-MMMyR(X~Idqg`hW}vF ztOZ^Pwi=VsD2(+eN1TUz-KV>);Hgg(YKo~_R0O2LvU+2KKn#3Y+O^Gw+YIu`-eSz_U?LsZruD<*Atp2T62OjYY;p_afhZnJ_Jx9UgG50|u-3j- z@BU}jCqEFh)UsiP+%#qpf35orMe5XMmd91Qn2w87AY(`KYM);~Yj>?+>RY7OQn^GxKL6)zIl8L zl}*`w{L%igLzzZ2QVRO3OOH=-&Xm<8BF?!r0%nG?H@cRw681-32qz)do1YnQO47Cj z++U2`P7sgfm&TD^#KpJR^r%?&(=$wy1bz?4LadCsI*0+zDDRWIFy!tJap*#0)upnj zSOcmfgKONss1)lkOHkyBjQ0q};A6J>oMiunIP~iW>YXB0I6s^wnL7v)=KKI{ovQnD=gh{ILD>zp$zL=~H%xD5Eh`c|+rJ`E*sfryZhwR~=K zaf~HEp~x$HM=~ zvt`}=6~c`gsOo*>&S)TG1dk!2YN0BR@c_*xee+HHp-tWK1Nahf+O`G1GxDvbnP)OO zkVJoo-iLQ&$d)Ow+T-u>s7=t%AD@&52gmDfK8{@HF=$|K+>(zitnC{^b^*t-6 zFU5XH8g6M#41KMwf}x0k6p?SCP0nv<4>;xuC&>^8HQ<#vV;90eV6lBayt@apBQ7)o zSGNQiYA(1i@z{5R03e|RJ_h865s?(C7%^CVXt=SSJ zBf-fj2fuJ=Y!=tPj52xqhJ3?V(Xj(xVHED8Z*t_AVRGdQF&MO z6lzV_@~X(qM6Ts$9OY^UV`=-VoGpWqk_NdCqB~)CnJ5c=tNM{|+0(JlI>XujyUc#L zu6r3iv!EFR69V>jw7e`alGt1wLW7h&lZL$RN(wY~Lk6hZj1X2M2utkJDR;t=F%=%b zG*`JQDy5>}Z;fuF(GL%RjXJsAl&Vm=Y77$FYpmwf`3x>w`MZt2jL8+%Yz{gS9+XXj z)e7?wIBJ};FG{6sNstc-#8^?BzTlyAas81FTsybTLT9SA^gm*pt}-#!jO!RWoY?8^ z>KXv2obd%ol9dl=$6a*vo({Y>NXC< zZ2*cZK z0v0%5KqO_iWA4aEs+liCDGw(NHmx*0Rk%E3kVTp%&fU(iuo9QDuq3oHM4hw zD2F2!tw-*r5%8XC^(R?A2W4ep9a#+XBl8o}hTZUEE(`Q2s-EX`CVg}wr`}lXD4N@UtVd>t3AnozaJk*MdPBQk-DBwt2`gC_7+8!TVKJo24L-Q?@MQI2wT9P zNl%c^PBfm;qY1=1j)CW8fhKYP%!bQ^qj*k=iAG>}LlA(wih$V3eL=^dI=n?;i@` zS3fmhsx{xQkj7k+xtDtr&vl3z>uFQD#2pyVeA&odKLC@&x~Vu1WSgV>as2R+MrZqA zCG%l+gY2O=19UY3OM6sSV0ieb@J}anvmtJPObvTIa3=QPw*8tszf=kU?5_pbX zcBK~9fL zPGfF~NWky0YB3xV4JYIBO)>KCuP(_HpyAoqPcp)yRL)f^7v9U?Ts_GI@()Yg4Ow_+ zqcvi3qh}0jISk^Bv1e=;VJ@c+n|t_Kc$_KXAnp}@-? zy&uuN@VjJwY$6{H!WsV`5fk)()WvJstZ4kp16h4O7GOOxxRy_CFNAs7B#jKdZ)yIQ zR#+lT_AP%-t#p4)7D!@F2LMW^TbJYlu=V05! zl{p4RBlMAuo?u0w6&IbMmL>Z-reN=dKGW#b;DjHjx!ellnn+hwE+9RMZwNr((oFhw zI!txxq|jv>wOX%!>HTzH=|<8jOVBC05&wxmT<@_`d39$#TjYMfDglmrvCg1KBA{nw zV9JM~kLN%jf^iO_a3IDhx7x5WENjTrO{16LO2>v*yDmi1C~bNIZ-D$#nt7L7l(p#3 z^ySP;>`4sy#{PW3eg~Ls+ zBC5 z9e+6ray%Gn0*$#WOi95RR5-?YX}y9U&nK}8n319Q3;I~nIQ;|boziXe{R&zzHijL& zbri5*hadVJPD18GuUYO1BnB4y@I1ESWLKje6*<AfXzgAPUDGy~?Ge*+Gq| zS?e*`Nm#MGd2jovot{&e#YtSjAEx-p$T>ZYAl$m~cG-&^SuRs@en}+j6u&VHW~z)} zkRRTpa;%eevm@0&W8I8cT94v^BQ5ISx_;8*4`KHA)QTF9C7uIrw);&oG&rwb>$u|b z=x5$K*HRQaWX*gS3Pv2~fa7ir6S5GJXmmy*DexGkMnslT*ZUDutT$MrvD_d6ZlC*^ zO%{0RY4kxuBrvQZd=YU8wDKCfjTz7)2` zm6#LLV&aFH?Bmh@HuSb5-!501b1gxBb|Ln`;wI{eV z7TkqK(HZ%!Q$Yd(4K7u@t6h1RzO3CJ6kf|@=!SE!QWHOSA7g+~U zN;{v?D^F1m;lm1nWds5~AfVov|3&zjMU6db%g^6H<3`qTd43;|<<_kJgJ0cCN9~RR zb%nRvF_#N-VikGfx=FSLz#tshga!Cwgqfv^6WA81vab*;UQEDlOPe3`ka#~~Gp8@E z03*`qhXPurApw}}N=jAX2#{ceeae%p4Q5!CUck%s(6=qO4n~4nWJO}eJM<&Q>66>B zR@;9xQgVcG+&cWy{7s4lCF#dBovRr!WfH)wXVh}s-QhmRYFdU>zOn548GyuotT6P` zcW}>=M|3P!5NA#$ZHhhzYKXoCaarWfCumtJ+oF8SItm#`b02&uqd|Q5SBw`Nt>gL zpopN&1O?V!jTMBWs8ku3v?vIxG05C!4#{i26)p+C9wS*M{P%SqlkTOPkzY&O0xEEe zpR+GBW4Afqz47qGmo|>VDNY{vH#%Cu0dnDGoA8^Y2Q2=5oU{3GTMs&}JOmUFDU+)H zay)kiTnIN+VVWE7G@~w=+#9~4{H#R@vtvaVLZjN#6djz`)l_bsr*&_nd6k-pwWf$L zr{Y5SPi)2JTDb8;Yc-7-##ZnYDWXdT7G&8eo z*v!ngVm4%wG5o}FfIzRim^4A@&wQ{Z5goi>K!J5KXay>-w^#s~bjSa5YAFp~%hx}f zsk48>E?7;A1stZ5u%ufoi^l7J6QQ3JojsfVdWoU|Jx(=e3ox+Be^Ds;vZWi6O0>!= zOCUBoJHq+6O#U2bor&y)cYuI zl;NR+*n~pjkUjFZC7EH*@4;<+zQ|!AI1wpLa*uB}9j6z7S;a09p^$IWe!zk3I&W`T z($_#TneE%R&crb5i@il6Jrfg)l(8YcO}_f4XaAQ`^Y!oBuVLJ}WzV-a(RiPo>v+cp z_7=~RN4|L9!yc7xLbBIN05U%*?3L^9YRsOx0~XOY3gVtOIDUU1n!|%?i{}rpQH}Vk z&yAe$RbL1Ix74)GE#ECQ(`X18ZM|4K8d}-y$C{%t`%ohF2>5FeaoGH>I=Dty)#&6F zk+mG}ofreM>ZVLDKev@@36c&bJdU|43A2~SLY5IZhZ*8$_i;)buPY(PQx^_|kcgOS zD+??2+)#%K_n#H0Yc$RvfEj8$f(@{Yycb>sa=02KlMwP%9;4BI#0;%fUus| zJ6|cxgyIWY!zQ+}c@EUlG1ebP77}n3z@_atuCKpKidawN#XX;IU5g+krvK$=Y6UwtUaL0P6t=CrW; z{FfZFShHF!WV@81JTi$($A>w!(*UZ*Cp}Q!pM8IjAyy7LB=Te#pM$>~*H_;yA^LWX zeT8tC*y-oPP?uI@-3Aiezr=gl-oACCE8aQ?(=$8L#iP=}bGlYZl&+(J-5F2M(Tcv3 z5#kom%@|VwLn!><-F<=s9#4gqZx1lb3!ZnrTeu`)O(nS(g{X_L{tk7~9o01+F z2BXQ)(xW@QJ^GAn zJ{ucb2v1^;1}s`s;nf#^CEEm99wr6WER#;=D~@_6)8)m**4oIvP8Lc!K__e2U^;f8 zLsivi4Rm*t3&*sNk(?Z3D1wA?wAN1792v$(gS+4x&2Ln>!$p2|eNQ8tuCHrkye-@< zH2!(~`hH8b=wpBhr0^slPhZZHR_c;VU>meHT4_UeodHL!)qi39rW8fEQxPvi2G1Zc zBV^B1?sDV~P5r%uJsW=#gcz+FsjjqGFm|^u$6Thr!eL=;9HDyQLhOA z9cLmHr=8wuV{jW5tF^_-`yl3GjWUIXQg`onR+L4a+%F2o&NwPMwe%=jGRO(YxBZAH z0^>P1aM)H}NK8YbcDcJbFw53?av|h*#_J zKmCLQz`>-$BsZ^@O~X&8fW>uXB7HJZ=myo!agm}F)eJJtxjsC=WK0?T;{4#|kKmS5 z=Z0O;DO9~*H2M2pxMyM;Awv*PFR!urH6tL=`~wDejZ=%a+8HR&cl=)lf9zH^E|(QP zM^SX!yhWz$1kaB*ZxIj4*Kotu+@{%aTyf*z*y?lCNGpo_O? zSW+Q~yQL?yo2keTMp_xID5br(ZJX>l&4{YUAi7&ZC{NeyZ(!-&LPj-$On5Bp5(Mv- zwtLhT8mZ70Pj{tf6V@N_=lE>EgBekUF!c24{feh=VktYt$kFzL4`Gm&cCD;?uFcnd ztuKt*Eq0u;;?B1TSHPD_9xM;o{( zz`m4W==>vB<<4JEtNpI{A4lxUe{4R$g<^6qRzS@f2?vcnIfk-Wfm(I2n{UwqQEXew1N;r`vvB=FvPKYFQf}i8H8m% z(kdG%r-fE{rwmgj?fM#Qshujy5(ya>aQ=lOuDCUaa?oBekF$@2w7+i?r)}Z*nesOV zfx5RocMz*bIpPHztd|xP3EUnJ?Y*bgDX3gyW+6$OXtwrI&>%!Q!OOU%fp{D15b>f zS%1CV^~ZmcWXw(*a>BnJdLz|&xDi6IQ>w8SRA7|AM1!r)lGDQDFFR_Rjwv!?rIq<2 zbjf2iXh_98zBywqfuWITu#z*x47+*2B zqBv*x?3j7Wx!}34_fz7~`PbX&SQVHG=M=3m`oio^z|fWS^d}mAJnnEuer;t@?O_iO zDLNTJvj+BI4s}Dhf|1bS=y2;Y`HniSvRiwNu91xIdmdT|(a zO<7YyW*Va0`wPxS>3s|1ks&}RrmWsc&=w(+3Mg}O2@($bJ2@bYLg10n==)E%RC&!pkV^w4NpZq4|}WR z?f(co{u)scea9pi{9XrFtYQ9{ijE|gwwX6f{t}(Vmc+D((&9s635V7^>q1mH>5)$w zEIE{8ZPbkH7~K{uM?LyoAnmQ#n6}aobc=n`Pgl~)(*2O8d}*vsFAFo)dap|%Cfy9X zK}3t%rH(Tq&qt3wt=Y|6ZQa))yt^HMW(Di3cW{Y5|GnKw_?wx-eGx5@p_G3|a>Q>C z6a0$7KBInWdg_%-K{Cxq#OjUKBcyVSb)%Rea8HkLZ~&SswlRlEZ^aQY(?vfdL)5S_ zh=#%E^XbLnhVR$(igKZPr>~;wIk^1dyn(tOxS{MCeP9OE=;me=K+@p03iwWA9CJFz zzC*_b|EV}7pCA6BZ?=HUCAP4Y@%{}GZP`Y<9D!QJD0Y0&vLdlEpxCUJIa2AThQv+* z-$Fz%7s(Q{KbVSYn|=?-nM*Y7EwaXH0MrYCcxOvOi!I=yYEM zHc^!WTV7Rke^=eh?8z5o6k3Li+gHpk8c%2LBEP;EkpRKfn2sg|t=rDP0Z-z>>yWi3 z!F#W9%DPIg{!|%jSvy)Zjl~4ue&@ON-zGtkv9Xe69QnE%E{)QS)m-?3#WB$6IbF_4 zUfkZk{xU{t=s05UzDAU(50*8W%7SMg+1n|(l|O;f_`@sq(Y-3BW+78*nyTev<7)|d zJ7GWzu*Il5srtd|H~xa}2BD)K)Qqe2$-X5L zXVwF;-Uvpef)blL;@ioxGZG6Xe>9!aJHpH2IXS30|0Dq<8bK#ADACy>dpvK7L4Ndu z=Y|gIs;l^n4CYK{;*Z@ph8te4!7OxfNP}F?nj2t+Vd7@0c9wmILgJe|MkcKt4OCdi z;g-+qe_okzi&TH$tEH}G9z292IOV8kLqbiLP2+C#O4$I(Lh^gA{%8c_9Y0(?{QHuP z^K}`nARZ8UfR^LO?u_h0AZgNm%K?}zYEhgsrBV6mICW_o!k2iy2vDP~mhS;Um;G@e zr_q?OlsWsp*&Kx{!$;OAuidABCXX zOJzMEgqIm;1M9SBT5gY;of=QzaFEz_9)mHgBWl&gEq^79r9x#Jx3=Ua-Yb zY9}884+1XGX1Sbd`LCof*(9qZY!F_S?3yV$T%qfU5kp&=ze|*$saM8sO0rQ`sm>Jl z=s)>MQr}787+Gz#aYTV|>Kqf{R@0{aXa!NuQd?h06ZWLoUHvB}!?;XD!=#h`$*U#I zQY^FG_@5irSDZCj+_yIwPiv&cTo< z_@Ox9EyBZO5o}!VD!(jA%Vt6)>;aHTzCi#)(J)3I2naZ8dWB6`v+~9f8gK78XKc?T z>ses2>;`H)Rf}a?!N3K+o07k?LB&7c&Q)8?n;FM2duox($&6DtX^D!hmIpYs>eC*c zR4XKn*Q$Ge1y*y=0ZLK$(NDCm4a#?d$!eyA4OxzQY^gC?IqhZ}_{rLZ(LBeyKg8ZA zr>1(9-ktU+t6^Oz_+c=Z&zX?R+>2Yz-i^xO1Am|>RO@BTs_nyIstL=Ga9Ic|3dHaW z6hZH>M(22{^n*{~NAj=y^k2#JAA1}~zY_c-wHjR882S@@v$1<=hY$4xz(C0={eD1E z3|-SBnugg&H^(DKgP+2Kp*6-O=VO#j7pu&G#dILhbBZ zlKQ`v<)}>zFh3vYdu!96I2V=+hI3>a4pI{f-}2p;wI0;RoEr=hm&MR4MZXnL_~vJu zWDgtg>F{e=uDJK}_fP!cZcx{{p~`>QR`SSQ9D1Gq{%cbE$_|{`y)(AssmL-S$)O{J z-MriPq1vLOt<9&tZ(42gMz(ePu#V zB)`RKDP#DOtm}z2B!3Cd?Uw}IO8AOrTd1`>pJIrb63mcklb~8Q(ga0a|GRjT>(xly z0~cDbyUmT3rjyeOrBAl*a_-6Y$G!-zBZs@o_ax){N?Cf)nLRIvq;SNn#78lw^!yQz zyD)+KY^pvRHm}`(7kfdL)m~|<0g?)Oqy!xMtiIni=6+x|OvzwRa7%V+GuLUi?&zsh zPnM=Jn-gruNQGC<672$9a_#D~CR2n!AqMtZ@d_K~o>+${Z!srRhdI;Ba}w6^A?zUv z#pSkRZCgF8q*EqpR-eYYRi4KLI|P(Fo!B>f1v*DeaF|BD?Xy3zMClf^faq>L_AN5C zOBVLVC~;QMOc;$&1+;aIEs|rI*DF>xWU+BjF`Wz6DJ>?Z&ECkXM5RK&WPgBL@bAup z%~VU~pWv}x)T?zDGMY+fx^PT8D{cc8If6X~g#zd z8Rx`d$L8G-1IxqOhFr&DOcr)fcqP)Nb9n_CvJZDP&=%J^Ij}VI%$+{tCx)Vvu280O z_XdB13qk-K4#{pX)?1^*_#Nq=mkt1tH&VhPRUG|6oC??kkrjAcZ3)$c2VH69#h-Fc z^#^yVQnmak5*~4R)ZeK~eG}9vLm2wZnY~V`Bsm!YHoP$W!Cvn_w>H3?TLzpeA8s5P zp`Rs*kBPgjOS+09p{W+@xoyHv2lyTbL^k`43g%Kxx=QWz911IVA24=t@ZnqAa(On5 z7thaeo7dDQ+7B3Tu=HAaK)L0=z_je7Ce}z?NLwmO+fanf6;C%q@EyS3l{*G5xHD4W zGziM|pu-|aTs0bx?xkl0_R6lP6?NGQX`Zw1BWb_&oU%)dzd^xfI>bsg#!hDJCgWxu z?8$#ZkGc!yd@vS09P-hFZ*Lp6aw`75JV8Y zVQI**eZw^d-A!CdS@)SZBcU z4VpBCv;?HSXCZ~N!XjRLv^P;cORQ4^8q1=J;5^=J7)r_Z5saIhkV+-dsc%I(ZUxi~ zNl+snR0i0HXJM z`JKSg3n<8Z{l~3nqbngoVeiKznciC-r$3`%ye@{P=?@M3mtmhYr#BZB(iq)5DzpfZ zfiPAs{|O(iThA`Y%w5lS&i@SJTi$KBctHpZ{ga{#s$wc%u<6%cK<|E z9s6yy5~d4}oGYPIf~j##BR}H3AS%LRAqp=`ICLyFc(5C*E=E6Za|NaG+x=v_X@@HY z0ZjTl=F@Uwi}_`0KsHBfn64)a#jA3S2-SY@Mv&Bd<(EG55}%t!1~La>KoD8G*{D}b zdm?1?$*Y4ZA61tEa@OhfyVKMZV)vz*Dj_3cg*<*ft(s!or@OOL#wDe=7cNu2e&Q)v z`yiRp@gWQA{s*2DYpdM2sw{9U8yYm;hMyGMcRN+A0f&(}6bRtv*fJ_OExM_Ey8paZoQcV@7 z`uj?yy{)2KsfBJPr{Z+g#MuX(X>%RXUckp7Js0!ZySbnj3hiEQDZj|=b)Parr-JO) zE`(84h$J~!(>{M-cSyiRT{gl2MtU=tlLK3m3aVms>rx7T1{@ZW=7k}bKfi)r^+qvd zeDf{biZYHgb<5^9_zlZwJXK^NKk+ZG_4>C(u{d0dn&Q2wNA9;Q+$l+3?i^~PYU&c@ zmG#Z^c&iB3(lqTfhF|{^`tUZo86;zfZau2D*szS-Y(`FlOfjVnI}8ZJuzU)zL>zt| zCX-egD=mZdpedI;5vyG_@ZRB}T~kwwMik0>pG7EM)SK zws$toNoQ&|va$zE{QJA2Htje`%a%jgW??Qry=Q(>78@rbs2AOO4Gu_LTs+(`~V_-Z4R1idsDddd+As=+ju`%=`B;Ip1uP-{53S z{{qyrGj1vtU~AILPZTna$T`@n$Z(hvn`F2aT4~Il>3g$^b>U@Ye99x1Qy5F2n4e5O z+|z)uG++tB8nt0*AD3MK-B^>21ZjjOU9kNoP33L72{HU#>cUE;2V|>uNN8%Ln`ie_b;W46@)H=f=phuwU zkq}EWL-R+El9*z~Ijwp`AHo+Y7X7;7uBKEjoA_&gPoJMd80#vt|BJr0Yd%m)2X)hHMrOlKyFuL zSWa?T*oIg8RAd=+y=nQxVJssb zboKIMB-f)`18Mlbs_;af_7$6?UTmb=`9BHjqS-l8=Zt@|?$dPOwII2>C^1=Ip`@`5 zBQRZR4nW5D?hvHwj|geT*Uw|l-fx8H)lkF&?*bKsV*&j+4`bGt71C3gUy;O5mV9%; z2NR09FL7?4ob@N9t@TBMjJ@17>kkuCMuGv|&W&VA4J?~YJg(6CCk+@)W#TZ$TYC;Ofo)7)Z||EmSi z;*_sA`ox;T4I3PBK+!v#_y?xu(&k_v?c8CAYC5<8?sPjYKtXt8MmBP;uABu$Xc#{Id!3rIuLEdK3c7N@gf}+y~WJ zo=vz4;kZ%W26u2{uSiOq3B7K+-D8uEn3$M&-xG|SJB4XHp2oss7espQ{qb#+a#Ndt zflKdun#B98-emuI?pgZ}Mai3x?cLC@{xg1Y&_no_AM&d^q>0G5G-=reQhdojfYZ;% zey@9`k(PpT)zjQSf2;TqLY4d9z(Nh zzpq{2>nz##2gUi)uRd;2>J_wXmVhY00?$~P(u0SjyAo1Qx?JrkTL1hBv=pFPOMpl08|>Ey28E-2Xn2@4Q&QT4o31A!v8{C z@{Sc^e6%^qUHoF#R1!)9u3vfJE=V#gMiQVq4}>`9nH;awc`b40#)`3_4y{>8E{w^Q zI)V6;Q3=v_QlYU$H}%~82?;QQ;AN1?E;nPdMsr|of+9##l^&twkDC7*TO5GHo@v_M zQ5nAg%tL(o$vqY;bSIzuj~Y(VuOaIKZnYDM?cPxR^+V9-3#ZA5_?HKd>*~{^W|M+J zH(`f)$q!4P*9B>p=UrXbRC3DV#{CCNWl7LD&8i~FB3{BqiFSF|7WKp!KHl%S({LwpyyX+Lfdt~|Wgvro9jARjvnv^W1N>^6gPsg^PQ<3%#)a^Q z?#h~plN?fdm4b;3gIY-;5wgnCElE|c#HC$GE@T5RZW!Y*YDQ(xx3sf{Z zmGtUQ0~e806M9)tbaXN+uG}nQn|QNo>J{xJ2-A2iH_gw^BO}8CI6QTpJl17P>BCBx z5U(Ak3+h`w66lifOx58?$dco40S_=&)*tG^g@P$-=wbBMASiKLOr4WzHg*%L0I}Wf zmakistZR29c9U9`pyVVcOkL1u{rDh>gjyV79Gt$HvSX>tAek+Zpa7YEKpCu=N*SGb z5pA~rSfLCAqd8En&R;3HA}~MA!;t5pnm2 zfqdH+X`CH_ahaLK5ch(c4gPgif2?o2sHNqLvCaRw#aIgHrvE;507ee7(%x0nw|vL_ z*OQfPK|VpnsUTqDa>Y9;cJUADIo-EbT?-~PnP%vIH~*zVUw)NGMw-W@nI8}v9f0OOB|Y$N&y_I*C+Cg}MQEb%+FIsD zw`tc@+~}abrA&19ZnOpchNoS}_?qyQ6h4KrgBpi;q`xGHe6$Nwrq0wb2O$%Ab=dPq zJW@KNMF{=H+`ZK!#cNWnJr7$j7s0nBmobOA&|~n^hk&TU7|s&Y&kxBW*MnXI?$q?o z-1bl~tTILZTJJR%m^mJ~P<0jg_4(DtE@&gu$45CC-A2kQNR;swMnL^h>}QC#2%a$j zJfM}ebBQ5+EBmlo@<{O?M)Ew>Dm0L4OP-^K{ay~k4S#IvMfopGg%ATIG`=doL5kXF zN$Iq!a&k4Gsqd6WWouGaT(Ry_{!wy2-RS*(`g=2`I#Muy?Qh8MiwOx8gC4Up6&5a? zmVn^ieWyq``hp~~zv5R(nT8BiR|V8J54~>4tIF^G&BvQ=)Au@H16W6UMMFx1mfa$UMT*3@grGtkOP_~@bS-Tv5&KpyZ)5tRgt*qrzsyf z`&sr|$=^j^yc;)L(8eiM+PXCoBWjqSldQvpe+a@~6>U`g#NzK;Hjt|>ySKiJyepe$s%WqahKY)g zYj)Df^`$z2zlmVx^3lVV+qqqe zNSK)E2nn!&MC`^Dk7x#byTN%85i~~^;mraZ!CZl;l(z0vN~&9mfb z=r`%F|B<5m!!tbv2uz|5xqiTZ$|L2?t0e7b5x`4duEvgGOUaGD3v_ay&(FM`7IXiP z>}ZUwWavM4(Ep6#r(HJ|-P^cGX!XtrNb=G#_(*bF*}~B3k1%ud^mm`VM9dn;1Z5Of z_BIuQ3CxNz6Se-{R8=i+h0>dzDq;O2U}B+&B>|~TLjpo_!av$`^kJSLW}PEA^53(j zu9neqOhHXdP7x5uHS_nB5a;d#1y@U3*v2g9y_$KFs18$2N9^u7%m@oQhsz=XC;TNI z9UpOKZrj^Ip7fp+;c?vyrx;TVbEY(T?8p*OHNgpKhOMa87yhKwa(R zK1&G&OVA_%b<7>|z14Dx)R-3pQwB?8h+5zTX@EOTv%a+D3KjXp8wTOuXxlx_k4F-s zJ=%6HbEvW(rh;LVEM=&GG~c^fERynv8O&BoaP`y^uegX=GCVmcJEWQ`HjwqXuK?=PkEQ0mw$8#?O(mrTlhR_xR0ej zJ`Vk?*J*VC1_*t(#=Tsv&+md8A{*J5ed3TzrMr2Pg~$Sa&VGCti%LWmm6D6f+{bro zM@<({S3qBjI;yfHFN zIVVKjOtEpc=%S?RxNoicGT7BV?O#MUXb&s3w$1irukzLiU#cN#4ZW3Sd)=W<)2JMh z*GEALUvIi*F9=Hf|470rGje^5s49+Q>x5(X9h@G~>5OfopNfU-mnU6-==-mrVBq~D zEoePGfFYD@YIrCFnAfuyct#?@$`OnM8%VnR$p1O_hiI=%1L<;OkyHQgREbmi1NeAJ zq6SODa}9}o&72fOPRA&jAJQK7s*-)pDW7o$m-|5cN_!>L1 z1B#nJO(#FHO(p(HI&RkdD{O#!jjx+#FhJ$4zYY1UW0du@<%TTUtBj-?;-F&u!6}`pZ;!OKHPTf5=GlUI- zLSM~x*!=!r#rsmY9uad=f+G$xetIoK1$wJ%UjW4Wrn=O9bdqOCI(nY3Yaoq)&G=!e zJ3rDaPbKe5?s`4`69WcQN4Tgq#F7S0mYMlHimQ*~5vEeS8G%G^EiIdFY;wE-75@!U z%$B$Rv|-m!cL_|M}Lwr}dzf>atk7{(*jM8Ur} zUiF62h`7J{rv136Z3{V?JSi;y*xSaQpSNRkcUX9Mkr5$Gy9;HktO#n3L|A350Aowk z@K_x!bh+6p8BtrUiLOtCG?9w+Jv;n9`YF|jY38;~5`|t{a|zhAbn1KGm}9DWtETKx zCZ;G1w2ftF`Q4lM)&CkcfBODFZw`K)EV~(Xe9#3z3JfQe)ug`h^o>-KHKXIJ@gzR| zV8n}R{kdPy2~!%RcRNdf$ibP$i{AbTwwUJNI+|^qh8p!n_B6rHFN?F@KOkzo3`JqW?%v7p21G+7xIzIr8ziQ}FjEhPtK5AkG zzxD#^pj8?|!h0N073+jX>z>kgkZ>5+R(7IttO@uR?B7ntipsbx+LGZcZv1BB{s5Y4 zqrLsfUbc^{qwoTJc_-v<)f7=%R?99OFg?(`ln209n45+n+V)U(Mf=`N9P$NS!&chi zv82s;(|+(dLC(r*sYFbydY%?=R8K_eJQ*x?&wF|gSWaPiXe-I05rvLSEov*?{%7YodxhaQMo_IcvwF$t$VJYV zvbUW^S5)YF^%@*5q1=Hp7utxV7`SYLdU3J4Ua4l6p-ZFv1VR|Kl?8=TpMN|KGiAgRtb^Q6@}=t$qx; zA@>e>7hL2*gm1`9reI~@Q+6-Yp0gpv)dp1|OV*tv@t{s^_lWo>uBSPrOi~w~k3Zw7 zmOY?MN$=AUHamL>eJH;48^5)yPiGR;$1eu{#Efq6f?FUns!qs2rBGF~pMAmGeChKF zngyb1Ltm(4fmx)sQnxTY9B^Nl*XwT}-&+EHFsi^20Pn;$bpMYdLh|PsjR@B(l)mqq zPuG>6?l~iAlH@QVIHG!$-JfVWD1)MoG&TQvNXOi6(cA;`Wm${mr~R^!U4@4CEa^Hh zOtM%uRoo29$hWL4LA35Mm>xx0U#zoFdyi6E5Xc zdl{c}(JlBu{}{T)F%MP3?gAxeZ@3o&d03ckt7F;=$54DA%4(zergI?#I4Y}Kn{}sh+?ck(b?`ablRB^U27;hv(z{Mm9ufK8w%xYFbUod zt#FCj5XYFADn-D=9Kiha0oTv=OSl|`giOU`U)qvrVsFKua~wxqyxh3;#wND=i@lnI?v zv|Wj)@w2g^J<8zRp+uZ@=~dCn3-;J}Gfw_U6!YW7M2W`NyHXt19aLSjO80PCWwjVn zxr#=nJ_wIHdbt%DhXHSlfqjf8(DcU4UZ>ODFzCZgq7g3YALij-)A&7z;qv)E1?dBc z)-u5Ind;8@4`^2#X$-}Kc?Iv>E)+8Ke7Ih~4Uf5jNrY;b` z>RjF%L+4>(cOmt2t%I1;l5P=+L*x_;;{S7qe%7SY=I_gc3^MGA3@An-q3(}<|VS3)e_$5x2!V(TM0#D3!clc z3E#>bqZW_=QiV$Q^RZytI}g+gzC#x?QdPsI;t~cM7d&8Yv;5UxY=Gv6Ak`Zj--7Qn zMfD%e6sfh1v0rL6ON&S?*YA!sy;RMp>W(+Bx=?9Cv+5%Ppc!N8KO?K{#YZQbu0<9t zEv-+ToiB}FBcqnizdaN5?5d@Awtu{DJP~QN#L81c#$w;lcnX$AAlA>9nqDSMOrXG~ z^?Gr4Aq+1#7qU9XP$xO8Mernflbnimy>&g2YlI)R`*IUKfP<`U6MM6)fC^P6T$c28 zQkQu=g@(~Q`hq-YNTniq+~bA@`3T|RfF{4 zO!uKw;KlpRdf2J^Pq6AWdJ?E`EdxHx=-86JV_!k8&N-g>nH1`&3$4Em(8oKmx(nE& z%y5AKS0ktG{4`mQd|$plL>1cr;<$tbl~9E8A#)kPz6i9^6cby=x2UYHZ$CzkA0_=- zG9wCYXtn(f$}m9Vou%O0PyQjQhtk4l1ana=ySm9?m6QSd*U&AA@nAb@)nndC_Lby| z&fxKTw|yQ!ud9IQ{xWOp=P)+?yS>I~&OSFGv|sO+^60KCW59-p9@_XQo-FGOmOQv; zDaEy}Taf6r?0N@Vp(BLZ7F2JaaQo#AV{?qeI~8A1o0t-6IxBz}E4t(Rc=Hc=rCh`= z&LzhrI(2`UR2t>E8W6VDFOj6kjtfQx zj24}6sPw0^y|bA3;MYWE=8YiVi4)e5(L5{5VeO;;x~#J)hSU0o_|+R`=MnnsN!BymGA-&IV)QdiT;TXouWiBaXvl(p`dT#)?vFGH|CBe2542CLH+uxG{|XRio$3B~s!7@DHj zp(I`93%j_;6u)oR|60Wi)~o&Wkc^!f3HnZA_WgXaZDvcbar6W;O$d za@W|q?(c%c84o}8sRy&|17Wh5+}RMO!i&7rT!K5j^6}^B%=ZCty%)30g_-i-+Cf8q{J7tnbj?v^sd5Ypw1_0U{o!ZbkX4_u zGNP%VwvuR8Big5tp|GHn-|61VxUFrwK;^>~XJGML? zQUbQ0FlhUz!jIy%3I~NW3vcwa4ts2kd=+cZcIjdI&Wm*KGHbOcP)__qKpeRPU$1F= z7-hcT19eTlK*40kc?%j(`-K4+Ho&o4Aj{4GH@I5x3Zq zl9KX(Rvktgb>_S4X|>QIlgV9ZH5z)2nhJ66@r`8^uMH;ZkUf$1v}r^{gUF|O1KFnb zSmgVyu*4F1L^hJnvk%taT@86xC~%O4bTcF%IH#wPVvwPqKND(yX|@3x$^EcxOaET* zE1_W}eTJ=6m?3)wCHHAEG`EUEtmesDU%l|eSLTdMo%>=3g{mL0`-b;fz+5rE1DK=| zzM6=_j;WB^zY*OrLC{fSy^0fkdw{xN{x9*@hpJ~uQYAuTSbhDRVLjI3TCNyGB!P^j z$5-pGxjM1)OaOIdYc1%Njp0TVE4)6&SvScbjFrYR67=(#e<4i7%#I$Wi$b_jom|AP zD_-~q1!2LsS#TZk4!Qk7hR0UBqODgvDIFw?I`KTrgrW*?Vq+L-*=g1BoXidJ-Dz%a zu4r#(9~3MqC1pq&1F0s<@*Y8oG4YfyH@t#dm6HjPt{+1_LoR|JB|HdcTNh!xAg#}5 zAk1_UZg1XNjodExpWTB5C|oIXFLhVj`zgzB%${%o2SG*z*P@u`n70GuFW=#Z{ptPY zGb0snK|X=3*Vx^s=f7<$KOXyj(~cl3ei`@xH@8lq-=+<_Mbz~_#rD$Y|CW9C?*@-01$+QMQHph!cQ_i*t!STl-kYBu%KrV8 z^#w>>&#Fsx-DpgLLyg%!b72!_aH)|fp)Vu2l9~OuMYp`Gy;hMd{ioRL@uZ@TNV0w^YrLF;TQS#XJKBBbm0w2z$-@YNA`ad=Pf2%zSwT5E74;g@Q8nW;n zc_4hs`|T&}K&f0gGW#B;DXa@gA0K$jK!yXEXhdxsLxxa*i>TIuVGOf->9tl@tZ`w-UsTrqYn0qJi1r&3mG^Z9Etas`KF0GREXh_Y~8-Rkb zT?t_Qk`ujD?Y4rF2W6VGaH5UBbi%W6uL<0H1f`x@r}JjtucUQkvfPfRC;*VU5RG(S zc~O%-d}aU4bB$jXYe-e2iNhBtF@yi)?6ytX_-Z1{n(3NOP;0J!59rFj`qXVD5sO8^;9XH{nqI zr6Hi*@H%hnuZPW>Tp|vW(twj|rXjr+BfVwLuC(#eh_#9Y-1k27>-O(abxZZop9G8* zfpX5o@D~*drC?q8OtCeyH|p^*i>8a zAdp3=S^UzSq1vz{8ya>3= zr5o$=*2CD3VfMn&ud4$~i676ZMZz$K`@^Tz3i|DM@Rrm&N5 zVacIgb&Q|Xr?b{=&e4pDydm}(RNz6a$HGwhD}d);OLdD1#4Q2e%MjB(H2d@y#xpw` zw}3NJ&6hL8qwl7zAOTrh0@WYLY#4{E4KBmAu#n07yDB-Da3>~n%0DTg>&&YXuPoT3 zHq7c0^f6JyL--J8q8wc8g|MKU%J#a70kb4T-CEqGQp(%(x_7VaTI^LVNM(OuLS$68 z%U(5KXK}mc%3#&XQlm!`bcxz-%UcnkzssLn_70EH)lF34(PLEkny)Tf9ku^-7vNoB z>fUBeePhy1M_v+Sd$)QXFeWy553`=oOeFljT7dNr4HfYHyC%i7;4@KbUaM6HGj7U{ zKdX1sc64jVi%d_vylYSLy;HF514gE<#yNI^^N*rBQNw4rTH#=Xad$)Msl5b6{~nF$wa??0|p zX?{8dDziZwMf)sj#$gd%tn_27IhFcj zv*S^Yev>4sL-Ie<3~y?uii(Q+CEjI?GWJ8#;LPSK*wBd}jFt)m?<~ZicxqgEWZkHD zgWv~8-741z2*k)%q z&gsY!z8r_a0aWK$BuB!80X=T z{p)$xNp5xRWS3Uy!h?#SPGZw@z2@&J;xEVAMh}Y%;v0z5V6IfvL8`dU|EOEOFe$YQ zoseY%-*~hwegP2LB-d8cZ((L@dN3Dlnp#7n6?^*4a3EI2#GHazia`;8-^yqjDomEn z0GERf7*=7qy>&9-NQPWF>6>^nxR<8p;C5X(M-|SQ=S(Udo_hAg2gB& zW`H@Dwe2B5Qp?q8%P8a8c>iXYQI2u}VHS9(TL=A1gRWa)RTHE;RvPj;+f7p#FOHy_ zNVu@gSvSozf?+>-L;OJOSda$}U3l;O!tRFOM-xc}BzfYw8MCFR1b!z=AV3D0q(M5X%f-Yj^lq0DB8j~F{fAQN@7=X?rE?$6+p(^kiqCTEOGvSAu89gfzir==vI{HK?4|9NHqqJ@}BN!{|ONo!` zBO?yPem)TUX|`Ol^8v*7^wJJ0evyB|Tb&o4eU%+51JK#(qQ996`X=pzz17SWl3XYd zd6QQag!ZenrDM%gRHI_ii6??ukM$U1!?plG@R=YM)0IKx-GC7`2YHc8nb0mxjnwGB zr-4K1cgT{o-2Pcr^5oNNj;z0XssBu@9gio^!C&H9h9{CNL-&|&q~1#KzBLD+1O7bS z6o(#^m%Mz|20XyO3&40R{MYXg&(t%I=e@E;9_#-vIP=AKY(4{!Bt4)S)tnmLtyKR5 zBiEWgkKu}$zEHbWS%{_NNkxJNmZ0#ZYDVv%H|QPSErE5B{2!b_VC?L)Z(ozEixr$u ztIKj(!Gihu4L5_rQ}VPe8G*d{-eZtt#t^=jRYDjDE6t%mXqu-DTcCzDUb0uE98E1S z62Ddh;A`l{o@{@^AfVUf3}VS}wh^8)1wo^$$LIiyMkYNG85VyBYz+eA#$8+IN?u&Y zq%)KVRwWetdmEa*N&Fq>P_i%}xf|8=irmZj{yuTR_8 z6$3bY7`n<=Pqd}p<~z0v2pnNImW!Tnv(D$hK!J+k(u`Sjr=Bp>ojZ3D(YHSwiE-ws z+btWCtA)k;Nffi}CypYHzY<=%_O^+5tLKm&?e*e?cD@Y#>2=O;eV+poZzGQI3@&qN zBE9vwTwjEAZSC!1xj(J=+MEg48n4m5u=%>1{C0cB0!Er(=-?r`g4ZIf7_N61>AemO z^5*L?>khzTuaQ=b&9k7@-SH2dntN4)0i*y5)oTP@vivmCbzgoQH!8D2xyq7`zVXjVpG+;)2Jb>e{Fj&~n252B~-XZp(9O!)# ztF2_Fc&&ynDVa(YD)9ce39zC~=5sp%#v}*_+ zNo!Tj86!HXYe`;Nmq23!h#dmWS480$rOaSdx8Fb{a+my;6Pl4`!qJwODjmN z>)gUCLX2~<4x0wjcE4GDC!Dkt^&<>lT5q2JP_=o7A5h25p0S!$P!VJ2Bq!sO+aKkR z1&eX^4&(aIGc(&Sccm{ikCyH=9vk5!0JL2i0!U^TCP(lO%>P6xR*&kh>aySKZ+Es# zPV|jOkHkRHVE6C#tew~SXzygqm*USE&ITJVNSV8UjziwJ-I3~JgKxzu9J(Q=!2_TrpFEkBh8ohxUZMcX*o&s%RVl#1$A@cQ&mOD`V z16#5*xM9y~703K&~yQ29-wMPLVW)8(H>xLl$_Zg!EWiat1&{c!7pYj_zo z(maD3R_Q(Ve`@pQznf6(#%DHZp0#QIW6beK5W$w=iFF&dg3WNw8M}pJ4ifN+pLmB) z_vfG2HaAhOrrj0(Yp!eZ+J+;^5TM@SS29yZMogq}aUKrDAKF|Amn;U0;`xJRoh^14 zOhzE+OqNbrg7qPYw8mYy8X%m$OnzdN%&EEIZN>Xw;VI$HEw`~xjpr>?_d1L#Zj_HX z$J2xg2;Qox;325$UX^@s!T6c#cA^SczyPeBtaxBJf(+H$(v6JH8)a;lExxAG_e=K2 zz?;2m_SRNh58>3xy*6XPmS!>+qEw**s9>4d$~)w~^dkz>csJ-@MGK0hgozvcSxKrF zyPyvOqCl|s9)$rg(477CH=yvhWG-%3KWak?(#;4~ra=&Kue|WFPD9VD%G>{>s4Td_ zP(X^FR!rfKd4|=->-%MB`udKS_kQm$D*Ra^E(fliNN@uo^HQ3mk&o3mOoXRlL;sHf`zGi$nZrqO5rl#JZghi4J`_%n#kOEl7d8R zdjsuvLTSP_ABBBrBYzK{c@iOyTR2HGDBwqScHJ#!$!8=XXE?93Np<`*oBJ**?bgqV z8ykoB&oy@Kh`ebn+FrtwR~C_BwSAJBPM}JK^kB^T{ zPNo3`d^UO~7k|oODDmyzeJVm;E`wga3-}jE|1T-+Go|I5w-M!yr1OiEUoYBtzwBHU zGGmUJi-Ru~rX62hqv-bKnh0#l-N1~Gm%kPpO|F-H;MhPH*=Veof>|6E(jP7*$r8+X zJhmuyXxTmBv^ud%5;yc}FCFYbvE3vKTF86y__X7(;_GYjEgp?840Q-{4-05tj6DpL z_;L5aw?9uFogE}Lh_UPhd!1wTb@315Ob52ZN< zL5%Y0x{bN%`!V{?V5h>f7%Lfp%LG`RX!zRF9NbdT?(GvV>fN zsxgaLVt&MB7>YpHh4L-5w&#qn&ESBXYsK(zdkUnV6?l`U$Iarp)Z^{}F|~`GGhin> zczTv75N5T8U}0c$4ixSgsKvkti33Ep8Z!*-21xjoMTGhsg0pSx2Cdf&;7fSFj`-E4 zFHE-Le9s&2`D$YGb*y#+HE$*Yx4;4o(XEAoZy;HBTe%x3qe z_YHezWj`Cz;-93{R>>!nCk6;4Rj?-vJHc?6n@m3?Bd2M2gfaKd6}qRXIwfx2^t=G6 zMtN+jZ)3Ga z5@|7x*-_Wshuto(q}O?D(hF$O?bq1Ye@}Y?DM@PcGkBd=wiS)qRJ-eUKu1ujHxsfd zG3FXswqDWrh5E;mm(jS;SO2b26u}g<7}0U;t4iYJS(a7R^D({8>IP0_Tub~**bT&= zy50Ct!YV6box5~;!(t(3@I8d4_}0Ey@>Wxk&$e-H@kKKC#<1`^nsar83Zbk`7rWAp zA(drbBQJIvk{VA}(&27g=J$tMGPW2bO!ibVRsghkGGLh+ zfBaHw{BK}R#ez1)uS#vdKTqtEn z^1gLUrtDya=B%uZ(P|p`z@fU)czGY~F>#aK*q^K)dG^i|AuB*<)jVix+DJ}vld3Qz zeD&5TX^1*5bYflQY=)0M`^wgO^oD7`%+XwqWvH>35v^EVCxC3)Gaif?ots? zjNGbvi4!47_!!gN~j0Uu(%iW z<`8}fkDSPEYQmu@f?CJI6T-4IQ$yxaOw9aC-oGdLRFY^88sZKbGP1Y6pUYC&ZR`lw zl|;5}($Npg+;^Lwyz7@=8&jVrL>7Au!&+U5aXu01Y%2HgXuCLQsy4*)D{&4cFXZ;v z6Kl-JL{==3raw`)EJdx&`XA<%=noW6H$QqbBzmTtbIOy`Ks;WwXZlyzuGAqlgMS*F+zyjVG zalq~T*?KL`(nU7DM8=&wLQUHDd%A*6_U@+8Lb-ukq(wTvVu0l2^CPwGFyx+ z8HyYgPZ@BiAmNbF0s$Wz?^%};B0f2OWSF0+)*es-MsYRZAL=Qfi{6Pd*V+GUGEg(x zSIV`2XZM2pg?|DnL{U2tA2y$~9t zU^H(1j_ci-stpcyEP)^;#;Hv2!nH%ub4_M6`B{?`pU0M#6-J)$38bq-&1Hs#JXAPG znaQbcZkVKw_ct zfl~BUDj(N9{0!Ei@(Q8J@q8)9veoqa5#06npw3+c&>{+>Ypa#kx!Kh%5x3;lQZwd9 z;3rTyb3vQIzmgACghum3shIPTS#{J^;!bsX4M{qQ56GqRQq|Bmvn->uU_(|Kgd(wr zd1LCjdgPmVvaVIEL7GJZfX7LL<}~^y6V8wHV;pk(C7~d+??V+mkm}M9Rnh}}rnq`m zC*YGr|43!_A$lWG>dhhR^oPK~8;pDx_s&fG_LaZ7@2HiZ8I~5Uc#6Ai!LNpNSq^@8 zZ>{~ae2Jbp_rhUNDZ+9Ya$wG8~Dz#y~<>}J%i-VyAOn2u^;a<80!6G>0YyQw!If&@}CG<5pr6Iz1E(`L{KNp;k zP|-usS;X~?EX9?5QG`iJ(Srij7F1$+-Qd&_Ht5&Z{`;hOmV)7DkMBRPG=dN~a}cwM zy2r4N^;U#;>4v2_=+nwe=L+uzrWv|Aa!8o6U@{fxob5@n*FAMzTd4__R^2Tq;B>Us z<^eCzH;pvuK)KFZ2F^bSmGy`2k~i2K{_=XPhw)v>7YoV&li^k>VPeOTH=U>vG(0QK zG0TU;1`9y|o*4d^o%5fE*+hDaOxBk7Dy90^cE`5y!1n8=eJ2`+msGkR#{}V*%22Nq zie*bs-nPW$I~tW@MDV56mMfl`^LA(l2hrRnS-qWl>$Zz#0;cIG{ONn1__GtUCKqu| z^8lz_2boe-Kju&FTC50EPIK$)=a@{i`!aGg%}GXymG}>VpdB&M@cxpJ%(6EX zBSk9~T`-_(2IoEhpnkX(%biYO%fdz&1~uP`FO*Tj4hHjY!OQej<#ZXCv9X0k&0Le&WTQs;rr_?`@5N;Aet zeoxnZ_HXDysK;h*vh>rr@OI1nYv|oQrcRc_;xRBNwYINQ2|`e+T_~ydT-Q}Go3Owv zj~^UnYz0&5t)+6s^pnHmsk#RWx5;R3p}XYz?R3i))B~@rPLk*e!xXG+Jk#HEQ;^=h znFZRw)T~F39$QXI6+;Y1sK~Z5UK9%x?rwBtdg?n%7bs8H@?lphY zRtY_wfxBGIiNr2nRbEV{Lo34ux~&;bePzg8*W2Jk}svK7y2DtB!@HlfOG z*tytuWv?>Jg%bEP`Mzf7z+LzLz|c4YLDJV9J~n#NO+cK_QAa&7Ih~J<5-NIsBbUWd z^c}Jzw6<({TqNdWjZnAdH~B?d1!qa{=<|VDQZC;|uEYvACXm_$`aT`W#Tm%n_t0QR z5YfPAdoHYanYfDAxR>TQ4mKCqAE>*B2yGIjI9{$s#=SY*KhG1Uqx>poQI*v2Q%+`| zK=$bDJT4j=v=w)4DQUCi? zESfND-zI^qk{78EXuyv3UI=xuIntdvACuv&Im{@~X86sNWmZKgdWC&fefWoA>XfFD zb#Z~e`m@@K;f?{!^;~Em_nufv4=5|Bt+`zJ@&jd^bEsfei46~tK#Q(x2U^_9jAb^j zA{)Qah4wg+kW;bV+NzXDH|s>|bLKTPm6W)DYWXuBO{2~{*VdTBET&)ymTO@oN8Y4l z1#gHhDSWl+kxgA9eYYJ}CG%CqkCNn}TCEtx%y7cBkPVC?!?pb;B;s*xm~&tAeNuah z1i|u`(&I8Wi}@*7hHyb+;+pDRsx9|D9kQa+NZ0l@1fmG>oNwhJF1ahkss68=hK+w0 zN>ZJMWiYV2dzB%+?!uNU{dEgB_S$_W7|j?^;RE@R3dGm$ER8k(2RBxYgbr%fvV@ zdvo2`mz-YEkFX}~y7_u$srWaPea^zy7#Pje;Yfs-3tUDhQm(@-pMCPDLR|U^TIbU{ z+{v=PA;QI}kY(dtDs(&kXvxguWW&Z>lIesjUK1}{?K_UUfj!G~HTrV`;^TCkbcUL< zrX{nl%R?+fJr~IwkQ@<%<8_^OWAZA^x?sgNB{soq1P(;AYKWbcCJ`*Ee&ldh?(fsG z-_SVU&+DH1KG9Fcv+-V4_HSwntk~i|{}FzXv9Baz8abw=-J(7vk*$ejinqO+c6e+U z0(BOZSLt?T6*7%6e!5$U=u8CL7)XsiFAyh23I#jnof|O0$_O7Yuy$)HFPg!UbOq`7 zmh$`|-$T!IIb~#VO{YwC1u@+CyQ?6qt5k?NE#~efn=NnMp>^sFqwyU9(;N9&>pVoh zOSrCmt$wda`P=q{RzALEC|p+}4SFKRS0DXj+_sm4rd>CbUL2Mplo};V#UF&NEkP5t z&2qaM?Hs4j5z-RJmuM@oMr7OaQ9^7=vl5k{^q)jUMJ;Q?dzMGNJns+@xUWZ#SUF+2 zohSqIYBg@HoZgP-!zs*C!#V{*3Q9`kerk8+*}Q-#`%^S84;ZK^U~C69ro1 zKN`1Rofq>h#CES-9-F<4L;0NiV;V>Ng(4a@eldr{&}{0=HeC!<64FbiOJ~aE}lYhBl*3 z*3R!11RUNujAhap#DGbuK>Q@?dz*T_mnm9D#ZNWJ#qjGo;cQ@#6m-iTPO9rFKSHEH z#d}j^Ls(sLLZl^*CeBYV1*M0|BM)(*d#0|4cE~sDjFl$<+us+9+kabgAHO317KRG0 z2(cVC!D_i+rul1{*#FWLFpH^b9BQfNmOU+#b~qNM(Si8KjnK?B{2({jp)3IfSCC>Q z^kOmRuo}jG`FG?7@4R!lK<&Xuxc|^1=I%U^gbwV8 zB>v@f4<4=|Pp44qtAzZ7Wc8%b=h;W|3XqjrCaJ@k#+L7Vjb~gYvi~_M6z}DTh=@3x z?AxRP|2OGFXX%iuk#g>H{-h4$Ms8RA|4u4sD9s}#CMTN@4xUlSM`zYpL>9gxPAwpi ziC?loO(c70AuzOsh?ZY23^iN>1|g2{%6W3xc~H4oM$4(5UUr%7%?HEZT>LbbEY{+q z9a(S3{Ibb>0ops4oaHkpfPe!q%Q36oxz6ReiqgOl_XhcUdmD-rEHLKsu9+*gBIu<1 zj&uIFx2&m0BLEIwecipG?tUsnmcB;Apjo)=?+;DR;npTZkS-t7amwpIq%@sdT~i?9 zS2B@*85#>lDA{t!^xopaJQI8(SL`9`({cV^kfSG)rej!P(d zpL!V8y{ye9ri9VCd+emq!O?qGmt$5HB^5a4p~Wsqs*<4Go=EO$BugIl+1`m0j98+_ zP;rOuOK|MQK-hj-Rt>XK*Wpohn$q%}GtSQ}q$5@p*m0qOtxQ3;VX=Hi9to!5{(mfr z=xOd3MPY9dh8o2lzP_;YRv+F0#nS^sX??Y;{EdKkJW~;g%(FGwUOy$>pf37u4s@7A zZ10YtSC1a3I9y@JakqK+uGmFXsDSC%-x%c=PlsGd24)!52OavX41x~*Gn9913${Z+ zqA_xT0;{#cQ;YsdE{1uiwPz@&r8P~iw*#z+$ETXRZvM`!2Fw>xe;D6jI+#~?Sn4{=|yv1an+I#=~qh}{@Oe8yZr9gT;rVCVkNa_vbIjP8|ACd4z5&&lPTizi*JoJzxX_n z4}O;(5O?d5y#qbEUYC%wZhg4x*LL^v;tOMa1aLm=4H;Otx-z)U98XtBmQO!@OK4xFDCWk;~+xZtW zF{N%twg0Q<7)4k-XA6y&g|646Uat~pq%J}OUeO;1Yn2O7Bl+mf%>&Je!ZaJ!q4#>?@B$eau2gCOxLo;$c;2x$!z#d;k>zr@>Gxk zfmG>*f$)e2f+{RkIa`O&mA!)62nB)dncQ_R_y$`}84s0{N|pV0BBEMNwqUavoBj^Z z8{UZhM&O5Zp-6c-a42*$J2AkSDx{L>c_ouM(W5Aq)}9`L+q@VpePKAhwCYk0vf^2i z^x-`@W>^N|@0izpP$eB?8W))38DaT*SmA3|zkf&UffvO80Q|03!HohILXZpG1s*VH z*42F<+j39u*@SLEPk1c%82U(tWY10{P=ExZvy3GOa_UOH9uU<%v`b4QqjK)3unk<9 zrR&JJIOO+LV3LU57 zPo?7J)18ymxzs7=R73aELTzBqH%N(JC+a|frH91D5!dI>4FRpKt+cmqo@7@yG(-&-YA#%y;ybst?f~NC z)%s0LWH798A}-X-?5J^GzFyyJ>(co#vzgb;$NeAa;)IPaL$aZIMG-#w^bWv84uKgf zWS~r=eev+JkBkjRA9q?9FHM1u{zrQI*V_r%NOwH9<5DjZus;YvTMef#H@3EZ_omzx z1(Xs1fk&vly)(bq9WUy-MlW?T7!3y9G5m_XI^W95ez%3ui4|=>S5*zWKf6P9HpF*M zyXAwgpG;=$AP`Ux#XD|H2;!j0RlI}Kpu9_bnuR#9A^uMO8dIwDXU*oA?>TKKq;j&K ztI3>x5;8h!p{1H##w>EiP)EIT!rEc&{ua7P>oZFjAdZhu$!MYMu2ZLLvk??G>*}=Z zV-9qL4~k&6RPQl_a1)sgo;vpGw9(K|4qvzaox#;~H$zhU^0=!lP>c-0FD8>+atjg@ zW?iZ{eyF7#>rq6{W#6hZN57@wPgN>J$zM)Z7DdE9M1LR}ahB1Y7Ad5+3FoqZ*9{rh z=u@U>O(qKlrA!n0z0`61%g)>%62g-3h(GuR0S-#f<*1t|kok$rBB|H70)Y%n)>WT@|i7uYGq{kRyafd!ogQ+Cr!!HsaWFi@G(2azVj7S$$=X zn@);

    +
    + +
    +
    + +
    +
    Generated at: 2021-12-07 16:19:07 (EST)
    +
    API Version: v1.23.0
    +
    +

    API OVERVIEW

    + +

    Welcome to the Kubernetes API. You can use the Kubernetes API to read +and write Kubernetes resource objects via a Kubernetes API endpoint.

    + +

    Resource Categories

    + +

    This is a high-level overview of the basic types of resources provide by the Kubernetes API and their primary functions.

    +

    Workloads are objects you use to manage and run your containers on the cluster.

    +

    Discovery & LB resources are objects you use to "stitch" your workloads together into an externally accessible, load-balanced Service.

    +

    Config & Storage resources are objects you use to inject initialization data into your applications, and to persist data that is external to your container.

    +

    Cluster resources objects define how the cluster itself is configured; these are typically used only by cluster operators.

    +

    Metadata resources are objects you use to configure the behavior of other resources within the cluster, such as HorizontalPodAutoscaler for scaling workloads.

    + +
    + +

    Resource Objects

    + +

    Resource objects typically have 3 components:

    +
      +
    • Resource ObjectMeta: This is metadata about the resource, such as its name, type, api version, annotations, and labels. This contains +fields that maybe updated both by the end user and the system (e.g. annotations).
    • +
    • ResourceSpec: This is defined by the user and describes the desired state of system. Fill this in when creating or updating an object.
    • +
    • ResourceStatus: This is filled in by the server and reports the current state of the system. In most cases, users don't need to change this.
    • +
    + +
    + +

    Resource Operations

    + +

    Most resources provide the following Operations:

    + +

    Create

    + +

    Create operations will create the resource in the storage backend. After a resource is create the system will apply +the desired state.

    + +

    Update

    + +

    Updates come in 2 forms: Replace and Patch: + +

      +
    • Replace: +Replacing a resource object will update the resource by replacing the existing spec with the provided one. For +read-then-write operations this is safe because an optimistic lock failure will occur if the resource was modified +between the read and write. Note: The ResourceStatus will be ignored by the system and will not be updated. +To update the status, one must invoke the specific status update operation.
      + +Note: Replacing a resource object may not result immediately in changes being propagated to downstream objects. For instance +replacing a ConfigMap or Secret resource will not result in all Pods seeing the changes unless the Pods are +restarted out of band.

    • + +
    • Patch: +Patch will apply a change to a specific field. How the change is merged is defined per field. Lists may either be +replaced or merged. Merging lists will not preserve ordering.
      + +Patches will never cause optimistic locking failures, and the last write will win. Patches are recommended +when the full state is not read before an update, or when failing on optimistic locking is undesirable. When patching +complex types, arrays and maps, how the patch is applied is defined on a per-field basis and may either replace +the field's current value, or merge the contents into the current value.
    • +
    + +

    Read

    + +

    Reads come in 3 forms: Get, List and Watch:

    + +

      +
    • Get: Get will retrieve a specific resource object by name.
    • +
    • List: List will retrieve all resource objects of a specific type within a namespace, and the results can be restricted to resources matching a selector query.
      +List All Namespaces: Like List but retrieves resources across all namespaces.
    • +
    • Watch: Watch will stream results for an object(s) as it is updated. Similar to a callback, watch is used to respond to resource changes.
    • +
    + +

    Delete

    + +

    Delete will delete a resource. Depending on the specific resource, child objects may or may not be garbage collected by the server. See +notes on specific resource objects for details.

    + +

    Additional Operations

    + +

    Resources may define additional operations specific to that resource type.

    + +
      +
    • Rollback: Rollback a PodTemplate to a previous version. Only available for some resource types.
    • +
    • Read / Write Scale: Read or Update the number of replicas for the given resource. Only available for some resource types.
    • +
    • Read / Write Status: Read or Update the Status for a resource object. The Status can only changed through these update operations.
    • +
    +
    +

    API Groups

    +

    The API Groups and their versions are summarized in the following table.

    + + + + + + + + + + + + + + + + + + + + + + + + +
    GroupVersion
    admissionregistration.k8s.iov1
    apiextensions.k8s.iov1
    apiregistration.k8s.iov1
    appsv1
    authentication.k8s.iov1
    authorization.k8s.iov1
    autoscalingv1, v2, v2beta2, v2beta1
    batchv1, v1beta1
    certificates.k8s.iov1
    coordination.k8s.iov1
    corev1
    discovery.k8s.iov1, v1beta1
    events.k8s.iov1, v1beta1
    flowcontrol.apiserver.k8s.iov1beta2, v1beta1
    internal.apiserver.k8s.iov1alpha1
    networking.k8s.iov1
    node.k8s.iov1, v1beta1, v1alpha1
    policyv1, v1beta1
    rbac.authorization.k8s.iov1
    scheduling.k8s.iov1
    storage.k8s.iov1, v1beta1, v1alpha1
    +

    WORKLOADS

    + +

    Workloads resources are responsible for managing and running your containers on the cluster. Containers are created +by Controllers through Pods. Pods run Containers and provide environmental dependencies such as shared or +persistent storage Volumes and Configuration or Secret +data injected into the container.

    + +

    The most common Controllers are:

    +
      +
    • Deployments for stateless persistent apps (e.g. HTTP servers).
    • +
    • StatefulSets for stateful persistent apps (e.g. databases).
    • +
    • Jobs for run-to-completion apps (e.g. batch Jobs).
    • +
    + +
    +

    Container v1 core

    + +
    +
    +
    Container Config to run nginx (must be embedded in a PodSpec to run).
    +
    +
    
    +name: nginx
    +# Run the nginx:1.14 image
    +image: nginx:1.14
    +
    +
    + + + + + +
    GroupVersionKind
    corev1Container
    +

    Warning:

    Containers are only ever created within the context of a Pod. This is usually done using a Controller. See Controllers: Deployment, Job, or StatefulSet

    +
    Appears In: + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    args
    string array
    Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
    command
    string array
    Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
    env
    EnvVar array
    patch strategy: merge
    patch merge key: name
    List of environment variables to set in the container. Cannot be updated.
    envFrom
    EnvFromSource array
    List of sources to populate environment variables in the container. The keys defined within a source must be a C_IDENTIFIER. All invalid keys will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated.
    image
    string
    Docker image name. More info: https://kubernetes.io/docs/concepts/containers/images This field is optional to allow higher level config management to default or override container images in workload controllers like Deployments and StatefulSets.
    imagePullPolicy
    string
    Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images Possible enum values: - `"Always"` means that kubelet always attempts to pull the latest image. Container will fail If the pull fails. - `"IfNotPresent"` means that kubelet pulls if the image isn't present on disk. Container will fail if the image isn't present and the pull fails. - `"Never"` means that kubelet never pulls an image, but only uses a local image. Container will fail if the image isn't present
    lifecycle
    Lifecycle
    Actions that the management system should take in response to container lifecycle events. Cannot be updated.
    livenessProbe
    Probe
    Periodic probe of container liveness. Container will be restarted if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
    name
    string
    Name of the container specified as a DNS_LABEL. Each container in a pod must have a unique name (DNS_LABEL). Cannot be updated.
    ports
    ContainerPort array
    patch strategy: merge
    patch merge key: containerPort
    List of ports to expose from the container. Exposing a port here gives the system additional information about the network connections a container uses, but is primarily informational. Not specifying a port here DOES NOT prevent that port from being exposed. Any port which is listening on the default "0.0.0.0" address inside a container will be accessible from the network. Cannot be updated.
    readinessProbe
    Probe
    Periodic probe of container service readiness. Container will be removed from service endpoints if the probe fails. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
    resources
    ResourceRequirements
    Compute Resources required by this container. Cannot be updated. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    securityContext
    SecurityContext
    SecurityContext defines the security options the container should be run with. If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
    startupProbe
    Probe
    StartupProbe indicates that the Pod has successfully initialized. If specified, no other probes are executed until this completes successfully. If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, when it might take a long time to load data or warm a cache, than during steady-state operation. This cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
    stdin
    boolean
    Whether this container should allocate a buffer for stdin in the container runtime. If this is not set, reads from stdin in the container will always result in EOF. Default is false.
    stdinOnce
    boolean
    Whether the container runtime should close the stdin channel after it has been opened by a single attach. When stdin is true the stdin stream will remain open across multiple attach sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the first client attaches to stdin, and then remains open and accepts data until the client disconnects, at which time stdin is closed and remains closed until the container is restarted. If this flag is false, a container processes that reads from stdin will never receive an EOF. Default is false
    terminationMessagePath
    string
    Optional: Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log. Cannot be updated.
    terminationMessagePolicy
    string
    Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated. Possible enum values: - `"FallbackToLogsOnError"` will read the most recent contents of the container logs for the container status message when the container exits with an error and the terminationMessagePath has no contents. - `"File"` is the default behavior and will set the container status message to the contents of the container's terminationMessagePath when the container exits.
    tty
    boolean
    Whether this container should allocate a TTY for itself, also requires 'stdin' to be true. Default is false.
    volumeDevices
    VolumeDevice array
    patch strategy: merge
    patch merge key: devicePath
    volumeDevices is the list of block devices to be used by the container.
    volumeMounts
    VolumeMount array
    patch strategy: merge
    patch merge key: mountPath
    Pod volumes to mount into the container's filesystem. Cannot be updated.
    workingDir
    string
    Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. Cannot be updated.
    +

    ContainerStatus v1 core

    +
    Appears In: + +
    + + + + + + + + + + + + + +
    FieldDescription
    containerID
    string
    Container's ID in the format 'docker://<container_id>'.
    image
    string
    The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images.
    imageID
    string
    ImageID of the container's image.
    lastState
    ContainerState
    Details about the container's last termination condition.
    name
    string
    This must be a DNS_LABEL. Each container in a pod must have a unique name. Cannot be updated.
    ready
    boolean
    Specifies whether the container has passed its readiness probe.
    restartCount
    integer
    The number of times the container has been restarted.
    started
    boolean
    Specifies whether the container has passed its startup probe. Initialized as false, becomes true after startupProbe is considered successful. Resets to false when the container is restarted, or if kubelet loses state temporarily. Is always true when no startupProbe is defined.
    state
    ContainerState
    Details about the container's current condition.
    +

    CronJob v1 batch

    + + + + + +
    GroupVersionKind
    batchv1CronJob
    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    CronJobSpec
    Specification of the desired behavior of a cron job, including the schedule. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    CronJobStatus
    Current status of a cron job. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    CronJobSpec v1 batch

    +
    Appears In: + +
    + + + + + + + + + + + +
    FieldDescription
    concurrencyPolicy
    string
    Specifies how to treat concurrent executions of a Job. Valid values are: - "Allow" (default): allows CronJobs to run concurrently; - "Forbid": forbids concurrent runs, skipping next run if previous run hasn't finished yet; - "Replace": cancels currently running job and replaces it with a new one Possible enum values: - `"Allow"` allows CronJobs to run concurrently. - `"Forbid"` forbids concurrent runs, skipping next run if previous hasn't finished yet. - `"Replace"` cancels currently running job and replaces it with a new one.
    failedJobsHistoryLimit
    integer
    The number of failed finished jobs to retain. Value must be non-negative integer. Defaults to 1.
    jobTemplate
    JobTemplateSpec
    Specifies the job that will be created when executing a CronJob.
    schedule
    string
    The schedule in Cron format, see https://en.wikipedia.org/wiki/Cron.
    startingDeadlineSeconds
    integer
    Optional deadline in seconds for starting the job if it misses scheduled time for any reason. Missed jobs executions will be counted as failed ones.
    successfulJobsHistoryLimit
    integer
    The number of successful finished jobs to retain. Value must be non-negative integer. Defaults to 3.
    suspend
    boolean
    This flag tells the controller to suspend subsequent executions, it does not apply to already started executions. Defaults to false.
    +

    CronJobStatus v1 batch

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    active
    ObjectReference array
    A list of pointers to currently running jobs.
    lastScheduleTime
    Time
    Information when was the last time the job was successfully scheduled.
    lastSuccessfulTime
    Time
    Information when was the last time the job successfully completed.
    +

    CronJobList v1 batch

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    CronJob array
    items is the list of CronJobs.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a CronJob

    +

    HTTP Request

    +POST /apis/batch/v1/namespaces/{namespace}/cronjobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CronJob
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    CronJob
    OK
    201
    CronJob
    Created
    202
    CronJob
    Accepted
    +

    Patch

    +

    partially update the specified CronJob

    +

    HTTP Request

    +PATCH /apis/batch/v1/namespaces/{namespace}/cronjobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CronJob
    OK
    201
    CronJob
    Created
    +

    Replace

    +

    replace the specified CronJob

    +

    HTTP Request

    +PUT /apis/batch/v1/namespaces/{namespace}/cronjobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CronJob
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CronJob
    OK
    201
    CronJob
    Created
    +

    Delete

    +

    delete a CronJob

    +

    HTTP Request

    +DELETE /apis/batch/v1/namespaces/{namespace}/cronjobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of CronJob

    +

    HTTP Request

    +DELETE /apis/batch/v1/namespaces/{namespace}/cronjobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified CronJob

    +

    HTTP Request

    +GET /apis/batch/v1/namespaces/{namespace}/cronjobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CronJob
    OK
    +

    List

    +

    list or watch objects of kind CronJob

    +

    HTTP Request

    +GET /apis/batch/v1/namespaces/{namespace}/cronjobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CronJobList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind CronJob

    +

    HTTP Request

    +GET /apis/batch/v1/cronjobs +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CronJobList
    OK
    +

    Watch

    +

    watch changes to an object of kind CronJob. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/batch/v1/watch/namespaces/{namespace}/cronjobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of CronJob. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/batch/v1/watch/namespaces/{namespace}/cronjobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of CronJob. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/batch/v1/watch/cronjobs +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified CronJob

    +

    HTTP Request

    +PATCH /apis/batch/v1/namespaces/{namespace}/cronjobs/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CronJob
    OK
    201
    CronJob
    Created
    +

    Read Status

    +

    read status of the specified CronJob

    +

    HTTP Request

    +GET /apis/batch/v1/namespaces/{namespace}/cronjobs/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CronJob
    OK
    +

    Replace Status

    +

    replace status of the specified CronJob

    +

    HTTP Request

    +PUT /apis/batch/v1/namespaces/{namespace}/cronjobs/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CronJob
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CronJob
    OK
    201
    CronJob
    Created
    +

    DaemonSet v1 apps

    + +
    +
    +
    DaemonSet Config to print the `hostname` on each Node in the cluster every 10 seconds.
    +
    +
    
    +apiVersion: apps/v1
    +kind: DaemonSet
    +metadata:
    +  # Unique key of the DaemonSet instance
    +  name: daemonset-example
    +spec:
    +  selector:
    +    matchLabels:
    +      app: daemonset-example
    +  template:
    +    metadata:
    +      labels:
    +        app: daemonset-example
    +    spec:
    +      containers:
    +      # This container is run once on each Node in the cluster
    +      - name: daemonset-example
    +        image: ubuntu:trusty
    +        command:
    +        - /bin/sh
    +        args:
    +        - -c
    +        # This script is run through `sh -c <script>`
    +        - >-
    +          while [ true ]; do
    +          echo "DaemonSet running on $(hostname)" ;
    +          sleep 10 ;
    +          done
    +
    + + + + + +
    GroupVersionKind
    appsv1DaemonSet
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    DaemonSetSpec
    The desired behavior of this daemon set. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    DaemonSetStatus
    The current status of this daemon set. This data may be out of date by some window of time. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    DaemonSetSpec v1 apps

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    minReadySeconds
    integer
    The minimum number of seconds for which a newly created DaemonSet pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready).
    revisionHistoryLimit
    integer
    The number of old history to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. Defaults to 10.
    selector
    LabelSelector
    A label query over pods that are managed by the daemon set. Must match in order to be controlled. It must match the pod template's labels. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
    template
    PodTemplateSpec
    An object that describes the pod that will be created. The DaemonSet will create exactly one copy of this pod on every node that matches the template's node selector (or on every node if no node selector is specified). More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
    updateStrategy
    DaemonSetUpdateStrategy
    An update strategy to replace existing DaemonSet pods with new pods.
    +

    DaemonSetStatus v1 apps

    +
    Appears In: + +
    + + + + + + + + + + + + + + +
    FieldDescription
    collisionCount
    integer
    Count of hash collisions for the DaemonSet. The DaemonSet controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ControllerRevision.
    conditions
    DaemonSetCondition array
    patch strategy: merge
    patch merge key: type
    Represents the latest available observations of a DaemonSet's current state.
    currentNumberScheduled
    integer
    The number of nodes that are running at least 1 daemon pod and are supposed to run the daemon pod. More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
    desiredNumberScheduled
    integer
    The total number of nodes that should be running the daemon pod (including nodes correctly running the daemon pod). More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
    numberAvailable
    integer
    The number of nodes that should be running the daemon pod and have one or more of the daemon pod running and available (ready for at least spec.minReadySeconds)
    numberMisscheduled
    integer
    The number of nodes that are running the daemon pod, but are not supposed to run the daemon pod. More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
    numberReady
    integer
    numberReady is the number of nodes that should be running the daemon pod and have one or more of the daemon pod running with a Ready Condition.
    numberUnavailable
    integer
    The number of nodes that should be running the daemon pod and have none of the daemon pod running and available (ready for at least spec.minReadySeconds)
    observedGeneration
    integer
    The most recent generation observed by the daemon set controller.
    updatedNumberScheduled
    integer
    The total number of nodes that are running updated daemon pod
    +

    DaemonSetList v1 apps

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    DaemonSet array
    A list of daemon sets.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    RollingUpdateDaemonSet v1 apps

    + + + + + + + +
    FieldDescription
    maxSurgeThe maximum number of nodes with an existing available DaemonSet pod that can have an updated DaemonSet pod during during an update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up to a minimum of 1. Default value is 0. Example: when this is set to 30%, at most 30% of the total number of nodes that should be running the daemon pod (i.e. status.desiredNumberScheduled) can have their a new pod created before the old pod is marked as deleted. The update starts by launching new pods on 30% of nodes. Once an updated pod is available (Ready for at least minReadySeconds) the old DaemonSet pod on that node is marked deleted. If the old pod becomes unavailable for any reason (Ready transitions to false, is evicted, or is drained) an updated pod is immediatedly created on that node without considering surge limits. Allowing surge implies the possibility that the resources consumed by the daemonset on any given node can double if the readiness check fails, and so resource intensive daemonsets should take into account that they may cause evictions during disruption. This is beta field and enabled/disabled by DaemonSetUpdateSurge feature gate.
    maxUnavailableThe maximum number of DaemonSet pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of total number of DaemonSet pods at the start of the update (ex: 10%). Absolute number is calculated from percentage by rounding up. This cannot be 0 if MaxSurge is 0 Default value is 1. Example: when this is set to 30%, at most 30% of the total number of nodes that should be running the daemon pod (i.e. status.desiredNumberScheduled) can have their pods stopped for an update at any given time. The update starts by stopping at most 30% of those DaemonSet pods and then brings up new DaemonSet pods in their place. Once the new pods are available, it then proceeds onto other DaemonSet pods, thus ensuring that at least 70% of original number of DaemonSet pods are available at all times during the update.
    +

    Write Operations

    +

    Create

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ echo 'apiVersion: apps/v1
    +kind: DaemonSet
    +metadata:
    +  name: daemonset-example
    +spec:
    +  selector:
    +    matchLabels:
    +      app: daemonset-example
    +  template:
    +    metadata:
    +      labels:
    +        app: daemonset-example
    +    spec:
    +      containers:
    +      - name: daemonset-example
    +        image: ubuntu:trusty
    +        command:
    +        - /bin/sh
    +        args:
    +        - -c
    +        - >-
    +          while [ true ]; do
    +          echo "DaemonSet running on $(hostname)" ;
    +          sleep 10 ;
    +          done
    +' | kubectl create -f -
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X POST -H 'Content-Type: application/yaml' --data '
    +apiVersion: apps/v1
    +kind: DaemonSet
    +metadata:
    +  name: daemonset-example
    +spec:
    +  selector:
    +    matchLabels:
    +      app: daemonset-example
    +  template:
    +    metadata:
    +      labels:
    +        app: daemonset-example
    +    spec:
    +      containers:
    +      - name: daemonset-example
    +        image: ubuntu:trusty
    +        command:
    +        - /bin/sh
    +        args:
    +        - -c
    +        - >-
    +          while [ true ]; do
    +          echo "DaemonSet running on $(hostname)" ;
    +          sleep 10 ;
    +          done
    +' http://127.0.0.1:8001/apis/apps/v1/namespaces/default/daemonsets
    +
    + + +
    +
    +
    Output
    +
    +
    
    +daemonset "daemonset-example" created
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "DaemonSet",
    +  "apiVersion": "apps/v1",
    +  "metadata": {
    +    "name": "daemonset-example",
    +    "namespace": "default",
    +    "selfLink": "/apis/apps/v1/namespaces/default/daemonsets/daemonset-example",
    +    "uid": "65552ced-b0e2-11e6-aef0-42010af00229",
    +    "resourceVersion": "3558",
    +    "generation": 1,
    +    "creationTimestamp": "2016-11-22T18:35:09Z",
    +    "labels": {
    +      "app": "daemonset-example"
    +    }
    +  },
    +  "spec": {
    +    "selector": {
    +      "matchLabels": {
    +        "app": "daemonset-example"
    +      }
    +    },
    +    "template": {
    +      "metadata": {
    +        "creationTimestamp": null,
    +        "labels": {
    +          "app": "daemonset-example"
    +        }
    +      },
    +      "spec": {
    +        "containers": [
    +          {
    +            "name": "daemonset-example",
    +            "image": "ubuntu:trusty",
    +            "command": [
    +              "/bin/sh"
    +            ],
    +            "args": [
    +              "-c",
    +              "while [ true ]; do echo \"DaemonSet running on $(hostname)\" ; sleep 10 ; done"
    +            ],
    +            "resources": {},
    +            "terminationMessagePath": "/dev/termination-log",
    +            "imagePullPolicy": "IfNotPresent"
    +          }
    +        ],
    +        "restartPolicy": "Always",
    +        "terminationGracePeriodSeconds": 30,
    +        "dnsPolicy": "ClusterFirst",
    +        "securityContext": {}
    +      }
    +    }
    +  },
    +  "status": {
    +    "currentNumberScheduled": 0,
    +    "numberMisscheduled": 0,
    +    "desiredNumberScheduled": 0
    +  }
    +}
    +
    +

    create a DaemonSet

    +

    HTTP Request

    +POST /apis/apps/v1/namespaces/{namespace}/daemonsets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DaemonSet
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    DaemonSet
    OK
    201
    DaemonSet
    Created
    202
    DaemonSet
    Accepted
    +

    Patch

    +

    partially update the specified DaemonSet

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/daemonsets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the DaemonSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    DaemonSet
    OK
    201
    DaemonSet
    Created
    +

    Replace

    +

    replace the specified DaemonSet

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/daemonsets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the DaemonSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DaemonSet
    +

    Response

    + + + + + + +
    CodeDescription
    200
    DaemonSet
    OK
    201
    DaemonSet
    Created
    +

    Delete

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl delete daemonset daemonset-example
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X DELETE -H 'Content-Type: application/yaml' --data '
    +gracePeriodSeconds: 0
    +orphanDependents: false
    +' 'http://127.0.0.1:8001/apis/apps/v1/namespaces/default/daemonsets/daemonset-example'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +daemonset "daemonset-example" deleted
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Status",
    +  "apiVersion": "v1",
    +  "metadata": {},
    +  "status": "Success",
    +  "code": 200
    +}
    +
    +
    +

    delete a DaemonSet

    +

    HTTP Request

    +DELETE /apis/apps/v1/namespaces/{namespace}/daemonsets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the DaemonSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of DaemonSet

    +

    HTTP Request

    +DELETE /apis/apps/v1/namespaces/{namespace}/daemonsets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl get daemonset daemonset-example -o json
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X GET http://127.0.0.1:8001/apis/apps/v1/namespaces/default/daemonsets/daemonset-example
    +
    +

    read the specified DaemonSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/daemonsets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the DaemonSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    DaemonSet
    OK
    +

    List

    +

    list or watch objects of kind DaemonSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/daemonsets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    DaemonSetList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind DaemonSet

    +

    HTTP Request

    +GET /apis/apps/v1/daemonsets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    DaemonSetList
    OK
    +

    Watch

    +

    watch changes to an object of kind DaemonSet. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/namespaces/{namespace}/daemonsets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the DaemonSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of DaemonSet. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/namespaces/{namespace}/daemonsets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of DaemonSet. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/daemonsets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified DaemonSet

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/daemonsets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the DaemonSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    DaemonSet
    OK
    201
    DaemonSet
    Created
    +

    Read Status

    +

    read status of the specified DaemonSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/daemonsets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the DaemonSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    DaemonSet
    OK
    +

    Replace Status

    +

    replace status of the specified DaemonSet

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/daemonsets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the DaemonSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DaemonSet
    +

    Response

    + + + + + + +
    CodeDescription
    200
    DaemonSet
    OK
    201
    DaemonSet
    Created
    +

    Deployment v1 apps

    + +
    +
    +
    Deployment Config to run 3 nginx instances (max rollback set to 10 revisions).
    +
    +
    
    +apiVersion: apps/v1
    +kind: Deployment
    +metadata:
    +  # Unique key of the Deployment instance
    +  name: deployment-example
    +spec:
    +  # 3 Pods should exist at all times.
    +  replicas: 3
    +  selector:
    +    matchLabels:
    +      app: nginx
    +  template:
    +    metadata:
    +      labels:
    +        # Apply this label to pods and default
    +        # the Deployment label selector to this value
    +        app: nginx
    +    spec:
    +      containers:
    +      - name: nginx
    +        # Run this image
    +        image: nginx:1.14
    +
    +
    + + + + + +
    GroupVersionKind
    appsv1Deployment
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    DeploymentSpec
    Specification of the desired behavior of the Deployment.
    status
    DeploymentStatus
    Most recently observed status of the Deployment.
    +

    DeploymentSpec v1 apps

    +
    Appears In: + +
    + + + + + + + + + + + + +
    FieldDescription
    minReadySeconds
    integer
    Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)
    paused
    boolean
    Indicates that the deployment is paused.
    progressDeadlineSeconds
    integer
    The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. Defaults to 600s.
    replicas
    integer
    Number of desired pods. This is a pointer to distinguish between explicit zero and not specified. Defaults to 1.
    revisionHistoryLimit
    integer
    The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. Defaults to 10.
    selector
    LabelSelector
    Label selector for pods. Existing ReplicaSets whose pods are selected by this will be the ones affected by this deployment. It must match the pod template's labels.
    strategy
    DeploymentStrategy
    patch strategy: retainKeys
    The deployment strategy to use to replace existing pods with new ones.
    template
    PodTemplateSpec
    Template describes the pods that will be created.
    +

    DeploymentStatus v1 apps

    +
    Appears In: + +
    + + + + + + + + + + + + +
    FieldDescription
    availableReplicas
    integer
    Total number of available pods (ready for at least minReadySeconds) targeted by this deployment.
    collisionCount
    integer
    Count of hash collisions for the Deployment. The Deployment controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ReplicaSet.
    conditions
    DeploymentCondition array
    patch strategy: merge
    patch merge key: type
    Represents the latest available observations of a deployment's current state.
    observedGeneration
    integer
    The generation observed by the deployment controller.
    readyReplicas
    integer
    readyReplicas is the number of pods targeted by this Deployment with a Ready Condition.
    replicas
    integer
    Total number of non-terminated pods targeted by this deployment (their labels match the selector).
    unavailableReplicas
    integer
    Total number of unavailable pods targeted by this deployment. This is the total number of pods that are still required for the deployment to have 100% available capacity. They may either be pods that are running but not yet available or pods that still have not been created.
    updatedReplicas
    integer
    Total number of non-terminated pods targeted by this deployment that have the desired template spec.
    +

    DeploymentList v1 apps

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Deployment array
    Items is the list of Deployments.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata.
    +

    DeploymentStrategy v1 apps

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    rollingUpdate
    RollingUpdateDeployment
    Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate.
    type
    string
    Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate. Possible enum values: - `"Recreate"` Kill all existing pods before creating new ones. - `"RollingUpdate"` Replace the old ReplicaSets by new one using rolling update i.e gradually scale down the old ReplicaSets and scale up the new one.
    +

    RollingUpdateDeployment v1 apps

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    maxSurgeThe maximum number of pods that can be scheduled above the desired number of pods. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is calculated from percentage by rounding up. Defaults to 25%. Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when the rolling update starts, such that the total number of old and new pods do not exceed 130% of desired pods. Once old pods have been killed, new ReplicaSet can be scaled up further, ensuring that total number of pods running at any time during the update is at most 130% of desired pods.
    maxUnavailableThe maximum number of pods that can be unavailable during the update. Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). Absolute number is calculated from percentage by rounding down. This can not be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods immediately when the rolling update starts. Once new pods are ready, old ReplicaSet can be scaled down further, followed by scaling up the new ReplicaSet, ensuring that the total number of pods available at all times during the update is at least 70% of desired pods.
    +

    Write Operations

    +

    Create

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ echo 'apiVersion: apps/v1
    +kind: Deployment
    +metadata:
    +  name: deployment-example
    +spec:
    +  replicas: 3
    +  revisionHistoryLimit: 10
    +  selector:
    +    matchLabels:
    +      app: nginx
    +  template:
    +    metadata:
    +      labels:
    +        app: nginx
    +    spec:
    +      containers:
    +      - name: nginx
    +        image: nginx:1.14
    +        ports:
    +        - containerPort: 80
    +' | kubectl create -f -
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X POST -H 'Content-Type: application/yaml' --data '
    +apiVersion: apps/v1
    +kind: Deployment
    +metadata:
    +  name: deployment-example
    +spec:
    +  replicas: 3
    +  revisionHistoryLimit: 10
    +  selector:
    +    matchLabels:
    +      app: nginx
    +  template:
    +    metadata:
    +      labels:
    +        app: nginx
    +    spec:
    +      containers:
    +      - name: nginx
    +        image: nginx:1.14
    +        ports:
    +        - containerPort: 80
    +' http://127.0.0.1:8001/apis/apps/v1/namespaces/default/deployments
    +
    + + +
    +
    +
    Output
    +
    +
    
    +deployment "deployment-example" created
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Deployment",
    +  "apiVersion": "apps/v1",
    +  "metadata": {
    +    "name": "deployment-example",
    +    "namespace": "default",
    +    "selfLink": "/apis/apps/v1/namespaces/default/deployments/deployment-example",
    +    "uid": "4ccca349-9cb1-11e6-9c54-42010a800148",
    +    "resourceVersion": "2118306",
    +    "generation": 1,
    +    "creationTimestamp": "2016-10-28T01:53:19Z",
    +    "labels": {
    +      "app": "nginx"
    +    }
    +  },
    +  "spec": {
    +    "replicas": 3,
    +    "selector": {
    +      "matchLabels": {
    +        "app": "nginx"
    +      }
    +    },
    +    "template": {
    +      "metadata": {
    +        "creationTimestamp": null,
    +        "labels": {
    +          "app": "nginx"
    +        }
    +      },
    +      "spec": {
    +        "containers": [
    +          {
    +            "name": "nginx",
    +            "image": "nginx:1.14",
    +            "ports": [
    +              {
    +                "containerPort": 80,
    +                "protocol": "TCP"
    +              }
    +            ],
    +            "resources": {},
    +            "terminationMessagePath": "/dev/termination-log",
    +            "imagePullPolicy": "IfNotPresent"
    +          }
    +        ],
    +        "restartPolicy": "Always",
    +        "terminationGracePeriodSeconds": 30,
    +        "dnsPolicy": "ClusterFirst",
    +        "securityContext": {}
    +      }
    +    },
    +    "strategy": {
    +      "type": "RollingUpdate",
    +      "rollingUpdate": {
    +        "maxUnavailable": 1,
    +        "maxSurge": 1
    +      }
    +    },
    +    "revisionHistoryLimit": 10
    +  },
    +  "status": {}
    +}
    +
    +
    +

    create a Deployment

    +

    HTTP Request

    +POST /apis/apps/v1/namespaces/{namespace}/deployments +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Deployment
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Deployment
    OK
    201
    Deployment
    Created
    202
    Deployment
    Accepted
    +

    Patch

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl patch deployment deployment-example -p \
    +	'{"spec":{"template":{"spec":{"containers":[{"name":"nginx","image":"nginx:1.16"}]}}}}'
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X PATCH -H 'Content-Type: application/strategic-merge-patch+json' --data '
    +{"spec":{"template":{"spec":{"containers":[{"name":"nginx","image":"nginx:1.16"}]}}}}' \
    +	'http://127.0.0.1:8001/apis/apps/v1/namespaces/default/deployments/deployment-example'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +"deployment-example" patched
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Deployment",
    +  "apiVersion": "apps/v1",
    +  "metadata": {
    +    "name": "deployment-example",
    +    "namespace": "default",
    +    "selfLink": "/apis/apps/v1/namespaces/default/deployments/deployment-example",
    +    "uid": "5dc3a8e6-b0ee-11e6-aef0-42010af00229",
    +    "resourceVersion": "164489",
    +    "generation": 11,
    +    "creationTimestamp": "2016-11-22T20:00:50Z",
    +    "labels": {
    +      "app": "nginx"
    +    },
    +    "annotations": {
    +      "deployment.kubernetes.io/revision": "5"
    +    }
    +  },
    +  "spec": {
    +    "replicas": 3,
    +    "selector": {
    +      "matchLabels": {
    +        "app": "nginx"
    +      }
    +    },
    +    "template": {
    +      "metadata": {
    +        "creationTimestamp": null,
    +        "labels": {
    +          "app": "nginx"
    +        }
    +      },
    +      "spec": {
    +        "containers": [
    +          {
    +            "name": "nginx",
    +            "image": "nginx:1.16",
    +            "ports": [
    +              {
    +                "containerPort": 80,
    +                "protocol": "TCP"
    +              }
    +            ],
    +            "resources": {},
    +            "terminationMessagePath": "/dev/termination-log",
    +            "imagePullPolicy": "IfNotPresent"
    +          }
    +        ],
    +        "restartPolicy": "Always",
    +        "terminationGracePeriodSeconds": 30,
    +        "dnsPolicy": "ClusterFirst",
    +        "securityContext": {}
    +      }
    +    },
    +    "strategy": {
    +      "type": "RollingUpdate",
    +      "rollingUpdate": {
    +        "maxUnavailable": 1,
    +        "maxSurge": 1
    +      }
    +    },
    +    "revisionHistoryLimit": 10
    +  },
    +  "status": {
    +    "observedGeneration": 10,
    +    "replicas": 3,
    +    "updatedReplicas": 3,
    +    "availableReplicas": 3
    +  }
    +}
    +
    +
    +

    partially update the specified Deployment

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/deployments/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Deployment
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Deployment
    OK
    201
    Deployment
    Created
    +

    Replace

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ echo 'apiVersion: apps/v1
    +kind: Deployment
    +metadata:
    +  name: deployment-example
    +spec:
    +  replicas: 3
    +  revisionHistoryLimit: 10
    +  selector:
    +    matchLabels:
    +      app: nginx
    +  template:
    +    metadata:
    +      labels:
    +        app: nginx
    +    spec:
    +      containers:
    +      - name: nginx
    +        image: nginx:1.16
    +        ports:
    +        - containerPort: 80
    +' | kubectl replace -f -
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X PUT -H 'Content-Type: application/yaml' --data '
    +apiVersion: apps/v1
    +kind: Deployment
    +metadata:
    +  name: deployment-example
    +spec:
    +  replicas: 3
    +  revisionHistoryLimit: 10
    +  selector:
    +    matchLabels:
    +      app: nginx
    +  template:
    +    metadata:
    +      labels:
    +        app: nginx
    +    spec:
    +      containers:
    +      - name: nginx
    +        image: nginx:1.16
    +        ports:
    +        - containerPort: 80
    +' http://127.0.0.1:8001/apis/apps/v1/namespaces/default/deployments/deployment-example
    +
    + + +
    +
    +
    Output
    +
    +
    
    +deployment "deployment-example" replaced
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Deployment",
    +  "apiVersion": "apps/v1",
    +  "metadata": {
    +    "name": "deployment-example",
    +    "namespace": "default",
    +    "selfLink": "/apis/apps/v1/namespaces/default/deployments/deployment-example",
    +    "uid": "4ccca349-9cb1-11e6-9c54-42010a800148",
    +    "resourceVersion": "2119082",
    +    "generation": 5,
    +    "creationTimestamp": "2016-10-28T01:53:19Z",
    +    "labels": {
    +      "app": "nginx"
    +    }
    +  },
    +  "spec": {
    +    "replicas": 3,
    +    "selector": {
    +      "matchLabels": {
    +        "app": "nginx"
    +      }
    +    },
    +    "template": {
    +      "metadata": {
    +        "creationTimestamp": null,
    +        "labels": {
    +          "app": "nginx"
    +        }
    +      },
    +      "spec": {
    +        "containers": [
    +          {
    +            "name": "nginx",
    +            "image": "nginx:1.16",
    +            "ports": [
    +              {
    +                "containerPort": 80,
    +                "protocol": "TCP"
    +              }
    +            ],
    +            "resources": {},
    +            "terminationMessagePath": "/dev/termination-log",
    +            "imagePullPolicy": "IfNotPresent"
    +          }
    +        ],
    +        "restartPolicy": "Always",
    +        "terminationGracePeriodSeconds": 30,
    +        "dnsPolicy": "ClusterFirst",
    +        "securityContext": {}
    +      }
    +    },
    +    "strategy": {
    +      "type": "RollingUpdate",
    +      "rollingUpdate": {
    +        "maxUnavailable": 1,
    +        "maxSurge": 1
    +      }
    +    },
    +    "revisionHistoryLimit": 10
    +  },
    +  "status": {
    +    "observedGeneration": 4,
    +    "replicas": 3,
    +    "updatedReplicas": 3,
    +    "availableReplicas": 3
    +  }
    +}
    +
    +
    +

    replace the specified Deployment

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/deployments/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Deployment
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Deployment
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Deployment
    OK
    201
    Deployment
    Created
    +

    Delete

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl delete deployment deployment-example
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X DELETE -H 'Content-Type: application/yaml' --data '
    +gracePeriodSeconds: 0
    +orphanDependents: false
    +' 'http://127.0.0.1:8001/apis/apps/v1/namespaces/default/deployments/deployment-example'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +deployment "deployment-example" deleted
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Status",
    +  "apiVersion": "v1",
    +  "metadata": {},
    +  "status": "Success",
    +  "code": 200
    +}
    +
    +
    +

    delete a Deployment

    +

    HTTP Request

    +DELETE /apis/apps/v1/namespaces/{namespace}/deployments/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Deployment
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Deployment

    +

    HTTP Request

    +DELETE /apis/apps/v1/namespaces/{namespace}/deployments +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl get deployment deployment-example -o json
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X GET http://127.0.0.1:8001/apis/apps/v1/namespaces/default/deployments/deployment-example
    +
    + + +
    +
    +
    Output
    +
    +
    
    +{
    +  "kind": "Deployment",
    +  "apiVersion": "apps/v1",
    +  "metadata": {
    +    "name": "deployment-example",
    +    "namespace": "default",
    +    "selfLink": "/apis/apps/v1/namespaces/default/deployments/deployment-example",
    +    "uid": "1b33145a-9c63-11e6-9c54-42010a800148",
    +    "resourceVersion": "2064726",
    +    "generation": 4,
    +    "creationTimestamp": "2016-10-27T16:33:35Z",
    +    "labels": {
    +      "app": "nginx"
    +    },
    +    "annotations": {
    +      "deployment.kubernetes.io/revision": "1"
    +    }
    +  },
    +  "spec": {
    +    "replicas": 3,
    +    "selector": {
    +      "matchLabels": {
    +        "app": "nginx"
    +      }
    +    },
    +    "template": {
    +      "metadata": {
    +        "creationTimestamp": null,
    +        "labels": {
    +          "app": "nginx"
    +        }
    +      },
    +      "spec": {
    +        "containers": [
    +          {
    +            "name": "nginx",
    +            "image": "nginx:1.14",
    +            "ports": [
    +              {
    +                "containerPort": 80,
    +                "protocol": "TCP"
    +              }
    +            ],
    +            "resources": {},
    +            "terminationMessagePath": "/dev/termination-log",
    +            "imagePullPolicy": "IfNotPresent"
    +          }
    +        ],
    +        "restartPolicy": "Always",
    +        "terminationGracePeriodSeconds": 30,
    +        "dnsPolicy": "ClusterFirst",
    +        "securityContext": {}
    +      }
    +    },
    +    "strategy": {
    +      "type": "RollingUpdate",
    +      "rollingUpdate": {
    +        "maxUnavailable": 1,
    +        "maxSurge": 1
    +      }
    +    }
    +  },
    +  "status": {
    +    "observedGeneration": 4,
    +    "replicas": 3,
    +    "updatedReplicas": 3,
    +    "availableReplicas": 3
    +  }
    +}
    +
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Deployment",
    +  "apiVersion": "apps/v1",
    +  "metadata": {
    +    "name": "deployment-example",
    +    "namespace": "default",
    +    "selfLink": "/apis/apps/v1/namespaces/default/deployments/deployment-example",
    +    "uid": "1b33145a-9c63-11e6-9c54-42010a800148",
    +    "resourceVersion": "2064726",
    +    "generation": 4,
    +    "creationTimestamp": "2016-10-27T16:33:35Z",
    +    "labels": {
    +      "app": "nginx"
    +    },
    +    "annotations": {
    +      "deployment.kubernetes.io/revision": "1"
    +    }
    +  },
    +  "spec": {
    +    "replicas": 3,
    +    "selector": {
    +      "matchLabels": {
    +        "app": "nginx"
    +      }
    +    },
    +    "template": {
    +      "metadata": {
    +        "creationTimestamp": null,
    +        "labels": {
    +          "app": "nginx"
    +        }
    +      },
    +      "spec": {
    +        "containers": [
    +          {
    +            "name": "nginx",
    +            "image": "nginx:1.14",
    +            "ports": [
    +              {
    +                "containerPort": 80,
    +                "protocol": "TCP"
    +              }
    +            ],
    +            "resources": {},
    +            "terminationMessagePath": "/dev/termination-log",
    +            "imagePullPolicy": "IfNotPresent"
    +          }
    +        ],
    +        "restartPolicy": "Always",
    +        "terminationGracePeriodSeconds": 30,
    +        "dnsPolicy": "ClusterFirst",
    +        "securityContext": {}
    +      }
    +    },
    +    "strategy": {
    +      "type": "RollingUpdate",
    +      "rollingUpdate": {
    +        "maxUnavailable": 1,
    +        "maxSurge": 1
    +      }
    +    }
    +  },
    +  "status": {
    +    "observedGeneration": 4,
    +    "replicas": 3,
    +    "updatedReplicas": 3,
    +    "availableReplicas": 3
    +  }
    +}
    +
    +
    +

    read the specified Deployment

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/deployments/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Deployment
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Deployment
    OK
    +

    List

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl get deployment -o json
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X GET 'http://127.0.0.1:8001/apis/apps/v1/namespaces/default/deployments'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +{
    +  "kind": "List",
    +  "apiVersion": "v1",
    +  "metadata": {},
    +  "items": [
    +    {
    +      "kind": "Deployment",
    +      "apiVersion": "app/v1beta1",
    +      "metadata": {
    +        "name": "docs",
    +        "namespace": "default",
    +        "selfLink": "/apis/app/v1beta1/namespaces/default/deployments/docs",
    +        "uid": "ef49e1d2-915e-11e6-be81-42010a80003f",
    +        "resourceVersion": "1924126",
    +        "generation": 21,
    +        "creationTimestamp": "2016-10-13T16:06:00Z",
    +        "labels": {
    +          "run": "docs"
    +        },
    +        "annotations": {
    +          "deployment.kubernetes.io/revision": "10",
    +          "replicatingperfection.net/push-image": "true"
    +        }
    +      },
    +      "spec": {
    +        "replicas": 1,
    +        "selector": {
    +          "matchLabels": {
    +            "run": "docs"
    +          }
    +        },
    +        "template": {
    +          "metadata": {
    +            "creationTimestamp": null,
    +            "labels": {
    +              "auto-pushed-image-pwittrock/api-docs": "1477496453",
    +              "run": "docs"
    +            }
    +          },
    +          "spec": {
    +            "containers": [
    +              {
    +                "name": "docs",
    +                "image": "pwittrock/api-docs:v9",
    +                "resources": {},
    +                "terminationMessagePath": "/dev/termination-log",
    +                "imagePullPolicy": "Always"
    +              }
    +            ],
    +            "restartPolicy": "Always",
    +            "terminationGracePeriodSeconds": 30,
    +            "dnsPolicy": "ClusterFirst",
    +            "securityContext": {}
    +          }
    +        },
    +        "strategy": {
    +          "type": "RollingUpdate",
    +          "rollingUpdate": {
    +            "maxUnavailable": 1,
    +            "maxSurge": 1
    +          }
    +        }
    +      },
    +      "status": {
    +        "observedGeneration": 21,
    +        "replicas": 1,
    +        "updatedReplicas": 1,
    +        "availableReplicas": 1
    +      }
    +    },
    +    {
    +      "kind": "Deployment",
    +      "apiVersion": "app/v1beta1",
    +      "metadata": {
    +        "name": "deployment-example",
    +        "namespace": "default",
    +        "selfLink": "/apis/app/v1beta1/namespaces/default/deployments/deployment-example",
    +        "uid": "1b33145a-9c63-11e6-9c54-42010a800148",
    +        "resourceVersion": "2064726",
    +        "generation": 4,
    +        "creationTimestamp": "2016-10-27T16:33:35Z",
    +        "labels": {
    +          "app": "nginx"
    +        },
    +        "annotations": {
    +          "deployment.kubernetes.io/revision": "1"
    +        }
    +      },
    +      "spec": {
    +        "replicas": 3,
    +        "selector": {
    +          "matchLabels": {
    +            "app": "nginx"
    +          }
    +        },
    +        "template": {
    +          "metadata": {
    +            "creationTimestamp": null,
    +            "labels": {
    +              "app": "nginx"
    +            }
    +          },
    +          "spec": {
    +            "containers": [
    +              {
    +                "name": "nginx",
    +                "image": "nginx:1.14",
    +                "ports": [
    +                  {
    +                    "containerPort": 80,
    +                    "protocol": "TCP"
    +                  }
    +                ],
    +                "resources": {},
    +                "terminationMessagePath": "/dev/termination-log",
    +                "imagePullPolicy": "IfNotPresent"
    +              }
    +            ],
    +            "restartPolicy": "Always",
    +            "terminationGracePeriodSeconds": 30,
    +            "dnsPolicy": "ClusterFirst",
    +            "securityContext": {}
    +          }
    +        },
    +        "strategy": {
    +          "type": "RollingUpdate",
    +          "rollingUpdate": {
    +            "maxUnavailable": 1,
    +            "maxSurge": 1
    +          }
    +        }
    +      },
    +      "status": {
    +        "observedGeneration": 4,
    +        "replicas": 3,
    +        "updatedReplicas": 3,
    +        "availableReplicas": 3
    +      }
    +    }
    +  ]
    +}
    +
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "List",
    +  "apiVersion": "v1",
    +  "metadata": {},
    +  "items": [
    +    {
    +      "kind": "Deployment",
    +      "apiVersion": "app/v1beta1",
    +      "metadata": {
    +        "name": "docs",
    +        "namespace": "default",
    +        "selfLink": "/apis/app/v1beta1/namespaces/default/deployments/docs",
    +        "uid": "ef49e1d2-915e-11e6-be81-42010a80003f",
    +        "resourceVersion": "1924126",
    +        "generation": 21,
    +        "creationTimestamp": "2016-10-13T16:06:00Z",
    +        "labels": {
    +          "run": "docs"
    +        },
    +        "annotations": {
    +          "deployment.kubernetes.io/revision": "10",
    +          "replicatingperfection.net/push-image": "true"
    +        }
    +      },
    +      "spec": {
    +        "replicas": 1,
    +        "selector": {
    +          "matchLabels": {
    +            "run": "docs"
    +          }
    +        },
    +        "template": {
    +          "metadata": {
    +            "creationTimestamp": null,
    +            "labels": {
    +              "auto-pushed-image-pwittrock/api-docs": "1477496453",
    +              "run": "docs"
    +            }
    +          },
    +          "spec": {
    +            "containers": [
    +              {
    +                "name": "docs",
    +                "image": "pwittrock/api-docs:v9",
    +                "resources": {},
    +                "terminationMessagePath": "/dev/termination-log",
    +                "imagePullPolicy": "Always"
    +              }
    +            ],
    +            "restartPolicy": "Always",
    +            "terminationGracePeriodSeconds": 30,
    +            "dnsPolicy": "ClusterFirst",
    +            "securityContext": {}
    +          }
    +        },
    +        "strategy": {
    +          "type": "RollingUpdate",
    +          "rollingUpdate": {
    +            "maxUnavailable": 1,
    +            "maxSurge": 1
    +          }
    +        }
    +      },
    +      "status": {
    +        "observedGeneration": 21,
    +        "replicas": 1,
    +        "updatedReplicas": 1,
    +        "availableReplicas": 1
    +      }
    +    },
    +    {
    +      "kind": "Deployment",
    +      "apiVersion": "app/v1beta1",
    +      "metadata": {
    +        "name": "deployment-example",
    +        "namespace": "default",
    +        "selfLink": "/apis/app/v1beta1/namespaces/default/deployments/deployment-example",
    +        "uid": "1b33145a-9c63-11e6-9c54-42010a800148",
    +        "resourceVersion": "2064726",
    +        "generation": 4,
    +        "creationTimestamp": "2016-10-27T16:33:35Z",
    +        "labels": {
    +          "app": "nginx"
    +        },
    +        "annotations": {
    +          "deployment.kubernetes.io/revision": "1"
    +        }
    +      },
    +      "spec": {
    +        "replicas": 3,
    +        "selector": {
    +          "matchLabels": {
    +            "app": "nginx"
    +          }
    +        },
    +        "template": {
    +          "metadata": {
    +            "creationTimestamp": null,
    +            "labels": {
    +              "app": "nginx"
    +            }
    +          },
    +          "spec": {
    +            "containers": [
    +              {
    +                "name": "nginx",
    +                "image": "nginx:1.14",
    +                "ports": [
    +                  {
    +                    "containerPort": 80,
    +                    "protocol": "TCP"
    +                  }
    +                ],
    +                "resources": {},
    +                "terminationMessagePath": "/dev/termination-log",
    +                "imagePullPolicy": "IfNotPresent"
    +              }
    +            ],
    +            "restartPolicy": "Always",
    +            "terminationGracePeriodSeconds": 30,
    +            "dnsPolicy": "ClusterFirst",
    +            "securityContext": {}
    +          }
    +        },
    +        "strategy": {
    +          "type": "RollingUpdate",
    +          "rollingUpdate": {
    +            "maxUnavailable": 1,
    +            "maxSurge": 1
    +          }
    +        }
    +      },
    +      "status": {
    +        "observedGeneration": 4,
    +        "replicas": 3,
    +        "updatedReplicas": 3,
    +        "availableReplicas": 3
    +      }
    +    }
    +  ]
    +}
    +
    +
    +

    list or watch objects of kind Deployment

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/deployments +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    DeploymentList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Deployment

    +

    HTTP Request

    +GET /apis/apps/v1/deployments +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    DeploymentList
    OK
    +

    Watch

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl get deployment deployment-example --watch -o json
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X GET 'http://127.0.0.1:8001/apis/apps/v1/watch/namespaces/default/deployments/deployment-example'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +{
    +	"type": "ADDED",
    +	"object": {
    +		"kind": "Deployment",
    +		"apiVersion": "apps/v1",
    +		"metadata": {
    +			"name": "deployment-example",
    +			"namespace": "default",
    +			"selfLink": "/apis/apps/v1/namespaces/default/deployments/deployment-example",
    +			"uid": "64c12290-9cbf-11e6-9c54-42010a800148",
    +			"resourceVersion": "2128095",
    +			"generation": 2,
    +			"creationTimestamp": "2016-10-28T03:34:12Z",
    +			"labels": {
    +				"app": "nginx"
    +			},
    +			"annotations": {
    +				"deployment.kubernetes.io/revision": "3"
    +			}
    +		},
    +		"spec": {
    +			"replicas": 3,
    +			"selector": {
    +				"matchLabels": {
    +					"app": "nginx"
    +				}
    +			},
    +			"template": {
    +				"metadata": {
    +					"creationTimestamp": null,
    +					"labels": {
    +						"app": "nginx"
    +					}
    +				},
    +				"spec": {
    +					"containers": [
    +						{
    +							"name": "nginx",
    +							"image": "nginx:1.14",
    +							"ports": [
    +								{
    +									"containerPort": 80,
    +									"protocol": "TCP"
    +								}
    +							],
    +							"resources": {
    +							},
    +							"terminationMessagePath": "/dev/termination-log",
    +							"imagePullPolicy": "IfNotPresent"
    +						}
    +					],
    +					"restartPolicy": "Always",
    +					"terminationGracePeriodSeconds": 30,
    +					"dnsPolicy": "ClusterFirst",
    +					"securityContext": {
    +					}
    +				}
    +			},
    +			"strategy": {
    +				"type": "RollingUpdate",
    +				"rollingUpdate": {
    +					"maxUnavailable": 1,
    +					"maxSurge": 1
    +				}
    +			}
    +		},
    +		"status": {
    +			"observedGeneration": 2,
    +			"replicas": 3,
    +			"updatedReplicas": 3,
    +			"availableReplicas": 3
    +		}
    +	}
    +}
    +
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +	"type": "ADDED",
    +	"object": {
    +		"kind": "Deployment",
    +		"apiVersion": "apps/v1",
    +		"metadata": {
    +			"name": "deployment-example",
    +			"namespace": "default",
    +			"selfLink": "/apis/apps/v1/namespaces/default/deployments/deployment-example",
    +			"uid": "64c12290-9cbf-11e6-9c54-42010a800148",
    +			"resourceVersion": "2128095",
    +			"generation": 2,
    +			"creationTimestamp": "2016-10-28T03:34:12Z",
    +			"labels": {
    +				"app": "nginx"
    +			},
    +			"annotations": {
    +				"deployment.kubernetes.io/revision": "3"
    +			}
    +		},
    +		"spec": {
    +			"replicas": 3,
    +			"selector": {
    +				"matchLabels": {
    +					"app": "nginx"
    +				}
    +			},
    +			"template": {
    +				"metadata": {
    +					"creationTimestamp": null,
    +					"labels": {
    +						"app": "nginx"
    +					}
    +				},
    +				"spec": {
    +					"containers": [
    +						{
    +							"name": "nginx",
    +							"image": "nginx:1.14",
    +							"ports": [
    +								{
    +									"containerPort": 80,
    +									"protocol": "TCP"
    +								}
    +							],
    +							"resources": {
    +							},
    +							"terminationMessagePath": "/dev/termination-log",
    +							"imagePullPolicy": "IfNotPresent"
    +						}
    +					],
    +					"restartPolicy": "Always",
    +					"terminationGracePeriodSeconds": 30,
    +					"dnsPolicy": "ClusterFirst",
    +					"securityContext": {
    +					}
    +				}
    +			},
    +			"strategy": {
    +				"type": "RollingUpdate",
    +				"rollingUpdate": {
    +					"maxUnavailable": 1,
    +					"maxSurge": 1
    +				}
    +			}
    +		},
    +		"status": {
    +			"observedGeneration": 2,
    +			"replicas": 3,
    +			"updatedReplicas": 3,
    +			"availableReplicas": 3
    +		}
    +	}
    +}
    +
    +
    +

    watch changes to an object of kind Deployment. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/namespaces/{namespace}/deployments/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Deployment
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Deployment. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/namespaces/{namespace}/deployments +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Deployment. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/deployments +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified Deployment

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/deployments/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Deployment
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Deployment
    OK
    201
    Deployment
    Created
    +

    Read Status

    +

    read status of the specified Deployment

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/deployments/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Deployment
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Deployment
    OK
    +

    Replace Status

    +

    replace status of the specified Deployment

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/deployments/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Deployment
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Deployment
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Deployment
    OK
    201
    Deployment
    Created
    +

    Misc Operations

    +

    Read Scale

    +

    read scale of the specified Deployment

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/deployments/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Scale
    OK
    +

    Replace Scale

    +

    replace scale of the specified Deployment

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/deployments/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Scale
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Scale
    OK
    201
    Scale
    Created
    +

    Patch Scale

    +

    partially update scale of the specified Deployment

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/deployments/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Scale
    OK
    201
    Scale
    Created
    +

    Job v1 batch

    + +
    +
    +
    Job Config to print pi up to 2000 digits (then exit).
    +
    +
    
    +apiVersion: batch/v1
    +kind: Job
    +metadata:
    +  # Unique key of the Job instance
    +  name: example-job
    +spec:
    +  template:
    +    metadata:
    +      name: example-job
    +    spec:
    +      containers:
    +      - name: pi
    +        image: perl
    +        command: ["perl"]
    +        args: ["-Mbignum=bpi", "-wle", "print bpi(2000)"]
    +      # Do not restart containers after they exit
    +      restartPolicy: Never
    +
    +
    + + + + + +
    GroupVersionKind
    batchv1Job
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    JobSpec
    Specification of the desired behavior of a job. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    JobStatus
    Current status of a job. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    JobSpec v1 batch

    + + + + + + + + + + + + + + + +
    FieldDescription
    activeDeadlineSeconds
    integer
    Specifies the duration in seconds relative to the startTime that the job may be continuously active before the system tries to terminate it; value must be positive integer. If a Job is suspended (at creation or through an update), this timer will effectively be stopped and reset when the Job is resumed again.
    backoffLimit
    integer
    Specifies the number of retries before marking this job failed. Defaults to 6
    completionMode
    string
    CompletionMode specifies how Pod completions are tracked. It can be `NonIndexed` (default) or `Indexed`. `NonIndexed` means that the Job is considered complete when there have been .spec.completions successfully completed Pods. Each Pod completion is homologous to each other. `Indexed` means that the Pods of a Job get an associated completion index from 0 to (.spec.completions - 1), available in the annotation batch.kubernetes.io/job-completion-index. The Job is considered complete when there is one successfully completed Pod for each index. When value is `Indexed`, .spec.completions must be specified and `.spec.parallelism` must be less than or equal to 10^5. In addition, The Pod name takes the form `$(job-name)-$(index)-$(random-string)`, the Pod hostname takes the form `$(job-name)-$(index)`. This field is beta-level. More completion modes can be added in the future. If the Job controller observes a mode that it doesn't recognize, the controller skips updates for the Job.
    completions
    integer
    Specifies the desired number of successfully finished pods the job should be run with. Setting to nil means that the success of any pod signals the success of all pods, and allows parallelism to have any positive value. Setting to 1 means that parallelism is limited to 1 and the success of that pod signals the success of the job. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
    manualSelector
    boolean
    manualSelector controls generation of pod labels and pod selectors. Leave `manualSelector` unset unless you are certain what you are doing. When false or unset, the system pick labels unique to this job and appends those labels to the pod template. When true, the user is responsible for picking unique labels and specifying the selector. Failure to pick a unique label may cause this and other jobs to not function correctly. However, You may see `manualSelector=true` in jobs that were created with the old `extensions/v1beta1` API. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/#specifying-your-own-pod-selector
    parallelism
    integer
    Specifies the maximum desired number of pods the job should run at any given time. The actual number of pods running in steady state will be less than this number when ((.spec.completions - .status.successful) < .spec.parallelism), i.e. when the work left to do is less than max parallelism. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
    selector
    LabelSelector
    A label query over pods that should match the pod count. Normally, the system sets this field for you. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
    suspend
    boolean
    Suspend specifies whether the Job controller should create Pods or not. If a Job is created with suspend set to true, no Pods are created by the Job controller. If a Job is suspended after creation (i.e. the flag goes from false to true), the Job controller will delete all active Pods associated with this Job. Users must design their workload to gracefully handle this. Suspending a Job will reset the StartTime field of the Job, effectively resetting the ActiveDeadlineSeconds timer too. Defaults to false. This field is beta-level, gated by SuspendJob feature flag (enabled by default).
    template
    PodTemplateSpec
    Describes the pod that will be created when executing a job. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
    ttlSecondsAfterFinished
    integer
    ttlSecondsAfterFinished limits the lifetime of a Job that has finished execution (either Complete or Failed). If this field is set, ttlSecondsAfterFinished after the Job finishes, it is eligible to be automatically deleted. When the Job is being deleted, its lifecycle guarantees (e.g. finalizers) will be honored. If this field is unset, the Job won't be automatically deleted. If this field is set to zero, the Job becomes eligible to be deleted immediately after it finishes.
    +

    JobStatus v1 batch

    +
    Appears In: + +
    + + + + + + + + + + + + + +
    FieldDescription
    active
    integer
    The number of pending and running pods.
    completedIndexes
    string
    CompletedIndexes holds the completed indexes when .spec.completionMode = "Indexed" in a text format. The indexes are represented as decimal integers separated by commas. The numbers are listed in increasing order. Three or more consecutive numbers are compressed and represented by the first and last element of the series, separated by a hyphen. For example, if the completed indexes are 1, 3, 4, 5 and 7, they are represented as "1,3-5,7".
    completionTime
    Time
    Represents time when the job was completed. It is not guaranteed to be set in happens-before order across separate operations. It is represented in RFC3339 form and is in UTC. The completion time is only set when the job finishes successfully.
    conditions
    JobCondition array
    patch strategy: merge
    patch merge key: type
    The latest available observations of an object's current state. When a Job fails, one of the conditions will have type "Failed" and status true. When a Job is suspended, one of the conditions will have type "Suspended" and status true; when the Job is resumed, the status of this condition will become false. When a Job is completed, one of the conditions will have type "Complete" and status true. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
    failed
    integer
    The number of pods which reached phase Failed.
    ready
    integer
    The number of pods which have a Ready condition. This field is alpha-level. The job controller populates the field when the feature gate JobReadyPods is enabled (disabled by default).
    startTime
    Time
    Represents time when the job controller started processing a job. When a Job is created in the suspended state, this field is not set until the first time it is resumed. This field is reset every time a Job is resumed from suspension. It is represented in RFC3339 form and is in UTC.
    succeeded
    integer
    The number of pods which reached phase Succeeded.
    uncountedTerminatedPods
    UncountedTerminatedPods
    UncountedTerminatedPods holds the UIDs of Pods that have terminated but the job controller hasn't yet accounted for in the status counters. The job controller creates pods with a finalizer. When a pod terminates (succeeded or failed), the controller does three steps to account for it in the job status: (1) Add the pod UID to the arrays in this field. (2) Remove the pod finalizer. (3) Remove the pod UID from the arrays while increasing the corresponding counter. This field is beta-level. The job controller only makes use of this field when the feature gate JobTrackingWithFinalizers is enabled (enabled by default). Old jobs might not be tracked using this field, in which case the field remains null.
    +

    JobList v1 batch

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Job array
    items is the list of Jobs.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ echo 'apiVersion: batch/v1
    +kind: Job
    +metadata:
    +  name: example-job
    +spec:
    +  template:
    +    metadata:
    +      name: example-job
    +    spec:
    +      containers:
    +      - name: pi
    +        image: perl
    +        command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]
    +      restartPolicy: Never
    +' | kubectl create -f -
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X POST -H 'Content-Type: application/yaml' --data '
    +apiVersion: batch/v1
    +kind: Job
    +metadata:
    +  name: example-job
    +spec:
    +  template:
    +    metadata:
    +      name: example-job
    +    spec:
    +      containers:
    +      - name: pi
    +        image: perl
    +        command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]
    +      restartPolicy: Never
    +' http://127.0.0.1:8001/apis/batch/v1/namespaces/default/jobs
    +
    + + +
    +
    +
    Output
    +
    +
    
    +job "example-job" created
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Job",
    +  "apiVersion": "batch/v1",
    +  "metadata": {
    +    "name": "example-job",
    +    "namespace": "default",
    +    "selfLink": "/apis/batch/v1/namespaces/default/jobs/example-job",
    +    "uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +    "resourceVersion": "7479",
    +    "creationTimestamp": "2016-11-04T18:45:25Z"
    +  },
    +  "spec": {
    +    "parallelism": 1,
    +    "completions": 1,
    +    "selector": {
    +      "matchLabels": {
    +        "controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7"
    +      }
    +    },
    +    "template": {
    +      "metadata": {
    +        "name": "example-job",
    +        "creationTimestamp": null,
    +        "labels": {
    +          "controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +          "job-name": "example-job"
    +        }
    +      },
    +      "spec": {
    +        "containers": [
    +          {
    +            "name": "pi",
    +            "image": "perl",
    +            "command": [
    +              "perl",
    +              "-Mbignum=bpi",
    +              "-wle",
    +              "print bpi(2000)"
    +            ],
    +            "resources": {},
    +            "terminationMessagePath": "/dev/termination-log",
    +            "imagePullPolicy": "Always"
    +          }
    +        ],
    +        "restartPolicy": "Never",
    +        "terminationGracePeriodSeconds": 30,
    +        "dnsPolicy": "ClusterFirst",
    +        "securityContext": {}
    +      }
    +    }
    +  },
    +  "status": {}
    +}
    +
    +

    create a Job

    +

    HTTP Request

    +POST /apis/batch/v1/namespaces/{namespace}/jobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Job
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Job
    OK
    201
    Job
    Created
    202
    Job
    Accepted
    +

    Patch

    +

    partially update the specified Job

    +

    HTTP Request

    +PATCH /apis/batch/v1/namespaces/{namespace}/jobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Job
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Job
    OK
    201
    Job
    Created
    +

    Replace

    +

    replace the specified Job

    +

    HTTP Request

    +PUT /apis/batch/v1/namespaces/{namespace}/jobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Job
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Job
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Job
    OK
    201
    Job
    Created
    +

    Delete

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl delete job example-job
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X DELETE -H 'Content-Type: application/yaml' --data '
    +gracePeriodSeconds: 0
    +orphanDependents: false
    +' 'http://127.0.0.1:8001/apis/batch/v1/namespaces/default/jobs/example-job'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +job "example-job" deleted
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Status",
    +  "apiVersion": "v1",
    +  "metadata": {},
    +  "status": "Success",
    +  "code": 200
    +}
    +
    +
    +

    delete a Job

    +

    HTTP Request

    +DELETE /apis/batch/v1/namespaces/{namespace}/jobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Job
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Job

    +

    HTTP Request

    +DELETE /apis/batch/v1/namespaces/{namespace}/jobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl get job example-job -o json
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X GET http://127.0.0.1:8001/apis/batch/v1/namespaces/default/jobs/example-job
    +
    + + +
    +
    +
    Output
    +
    +
    
    +{
    +  "kind": "Job",
    +  "apiVersion": "batch/v1",
    +  "metadata": {
    +    "name": "example-job",
    +    "namespace": "default",
    +    "selfLink": "/apis/batch/v1/namespaces/default/jobs/example-job",
    +    "uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +    "resourceVersion": "7482",
    +    "creationTimestamp": "2016-11-04T18:45:25Z"
    +  },
    +  "spec": {
    +    "parallelism": 1,
    +    "completions": 1,
    +    "selector": {
    +      "matchLabels": {
    +        "controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7"
    +      }
    +    },
    +    "template": {
    +      "metadata": {
    +        "name": "example-job",
    +        "creationTimestamp": null,
    +        "labels": {
    +          "controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +          "job-name": "example-job"
    +        }
    +      },
    +      "spec": {
    +        "containers": [
    +          {
    +            "name": "pi",
    +            "image": "perl",
    +            "command": [
    +              "perl",
    +              "-Mbignum=bpi",
    +              "-wle",
    +              "print bpi(2000)"
    +            ],
    +            "resources": {},
    +            "terminationMessagePath": "/dev/termination-log",
    +            "imagePullPolicy": "Always"
    +          }
    +        ],
    +        "restartPolicy": "Never",
    +        "terminationGracePeriodSeconds": 30,
    +        "dnsPolicy": "ClusterFirst",
    +        "securityContext": {}
    +      }
    +    }
    +  },
    +  "status": {
    +    "startTime": "2016-11-04T18:45:25Z",
    +    "active": 1
    +  }
    +}
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Job",
    +  "apiVersion": "batch/v1",
    +  "metadata": {
    +    "name": "example-job",
    +    "namespace": "default",
    +    "selfLink": "/apis/batch/v1/namespaces/default/jobs/example-job",
    +    "uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +    "resourceVersion": "7482",
    +    "creationTimestamp": "2016-11-04T18:45:25Z"
    +  },
    +  "spec": {
    +    "parallelism": 1,
    +    "completions": 1,
    +    "selector": {
    +      "matchLabels": {
    +        "controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7"
    +      }
    +    },
    +    "template": {
    +      "metadata": {
    +        "name": "example-job",
    +        "creationTimestamp": null,
    +        "labels": {
    +          "controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +          "job-name": "example-job"
    +        }
    +      },
    +      "spec": {
    +        "containers": [
    +          {
    +            "name": "pi",
    +            "image": "perl",
    +            "command": [
    +              "perl",
    +              "-Mbignum=bpi",
    +              "-wle",
    +              "print bpi(2000)"
    +            ],
    +            "resources": {},
    +            "terminationMessagePath": "/dev/termination-log",
    +            "imagePullPolicy": "Always"
    +          }
    +        ],
    +        "restartPolicy": "Never",
    +        "terminationGracePeriodSeconds": 30,
    +        "dnsPolicy": "ClusterFirst",
    +        "securityContext": {}
    +      }
    +    }
    +  },
    +  "status": {
    +    "startTime": "2016-11-04T18:45:25Z",
    +    "active": 1
    +  }
    +}
    +
    +

    read the specified Job

    +

    HTTP Request

    +GET /apis/batch/v1/namespaces/{namespace}/jobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Job
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Job
    OK
    +

    List

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl get job -o json
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X GET 'http://127.0.0.1:8001/apis/batch/v1/namespaces/default/jobs'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +{
    +  "kind": "JobList",
    +  "apiVersion": "batch/v1",
    +  "metadata": {
    +    "selfLink": "/apis/batch/v1/namespaces/default/jobs",
    +    "resourceVersion": "7589"
    +  },
    +  "items": [
    +    {
    +      "metadata": {
    +        "name": "",
    +        "namespace": "default",
    +        "selfLink": "/apis/batch/v1/namespaces/default/jobs/",
    +        "uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +        "resourceVersion": "7482",
    +        "creationTimestamp": "2016-11-04T18:45:25Z"
    +      },
    +      "spec": {
    +        "parallelism": 1,
    +        "completions": 1,
    +        "selector": {
    +          "matchLabels": {
    +            "controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7"
    +          }
    +        },
    +        "template": {
    +          "metadata": {
    +            "name": "",
    +            "creationTimestamp": null,
    +            "labels": {
    +              "controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +              "job-name": ""
    +            }
    +          },
    +          "spec": {
    +            "containers": [
    +              {
    +                "name": "pi",
    +                "image": "perl",
    +                "command": [
    +                  "perl",
    +                  "-Mbignum=bpi",
    +                  "-wle",
    +                  "print bpi(2000)"
    +                ],
    +                "resources": {},
    +                "terminationMessagePath": "/dev/termination-log",
    +                "imagePullPolicy": "Always"
    +              }
    +            ],
    +            "restartPolicy": "Never",
    +            "terminationGracePeriodSeconds": 30,
    +            "dnsPolicy": "ClusterFirst",
    +            "securityContext": {}
    +          }
    +        }
    +      },
    +      "status": {
    +        "startTime": "2016-11-04T18:45:25Z",
    +        "active": 1
    +      }
    +    }
    +  ]
    +}
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "JobList",
    +  "apiVersion": "batch/v1",
    +  "metadata": {
    +    "selfLink": "/apis/batch/v1/namespaces/default/jobs",
    +    "resourceVersion": "7589"
    +  },
    +  "items": [
    +    {
    +      "metadata": {
    +        "name": "",
    +        "namespace": "default",
    +        "selfLink": "/apis/batch/v1/namespaces/default/jobs/",
    +        "uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +        "resourceVersion": "7482",
    +        "creationTimestamp": "2016-11-04T18:45:25Z"
    +      },
    +      "spec": {
    +        "parallelism": 1,
    +        "completions": 1,
    +        "selector": {
    +          "matchLabels": {
    +            "controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7"
    +          }
    +        },
    +        "template": {
    +          "metadata": {
    +            "name": "",
    +            "creationTimestamp": null,
    +            "labels": {
    +              "controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +              "job-name": ""
    +            }
    +          },
    +          "spec": {
    +            "containers": [
    +              {
    +                "name": "pi",
    +                "image": "perl",
    +                "command": [
    +                  "perl",
    +                  "-Mbignum=bpi",
    +                  "-wle",
    +                  "print bpi(2000)"
    +                ],
    +                "resources": {},
    +                "terminationMessagePath": "/dev/termination-log",
    +                "imagePullPolicy": "Always"
    +              }
    +            ],
    +            "restartPolicy": "Never",
    +            "terminationGracePeriodSeconds": 30,
    +            "dnsPolicy": "ClusterFirst",
    +            "securityContext": {}
    +          }
    +        }
    +      },
    +      "status": {
    +        "startTime": "2016-11-04T18:45:25Z",
    +        "active": 1
    +      }
    +    }
    +  ]
    +}
    +
    +

    list or watch objects of kind Job

    +

    HTTP Request

    +GET /apis/batch/v1/namespaces/{namespace}/jobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    JobList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Job

    +

    HTTP Request

    +GET /apis/batch/v1/jobs +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    JobList
    OK
    +

    Watch

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl get job example-job --watch -o json
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X GET 'http://127.0.0.1:8001/apis/batch/v1/watch/namespaces/default/jobs/example-job'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +{
    +	"type": "ADDED",
    +	"object": {
    +		"kind": "Job",
    +		"apiVersion": "batch/v1",
    +		"metadata": {
    +			"name": "example-job",
    +			"namespace": "default",
    +			"selfLink": "/apis/batch/v1/namespaces/default/jobs/example-job",
    +			"uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +			"resourceVersion": "7482",
    +			"creationTimestamp": "2016-11-04T18:45:25Z"
    +		},
    +		"spec": {
    +			"parallelism": 1,
    +			"completions": 1,
    +			"selector": {
    +				"matchLabels": {
    +					"controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7"
    +				}
    +			},
    +			"template": {
    +				"metadata": {
    +					"name": "example-job",
    +					"creationTimestamp": null,
    +					"labels": {
    +						"controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +						"job-name": "example-job"
    +					}
    +				},
    +				"spec": {
    +					"containers": [
    +						{
    +							"name": "pi",
    +							"image": "perl",
    +							"command": [
    +								"perl",
    +								"-Mbignum=bpi",
    +								"-wle",
    +								"print bpi(2000)"
    +							],
    +							"resources": {
    +							},
    +							"terminationMessagePath": "/dev/termination-log",
    +							"imagePullPolicy": "Always"
    +						}
    +					],
    +					"restartPolicy": "Never",
    +					"terminationGracePeriodSeconds": 30,
    +					"dnsPolicy": "ClusterFirst",
    +					"securityContext": {
    +					}
    +				}
    +			}
    +		},
    +		"status": {
    +			"startTime": "2016-11-04T18:45:25Z",
    +			"active": 1
    +		}
    +	}
    +}
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +	"type": "ADDED",
    +	"object": {
    +		"kind": "Job",
    +		"apiVersion": "batch/v1",
    +		"metadata": {
    +			"name": "example-job",
    +			"namespace": "default",
    +			"selfLink": "/apis/batch/v1/namespaces/default/jobs/example-job",
    +			"uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +			"resourceVersion": "7482",
    +			"creationTimestamp": "2016-11-04T18:45:25Z"
    +		},
    +		"spec": {
    +			"parallelism": 1,
    +			"completions": 1,
    +			"selector": {
    +				"matchLabels": {
    +					"controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7"
    +				}
    +			},
    +			"template": {
    +				"metadata": {
    +					"name": "example-job",
    +					"creationTimestamp": null,
    +					"labels": {
    +						"controller-uid": "d93a3569-a2be-11e6-a008-fa043d458cc7",
    +						"job-name": "example-job"
    +					}
    +				},
    +				"spec": {
    +					"containers": [
    +						{
    +							"name": "pi",
    +							"image": "perl",
    +							"command": [
    +								"perl",
    +								"-Mbignum=bpi",
    +								"-wle",
    +								"print bpi(2000)"
    +							],
    +							"resources": {
    +							},
    +							"terminationMessagePath": "/dev/termination-log",
    +							"imagePullPolicy": "Always"
    +						}
    +					],
    +					"restartPolicy": "Never",
    +					"terminationGracePeriodSeconds": 30,
    +					"dnsPolicy": "ClusterFirst",
    +					"securityContext": {
    +					}
    +				}
    +			}
    +		},
    +		"status": {
    +			"startTime": "2016-11-04T18:45:25Z",
    +			"active": 1
    +		}
    +	}
    +}
    +
    +

    watch changes to an object of kind Job. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/batch/v1/watch/namespaces/{namespace}/jobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Job
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Job. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/batch/v1/watch/namespaces/{namespace}/jobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Job. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/batch/v1/watch/jobs +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified Job

    +

    HTTP Request

    +PATCH /apis/batch/v1/namespaces/{namespace}/jobs/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Job
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Job
    OK
    201
    Job
    Created
    +

    Read Status

    +

    read status of the specified Job

    +

    HTTP Request

    +GET /apis/batch/v1/namespaces/{namespace}/jobs/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Job
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Job
    OK
    +

    Replace Status

    +

    replace status of the specified Job

    +

    HTTP Request

    +PUT /apis/batch/v1/namespaces/{namespace}/jobs/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Job
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Job
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Job
    OK
    201
    Job
    Created
    +

    Pod v1 core

    + +
    +
    +
    Pod Config to print "Hello World".
    +
    +
    
    +apiVersion: v1
    +kind: Pod
    +metadata:
    +  name: pod-example
    +spec:
    +  containers:
    +  - name: ubuntu
    +    image: ubuntu:trusty
    +    command: ["echo"]
    +    args: ["Hello World"]
    +
    +
    + + + + + +
    GroupVersionKind
    corev1Pod
    +

    Warning:

    It is recommended that users create Pods only through a Controller, and not directly. See Controllers: Deployment, Job, or StatefulSet.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    PodSpec
    Specification of the desired behavior of the pod. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    PodStatus
    Most recently observed status of the pod. This data may not be up to date. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    PodSpec v1 core

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    activeDeadlineSeconds
    integer
    Optional duration in seconds the pod may be active on the node relative to StartTime before the system will actively try to mark it failed and kill associated containers. Value must be a positive integer.
    affinity
    Affinity
    If specified, the pod's scheduling constraints
    automountServiceAccountToken
    boolean
    AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
    containers
    Container array
    patch strategy: merge
    patch merge key: name
    List of containers belonging to the pod. Containers cannot currently be added or removed. There must be at least one container in a Pod. Cannot be updated.
    dnsConfig
    PodDNSConfig
    Specifies the DNS parameters of a pod. Parameters specified here will be merged to the generated DNS configuration based on DNSPolicy.
    dnsPolicy
    string
    Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. To have DNS options set along with hostNetwork, you have to specify DNS policy explicitly to 'ClusterFirstWithHostNet'. Possible enum values: - `"ClusterFirst"` indicates that the pod should use cluster DNS first unless hostNetwork is true, if it is available, then fall back on the default (as determined by kubelet) DNS settings. - `"ClusterFirstWithHostNet"` indicates that the pod should use cluster DNS first, if it is available, then fall back on the default (as determined by kubelet) DNS settings. - `"Default"` indicates that the pod should use the default (as determined by kubelet) DNS settings. - `"None"` indicates that the pod should use empty DNS settings. DNS parameters such as nameservers and search paths should be defined via DNSConfig.
    enableServiceLinks
    boolean
    EnableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Defaults to true.
    ephemeralContainers
    EphemeralContainer array
    patch strategy: merge
    patch merge key: name
    List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing pod to perform user-initiated actions such as debugging. This list cannot be specified when creating a pod, and it cannot be modified by updating the pod spec. In order to add an ephemeral container to an existing pod, use the pod's ephemeralcontainers subresource. This field is beta-level and available on clusters that haven't disabled the EphemeralContainers feature gate.
    hostAliases
    HostAlias array
    patch strategy: merge
    patch merge key: ip
    HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts file if specified. This is only valid for non-hostNetwork pods.
    hostIPC
    boolean
    Use the host's ipc namespace. Optional: Default to false.
    hostNetwork
    boolean
    Host networking requested for this pod. Use the host's network namespace. If this option is set, the ports that will be used must be specified. Default to false.
    hostPID
    boolean
    Use the host's pid namespace. Optional: Default to false.
    hostname
    string
    Specifies the hostname of the Pod If not specified, the pod's hostname will be set to a system-defined value.
    imagePullSecrets
    LocalObjectReference array
    patch strategy: merge
    patch merge key: name
    ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. If specified, these secrets will be passed to individual puller implementations for them to use. For example, in the case of docker, only DockerConfig type secrets are honored. More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
    initContainers
    Container array
    patch strategy: merge
    patch merge key: name
    List of initialization containers belonging to the pod. Init containers are executed in order prior to containers being started. If any init container fails, the pod is considered to have failed and is handled according to its restartPolicy. The name for an init container or normal container must be unique among all containers. Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. The resourceRequirements of an init container are taken into account during scheduling by finding the highest request/limit for each resource type, and then using the max of of that value or the sum of the normal containers. Limits are applied to init containers in a similar fashion. Init containers cannot currently be added or removed. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
    nodeName
    string
    NodeName is a request to schedule this pod onto a specific node. If it is non-empty, the scheduler simply schedules this pod onto that node, assuming that it fits resource requirements.
    nodeSelector
    object
    NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
    os
    PodOS
    Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set. If the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions If the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup This is an alpha field and requires the IdentifyPodOS feature
    overhead
    object
    Overhead represents the resource overhead associated with running a pod for a given RuntimeClass. This field will be autopopulated at admission time by the RuntimeClass admission controller. If the RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests. The RuntimeClass admission controller will reject Pod create requests which have the overhead already set. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value defined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md This field is beta-level as of Kubernetes v1.18, and is only honored by servers that enable the PodOverhead feature.
    preemptionPolicy
    string
    PreemptionPolicy is the Policy for preempting pods with lower priority. One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset. This field is beta-level, gated by the NonPreemptingPriority feature-gate.
    priority
    integer
    The priority value. Various system components use this field to find the priority of the pod. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority.
    priorityClassName
    string
    If specified, indicates the pod's priority. "system-node-critical" and "system-cluster-critical" are two special keywords which indicate the highest priorities with the former being the highest priority. Any other name must be defined by creating a PriorityClass object with that name. If not specified, the pod priority will be default or zero if there is no default.
    readinessGates
    PodReadinessGate array
    If specified, all readiness gates will be evaluated for pod readiness. A pod is ready when all its containers are ready AND all conditions specified in the readiness gates have status equal to "True" More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates
    restartPolicy
    string
    Restart policy for all containers within the pod. One of Always, OnFailure, Never. Default to Always. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy Possible enum values: - `"Always"` - `"Never"` - `"OnFailure"`
    runtimeClassName
    string
    RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used to run this pod. If no RuntimeClass resource matches the named class, the pod will not be run. If unset or empty, the "legacy" RuntimeClass will be used, which is an implicit class with an empty definition that uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class This is a beta feature as of Kubernetes v1.14.
    schedulerName
    string
    If specified, the pod will be dispatched by specified scheduler. If not specified, the pod will be dispatched by default scheduler.
    securityContext
    PodSecurityContext
    SecurityContext holds pod-level security attributes and common container settings. Optional: Defaults to empty. See type description for default values of each field.
    serviceAccount
    string
    DeprecatedServiceAccount is a depreciated alias for ServiceAccountName. Deprecated: Use serviceAccountName instead.
    serviceAccountName
    string
    ServiceAccountName is the name of the ServiceAccount to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
    setHostnameAsFQDN
    boolean
    If true the pod's hostname will be configured as the pod's FQDN, rather than the leaf name (the default). In Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname). In Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters to FQDN. If a pod does not have FQDN, this has no effect. Default to false.
    shareProcessNamespace
    boolean
    Share a single process namespace between all of the containers in a pod. When this is set containers will be able to view and signal processes from other containers in the same pod, and the first process in each container will not be assigned PID 1. HostPID and ShareProcessNamespace cannot both be set. Optional: Default to false.
    subdomain
    string
    If specified, the fully qualified Pod hostname will be "<hostname>.<subdomain>.<pod namespace>.svc.<cluster domain>". If not specified, the pod will not have a domainname at all.
    terminationGracePeriodSeconds
    integer
    Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. Defaults to 30 seconds.
    tolerations
    Toleration array
    If specified, the pod's tolerations.
    topologySpreadConstraints
    TopologySpreadConstraint array
    patch strategy: merge
    patch merge key: topologyKey
    TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.
    volumes
    Volume array
    patch strategy: merge,retainKeys
    patch merge key: name
    List of volumes that can be mounted by containers belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes
    +

    PodStatus v1 core

    +
    Appears In: + +
    + + + + + + + + + + + + + + + + + +
    FieldDescription
    conditions
    PodCondition array
    patch strategy: merge
    patch merge key: type
    Current service state of pod. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions
    containerStatuses
    ContainerStatus array
    The list has one entry per container in the manifest. Each entry is currently the output of `docker inspect`. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status
    ephemeralContainerStatuses
    ContainerStatus array
    Status for any ephemeral containers that have run in this pod. This field is beta-level and available on clusters that haven't disabled the EphemeralContainers feature gate.
    hostIP
    string
    IP address of the host to which the pod is assigned. Empty if not yet scheduled.
    initContainerStatuses
    ContainerStatus array
    The list has one entry per init container in the manifest. The most recent successful init container will have ready = true, the most recently started container will have startTime set. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-and-container-status
    message
    string
    A human readable message indicating details about why the pod is in this condition.
    nominatedNodeName
    string
    nominatedNodeName is set only when this pod preempts other pods on the node, but it cannot be scheduled right away as preemption victims receive their graceful termination periods. This field does not guarantee that the pod will be scheduled on this node. Scheduler may decide to place the pod elsewhere if other nodes become available sooner. Scheduler may also decide to give the resources on this node to a higher priority pod that is created after preemption. As a result, this field may be different than PodSpec.nodeName when the pod is scheduled.
    phase
    string
    The phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle. The conditions array, the reason and message fields, and the individual container status arrays contain more detail about the pod's status. There are five possible phase values: Pending: The pod has been accepted by the Kubernetes system, but one or more of the container images has not been created. This includes time before being scheduled as well as time spent downloading images over the network, which could take a while. Running: The pod has been bound to a node, and all of the containers have been created. At least one container is still running, or is in the process of starting or restarting. Succeeded: All containers in the pod have terminated in success, and will not be restarted. Failed: All containers in the pod have terminated, and at least one container has terminated in failure. The container either exited with non-zero status or was terminated by the system. Unknown: For some reason the state of the pod could not be obtained, typically due to an error in communicating with the host of the pod. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-phase Possible enum values: - `"Failed"` means that all containers in the pod have terminated, and at least one container has terminated in a failure (exited with a non-zero exit code or was stopped by the system). - `"Pending"` means the pod has been accepted by the system, but one or more of the containers has not been started. This includes time before being bound to a node, as well as time spent pulling images onto the host. - `"Running"` means the pod has been bound to a node and all of the containers have been started. At least one container is still running or is in the process of being restarted. - `"Succeeded"` means that all containers in the pod have voluntarily terminated with a container exit code of 0, and the system is not going to restart any of these containers. - `"Unknown"` means that for some reason the state of the pod could not be obtained, typically due to an error in communicating with the host of the pod. Deprecated: It isn't being set since 2015 (74da3b14b0c0f658b3bb8d2def5094686d0e9095)
    podIP
    string
    IP address allocated to the pod. Routable at least within the cluster. Empty if not yet allocated.
    podIPs
    PodIP array
    patch strategy: merge
    patch merge key: ip
    podIPs holds the IP addresses allocated to the pod. If this field is specified, the 0th entry must match the podIP field. Pods may be allocated at most 1 value for each of IPv4 and IPv6. This list is empty if no IPs have been allocated yet.
    qosClass
    string
    The Quality of Service (QOS) classification assigned to the pod based on resource requirements See PodQOSClass type for available QOS classes More info: https://git.k8s.io/community/contributors/design-proposals/node/resource-qos.md Possible enum values: - `"BestEffort"` is the BestEffort qos class. - `"Burstable"` is the Burstable qos class. - `"Guaranteed"` is the Guaranteed qos class.
    reason
    string
    A brief CamelCase message indicating details about why the pod is in this state. e.g. 'Evicted'
    startTime
    Time
    RFC 3339 date and time at which the object was acknowledged by the Kubelet. This is before the Kubelet pulled the container image(s) for the pod.
    +

    PodList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Pod array
    List of pods. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a Pod

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/pods +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Pod
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Pod
    OK
    201
    Pod
    Created
    202
    Pod
    Accepted
    +

    Create Eviction

    +

    create eviction of a Pod

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/pods/{name}/eviction +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Eviction
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    prettyIf 'true', then the output is pretty printed.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Eviction
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Eviction
    OK
    201
    Eviction
    Created
    202
    Eviction
    Accepted
    +

    Patch

    +

    partially update the specified Pod

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/pods/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Pod
    OK
    201
    Pod
    Created
    +

    Replace

    +

    replace the specified Pod

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/pods/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Pod
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Pod
    OK
    201
    Pod
    Created
    +

    Delete

    +

    delete a Pod

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/pods/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Pod
    OK
    202
    Pod
    Accepted
    +

    Delete Collection

    +

    delete collection of Pod

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/pods +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified Pod

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/pods/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Pod
    OK
    +

    List

    +

    list or watch objects of kind Pod

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/pods +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Pod

    +

    HTTP Request

    +GET /api/v1/pods +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodList
    OK
    +

    Watch

    +

    watch changes to an object of kind Pod. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/pods/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Pod. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/pods +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Pod. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/pods +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified Pod

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/pods/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Pod
    OK
    201
    Pod
    Created
    +

    Read Status

    +

    read status of the specified Pod

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/pods/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Pod
    OK
    +

    Replace Status

    +

    replace status of the specified Pod

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/pods/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Pod
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Pod
    OK
    201
    Pod
    Created
    +

    EphemeralContainers Operations

    +

    Patch EphemeralContainers

    +

    partially update ephemeralcontainers of the specified Pod

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/pods/{name}/ephemeralcontainers +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Pod
    OK
    201
    Pod
    Created
    +

    Read EphemeralContainers

    +

    read ephemeralcontainers of the specified Pod

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/pods/{name}/ephemeralcontainers +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Pod
    OK
    +

    Replace EphemeralContainers

    +

    replace ephemeralcontainers of the specified Pod

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/pods/{name}/ephemeralcontainers +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Pod
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Pod
    OK
    201
    Pod
    Created
    +

    Proxy Operations

    +

    Create Connect Portforward

    +

    connect POST requests to portforward of Pod

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/pods/{name}/portforward +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodPortForwardOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    portsList of ports to forward Required when using WebSockets
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Create Connect Proxy

    +

    connect POST requests to proxy of Pod

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/pods/{name}/proxy +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to pod.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Create Connect Proxy Path

    +

    connect POST requests to proxy of Pod

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/pods/{name}/proxy/{path} +

    Path Parameters

    + + + + + + + +
    ParameterDescription
    namename of the PodProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to pod.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Delete Connect Proxy

    +

    connect DELETE requests to proxy of Pod

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/pods/{name}/proxy +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to pod.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Delete Connect Proxy Path

    +

    connect DELETE requests to proxy of Pod

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/pods/{name}/proxy/{path} +

    Path Parameters

    + + + + + + + +
    ParameterDescription
    namename of the PodProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to pod.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Get Connect Portforward

    +

    connect GET requests to portforward of Pod

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/pods/{name}/portforward +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodPortForwardOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    portsList of ports to forward Required when using WebSockets
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Get Connect Proxy

    +

    connect GET requests to proxy of Pod

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/pods/{name}/proxy +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to pod.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Get Connect Proxy Path

    +

    connect GET requests to proxy of Pod

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/pods/{name}/proxy/{path} +

    Path Parameters

    + + + + + + + +
    ParameterDescription
    namename of the PodProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to pod.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Head Connect Proxy

    +

    connect HEAD requests to proxy of Pod

    +

    HTTP Request

    +HEAD /api/v1/namespaces/{namespace}/pods/{name}/proxy +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to pod.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Head Connect Proxy Path

    +

    connect HEAD requests to proxy of Pod

    +

    HTTP Request

    +HEAD /api/v1/namespaces/{namespace}/pods/{name}/proxy/{path} +

    Path Parameters

    + + + + + + + +
    ParameterDescription
    namename of the PodProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to pod.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Replace Connect Proxy

    +

    connect PUT requests to proxy of Pod

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/pods/{name}/proxy +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to pod.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Replace Connect Proxy Path

    +

    connect PUT requests to proxy of Pod

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/pods/{name}/proxy/{path} +

    Path Parameters

    + + + + + + + +
    ParameterDescription
    namename of the PodProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to pod.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Misc Operations

    +

    Read Log

    +

    read log of the specified Pod

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/pods/{name}/log +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Pod
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + +
    ParameterDescription
    containerThe container for which to stream logs. Defaults to only container if there is one container in the pod.
    followFollow the log stream of the pod. Defaults to false.
    insecureSkipTLSVerifyBackendinsecureSkipTLSVerifyBackend indicates that the apiserver should not confirm the validity of the serving certificate of the backend it is connecting to. This will make the HTTPS connection between the apiserver and the backend insecure. This means the apiserver cannot verify the log data it is receiving came from the real kubelet. If the kubelet is configured to verify the apiserver's TLS credentials, it does not mean the connection to the real kubelet is vulnerable to a man in the middle attack (e.g. an attacker could not intercept the actual log data coming from the real kubelet).
    limitBytesIf set, the number of bytes to read from the server before terminating the log output. This may not display a complete final line of logging, and may return slightly more or slightly less than the specified limit.
    prettyIf 'true', then the output is pretty printed.
    previousReturn previous terminated container logs. Defaults to false.
    sinceSecondsA relative time in seconds before the current time from which to show logs. If this value precedes the time a pod was started, only logs since the pod start will be returned. If this value is in the future, no logs will be returned. Only one of sinceSeconds or sinceTime may be specified.
    tailLinesIf set, the number of lines from the end of the logs to show. If not specified, logs are shown from the creation of the container or sinceSeconds or sinceTime
    timestampsIf true, add an RFC3339 or RFC3339Nano timestamp at the beginning of every line of log output. Defaults to false.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    ReplicaSet v1 apps

    + +
    +
    +
    ReplicaSet Config to run 3 nginx instances.
    +
    +
    
    +apiVersion: apps/v1
    +kind: ReplicaSet
    +metadata:
    +  # Unique key of the ReplicaSet instance
    +  name: replicaset-example
    +spec:
    +  # 3 Pods should exist at all times.
    +  replicas: 3
    +  selector:
    +    matchLabels:
    +      app: nginx
    +  template:
    +    metadata:
    +      labels:
    +        app: nginx
    +    spec:
    +      containers:
    +      # Run the nginx image
    +      - name: nginx
    +        image: nginx:1.14
    +
    +
    + + + + + +
    GroupVersionKind
    appsv1ReplicaSet
    +

    Warning:

    In many cases it is recommended to create a Deployment instead of ReplicaSet.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    If the Labels of a ReplicaSet are empty, they are defaulted to be the same as the Pod(s) that the ReplicaSet manages. Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    ReplicaSetSpec
    Spec defines the specification of the desired behavior of the ReplicaSet. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    ReplicaSetStatus
    Status is the most recently observed status of the ReplicaSet. This data may be out of date by some window of time. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    ReplicaSetSpec v1 apps

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    minReadySeconds
    integer
    Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)
    replicas
    integer
    Replicas is the number of desired replicas. This is a pointer to distinguish between explicit zero and unspecified. Defaults to 1. More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller/#what-is-a-replicationcontroller
    selector
    LabelSelector
    Selector is a label query over pods that should match the replica count. Label keys and values that must match in order to be controlled by this replica set. It must match the pod template's labels. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
    template
    PodTemplateSpec
    Template is the object that describes the pod that will be created if insufficient replicas are detected. More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
    +

    ReplicaSetStatus v1 apps

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    availableReplicas
    integer
    The number of available replicas (ready for at least minReadySeconds) for this replica set.
    conditions
    ReplicaSetCondition array
    patch strategy: merge
    patch merge key: type
    Represents the latest available observations of a replica set's current state.
    fullyLabeledReplicas
    integer
    The number of pods that have labels matching the labels of the pod template of the replicaset.
    observedGeneration
    integer
    ObservedGeneration reflects the generation of the most recently observed ReplicaSet.
    readyReplicas
    integer
    readyReplicas is the number of pods targeted by this ReplicaSet with a Ready Condition.
    replicas
    integer
    Replicas is the most recently oberved number of replicas. More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller/#what-is-a-replicationcontroller
    +

    ReplicaSetList v1 apps

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    ReplicaSet array
    List of ReplicaSets. More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a ReplicaSet

    +

    HTTP Request

    +POST /apis/apps/v1/namespaces/{namespace}/replicasets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ReplicaSet
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    ReplicaSet
    OK
    201
    ReplicaSet
    Created
    202
    ReplicaSet
    Accepted
    +

    Patch

    +

    partially update the specified ReplicaSet

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/replicasets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicaSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ReplicaSet
    OK
    201
    ReplicaSet
    Created
    +

    Replace

    +

    replace the specified ReplicaSet

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/replicasets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicaSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ReplicaSet
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ReplicaSet
    OK
    201
    ReplicaSet
    Created
    +

    Delete

    +

    delete a ReplicaSet

    +

    HTTP Request

    +DELETE /apis/apps/v1/namespaces/{namespace}/replicasets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicaSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of ReplicaSet

    +

    HTTP Request

    +DELETE /apis/apps/v1/namespaces/{namespace}/replicasets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified ReplicaSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/replicasets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicaSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ReplicaSet
    OK
    +

    List

    +

    list or watch objects of kind ReplicaSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/replicasets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ReplicaSetList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind ReplicaSet

    +

    HTTP Request

    +GET /apis/apps/v1/replicasets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ReplicaSetList
    OK
    +

    Watch

    +

    watch changes to an object of kind ReplicaSet. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/namespaces/{namespace}/replicasets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicaSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of ReplicaSet. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/namespaces/{namespace}/replicasets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of ReplicaSet. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/replicasets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified ReplicaSet

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/replicasets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicaSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ReplicaSet
    OK
    201
    ReplicaSet
    Created
    +

    Read Status

    +

    read status of the specified ReplicaSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/replicasets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicaSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ReplicaSet
    OK
    +

    Replace Status

    +

    replace status of the specified ReplicaSet

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/replicasets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicaSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ReplicaSet
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ReplicaSet
    OK
    201
    ReplicaSet
    Created
    +

    Misc Operations

    +

    Read Scale

    +

    read scale of the specified ReplicaSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/replicasets/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Scale
    OK
    +

    Replace Scale

    +

    replace scale of the specified ReplicaSet

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/replicasets/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Scale
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Scale
    OK
    201
    Scale
    Created
    +

    Patch Scale

    +

    partially update scale of the specified ReplicaSet

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/replicasets/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Scale
    OK
    201
    Scale
    Created
    +

    ReplicationController v1 core

    + +
    +
    +
    ReplicationController Config to run 3 nginx instances.
    +
    +
    
    +apiVersion: v1
    +kind: ReplicationController
    +metadata:
    +  # Unique key of the ReplicationController instance
    +  name: replicationcontroller-example
    +spec:
    +  # 3 Pods should exist at all times.
    +  replicas: 3
    +  template:
    +    metadata:
    +      labels:
    +        app: nginx
    +    spec:
    +      containers:
    +      # Run the nginx image
    +      - name: nginx
    +        image: nginx:1.14
    +
    +
    + + + + + +
    GroupVersionKind
    corev1ReplicationController
    +

    Warning:

    In many cases it is recommended to create a Deployment instead of a ReplicationController.

    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    If the Labels of a ReplicationController are empty, they are defaulted to be the same as the Pod(s) that the replication controller manages. Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    ReplicationControllerSpec
    Spec defines the specification of the desired behavior of the replication controller. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    ReplicationControllerStatus
    Status is the most recently observed status of the replication controller. This data may be out of date by some window of time. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    ReplicationControllerSpec v1 core

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    minReadySeconds
    integer
    Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)
    replicas
    integer
    Replicas is the number of desired replicas. This is a pointer to distinguish between explicit zero and unspecified. Defaults to 1. More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#what-is-a-replicationcontroller
    selector
    object
    Selector is a label query over pods that should match the Replicas count. If Selector is empty, it is defaulted to the labels present on the Pod template. Label keys and values that must match in order to be controlled by this replication controller, if empty defaulted to labels on Pod template. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
    template
    PodTemplateSpec
    Template is the object that describes the pod that will be created if insufficient replicas are detected. This takes precedence over a TemplateRef. More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#pod-template
    +

    ReplicationControllerStatus v1 core

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    availableReplicas
    integer
    The number of available replicas (ready for at least minReadySeconds) for this replication controller.
    conditions
    ReplicationControllerCondition array
    patch strategy: merge
    patch merge key: type
    Represents the latest available observations of a replication controller's current state.
    fullyLabeledReplicas
    integer
    The number of pods that have labels matching the labels of the pod template of the replication controller.
    observedGeneration
    integer
    ObservedGeneration reflects the generation of the most recently observed replication controller.
    readyReplicas
    integer
    The number of ready replicas for this replication controller.
    replicas
    integer
    Replicas is the most recently oberved number of replicas. More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller#what-is-a-replicationcontroller
    +

    ReplicationControllerList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    ReplicationController array
    List of replication controllers. More info: https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a ReplicationController

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/replicationcontrollers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ReplicationController
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    ReplicationController
    OK
    201
    ReplicationController
    Created
    202
    ReplicationController
    Accepted
    +

    Patch

    +

    partially update the specified ReplicationController

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/replicationcontrollers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicationController
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ReplicationController
    OK
    201
    ReplicationController
    Created
    +

    Replace

    +

    replace the specified ReplicationController

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/replicationcontrollers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicationController
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ReplicationController
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ReplicationController
    OK
    201
    ReplicationController
    Created
    +

    Delete

    +

    delete a ReplicationController

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/replicationcontrollers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicationController
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of ReplicationController

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/replicationcontrollers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified ReplicationController

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/replicationcontrollers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicationController
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ReplicationController
    OK
    +

    List

    +

    list or watch objects of kind ReplicationController

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/replicationcontrollers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ReplicationControllerList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind ReplicationController

    +

    HTTP Request

    +GET /api/v1/replicationcontrollers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ReplicationControllerList
    OK
    +

    Watch

    +

    watch changes to an object of kind ReplicationController. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/replicationcontrollers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicationController
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of ReplicationController. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/replicationcontrollers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of ReplicationController. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/replicationcontrollers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified ReplicationController

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/replicationcontrollers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicationController
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ReplicationController
    OK
    201
    ReplicationController
    Created
    +

    Read Status

    +

    read status of the specified ReplicationController

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/replicationcontrollers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicationController
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ReplicationController
    OK
    +

    Replace Status

    +

    replace status of the specified ReplicationController

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/replicationcontrollers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ReplicationController
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ReplicationController
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ReplicationController
    OK
    201
    ReplicationController
    Created
    +

    Misc Operations

    +

    Read Scale

    +

    read scale of the specified ReplicationController

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/replicationcontrollers/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Scale
    OK
    +

    Replace Scale

    +

    replace scale of the specified ReplicationController

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/replicationcontrollers/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Scale
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Scale
    OK
    201
    Scale
    Created
    +

    Patch Scale

    +

    partially update scale of the specified ReplicationController

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/replicationcontrollers/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Scale
    OK
    201
    Scale
    Created
    +

    StatefulSet v1 apps

    + + + + + +
    GroupVersionKind
    appsv1StatefulSet
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    StatefulSetSpec
    Spec defines the desired identities of pods in this set.
    status
    StatefulSetStatus
    Status is the current status of Pods in this StatefulSet. This data may be out of date by some window of time.
    +

    StatefulSetSpec v1 apps

    +
    Appears In: + +
    + + + + + + + + + + + + + + +
    FieldDescription
    minReadySeconds
    integer
    Minimum number of seconds for which a newly created pod should be ready without any of its container crashing for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready) This is an alpha field and requires enabling StatefulSetMinReadySeconds feature gate.
    persistentVolumeClaimRetentionPolicy
    StatefulSetPersistentVolumeClaimRetentionPolicy
    persistentVolumeClaimRetentionPolicy describes the lifecycle of persistent volume claims created from volumeClaimTemplates. By default, all persistent volume claims are created as needed and retained until manually deleted. This policy allows the lifecycle to be altered, for example by deleting persistent volume claims when their stateful set is deleted, or when their pod is scaled down. This requires the StatefulSetAutoDeletePVC feature gate to be enabled, which is alpha. +optional
    podManagementPolicy
    string
    podManagementPolicy controls how pods are created during initial scale up, when replacing pods on nodes, or when scaling down. The default policy is `OrderedReady`, where pods are created in increasing order (pod-0, then pod-1, etc) and the controller will wait until each pod is ready before continuing. When scaling down, the pods are removed in the opposite order. The alternative policy is `Parallel` which will create pods in parallel to match the desired scale without waiting, and on scale down will delete all pods at once. Possible enum values: - `"OrderedReady"` will create pods in strictly increasing order on scale up and strictly decreasing order on scale down, progressing only when the previous pod is ready or terminated. At most one pod will be changed at any time. - `"Parallel"` will create and delete pods as soon as the stateful set replica count is changed, and will not wait for pods to be ready or complete termination.
    replicas
    integer
    replicas is the desired number of replicas of the given Template. These are replicas in the sense that they are instantiations of the same Template, but individual replicas also have a consistent identity. If unspecified, defaults to 1.
    revisionHistoryLimit
    integer
    revisionHistoryLimit is the maximum number of revisions that will be maintained in the StatefulSet's revision history. The revision history consists of all revisions not represented by a currently applied StatefulSetSpec version. The default value is 10.
    selector
    LabelSelector
    selector is a label query over pods that should match the replica count. It must match the pod template's labels. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
    serviceName
    string
    serviceName is the name of the service that governs this StatefulSet. This service must exist before the StatefulSet, and is responsible for the network identity of the set. Pods get DNS/hostnames that follow the pattern: pod-specific-string.serviceName.default.svc.cluster.local where "pod-specific-string" is managed by the StatefulSet controller.
    template
    PodTemplateSpec
    template is the object that describes the pod that will be created if insufficient replicas are detected. Each pod stamped out by the StatefulSet will fulfill this Template, but have a unique identity from the rest of the StatefulSet.
    updateStrategy
    StatefulSetUpdateStrategy
    updateStrategy indicates the StatefulSetUpdateStrategy that will be employed to update Pods in the StatefulSet when a revision is made to Template.
    volumeClaimTemplates
    PersistentVolumeClaim array
    volumeClaimTemplates is a list of claims that pods are allowed to reference. The StatefulSet controller is responsible for mapping network identities to claims in a way that maintains the identity of a pod. Every claim in this list must have at least one matching (by name) volumeMount in one container in the template. A claim in this list takes precedence over any volumes in the template, with the same name.
    +

    StatefulSetStatus v1 apps

    +
    Appears In: + +
    + + + + + + + + + + + + + + +
    FieldDescription
    availableReplicas
    integer
    Total number of available pods (ready for at least minReadySeconds) targeted by this statefulset. This is a beta field and enabled/disabled by StatefulSetMinReadySeconds feature gate.
    collisionCount
    integer
    collisionCount is the count of hash collisions for the StatefulSet. The StatefulSet controller uses this field as a collision avoidance mechanism when it needs to create the name for the newest ControllerRevision.
    conditions
    StatefulSetCondition array
    patch strategy: merge
    patch merge key: type
    Represents the latest available observations of a statefulset's current state.
    currentReplicas
    integer
    currentReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version indicated by currentRevision.
    currentRevision
    string
    currentRevision, if not empty, indicates the version of the StatefulSet used to generate Pods in the sequence [0,currentReplicas).
    observedGeneration
    integer
    observedGeneration is the most recent generation observed for this StatefulSet. It corresponds to the StatefulSet's generation, which is updated on mutation by the API Server.
    readyReplicas
    integer
    readyReplicas is the number of pods created for this StatefulSet with a Ready Condition.
    replicas
    integer
    replicas is the number of Pods created by the StatefulSet controller.
    updateRevision
    string
    updateRevision, if not empty, indicates the version of the StatefulSet used to generate Pods in the sequence [replicas-updatedReplicas,replicas)
    updatedReplicas
    integer
    updatedReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version indicated by updateRevision.
    +

    StatefulSetList v1 apps

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    StatefulSet array
    Items is the list of stateful sets.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a StatefulSet

    +

    HTTP Request

    +POST /apis/apps/v1/namespaces/{namespace}/statefulsets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    StatefulSet
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    StatefulSet
    OK
    201
    StatefulSet
    Created
    202
    StatefulSet
    Accepted
    +

    Patch

    +

    partially update the specified StatefulSet

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/statefulsets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the StatefulSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StatefulSet
    OK
    201
    StatefulSet
    Created
    +

    Replace

    +

    replace the specified StatefulSet

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/statefulsets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the StatefulSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    StatefulSet
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StatefulSet
    OK
    201
    StatefulSet
    Created
    +

    Delete

    +

    delete a StatefulSet

    +

    HTTP Request

    +DELETE /apis/apps/v1/namespaces/{namespace}/statefulsets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the StatefulSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of StatefulSet

    +

    HTTP Request

    +DELETE /apis/apps/v1/namespaces/{namespace}/statefulsets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified StatefulSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/statefulsets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the StatefulSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    StatefulSet
    OK
    +

    List

    +

    list or watch objects of kind StatefulSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/statefulsets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    StatefulSetList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind StatefulSet

    +

    HTTP Request

    +GET /apis/apps/v1/statefulsets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    StatefulSetList
    OK
    +

    Watch

    +

    watch changes to an object of kind StatefulSet. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/namespaces/{namespace}/statefulsets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the StatefulSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of StatefulSet. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/namespaces/{namespace}/statefulsets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of StatefulSet. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/statefulsets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified StatefulSet

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/statefulsets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the StatefulSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StatefulSet
    OK
    201
    StatefulSet
    Created
    +

    Read Status

    +

    read status of the specified StatefulSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/statefulsets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the StatefulSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    StatefulSet
    OK
    +

    Replace Status

    +

    replace status of the specified StatefulSet

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/statefulsets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the StatefulSet
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    StatefulSet
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StatefulSet
    OK
    201
    StatefulSet
    Created
    +

    Misc Operations

    +

    Read Scale

    +

    read scale of the specified StatefulSet

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/statefulsets/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Scale
    OK
    +

    Replace Scale

    +

    replace scale of the specified StatefulSet

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/statefulsets/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Scale
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Scale
    OK
    201
    Scale
    Created
    +

    Patch Scale

    +

    partially update scale of the specified StatefulSet

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/statefulsets/{name}/scale +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Scale
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Scale
    OK
    201
    Scale
    Created
    +

    SERVICE APIs

    + +

    Service API resources are responsible for stitching your workloads together into an accessible Loadbalanced Service. By default, +Workloads are only accessible within the cluster, and they must be exposed externally using a either +a *LoadBalancer* or *NodePort* Service. For development, internally accessible +Workloads can be accessed via proxy through the api master using the kubectl proxy command.

    + +

    Common resource types:

    + +
      +
    • Services for providing a single ip endpoint loadbalanced across multiple Workload replicas.
    • +
    • Ingress for providing a https(s) endpoint http(s) routed to one or more *Services*.
    • +
    +
    +

    Endpoints v1 core

    + + + + + +
    GroupVersionKind
    corev1Endpoints
    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    subsets
    EndpointSubset array
    The set of all endpoints is the union of all subsets. Addresses are placed into subsets according to the IPs they share. A single address with multiple ports, some of which are ready and some of which are not (because they come from different containers) will result in the address being displayed in different subsets for the different ports. No address will appear in both Addresses and NotReadyAddresses in the same subset. Sets of addresses and ports that comprise a service.
    +

    EndpointsList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Endpoints array
    List of endpoints.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create Endpoints

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/endpoints +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Endpoints
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Endpoints
    OK
    201
    Endpoints
    Created
    202
    Endpoints
    Accepted
    +

    Patch

    +

    partially update the specified Endpoints

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/endpoints/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Endpoints
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Endpoints
    OK
    201
    Endpoints
    Created
    +

    Replace

    +

    replace the specified Endpoints

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/endpoints/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Endpoints
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Endpoints
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Endpoints
    OK
    201
    Endpoints
    Created
    +

    Delete

    +

    delete Endpoints

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/endpoints/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Endpoints
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Endpoints

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/endpoints +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified Endpoints

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/endpoints/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Endpoints
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Endpoints
    OK
    +

    List

    +

    list or watch objects of kind Endpoints

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/endpoints +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EndpointsList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Endpoints

    +

    HTTP Request

    +GET /api/v1/endpoints +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EndpointsList
    OK
    +

    Watch

    +

    watch changes to an object of kind Endpoints. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/endpoints/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Endpoints
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Endpoints. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/endpoints +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Endpoints. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/endpoints +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    EndpointSlice v1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1EndpointSlice
    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + + + + + +
    FieldDescription
    addressType
    string
    addressType specifies the type of address carried by this EndpointSlice. All addresses in this slice must be the same type. This field is immutable after creation. The following address types are currently supported: * IPv4: Represents an IPv4 Address. * IPv6: Represents an IPv6 Address. * FQDN: Represents a Fully Qualified Domain Name. Possible enum values: - `"FQDN"` represents a FQDN. - `"IPv4"` represents an IPv4 Address. - `"IPv6"` represents an IPv6 Address.
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    endpoints
    Endpoint array
    endpoints is a list of unique endpoints in this slice. Each slice may include a maximum of 1000 endpoints.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata.
    ports
    EndpointPort array
    ports specifies the list of network ports exposed by each endpoint in this slice. Each port must have a unique name. When ports is empty, it indicates that there are no defined ports. When a port is defined with a nil port value, it indicates "all ports". Each slice may include a maximum of 100 ports.
    +

    EndpointSliceList v1 discovery

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    EndpointSlice array
    List of endpoint slices
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata.
    +

    Write Operations

    +

    Create

    +

    create an EndpointSlice

    +

    HTTP Request

    +POST /apis/discovery.k8s.io/v1/namespaces/{namespace}/endpointslices +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    EndpointSlice
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    EndpointSlice
    OK
    201
    EndpointSlice
    Created
    202
    EndpointSlice
    Accepted
    +

    Patch

    +

    partially update the specified EndpointSlice

    +

    HTTP Request

    +PATCH /apis/discovery.k8s.io/v1/namespaces/{namespace}/endpointslices/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the EndpointSlice
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    EndpointSlice
    OK
    201
    EndpointSlice
    Created
    +

    Replace

    +

    replace the specified EndpointSlice

    +

    HTTP Request

    +PUT /apis/discovery.k8s.io/v1/namespaces/{namespace}/endpointslices/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the EndpointSlice
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    EndpointSlice
    +

    Response

    + + + + + + +
    CodeDescription
    200
    EndpointSlice
    OK
    201
    EndpointSlice
    Created
    +

    Delete

    +

    delete an EndpointSlice

    +

    HTTP Request

    +DELETE /apis/discovery.k8s.io/v1/namespaces/{namespace}/endpointslices/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the EndpointSlice
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of EndpointSlice

    +

    HTTP Request

    +DELETE /apis/discovery.k8s.io/v1/namespaces/{namespace}/endpointslices +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified EndpointSlice

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1/namespaces/{namespace}/endpointslices/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the EndpointSlice
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EndpointSlice
    OK
    +

    List

    +

    list or watch objects of kind EndpointSlice

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1/namespaces/{namespace}/endpointslices +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EndpointSliceList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind EndpointSlice

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1/endpointslices +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EndpointSliceList
    OK
    +

    Watch

    +

    watch changes to an object of kind EndpointSlice. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1/watch/namespaces/{namespace}/endpointslices/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the EndpointSlice
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of EndpointSlice. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1/watch/namespaces/{namespace}/endpointslices +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of EndpointSlice. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1/watch/endpointslices +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Ingress v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1Ingress
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    IngressSpec
    Spec is the desired state of the Ingress. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    IngressStatus
    Status is the current state of the Ingress. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    IngressSpec v1 networking

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    defaultBackend
    IngressBackend
    DefaultBackend is the backend that should handle requests that don't match any rule. If Rules are not specified, DefaultBackend must be specified. If DefaultBackend is not set, the handling of requests that do not match any of the rules will be up to the Ingress controller.
    ingressClassName
    string
    IngressClassName is the name of the IngressClass cluster resource. The associated IngressClass defines which controller will implement the resource. This replaces the deprecated `kubernetes.io/ingress.class` annotation. For backwards compatibility, when that annotation is set, it must be given precedence over this field. The controller may emit a warning if the field and annotation have different values. Implementations of this API should ignore Ingresses without a class specified. An IngressClass resource may be marked as default, which can be used to set a default value for this field. For more information, refer to the IngressClass documentation.
    rules
    IngressRule array
    A list of host rules used to configure the Ingress. If unspecified, or no rule matches, all traffic is sent to the default backend.
    tls
    IngressTLS array
    TLS configuration. Currently the Ingress only supports a single TLS port, 443. If multiple members of this list specify different hosts, they will be multiplexed on the same port according to the hostname specified through the SNI TLS extension, if the ingress controller fulfilling the ingress supports SNI.
    +

    IngressStatus v1 networking

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    loadBalancer
    LoadBalancerStatus
    LoadBalancer contains the current status of the load-balancer.
    +

    IngressList v1 networking

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Ingress array
    Items is the list of Ingress.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create an Ingress

    +

    HTTP Request

    +POST /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Ingress
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Ingress
    OK
    201
    Ingress
    Created
    202
    Ingress
    Accepted
    +

    Patch

    +

    partially update the specified Ingress

    +

    HTTP Request

    +PATCH /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Ingress
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Ingress
    OK
    201
    Ingress
    Created
    +

    Replace

    +

    replace the specified Ingress

    +

    HTTP Request

    +PUT /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Ingress
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Ingress
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Ingress
    OK
    201
    Ingress
    Created
    +

    Delete

    +

    delete an Ingress

    +

    HTTP Request

    +DELETE /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Ingress
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Ingress

    +

    HTTP Request

    +DELETE /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified Ingress

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Ingress
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Ingress
    OK
    +

    List

    +

    list or watch objects of kind Ingress

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    IngressList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Ingress

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/ingresses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    IngressList
    OK
    +

    Watch

    +

    watch changes to an object of kind Ingress. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/watch/namespaces/{namespace}/ingresses/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Ingress
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Ingress. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/watch/namespaces/{namespace}/ingresses +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Ingress. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/watch/ingresses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified Ingress

    +

    HTTP Request

    +PATCH /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Ingress
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Ingress
    OK
    201
    Ingress
    Created
    +

    Read Status

    +

    read status of the specified Ingress

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Ingress
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Ingress
    OK
    +

    Replace Status

    +

    replace status of the specified Ingress

    +

    HTTP Request

    +PUT /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Ingress
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Ingress
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Ingress
    OK
    201
    Ingress
    Created
    +

    IngressClass v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1IngressClass
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    IngressClassSpec
    Spec is the desired state of the IngressClass. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    IngressClassSpec v1 networking

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    controller
    string
    Controller refers to the name of the controller that should handle this class. This allows for different "flavors" that are controlled by the same controller. For example, you may have different Parameters for the same implementing controller. This should be specified as a domain-prefixed path no more than 250 characters in length, e.g. "acme.io/ingress-controller". This field is immutable.
    parameters
    IngressClassParametersReference
    Parameters is a link to a custom resource containing additional configuration for the controller. This is optional if the controller does not require extra parameters.
    +

    IngressClassList v1 networking

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    IngressClass array
    Items is the list of IngressClasses.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata.
    +

    Write Operations

    +

    Create

    +

    create an IngressClass

    +

    HTTP Request

    +POST /apis/networking.k8s.io/v1/ingressclasses +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    IngressClass
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    IngressClass
    OK
    201
    IngressClass
    Created
    202
    IngressClass
    Accepted
    +

    Patch

    +

    partially update the specified IngressClass

    +

    HTTP Request

    +PATCH /apis/networking.k8s.io/v1/ingressclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the IngressClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    IngressClass
    OK
    201
    IngressClass
    Created
    +

    Replace

    +

    replace the specified IngressClass

    +

    HTTP Request

    +PUT /apis/networking.k8s.io/v1/ingressclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the IngressClass
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    IngressClass
    +

    Response

    + + + + + + +
    CodeDescription
    200
    IngressClass
    OK
    201
    IngressClass
    Created
    +

    Delete

    +

    delete an IngressClass

    +

    HTTP Request

    +DELETE /apis/networking.k8s.io/v1/ingressclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the IngressClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of IngressClass

    +

    HTTP Request

    +DELETE /apis/networking.k8s.io/v1/ingressclasses +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified IngressClass

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/ingressclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the IngressClass
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    IngressClass
    OK
    +

    List

    +

    list or watch objects of kind IngressClass

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/ingressclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    IngressClassList
    OK
    +

    Watch

    +

    watch changes to an object of kind IngressClass. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/watch/ingressclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the IngressClass
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of IngressClass. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/watch/ingressclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Service v1 core

    + +
    +
    +
    Service Config to load balance traffic across all Pods with the app=nginx label. Receives on and sends to port 80. Exposes an externally accessible endpoint.
    +
    +
    
    +kind: Service
    +apiVersion: v1
    +metadata:
    +  # Unique key of the Service instance
    +  name: service-example
    +spec:
    +  ports:
    +    # Accept traffic sent to port 80
    +    - name: http
    +      port: 80
    +      targetPort: 80
    +  selector:
    +    # Loadbalance traffic across Pods matching
    +    # this label selector
    +    app: nginx
    +  # Create an HA proxy in the cloud provider
    +  # with an External IP address - *Only supported
    +  # by some cloud providers*
    +  type: LoadBalancer
    +
    +
    + + + + + +
    GroupVersionKind
    corev1Service
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    ServiceSpec
    Spec defines the behavior of a service. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    ServiceStatus
    Most recently observed status of the service. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    ServiceSpec v1 core

    +
    Appears In: + +
    + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    allocateLoadBalancerNodePorts
    boolean
    allocateLoadBalancerNodePorts defines if NodePorts will be automatically allocated for services with type LoadBalancer. Default is "true". It may be set to "false" if the cluster load-balancer does not rely on NodePorts. If the caller requests specific NodePorts (by specifying a value), those requests will be respected, regardless of this field. This field may only be set for services with type LoadBalancer and will be cleared if the type is changed to any other type. This field is beta-level and is only honored by servers that enable the ServiceLBNodePortControl feature.
    clusterIP
    string
    clusterIP is the IP address of the service and is usually assigned randomly. If an address is specified manually, is in-range (as per system configuration), and is not in use, it will be allocated to the service; otherwise creation of the service will fail. This field may not be changed through updates unless the type field is also being changed to ExternalName (which requires this field to be blank) or the type field is being changed from ExternalName (in which case this field may optionally be specified, as describe above). Valid values are "None", empty string (""), or a valid IP address. Setting this to "None" makes a "headless service" (no virtual IP), which is useful when direct endpoint connections are preferred and proxying is not required. Only applies to types ClusterIP, NodePort, and LoadBalancer. If this field is specified when creating a Service of type ExternalName, creation will fail. This field will be wiped when updating a Service to type ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
    clusterIPs
    string array
    ClusterIPs is a list of IP addresses assigned to this service, and are usually assigned randomly. If an address is specified manually, is in-range (as per system configuration), and is not in use, it will be allocated to the service; otherwise creation of the service will fail. This field may not be changed through updates unless the type field is also being changed to ExternalName (which requires this field to be empty) or the type field is being changed from ExternalName (in which case this field may optionally be specified, as describe above). Valid values are "None", empty string (""), or a valid IP address. Setting this to "None" makes a "headless service" (no virtual IP), which is useful when direct endpoint connections are preferred and proxying is not required. Only applies to types ClusterIP, NodePort, and LoadBalancer. If this field is specified when creating a Service of type ExternalName, creation will fail. This field will be wiped when updating a Service to type ExternalName. If this field is not specified, it will be initialized from the clusterIP field. If this field is specified, clients must ensure that clusterIPs[0] and clusterIP have the same value. This field may hold a maximum of two entries (dual-stack IPs, in either order). These IPs must correspond to the values of the ipFamilies field. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
    externalIPs
    string array
    externalIPs is a list of IP addresses for which nodes in the cluster will also accept traffic for this service. These IPs are not managed by Kubernetes. The user is responsible for ensuring that traffic arrives at a node with this IP. A common example is external load-balancers that are not part of the Kubernetes system.
    externalName
    string
    externalName is the external reference that discovery mechanisms will return as an alias for this service (e.g. a DNS CNAME record). No proxying will be involved. Must be a lowercase RFC-1123 hostname (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName".
    externalTrafficPolicy
    string
    externalTrafficPolicy denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints. "Local" preserves the client source IP and avoids a second hop for LoadBalancer and Nodeport type services, but risks potentially imbalanced traffic spreading. "Cluster" obscures the client source IP and may cause a second hop to another node, but should have good overall load-spreading. Possible enum values: - `"Cluster"` specifies node-global (legacy) behavior. - `"Local"` specifies node-local endpoints behavior.
    healthCheckNodePort
    integer
    healthCheckNodePort specifies the healthcheck nodePort for the service. This only applies when type is set to LoadBalancer and externalTrafficPolicy is set to Local. If a value is specified, is in-range, and is not in use, it will be used. If not specified, a value will be automatically allocated. External systems (e.g. load-balancers) can use this port to determine if a given node holds endpoints for this service or not. If this field is specified when creating a Service which does not need it, creation will fail. This field will be wiped when updating a Service to no longer need it (e.g. changing type).
    internalTrafficPolicy
    string
    InternalTrafficPolicy specifies if the cluster internal traffic should be routed to all endpoints or node-local endpoints only. "Cluster" routes internal traffic to a Service to all endpoints. "Local" routes traffic to node-local endpoints only, traffic is dropped if no node-local endpoints are ready. The default value is "Cluster".
    ipFamilies
    string array
    IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this service. This field is usually assigned automatically based on cluster configuration and the ipFamilyPolicy field. If this field is specified manually, the requested family is available in the cluster, and ipFamilyPolicy allows it, it will be used; otherwise creation of the service will fail. This field is conditionally mutable: it allows for adding or removing a secondary IP family, but it does not allow changing the primary IP family of the Service. Valid values are "IPv4" and "IPv6". This field only applies to Services of types ClusterIP, NodePort, and LoadBalancer, and does apply to "headless" services. This field will be wiped when updating a Service to type ExternalName. This field may hold a maximum of two entries (dual-stack families, in either order). These families must correspond to the values of the clusterIPs field, if specified. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field.
    ipFamilyPolicy
    string
    IPFamilyPolicy represents the dual-stack-ness requested or required by this Service. If there is no value provided, then this field will be set to SingleStack. Services can be "SingleStack" (a single IP family), "PreferDualStack" (two IP families on dual-stack configured clusters or a single IP family on single-stack clusters), or "RequireDualStack" (two IP families on dual-stack configured clusters, otherwise fail). The ipFamilies and clusterIPs fields depend on the value of this field. This field will be wiped when updating a service to type ExternalName.
    loadBalancerClass
    string
    loadBalancerClass is the class of the load balancer implementation this Service belongs to. If specified, the value of this field must be a label-style identifier, with an optional prefix, e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load balancer implementation is used, today this is typically done through the cloud provider integration, but should apply for any default implementation. If set, it is assumed that a load balancer implementation is watching for Services with a matching class. Any default load balancer implementation (e.g. cloud providers) should ignore Services that set this field. This field can only be set when creating or updating a Service to type 'LoadBalancer'. Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type.
    loadBalancerIP
    string
    Only applies to Service Type: LoadBalancer LoadBalancer will get created with the IP specified in this field. This feature depends on whether the underlying cloud-provider supports specifying the loadBalancerIP when a load balancer is created. This field will be ignored if the cloud-provider does not support the feature.
    loadBalancerSourceRanges
    string array
    If specified and supported by the platform, this will restrict traffic through the cloud-provider load-balancer will be restricted to the specified client IPs. This field will be ignored if the cloud-provider does not support the feature." More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/
    ports
    ServicePort array
    patch strategy: merge
    patch merge key: port
    The list of ports that are exposed by this service. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
    publishNotReadyAddresses
    boolean
    publishNotReadyAddresses indicates that any agent which deals with endpoints for this Service should disregard any indications of ready/not-ready. The primary use case for setting this field is for a StatefulSet's Headless Service to propagate SRV DNS records for its Pods for the purpose of peer discovery. The Kubernetes controllers that generate Endpoints and EndpointSlice resources for Services interpret this to mean that all endpoints are considered "ready" even if the Pods themselves are not. Agents which consume only Kubernetes generated endpoints through the Endpoints or EndpointSlice resources can safely assume this behavior.
    selector
    object
    Route service traffic to pods with label keys and values matching this selector. If empty or not present, the service is assumed to have an external process managing its endpoints, which Kubernetes will not modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. Ignored if type is ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/
    sessionAffinity
    string
    Supports "ClientIP" and "None". Used to maintain session affinity. Enable client IP based session affinity. Must be ClientIP or None. Defaults to None. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies Possible enum values: - `"ClientIP"` is the Client IP based. - `"None"` - no session affinity.
    sessionAffinityConfig
    SessionAffinityConfig
    sessionAffinityConfig contains the configurations of session affinity.
    type
    string
    type determines how the Service is exposed. Defaults to ClusterIP. Valid options are ExternalName, ClusterIP, NodePort, and LoadBalancer. "ClusterIP" allocates a cluster-internal IP address for load-balancing to endpoints. Endpoints are determined by the selector or if that is not specified, by manual construction of an Endpoints object or EndpointSlice objects. If clusterIP is "None", no virtual IP is allocated and the endpoints are published as a set of endpoints rather than a virtual IP. "NodePort" builds on ClusterIP and allocates a port on every node which routes to the same endpoints as the clusterIP. "LoadBalancer" builds on NodePort and creates an external load-balancer (if supported in the current cloud) which routes to the same endpoints as the clusterIP. "ExternalName" aliases this service to the specified externalName. Several other fields do not apply to ExternalName services. More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types Possible enum values: - `"ClusterIP"` means a service will only be accessible inside the cluster, via the cluster IP. - `"ExternalName"` means a service consists of only a reference to an external name that kubedns or equivalent will return as a CNAME record, with no exposing or proxying of any pods involved. - `"LoadBalancer"` means a service will be exposed via an external load balancer (if the cloud provider supports it), in addition to 'NodePort' type. - `"NodePort"` means a service will be exposed on one port of every node, in addition to 'ClusterIP' type.
    +

    ServiceStatus v1 core

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    conditions
    Condition array
    patch strategy: merge
    patch merge key: type
    Current service state
    loadBalancer
    LoadBalancerStatus
    LoadBalancer contains the current status of the load-balancer, if one is present.
    +

    ServiceList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Service array
    List of services
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ echo 'kind: Service
    +apiVersion: v1
    +metadata:
    +  name: service-example
    +spec:
    +  ports:
    +    - name: http
    +      port: 80
    +      targetPort: 80
    +  selector:
    +      app: nginx
    +  type: LoadBalancer
    +' | kubectl create -f -
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X POST -H 'Content-Type: application/yaml' --data '
    +kind: Service
    +apiVersion: v1
    +metadata:
    +  name: service-example
    +spec:
    +  ports:
    +    - name: http
    +      port: 80
    +      targetPort: 80
    +  selector:
    +      app: nginx
    +  type: LoadBalancer
    +' http://127.0.0.1:8001/api/v1/namespaces/default/services
    +
    + + +
    +
    +
    Output
    +
    +
    
    +service "service-example" created
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Service",
    +  "apiVersion": "v1",
    +  "metadata": {
    +    "name": "service-example",
    +    "namespace": "default",
    +    "selfLink": "/api/v1/namespaces/default/services/service-example",
    +    "uid": "93e5c731-9d30-11e6-9c54-42010a800148",
    +    "resourceVersion": "2205767",
    +    "creationTimestamp": "2016-10-28T17:04:24Z"
    +  },
    +  "spec": {
    +    "ports": [
    +      {
    +        "name": "http",
    +        "protocol": "TCP",
    +        "port": 80,
    +        "targetPort": 80,
    +        "nodePort": 32417
    +      }
    +    ],
    +    "selector": {
    +      "app": "nginx"
    +    },
    +    "clusterIP": "10.183.250.161",
    +    "type": "LoadBalancer",
    +    "sessionAffinity": "None"
    +  },
    +  "status": {
    +    "loadBalancer": {}
    +  }
    +}
    +
    +

    create a Service

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/services +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Service
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Service
    OK
    201
    Service
    Created
    202
    Service
    Accepted
    +

    Patch

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl patch service  -p \
    +	'{"spec":{"ports":[{"name":"http","port":80,"targetPort":8080}]}}'
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X PATCH -H 'Content-Type: application/strategic-merge-patch+json' --data '
    +{"spec":{"ports":[{"name":"http","port":80,"targetPort":8080}]}}' \
    +	'http://127.0.0.1:8001/api/v1/namespaces/default/services/'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +"" patched
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Service",
    +  "apiVersion": "v1",
    +  "metadata": {
    +    "name": "deployment-example",
    +    "namespace": "default",
    +    "selfLink": "/api/v1/namespaces/default/services/deployment-example",
    +    "uid": "93e5c731-9d30-11e6-9c54-42010a800148",
    +    "resourceVersion": "2205995",
    +    "creationTimestamp": "2016-10-28T17:04:24Z"
    +  },
    +  "spec": {
    +    "ports": [
    +      {
    +        "name": "http",
    +        "protocol": "TCP",
    +        "port": 80,
    +        "targetPort": 8080,
    +        "nodePort": 32417
    +      }
    +    ],
    +    "selector": {
    +      "app": "nginx"
    +    },
    +    "clusterIP": "10.183.250.161",
    +    "type": "LoadBalancer",
    +    "sessionAffinity": "None"
    +  },
    +  "status": {
    +    "loadBalancer": {
    +      "ingress": [
    +        {
    +          "ip": "104.198.186.106"
    +        }
    +      ]
    +    }
    +  }
    +}
    +
    +

    partially update the specified Service

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/services/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Service
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Service
    OK
    201
    Service
    Created
    +

    Replace

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ echo 'apiVersion: v1
    +kind: Service
    +metadata:
    +  name: deployment-example
    +  resourceVersion: "2205995"
    +spec:
    +  clusterIP: 10.183.250.161
    +  ports:
    +  - name: http
    +    nodePort: 32417
    +    port: 80
    +    protocol: TCP
    +    targetPort: 8080
    +  selector:
    +    app: nginx
    +  sessionAffinity: None
    +  type: LoadBalancer
    +' | kubectl replace -f -
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X PUT -H 'Content-Type: application/yaml' --data '
    +apiVersion: v1
    +kind: Service
    +metadata:
    +  name: deployment-example
    +  resourceVersion: "2205995"
    +spec:
    +  clusterIP: 10.183.250.161
    +  ports:
    +  - name: http
    +    nodePort: 32417
    +    port: 80
    +    protocol: TCP
    +    targetPort: 8080
    +  selector:
    +    app: nginx
    +  sessionAffinity: None
    +  type: LoadBalancer
    +' http://127.0.0.1:8001/api/v1/namespaces/default/services/deployment-example
    +
    + + +
    +
    +
    Output
    +
    +
    
    +service "deployment-example" replaced
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Service",
    +  "apiVersion": "v1",
    +  "metadata": {
    +    "name": "deployment-example",
    +    "namespace": "default",
    +    "selfLink": "/api/v1/namespaces/default/services/deployment-example",
    +    "uid": "93e5c731-9d30-11e6-9c54-42010a800148",
    +    "resourceVersion": "2208672",
    +    "creationTimestamp": "2016-10-28T17:04:24Z"
    +  },
    +  "spec": {
    +    "ports": [
    +      {
    +        "name": "http",
    +        "protocol": "TCP",
    +        "port": 80,
    +        "targetPort": 8080,
    +        "nodePort": 32417
    +      }
    +    ],
    +    "selector": {
    +      "app": "nginx"
    +    },
    +    "clusterIP": "10.183.250.161",
    +    "type": "LoadBalancer",
    +    "sessionAffinity": "None"
    +  },
    +  "status": {
    +    "loadBalancer": {
    +      "ingress": [
    +        {
    +          "ip": "104.198.186.106"
    +        }
    +      ]
    +    }
    +  }
    +}
    +
    +

    replace the specified Service

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/services/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Service
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Service
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Service
    OK
    201
    Service
    Created
    +

    Delete

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl delete service deployment-example
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X DELETE -H 'Content-Type: application/yaml' --data '
    +gracePeriodSeconds: 0
    +orphanDependents: false
    +' 'http://127.0.0.1:8001/api/v1/namespaces/default/services/deployment-example'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +service "deployment-example" deleted
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Status",
    +  "apiVersion": "v1",
    +  "metadata": {},
    +  "status": "Success",
    +  "code": 200
    +}
    +
    +
    +

    delete a Service

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/services/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Service
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Service
    OK
    202
    Service
    Accepted
    +

    Delete Collection

    +

    delete collection of Service

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/services +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl get service deployment-example -o json
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X GET http://127.0.0.1:8001/api/v1/namespaces/default/services/deployment-example
    +
    + + +
    +
    +
    Output
    +
    +
    
    +{
    +  "kind": "Service",
    +  "apiVersion": "v1",
    +  "metadata": {
    +    "name": "deployment-example",
    +    "namespace": "default",
    +    "selfLink": "/api/v1/namespaces/default/services/deployment-example",
    +    "uid": "93e5c731-9d30-11e6-9c54-42010a800148",
    +    "resourceVersion": "2205995",
    +    "creationTimestamp": "2016-10-28T17:04:24Z"
    +  },
    +  "spec": {
    +    "ports": [
    +      {
    +        "name": "http",
    +        "protocol": "TCP",
    +        "port": 80,
    +        "targetPort": 8080,
    +        "nodePort": 32417
    +      }
    +    ],
    +    "selector": {
    +      "app": "nginx"
    +    },
    +    "clusterIP": "10.183.250.161",
    +    "type": "LoadBalancer",
    +    "sessionAffinity": "None"
    +  },
    +  "status": {
    +    "loadBalancer": {
    +      "ingress": [
    +        {
    +          "ip": "104.198.186.106"
    +        }
    +      ]
    +    }
    +  }
    +}
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +  "kind": "Service",
    +  "apiVersion": "v1",
    +  "metadata": {
    +    "name": "deployment-example",
    +    "namespace": "default",
    +    "selfLink": "/api/v1/namespaces/default/services/deployment-example",
    +    "uid": "93e5c731-9d30-11e6-9c54-42010a800148",
    +    "resourceVersion": "2205995",
    +    "creationTimestamp": "2016-10-28T17:04:24Z"
    +  },
    +  "spec": {
    +    "ports": [
    +      {
    +        "name": "http",
    +        "protocol": "TCP",
    +        "port": 80,
    +        "targetPort": 8080,
    +        "nodePort": 32417
    +      }
    +    ],
    +    "selector": {
    +      "app": "nginx"
    +    },
    +    "clusterIP": "10.183.250.161",
    +    "type": "LoadBalancer",
    +    "sessionAffinity": "None"
    +  },
    +  "status": {
    +    "loadBalancer": {
    +      "ingress": [
    +        {
    +          "ip": "104.198.186.106"
    +        }
    +      ]
    +    }
    +  }
    +}
    +
    +

    read the specified Service

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/services/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Service
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Service
    OK
    +

    List

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl get service -o json
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X GET 'http://127.0.0.1:8001/api/v1/namespaces/default/services'
    +
    +

    list or watch objects of kind Service

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/services +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ServiceList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Service

    +

    HTTP Request

    +GET /api/v1/services +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ServiceList
    OK
    +

    Watch

    + + +
    +
    +
    kubectl command
    +
    +
    
    +$ kubectl get service deployment-example --watch -o json
    +
    +
    +
    +
    curl command (requires kubectl proxy to be running)
    +
    +
    
    +$ kubectl proxy
    +$ curl -X GET 'http://127.0.0.1:8001/api/v1/watch/namespaces/default/services/deployment-example'
    +
    + + +
    +
    +
    Output
    +
    +
    
    +{
    +	"type": "ADDED",
    +	"object": {
    +		"kind": "Service",
    +		"apiVersion": "v1",
    +		"metadata": {
    +			"name": "deployment-example",
    +			"namespace": "default",
    +			"selfLink": "/api/v1/namespaces/default/services/deployment-example",
    +			"uid": "93e5c731-9d30-11e6-9c54-42010a800148",
    +			"resourceVersion": "2205995",
    +			"creationTimestamp": "2016-10-28T17:04:24Z"
    +		},
    +		"spec": {
    +			"ports": [
    +				{
    +					"name": "http",
    +					"protocol": "TCP",
    +					"port": 80,
    +					"targetPort": 8080,
    +					"nodePort": 32417
    +				}
    +			],
    +			"selector": {
    +				"app": "nginx"
    +			},
    +			"clusterIP": "10.183.250.161",
    +			"type": "LoadBalancer",
    +			"sessionAffinity": "None"
    +		},
    +		"status": {
    +			"loadBalancer": {
    +				"ingress": [
    +					{
    +						"ip": "104.198.186.106"
    +					}
    +				]
    +			}
    +		}
    +	}
    +}
    +
    +
    +
    +
    Response Body
    +
    +
    
    +{
    +	"type": "ADDED",
    +	"object": {
    +		"kind": "Service",
    +		"apiVersion": "v1",
    +		"metadata": {
    +			"name": "deployment-example",
    +			"namespace": "default",
    +			"selfLink": "/api/v1/namespaces/default/services/deployment-example",
    +			"uid": "93e5c731-9d30-11e6-9c54-42010a800148",
    +			"resourceVersion": "2205995",
    +			"creationTimestamp": "2016-10-28T17:04:24Z"
    +		},
    +		"spec": {
    +			"ports": [
    +				{
    +					"name": "http",
    +					"protocol": "TCP",
    +					"port": 80,
    +					"targetPort": 8080,
    +					"nodePort": 32417
    +				}
    +			],
    +			"selector": {
    +				"app": "nginx"
    +			},
    +			"clusterIP": "10.183.250.161",
    +			"type": "LoadBalancer",
    +			"sessionAffinity": "None"
    +		},
    +		"status": {
    +			"loadBalancer": {
    +				"ingress": [
    +					{
    +						"ip": "104.198.186.106"
    +					}
    +				]
    +			}
    +		}
    +	}
    +}
    +
    +

    watch changes to an object of kind Service. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/services/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Service
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Service. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/services +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Service. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/services +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified Service

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/services/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Service
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Service
    OK
    201
    Service
    Created
    +

    Read Status

    +

    read status of the specified Service

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/services/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Service
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Service
    OK
    +

    Replace Status

    +

    replace status of the specified Service

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/services/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Service
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Service
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Service
    OK
    201
    Service
    Created
    +

    Proxy Operations

    +

    Create Connect Proxy

    +

    connect POST requests to proxy of Service

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/services/{name}/proxy +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ServiceProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Create Connect Proxy Path

    +

    connect POST requests to proxy of Service

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/services/{name}/proxy/{path} +

    Path Parameters

    + + + + + + + +
    ParameterDescription
    namename of the ServiceProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Delete Connect Proxy

    +

    connect DELETE requests to proxy of Service

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/services/{name}/proxy +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ServiceProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Delete Connect Proxy Path

    +

    connect DELETE requests to proxy of Service

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/services/{name}/proxy/{path} +

    Path Parameters

    + + + + + + + +
    ParameterDescription
    namename of the ServiceProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Get Connect Proxy

    +

    connect GET requests to proxy of Service

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/services/{name}/proxy +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ServiceProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Get Connect Proxy Path

    +

    connect GET requests to proxy of Service

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/services/{name}/proxy/{path} +

    Path Parameters

    + + + + + + + +
    ParameterDescription
    namename of the ServiceProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Head Connect Proxy

    +

    connect HEAD requests to proxy of Service

    +

    HTTP Request

    +HEAD /api/v1/namespaces/{namespace}/services/{name}/proxy +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ServiceProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Head Connect Proxy Path

    +

    connect HEAD requests to proxy of Service

    +

    HTTP Request

    +HEAD /api/v1/namespaces/{namespace}/services/{name}/proxy/{path} +

    Path Parameters

    + + + + + + + +
    ParameterDescription
    namename of the ServiceProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Replace Connect Proxy

    +

    connect PUT requests to proxy of Service

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/services/{name}/proxy +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ServiceProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Replace Connect Proxy Path

    +

    connect PUT requests to proxy of Service

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/services/{name}/proxy/{path} +

    Path Parameters

    + + + + + + + +
    ParameterDescription
    namename of the ServiceProxyOptions
    namespaceobject name and auth scope, such as for teams and projects
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the part of URLs that include service endpoints, suffixes, and parameters to use for the current proxy request to service. For example, the whole request URL is http://localhost/api/v1/namespaces/kube-system/services/elasticsearch-logging/_search?q=user:kimchy. Path is _search?q=user:kimchy.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    CONFIG & STORAGE

    + +

    Config and Storage resources are responsible for injecting data into your applications and persisting data externally to your container.

    + +

    Common resource types:

    +
      +
    • ConfigMaps for providing text key value pairs injected into the application through environment variables, command line arguments, or files
    • +
    • Secrets for providing binary data injected into the application through files
    • +
    • Volumes for providing a filesystem external to the Container. Maybe shared across Containers within the same Pod and have a lifetime persisting beyond a Container or Pod.
    • +
    +
    +

    ConfigMap v1 core

    + + + + + +
    GroupVersionKind
    corev1ConfigMap
    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    binaryData
    object
    BinaryData contains the binary data. Each key must consist of alphanumeric characters, '-', '_' or '.'. BinaryData can contain byte sequences that are not in the UTF-8 range. The keys stored in BinaryData must not overlap with the ones in the Data field, this is enforced during validation process. Using this field will require 1.10+ apiserver and kubelet.
    data
    object
    Data contains the configuration data. Each key must consist of alphanumeric characters, '-', '_' or '.'. Values with non-UTF-8 byte sequences must use the BinaryData field. The keys stored in Data must not overlap with the keys in the BinaryData field, this is enforced during validation process.
    immutable
    boolean
    Immutable, if set to true, ensures that data stored in the ConfigMap cannot be updated (only object metadata can be modified). If not set to true, the field can be modified at any time. Defaulted to nil.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    ConfigMapList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    ConfigMap array
    Items is the list of ConfigMaps.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a ConfigMap

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/configmaps +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ConfigMap
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    ConfigMap
    OK
    201
    ConfigMap
    Created
    202
    ConfigMap
    Accepted
    +

    Patch

    +

    partially update the specified ConfigMap

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/configmaps/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ConfigMap
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ConfigMap
    OK
    201
    ConfigMap
    Created
    +

    Replace

    +

    replace the specified ConfigMap

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/configmaps/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ConfigMap
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ConfigMap
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ConfigMap
    OK
    201
    ConfigMap
    Created
    +

    Delete

    +

    delete a ConfigMap

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/configmaps/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ConfigMap
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of ConfigMap

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/configmaps +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified ConfigMap

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/configmaps/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ConfigMap
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ConfigMap
    OK
    +

    List

    +

    list or watch objects of kind ConfigMap

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/configmaps +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ConfigMapList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind ConfigMap

    +

    HTTP Request

    +GET /api/v1/configmaps +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ConfigMapList
    OK
    +

    Watch

    +

    watch changes to an object of kind ConfigMap. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/configmaps/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ConfigMap
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of ConfigMap. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/configmaps +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of ConfigMap. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/configmaps +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    CSIDriver v1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1CSIDriver
    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object metadata. metadata.Name indicates the name of the CSI driver that this object refers to; it MUST be the same name returned by the CSI GetPluginName() call for that driver. The driver name must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    CSIDriverSpec
    Specification of the CSI Driver.
    +

    CSIDriverSpec v1 storage

    +
    Appears In: + +
    + + + + + + + + + + + +
    FieldDescription
    attachRequired
    boolean
    attachRequired indicates this CSI volume driver requires an attach operation (because it implements the CSI ControllerPublishVolume() method), and that the Kubernetes attach detach controller should call the attach volume interface which checks the volumeattachment status and waits until the volume is attached before proceeding to mounting. The CSI external-attacher coordinates with CSI volume driver and updates the volumeattachment status when the attach operation is complete. If the CSIDriverRegistry feature gate is enabled and the value is specified to false, the attach operation will be skipped. Otherwise the attach operation will be called. This field is immutable.
    fsGroupPolicy
    string
    Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details. This field is immutable. Defaults to ReadWriteOnceWithFSType, which will examine each volume to determine if Kubernetes should modify ownership and permissions of the volume. With the default policy the defined fsGroup will only be applied if a fstype is defined and the volume's access mode contains ReadWriteOnce.
    podInfoOnMount
    boolean
    If set to true, podInfoOnMount indicates this CSI volume driver requires additional pod information (like podName, podUID, etc.) during mount operations. If set to false, pod information will not be passed on mount. Default is false. The CSI driver specifies podInfoOnMount as part of driver deployment. If true, Kubelet will pass pod information as VolumeContext in the CSI NodePublishVolume() calls. The CSI driver is responsible for parsing and validating the information passed in as VolumeContext. The following VolumeConext will be passed if podInfoOnMount is set to true. This list might grow, but the prefix will be used. "csi.storage.k8s.io/pod.name": pod.Name "csi.storage.k8s.io/pod.namespace": pod.Namespace "csi.storage.k8s.io/pod.uid": string(pod.UID) "csi.storage.k8s.io/ephemeral": "true" if the volume is an ephemeral inline volume defined by a CSIVolumeSource, otherwise "false" "csi.storage.k8s.io/ephemeral" is a new feature in Kubernetes 1.16. It is only required for drivers which support both the "Persistent" and "Ephemeral" VolumeLifecycleMode. Other drivers can leave pod info disabled and/or ignore this field. As Kubernetes 1.15 doesn't support this field, drivers can only support one mode when deployed on such a cluster and the deployment determines which mode that is, for example via a command line parameter of the driver. This field is immutable.
    requiresRepublish
    boolean
    RequiresRepublish indicates the CSI driver wants `NodePublishVolume` being periodically called to reflect any possible change in the mounted volume. This field defaults to false. Note: After a successful initial NodePublishVolume call, subsequent calls to NodePublishVolume should only update the contents of the volume. New mount points will not be seen by a running container.
    storageCapacity
    boolean
    If set to true, storageCapacity indicates that the CSI volume driver wants pod scheduling to consider the storage capacity that the driver deployment will report by creating CSIStorageCapacity objects with capacity information. The check can be enabled immediately when deploying a driver. In that case, provisioning new volumes with late binding will pause until the driver deployment has published some suitable CSIStorageCapacity object. Alternatively, the driver can be deployed with the field unset or false and it can be flipped later when storage capacity information has been published. This field was immutable in Kubernetes <= 1.22 and now is mutable. This is a beta field and only available when the CSIStorageCapacity feature is enabled. The default is false.
    tokenRequests
    TokenRequest array
    TokenRequests indicates the CSI driver needs pods' service account tokens it is mounting volume for to do necessary authentication. Kubelet will pass the tokens in VolumeContext in the CSI NodePublishVolume calls. The CSI driver should parse and validate the following VolumeContext: "csi.storage.k8s.io/serviceAccount.tokens": { "<audience>": { "token": <token>, "expirationTimestamp": <expiration timestamp in RFC3339>, }, ... } Note: Audience in each TokenRequest should be different and at most one token is empty string. To receive a new token after expiry, RequiresRepublish can be used to trigger NodePublishVolume periodically.
    volumeLifecycleModes
    string array
    volumeLifecycleModes defines what kind of volumes this CSI volume driver supports. The default if the list is empty is "Persistent", which is the usage defined by the CSI specification and implemented in Kubernetes via the usual PV/PVC mechanism. The other mode is "Ephemeral". In this mode, volumes are defined inline inside the pod spec with CSIVolumeSource and their lifecycle is tied to the lifecycle of that pod. A driver has to be aware of this because it is only going to get a NodePublishVolume call for such a volume. For more information about implementing this mode, see https://kubernetes-csi.github.io/docs/ephemeral-local-volumes.html A driver can support one or more of these modes and more modes may be added in the future. This field is beta. This field is immutable.
    +

    CSIDriverList v1 storage

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    CSIDriver array
    items is the list of CSIDriver
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a CSIDriver

    +

    HTTP Request

    +POST /apis/storage.k8s.io/v1/csidrivers +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CSIDriver
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    CSIDriver
    OK
    201
    CSIDriver
    Created
    202
    CSIDriver
    Accepted
    +

    Patch

    +

    partially update the specified CSIDriver

    +

    HTTP Request

    +PATCH /apis/storage.k8s.io/v1/csidrivers/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CSIDriver
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CSIDriver
    OK
    201
    CSIDriver
    Created
    +

    Replace

    +

    replace the specified CSIDriver

    +

    HTTP Request

    +PUT /apis/storage.k8s.io/v1/csidrivers/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CSIDriver
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CSIDriver
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CSIDriver
    OK
    201
    CSIDriver
    Created
    +

    Delete

    +

    delete a CSIDriver

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1/csidrivers/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CSIDriver
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CSIDriver
    OK
    202
    CSIDriver
    Accepted
    +

    Delete Collection

    +

    delete collection of CSIDriver

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1/csidrivers +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified CSIDriver

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/csidrivers/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CSIDriver
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CSIDriver
    OK
    +

    List

    +

    list or watch objects of kind CSIDriver

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/csidrivers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CSIDriverList
    OK
    +

    Watch

    +

    watch changes to an object of kind CSIDriver. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/watch/csidrivers/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CSIDriver
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of CSIDriver. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/watch/csidrivers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    CSINode v1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1CSINode
    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    metadata.name must be the Kubernetes node name.
    spec
    CSINodeSpec
    spec is the specification of CSINode
    +

    CSINodeSpec v1 storage

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    drivers
    CSINodeDriver array
    patch strategy: merge
    patch merge key: name
    drivers is a list of information of all CSI Drivers existing on a node. If all drivers in the list are uninstalled, this can become empty.
    +

    CSINodeList v1 storage

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    CSINode array
    items is the list of CSINode
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a CSINode

    +

    HTTP Request

    +POST /apis/storage.k8s.io/v1/csinodes +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CSINode
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    CSINode
    OK
    201
    CSINode
    Created
    202
    CSINode
    Accepted
    +

    Patch

    +

    partially update the specified CSINode

    +

    HTTP Request

    +PATCH /apis/storage.k8s.io/v1/csinodes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CSINode
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CSINode
    OK
    201
    CSINode
    Created
    +

    Replace

    +

    replace the specified CSINode

    +

    HTTP Request

    +PUT /apis/storage.k8s.io/v1/csinodes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CSINode
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CSINode
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CSINode
    OK
    201
    CSINode
    Created
    +

    Delete

    +

    delete a CSINode

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1/csinodes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CSINode
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CSINode
    OK
    202
    CSINode
    Accepted
    +

    Delete Collection

    +

    delete collection of CSINode

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1/csinodes +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified CSINode

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/csinodes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CSINode
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CSINode
    OK
    +

    List

    +

    list or watch objects of kind CSINode

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/csinodes +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CSINodeList
    OK
    +

    Watch

    +

    watch changes to an object of kind CSINode. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/watch/csinodes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CSINode
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of CSINode. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/watch/csinodes +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Secret v1 core

    + + + + + +
    GroupVersionKind
    corev1Secret
    +
    Appears In: + +
    + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    data
    object
    Data contains the secret data. Each key must consist of alphanumeric characters, '-', '_' or '.'. The serialized form of the secret data is a base64 encoded string, representing the arbitrary (possibly non-string) data value here. Described in https://tools.ietf.org/html/rfc4648#section-4
    immutable
    boolean
    Immutable, if set to true, ensures that data stored in the Secret cannot be updated (only object metadata can be modified). If not set to true, the field can be modified at any time. Defaulted to nil.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    stringData
    object
    stringData allows specifying non-binary secret data in string form. It is provided as a write-only input field for convenience. All keys and values are merged into the data field on write, overwriting any existing values. The stringData field is never output when reading from the API.
    type
    string
    Used to facilitate programmatic handling of secret data. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
    +

    SecretList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Secret array
    Items is a list of secret objects. More info: https://kubernetes.io/docs/concepts/configuration/secret
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a Secret

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/secrets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Secret
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Secret
    OK
    201
    Secret
    Created
    202
    Secret
    Accepted
    +

    Patch

    +

    partially update the specified Secret

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/secrets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Secret
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Secret
    OK
    201
    Secret
    Created
    +

    Replace

    +

    replace the specified Secret

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/secrets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Secret
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Secret
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Secret
    OK
    201
    Secret
    Created
    +

    Delete

    +

    delete a Secret

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/secrets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Secret
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Secret

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/secrets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified Secret

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/secrets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Secret
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Secret
    OK
    +

    List

    +

    list or watch objects of kind Secret

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/secrets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    SecretList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Secret

    +

    HTTP Request

    +GET /api/v1/secrets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    SecretList
    OK
    +

    Watch

    +

    watch changes to an object of kind Secret. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/secrets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Secret
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Secret. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/secrets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Secret. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/secrets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    PersistentVolumeClaim v1 core

    + + + + + +
    GroupVersionKind
    corev1PersistentVolumeClaim
    +
    A PersistentVolume must be allocated in the cluster to use this.
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    PersistentVolumeClaimSpec
    Spec defines the desired characteristics of a volume requested by a pod author. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
    status
    PersistentVolumeClaimStatus
    Status represents the current information/status of a persistent volume claim. Read-only. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
    +

    PersistentVolumeClaimSpec v1 core

    + + + + + + + + + + + + + +
    FieldDescription
    accessModes
    string array
    AccessModes contains the desired access modes the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
    dataSource
    TypedLocalObjectReference
    This field can be used to specify either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. If the AnyVolumeDataSource feature gate is enabled, this field will always have the same contents as the DataSourceRef field.
    dataSourceRef
    TypedLocalObjectReference
    Specifies the object from which to populate the volume with data, if a non-empty volume is desired. This may be any local object from a non-empty API group (non core object) or a PersistentVolumeClaim object. When this field is specified, volume binding will only succeed if the type of the specified object matches some installed volume populator or dynamic provisioner. This field will replace the functionality of the DataSource field and as such if both fields are non-empty, they must have the same value. For backwards compatibility, both fields (DataSource and DataSourceRef) will be set to the same value automatically if one of them is empty and the other is non-empty. There are two important differences between DataSource and DataSourceRef: * While DataSource only allows two specific types of objects, DataSourceRef allows any non-core object, as well as PersistentVolumeClaim objects. * While DataSource ignores disallowed values (dropping them), DataSourceRef preserves all values, and generates an error if a disallowed value is specified. (Alpha) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
    resources
    ResourceRequirements
    Resources represents the minimum resources the volume should have. If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
    selector
    LabelSelector
    A label query over volumes to consider for binding.
    storageClassName
    string
    Name of the StorageClass required by the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1
    volumeMode
    string
    volumeMode defines what type of volume is required by the claim. Value of Filesystem is implied when not included in claim spec.
    volumeName
    string
    VolumeName is the binding reference to the PersistentVolume backing this claim.
    +

    PersistentVolumeClaimStatus v1 core

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    accessModes
    string array
    AccessModes contains the actual access modes the volume backing the PVC has. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1
    allocatedResources
    object
    The storage resource within AllocatedResources tracks the capacity allocated to a PVC. It may be larger than the actual capacity when a volume expansion operation is requested. For storage quota, the larger value from allocatedResources and PVC.spec.resources is used. If allocatedResources is not set, PVC.spec.resources alone is used for quota calculation. If a volume expansion capacity request is lowered, allocatedResources is only lowered if there are no expansion operations in progress and if the actual volume capacity is equal or lower than the requested capacity. This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature.
    capacity
    object
    Represents the actual resources of the underlying volume.
    conditions
    PersistentVolumeClaimCondition array
    patch strategy: merge
    patch merge key: type
    Current Condition of persistent volume claim. If underlying persistent volume is being resized then the Condition will be set to 'ResizeStarted'.
    phase
    string
    Phase represents the current phase of PersistentVolumeClaim. Possible enum values: - `"Bound"` used for PersistentVolumeClaims that are bound - `"Lost"` used for PersistentVolumeClaims that lost their underlying PersistentVolume. The claim was bound to a PersistentVolume and this volume does not exist any longer and all data on it was lost. - `"Pending"` used for PersistentVolumeClaims that are not yet bound
    resizeStatus
    string
    ResizeStatus stores status of resize operation. ResizeStatus is not set by default but when expansion is complete resizeStatus is set to empty string by resize controller or kubelet. This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature.
    +

    PersistentVolumeClaimList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    PersistentVolumeClaim array
    A list of persistent volume claims. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a PersistentVolumeClaim

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/persistentvolumeclaims +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PersistentVolumeClaim
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    PersistentVolumeClaim
    OK
    201
    PersistentVolumeClaim
    Created
    202
    PersistentVolumeClaim
    Accepted
    +

    Patch

    +

    partially update the specified PersistentVolumeClaim

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PersistentVolumeClaim
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PersistentVolumeClaim
    OK
    201
    PersistentVolumeClaim
    Created
    +

    Replace

    +

    replace the specified PersistentVolumeClaim

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PersistentVolumeClaim
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PersistentVolumeClaim
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PersistentVolumeClaim
    OK
    201
    PersistentVolumeClaim
    Created
    +

    Delete

    +

    delete a PersistentVolumeClaim

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PersistentVolumeClaim
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PersistentVolumeClaim
    OK
    202
    PersistentVolumeClaim
    Accepted
    +

    Delete Collection

    +

    delete collection of PersistentVolumeClaim

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/persistentvolumeclaims +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified PersistentVolumeClaim

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PersistentVolumeClaim
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PersistentVolumeClaim
    OK
    +

    List

    +

    list or watch objects of kind PersistentVolumeClaim

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/persistentvolumeclaims +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PersistentVolumeClaimList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind PersistentVolumeClaim

    +

    HTTP Request

    +GET /api/v1/persistentvolumeclaims +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PersistentVolumeClaimList
    OK
    +

    Watch

    +

    watch changes to an object of kind PersistentVolumeClaim. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/persistentvolumeclaims/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PersistentVolumeClaim
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of PersistentVolumeClaim. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/persistentvolumeclaims +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of PersistentVolumeClaim. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/persistentvolumeclaims +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified PersistentVolumeClaim

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PersistentVolumeClaim
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PersistentVolumeClaim
    OK
    201
    PersistentVolumeClaim
    Created
    +

    Read Status

    +

    read status of the specified PersistentVolumeClaim

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PersistentVolumeClaim
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PersistentVolumeClaim
    OK
    +

    Replace Status

    +

    replace status of the specified PersistentVolumeClaim

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PersistentVolumeClaim
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PersistentVolumeClaim
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PersistentVolumeClaim
    OK
    201
    PersistentVolumeClaim
    Created
    +

    StorageClass v1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1StorageClass
    +
    Appears In: + +
    + + + + + + + + + + + + + + +
    FieldDescription
    allowVolumeExpansion
    boolean
    AllowVolumeExpansion shows whether the storage class allow volume expand
    allowedTopologies
    TopologySelectorTerm array
    Restrict the node topologies where volumes can be dynamically provisioned. Each volume plugin defines its own supported topology specifications. An empty TopologySelectorTerm list means there is no topology restriction. This field is only honored by servers that enable the VolumeScheduling feature.
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    mountOptions
    string array
    Dynamically provisioned PersistentVolumes of this storage class are created with these mountOptions, e.g. ["ro", "soft"]. Not validated - mount of the PVs will simply fail if one is invalid.
    parameters
    object
    Parameters holds the parameters for the provisioner that should create volumes of this storage class.
    provisioner
    string
    Provisioner indicates the type of the provisioner.
    reclaimPolicy
    string
    Dynamically provisioned PersistentVolumes of this storage class are created with this reclaimPolicy. Defaults to Delete.
    volumeBindingMode
    string
    VolumeBindingMode indicates how PersistentVolumeClaims should be provisioned and bound. When unset, VolumeBindingImmediate is used. This field is only honored by servers that enable the VolumeScheduling feature.
    +

    StorageClassList v1 storage

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    StorageClass array
    Items is the list of StorageClasses
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a StorageClass

    +

    HTTP Request

    +POST /apis/storage.k8s.io/v1/storageclasses +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    StorageClass
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    StorageClass
    OK
    201
    StorageClass
    Created
    202
    StorageClass
    Accepted
    +

    Patch

    +

    partially update the specified StorageClass

    +

    HTTP Request

    +PATCH /apis/storage.k8s.io/v1/storageclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StorageClass
    OK
    201
    StorageClass
    Created
    +

    Replace

    +

    replace the specified StorageClass

    +

    HTTP Request

    +PUT /apis/storage.k8s.io/v1/storageclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageClass
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    StorageClass
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StorageClass
    OK
    201
    StorageClass
    Created
    +

    Delete

    +

    delete a StorageClass

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1/storageclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StorageClass
    OK
    202
    StorageClass
    Accepted
    +

    Delete Collection

    +

    delete collection of StorageClass

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1/storageclasses +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified StorageClass

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/storageclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageClass
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    StorageClass
    OK
    +

    List

    +

    list or watch objects of kind StorageClass

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/storageclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    StorageClassList
    OK
    +

    Watch

    +

    watch changes to an object of kind StorageClass. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/watch/storageclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageClass
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of StorageClass. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/watch/storageclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    CSIStorageCapacity v1beta1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1beta1CSIStorageCapacity
    +
    Other API versions of this object exist: +v1alpha1 +
    + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    capacity
    Quantity
    Capacity is the value reported by the CSI driver in its GetCapacityResponse for a GetCapacityRequest with topology and parameters that match the previous fields. The semantic is currently (CSI spec 1.2) defined as: The available capacity, in bytes, of the storage that can be used to provision volumes. If not set, that information is currently unavailable and treated like zero capacity.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    maximumVolumeSize
    Quantity
    MaximumVolumeSize is the value reported by the CSI driver in its GetCapacityResponse for a GetCapacityRequest with topology and parameters that match the previous fields. This is defined since CSI spec 1.4.0 as the largest size that may be used in a CreateVolumeRequest.capacity_range.required_bytes field to create a volume with the same parameters as those in GetCapacityRequest. The corresponding value in the Kubernetes API is ResourceRequirements.Requests in a volume claim.
    metadata
    ObjectMeta
    Standard object's metadata. The name has no particular meaning. It must be be a DNS subdomain (dots allowed, 253 characters). To ensure that there are no conflicts with other CSI drivers on the cluster, the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends with the unique CSI driver name. Objects are namespaced. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    nodeTopology
    LabelSelector
    NodeTopology defines which nodes have access to the storage for which capacity was reported. If not set, the storage is not accessible from any node in the cluster. If empty, the storage is accessible from all nodes. This field is immutable.
    storageClassName
    string
    The name of the StorageClass that the reported capacity applies to. It must meet the same requirements as the name of a StorageClass object (non-empty, DNS subdomain). If that object no longer exists, the CSIStorageCapacity object is obsolete and should be removed by its creator. This field is immutable.
    +

    CSIStorageCapacityList v1beta1 storage

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    CSIStorageCapacity array
    Items is the list of CSIStorageCapacity objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a CSIStorageCapacity

    +

    HTTP Request

    +POST /apis/storage.k8s.io/v1beta1/namespaces/{namespace}/csistoragecapacities +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CSIStorageCapacity
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    CSIStorageCapacity
    OK
    201
    CSIStorageCapacity
    Created
    202
    CSIStorageCapacity
    Accepted
    +

    Patch

    +

    partially update the specified CSIStorageCapacity

    +

    HTTP Request

    +PATCH /apis/storage.k8s.io/v1beta1/namespaces/{namespace}/csistoragecapacities/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CSIStorageCapacity
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CSIStorageCapacity
    OK
    201
    CSIStorageCapacity
    Created
    +

    Replace

    +

    replace the specified CSIStorageCapacity

    +

    HTTP Request

    +PUT /apis/storage.k8s.io/v1beta1/namespaces/{namespace}/csistoragecapacities/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CSIStorageCapacity
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CSIStorageCapacity
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CSIStorageCapacity
    OK
    201
    CSIStorageCapacity
    Created
    +

    Delete

    +

    delete a CSIStorageCapacity

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1beta1/namespaces/{namespace}/csistoragecapacities/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CSIStorageCapacity
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of CSIStorageCapacity

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1beta1/namespaces/{namespace}/csistoragecapacities +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified CSIStorageCapacity

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1beta1/namespaces/{namespace}/csistoragecapacities/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CSIStorageCapacity
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CSIStorageCapacity
    OK
    +

    List

    +

    list or watch objects of kind CSIStorageCapacity

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1beta1/namespaces/{namespace}/csistoragecapacities +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CSIStorageCapacityList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind CSIStorageCapacity

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1beta1/csistoragecapacities +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CSIStorageCapacityList
    OK
    +

    Watch

    +

    watch changes to an object of kind CSIStorageCapacity. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1beta1/watch/namespaces/{namespace}/csistoragecapacities/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CSIStorageCapacity
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of CSIStorageCapacity. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1beta1/watch/namespaces/{namespace}/csistoragecapacities +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of CSIStorageCapacity. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1beta1/watch/csistoragecapacities +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Volume v1 core

    + + + + + +
    GroupVersionKind
    corev1Volume
    +
    Appears In: + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    awsElasticBlockStore
    AWSElasticBlockStoreVolumeSource
    AWSElasticBlockStore represents an AWS Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
    azureDisk
    AzureDiskVolumeSource
    AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
    azureFile
    AzureFileVolumeSource
    AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
    cephfs
    CephFSVolumeSource
    CephFS represents a Ceph FS mount on the host that shares a pod's lifetime
    cinder
    CinderVolumeSource
    Cinder represents a cinder volume attached and mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md
    configMap
    ConfigMapVolumeSource
    ConfigMap represents a configMap that should populate this volume
    csi
    CSIVolumeSource
    CSI (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers (Beta feature).
    downwardAPI
    DownwardAPIVolumeSource
    DownwardAPI represents downward API about the pod that should populate this volume
    emptyDir
    EmptyDirVolumeSource
    EmptyDir represents a temporary directory that shares a pod's lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
    ephemeral
    EphemeralVolumeSource
    Ephemeral represents a volume that is handled by a cluster storage driver. The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, and deleted when the pod is removed. Use this if: a) the volume is only needed while the pod runs, b) features of normal volumes like restoring from snapshot or capacity tracking are needed, c) the storage driver is specified through a storage class, and d) the storage driver supports dynamic volume provisioning through a PersistentVolumeClaim (see EphemeralVolumeSource for more information on the connection between this volume type and PersistentVolumeClaim). Use PersistentVolumeClaim or one of the vendor-specific APIs for volumes that persist for longer than the lifecycle of an individual pod. Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to be used that way - see the documentation of the driver for more information. A pod can use both types of ephemeral volumes and persistent volumes at the same time.
    fc
    FCVolumeSource
    FC represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.
    flexVolume
    FlexVolumeSource
    FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin.
    flocker
    FlockerVolumeSource
    Flocker represents a Flocker volume attached to a kubelet's host machine. This depends on the Flocker control service being running
    gcePersistentDisk
    GCEPersistentDiskVolumeSource
    GCEPersistentDisk represents a GCE Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
    gitRepo
    GitRepoVolumeSource
    GitRepo represents a git repository at a particular revision. DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container.
    glusterfs
    GlusterfsVolumeSource
    Glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/glusterfs/README.md
    hostPath
    HostPathVolumeSource
    HostPath represents a pre-existing file or directory on the host machine that is directly exposed to the container. This is generally used for system agents or other privileged things that are allowed to see the host machine. Most containers will NOT need this. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
    iscsi
    ISCSIVolumeSource
    ISCSI represents an ISCSI Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://examples.k8s.io/volumes/iscsi/README.md
    name
    string
    Volume's name. Must be a DNS_LABEL and unique within the pod. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    nfs
    NFSVolumeSource
    NFS represents an NFS mount on the host that shares a pod's lifetime More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
    persistentVolumeClaim
    PersistentVolumeClaimVolumeSource
    PersistentVolumeClaimVolumeSource represents a reference to a PersistentVolumeClaim in the same namespace. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
    photonPersistentDisk
    PhotonPersistentDiskVolumeSource
    PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine
    portworxVolume
    PortworxVolumeSource
    PortworxVolume represents a portworx volume attached and mounted on kubelets host machine
    projected
    ProjectedVolumeSource
    Items for all in one resources secrets, configmaps, and downward API
    quobyte
    QuobyteVolumeSource
    Quobyte represents a Quobyte mount on the host that shares a pod's lifetime
    rbd
    RBDVolumeSource
    RBD represents a Rados Block Device mount on the host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md
    scaleIO
    ScaleIOVolumeSource
    ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
    secret
    SecretVolumeSource
    Secret represents a secret that should populate this volume. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
    storageos
    StorageOSVolumeSource
    StorageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
    vsphereVolume
    VsphereVirtualDiskVolumeSource
    VsphereVolume represents a vSphere volume attached and mounted on kubelets host machine
    +

    VolumeAttachment v1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1VolumeAttachment
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    VolumeAttachmentSpec
    Specification of the desired attach/detach volume behavior. Populated by the Kubernetes system.
    status
    VolumeAttachmentStatus
    Status of the VolumeAttachment request. Populated by the entity completing the attach or detach operation, i.e. the external-attacher.
    +

    VolumeAttachmentSpec v1 storage

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    attacher
    string
    Attacher indicates the name of the volume driver that MUST handle this request. This is the name returned by GetPluginName().
    nodeName
    string
    The node that the volume should be attached to.
    source
    VolumeAttachmentSource
    Source represents the volume that should be attached.
    +

    VolumeAttachmentStatus v1 storage

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    attachError
    VolumeError
    The last error encountered during attach operation, if any. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.
    attached
    boolean
    Indicates the volume is successfully attached. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.
    attachmentMetadata
    object
    Upon successful attach, this field is populated with any information returned by the attach operation that must be passed into subsequent WaitForAttach or Mount calls. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.
    detachError
    VolumeError
    The last error encountered during detach operation, if any. This field must only be set by the entity completing the detach operation, i.e. the external-attacher.
    +

    VolumeAttachmentList v1 storage

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    VolumeAttachment array
    Items is the list of VolumeAttachments
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a VolumeAttachment

    +

    HTTP Request

    +POST /apis/storage.k8s.io/v1/volumeattachments +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    VolumeAttachment
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    VolumeAttachment
    OK
    201
    VolumeAttachment
    Created
    202
    VolumeAttachment
    Accepted
    +

    Patch

    +

    partially update the specified VolumeAttachment

    +

    HTTP Request

    +PATCH /apis/storage.k8s.io/v1/volumeattachments/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the VolumeAttachment
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    VolumeAttachment
    OK
    201
    VolumeAttachment
    Created
    +

    Replace

    +

    replace the specified VolumeAttachment

    +

    HTTP Request

    +PUT /apis/storage.k8s.io/v1/volumeattachments/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the VolumeAttachment
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    VolumeAttachment
    +

    Response

    + + + + + + +
    CodeDescription
    200
    VolumeAttachment
    OK
    201
    VolumeAttachment
    Created
    +

    Delete

    +

    delete a VolumeAttachment

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1/volumeattachments/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the VolumeAttachment
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    VolumeAttachment
    OK
    202
    VolumeAttachment
    Accepted
    +

    Delete Collection

    +

    delete collection of VolumeAttachment

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1/volumeattachments +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified VolumeAttachment

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/volumeattachments/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the VolumeAttachment
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    VolumeAttachment
    OK
    +

    List

    +

    list or watch objects of kind VolumeAttachment

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/volumeattachments +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    VolumeAttachmentList
    OK
    +

    Watch

    +

    watch changes to an object of kind VolumeAttachment. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/watch/volumeattachments/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the VolumeAttachment
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of VolumeAttachment. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/watch/volumeattachments +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified VolumeAttachment

    +

    HTTP Request

    +PATCH /apis/storage.k8s.io/v1/volumeattachments/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the VolumeAttachment
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    VolumeAttachment
    OK
    201
    VolumeAttachment
    Created
    +

    Read Status

    +

    read status of the specified VolumeAttachment

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1/volumeattachments/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the VolumeAttachment
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    VolumeAttachment
    OK
    +

    Replace Status

    +

    replace status of the specified VolumeAttachment

    +

    HTTP Request

    +PUT /apis/storage.k8s.io/v1/volumeattachments/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the VolumeAttachment
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    VolumeAttachment
    +

    Response

    + + + + + + +
    CodeDescription
    200
    VolumeAttachment
    OK
    201
    VolumeAttachment
    Created
    +

    METADATA

    + +

    Metadata resources are responsible for configuring behavior of your other Resources within the Cluster.

    + +

    Common resource types:

    +
      +
    • HorizontalPodAutoscaler (HPA) for automatically scaling the replicacount of your workloads in response to load.
    • +
    • PodDisruptionBudget for configuring how many replicas in a given workload maybe made concurrently unavailable when performing maintenance.
    • +
    • Event for notification of resource lifecycle events in the cluster.
    • +
    +
    +

    ControllerRevision v1 apps

    + + + + + +
    GroupVersionKind
    appsv1ControllerRevision
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    dataData is the serialized representation of the state.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    revision
    integer
    Revision indicates the revision of the state represented by Data.
    +

    ControllerRevisionList v1 apps

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    ControllerRevision array
    Items is the list of ControllerRevisions
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a ControllerRevision

    +

    HTTP Request

    +POST /apis/apps/v1/namespaces/{namespace}/controllerrevisions +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ControllerRevision
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    ControllerRevision
    OK
    201
    ControllerRevision
    Created
    202
    ControllerRevision
    Accepted
    +

    Patch

    +

    partially update the specified ControllerRevision

    +

    HTTP Request

    +PATCH /apis/apps/v1/namespaces/{namespace}/controllerrevisions/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ControllerRevision
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ControllerRevision
    OK
    201
    ControllerRevision
    Created
    +

    Replace

    +

    replace the specified ControllerRevision

    +

    HTTP Request

    +PUT /apis/apps/v1/namespaces/{namespace}/controllerrevisions/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ControllerRevision
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ControllerRevision
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ControllerRevision
    OK
    201
    ControllerRevision
    Created
    +

    Delete

    +

    delete a ControllerRevision

    +

    HTTP Request

    +DELETE /apis/apps/v1/namespaces/{namespace}/controllerrevisions/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ControllerRevision
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of ControllerRevision

    +

    HTTP Request

    +DELETE /apis/apps/v1/namespaces/{namespace}/controllerrevisions +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified ControllerRevision

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/controllerrevisions/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ControllerRevision
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ControllerRevision
    OK
    +

    List

    +

    list or watch objects of kind ControllerRevision

    +

    HTTP Request

    +GET /apis/apps/v1/namespaces/{namespace}/controllerrevisions +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ControllerRevisionList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind ControllerRevision

    +

    HTTP Request

    +GET /apis/apps/v1/controllerrevisions +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ControllerRevisionList
    OK
    +

    Watch

    +

    watch changes to an object of kind ControllerRevision. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/namespaces/{namespace}/controllerrevisions/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ControllerRevision
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of ControllerRevision. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/namespaces/{namespace}/controllerrevisions +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of ControllerRevision. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apps/v1/watch/controllerrevisions +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    CustomResourceDefinition v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1CustomResourceDefinition
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    CustomResourceDefinitionSpec
    spec describes how the user wants the resources to appear
    status
    CustomResourceDefinitionStatus
    status indicates the actual state of the CustomResourceDefinition
    +

    CustomResourceDefinitionSpec v1 apiextensions

    + + + + + + + + + + + +
    FieldDescription
    conversion
    CustomResourceConversion
    conversion defines conversion settings for the CRD.
    group
    string
    group is the API group of the defined custom resource. The custom resources are served under `/apis/<group>/...`. Must match the name of the CustomResourceDefinition (in the form `<names.plural>.<group>`).
    names
    CustomResourceDefinitionNames
    names specify the resource and kind names for the custom resource.
    preserveUnknownFields
    boolean
    preserveUnknownFields indicates that object fields which are not specified in the OpenAPI schema should be preserved when persisting to storage. apiVersion, kind, metadata and known fields inside metadata are always preserved. This field is deprecated in favor of setting `x-preserve-unknown-fields` to true in `spec.versions[*].schema.openAPIV3Schema`. See https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/#pruning-versus-preserving-unknown-fields for details.
    scope
    string
    scope indicates whether the defined custom resource is cluster- or namespace-scoped. Allowed values are `Cluster` and `Namespaced`.
    versions
    CustomResourceDefinitionVersion array
    versions is the list of all API versions of the defined custom resource. Version names are used to compute the order in which served versions are listed in API discovery. If the version string is "kube-like", it will sort above non "kube-like" version strings, which are ordered lexicographically. "Kube-like" versions start with a "v", then are followed by a number (the major version), then optionally the string "alpha" or "beta" and another number (the minor version). These are sorted first by GA > beta > alpha (where GA is a version with no suffix such as beta or alpha), and then by comparing major version, then minor version. An example sorted list of versions: v10, v2, v1, v11beta2, v10beta3, v3beta1, v12alpha1, v11alpha2, foo1, foo10.
    +

    CustomResourceDefinitionStatus v1 apiextensions

    + + + + + + + + +
    FieldDescription
    acceptedNames
    CustomResourceDefinitionNames
    acceptedNames are the names that are actually being used to serve discovery. They may be different than the names in spec.
    conditions
    CustomResourceDefinitionCondition array
    conditions indicate state for particular aspects of a CustomResourceDefinition
    storedVersions
    string array
    storedVersions lists all versions of CustomResources that were ever persisted. Tracking these versions allows a migration path for stored versions in etcd. The field is mutable so a migration controller can finish a migration to another version (ensuring no old objects are left in storage), and then remove the rest of the versions from this list. Versions may not be removed from `spec.versions` while they exist in this list.
    +

    CustomResourceDefinitionList v1 apiextensions

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    CustomResourceDefinition array
    items list individual CustomResourceDefinition objects
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard object's metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a CustomResourceDefinition

    +

    HTTP Request

    +POST /apis/apiextensions.k8s.io/v1/customresourcedefinitions +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CustomResourceDefinition
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    CustomResourceDefinition
    OK
    201
    CustomResourceDefinition
    Created
    202
    CustomResourceDefinition
    Accepted
    +

    Patch

    +

    partially update the specified CustomResourceDefinition

    +

    HTTP Request

    +PATCH /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CustomResourceDefinition
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CustomResourceDefinition
    OK
    201
    CustomResourceDefinition
    Created
    +

    Replace

    +

    replace the specified CustomResourceDefinition

    +

    HTTP Request

    +PUT /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CustomResourceDefinition
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CustomResourceDefinition
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CustomResourceDefinition
    OK
    201
    CustomResourceDefinition
    Created
    +

    Delete

    +

    delete a CustomResourceDefinition

    +

    HTTP Request

    +DELETE /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CustomResourceDefinition
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of CustomResourceDefinition

    +

    HTTP Request

    +DELETE /apis/apiextensions.k8s.io/v1/customresourcedefinitions +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified CustomResourceDefinition

    +

    HTTP Request

    +GET /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CustomResourceDefinition
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CustomResourceDefinition
    OK
    +

    List

    +

    list or watch objects of kind CustomResourceDefinition

    +

    HTTP Request

    +GET /apis/apiextensions.k8s.io/v1/customresourcedefinitions +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CustomResourceDefinitionList
    OK
    +

    Watch

    +

    watch changes to an object of kind CustomResourceDefinition. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/apiextensions.k8s.io/v1/watch/customresourcedefinitions/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CustomResourceDefinition
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of CustomResourceDefinition. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apiextensions.k8s.io/v1/watch/customresourcedefinitions +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified CustomResourceDefinition

    +

    HTTP Request

    +PATCH /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CustomResourceDefinition
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CustomResourceDefinition
    OK
    201
    CustomResourceDefinition
    Created
    +

    Read Status

    +

    read status of the specified CustomResourceDefinition

    +

    HTTP Request

    +GET /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CustomResourceDefinition
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CustomResourceDefinition
    OK
    +

    Replace Status

    +

    replace status of the specified CustomResourceDefinition

    +

    HTTP Request

    +PUT /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CustomResourceDefinition
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CustomResourceDefinition
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CustomResourceDefinition
    OK
    201
    CustomResourceDefinition
    Created
    +

    Event v1 events.k8s.io

    + + + + + +
    GroupVersionKind
    events.k8s.iov1Event
    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    action
    string
    action is what action was taken/failed regarding to the regarding object. It is machine-readable. This field cannot be empty for new Events and it can have at most 128 characters.
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    deprecatedCount
    integer
    deprecatedCount is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedFirstTimestamp
    Time
    deprecatedFirstTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedLastTimestamp
    Time
    deprecatedLastTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedSource
    EventSource
    deprecatedSource is the deprecated field assuring backward compatibility with core.v1 Event type.
    eventTime
    MicroTime
    eventTime is the time when this Event was first observed. It is required.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    note
    string
    note is a human-readable description of the status of this operation. Maximal length of the note is 1kB, but libraries should be prepared to handle values up to 64kB.
    reason
    string
    reason is why the action was taken. It is human-readable. This field cannot be empty for new Events and it can have at most 128 characters.
    regarding
    ObjectReference
    regarding contains the object this Event is about. In most cases it's an Object reporting controller implements, e.g. ReplicaSetController implements ReplicaSets and this event is emitted because it acts on some changes in a ReplicaSet object.
    related
    ObjectReference
    related is the optional secondary object for more complex actions. E.g. when regarding object triggers a creation or deletion of related object.
    reportingController
    string
    reportingController is the name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`. This field cannot be empty for new Events.
    reportingInstance
    string
    reportingInstance is the ID of the controller instance, e.g. `kubelet-xyzf`. This field cannot be empty for new Events and it can have at most 128 characters.
    series
    EventSeries
    series is data about the Event series this event represents or nil if it's a singleton Event.
    type
    string
    type is the type of this event (Normal, Warning), new types could be added in the future. It is machine-readable. This field cannot be empty for new Events.
    +

    EventList v1 events

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Event array
    items is a list of schema objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create an Event

    +

    HTTP Request

    +POST /apis/events.k8s.io/v1/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Event
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Event
    OK
    201
    Event
    Created
    202
    Event
    Accepted
    +

    Patch

    +

    partially update the specified Event

    +

    HTTP Request

    +PATCH /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Event
    OK
    201
    Event
    Created
    +

    Replace

    +

    replace the specified Event

    +

    HTTP Request

    +PUT /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Event
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Event
    OK
    201
    Event
    Created
    +

    Delete

    +

    delete an Event

    +

    HTTP Request

    +DELETE /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Event

    +

    HTTP Request

    +DELETE /apis/events.k8s.io/v1/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified Event

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Event
    OK
    +

    List

    +

    list or watch objects of kind Event

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EventList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Event

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1/events +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EventList
    OK
    +

    Watch

    +

    watch changes to an object of kind Event. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1/watch/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Event. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1/watch/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Event. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1/watch/events +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    LimitRange v1 core

    + + + + + +
    GroupVersionKind
    corev1LimitRange
    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    LimitRangeSpec
    Spec defines the limits enforced. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    LimitRangeSpec v1 core

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    limits
    LimitRangeItem array
    Limits is the list of LimitRangeItem objects that are enforced.
    +

    LimitRangeList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    LimitRange array
    Items is a list of LimitRange objects. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a LimitRange

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/limitranges +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    LimitRange
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    LimitRange
    OK
    201
    LimitRange
    Created
    202
    LimitRange
    Accepted
    +

    Patch

    +

    partially update the specified LimitRange

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/limitranges/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the LimitRange
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    LimitRange
    OK
    201
    LimitRange
    Created
    +

    Replace

    +

    replace the specified LimitRange

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/limitranges/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the LimitRange
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    LimitRange
    +

    Response

    + + + + + + +
    CodeDescription
    200
    LimitRange
    OK
    201
    LimitRange
    Created
    +

    Delete

    +

    delete a LimitRange

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/limitranges/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the LimitRange
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of LimitRange

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/limitranges +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified LimitRange

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/limitranges/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the LimitRange
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    LimitRange
    OK
    +

    List

    +

    list or watch objects of kind LimitRange

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/limitranges +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    LimitRangeList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind LimitRange

    +

    HTTP Request

    +GET /api/v1/limitranges +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    LimitRangeList
    OK
    +

    Watch

    +

    watch changes to an object of kind LimitRange. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/limitranges/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the LimitRange
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of LimitRange. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/limitranges +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of LimitRange. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/limitranges +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    HorizontalPodAutoscaler v1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv1HorizontalPodAutoscaler
    +
    Other API versions of this object exist: +v2 +v2beta2 +v2beta1 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    HorizontalPodAutoscalerSpec
    behaviour of autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
    status
    HorizontalPodAutoscalerStatus
    current information about the autoscaler.
    +

    HorizontalPodAutoscalerSpec v1 autoscaling

    + + + + + + + + + +
    FieldDescription
    maxReplicas
    integer
    upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.
    minReplicas
    integer
    minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available.
    scaleTargetRef
    CrossVersionObjectReference
    reference to scaled resource; horizontal pod autoscaler will learn the current resource consumption and will set the desired number of pods by using its Scale subresource.
    targetCPUUtilizationPercentage
    integer
    target average CPU utilization (represented as a percentage of requested CPU) over all the pods; if not specified the default autoscaling policy will be used.
    +

    HorizontalPodAutoscalerStatus v1 autoscaling

    + + + + + + + + + + +
    FieldDescription
    currentCPUUtilizationPercentage
    integer
    current average CPU utilization over all pods, represented as a percentage of requested CPU, e.g. 70 means that an average pod is using now 70% of its requested CPU.
    currentReplicas
    integer
    current number of replicas of pods managed by this autoscaler.
    desiredReplicas
    integer
    desired number of replicas of pods managed by this autoscaler.
    lastScaleTime
    Time
    last time the HorizontalPodAutoscaler scaled the number of pods; used by the autoscaler to control how often the number of pods is changed.
    observedGeneration
    integer
    most recent generation observed by this autoscaler.
    +

    HorizontalPodAutoscalerList v1 autoscaling

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    HorizontalPodAutoscaler array
    list of horizontal pod autoscaler objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata.
    +

    Write Operations

    +

    Create

    +

    create a HorizontalPodAutoscaler

    +

    HTTP Request

    +POST /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    202
    HorizontalPodAutoscaler
    Accepted
    +

    Patch

    +

    partially update the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PATCH /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Replace

    +

    replace the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PUT /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Delete

    +

    delete a HorizontalPodAutoscaler

    +

    HTTP Request

    +DELETE /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of HorizontalPodAutoscaler

    +

    HTTP Request

    +DELETE /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    +

    List

    +

    list or watch objects of kind HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscalerList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v1/horizontalpodautoscalers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscalerList
    OK
    +

    Watch

    +

    watch changes to an object of kind HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/autoscaling/v1/watch/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/autoscaling/v1/watch/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/autoscaling/v1/watch/horizontalpodautoscalers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PATCH /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Read Status

    +

    read status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    +

    Replace Status

    +

    replace status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PUT /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    MutatingWebhookConfiguration v1 admissionregistration.k8s.io

    + + + + + +
    GroupVersionKind
    admissionregistration.k8s.iov1MutatingWebhookConfiguration
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
    webhooks
    MutatingWebhook array
    patch strategy: merge
    patch merge key: name
    Webhooks is a list of webhooks and the affected resources and operations.
    +

    MutatingWebhookConfigurationList v1 admissionregistration

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    MutatingWebhookConfiguration array
    List of MutatingWebhookConfiguration.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a MutatingWebhookConfiguration

    +

    HTTP Request

    +POST /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    MutatingWebhookConfiguration
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    MutatingWebhookConfiguration
    OK
    201
    MutatingWebhookConfiguration
    Created
    202
    MutatingWebhookConfiguration
    Accepted
    +

    Patch

    +

    partially update the specified MutatingWebhookConfiguration

    +

    HTTP Request

    +PATCH /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the MutatingWebhookConfiguration
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    MutatingWebhookConfiguration
    OK
    201
    MutatingWebhookConfiguration
    Created
    +

    Replace

    +

    replace the specified MutatingWebhookConfiguration

    +

    HTTP Request

    +PUT /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the MutatingWebhookConfiguration
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    MutatingWebhookConfiguration
    +

    Response

    + + + + + + +
    CodeDescription
    200
    MutatingWebhookConfiguration
    OK
    201
    MutatingWebhookConfiguration
    Created
    +

    Delete

    +

    delete a MutatingWebhookConfiguration

    +

    HTTP Request

    +DELETE /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the MutatingWebhookConfiguration
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of MutatingWebhookConfiguration

    +

    HTTP Request

    +DELETE /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified MutatingWebhookConfiguration

    +

    HTTP Request

    +GET /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the MutatingWebhookConfiguration
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    MutatingWebhookConfiguration
    OK
    +

    List

    +

    list or watch objects of kind MutatingWebhookConfiguration

    +

    HTTP Request

    +GET /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    MutatingWebhookConfigurationList
    OK
    +

    Watch

    +

    watch changes to an object of kind MutatingWebhookConfiguration. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/admissionregistration.k8s.io/v1/watch/mutatingwebhookconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the MutatingWebhookConfiguration
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of MutatingWebhookConfiguration. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/admissionregistration.k8s.io/v1/watch/mutatingwebhookconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    ValidatingWebhookConfiguration v1 admissionregistration.k8s.io

    + + + + + +
    GroupVersionKind
    admissionregistration.k8s.iov1ValidatingWebhookConfiguration
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
    webhooks
    ValidatingWebhook array
    patch strategy: merge
    patch merge key: name
    Webhooks is a list of webhooks and the affected resources and operations.
    +

    ValidatingWebhookConfigurationList v1 admissionregistration

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    ValidatingWebhookConfiguration array
    List of ValidatingWebhookConfiguration.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a ValidatingWebhookConfiguration

    +

    HTTP Request

    +POST /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ValidatingWebhookConfiguration
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    ValidatingWebhookConfiguration
    OK
    201
    ValidatingWebhookConfiguration
    Created
    202
    ValidatingWebhookConfiguration
    Accepted
    +

    Patch

    +

    partially update the specified ValidatingWebhookConfiguration

    +

    HTTP Request

    +PATCH /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ValidatingWebhookConfiguration
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ValidatingWebhookConfiguration
    OK
    201
    ValidatingWebhookConfiguration
    Created
    +

    Replace

    +

    replace the specified ValidatingWebhookConfiguration

    +

    HTTP Request

    +PUT /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ValidatingWebhookConfiguration
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ValidatingWebhookConfiguration
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ValidatingWebhookConfiguration
    OK
    201
    ValidatingWebhookConfiguration
    Created
    +

    Delete

    +

    delete a ValidatingWebhookConfiguration

    +

    HTTP Request

    +DELETE /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ValidatingWebhookConfiguration
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of ValidatingWebhookConfiguration

    +

    HTTP Request

    +DELETE /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified ValidatingWebhookConfiguration

    +

    HTTP Request

    +GET /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ValidatingWebhookConfiguration
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ValidatingWebhookConfiguration
    OK
    +

    List

    +

    list or watch objects of kind ValidatingWebhookConfiguration

    +

    HTTP Request

    +GET /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ValidatingWebhookConfigurationList
    OK
    +

    Watch

    +

    watch changes to an object of kind ValidatingWebhookConfiguration. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/admissionregistration.k8s.io/v1/watch/validatingwebhookconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ValidatingWebhookConfiguration
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of ValidatingWebhookConfiguration. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/admissionregistration.k8s.io/v1/watch/validatingwebhookconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    PodTemplate v1 core

    + + + + + +
    GroupVersionKind
    corev1PodTemplate
    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    template
    PodTemplateSpec
    Template defines the pods that will be created from this pod template. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    PodTemplateSpec v1 core

    + + + + + + + +
    FieldDescription
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    PodSpec
    Specification of the desired behavior of the pod. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    PodTemplateList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    PodTemplate array
    List of pod templates
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a PodTemplate

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/podtemplates +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PodTemplate
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    PodTemplate
    OK
    201
    PodTemplate
    Created
    202
    PodTemplate
    Accepted
    +

    Patch

    +

    partially update the specified PodTemplate

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/podtemplates/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodTemplate
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodTemplate
    OK
    201
    PodTemplate
    Created
    +

    Replace

    +

    replace the specified PodTemplate

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/podtemplates/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodTemplate
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PodTemplate
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodTemplate
    OK
    201
    PodTemplate
    Created
    +

    Delete

    +

    delete a PodTemplate

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/podtemplates/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodTemplate
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodTemplate
    OK
    202
    PodTemplate
    Accepted
    +

    Delete Collection

    +

    delete collection of PodTemplate

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/podtemplates +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified PodTemplate

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/podtemplates/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodTemplate
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodTemplate
    OK
    +

    List

    +

    list or watch objects of kind PodTemplate

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/podtemplates +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodTemplateList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind PodTemplate

    +

    HTTP Request

    +GET /api/v1/podtemplates +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodTemplateList
    OK
    +

    Watch

    +

    watch changes to an object of kind PodTemplate. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/podtemplates/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodTemplate
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of PodTemplate. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/podtemplates +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of PodTemplate. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/podtemplates +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    PodDisruptionBudget v1 policy

    + + + + + +
    GroupVersionKind
    policyv1PodDisruptionBudget
    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    PodDisruptionBudgetSpec
    Specification of the desired behavior of the PodDisruptionBudget.
    status
    PodDisruptionBudgetStatus
    Most recently observed status of the PodDisruptionBudget.
    +

    PodDisruptionBudgetSpec v1 policy

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    maxUnavailableAn eviction is allowed if at most "maxUnavailable" pods selected by "selector" are unavailable after the eviction, i.e. even in absence of the evicted pod. For example, one can prevent all voluntary evictions by specifying 0. This is a mutually exclusive setting with "minAvailable".
    minAvailableAn eviction is allowed if at least "minAvailable" pods selected by "selector" will still be available after the eviction, i.e. even in the absence of the evicted pod. So for example you can prevent all voluntary evictions by specifying "100%".
    selector
    LabelSelector
    patch strategy: replace
    Label query over pods whose evictions are managed by the disruption budget. A null selector will match no pods, while an empty ({}) selector will select all pods within the namespace.
    +

    PodDisruptionBudgetStatus v1 policy

    +
    Appears In: + +
    + + + + + + + + + + + +
    FieldDescription
    conditions
    Condition array
    patch strategy: merge
    patch merge key: type
    Conditions contain conditions for PDB. The disruption controller sets the DisruptionAllowed condition. The following are known values for the reason field (additional reasons could be added in the future): - SyncFailed: The controller encountered an error and wasn't able to compute the number of allowed disruptions. Therefore no disruptions are allowed and the status of the condition will be False. - InsufficientPods: The number of pods are either at or below the number required by the PodDisruptionBudget. No disruptions are allowed and the status of the condition will be False. - SufficientPods: There are more pods than required by the PodDisruptionBudget. The condition will be True, and the number of allowed disruptions are provided by the disruptionsAllowed property.
    currentHealthy
    integer
    current number of healthy pods
    desiredHealthy
    integer
    minimum desired number of healthy pods
    disruptedPods
    object
    DisruptedPods contains information about pods whose eviction was processed by the API server eviction subresource handler but has not yet been observed by the PodDisruptionBudget controller. A pod will be in this map from the time when the API server processed the eviction request to the time when the pod is seen by PDB controller as having been marked for deletion (or after a timeout). The key in the map is the name of the pod and the value is the time when the API server processed the eviction request. If the deletion didn't occur and a pod is still there it will be removed from the list automatically by PodDisruptionBudget controller after some time. If everything goes smooth this map should be empty for the most of the time. Large number of entries in the map may indicate problems with pod deletions.
    disruptionsAllowed
    integer
    Number of pod disruptions that are currently allowed.
    expectedPods
    integer
    total number of pods counted by this disruption budget
    observedGeneration
    integer
    Most recent generation observed when updating this PDB status. DisruptionsAllowed and other status information is valid only if observedGeneration equals to PDB's object generation.
    +

    PodDisruptionBudgetList v1 policy

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    PodDisruptionBudget array
    Items is a list of PodDisruptionBudgets
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a PodDisruptionBudget

    +

    HTTP Request

    +POST /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PodDisruptionBudget
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    201
    PodDisruptionBudget
    Created
    202
    PodDisruptionBudget
    Accepted
    +

    Patch

    +

    partially update the specified PodDisruptionBudget

    +

    HTTP Request

    +PATCH /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    201
    PodDisruptionBudget
    Created
    +

    Replace

    +

    replace the specified PodDisruptionBudget

    +

    HTTP Request

    +PUT /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PodDisruptionBudget
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    201
    PodDisruptionBudget
    Created
    +

    Delete

    +

    delete a PodDisruptionBudget

    +

    HTTP Request

    +DELETE /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of PodDisruptionBudget

    +

    HTTP Request

    +DELETE /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified PodDisruptionBudget

    +

    HTTP Request

    +GET /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    +

    List

    +

    list or watch objects of kind PodDisruptionBudget

    +

    HTTP Request

    +GET /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodDisruptionBudgetList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind PodDisruptionBudget

    +

    HTTP Request

    +GET /apis/policy/v1/poddisruptionbudgets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodDisruptionBudgetList
    OK
    +

    Watch

    +

    watch changes to an object of kind PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/policy/v1/watch/namespaces/{namespace}/poddisruptionbudgets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/policy/v1/watch/namespaces/{namespace}/poddisruptionbudgets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/policy/v1/watch/poddisruptionbudgets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified PodDisruptionBudget

    +

    HTTP Request

    +PATCH /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    201
    PodDisruptionBudget
    Created
    +

    Read Status

    +

    read status of the specified PodDisruptionBudget

    +

    HTTP Request

    +GET /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    +

    Replace Status

    +

    replace status of the specified PodDisruptionBudget

    +

    HTTP Request

    +PUT /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PodDisruptionBudget
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    201
    PodDisruptionBudget
    Created
    +

    PriorityClass v1 scheduling.k8s.io

    + + + + + +
    GroupVersionKind
    scheduling.k8s.iov1PriorityClass
    + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    description
    string
    description is an arbitrary string that usually provides guidelines on when this priority class should be used.
    globalDefault
    boolean
    globalDefault specifies whether this PriorityClass should be considered as the default priority for pods that do not have any priority class. Only one PriorityClass can be marked as `globalDefault`. However, if more than one PriorityClasses exists with their `globalDefault` field set to true, the smallest value of such global default PriorityClasses will be used as the default priority.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    preemptionPolicy
    string
    PreemptionPolicy is the Policy for preempting pods with lower priority. One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset. This field is beta-level, gated by the NonPreemptingPriority feature-gate.
    value
    integer
    The value of this priority class. This is the actual priority that pods receive when they have the name of this class in their pod spec.
    +

    PriorityClassList v1 scheduling

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    PriorityClass array
    items is the list of PriorityClasses
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a PriorityClass

    +

    HTTP Request

    +POST /apis/scheduling.k8s.io/v1/priorityclasses +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PriorityClass
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    PriorityClass
    OK
    201
    PriorityClass
    Created
    202
    PriorityClass
    Accepted
    +

    Patch

    +

    partially update the specified PriorityClass

    +

    HTTP Request

    +PATCH /apis/scheduling.k8s.io/v1/priorityclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PriorityClass
    OK
    201
    PriorityClass
    Created
    +

    Replace

    +

    replace the specified PriorityClass

    +

    HTTP Request

    +PUT /apis/scheduling.k8s.io/v1/priorityclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityClass
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PriorityClass
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PriorityClass
    OK
    201
    PriorityClass
    Created
    +

    Delete

    +

    delete a PriorityClass

    +

    HTTP Request

    +DELETE /apis/scheduling.k8s.io/v1/priorityclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of PriorityClass

    +

    HTTP Request

    +DELETE /apis/scheduling.k8s.io/v1/priorityclasses +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified PriorityClass

    +

    HTTP Request

    +GET /apis/scheduling.k8s.io/v1/priorityclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityClass
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PriorityClass
    OK
    +

    List

    +

    list or watch objects of kind PriorityClass

    +

    HTTP Request

    +GET /apis/scheduling.k8s.io/v1/priorityclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PriorityClassList
    OK
    +

    Watch

    +

    watch changes to an object of kind PriorityClass. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/scheduling.k8s.io/v1/watch/priorityclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityClass
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of PriorityClass. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/scheduling.k8s.io/v1/watch/priorityclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    PodSecurityPolicy v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1PodSecurityPolicy
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    PodSecurityPolicySpec
    spec defines the policy enforced.
    +

    PodSecurityPolicySpec v1beta1 policy

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    allowPrivilegeEscalation
    boolean
    allowPrivilegeEscalation determines if a pod can request to allow privilege escalation. If unspecified, defaults to true.
    allowedCSIDrivers
    AllowedCSIDriver array
    AllowedCSIDrivers is an allowlist of inline CSI drivers that must be explicitly set to be embedded within a pod spec. An empty value indicates that any CSI driver can be used for inline ephemeral volumes. This is a beta field, and is only honored if the API server enables the CSIInlineVolume feature gate.
    allowedCapabilities
    string array
    allowedCapabilities is a list of capabilities that can be requested to add to the container. Capabilities in this field may be added at the pod author's discretion. You must not list a capability in both allowedCapabilities and requiredDropCapabilities.
    allowedFlexVolumes
    AllowedFlexVolume array
    allowedFlexVolumes is an allowlist of Flexvolumes. Empty or nil indicates that all Flexvolumes may be used. This parameter is effective only when the usage of the Flexvolumes is allowed in the "volumes" field.
    allowedHostPaths
    AllowedHostPath array
    allowedHostPaths is an allowlist of host paths. Empty indicates that all host paths may be used.
    allowedProcMountTypes
    string array
    AllowedProcMountTypes is an allowlist of allowed ProcMountTypes. Empty or nil indicates that only the DefaultProcMountType may be used. This requires the ProcMountType feature flag to be enabled.
    allowedUnsafeSysctls
    string array
    allowedUnsafeSysctls is a list of explicitly allowed unsafe sysctls, defaults to none. Each entry is either a plain sysctl name or ends in "*" in which case it is considered as a prefix of allowed sysctls. Single * means all unsafe sysctls are allowed. Kubelet has to allowlist all allowed unsafe sysctls explicitly to avoid rejection. Examples: e.g. "foo/*" allows "foo/bar", "foo/baz", etc. e.g. "foo.*" allows "foo.bar", "foo.baz", etc.
    defaultAddCapabilities
    string array
    defaultAddCapabilities is the default set of capabilities that will be added to the container unless the pod spec specifically drops the capability. You may not list a capability in both defaultAddCapabilities and requiredDropCapabilities. Capabilities added here are implicitly allowed, and need not be included in the allowedCapabilities list.
    defaultAllowPrivilegeEscalation
    boolean
    defaultAllowPrivilegeEscalation controls the default setting for whether a process can gain more privileges than its parent process.
    forbiddenSysctls
    string array
    forbiddenSysctls is a list of explicitly forbidden sysctls, defaults to none. Each entry is either a plain sysctl name or ends in "*" in which case it is considered as a prefix of forbidden sysctls. Single * means all sysctls are forbidden. Examples: e.g. "foo/*" forbids "foo/bar", "foo/baz", etc. e.g. "foo.*" forbids "foo.bar", "foo.baz", etc.
    fsGroup
    FSGroupStrategyOptions
    fsGroup is the strategy that will dictate what fs group is used by the SecurityContext.
    hostIPC
    boolean
    hostIPC determines if the policy allows the use of HostIPC in the pod spec.
    hostNetwork
    boolean
    hostNetwork determines if the policy allows the use of HostNetwork in the pod spec.
    hostPID
    boolean
    hostPID determines if the policy allows the use of HostPID in the pod spec.
    hostPorts
    HostPortRange array
    hostPorts determines which host port ranges are allowed to be exposed.
    privileged
    boolean
    privileged determines if a pod can request to be run as privileged.
    readOnlyRootFilesystem
    boolean
    readOnlyRootFilesystem when set to true will force containers to run with a read only root file system. If the container specifically requests to run with a non-read only root file system the PSP should deny the pod. If set to false the container may run with a read only root file system if it wishes but it will not be forced to.
    requiredDropCapabilities
    string array
    requiredDropCapabilities are the capabilities that will be dropped from the container. These are required to be dropped and cannot be added.
    runAsGroup
    RunAsGroupStrategyOptions
    RunAsGroup is the strategy that will dictate the allowable RunAsGroup values that may be set. If this field is omitted, the pod's RunAsGroup can take any value. This field requires the RunAsGroup feature gate to be enabled.
    runAsUser
    RunAsUserStrategyOptions
    runAsUser is the strategy that will dictate the allowable RunAsUser values that may be set.
    runtimeClass
    RuntimeClassStrategyOptions
    runtimeClass is the strategy that will dictate the allowable RuntimeClasses for a pod. If this field is omitted, the pod's runtimeClassName field is unrestricted. Enforcement of this field depends on the RuntimeClass feature gate being enabled.
    seLinux
    SELinuxStrategyOptions
    seLinux is the strategy that will dictate the allowable labels that may be set.
    supplementalGroups
    SupplementalGroupsStrategyOptions
    supplementalGroups is the strategy that will dictate what supplemental groups are used by the SecurityContext.
    volumes
    string array
    volumes is an allowlist of volume plugins. Empty indicates that no volumes may be used. To allow all volumes you may use '\*'.
    +

    PodSecurityPolicyList v1beta1 policy

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    PodSecurityPolicy array
    items is a list of schema objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a PodSecurityPolicy

    +

    HTTP Request

    +POST /apis/policy/v1beta1/podsecuritypolicies +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PodSecurityPolicy
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    PodSecurityPolicy
    OK
    201
    PodSecurityPolicy
    Created
    202
    PodSecurityPolicy
    Accepted
    +

    Patch

    +

    partially update the specified PodSecurityPolicy

    +

    HTTP Request

    +PATCH /apis/policy/v1beta1/podsecuritypolicies/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PodSecurityPolicy
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodSecurityPolicy
    OK
    201
    PodSecurityPolicy
    Created
    +

    Replace

    +

    replace the specified PodSecurityPolicy

    +

    HTTP Request

    +PUT /apis/policy/v1beta1/podsecuritypolicies/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PodSecurityPolicy
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PodSecurityPolicy
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodSecurityPolicy
    OK
    201
    PodSecurityPolicy
    Created
    +

    Delete

    +

    delete a PodSecurityPolicy

    +

    HTTP Request

    +DELETE /apis/policy/v1beta1/podsecuritypolicies/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PodSecurityPolicy
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodSecurityPolicy
    OK
    202
    PodSecurityPolicy
    Accepted
    +

    Delete Collection

    +

    delete collection of PodSecurityPolicy

    +

    HTTP Request

    +DELETE /apis/policy/v1beta1/podsecuritypolicies +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified PodSecurityPolicy

    +

    HTTP Request

    +GET /apis/policy/v1beta1/podsecuritypolicies/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PodSecurityPolicy
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodSecurityPolicy
    OK
    +

    List

    +

    list or watch objects of kind PodSecurityPolicy

    +

    HTTP Request

    +GET /apis/policy/v1beta1/podsecuritypolicies +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodSecurityPolicyList
    OK
    +

    Watch

    +

    watch changes to an object of kind PodSecurityPolicy. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/policy/v1beta1/watch/podsecuritypolicies/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PodSecurityPolicy
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of PodSecurityPolicy. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/policy/v1beta1/watch/podsecuritypolicies +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    CLUSTER

    + +

    Cluster resources are responsible for defining configuration of the cluster itself, and are generally only used by cluster operators.

    + +
    +

    APIService v1 apiregistration.k8s.io

    + + + + + +
    GroupVersionKind
    apiregistration.k8s.iov1APIService
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    APIServiceSpec
    Spec contains information for locating and communicating with a server
    status
    APIServiceStatus
    Status contains derived information about an API server
    +

    APIServiceSpec v1 apiregistration

    +
    Appears In: + +
    + + + + + + + + + + + +
    FieldDescription
    caBundle
    string
    CABundle is a PEM encoded CA bundle which will be used to validate an API server's serving certificate. If unspecified, system trust roots on the apiserver are used.
    group
    string
    Group is the API group name this server hosts
    groupPriorityMinimum
    integer
    GroupPriorityMininum is the priority this group should have at least. Higher priority means that the group is preferred by clients over lower priority ones. Note that other versions of this group might specify even higher GroupPriorityMininum values such that the whole group gets a higher priority. The primary sort is based on GroupPriorityMinimum, ordered highest number to lowest (20 before 10). The secondary sort is based on the alphabetical comparison of the name of the object. (v1.bar before v1.foo) We'd recommend something like: *.k8s.io (except extensions) at 18000 and PaaSes (OpenShift, Deis) are recommended to be in the 2000s
    insecureSkipTLSVerify
    boolean
    InsecureSkipTLSVerify disables TLS certificate verification when communicating with this server. This is strongly discouraged. You should use the CABundle instead.
    service
    ServiceReference
    Service is a reference to the service for this API server. It must communicate on port 443. If the Service is nil, that means the handling for the API groupversion is handled locally on this server. The call will simply delegate to the normal handler chain to be fulfilled.
    version
    string
    Version is the API version this server hosts. For example, "v1"
    versionPriority
    integer
    VersionPriority controls the ordering of this API version inside of its group. Must be greater than zero. The primary sort is based on VersionPriority, ordered highest to lowest (20 before 10). Since it's inside of a group, the number can be small, probably in the 10s. In case of equal version priorities, the version string will be used to compute the order inside a group. If the version string is "kube-like", it will sort above non "kube-like" version strings, which are ordered lexicographically. "Kube-like" versions start with a "v", then are followed by a number (the major version), then optionally the string "alpha" or "beta" and another number (the minor version). These are sorted first by GA > beta > alpha (where GA is a version with no suffix such as beta or alpha), and then by comparing major version, then minor version. An example sorted list of versions: v10, v2, v1, v11beta2, v10beta3, v3beta1, v12alpha1, v11alpha2, foo1, foo10.
    +

    APIServiceStatus v1 apiregistration

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    conditions
    APIServiceCondition array
    patch strategy: merge
    patch merge key: type
    Current service state of apiService.
    +

    APIServiceList v1 apiregistration

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    APIService array
    Items is the list of APIService
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create an APIService

    +

    HTTP Request

    +POST /apis/apiregistration.k8s.io/v1/apiservices +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    APIService
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    APIService
    OK
    201
    APIService
    Created
    202
    APIService
    Accepted
    +

    Patch

    +

    partially update the specified APIService

    +

    HTTP Request

    +PATCH /apis/apiregistration.k8s.io/v1/apiservices/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the APIService
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    APIService
    OK
    201
    APIService
    Created
    +

    Replace

    +

    replace the specified APIService

    +

    HTTP Request

    +PUT /apis/apiregistration.k8s.io/v1/apiservices/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the APIService
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    APIService
    +

    Response

    + + + + + + +
    CodeDescription
    200
    APIService
    OK
    201
    APIService
    Created
    +

    Delete

    +

    delete an APIService

    +

    HTTP Request

    +DELETE /apis/apiregistration.k8s.io/v1/apiservices/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the APIService
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of APIService

    +

    HTTP Request

    +DELETE /apis/apiregistration.k8s.io/v1/apiservices +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified APIService

    +

    HTTP Request

    +GET /apis/apiregistration.k8s.io/v1/apiservices/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the APIService
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    APIService
    OK
    +

    List

    +

    list or watch objects of kind APIService

    +

    HTTP Request

    +GET /apis/apiregistration.k8s.io/v1/apiservices +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    APIServiceList
    OK
    +

    Watch

    +

    watch changes to an object of kind APIService. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/apiregistration.k8s.io/v1/watch/apiservices/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the APIService
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of APIService. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/apiregistration.k8s.io/v1/watch/apiservices +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified APIService

    +

    HTTP Request

    +PATCH /apis/apiregistration.k8s.io/v1/apiservices/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the APIService
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    APIService
    OK
    201
    APIService
    Created
    +

    Read Status

    +

    read status of the specified APIService

    +

    HTTP Request

    +GET /apis/apiregistration.k8s.io/v1/apiservices/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the APIService
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    APIService
    OK
    +

    Replace Status

    +

    replace status of the specified APIService

    +

    HTTP Request

    +PUT /apis/apiregistration.k8s.io/v1/apiservices/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the APIService
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    APIService
    +

    Response

    + + + + + + +
    CodeDescription
    200
    APIService
    OK
    201
    APIService
    Created
    +

    Binding v1 core

    + + + + + +
    GroupVersionKind
    corev1Binding
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    target
    ObjectReference
    The target object that you want to bind to the standard object.
    +

    Write Operations

    +

    Create

    +

    create a Binding

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/bindings +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    prettyIf 'true', then the output is pretty printed.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Binding
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Binding
    OK
    201
    Binding
    Created
    202
    Binding
    Accepted
    +

    CertificateSigningRequest v1 certificates.k8s.io

    + + + + + +
    GroupVersionKind
    certificates.k8s.iov1CertificateSigningRequest
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    spec
    CertificateSigningRequestSpec
    spec contains the certificate request, and is immutable after creation. Only the request, signerName, expirationSeconds, and usages fields can be set on creation. Other fields are derived by Kubernetes and cannot be modified by users.
    status
    CertificateSigningRequestStatus
    status contains information about whether the request is approved or denied, and the certificate issued by the signer, or the failure condition indicating signer failure.
    +

    CertificateSigningRequestSpec v1 certificates

    + + + + + + + + + + + + + +
    FieldDescription
    expirationSeconds
    integer
    expirationSeconds is the requested duration of validity of the issued certificate. The certificate signer may issue a certificate with a different validity duration so a client must check the delta between the notBefore and and notAfter fields in the issued certificate to determine the actual duration. The v1.22+ in-tree implementations of the well-known Kubernetes signers will honor this field as long as the requested duration is not greater than the maximum duration they will honor per the --cluster-signing-duration CLI flag to the Kubernetes controller manager. Certificate signers may not honor this field for various reasons: 1. Old signer that is unaware of the field (such as the in-tree implementations prior to v1.22) 2. Signer whose configured maximum is shorter than the requested duration 3. Signer whose configured minimum is longer than the requested duration The minimum valid value for expirationSeconds is 600, i.e. 10 minutes. As of v1.22, this field is beta and is controlled via the CSRDuration feature gate.
    extra
    object
    extra contains extra attributes of the user that created the CertificateSigningRequest. Populated by the API server on creation and immutable.
    groups
    string array
    groups contains group membership of the user that created the CertificateSigningRequest. Populated by the API server on creation and immutable.
    request
    string
    request contains an x509 certificate signing request encoded in a "CERTIFICATE REQUEST" PEM block. When serialized as JSON or YAML, the data is additionally base64-encoded.
    signerName
    string
    signerName indicates the requested signer, and is a qualified name. List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector. Well-known Kubernetes signers are: 1. "kubernetes.io/kube-apiserver-client": issues client certificates that can be used to authenticate to kube-apiserver. Requests for this signer are never auto-approved by kube-controller-manager, can be issued by the "csrsigning" controller in kube-controller-manager. 2. "kubernetes.io/kube-apiserver-client-kubelet": issues client certificates that kubelets use to authenticate to kube-apiserver. Requests for this signer can be auto-approved by the "csrapproving" controller in kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager. 3. "kubernetes.io/kubelet-serving" issues serving certificates that kubelets use to serve TLS endpoints, which kube-apiserver can connect to securely. Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager. More details are available at https://k8s.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers Custom signerNames can also be specified. The signer defines: 1. Trust distribution: how trust (CA bundles) are distributed. 2. Permitted subjects: and behavior when a disallowed subject is requested. 3. Required, permitted, or forbidden x509 extensions in the request (including whether subjectAltNames are allowed, which types, restrictions on allowed values) and behavior when a disallowed extension is requested. 4. Required, permitted, or forbidden key usages / extended key usages. 5. Expiration/certificate lifetime: whether it is fixed by the signer, configurable by the admin. 6. Whether or not requests for CA certificates are allowed.
    uid
    string
    uid contains the uid of the user that created the CertificateSigningRequest. Populated by the API server on creation and immutable.
    usages
    string array
    usages specifies a set of key usages requested in the issued certificate. Requests for TLS client certificates typically request: "digital signature", "key encipherment", "client auth". Requests for TLS serving certificates typically request: "key encipherment", "digital signature", "server auth". Valid values are: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"
    username
    string
    username contains the name of the user that created the CertificateSigningRequest. Populated by the API server on creation and immutable.
    +

    CertificateSigningRequestStatus v1 certificates

    + + + + + + + +
    FieldDescription
    certificate
    string
    certificate is populated with an issued certificate by the signer after an Approved condition is present. This field is set via the /status subresource. Once populated, this field is immutable. If the certificate signing request is denied, a condition of type "Denied" is added and this field remains empty. If the signer cannot issue the certificate, a condition of type "Failed" is added and this field remains empty. Validation requirements: 1. certificate must contain one or more PEM blocks. 2. All PEM blocks must have the "CERTIFICATE" label, contain no headers, and the encoded data must be a BER-encoded ASN.1 Certificate structure as described in section 4 of RFC5280. 3. Non-PEM content may appear before or after the "CERTIFICATE" PEM blocks and is unvalidated, to allow for explanatory text as described in section 5.2 of RFC7468. If more than one PEM block is present, and the definition of the requested spec.signerName does not indicate otherwise, the first block is the issued certificate, and subsequent blocks should be treated as intermediate certificates and presented in TLS handshakes. The certificate is encoded in PEM format. When serialized as JSON or YAML, the data is additionally base64-encoded, so it consists of: base64( -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- )
    conditions
    CertificateSigningRequestCondition array
    conditions applied to the request. Known conditions are "Approved", "Denied", and "Failed".
    +

    CertificateSigningRequestList v1 certificates

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    CertificateSigningRequest array
    items is a collection of CertificateSigningRequest objects
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    +

    Write Operations

    +

    Create

    +

    create a CertificateSigningRequest

    +

    HTTP Request

    +POST /apis/certificates.k8s.io/v1/certificatesigningrequests +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CertificateSigningRequest
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    CertificateSigningRequest
    OK
    201
    CertificateSigningRequest
    Created
    202
    CertificateSigningRequest
    Accepted
    +

    Patch

    +

    partially update the specified CertificateSigningRequest

    +

    HTTP Request

    +PATCH /apis/certificates.k8s.io/v1/certificatesigningrequests/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CertificateSigningRequest
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CertificateSigningRequest
    OK
    201
    CertificateSigningRequest
    Created
    +

    Replace

    +

    replace the specified CertificateSigningRequest

    +

    HTTP Request

    +PUT /apis/certificates.k8s.io/v1/certificatesigningrequests/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CertificateSigningRequest
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CertificateSigningRequest
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CertificateSigningRequest
    OK
    201
    CertificateSigningRequest
    Created
    +

    Delete

    +

    delete a CertificateSigningRequest

    +

    HTTP Request

    +DELETE /apis/certificates.k8s.io/v1/certificatesigningrequests/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CertificateSigningRequest
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of CertificateSigningRequest

    +

    HTTP Request

    +DELETE /apis/certificates.k8s.io/v1/certificatesigningrequests +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified CertificateSigningRequest

    +

    HTTP Request

    +GET /apis/certificates.k8s.io/v1/certificatesigningrequests/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CertificateSigningRequest
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CertificateSigningRequest
    OK
    +

    List

    +

    list or watch objects of kind CertificateSigningRequest

    +

    HTTP Request

    +GET /apis/certificates.k8s.io/v1/certificatesigningrequests +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CertificateSigningRequestList
    OK
    +

    Watch

    +

    watch changes to an object of kind CertificateSigningRequest. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/certificates.k8s.io/v1/watch/certificatesigningrequests/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CertificateSigningRequest
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of CertificateSigningRequest. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/certificates.k8s.io/v1/watch/certificatesigningrequests +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified CertificateSigningRequest

    +

    HTTP Request

    +PATCH /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CertificateSigningRequest
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CertificateSigningRequest
    OK
    201
    CertificateSigningRequest
    Created
    +

    Read Status

    +

    read status of the specified CertificateSigningRequest

    +

    HTTP Request

    +GET /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CertificateSigningRequest
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CertificateSigningRequest
    OK
    +

    Replace Status

    +

    replace status of the specified CertificateSigningRequest

    +

    HTTP Request

    +PUT /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the CertificateSigningRequest
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CertificateSigningRequest
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CertificateSigningRequest
    OK
    201
    CertificateSigningRequest
    Created
    +

    ClusterRole v1 rbac.authorization.k8s.io

    + + + + + +
    GroupVersionKind
    rbac.authorization.k8s.iov1ClusterRole
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    aggregationRule
    AggregationRule
    AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller.
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata.
    rules
    PolicyRule array
    Rules holds all the PolicyRules for this ClusterRole
    +

    ClusterRoleList v1 rbac

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    ClusterRole array
    Items is a list of ClusterRoles
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard object's metadata.
    +

    Write Operations

    +

    Create

    +

    create a ClusterRole

    +

    HTTP Request

    +POST /apis/rbac.authorization.k8s.io/v1/clusterroles +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ClusterRole
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    ClusterRole
    OK
    201
    ClusterRole
    Created
    202
    ClusterRole
    Accepted
    +

    Patch

    +

    partially update the specified ClusterRole

    +

    HTTP Request

    +PATCH /apis/rbac.authorization.k8s.io/v1/clusterroles/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ClusterRole
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ClusterRole
    OK
    201
    ClusterRole
    Created
    +

    Replace

    +

    replace the specified ClusterRole

    +

    HTTP Request

    +PUT /apis/rbac.authorization.k8s.io/v1/clusterroles/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ClusterRole
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ClusterRole
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ClusterRole
    OK
    201
    ClusterRole
    Created
    +

    Delete

    +

    delete a ClusterRole

    +

    HTTP Request

    +DELETE /apis/rbac.authorization.k8s.io/v1/clusterroles/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ClusterRole
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of ClusterRole

    +

    HTTP Request

    +DELETE /apis/rbac.authorization.k8s.io/v1/clusterroles +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified ClusterRole

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/clusterroles/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ClusterRole
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ClusterRole
    OK
    +

    List

    +

    list or watch objects of kind ClusterRole

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/clusterroles +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ClusterRoleList
    OK
    +

    Watch

    +

    watch changes to an object of kind ClusterRole. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/watch/clusterroles/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ClusterRole
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of ClusterRole. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/watch/clusterroles +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    ClusterRoleBinding v1 rbac.authorization.k8s.io

    + + + + + +
    GroupVersionKind
    rbac.authorization.k8s.iov1ClusterRoleBinding
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata.
    roleRef
    RoleRef
    RoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.
    subjects
    Subject array
    Subjects holds references to the objects the role applies to.
    +

    ClusterRoleBindingList v1 rbac

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    ClusterRoleBinding array
    Items is a list of ClusterRoleBindings
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard object's metadata.
    +

    Write Operations

    +

    Create

    +

    create a ClusterRoleBinding

    +

    HTTP Request

    +POST /apis/rbac.authorization.k8s.io/v1/clusterrolebindings +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ClusterRoleBinding
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    ClusterRoleBinding
    OK
    201
    ClusterRoleBinding
    Created
    202
    ClusterRoleBinding
    Accepted
    +

    Patch

    +

    partially update the specified ClusterRoleBinding

    +

    HTTP Request

    +PATCH /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ClusterRoleBinding
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ClusterRoleBinding
    OK
    201
    ClusterRoleBinding
    Created
    +

    Replace

    +

    replace the specified ClusterRoleBinding

    +

    HTTP Request

    +PUT /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ClusterRoleBinding
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ClusterRoleBinding
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ClusterRoleBinding
    OK
    201
    ClusterRoleBinding
    Created
    +

    Delete

    +

    delete a ClusterRoleBinding

    +

    HTTP Request

    +DELETE /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ClusterRoleBinding
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of ClusterRoleBinding

    +

    HTTP Request

    +DELETE /apis/rbac.authorization.k8s.io/v1/clusterrolebindings +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified ClusterRoleBinding

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ClusterRoleBinding
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ClusterRoleBinding
    OK
    +

    List

    +

    list or watch objects of kind ClusterRoleBinding

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/clusterrolebindings +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ClusterRoleBindingList
    OK
    +

    Watch

    +

    watch changes to an object of kind ClusterRoleBinding. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/watch/clusterrolebindings/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ClusterRoleBinding
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of ClusterRoleBinding. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/watch/clusterrolebindings +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    ComponentStatus v1 core

    + + + + + +
    GroupVersionKind
    corev1ComponentStatus
    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    conditions
    ComponentCondition array
    patch strategy: merge
    patch merge key: type
    List of component conditions observed
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    ComponentStatusList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    ComponentStatus array
    List of ComponentStatus objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Read Operations

    +

    Read

    +

    read the specified ComponentStatus

    +

    HTTP Request

    +GET /api/v1/componentstatuses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the ComponentStatus
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ComponentStatus
    OK
    +

    List

    +

    list objects of kind ComponentStatus

    +

    HTTP Request

    +GET /api/v1/componentstatuses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ComponentStatusList
    OK
    +

    FlowSchema v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1FlowSchema
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    FlowSchemaSpec
    `spec` is the specification of the desired behavior of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    FlowSchemaStatus
    `status` is the current status of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    FlowSchemaSpec v1beta1 flowcontrol

    + + + + + + + + + +
    FieldDescription
    distinguisherMethod
    FlowDistinguisherMethod
    `distinguisherMethod` defines how to compute the flow distinguisher for requests that match this schema. `nil` specifies that the distinguisher is disabled and thus will always be the empty string.
    matchingPrecedence
    integer
    `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen FlowSchema is among those with the numerically lowest (which we take to be logically highest) MatchingPrecedence. Each MatchingPrecedence value must be ranged in [1,10000]. Note that if the precedence is not specified, it will be set to 1000 as default.
    priorityLevelConfiguration
    PriorityLevelConfigurationReference
    `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot be resolved, the FlowSchema will be ignored and marked as invalid in its status. Required.
    rules
    PolicyRulesWithSubjects array
    `rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if at least one member of rules matches the request. if it is an empty slice, there will be no requests matching the FlowSchema.
    +

    FlowSchemaStatus v1beta1 flowcontrol

    + + + + + + +
    FieldDescription
    conditions
    FlowSchemaCondition array
    `conditions` is a list of the current states of FlowSchema.
    +

    FlowSchemaList v1beta1 flowcontrol

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    FlowSchema array
    `items` is a list of FlowSchemas.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    `metadata` is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a FlowSchema

    +

    HTTP Request

    +POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    FlowSchema
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    201
    FlowSchema
    Created
    202
    FlowSchema
    Accepted
    +

    Patch

    +

    partially update the specified FlowSchema

    +

    HTTP Request

    +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    201
    FlowSchema
    Created
    +

    Replace

    +

    replace the specified FlowSchema

    +

    HTTP Request

    +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    FlowSchema
    +

    Response

    + + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    201
    FlowSchema
    Created
    +

    Delete

    +

    delete a FlowSchema

    +

    HTTP Request

    +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of FlowSchema

    +

    HTTP Request

    +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified FlowSchema

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    +

    List

    +

    list or watch objects of kind FlowSchema

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    FlowSchemaList
    OK
    +

    Watch

    +

    watch changes to an object of kind FlowSchema. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/watch/flowschemas/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of FlowSchema. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/watch/flowschemas +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified FlowSchema

    +

    HTTP Request

    +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    201
    FlowSchema
    Created
    +

    Read Status

    +

    read status of the specified FlowSchema

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    +

    Replace Status

    +

    replace status of the specified FlowSchema

    +

    HTTP Request

    +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    FlowSchema
    +

    Response

    + + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    201
    FlowSchema
    Created
    +

    Lease v1 coordination.k8s.io

    + + + + + +
    GroupVersionKind
    coordination.k8s.iov1Lease
    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    LeaseSpec
    Specification of the Lease. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    LeaseSpec v1 coordination

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    acquireTime
    MicroTime
    acquireTime is a time when the current lease was acquired.
    holderIdentity
    string
    holderIdentity contains the identity of the holder of a current lease.
    leaseDurationSeconds
    integer
    leaseDurationSeconds is a duration that candidates for a lease need to wait to force acquire it. This is measure against time of last observed RenewTime.
    leaseTransitions
    integer
    leaseTransitions is the number of transitions of a lease between holders.
    renewTime
    MicroTime
    renewTime is a time when the current holder of a lease has last updated the lease.
    +

    LeaseList v1 coordination

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Lease array
    Items is a list of schema objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a Lease

    +

    HTTP Request

    +POST /apis/coordination.k8s.io/v1/namespaces/{namespace}/leases +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Lease
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Lease
    OK
    201
    Lease
    Created
    202
    Lease
    Accepted
    +

    Patch

    +

    partially update the specified Lease

    +

    HTTP Request

    +PATCH /apis/coordination.k8s.io/v1/namespaces/{namespace}/leases/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Lease
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Lease
    OK
    201
    Lease
    Created
    +

    Replace

    +

    replace the specified Lease

    +

    HTTP Request

    +PUT /apis/coordination.k8s.io/v1/namespaces/{namespace}/leases/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Lease
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Lease
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Lease
    OK
    201
    Lease
    Created
    +

    Delete

    +

    delete a Lease

    +

    HTTP Request

    +DELETE /apis/coordination.k8s.io/v1/namespaces/{namespace}/leases/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Lease
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Lease

    +

    HTTP Request

    +DELETE /apis/coordination.k8s.io/v1/namespaces/{namespace}/leases +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified Lease

    +

    HTTP Request

    +GET /apis/coordination.k8s.io/v1/namespaces/{namespace}/leases/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Lease
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Lease
    OK
    +

    List

    +

    list or watch objects of kind Lease

    +

    HTTP Request

    +GET /apis/coordination.k8s.io/v1/namespaces/{namespace}/leases +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    LeaseList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Lease

    +

    HTTP Request

    +GET /apis/coordination.k8s.io/v1/leases +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    LeaseList
    OK
    +

    Watch

    +

    watch changes to an object of kind Lease. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/coordination.k8s.io/v1/watch/namespaces/{namespace}/leases/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Lease
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Lease. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/coordination.k8s.io/v1/watch/namespaces/{namespace}/leases +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Lease. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/coordination.k8s.io/v1/watch/leases +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    LocalSubjectAccessReview v1 authorization.k8s.io

    + + + + + +
    GroupVersionKind
    authorization.k8s.iov1LocalSubjectAccessReview
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    SubjectAccessReviewSpec
    Spec holds information about the request being evaluated. spec.namespace must be equal to the namespace you made the request against. If empty, it is defaulted.
    status
    SubjectAccessReviewStatus
    Status is filled in by the server and indicates whether the request is allowed or not
    +

    Write Operations

    +

    Create

    +

    create a LocalSubjectAccessReview

    +

    HTTP Request

    +POST /apis/authorization.k8s.io/v1/namespaces/{namespace}/localsubjectaccessreviews +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    prettyIf 'true', then the output is pretty printed.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    LocalSubjectAccessReview
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    LocalSubjectAccessReview
    OK
    201
    LocalSubjectAccessReview
    Created
    202
    LocalSubjectAccessReview
    Accepted
    +

    Namespace v1 core

    + + + + + +
    GroupVersionKind
    corev1Namespace
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    NamespaceSpec
    Spec defines the behavior of the Namespace. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    NamespaceStatus
    Status describes the current status of a Namespace. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    NamespaceSpec v1 core

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    finalizers
    string array
    Finalizers is an opaque list of values that must be empty to permanently remove object from storage. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/
    +

    NamespaceStatus v1 core

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    conditions
    NamespaceCondition array
    patch strategy: merge
    patch merge key: type
    Represents the latest available observations of a namespace's current state.
    phase
    string
    Phase is the current lifecycle phase of the namespace. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/ Possible enum values: - `"Active"` means the namespace is available for use in the system - `"Terminating"` means the namespace is undergoing graceful termination
    +

    NamespaceList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Namespace array
    Items is the list of Namespace objects in the list. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a Namespace

    +

    HTTP Request

    +POST /api/v1/namespaces +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Namespace
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Namespace
    OK
    201
    Namespace
    Created
    202
    Namespace
    Accepted
    +

    Patch

    +

    partially update the specified Namespace

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Namespace
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Namespace
    OK
    201
    Namespace
    Created
    +

    Replace

    +

    replace the specified Namespace

    +

    HTTP Request

    +PUT /api/v1/namespaces/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Namespace
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Namespace
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Namespace
    OK
    201
    Namespace
    Created
    +

    Delete

    +

    delete a Namespace

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Namespace
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Read Operations

    +

    Read

    +

    read the specified Namespace

    +

    HTTP Request

    +GET /api/v1/namespaces/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Namespace
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Namespace
    OK
    +

    List

    +

    list or watch objects of kind Namespace

    +

    HTTP Request

    +GET /api/v1/namespaces +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    NamespaceList
    OK
    +

    Watch

    +

    watch changes to an object of kind Namespace. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Namespace
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Namespace. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified Namespace

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Namespace
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Namespace
    OK
    201
    Namespace
    Created
    +

    Read Status

    +

    read status of the specified Namespace

    +

    HTTP Request

    +GET /api/v1/namespaces/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Namespace
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Namespace
    OK
    +

    Replace Status

    +

    replace status of the specified Namespace

    +

    HTTP Request

    +PUT /api/v1/namespaces/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Namespace
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Namespace
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Namespace
    OK
    201
    Namespace
    Created
    +

    Node v1 core

    + + + + + +
    GroupVersionKind
    corev1Node
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    NodeSpec
    Spec defines the behavior of a node. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    NodeStatus
    Most recently observed status of the node. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    NodeSpec v1 core

    +
    Appears In: + +
    + + + + + + + + + + + +
    FieldDescription
    configSource
    NodeConfigSource
    Deprecated. If specified, the source of the node's configuration. The DynamicKubeletConfig feature gate must be enabled for the Kubelet to use this field. This field is deprecated as of 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configuration
    externalID
    string
    Deprecated. Not all kubelets will set this field. Remove field after 1.13. see: https://issues.k8s.io/61966
    podCIDR
    string
    PodCIDR represents the pod IP range assigned to the node.
    podCIDRs
    string array
    patch strategy: merge
    podCIDRs represents the IP ranges assigned to the node for usage by Pods on that node. If this field is specified, the 0th entry must match the podCIDR field. It may contain at most 1 value for each of IPv4 and IPv6.
    providerID
    string
    ID of the node assigned by the cloud provider in the format: <ProviderName>://<ProviderSpecificNodeID>
    taints
    Taint array
    If specified, the node's taints.
    unschedulable
    boolean
    Unschedulable controls node schedulability of new pods. By default, node is schedulable. More info: https://kubernetes.io/docs/concepts/nodes/node/#manual-node-administration
    +

    NodeStatus v1 core

    +
    Appears In: + +
    + + + + + + + + + + + + + + + +
    FieldDescription
    addresses
    NodeAddress array
    patch strategy: merge
    patch merge key: type
    List of addresses reachable to the node. Queried from cloud provider, if available. More info: https://kubernetes.io/docs/concepts/nodes/node/#addresses Note: This field is declared as mergeable, but the merge key is not sufficiently unique, which can cause data corruption when it is merged. Callers should instead use a full-replacement patch. See http://pr.k8s.io/79391 for an example.
    allocatable
    object
    Allocatable represents the resources of a node that are available for scheduling. Defaults to Capacity.
    capacity
    object
    Capacity represents the total resources of a node. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#capacity
    conditions
    NodeCondition array
    patch strategy: merge
    patch merge key: type
    Conditions is an array of current observed node conditions. More info: https://kubernetes.io/docs/concepts/nodes/node/#condition
    config
    NodeConfigStatus
    Status of the config assigned to the node via the dynamic Kubelet config feature.
    daemonEndpoints
    NodeDaemonEndpoints
    Endpoints of daemons running on the Node.
    images
    ContainerImage array
    List of container images on this node
    nodeInfo
    NodeSystemInfo
    Set of ids/uuids to uniquely identify the node. More info: https://kubernetes.io/docs/concepts/nodes/node/#info
    phase
    string
    NodePhase is the recently observed lifecycle phase of the node. More info: https://kubernetes.io/docs/concepts/nodes/node/#phase The field is never populated, and now is deprecated. Possible enum values: - `"Pending"` means the node has been created/added by the system, but not configured. - `"Running"` means the node has been configured and has Kubernetes components running. - `"Terminated"` means the node has been removed from the cluster.
    volumesAttached
    AttachedVolume array
    List of volumes that are attached to the node.
    volumesInUse
    string array
    List of attachable volumes in use (mounted) by the node.
    +

    NodeList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Node array
    List of nodes
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a Node

    +

    HTTP Request

    +POST /api/v1/nodes +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Node
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Node
    OK
    201
    Node
    Created
    202
    Node
    Accepted
    +

    Patch

    +

    partially update the specified Node

    +

    HTTP Request

    +PATCH /api/v1/nodes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Node
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Node
    OK
    201
    Node
    Created
    +

    Replace

    +

    replace the specified Node

    +

    HTTP Request

    +PUT /api/v1/nodes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Node
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Node
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Node
    OK
    201
    Node
    Created
    +

    Delete

    +

    delete a Node

    +

    HTTP Request

    +DELETE /api/v1/nodes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Node
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Node

    +

    HTTP Request

    +DELETE /api/v1/nodes +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified Node

    +

    HTTP Request

    +GET /api/v1/nodes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Node
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Node
    OK
    +

    List

    +

    list or watch objects of kind Node

    +

    HTTP Request

    +GET /api/v1/nodes +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    NodeList
    OK
    +

    Watch

    +

    watch changes to an object of kind Node. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/nodes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Node
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Node. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/nodes +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified Node

    +

    HTTP Request

    +PATCH /api/v1/nodes/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Node
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Node
    OK
    201
    Node
    Created
    +

    Read Status

    +

    read status of the specified Node

    +

    HTTP Request

    +GET /api/v1/nodes/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Node
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Node
    OK
    +

    Replace Status

    +

    replace status of the specified Node

    +

    HTTP Request

    +PUT /api/v1/nodes/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the Node
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Node
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Node
    OK
    201
    Node
    Created
    +

    Proxy Operations

    +

    Create Connect Proxy

    +

    connect POST requests to proxy of Node

    +

    HTTP Request

    +POST /api/v1/nodes/{name}/proxy +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the NodeProxyOptions
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to node.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Create Connect Proxy Path

    +

    connect POST requests to proxy of Node

    +

    HTTP Request

    +POST /api/v1/nodes/{name}/proxy/{path} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the NodeProxyOptions
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to node.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Delete Connect Proxy

    +

    connect DELETE requests to proxy of Node

    +

    HTTP Request

    +DELETE /api/v1/nodes/{name}/proxy +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the NodeProxyOptions
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to node.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Delete Connect Proxy Path

    +

    connect DELETE requests to proxy of Node

    +

    HTTP Request

    +DELETE /api/v1/nodes/{name}/proxy/{path} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the NodeProxyOptions
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to node.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Get Connect Proxy

    +

    connect GET requests to proxy of Node

    +

    HTTP Request

    +GET /api/v1/nodes/{name}/proxy +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the NodeProxyOptions
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to node.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Get Connect Proxy Path

    +

    connect GET requests to proxy of Node

    +

    HTTP Request

    +GET /api/v1/nodes/{name}/proxy/{path} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the NodeProxyOptions
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to node.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Head Connect Proxy

    +

    connect HEAD requests to proxy of Node

    +

    HTTP Request

    +HEAD /api/v1/nodes/{name}/proxy +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the NodeProxyOptions
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to node.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Head Connect Proxy Path

    +

    connect HEAD requests to proxy of Node

    +

    HTTP Request

    +HEAD /api/v1/nodes/{name}/proxy/{path} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the NodeProxyOptions
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to node.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Replace Connect Proxy

    +

    connect PUT requests to proxy of Node

    +

    HTTP Request

    +PUT /api/v1/nodes/{name}/proxy +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the NodeProxyOptions
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to node.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    Replace Connect Proxy Path

    +

    connect PUT requests to proxy of Node

    +

    HTTP Request

    +PUT /api/v1/nodes/{name}/proxy/{path} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the NodeProxyOptions
    pathpath to the resource
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    pathPath is the URL path to use for the current proxy request to node.
    +

    Response

    + + + + + +
    CodeDescription
    200
    string
    OK
    +

    PersistentVolume v1 core

    + + + + + +
    GroupVersionKind
    corev1PersistentVolume
    +
    These are assigned to Pods using PersistentVolumeClaims.
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    PersistentVolumeSpec
    Spec defines a specification of a persistent volume owned by the cluster. Provisioned by an administrator. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistent-volumes
    status
    PersistentVolumeStatus
    Status represents the current information/status for the persistent volume. Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistent-volumes
    +

    PersistentVolumeSpec v1 core

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    accessModes
    string array
    AccessModes contains all ways the volume can be mounted. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes
    awsElasticBlockStore
    AWSElasticBlockStoreVolumeSource
    AWSElasticBlockStore represents an AWS Disk resource that is attached to a kubelet's host machine and then exposed to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
    azureDisk
    AzureDiskVolumeSource
    AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.
    azureFile
    AzureFilePersistentVolumeSource
    AzureFile represents an Azure File Service mount on the host and bind mount to the pod.
    capacity
    object
    A description of the persistent volume's resources and capacity. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#capacity
    cephfs
    CephFSPersistentVolumeSource
    CephFS represents a Ceph FS mount on the host that shares a pod's lifetime
    cinder
    CinderPersistentVolumeSource
    Cinder represents a cinder volume attached and mounted on kubelets host machine. More info: https://examples.k8s.io/mysql-cinder-pd/README.md
    claimRef
    ObjectReference
    ClaimRef is part of a bi-directional binding between PersistentVolume and PersistentVolumeClaim. Expected to be non-nil when bound. claim.VolumeName is the authoritative bind between PV and PVC. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#binding
    csi
    CSIPersistentVolumeSource
    CSI represents storage that is handled by an external CSI driver (Beta feature).
    fc
    FCVolumeSource
    FC represents a Fibre Channel resource that is attached to a kubelet's host machine and then exposed to the pod.
    flexVolume
    FlexPersistentVolumeSource
    FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin.
    flocker
    FlockerVolumeSource
    Flocker represents a Flocker volume attached to a kubelet's host machine and exposed to the pod for its usage. This depends on the Flocker control service being running
    gcePersistentDisk
    GCEPersistentDiskVolumeSource
    GCEPersistentDisk represents a GCE Disk resource that is attached to a kubelet's host machine and then exposed to the pod. Provisioned by an admin. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
    glusterfs
    GlusterfsPersistentVolumeSource
    Glusterfs represents a Glusterfs volume that is attached to a host and exposed to the pod. Provisioned by an admin. More info: https://examples.k8s.io/volumes/glusterfs/README.md
    hostPath
    HostPathVolumeSource
    HostPath represents a directory on the host. Provisioned by a developer or tester. This is useful for single-node development and testing only! On-host storage is not supported in any way and WILL NOT WORK in a multi-node cluster. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
    iscsi
    ISCSIPersistentVolumeSource
    ISCSI represents an ISCSI Disk resource that is attached to a kubelet's host machine and then exposed to the pod. Provisioned by an admin.
    local
    LocalVolumeSource
    Local represents directly-attached storage with node affinity
    mountOptions
    string array
    A list of mount options, e.g. ["ro", "soft"]. Not validated - mount will simply fail if one is invalid. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#mount-options
    nfs
    NFSVolumeSource
    NFS represents an NFS mount on the host. Provisioned by an admin. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
    nodeAffinity
    VolumeNodeAffinity
    NodeAffinity defines constraints that limit what nodes this volume can be accessed from. This field influences the scheduling of pods that use this volume.
    persistentVolumeReclaimPolicy
    string
    What happens to a persistent volume when released from its claim. Valid options are Retain (default for manually created PersistentVolumes), Delete (default for dynamically provisioned PersistentVolumes), and Recycle (deprecated). Recycle must be supported by the volume plugin underlying this PersistentVolume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#reclaiming Possible enum values: - `"Delete"` means the volume will be deleted from Kubernetes on release from its claim. The volume plugin must support Deletion. - `"Recycle"` means the volume will be recycled back into the pool of unbound persistent volumes on release from its claim. The volume plugin must support Recycling. - `"Retain"` means the volume will be left in its current phase (Released) for manual reclamation by the administrator. The default policy is Retain.
    photonPersistentDisk
    PhotonPersistentDiskVolumeSource
    PhotonPersistentDisk represents a PhotonController persistent disk attached and mounted on kubelets host machine
    portworxVolume
    PortworxVolumeSource
    PortworxVolume represents a portworx volume attached and mounted on kubelets host machine
    quobyte
    QuobyteVolumeSource
    Quobyte represents a Quobyte mount on the host that shares a pod's lifetime
    rbd
    RBDPersistentVolumeSource
    RBD represents a Rados Block Device mount on the host that shares a pod's lifetime. More info: https://examples.k8s.io/volumes/rbd/README.md
    scaleIO
    ScaleIOPersistentVolumeSource
    ScaleIO represents a ScaleIO persistent volume attached and mounted on Kubernetes nodes.
    storageClassName
    string
    Name of StorageClass to which this persistent volume belongs. Empty value means that this volume does not belong to any StorageClass.
    storageos
    StorageOSPersistentVolumeSource
    StorageOS represents a StorageOS volume that is attached to the kubelet's host machine and mounted into the pod More info: https://examples.k8s.io/volumes/storageos/README.md
    volumeMode
    string
    volumeMode defines if a volume is intended to be used with a formatted filesystem or to remain in raw block state. Value of Filesystem is implied when not included in spec.
    vsphereVolume
    VsphereVirtualDiskVolumeSource
    VsphereVolume represents a vSphere volume attached and mounted on kubelets host machine
    +

    PersistentVolumeStatus v1 core

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    message
    string
    A human-readable message indicating details about why the volume is in this state.
    phase
    string
    Phase indicates if a volume is available, bound to a claim, or released by a claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#phase Possible enum values: - `"Available"` used for PersistentVolumes that are not yet bound Available volumes are held by the binder and matched to PersistentVolumeClaims - `"Bound"` used for PersistentVolumes that are bound - `"Failed"` used for PersistentVolumes that failed to be correctly recycled or deleted after being released from a claim - `"Pending"` used for PersistentVolumes that are not available - `"Released"` used for PersistentVolumes where the bound PersistentVolumeClaim was deleted released volumes must be recycled before becoming available again this phase is used by the persistent volume claim binder to signal to another process to reclaim the resource
    reason
    string
    Reason is a brief CamelCase string that describes any failure and is meant for machine parsing and tidy display in the CLI.
    +

    PersistentVolumeList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    PersistentVolume array
    List of persistent volumes. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a PersistentVolume

    +

    HTTP Request

    +POST /api/v1/persistentvolumes +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PersistentVolume
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    PersistentVolume
    OK
    201
    PersistentVolume
    Created
    202
    PersistentVolume
    Accepted
    +

    Patch

    +

    partially update the specified PersistentVolume

    +

    HTTP Request

    +PATCH /api/v1/persistentvolumes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PersistentVolume
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PersistentVolume
    OK
    201
    PersistentVolume
    Created
    +

    Replace

    +

    replace the specified PersistentVolume

    +

    HTTP Request

    +PUT /api/v1/persistentvolumes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PersistentVolume
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PersistentVolume
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PersistentVolume
    OK
    201
    PersistentVolume
    Created
    +

    Delete

    +

    delete a PersistentVolume

    +

    HTTP Request

    +DELETE /api/v1/persistentvolumes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PersistentVolume
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PersistentVolume
    OK
    202
    PersistentVolume
    Accepted
    +

    Delete Collection

    +

    delete collection of PersistentVolume

    +

    HTTP Request

    +DELETE /api/v1/persistentvolumes +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified PersistentVolume

    +

    HTTP Request

    +GET /api/v1/persistentvolumes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PersistentVolume
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PersistentVolume
    OK
    +

    List

    +

    list or watch objects of kind PersistentVolume

    +

    HTTP Request

    +GET /api/v1/persistentvolumes +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PersistentVolumeList
    OK
    +

    Watch

    +

    watch changes to an object of kind PersistentVolume. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/persistentvolumes/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PersistentVolume
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of PersistentVolume. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/persistentvolumes +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified PersistentVolume

    +

    HTTP Request

    +PATCH /api/v1/persistentvolumes/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PersistentVolume
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PersistentVolume
    OK
    201
    PersistentVolume
    Created
    +

    Read Status

    +

    read status of the specified PersistentVolume

    +

    HTTP Request

    +GET /api/v1/persistentvolumes/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PersistentVolume
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PersistentVolume
    OK
    +

    Replace Status

    +

    replace status of the specified PersistentVolume

    +

    HTTP Request

    +PUT /api/v1/persistentvolumes/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PersistentVolume
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PersistentVolume
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PersistentVolume
    OK
    201
    PersistentVolume
    Created
    +

    PriorityLevelConfiguration v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1PriorityLevelConfiguration
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    PriorityLevelConfigurationSpec
    `spec` is the specification of the desired behavior of a "request-priority". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    PriorityLevelConfigurationStatus
    `status` is the current status of a "request-priority". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    PriorityLevelConfigurationSpec v1beta1 flowcontrol

    + + + + + + + +
    FieldDescription
    limited
    LimitedPriorityLevelConfiguration
    `limited` specifies how requests are handled for a Limited priority level. This field must be non-empty if and only if `type` is `"Limited"`.
    type
    string
    `type` indicates whether this priority level is subject to limitation on request execution. A value of `"Exempt"` means that requests of this priority level are not subject to a limit (and thus are never queued) and do not detract from the capacity made available to other priority levels. A value of `"Limited"` means that (a) requests of this priority level _are_ subject to limits and (b) some of the server's limited capacity is made available exclusively to this priority level. Required.
    +

    PriorityLevelConfigurationStatus v1beta1 flowcontrol

    + + + + + + +
    FieldDescription
    conditions
    PriorityLevelConfigurationCondition array
    `conditions` is the current state of "request-priority".
    +

    PriorityLevelConfigurationList v1beta1 flowcontrol

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    PriorityLevelConfiguration array
    `items` is a list of request-priorities.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a PriorityLevelConfiguration

    +

    HTTP Request

    +POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PriorityLevelConfiguration
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    201
    PriorityLevelConfiguration
    Created
    202
    PriorityLevelConfiguration
    Accepted
    +

    Patch

    +

    partially update the specified PriorityLevelConfiguration

    +

    HTTP Request

    +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    201
    PriorityLevelConfiguration
    Created
    +

    Replace

    +

    replace the specified PriorityLevelConfiguration

    +

    HTTP Request

    +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PriorityLevelConfiguration
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    201
    PriorityLevelConfiguration
    Created
    +

    Delete

    +

    delete a PriorityLevelConfiguration

    +

    HTTP Request

    +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of PriorityLevelConfiguration

    +

    HTTP Request

    +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified PriorityLevelConfiguration

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    +

    List

    +

    list or watch objects of kind PriorityLevelConfiguration

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PriorityLevelConfigurationList
    OK
    +

    Watch

    +

    watch changes to an object of kind PriorityLevelConfiguration. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/watch/prioritylevelconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of PriorityLevelConfiguration. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/watch/prioritylevelconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified PriorityLevelConfiguration

    +

    HTTP Request

    +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    201
    PriorityLevelConfiguration
    Created
    +

    Read Status

    +

    read status of the specified PriorityLevelConfiguration

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    +

    Replace Status

    +

    replace status of the specified PriorityLevelConfiguration

    +

    HTTP Request

    +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PriorityLevelConfiguration
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    201
    PriorityLevelConfiguration
    Created
    +

    ResourceQuota v1 core

    + + + + + +
    GroupVersionKind
    corev1ResourceQuota
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    ResourceQuotaSpec
    Spec defines the desired quota. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    ResourceQuotaStatus
    Status defines the actual enforced quota and its current usage. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    ResourceQuotaSpec v1 core

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    hard
    object
    hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
    scopeSelector
    ScopeSelector
    scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
    scopes
    string array
    A collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.
    +

    ResourceQuotaStatus v1 core

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    hard
    object
    Hard is the set of enforced hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
    used
    object
    Used is the current observed total usage of the resource in the namespace.
    +

    ResourceQuotaList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    ResourceQuota array
    Items is a list of ResourceQuota objects. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a ResourceQuota

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/resourcequotas +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ResourceQuota
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    ResourceQuota
    OK
    201
    ResourceQuota
    Created
    202
    ResourceQuota
    Accepted
    +

    Patch

    +

    partially update the specified ResourceQuota

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/resourcequotas/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ResourceQuota
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ResourceQuota
    OK
    201
    ResourceQuota
    Created
    +

    Replace

    +

    replace the specified ResourceQuota

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/resourcequotas/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ResourceQuota
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ResourceQuota
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ResourceQuota
    OK
    201
    ResourceQuota
    Created
    +

    Delete

    +

    delete a ResourceQuota

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/resourcequotas/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ResourceQuota
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ResourceQuota
    OK
    202
    ResourceQuota
    Accepted
    +

    Delete Collection

    +

    delete collection of ResourceQuota

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/resourcequotas +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified ResourceQuota

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/resourcequotas/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ResourceQuota
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ResourceQuota
    OK
    +

    List

    +

    list or watch objects of kind ResourceQuota

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/resourcequotas +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ResourceQuotaList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind ResourceQuota

    +

    HTTP Request

    +GET /api/v1/resourcequotas +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ResourceQuotaList
    OK
    +

    Watch

    +

    watch changes to an object of kind ResourceQuota. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/resourcequotas/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ResourceQuota
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of ResourceQuota. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/resourcequotas +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of ResourceQuota. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/resourcequotas +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified ResourceQuota

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/resourcequotas/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ResourceQuota
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ResourceQuota
    OK
    201
    ResourceQuota
    Created
    +

    Read Status

    +

    read status of the specified ResourceQuota

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/resourcequotas/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ResourceQuota
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ResourceQuota
    OK
    +

    Replace Status

    +

    replace status of the specified ResourceQuota

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/resourcequotas/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ResourceQuota
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ResourceQuota
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ResourceQuota
    OK
    201
    ResourceQuota
    Created
    +

    Role v1 rbac.authorization.k8s.io

    + + + + + +
    GroupVersionKind
    rbac.authorization.k8s.iov1Role
    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata.
    rules
    PolicyRule array
    Rules holds all the PolicyRules for this Role
    +

    RoleList v1 rbac

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Role array
    Items is a list of Roles
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard object's metadata.
    +

    Write Operations

    +

    Create

    +

    create a Role

    +

    HTTP Request

    +POST /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Role
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Role
    OK
    201
    Role
    Created
    202
    Role
    Accepted
    +

    Patch

    +

    partially update the specified Role

    +

    HTTP Request

    +PATCH /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Role
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Role
    OK
    201
    Role
    Created
    +

    Replace

    +

    replace the specified Role

    +

    HTTP Request

    +PUT /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Role
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Role
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Role
    OK
    201
    Role
    Created
    +

    Delete

    +

    delete a Role

    +

    HTTP Request

    +DELETE /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Role
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Role

    +

    HTTP Request

    +DELETE /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified Role

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Role
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Role
    OK
    +

    List

    +

    list or watch objects of kind Role

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RoleList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Role

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/roles +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RoleList
    OK
    +

    Watch

    +

    watch changes to an object of kind Role. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/watch/namespaces/{namespace}/roles/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Role
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Role. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/watch/namespaces/{namespace}/roles +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Role. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/watch/roles +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    RoleBinding v1 rbac.authorization.k8s.io

    + + + + + +
    GroupVersionKind
    rbac.authorization.k8s.iov1RoleBinding
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata.
    roleRef
    RoleRef
    RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error.
    subjects
    Subject array
    Subjects holds references to the objects the role applies to.
    +

    RoleBindingList v1 rbac

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    RoleBinding array
    Items is a list of RoleBindings
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard object's metadata.
    +

    Write Operations

    +

    Create

    +

    create a RoleBinding

    +

    HTTP Request

    +POST /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    RoleBinding
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    RoleBinding
    OK
    201
    RoleBinding
    Created
    202
    RoleBinding
    Accepted
    +

    Patch

    +

    partially update the specified RoleBinding

    +

    HTTP Request

    +PATCH /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the RoleBinding
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    RoleBinding
    OK
    201
    RoleBinding
    Created
    +

    Replace

    +

    replace the specified RoleBinding

    +

    HTTP Request

    +PUT /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the RoleBinding
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    RoleBinding
    +

    Response

    + + + + + + +
    CodeDescription
    200
    RoleBinding
    OK
    201
    RoleBinding
    Created
    +

    Delete

    +

    delete a RoleBinding

    +

    HTTP Request

    +DELETE /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the RoleBinding
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of RoleBinding

    +

    HTTP Request

    +DELETE /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified RoleBinding

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the RoleBinding
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RoleBinding
    OK
    +

    List

    +

    list or watch objects of kind RoleBinding

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RoleBindingList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind RoleBinding

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/rolebindings +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RoleBindingList
    OK
    +

    Watch

    +

    watch changes to an object of kind RoleBinding. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/watch/namespaces/{namespace}/rolebindings/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the RoleBinding
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of RoleBinding. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/watch/namespaces/{namespace}/rolebindings +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of RoleBinding. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/rbac.authorization.k8s.io/v1/watch/rolebindings +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    RuntimeClass v1 node.k8s.io

    + + + + + +
    GroupVersionKind
    node.k8s.iov1RuntimeClass
    +
    Other API versions of this object exist: +v1beta1 +v1alpha1 +
    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    handler
    string
    Handler specifies the underlying runtime and configuration that the CRI implementation will use to handle pods of this class. The possible values are specific to the node & CRI configuration. It is assumed that all handlers are available on every node, and handlers of the same name are equivalent on every node. For example, a handler called "runc" might specify that the runc OCI runtime (using native Linux containers) will be used to run the containers in a pod. The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements, and is immutable.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    overhead
    Overhead
    Overhead represents the resource overhead associated with running a pod for a given RuntimeClass. For more details, see https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/ This field is in beta starting v1.18 and is only honored by servers that enable the PodOverhead feature.
    scheduling
    Scheduling
    Scheduling holds the scheduling constraints to ensure that pods running with this RuntimeClass are scheduled to nodes that support it. If scheduling is nil, this RuntimeClass is assumed to be supported by all nodes.
    +

    RuntimeClassList v1 node

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    RuntimeClass array
    Items is a list of schema objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a RuntimeClass

    +

    HTTP Request

    +POST /apis/node.k8s.io/v1/runtimeclasses +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    RuntimeClass
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    201
    RuntimeClass
    Created
    202
    RuntimeClass
    Accepted
    +

    Patch

    +

    partially update the specified RuntimeClass

    +

    HTTP Request

    +PATCH /apis/node.k8s.io/v1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    201
    RuntimeClass
    Created
    +

    Replace

    +

    replace the specified RuntimeClass

    +

    HTTP Request

    +PUT /apis/node.k8s.io/v1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    RuntimeClass
    +

    Response

    + + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    201
    RuntimeClass
    Created
    +

    Delete

    +

    delete a RuntimeClass

    +

    HTTP Request

    +DELETE /apis/node.k8s.io/v1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of RuntimeClass

    +

    HTTP Request

    +DELETE /apis/node.k8s.io/v1/runtimeclasses +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified RuntimeClass

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    +

    List

    +

    list or watch objects of kind RuntimeClass

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1/runtimeclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RuntimeClassList
    OK
    +

    Watch

    +

    watch changes to an object of kind RuntimeClass. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1/watch/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of RuntimeClass. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1/watch/runtimeclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    SelfSubjectAccessReview v1 authorization.k8s.io

    + + + + + +
    GroupVersionKind
    authorization.k8s.iov1SelfSubjectAccessReview
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    SelfSubjectAccessReviewSpec
    Spec holds information about the request being evaluated. user and groups must be empty
    status
    SubjectAccessReviewStatus
    Status is filled in by the server and indicates whether the request is allowed or not
    +

    SelfSubjectAccessReviewSpec v1 authorization

    + + + + + + + +
    FieldDescription
    nonResourceAttributes
    NonResourceAttributes
    NonResourceAttributes describes information for a non-resource access request
    resourceAttributes
    ResourceAttributes
    ResourceAuthorizationAttributes describes information for a resource access request
    +

    Write Operations

    +

    Create

    +

    create a SelfSubjectAccessReview

    +

    HTTP Request

    +POST /apis/authorization.k8s.io/v1/selfsubjectaccessreviews +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    prettyIf 'true', then the output is pretty printed.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    SelfSubjectAccessReview
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    SelfSubjectAccessReview
    OK
    201
    SelfSubjectAccessReview
    Created
    202
    SelfSubjectAccessReview
    Accepted
    +

    SelfSubjectRulesReview v1 authorization.k8s.io

    + + + + + +
    GroupVersionKind
    authorization.k8s.iov1SelfSubjectRulesReview
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    SelfSubjectRulesReviewSpec
    Spec holds information about the request being evaluated.
    status
    SubjectRulesReviewStatus
    Status is filled in by the server and indicates the set of actions a user can perform.
    +

    SelfSubjectRulesReviewSpec v1 authorization

    + + + + + + +
    FieldDescription
    namespace
    string
    Namespace to evaluate rules for. Required.
    +

    Write Operations

    +

    Create

    +

    create a SelfSubjectRulesReview

    +

    HTTP Request

    +POST /apis/authorization.k8s.io/v1/selfsubjectrulesreviews +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    prettyIf 'true', then the output is pretty printed.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    SelfSubjectRulesReview
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    SelfSubjectRulesReview
    OK
    201
    SelfSubjectRulesReview
    Created
    202
    SelfSubjectRulesReview
    Accepted
    +

    ServiceAccount v1 core

    + + + + + +
    GroupVersionKind
    corev1ServiceAccount
    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    automountServiceAccountToken
    boolean
    AutomountServiceAccountToken indicates whether pods running as this service account should have an API token automatically mounted. Can be overridden at the pod level.
    imagePullSecrets
    LocalObjectReference array
    ImagePullSecrets is a list of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet. More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    secrets
    ObjectReference array
    patch strategy: merge
    patch merge key: name
    Secrets is the list of secrets allowed to be used by pods running using this ServiceAccount. More info: https://kubernetes.io/docs/concepts/configuration/secret
    +

    ServiceAccountList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    ServiceAccount array
    List of ServiceAccounts. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create a ServiceAccount

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/serviceaccounts +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ServiceAccount
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    ServiceAccount
    OK
    201
    ServiceAccount
    Created
    202
    ServiceAccount
    Accepted
    +

    Patch

    +

    partially update the specified ServiceAccount

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/serviceaccounts/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ServiceAccount
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ServiceAccount
    OK
    201
    ServiceAccount
    Created
    +

    Replace

    +

    replace the specified ServiceAccount

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/serviceaccounts/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ServiceAccount
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    ServiceAccount
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ServiceAccount
    OK
    201
    ServiceAccount
    Created
    +

    Delete

    +

    delete a ServiceAccount

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/serviceaccounts/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ServiceAccount
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    ServiceAccount
    OK
    202
    ServiceAccount
    Accepted
    +

    Delete Collection

    +

    delete collection of ServiceAccount

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/serviceaccounts +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified ServiceAccount

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/serviceaccounts/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ServiceAccount
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ServiceAccount
    OK
    +

    List

    +

    list or watch objects of kind ServiceAccount

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/serviceaccounts +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ServiceAccountList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind ServiceAccount

    +

    HTTP Request

    +GET /api/v1/serviceaccounts +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    ServiceAccountList
    OK
    +

    Watch

    +

    watch changes to an object of kind ServiceAccount. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/serviceaccounts/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the ServiceAccount
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of ServiceAccount. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/serviceaccounts +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of ServiceAccount. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/serviceaccounts +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    StorageVersion v1alpha1 internal.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    internal.apiserver.k8s.iov1alpha1StorageVersion
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    The name is <group>.<resource>.
    spec
    StorageVersionSpec
    Spec is an empty spec. It is here to comply with Kubernetes API style.
    status
    StorageVersionStatus
    API server instances report the version they can decode and the version they encode objects to when persisting objects in the backend.
    +

    StorageVersionSpec v1alpha1 apiserverinternal

    + + + + + +
    FieldDescription
    +

    StorageVersionStatus v1alpha1 apiserverinternal

    + + + + + + + + +
    FieldDescription
    commonEncodingVersion
    string
    If all API server instances agree on the same encoding storage version, then this field is set to that version. Otherwise this field is left empty. API servers should finish updating its storageVersionStatus entry before serving write operations, so that this field will be in sync with the reality.
    conditions
    StorageVersionCondition array
    The latest available observations of the storageVersion's state.
    storageVersions
    ServerStorageVersion array
    The reported versions per API server instance.
    +

    StorageVersionList v1alpha1 apiserverinternal

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    StorageVersion array
    Items holds a list of StorageVersion
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a StorageVersion

    +

    HTTP Request

    +POST /apis/internal.apiserver.k8s.io/v1alpha1/storageversions +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    StorageVersion
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    StorageVersion
    OK
    201
    StorageVersion
    Created
    202
    StorageVersion
    Accepted
    +

    Patch

    +

    partially update the specified StorageVersion

    +

    HTTP Request

    +PATCH /apis/internal.apiserver.k8s.io/v1alpha1/storageversions/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageVersion
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StorageVersion
    OK
    201
    StorageVersion
    Created
    +

    Replace

    +

    replace the specified StorageVersion

    +

    HTTP Request

    +PUT /apis/internal.apiserver.k8s.io/v1alpha1/storageversions/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageVersion
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    StorageVersion
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StorageVersion
    OK
    201
    StorageVersion
    Created
    +

    Delete

    +

    delete a StorageVersion

    +

    HTTP Request

    +DELETE /apis/internal.apiserver.k8s.io/v1alpha1/storageversions/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageVersion
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of StorageVersion

    +

    HTTP Request

    +DELETE /apis/internal.apiserver.k8s.io/v1alpha1/storageversions +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified StorageVersion

    +

    HTTP Request

    +GET /apis/internal.apiserver.k8s.io/v1alpha1/storageversions/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageVersion
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    StorageVersion
    OK
    +

    List

    +

    list or watch objects of kind StorageVersion

    +

    HTTP Request

    +GET /apis/internal.apiserver.k8s.io/v1alpha1/storageversions +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    StorageVersionList
    OK
    +

    Watch

    +

    watch changes to an object of kind StorageVersion. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/internal.apiserver.k8s.io/v1alpha1/watch/storageversions/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageVersion
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of StorageVersion. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/internal.apiserver.k8s.io/v1alpha1/watch/storageversions +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified StorageVersion

    +

    HTTP Request

    +PATCH /apis/internal.apiserver.k8s.io/v1alpha1/storageversions/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageVersion
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StorageVersion
    OK
    201
    StorageVersion
    Created
    +

    Read Status

    +

    read status of the specified StorageVersion

    +

    HTTP Request

    +GET /apis/internal.apiserver.k8s.io/v1alpha1/storageversions/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageVersion
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    StorageVersion
    OK
    +

    Replace Status

    +

    replace status of the specified StorageVersion

    +

    HTTP Request

    +PUT /apis/internal.apiserver.k8s.io/v1alpha1/storageversions/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the StorageVersion
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    StorageVersion
    +

    Response

    + + + + + + +
    CodeDescription
    200
    StorageVersion
    OK
    201
    StorageVersion
    Created
    +

    SubjectAccessReview v1 authorization.k8s.io

    + + + + + +
    GroupVersionKind
    authorization.k8s.iov1SubjectAccessReview
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    SubjectAccessReviewSpec
    Spec holds information about the request being evaluated
    status
    SubjectAccessReviewStatus
    Status is filled in by the server and indicates whether the request is allowed or not
    +

    SubjectAccessReviewSpec v1 authorization

    + + + + + + + + + + + +
    FieldDescription
    extra
    object
    Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.
    groups
    string array
    Groups is the groups you're testing for.
    nonResourceAttributes
    NonResourceAttributes
    NonResourceAttributes describes information for a non-resource access request
    resourceAttributes
    ResourceAttributes
    ResourceAuthorizationAttributes describes information for a resource access request
    uid
    string
    UID information about the requesting user.
    user
    string
    User is the user you're testing for. If you specify "User" but not "Groups", then is it interpreted as "What if User were not a member of any groups
    +

    SubjectAccessReviewStatus v1 authorization

    + + + + + + + + + +
    FieldDescription
    allowed
    boolean
    Allowed is required. True if the action would be allowed, false otherwise.
    denied
    boolean
    Denied is optional. True if the action would be denied, otherwise false. If both allowed is false and denied is false, then the authorizer has no opinion on whether to authorize the action. Denied may not be true if Allowed is true.
    evaluationError
    string
    EvaluationError is an indication that some error occurred during the authorization check. It is entirely possible to get an error and be able to continue determine authorization status in spite of it. For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
    reason
    string
    Reason is optional. It indicates why a request was allowed or denied.
    +

    Write Operations

    +

    Create

    +

    create a SubjectAccessReview

    +

    HTTP Request

    +POST /apis/authorization.k8s.io/v1/subjectaccessreviews +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    prettyIf 'true', then the output is pretty printed.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    SubjectAccessReview
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    SubjectAccessReview
    OK
    201
    SubjectAccessReview
    Created
    202
    SubjectAccessReview
    Accepted
    +

    TokenRequest v1 authentication.k8s.io

    + + + + + +
    GroupVersionKind
    authentication.k8s.iov1TokenRequest
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    TokenRequestSpec
    Spec holds information about the request being evaluated
    status
    TokenRequestStatus
    Status is filled in by the server and indicates whether the token can be authenticated.
    +

    TokenRequestSpec v1 authentication

    + + + + + + + + +
    FieldDescription
    audiences
    string array
    Audiences are the intendend audiences of the token. A recipient of a token must identitfy themself with an identifier in the list of audiences of the token, and otherwise should reject the token. A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences.
    boundObjectRef
    BoundObjectReference
    BoundObjectRef is a reference to an object that the token will be bound to. The token will only be valid for as long as the bound object exists. NOTE: The API server's TokenReview endpoint will validate the BoundObjectRef, but other audiences may not. Keep ExpirationSeconds small if you want prompt revocation.
    expirationSeconds
    integer
    ExpirationSeconds is the requested duration of validity of the request. The token issuer may return a token with a different validity duration so a client needs to check the 'expiration' field in a response.
    +

    TokenRequestStatus v1 authentication

    + + + + + + + +
    FieldDescription
    expirationTimestamp
    Time
    ExpirationTimestamp is the time of expiration of the returned token.
    token
    string
    Token is the opaque bearer token.
    +

    TokenReview v1 authentication.k8s.io

    + + + + + +
    GroupVersionKind
    authentication.k8s.iov1TokenReview
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    TokenReviewSpec
    Spec holds information about the request being evaluated
    status
    TokenReviewStatus
    Status is filled in by the server and indicates whether the request can be authenticated.
    +

    TokenReviewSpec v1 authentication

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    audiences
    string array
    Audiences is a list of the identifiers that the resource server presented with the token identifies as. Audience-aware token authenticators will verify that the token was intended for at least one of the audiences in this list. If no audiences are provided, the audience will default to the audience of the Kubernetes apiserver.
    token
    string
    Token is the opaque bearer token.
    +

    TokenReviewStatus v1 authentication

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    audiences
    string array
    Audiences are audience identifiers chosen by the authenticator that are compatible with both the TokenReview and token. An identifier is any identifier in the intersection of the TokenReviewSpec audiences and the token's audiences. A client of the TokenReview API that sets the spec.audiences field should validate that a compatible audience identifier is returned in the status.audiences field to ensure that the TokenReview server is audience aware. If a TokenReview returns an empty status.audience field where status.authenticated is "true", the token is valid against the audience of the Kubernetes API server.
    authenticated
    boolean
    Authenticated indicates that the token was associated with a known user.
    error
    string
    Error indicates that the token couldn't be checked
    user
    UserInfo
    User is the UserInfo associated with the provided token.
    +

    Write Operations

    +

    Create

    +

    create a TokenReview

    +

    HTTP Request

    +POST /apis/authentication.k8s.io/v1/tokenreviews +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    prettyIf 'true', then the output is pretty printed.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    TokenReview
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    TokenReview
    OK
    201
    TokenReview
    Created
    202
    TokenReview
    Accepted
    +

    NetworkPolicy v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1NetworkPolicy
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    NetworkPolicySpec
    Specification of the desired behavior for this NetworkPolicy.
    +

    NetworkPolicySpec v1 networking

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    egress
    NetworkPolicyEgressRule array
    List of egress rules to be applied to the selected pods. Outgoing traffic is allowed if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic matches at least one egress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy limits all outgoing traffic (and serves solely to ensure that the pods it selects are isolated by default). This field is beta-level in 1.8
    ingress
    NetworkPolicyIngressRule array
    List of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated by default)
    podSelector
    LabelSelector
    Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.
    policyTypes
    string array
    List of rule types that the NetworkPolicy relates to. Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"]. If this field is not specified, it will default based on the existence of Ingress or Egress rules; policies that contain an Egress section are assumed to affect Egress, and all policies (whether or not they contain an Ingress section) are assumed to affect Ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include "Egress" (since such a policy would not include an Egress section and would otherwise default to just [ "Ingress" ]). This field is beta-level in 1.8
    +

    NetworkPolicyList v1 networking

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    NetworkPolicy array
    Items is a list of schema objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a NetworkPolicy

    +

    HTTP Request

    +POST /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    NetworkPolicy
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    NetworkPolicy
    OK
    201
    NetworkPolicy
    Created
    202
    NetworkPolicy
    Accepted
    +

    Patch

    +

    partially update the specified NetworkPolicy

    +

    HTTP Request

    +PATCH /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the NetworkPolicy
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    NetworkPolicy
    OK
    201
    NetworkPolicy
    Created
    +

    Replace

    +

    replace the specified NetworkPolicy

    +

    HTTP Request

    +PUT /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the NetworkPolicy
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    NetworkPolicy
    +

    Response

    + + + + + + +
    CodeDescription
    200
    NetworkPolicy
    OK
    201
    NetworkPolicy
    Created
    +

    Delete

    +

    delete a NetworkPolicy

    +

    HTTP Request

    +DELETE /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the NetworkPolicy
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of NetworkPolicy

    +

    HTTP Request

    +DELETE /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified NetworkPolicy

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the NetworkPolicy
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    NetworkPolicy
    OK
    +

    List

    +

    list or watch objects of kind NetworkPolicy

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    NetworkPolicyList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind NetworkPolicy

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/networkpolicies +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    NetworkPolicyList
    OK
    +

    Watch

    +

    watch changes to an object of kind NetworkPolicy. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/watch/namespaces/{namespace}/networkpolicies/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the NetworkPolicy
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of NetworkPolicy. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/watch/namespaces/{namespace}/networkpolicies +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of NetworkPolicy. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/networking.k8s.io/v1/watch/networkpolicies +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    DEFINITIONS

    + +

    This section contains definitions for objects used in the Kubernetes APIs.

    +

    APIGroup v1 meta

    + + + + + +
    GroupVersionKind
    metav1APIGroup
    +

    APIGroup contains the name, the supported versions, and the preferred version of a group.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    name
    string
    name is the name of the group.
    preferredVersion
    GroupVersionForDiscovery
    preferredVersion is the version preferred by the API server, which probably is the storage version.
    serverAddressByClientCIDRs
    ServerAddressByClientCIDR array
    a map of client CIDR to server address that is serving this group. This is to help clients reach servers in the most network-efficient way possible. Clients can use the appropriate server address as per the CIDR that they match. In case of multiple matches, clients should use the longest matching CIDR. The server returns only those CIDRs that it thinks that the client can match. For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP. Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
    versions
    GroupVersionForDiscovery array
    versions are the versions supported in this group.
    +

    APIResource v1 meta

    + + + + + +
    GroupVersionKind
    metav1APIResource
    +

    APIResource specifies the name of a resource and whether it is namespaced.

    +
    Appears In: + +
    + + + + + + + + + + + + + + +
    FieldDescription
    categories
    string array
    categories is a list of the grouped resources this resource belongs to (e.g. 'all')
    group
    string
    group is the preferred group of the resource. Empty implies the group of the containing resource list. For subresources, this may have a different value, for example: Scale".
    kind
    string
    kind is the kind for the resource (e.g. 'Foo' is the kind for a resource 'foo')
    name
    string
    name is the plural name of the resource.
    namespaced
    boolean
    namespaced indicates if a resource is namespaced or not.
    shortNames
    string array
    shortNames is a list of suggested short names of the resource.
    singularName
    string
    singularName is the singular name of the resource. This allows clients to handle plural and singular opaquely. The singularName is more correct for reporting status on a single item and both singular and plural are allowed from the kubectl CLI interface.
    storageVersionHash
    string
    The hash value of the storage version, the version this resource is converted to when written to the data store. Value must be treated as opaque by clients. Only equality comparison on the value is valid. This is an alpha feature and may change or be removed in the future. The field is populated by the apiserver only if the StorageVersionHash feature gate is enabled. This field will remain optional even if it graduates.
    verbs
    string array
    verbs is a list of supported kube verbs (this includes get, list, watch, create, update, patch, delete, deletecollection, and proxy)
    version
    string
    version is the preferred version of the resource. Empty implies the version of the containing resource list For subresources, this may have a different value, for example: v1 (while inside a v1beta1 version of the core resource's group)".
    +

    APIServiceCondition v1 apiregistration.k8s.io

    + + + + + +
    GroupVersionKind
    apiregistration.k8s.iov1APIServiceCondition
    +

    APIServiceCondition describes the state of an APIService at a particular point

    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    Last time the condition transitioned from one status to another.
    message
    string
    Human-readable message indicating details about last transition.
    reason
    string
    Unique, one-word, CamelCase reason for the condition's last transition.
    status
    string
    Status is the status of the condition. Can be True, False, Unknown.
    type
    string
    Type is the type of the condition.
    +

    APIVersions v1 meta

    + + + + + +
    GroupVersionKind
    metav1APIVersions
    +

    APIVersions lists the versions that are available, to allow clients to discover the API at /api, which is the root path of the legacy v1 API.

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    serverAddressByClientCIDRs
    ServerAddressByClientCIDR array
    a map of client CIDR to server address that is serving this group. This is to help clients reach servers in the most network-efficient way possible. Clients can use the appropriate server address as per the CIDR that they match. In case of multiple matches, clients should use the longest matching CIDR. The server returns only those CIDRs that it thinks that the client can match. For example: the master will return an internal IP CIDR only, if the client reaches the server using an internal IP. Server looks at X-Forwarded-For header or X-Real-Ip header or request.RemoteAddr (in that order) to get the client IP.
    versions
    string array
    versions are the api versions that are available.
    +

    AWSElasticBlockStoreVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1AWSElasticBlockStoreVolumeSource
    +

    Represents a Persistent Disk resource in AWS. + +An AWS EBS disk must exist before mounting to a container. The disk must also be in the same AWS zone as the kubelet. An AWS EBS disk can only be mounted as read/write once. AWS EBS volumes support ownership management and SELinux relabeling.

    + + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
    partition
    integer
    The partition in the volume that you want to mount. If omitted, the default is to mount by volume name. Examples: For volume /dev/sda1, you specify the partition as "1". Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty).
    readOnly
    boolean
    Specify "true" to force and set the ReadOnly property in VolumeMounts to "true". If omitted, the default is "false". More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
    volumeID
    string
    Unique ID of the persistent disk resource in AWS (Amazon EBS volume). More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore
    +

    Affinity v1 core

    + + + + + +
    GroupVersionKind
    corev1Affinity
    +

    Affinity is a group of affinity scheduling rules.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    nodeAffinity
    NodeAffinity
    Describes node affinity scheduling rules for the pod.
    podAffinity
    PodAffinity
    Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).
    podAntiAffinity
    PodAntiAffinity
    Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).
    +

    AggregationRule v1 rbac.authorization.k8s.io

    + + + + + +
    GroupVersionKind
    rbac.authorization.k8s.iov1AggregationRule
    +

    AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    clusterRoleSelectors
    LabelSelector array
    ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be added
    +

    AllowedCSIDriver v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1AllowedCSIDriver
    +

    AllowedCSIDriver represents a single inline CSI Driver that is allowed to be used.

    + + + + + + +
    FieldDescription
    name
    string
    Name is the registered name of the CSI driver
    +

    AllowedFlexVolume v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1AllowedFlexVolume
    +

    AllowedFlexVolume represents a single Flexvolume that is allowed to be used.

    + + + + + + +
    FieldDescription
    driver
    string
    driver is the name of the Flexvolume driver.
    +

    AllowedHostPath v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1AllowedHostPath
    +

    AllowedHostPath defines the host volume conditions that will be enabled by a policy for pods to use. It requires the path prefix to be defined.

    + + + + + + + +
    FieldDescription
    pathPrefix
    string
    pathPrefix is the path prefix that the host volume must match. It does not support `*`. Trailing slashes are trimmed when validating the path prefix with a host path. Examples: `/foo` would allow `/foo`, `/foo/` and `/foo/bar` `/foo` would not allow `/food` or `/etc/foo`
    readOnly
    boolean
    when set to true, will allow host volumes matching the pathPrefix only if all volume mounts are readOnly.
    +

    AttachedVolume v1 core

    + + + + + +
    GroupVersionKind
    corev1AttachedVolume
    +

    AttachedVolume describes a volume attached to a node

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    devicePath
    string
    DevicePath represents the device path where the volume should be available
    name
    string
    Name of the attached volume
    +

    AzureDiskVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1AzureDiskVolumeSource
    +

    AzureDisk represents an Azure Data Disk mount on the host and bind mount to the pod.

    + + + + + + + + + + + +
    FieldDescription
    cachingMode
    string
    Host Caching mode: None, Read Only, Read Write.
    diskName
    string
    The Name of the data disk in the blob storage
    diskURI
    string
    The URI the data disk in the blob storage
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
    kind
    string
    Expected values Shared: multiple blob disks per storage account Dedicated: single blob disk per storage account Managed: azure managed data disk (only in managed availability set). defaults to shared
    readOnly
    boolean
    Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    +

    AzureFilePersistentVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1AzureFilePersistentVolumeSource
    +

    AzureFile represents an Azure File Service mount on the host and bind mount to the pod.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    readOnly
    boolean
    Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    secretName
    string
    the name of secret that contains Azure Storage Account Name and Key
    secretNamespace
    string
    the namespace of the secret that contains Azure Storage Account Name and Key default is the same as the Pod
    shareName
    string
    Share Name
    +

    AzureFileVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1AzureFileVolumeSource
    +

    AzureFile represents an Azure File Service mount on the host and bind mount to the pod.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    readOnly
    boolean
    Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    secretName
    string
    the name of secret that contains Azure Storage Account Name and Key
    shareName
    string
    Share Name
    +

    BoundObjectReference v1 authentication.k8s.io

    + + + + + +
    GroupVersionKind
    authentication.k8s.iov1BoundObjectReference
    +

    BoundObjectReference is a reference to an object that a token is bound to.

    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    API version of the referent.
    kind
    string
    Kind of the referent. Valid kinds are 'Pod' and 'Secret'.
    name
    string
    Name of the referent.
    uid
    string
    UID of the referent.
    +

    CSINodeDriver v1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1CSINodeDriver
    +

    CSINodeDriver holds information about the specification of one CSI driver installed on a node

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    allocatable
    VolumeNodeResources
    allocatable represents the volume resources of a node that are available for scheduling. This field is beta.
    name
    string
    This is the name of the CSI driver that this object refers to. This MUST be the same name returned by the CSI GetPluginName() call for that driver.
    nodeID
    string
    nodeID of the node from the driver point of view. This field enables Kubernetes to communicate with storage systems that do not share the same nomenclature for nodes. For example, Kubernetes may refer to a given node as "node1", but the storage system may refer to the same node as "nodeA". When Kubernetes issues a command to the storage system to attach a volume to a specific node, it can use this field to refer to the node name using the ID that the storage system will understand, e.g. "nodeA" instead of "node1". This field is required.
    topologyKeys
    string array
    topologyKeys is the list of keys supported by the driver. When a driver is initialized on a cluster, it provides a set of topology keys that it understands (e.g. "company.com/zone", "company.com/region"). When a driver is initialized on a node, it provides the same topology keys along with values. Kubelet will expose these topology keys as labels on its own node object. When Kubernetes does topology aware provisioning, it can use this list to determine which labels it should retrieve from the node object and pass back to the driver. It is possible for different nodes to use different topology keys. This can be empty if driver does not support topology.
    +

    CSIPersistentVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1CSIPersistentVolumeSource
    +

    Represents storage that is managed by an external CSI volume driver (Beta feature)

    +
    Appears In: + +
    + + + + + + + + + + + + + +
    FieldDescription
    controllerExpandSecretRef
    SecretReference
    ControllerExpandSecretRef is a reference to the secret object containing sensitive information to pass to the CSI driver to complete the CSI ControllerExpandVolume call. This is an alpha field and requires enabling ExpandCSIVolumes feature gate. This field is optional, and may be empty if no secret is required. If the secret object contains more than one secret, all secrets are passed.
    controllerPublishSecretRef
    SecretReference
    ControllerPublishSecretRef is a reference to the secret object containing sensitive information to pass to the CSI driver to complete the CSI ControllerPublishVolume and ControllerUnpublishVolume calls. This field is optional, and may be empty if no secret is required. If the secret object contains more than one secret, all secrets are passed.
    driver
    string
    Driver is the name of the driver to use for this volume. Required.
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs".
    nodePublishSecretRef
    SecretReference
    NodePublishSecretRef is a reference to the secret object containing sensitive information to pass to the CSI driver to complete the CSI NodePublishVolume and NodeUnpublishVolume calls. This field is optional, and may be empty if no secret is required. If the secret object contains more than one secret, all secrets are passed.
    nodeStageSecretRef
    SecretReference
    NodeStageSecretRef is a reference to the secret object containing sensitive information to pass to the CSI driver to complete the CSI NodeStageVolume and NodeStageVolume and NodeUnstageVolume calls. This field is optional, and may be empty if no secret is required. If the secret object contains more than one secret, all secrets are passed.
    readOnly
    boolean
    Optional: The value to pass to ControllerPublishVolumeRequest. Defaults to false (read/write).
    volumeAttributes
    object
    Attributes of the volume to publish.
    volumeHandle
    string
    VolumeHandle is the unique volume name returned by the CSI volume plugin’s CreateVolume to refer to the volume on all subsequent calls. Required.
    +

    CSIVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1CSIVolumeSource
    +

    Represents a source location of a volume to mount, managed by an external CSI driver

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    driver
    string
    Driver is the name of the CSI driver that handles this volume. Consult with your admin for the correct name as registered in the cluster.
    fsType
    string
    Filesystem type to mount. Ex. "ext4", "xfs", "ntfs". If not provided, the empty value is passed to the associated CSI driver which will determine the default filesystem to apply.
    nodePublishSecretRef
    LocalObjectReference
    NodePublishSecretRef is a reference to the secret object containing sensitive information to pass to the CSI driver to complete the CSI NodePublishVolume and NodeUnpublishVolume calls. This field is optional, and may be empty if no secret is required. If the secret object contains more than one secret, all secret references are passed.
    readOnly
    boolean
    Specifies a read-only configuration for the volume. Defaults to false (read/write).
    volumeAttributes
    object
    VolumeAttributes stores driver-specific properties that are passed to the CSI driver. Consult your driver's documentation for supported values.
    +

    Capabilities v1 core

    + + + + + +
    GroupVersionKind
    corev1Capabilities
    +

    Adds and removes POSIX capabilities from running containers.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    add
    string array
    Added capabilities
    drop
    string array
    Removed capabilities
    +

    CephFSPersistentVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1CephFSPersistentVolumeSource
    +

    Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    monitors
    string array
    Required: Monitors is a collection of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
    path
    string
    Optional: Used as the mounted root, rather than the full Ceph tree, default is /
    readOnly
    boolean
    Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
    secretFile
    string
    Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
    secretRef
    SecretReference
    Optional: SecretRef is reference to the authentication secret for User, default is empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
    user
    string
    Optional: User is the rados user name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
    +

    CephFSVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1CephFSVolumeSource
    +

    Represents a Ceph Filesystem mount that lasts the lifetime of a pod Cephfs volumes do not support ownership management or SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    monitors
    string array
    Required: Monitors is a collection of Ceph monitors More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
    path
    string
    Optional: Used as the mounted root, rather than the full Ceph tree, default is /
    readOnly
    boolean
    Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
    secretFile
    string
    Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
    secretRef
    LocalObjectReference
    Optional: SecretRef is reference to the authentication secret for User, default is empty. More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
    user
    string
    Optional: User is the rados user name, default is admin More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it
    +

    CertificateSigningRequestCondition v1 certificates.k8s.io

    + + + + + +
    GroupVersionKind
    certificates.k8s.iov1CertificateSigningRequestCondition
    +

    CertificateSigningRequestCondition describes a condition of a CertificateSigningRequest object

    + + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    lastTransitionTime is the time the condition last transitioned from one status to another. If unset, when a new condition type is added or an existing condition's status is changed, the server defaults this to the current time.
    lastUpdateTime
    Time
    lastUpdateTime is the time of the last update to this condition
    message
    string
    message contains a human readable message with details about the request state
    reason
    string
    reason indicates a brief reason for the request state
    status
    string
    status of the condition, one of True, False, Unknown. Approved, Denied, and Failed conditions may not be "False" or "Unknown".
    type
    string
    type of the condition. Known conditions are "Approved", "Denied", and "Failed". An "Approved" condition is added via the /approval subresource, indicating the request was approved and should be issued by the signer. A "Denied" condition is added via the /approval subresource, indicating the request was denied and should not be issued by the signer. A "Failed" condition is added via the /status subresource, indicating the signer failed to issue the certificate. Approved and Denied conditions are mutually exclusive. Approved, Denied, and Failed conditions cannot be removed once added. Only one condition of a given type is allowed. Possible enum values: - `"Approved"` Approved indicates the request was approved and should be issued by the signer. - `"Denied"` Denied indicates the request was denied and should not be issued by the signer. - `"Failed"` Failed indicates the signer failed to issue the certificate.
    +

    CinderPersistentVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1CinderPersistentVolumeSource
    +

    Represents a cinder volume resource in Openstack. A Cinder volume must exist before mounting to a container. The volume must also be in the same region as the kubelet. Cinder volumes support ownership management and SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md
    readOnly
    boolean
    Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md
    secretRef
    SecretReference
    Optional: points to a secret object containing parameters used to connect to OpenStack.
    volumeID
    string
    volume id used to identify the volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md
    +

    CinderVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1CinderVolumeSource
    +

    Represents a cinder volume resource in Openstack. A Cinder volume must exist before mounting to a container. The volume must also be in the same region as the kubelet. Cinder volumes support ownership management and SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://examples.k8s.io/mysql-cinder-pd/README.md
    readOnly
    boolean
    Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts. More info: https://examples.k8s.io/mysql-cinder-pd/README.md
    secretRef
    LocalObjectReference
    Optional: points to a secret object containing parameters used to connect to OpenStack.
    volumeID
    string
    volume id used to identify the volume in cinder. More info: https://examples.k8s.io/mysql-cinder-pd/README.md
    +

    ClientIPConfig v1 core

    + + + + + +
    GroupVersionKind
    corev1ClientIPConfig
    +

    ClientIPConfig represents the configurations of Client IP based session affinity.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    timeoutSeconds
    integer
    timeoutSeconds specifies the seconds of ClientIP type session sticky time. The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". Default value is 10800(for 3 hours).
    +

    ComponentCondition v1 core

    + + + + + +
    GroupVersionKind
    corev1ComponentCondition
    +

    Information about the condition of a component.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    error
    string
    Condition error code for a component. For example, a health check error code.
    message
    string
    Message about the condition for a component. For example, information about a health check.
    status
    string
    Status of the condition for a component. Valid values for "Healthy": "True", "False", or "Unknown".
    type
    string
    Type of condition for a component. Valid value: "Healthy"
    +

    Condition v1 meta

    + + + + + +
    GroupVersionKind
    metav1Condition
    +

    Condition contains details for one aspect of the current state of this API Resource.

    + + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
    message
    string
    message is a human readable message indicating details about the transition. This may be an empty string.
    observedGeneration
    integer
    observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
    reason
    string
    reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
    status
    string
    status of the condition, one of True, False, Unknown.
    type
    string
    type of condition in CamelCase or in foo.example.com/CamelCase.
    +

    ConfigMapEnvSource v1 core

    + + + + + +
    GroupVersionKind
    corev1ConfigMapEnvSource
    +

    ConfigMapEnvSource selects a ConfigMap to populate the environment variables with. + +The contents of the target ConfigMap's Data field will represent the key-value pairs as environment variables.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    optional
    boolean
    Specify whether the ConfigMap must be defined
    +

    ConfigMapKeySelector v1 core

    + + + + + +
    GroupVersionKind
    corev1ConfigMapKeySelector
    +

    Selects a key from a ConfigMap.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    key
    string
    The key to select.
    name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    optional
    boolean
    Specify whether the ConfigMap or its key must be defined
    +

    ConfigMapNodeConfigSource v1 core

    + + + + + +
    GroupVersionKind
    corev1ConfigMapNodeConfigSource
    +

    ConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configuration

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    kubeletConfigKey
    string
    KubeletConfigKey declares which key of the referenced ConfigMap corresponds to the KubeletConfiguration structure This field is required in all cases.
    name
    string
    Name is the metadata.name of the referenced ConfigMap. This field is required in all cases.
    namespace
    string
    Namespace is the metadata.namespace of the referenced ConfigMap. This field is required in all cases.
    resourceVersion
    string
    ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.
    uid
    string
    UID is the metadata.UID of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.
    +

    ConfigMapProjection v1 core

    + + + + + +
    GroupVersionKind
    corev1ConfigMapProjection
    +

    Adapts a ConfigMap into a projected volume. + +The contents of the target ConfigMap's Data field will be presented in a projected volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths. Note that this is identical to a configmap volume source without the default mode.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    items
    KeyToPath array
    If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.
    name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    optional
    boolean
    Specify whether the ConfigMap or its keys must be defined
    +

    ConfigMapVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1ConfigMapVolumeSource
    +

    Adapts a ConfigMap into a volume. + +The contents of the target ConfigMap's Data field will be presented in a volume as files using the keys in the Data field as the file names, unless the items element is populated with specific mappings of keys to paths. ConfigMap volumes support ownership management and SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    defaultMode
    integer
    Optional: mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
    items
    KeyToPath array
    If unspecified, each key-value pair in the Data field of the referenced ConfigMap will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the ConfigMap, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.
    name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    optional
    boolean
    Specify whether the ConfigMap or its keys must be defined
    +

    ContainerImage v1 core

    + + + + + +
    GroupVersionKind
    corev1ContainerImage
    +

    Describe a container image

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    names
    string array
    Names by which this image is known. e.g. ["k8s.gcr.io/hyperkube:v1.0.7", "dockerhub.io/google_containers/hyperkube:v1.0.7"]
    sizeBytes
    integer
    The size of the image in bytes.
    +

    ContainerPort v1 core

    + + + + + +
    GroupVersionKind
    corev1ContainerPort
    +

    ContainerPort represents a network port in a single container.

    + + + + + + + + + + +
    FieldDescription
    containerPort
    integer
    Number of port to expose on the pod's IP address. This must be a valid port number, 0 < x < 65536.
    hostIP
    string
    What host IP to bind the external port to.
    hostPort
    integer
    Number of port to expose on the host. If specified, this must be a valid port number, 0 < x < 65536. If HostNetwork is specified, this must match ContainerPort. Most containers do not need this.
    name
    string
    If specified, this must be an IANA_SVC_NAME and unique within the pod. Each named port in a pod must have a unique name. Name for the port that can be referred to by services.
    protocol
    string
    Protocol for port. Must be UDP, TCP, or SCTP. Defaults to "TCP". Possible enum values: - `"SCTP"` is the SCTP protocol. - `"TCP"` is the TCP protocol. - `"UDP"` is the UDP protocol.
    +

    ContainerResourceMetricSource v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2ContainerResourceMetricSource
    +

    ContainerResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. Only one "target" type should be set.

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    container
    string
    container is the name of the container in the pods of the scaling target
    name
    string
    name is the name of the resource in question.
    target
    MetricTarget
    target specifies the target value for the given metric
    +

    ContainerResourceMetricStatus v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2ContainerResourceMetricStatus
    +

    ContainerResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    container
    string
    Container is the name of the container in the pods of the scaling target
    current
    MetricValueStatus
    current contains the current value for the given metric
    name
    string
    Name is the name of the resource in question.
    +

    ContainerState v1 core

    + + + + + +
    GroupVersionKind
    corev1ContainerState
    +

    ContainerState holds a possible state of container. Only one of its members may be specified. If none of them is specified, the default one is ContainerStateWaiting.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    running
    ContainerStateRunning
    Details about a running container
    terminated
    ContainerStateTerminated
    Details about a terminated container
    waiting
    ContainerStateWaiting
    Details about a waiting container
    +

    ContainerStateRunning v1 core

    + + + + + +
    GroupVersionKind
    corev1ContainerStateRunning
    +

    ContainerStateRunning is a running state of a container.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    startedAt
    Time
    Time at which the container was last (re-)started
    +

    ContainerStateTerminated v1 core

    + + + + + +
    GroupVersionKind
    corev1ContainerStateTerminated
    +

    ContainerStateTerminated is a terminated state of a container.

    +
    Appears In: + +
    + + + + + + + + + + + +
    FieldDescription
    containerID
    string
    Container's ID in the format 'docker://<container_id>'
    exitCode
    integer
    Exit status from the last termination of the container
    finishedAt
    Time
    Time at which the container last terminated
    message
    string
    Message regarding the last termination of the container
    reason
    string
    (brief) reason from the last termination of the container
    signal
    integer
    Signal from the last termination of the container
    startedAt
    Time
    Time at which previous execution of the container started
    +

    ContainerStateWaiting v1 core

    + + + + + +
    GroupVersionKind
    corev1ContainerStateWaiting
    +

    ContainerStateWaiting is a waiting state of a container.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    message
    string
    Message regarding why the container is not yet running.
    reason
    string
    (brief) reason the container is not yet running.
    +

    CrossVersionObjectReference v1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv1CrossVersionObjectReference
    +

    CrossVersionObjectReference contains enough information to let you identify the referred resource.

    +
    Other API versions of this object exist: +v2 +v2beta2 +v2beta1 +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    API version of the referent
    kind
    string
    Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
    name
    string
    Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names
    +

    CustomResourceColumnDefinition v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1CustomResourceColumnDefinition
    +

    CustomResourceColumnDefinition specifies a column for server side printing.

    + + + + + + + + + + + +
    FieldDescription
    description
    string
    description is a human readable description of this column.
    format
    string
    format is an optional OpenAPI type definition for this column. The 'name' format is applied to the primary identifier column to assist in clients identifying column is the resource name. See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for details.
    jsonPath
    string
    jsonPath is a simple JSON path (i.e. with array notation) which is evaluated against each custom resource to produce the value for this column.
    name
    string
    name is a human readable name for the column.
    priority
    integer
    priority is an integer defining the relative importance of this column compared to others. Lower numbers are considered higher priority. Columns that may be omitted in limited space scenarios should be given a priority greater than 0.
    type
    string
    type is an OpenAPI type definition for this column. See https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#data-types for details.
    +

    CustomResourceConversion v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1CustomResourceConversion
    +

    CustomResourceConversion describes how to convert different versions of a CR.

    + + + + + + + +
    FieldDescription
    strategy
    string
    strategy specifies how custom resources are converted between versions. Allowed values are: - `None`: The converter only change the apiVersion and would not touch any other field in the custom resource. - `Webhook`: API Server will call to an external webhook to do the conversion. Additional information is needed for this option. This requires spec.preserveUnknownFields to be false, and spec.conversion.webhook to be set.
    webhook
    WebhookConversion
    webhook describes how to call the conversion webhook. Required when `strategy` is set to `Webhook`.
    +

    CustomResourceDefinitionCondition v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1CustomResourceDefinitionCondition
    +

    CustomResourceDefinitionCondition contains details for the current condition of this pod.

    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    lastTransitionTime last time the condition transitioned from one status to another.
    message
    string
    message is a human-readable message indicating details about last transition.
    reason
    string
    reason is a unique, one-word, CamelCase reason for the condition's last transition.
    status
    string
    status is the status of the condition. Can be True, False, Unknown.
    type
    string
    type is the type of the condition. Types include Established, NamesAccepted and Terminating.
    +

    CustomResourceDefinitionNames v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1CustomResourceDefinitionNames
    +

    CustomResourceDefinitionNames indicates the names to serve this CustomResourceDefinition

    + + + + + + + + + + + +
    FieldDescription
    categories
    string array
    categories is a list of grouped resources this custom resource belongs to (e.g. 'all'). This is published in API discovery documents, and used by clients to support invocations like `kubectl get all`.
    kind
    string
    kind is the serialized kind of the resource. It is normally CamelCase and singular. Custom resource instances will use this value as the `kind` attribute in API calls.
    listKind
    string
    listKind is the serialized kind of the list for this resource. Defaults to "`kind`List".
    plural
    string
    plural is the plural name of the resource to serve. The custom resources are served under `/apis/<group>/<version>/.../<plural>`. Must match the name of the CustomResourceDefinition (in the form `<names.plural>.<group>`). Must be all lowercase.
    shortNames
    string array
    shortNames are short names for the resource, exposed in API discovery documents, and used by clients to support invocations like `kubectl get <shortname>`. It must be all lowercase.
    singular
    string
    singular is the singular name of the resource. It must be all lowercase. Defaults to lowercased `kind`.
    +

    CustomResourceDefinitionVersion v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1CustomResourceDefinitionVersion
    +

    CustomResourceDefinitionVersion describes a version for CRD.

    + + + + + + + + + + + + + +
    FieldDescription
    additionalPrinterColumns
    CustomResourceColumnDefinition array
    additionalPrinterColumns specifies additional columns returned in Table output. See https://kubernetes.io/docs/reference/using-api/api-concepts/#receiving-resources-as-tables for details. If no columns are specified, a single column displaying the age of the custom resource is used.
    deprecated
    boolean
    deprecated indicates this version of the custom resource API is deprecated. When set to true, API requests to this version receive a warning header in the server response. Defaults to false.
    deprecationWarning
    string
    deprecationWarning overrides the default warning returned to API clients. May only be set when `deprecated` is true. The default warning indicates this version is deprecated and recommends use of the newest served version of equal or greater stability, if one exists.
    name
    string
    name is the version name, e.g. “v1”, “v2beta1”, etc. The custom resources are served under this version at `/apis/<group>/<version>/...` if `served` is true.
    schema
    CustomResourceValidation
    schema describes the schema used for validation, pruning, and defaulting of this version of the custom resource.
    served
    boolean
    served is a flag enabling/disabling this version from being served via REST APIs
    storage
    boolean
    storage indicates this version should be used when persisting custom resources to storage. There must be exactly one version with storage=true.
    subresources
    CustomResourceSubresources
    subresources specify what subresources this version of the defined custom resource have.
    +

    CustomResourceSubresourceScale v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1CustomResourceSubresourceScale
    +

    CustomResourceSubresourceScale defines how to serve the scale subresource for CustomResources.

    + + + + + + + + +
    FieldDescription
    labelSelectorPath
    string
    labelSelectorPath defines the JSON path inside of a custom resource that corresponds to Scale `status.selector`. Only JSON paths without the array notation are allowed. Must be a JSON Path under `.status` or `.spec`. Must be set to work with HorizontalPodAutoscaler. The field pointed by this JSON path must be a string field (not a complex selector struct) which contains a serialized label selector in string form. More info: https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions#scale-subresource If there is no value under the given path in the custom resource, the `status.selector` value in the `/scale` subresource will default to the empty string.
    specReplicasPath
    string
    specReplicasPath defines the JSON path inside of a custom resource that corresponds to Scale `spec.replicas`. Only JSON paths without the array notation are allowed. Must be a JSON Path under `.spec`. If there is no value under the given path in the custom resource, the `/scale` subresource will return an error on GET.
    statusReplicasPath
    string
    statusReplicasPath defines the JSON path inside of a custom resource that corresponds to Scale `status.replicas`. Only JSON paths without the array notation are allowed. Must be a JSON Path under `.status`. If there is no value under the given path in the custom resource, the `status.replicas` value in the `/scale` subresource will default to 0.
    +

    CustomResourceSubresourceStatus v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1CustomResourceSubresourceStatus
    +

    CustomResourceSubresourceStatus defines how to serve the status subresource for CustomResources. Status is represented by the `.status` JSON path inside of a CustomResource. When set, * exposes a /status subresource for the custom resource * PUT requests to the /status subresource take a custom resource object, and ignore changes to anything except the status stanza * PUT/POST/PATCH requests to the custom resource ignore changes to the status stanza

    + + + + + +
    FieldDescription
    +

    CustomResourceSubresources v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1CustomResourceSubresources
    +

    CustomResourceSubresources defines the status and scale subresources for CustomResources.

    + + + + + + + +
    FieldDescription
    scale
    CustomResourceSubresourceScale
    scale indicates the custom resource should serve a `/scale` subresource that returns an `autoscaling/v1` Scale object.
    status
    CustomResourceSubresourceStatus
    status indicates the custom resource should serve a `/status` subresource. When enabled: 1. requests to the custom resource primary endpoint ignore changes to the `status` stanza of the object. 2. requests to the custom resource `/status` subresource ignore changes to anything other than the `status` stanza of the object.
    +

    CustomResourceValidation v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1CustomResourceValidation
    +

    CustomResourceValidation is a list of validation methods for CustomResources.

    + + + + + + +
    FieldDescription
    openAPIV3Schema
    JSONSchemaProps
    openAPIV3Schema is the OpenAPI v3 schema to use for validation and pruning.
    +

    DaemonEndpoint v1 core

    + + + + + +
    GroupVersionKind
    corev1DaemonEndpoint
    +

    DaemonEndpoint contains information about a single Daemon endpoint.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    Port
    integer
    Port number of the given endpoint.
    +

    DaemonSetCondition v1 apps

    + + + + + +
    GroupVersionKind
    appsv1DaemonSetCondition
    +

    DaemonSetCondition describes the state of a DaemonSet at a certain point.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    Last time the condition transitioned from one status to another.
    message
    string
    A human readable message indicating details about the transition.
    reason
    string
    The reason for the condition's last transition.
    status
    string
    Status of the condition, one of True, False, Unknown.
    type
    string
    Type of DaemonSet condition.
    +

    DaemonSetUpdateStrategy v1 apps

    + + + + + +
    GroupVersionKind
    appsv1DaemonSetUpdateStrategy
    +

    DaemonSetUpdateStrategy is a struct used to control the update strategy for a DaemonSet.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    rollingUpdate
    RollingUpdateDaemonSet
    Rolling update config params. Present only if type = "RollingUpdate".
    type
    string
    Type of daemon set update. Can be "RollingUpdate" or "OnDelete". Default is RollingUpdate. Possible enum values: - `"OnDelete"` Replace the old daemons only when it's killed - `"RollingUpdate"` Replace the old daemons by new ones using rolling update i.e replace them on each node one after the other.
    +

    DeleteOptions v1 meta

    + + + + + +
    GroupVersionKind
    metav1DeleteOptions
    +

    DeleteOptions may be provided when deleting an API object.

    +
    Appears In: + +
    + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    dryRun
    string array
    When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSeconds
    integer
    The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    orphanDependents
    boolean
    Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    preconditions
    Preconditions
    Must be fulfilled before a deletion is carried out. If not possible, a 409 Conflict status will be returned.
    propagationPolicy
    string
    Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    DeploymentCondition v1 apps

    + + + + + +
    GroupVersionKind
    appsv1DeploymentCondition
    +

    DeploymentCondition describes the state of a deployment at a certain point.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    Last time the condition transitioned from one status to another.
    lastUpdateTime
    Time
    The last time this condition was updated.
    message
    string
    A human readable message indicating details about the transition.
    reason
    string
    The reason for the condition's last transition.
    status
    string
    Status of the condition, one of True, False, Unknown.
    type
    string
    Type of deployment condition.
    +

    DownwardAPIProjection v1 core

    + + + + + +
    GroupVersionKind
    corev1DownwardAPIProjection
    +

    Represents downward API info for projecting into a projected volume. Note that this is identical to a downwardAPI volume source without the default mode.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    items
    DownwardAPIVolumeFile array
    Items is a list of DownwardAPIVolume file
    +

    DownwardAPIVolumeFile v1 core

    + + + + + +
    GroupVersionKind
    corev1DownwardAPIVolumeFile
    +

    DownwardAPIVolumeFile represents information to create the file containing the pod field

    + + + + + + + + + +
    FieldDescription
    fieldRef
    ObjectFieldSelector
    Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.
    mode
    integer
    Optional: mode bits used to set permissions on this file, must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
    path
    string
    Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'
    resourceFieldRef
    ResourceFieldSelector
    Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.
    +

    DownwardAPIVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1DownwardAPIVolumeSource
    +

    DownwardAPIVolumeSource represents a volume containing downward API info. Downward API volumes support ownership management and SELinux relabeling.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    defaultMode
    integer
    Optional: mode bits to use on created files by default. Must be a Optional: mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
    items
    DownwardAPIVolumeFile array
    Items is a list of downward API volume file
    +

    EmptyDirVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1EmptyDirVolumeSource
    +

    Represents an empty directory for a pod. Empty directory volumes support ownership management and SELinux relabeling.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    medium
    string
    What type of storage medium should back this directory. The default is "" which means to use the node's default medium. Must be an empty string (default) or Memory. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
    sizeLimit
    Quantity
    Total amount of local storage required for this EmptyDir volume. The size limit is also applicable for memory medium. The maximum usage on memory medium EmptyDir would be the minimum value between the SizeLimit specified here and the sum of memory limits of all containers in a pod. The default is nil which means that the limit is undefined. More info: http://kubernetes.io/docs/user-guide/volumes#emptydir
    +

    Endpoint v1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1Endpoint
    +

    Endpoint represents a single logical "backend" implementing a service.

    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + + + + + + + +
    FieldDescription
    addresses
    string array
    addresses of this endpoint. The contents of this field are interpreted according to the corresponding EndpointSlice addressType field. Consumers must handle different types of addresses in the context of their own capabilities. This must contain at least one address but no more than 100.
    conditions
    EndpointConditions
    conditions contains information about the current status of the endpoint.
    deprecatedTopology
    object
    deprecatedTopology contains topology information part of the v1beta1 API. This field is deprecated, and will be removed when the v1beta1 API is removed (no sooner than kubernetes v1.24). While this field can hold values, it is not writable through the v1 API, and any attempts to write to it will be silently ignored. Topology information can be found in the zone and nodeName fields instead.
    hints
    EndpointHints
    hints contains information associated with how an endpoint should be consumed.
    hostname
    string
    hostname of this endpoint. This field may be used by consumers of endpoints to distinguish endpoints from each other (e.g. in DNS names). Multiple endpoints which use the same hostname should be considered fungible (e.g. multiple A values in DNS). Must be lowercase and pass DNS Label (RFC 1123) validation.
    nodeName
    string
    nodeName represents the name of the Node hosting this endpoint. This can be used to determine endpoints local to a Node. This field can be enabled with the EndpointSliceNodeName feature gate.
    targetRef
    ObjectReference
    targetRef is a reference to a Kubernetes object that represents this endpoint.
    zone
    string
    zone is the name of the Zone this endpoint exists in.
    +

    EndpointAddress v1 core

    + + + + + +
    GroupVersionKind
    corev1EndpointAddress
    +

    EndpointAddress is a tuple that describes single IP address.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    hostname
    string
    The Hostname of this endpoint
    ip
    string
    The IP of this endpoint. May not be loopback (127.0.0.0/8), link-local (169.254.0.0/16), or link-local multicast ((224.0.0.0/24). IPv6 is also accepted but not fully supported on all platforms. Also, certain kubernetes components, like kube-proxy, are not IPv6 ready.
    nodeName
    string
    Optional: Node hosting this endpoint. This can be used to determine endpoints local to a node.
    targetRef
    ObjectReference
    Reference to object providing the endpoint.
    +

    EndpointConditions v1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1EndpointConditions
    +

    EndpointConditions represents the current condition of an endpoint.

    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    ready
    boolean
    ready indicates that this endpoint is prepared to receive traffic, according to whatever system is managing the endpoint. A nil value indicates an unknown state. In most cases consumers should interpret this unknown state as ready. For compatibility reasons, ready should never be "true" for terminating endpoints.
    serving
    boolean
    serving is identical to ready except that it is set regardless of the terminating state of endpoints. This condition should be set to true for a ready endpoint that is terminating. If nil, consumers should defer to the ready condition. This field can be enabled with the EndpointSliceTerminatingCondition feature gate.
    terminating
    boolean
    terminating indicates that this endpoint is terminating. A nil value indicates an unknown state. Consumers should interpret this unknown state to mean that the endpoint is not terminating. This field can be enabled with the EndpointSliceTerminatingCondition feature gate.
    +

    EndpointHints v1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1EndpointHints
    +

    EndpointHints provides hints describing how an endpoint should be consumed.

    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + +
    FieldDescription
    forZones
    ForZone array
    forZones indicates the zone(s) this endpoint should be consumed by to enable topology aware routing.
    +

    EndpointPort v1 core

    + + + + + +
    GroupVersionKind
    corev1EndpointPort
    +

    EndpointPort is a tuple that describes a single port.

    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    appProtocol
    string
    The application protocol for this port. This field follows standard Kubernetes label syntax. Un-prefixed names are reserved for IANA standard service names (as per RFC-6335 and http://www.iana.org/assignments/service-names). Non-standard protocols should use prefixed names such as mycompany.com/my-custom-protocol.
    name
    string
    The name of this port. This must match the 'name' field in the corresponding ServicePort. Must be a DNS_LABEL. Optional only if one port is defined.
    port
    integer
    The port number of the endpoint.
    protocol
    string
    The IP protocol for this port. Must be UDP, TCP, or SCTP. Default is TCP. Possible enum values: - `"SCTP"` is the SCTP protocol. - `"TCP"` is the TCP protocol. - `"UDP"` is the UDP protocol.
    +

    EndpointSubset v1 core

    + + + + + +
    GroupVersionKind
    corev1EndpointSubset
    +

    EndpointSubset is a group of addresses with a common set of ports. The expanded set of endpoints is the Cartesian product of Addresses x Ports. For example, given: + { + Addresses: [{"ip": "10.10.1.1"}, {"ip": "10.10.2.2"}], + Ports: [{"name": "a", "port": 8675}, {"name": "b", "port": 309}] + } +The resulting set of endpoints can be viewed as: + a: [ 10.10.1.1:8675, 10.10.2.2:8675 ], + b: [ 10.10.1.1:309, 10.10.2.2:309 ]

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    addresses
    EndpointAddress array
    IP addresses which offer the related ports that are marked as ready. These endpoints should be considered safe for load balancers and clients to utilize.
    notReadyAddresses
    EndpointAddress array
    IP addresses which offer the related ports but are not currently marked as ready because they have not yet finished starting, have recently failed a readiness check, or have recently failed a liveness check.
    ports
    EndpointPort array
    Port numbers available on the related IP addresses.
    +

    EnvFromSource v1 core

    + + + + + +
    GroupVersionKind
    corev1EnvFromSource
    +

    EnvFromSource represents the source of a set of ConfigMaps

    + + + + + + + + +
    FieldDescription
    configMapRef
    ConfigMapEnvSource
    The ConfigMap to select from
    prefix
    string
    An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
    secretRef
    SecretEnvSource
    The Secret to select from
    +

    EnvVar v1 core

    + + + + + +
    GroupVersionKind
    corev1EnvVar
    +

    EnvVar represents an environment variable present in a Container.

    + + + + + + + + +
    FieldDescription
    name
    string
    Name of the environment variable. Must be a C_IDENTIFIER.
    value
    string
    Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".
    valueFrom
    EnvVarSource
    Source for the environment variable's value. Cannot be used if value is not empty.
    +

    EnvVarSource v1 core

    + + + + + +
    GroupVersionKind
    corev1EnvVarSource
    +

    EnvVarSource represents a source for the value of an EnvVar.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    configMapKeyRef
    ConfigMapKeySelector
    Selects a key of a ConfigMap.
    fieldRef
    ObjectFieldSelector
    Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`, spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
    resourceFieldRef
    ResourceFieldSelector
    Selects a resource of the container: only resources limits and requests (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
    secretKeyRef
    SecretKeySelector
    Selects a key of a secret in the pod's namespace
    +

    EphemeralContainer v1 core

    + + + + + +
    GroupVersionKind
    corev1EphemeralContainer
    +

    An EphemeralContainer is a temporary container that you may add to an existing Pod for user-initiated activities such as debugging. Ephemeral containers have no resource or scheduling guarantees, and they will not be restarted when they exit or when a Pod is removed or restarted. The kubelet may evict a Pod if an ephemeral container causes the Pod to exceed its resource allocation. + +To add an ephemeral container, use the ephemeralcontainers subresource of an existing Pod. Ephemeral containers may not be removed or restarted. + +This is a beta feature available on clusters that haven't disabled the EphemeralContainers feature gate.

    +
    Appears In: + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    args
    string array
    Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
    command
    string array
    Entrypoint array. Not executed within a shell. The docker image's ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell
    env
    EnvVar array
    patch strategy: merge
    patch merge key: name
    List of environment variables to set in the container. Cannot be updated.
    envFrom
    EnvFromSource array
    List of sources to populate environment variables in the container. The keys defined within a source must be a C_IDENTIFIER. All invalid keys will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated.
    image
    string
    Docker image name. More info: https://kubernetes.io/docs/concepts/containers/images
    imagePullPolicy
    string
    Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images Possible enum values: - `"Always"` means that kubelet always attempts to pull the latest image. Container will fail If the pull fails. - `"IfNotPresent"` means that kubelet pulls if the image isn't present on disk. Container will fail if the image isn't present and the pull fails. - `"Never"` means that kubelet never pulls an image, but only uses a local image. Container will fail if the image isn't present
    lifecycle
    Lifecycle
    Lifecycle is not allowed for ephemeral containers.
    livenessProbe
    Probe
    Probes are not allowed for ephemeral containers.
    name
    string
    Name of the ephemeral container specified as a DNS_LABEL. This name must be unique among all containers, init containers and ephemeral containers.
    ports
    ContainerPort array
    patch strategy: merge
    patch merge key: containerPort
    Ports are not allowed for ephemeral containers.
    readinessProbe
    Probe
    Probes are not allowed for ephemeral containers.
    resources
    ResourceRequirements
    Resources are not allowed for ephemeral containers. Ephemeral containers use spare resources already allocated to the pod.
    securityContext
    SecurityContext
    Optional: SecurityContext defines the security options the ephemeral container should be run with. If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
    startupProbe
    Probe
    Probes are not allowed for ephemeral containers.
    stdin
    boolean
    Whether this container should allocate a buffer for stdin in the container runtime. If this is not set, reads from stdin in the container will always result in EOF. Default is false.
    stdinOnce
    boolean
    Whether the container runtime should close the stdin channel after it has been opened by a single attach. When stdin is true the stdin stream will remain open across multiple attach sessions. If stdinOnce is set to true, stdin is opened on container start, is empty until the first client attaches to stdin, and then remains open and accepts data until the client disconnects, at which time stdin is closed and remains closed until the container is restarted. If this flag is false, a container processes that reads from stdin will never receive an EOF. Default is false
    targetContainerName
    string
    If set, the name of the container from PodSpec that this ephemeral container targets. The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container. If not set then the ephemeral container uses the namespaces configured in the Pod spec. The container runtime must implement support for this feature. If the runtime does not support namespace targeting then the result of setting this field is undefined.
    terminationMessagePath
    string
    Optional: Path at which the file to which the container's termination message will be written is mounted into the container's filesystem. Message written is intended to be brief final status, such as an assertion failure message. Will be truncated by the node if greater than 4096 bytes. The total message length across all containers will be limited to 12kb. Defaults to /dev/termination-log. Cannot be updated.
    terminationMessagePolicy
    string
    Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated. Possible enum values: - `"FallbackToLogsOnError"` will read the most recent contents of the container logs for the container status message when the container exits with an error and the terminationMessagePath has no contents. - `"File"` is the default behavior and will set the container status message to the contents of the container's terminationMessagePath when the container exits.
    tty
    boolean
    Whether this container should allocate a TTY for itself, also requires 'stdin' to be true. Default is false.
    volumeDevices
    VolumeDevice array
    patch strategy: merge
    patch merge key: devicePath
    volumeDevices is the list of block devices to be used by the container.
    volumeMounts
    VolumeMount array
    patch strategy: merge
    patch merge key: mountPath
    Pod volumes to mount into the container's filesystem. Subpath mounts are not allowed for ephemeral containers. Cannot be updated.
    workingDir
    string
    Container's working directory. If not specified, the container runtime's default will be used, which might be configured in the container image. Cannot be updated.
    +

    EphemeralVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1EphemeralVolumeSource
    +

    Represents an ephemeral volume that is handled by a normal storage driver.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    volumeClaimTemplate
    PersistentVolumeClaimTemplate
    Will be used to create a stand-alone PVC to provision the volume. The pod in which this EphemeralVolumeSource is embedded will be the owner of the PVC, i.e. the PVC will be deleted together with the pod. The name of the PVC will be `<pod name>-<volume name>` where `<volume name>` is the name from the `PodSpec.Volumes` array entry. Pod validation will reject the pod if the concatenated name is not valid for a PVC (for example, too long). An existing PVC with that name that is not owned by the pod will *not* be used for the pod to avoid using an unrelated volume by mistake. Starting the pod is then blocked until the unrelated PVC is removed. If such a pre-created PVC is meant to be used by the pod, the PVC has to updated with an owner reference to the pod once the pod exists. Normally this should not be necessary, but it may be useful when manually reconstructing a broken cluster. This field is read-only and no changes will be made by Kubernetes to the PVC after it has been created. Required, must not be nil.
    +

    EventSeries v1 events.k8s.io

    + + + + + +
    GroupVersionKind
    events.k8s.iov1EventSeries
    +

    EventSeries contain information on series of events, i.e. thing that was/is happening continuously for some time. How often to update the EventSeries is up to the event reporters. The default event reporter in "k8s.io/client-go/tools/events/event_broadcaster.go" shows how this struct is updated on heartbeats and can guide customized reporter implementations.

    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    count
    integer
    count is the number of occurrences in this series up to the last heartbeat time.
    lastObservedTime
    MicroTime
    lastObservedTime is the time when last Event from the series was seen before last heartbeat.
    +

    EventSource v1 core

    + + + + + +
    GroupVersionKind
    corev1EventSource
    +

    EventSource contains information for an event.

    + + + + + + + +
    FieldDescription
    component
    string
    Component from which the event is generated.
    host
    string
    Node name on which the event is generated.
    +

    Eviction v1 policy

    + + + + + +
    GroupVersionKind
    policyv1Eviction
    +

    Eviction evicts a pod from its node subject to certain policies and safety constraints. This is a subresource of Pod. A request to cause such an eviction is created by POSTing to .../pods/<pod name>/evictions.

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    deleteOptions
    DeleteOptions
    DeleteOptions may be provided
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    ObjectMeta describes the pod that is being evicted.
    +

    ExecAction v1 core

    + + + + + +
    GroupVersionKind
    corev1ExecAction
    +

    ExecAction describes a "run in container" action.

    + + + + + + +
    FieldDescription
    command
    string array
    Command is the command line to execute inside the container, the working directory for the command is root ('/') in the container's filesystem. The command is simply exec'd, it is not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use a shell, you need to explicitly call out to that shell. Exit status of 0 is treated as live/healthy and non-zero is unhealthy.
    +

    ExternalDocumentation v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1ExternalDocumentation
    +

    ExternalDocumentation allows referencing an external resource for extended documentation.

    + + + + + + + +
    FieldDescription
    description
    string
    url
    string
    +

    ExternalMetricSource v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2ExternalMetricSource
    +

    ExternalMetricSource indicates how to scale on a metric not associated with any Kubernetes object (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    target
    MetricTarget
    target specifies the target value for the given metric
    +

    ExternalMetricStatus v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2ExternalMetricStatus
    +

    ExternalMetricStatus indicates the current value of a global metric not associated with any Kubernetes object.

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    current
    MetricValueStatus
    current contains the current value for the given metric
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    +

    FCVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1FCVolumeSource
    +

    Represents a Fibre Channel volume. Fibre Channel volumes can only be mounted as read/write once. Fibre Channel volumes support ownership management and SELinux relabeling.

    + + + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
    lun
    integer
    Optional: FC target lun number
    readOnly
    boolean
    Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    targetWWNs
    string array
    Optional: FC target worldwide names (WWNs)
    wwids
    string array
    Optional: FC volume world wide identifiers (wwids) Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously.
    +

    FSGroupStrategyOptions v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1FSGroupStrategyOptions
    +

    FSGroupStrategyOptions defines the strategy type and options used to create the strategy.

    + + + + + + + +
    FieldDescription
    ranges
    IDRange array
    ranges are the allowed ranges of fs groups. If you would like to force a single fs group then supply a single range with the same start and end. Required for MustRunAs.
    rule
    string
    rule is the strategy that will dictate what FSGroup is used in the SecurityContext.
    +

    FieldsV1 v1 meta

    + + + + + +
    GroupVersionKind
    metav1FieldsV1
    +

    FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format. + +Each key is either a '.' representing the field itself, and will always map to an empty set, or a string representing a sub-field or item. The string will follow one of these four formats: 'f:<name>', where <name> is the name of a field in a struct, or key in a map 'v:<value>', where <value> is the exact json formatted value of a list item 'i:<index>', where <index> is position of a item in a list 'k:<keys>', where <keys> is a map of a list item's key fields to their unique values If a key maps to an empty Fields value, the field that key represents is part of the set. + +The exact format is defined in sigs.k8s.io/structured-merge-diff

    +
    Appears In: + +
    + + + + +
    FieldDescription
    +

    FlexPersistentVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1FlexPersistentVolumeSource
    +

    FlexPersistentVolumeSource represents a generic persistent volume resource that is provisioned/attached using an exec based plugin.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    driver
    string
    Driver is the name of the driver to use for this volume.
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script.
    options
    object
    Optional: Extra command options if any.
    readOnly
    boolean
    Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    secretRef
    SecretReference
    Optional: SecretRef is reference to the secret object containing sensitive information to pass to the plugin scripts. This may be empty if no secret object is specified. If the secret object contains more than one secret, all secrets are passed to the plugin scripts.
    +

    FlexVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1FlexVolumeSource
    +

    FlexVolume represents a generic volume resource that is provisioned/attached using an exec based plugin.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    driver
    string
    Driver is the name of the driver to use for this volume.
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script.
    options
    object
    Optional: Extra command options if any.
    readOnly
    boolean
    Optional: Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    secretRef
    LocalObjectReference
    Optional: SecretRef is reference to the secret object containing sensitive information to pass to the plugin scripts. This may be empty if no secret object is specified. If the secret object contains more than one secret, all secrets are passed to the plugin scripts.
    +

    FlockerVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1FlockerVolumeSource
    +

    Represents a Flocker volume mounted by the Flocker agent. One and only one of datasetName and datasetUUID should be set. Flocker volumes do not support ownership management or SELinux relabeling.

    + + + + + + + +
    FieldDescription
    datasetName
    string
    Name of the dataset stored as metadata -> name on the dataset for Flocker should be considered as deprecated
    datasetUUID
    string
    UUID of the dataset. This is unique identifier of a Flocker dataset
    +

    FlowDistinguisherMethod v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2FlowDistinguisherMethod
    +

    FlowDistinguisherMethod specifies the method of a flow distinguisher.

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + +
    FieldDescription
    type
    string
    `type` is the type of flow distinguisher method The supported types are "ByUser" and "ByNamespace". Required.
    +

    FlowSchema v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2FlowSchema
    +

    FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with similar attributes and is identified by a pair of strings: the name of the FlowSchema and a "flow distinguisher".

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    FlowSchemaSpec
    `spec` is the specification of the desired behavior of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    FlowSchemaStatus
    `status` is the current status of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    FlowSchemaCondition v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2FlowSchemaCondition
    +

    FlowSchemaCondition describes conditions for a FlowSchema.

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    `lastTransitionTime` is the last time the condition transitioned from one status to another.
    message
    string
    `message` is a human-readable message indicating details about last transition.
    reason
    string
    `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
    status
    string
    `status` is the status of the condition. Can be True, False, Unknown. Required.
    type
    string
    `type` is the type of the condition. Required.
    +

    ForZone v1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1ForZone
    +

    ForZone provides information about which zones should consume this endpoint.

    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + +
    FieldDescription
    name
    string
    name represents the name of the zone.
    +

    GCEPersistentDiskVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1GCEPersistentDiskVolumeSource
    +

    Represents a Persistent Disk resource in Google Compute Engine. + +A GCE PD must exist before mounting to a container. The disk must also be in the same GCE project and zone as the kubelet. A GCE PD can only be mounted as read/write once or read-only many times. GCE PDs support ownership management and SELinux relabeling.

    + + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
    partition
    integer
    The partition in the volume that you want to mount. If omitted, the default is to mount by volume name. Examples: For volume /dev/sda1, you specify the partition as "1". Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
    pdName
    string
    Unique name of the PD resource in GCE. Used to identify the disk in GCE. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
    readOnly
    boolean
    ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk
    +

    GRPCAction v1 core

    + + + + + +
    GroupVersionKind
    corev1GRPCAction
    +

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    port
    integer
    Port number of the gRPC service. Number must be in the range 1 to 65535.
    service
    string
    Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). If this is not specified, the default behavior is defined by gRPC.
    +

    GitRepoVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1GitRepoVolumeSource
    +

    Represents a volume that is populated with the contents of a git repository. Git repo volumes do not support ownership management. Git repo volumes support SELinux relabeling. + +DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    directory
    string
    Target directory name. Must not contain or start with '..'. If '.' is supplied, the volume directory will be the git repository. Otherwise, if specified, the volume will contain the git repository in the subdirectory with the given name.
    repository
    string
    Repository URL
    revision
    string
    Commit hash for the specified revision.
    +

    GlusterfsPersistentVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1GlusterfsPersistentVolumeSource
    +

    Represents a Glusterfs mount that lasts the lifetime of a pod. Glusterfs volumes do not support ownership management or SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    endpoints
    string
    EndpointsName is the endpoint name that details Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
    endpointsNamespace
    string
    EndpointsNamespace is the namespace that contains Glusterfs endpoint. If this field is empty, the EndpointNamespace defaults to the same namespace as the bound PVC. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
    path
    string
    Path is the Glusterfs volume path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
    readOnly
    boolean
    ReadOnly here will force the Glusterfs volume to be mounted with read-only permissions. Defaults to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
    +

    GlusterfsVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1GlusterfsVolumeSource
    +

    Represents a Glusterfs mount that lasts the lifetime of a pod. Glusterfs volumes do not support ownership management or SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    endpoints
    string
    EndpointsName is the endpoint name that details Glusterfs topology. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
    path
    string
    Path is the Glusterfs volume path. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
    readOnly
    boolean
    ReadOnly here will force the Glusterfs volume to be mounted with read-only permissions. Defaults to false. More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod
    +

    GroupSubject v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2GroupSubject
    +

    GroupSubject holds detailed information for group-kind subject.

    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + +
    FieldDescription
    name
    string
    name is the user group that matches, or "*" to match all user groups. See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some well-known group names. Required.
    +

    GroupVersionForDiscovery v1 meta

    + + + + + +
    GroupVersionKind
    metav1GroupVersionForDiscovery
    +

    GroupVersion contains the "group/version" and "version" string of a version. It is made a struct to keep extensibility.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    groupVersion
    string
    groupVersion specifies the API group and version in the form "group/version"
    version
    string
    version specifies the version in the form of "version". This is to save the clients the trouble of splitting the GroupVersion.
    +

    HPAScalingPolicy v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2HPAScalingPolicy
    +

    HPAScalingPolicy is a single policy which must hold true for a specified past interval.

    +
    Other API versions of this object exist: +v2beta2 +
    + + + + + + + + +
    FieldDescription
    periodSeconds
    integer
    PeriodSeconds specifies the window of time for which the policy should hold true. PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).
    type
    string
    Type is used to specify the scaling policy.
    value
    integer
    Value contains the amount of change which is permitted by the policy. It must be greater than zero
    +

    HPAScalingRules v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2HPAScalingRules
    +

    HPAScalingRules configures the scaling behavior for one direction. These Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.

    +
    Other API versions of this object exist: +v2beta2 +
    + + + + + + + + +
    FieldDescription
    policies
    HPAScalingPolicy array
    policies is a list of potential scaling polices which can be used during scaling. At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
    selectPolicy
    string
    selectPolicy is used to specify which policy should be used. If not set, the default value Max is used.
    stabilizationWindowSeconds
    integer
    StabilizationWindowSeconds is the number of seconds for which past recommendations should be considered while scaling up or scaling down. StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour). If not set, use the default values: - For scale up: 0 (i.e. no stabilization is done). - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
    +

    HTTPGetAction v1 core

    + + + + + +
    GroupVersionKind
    corev1HTTPGetAction
    +

    HTTPGetAction describes an action based on HTTP Get requests.

    + + + + + + + + + + +
    FieldDescription
    host
    string
    Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead.
    httpHeaders
    HTTPHeader array
    Custom headers to set in the request. HTTP allows repeated headers.
    path
    string
    Path to access on the HTTP server.
    portName or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
    scheme
    string
    Scheme to use for connecting to the host. Defaults to HTTP. Possible enum values: - `"HTTP"` means that the scheme used will be http:// - `"HTTPS"` means that the scheme used will be https://
    +

    HTTPHeader v1 core

    + + + + + +
    GroupVersionKind
    corev1HTTPHeader
    +

    HTTPHeader describes a custom header to be used in HTTP probes

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    name
    string
    The header field name
    value
    string
    The header field value
    +

    HTTPIngressPath v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1HTTPIngressPath
    +

    HTTPIngressPath associates a path with a backend. Incoming urls matching the path are forwarded to the backend.

    + + + + + + + + +
    FieldDescription
    backend
    IngressBackend
    Backend defines the referenced service endpoint to which the traffic will be forwarded to.
    path
    string
    Path is matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. Paths must begin with a '/' and must be present when using PathType with value "Exact" or "Prefix".
    pathType
    string
    PathType determines the interpretation of the Path matching. PathType can be one of the following values: * Exact: Matches the URL path exactly. * Prefix: Matches based on a URL path prefix split by '/'. Matching is done on a path element by element basis. A path element refers is the list of labels in the path split by the '/' separator. A request is a match for path p if every p is an element-wise prefix of p of the request path. Note that if the last element of the path is a substring of the last element in request path, it is not a match (e.g. /foo/bar matches /foo/bar/baz, but does not match /foo/barbaz). * ImplementationSpecific: Interpretation of the Path matching is up to the IngressClass. Implementations can treat this as a separate PathType or treat it identically to Prefix or Exact path types. Implementations are required to support all path types.
    +

    HTTPIngressRuleValue v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1HTTPIngressRuleValue
    +

    HTTPIngressRuleValue is a list of http selectors pointing to backends. In the example: http://<host>/<path>?<searchpart> -> backend where where parts of the url correspond to RFC 3986, this resource will be used to match against everything after the last '/' and before the first '?' or '#'.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    paths
    HTTPIngressPath array
    A collection of paths that map requests to backends.
    +

    HorizontalPodAutoscaler v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2HorizontalPodAutoscaler
    +

    HorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified.

    +
    Other API versions of this object exist: +v1 +v2beta2 +v2beta1 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    HorizontalPodAutoscalerSpec
    spec is the specification for the behaviour of the autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
    status
    HorizontalPodAutoscalerStatus
    status is the current information about the autoscaler.
    +

    HorizontalPodAutoscalerBehavior v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2HorizontalPodAutoscalerBehavior
    +

    HorizontalPodAutoscalerBehavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively).

    +
    Other API versions of this object exist: +v2beta2 +
    + + + + + + + +
    FieldDescription
    scaleDown
    HPAScalingRules
    scaleDown is scaling policy for scaling Down. If not set, the default value is to allow to scale down to minReplicas pods, with a 300 second stabilization window (i.e., the highest recommendation for the last 300sec is used).
    scaleUp
    HPAScalingRules
    scaleUp is scaling policy for scaling Up. If not set, the default value is the higher of: * increase no more than 4 pods per 60 seconds * double the number of pods per 60 seconds No stabilization is used.
    +

    HorizontalPodAutoscalerCondition v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2HorizontalPodAutoscalerCondition
    +

    HorizontalPodAutoscalerCondition describes the state of a HorizontalPodAutoscaler at a certain point.

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    lastTransitionTime is the last time the condition transitioned from one status to another
    message
    string
    message is a human-readable explanation containing details about the transition
    reason
    string
    reason is the reason for the condition's last transition.
    status
    string
    status is the status of the condition (True, False, Unknown)
    type
    string
    type describes the current condition
    +

    HostAlias v1 core

    + + + + + +
    GroupVersionKind
    corev1HostAlias
    +

    HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    hostnames
    string array
    Hostnames for the above IP address.
    ip
    string
    IP address of the host file entry.
    +

    HostPathVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1HostPathVolumeSource
    +

    Represents a host path mapped into a pod. Host path volumes do not support ownership management or SELinux relabeling.

    + + + + + + + +
    FieldDescription
    path
    string
    Path of the directory on the host. If the path is a symlink, it will follow the link to the real path. More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
    type
    string
    Type for HostPath Volume Defaults to "" More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
    +

    HostPortRange v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1HostPortRange
    +

    HostPortRange defines a range of host ports that will be enabled by a policy for pods to use. It requires both the start and end to be defined.

    + + + + + + + +
    FieldDescription
    max
    integer
    max is the end of the range, inclusive.
    min
    integer
    min is the start of the range, inclusive.
    +

    IDRange v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1IDRange
    +

    IDRange provides a min/max of an allowed range of IDs.

    + + + + + + + +
    FieldDescription
    max
    integer
    max is the end of the range, inclusive.
    min
    integer
    min is the start of the range, inclusive.
    +

    IPBlock v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1IPBlock
    +

    IPBlock describes a particular CIDR (Ex. "192.168.1.1/24","2001:db9::/64") that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should not be included within this rule.

    + + + + + + + +
    FieldDescription
    cidr
    string
    CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64"
    except
    string array
    Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" or "2001:db9::/64" Except values will be rejected if they are outside the CIDR range
    +

    ISCSIPersistentVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1ISCSIPersistentVolumeSource
    +

    ISCSIPersistentVolumeSource represents an ISCSI disk. ISCSI volumes can only be mounted as read/write once. ISCSI volumes support ownership management and SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + + + + + + + + +
    FieldDescription
    chapAuthDiscovery
    boolean
    whether support iSCSI Discovery CHAP authentication
    chapAuthSession
    boolean
    whether support iSCSI Session CHAP authentication
    fsType
    string
    Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi
    initiatorName
    string
    Custom iSCSI Initiator Name. If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface <target portal>:<volume name> will be created for the connection.
    iqn
    string
    Target iSCSI Qualified Name.
    iscsiInterface
    string
    iSCSI Interface Name that uses an iSCSI transport. Defaults to 'default' (tcp).
    lun
    integer
    iSCSI Target Lun number.
    portals
    string array
    iSCSI Target Portal List. The Portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260).
    readOnly
    boolean
    ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false.
    secretRef
    SecretReference
    CHAP Secret for iSCSI target and initiator authentication
    targetPortal
    string
    iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260).
    +

    ISCSIVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1ISCSIVolumeSource
    +

    Represents an ISCSI disk. ISCSI volumes can only be mounted as read/write once. ISCSI volumes support ownership management and SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + + + + + + + + +
    FieldDescription
    chapAuthDiscovery
    boolean
    whether support iSCSI Discovery CHAP authentication
    chapAuthSession
    boolean
    whether support iSCSI Session CHAP authentication
    fsType
    string
    Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi
    initiatorName
    string
    Custom iSCSI Initiator Name. If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface <target portal>:<volume name> will be created for the connection.
    iqn
    string
    Target iSCSI Qualified Name.
    iscsiInterface
    string
    iSCSI Interface Name that uses an iSCSI transport. Defaults to 'default' (tcp).
    lun
    integer
    iSCSI Target Lun number.
    portals
    string array
    iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260).
    readOnly
    boolean
    ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false.
    secretRef
    LocalObjectReference
    CHAP Secret for iSCSI target and initiator authentication
    targetPortal
    string
    iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port is other than default (typically TCP ports 860 and 3260).
    +

    IngressBackend v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1IngressBackend
    +

    IngressBackend describes all endpoints for a given service and port.

    + + + + + + + +
    FieldDescription
    resource
    TypedLocalObjectReference
    Resource is an ObjectRef to another Kubernetes resource in the namespace of the Ingress object. If resource is specified, a service.Name and service.Port must not be specified. This is a mutually exclusive setting with "Service".
    service
    IngressServiceBackend
    Service references a Service as a Backend. This is a mutually exclusive setting with "Resource".
    +

    IngressClassParametersReference v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1IngressClassParametersReference
    +

    IngressClassParametersReference identifies an API object. This can be used to specify a cluster or namespace-scoped resource.

    + + + + + + + + + + +
    FieldDescription
    apiGroup
    string
    APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required.
    kind
    string
    Kind is the type of resource being referenced.
    name
    string
    Name is the name of resource being referenced.
    namespace
    string
    Namespace is the namespace of the resource being referenced. This field is required when scope is set to "Namespace" and must be unset when scope is set to "Cluster".
    scope
    string
    Scope represents if this refers to a cluster or namespace scoped resource. This may be set to "Cluster" (default) or "Namespace".
    +

    IngressRule v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1IngressRule
    +

    IngressRule represents the rules mapping the paths under a specified host to the related backend services. Incoming requests are first evaluated for a host match, then routed to the backend associated with the matching IngressRuleValue.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    host
    string
    Host is the fully qualified domain name of a network host, as defined by RFC 3986. Note the following deviations from the "host" part of the URI as defined in RFC 3986: 1. IPs are not allowed. Currently an IngressRuleValue can only apply to the IP in the Spec of the parent Ingress. 2. The `:` delimiter is not respected because ports are not allowed. Currently the port of an Ingress is implicitly :80 for http and :443 for https. Both these may change in the future. Incoming requests are matched against the host before the IngressRuleValue. If the host is unspecified, the Ingress routes all traffic based on the specified IngressRuleValue. Host can be "precise" which is a domain name without the terminating dot of a network host (e.g. "foo.bar.com") or "wildcard", which is a domain name prefixed with a single wildcard label (e.g. "*.foo.com"). The wildcard character '\*' must appear by itself as the first DNS label and matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*"). Requests will be matched against the Host field in the following way: 1. If Host is precise, the request matches this rule if the http host header is equal to Host. 2. If Host is a wildcard, then the request matches this rule if the http host header is to equal to the suffix (removing the first label) of the wildcard rule.
    http
    HTTPIngressRuleValue
    +

    IngressServiceBackend v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1IngressServiceBackend
    +

    IngressServiceBackend references a Kubernetes Service as a Backend.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    name
    string
    Name is the referenced service. The service must exist in the same namespace as the Ingress object.
    port
    ServiceBackendPort
    Port of the referenced service. A port name or port number is required for a IngressServiceBackend.
    +

    IngressTLS v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1IngressTLS
    +

    IngressTLS describes the transport layer security associated with an Ingress.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    hosts
    string array
    Hosts are a list of hosts included in the TLS certificate. The values in this list must match the name/s used in the tlsSecret. Defaults to the wildcard host setting for the loadbalancer controller fulfilling this Ingress, if left unspecified.
    secretName
    string
    SecretName is the name of the secret used to terminate TLS traffic on port 443. Field is left optional to allow TLS routing based on SNI hostname alone. If the SNI host in a listener conflicts with the "Host" header field used by an IngressRule, the SNI host is used for termination and value of the Host header is used for routing.
    +

    JSON v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1JSON
    +

    JSON represents any valid JSON value. These types are supported: bool, int64, float64, string, []interface{}, map[string]interface{} and nil.

    + + + + + +
    FieldDescription
    +

    JSONSchemaProps v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1JSONSchemaProps
    +

    JSONSchemaProps is a JSON-Schema following Specification Draft 4 (http://json-schema.org/).

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    $ref
    string
    $schema
    string
    additionalItems
    JSONSchemaPropsOrBool
    additionalProperties
    JSONSchemaPropsOrBool
    allOf
    JSONSchemaProps array
    anyOf
    JSONSchemaProps array
    default
    JSON
    default is a default value for undefined object fields. Defaulting is a beta feature under the CustomResourceDefaulting feature gate. Defaulting requires spec.preserveUnknownFields to be false.
    definitions
    object
    dependencies
    object
    description
    string
    enum
    JSON array
    example
    JSON
    exclusiveMaximum
    boolean
    exclusiveMinimum
    boolean
    externalDocs
    ExternalDocumentation
    format
    string
    format is an OpenAPI v3 format string. Unknown formats are ignored. The following formats are validated: - bsonobjectid: a bson object ID, i.e. a 24 characters hex string - uri: an URI as parsed by Golang net/url.ParseRequestURI - email: an email address as parsed by Golang net/mail.ParseAddress - hostname: a valid representation for an Internet host name, as defined by RFC 1034, section 3.1 [RFC1034]. - ipv4: an IPv4 IP as parsed by Golang net.ParseIP - ipv6: an IPv6 IP as parsed by Golang net.ParseIP - cidr: a CIDR as parsed by Golang net.ParseCIDR - mac: a MAC address as parsed by Golang net.ParseMAC - uuid: an UUID that allows uppercase defined by the regex (?i)^[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}$ - uuid3: an UUID3 that allows uppercase defined by the regex (?i)^[0-9a-f]{8}-?[0-9a-f]{4}-?3[0-9a-f]{3}-?[0-9a-f]{4}-?[0-9a-f]{12}$ - uuid4: an UUID4 that allows uppercase defined by the regex (?i)^[0-9a-f]{8}-?[0-9a-f]{4}-?4[0-9a-f]{3}-?[89ab][0-9a-f]{3}-?[0-9a-f]{12}$ - uuid5: an UUID5 that allows uppercase defined by the regex (?i)^[0-9a-f]{8}-?[0-9a-f]{4}-?5[0-9a-f]{3}-?[89ab][0-9a-f]{3}-?[0-9a-f]{12}$ - isbn: an ISBN10 or ISBN13 number string like "0321751043" or "978-0321751041" - isbn10: an ISBN10 number string like "0321751043" - isbn13: an ISBN13 number string like "978-0321751041" - creditcard: a credit card number defined by the regex ^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})$ with any non digit characters mixed in - ssn: a U.S. social security number following the regex ^\d{3}[- ]?\d{2}[- ]?\d{4}$ - hexcolor: an hexadecimal color code like "#FFFFFF: following the regex ^#?([0-9a-fA-F]{3}|[0-9a-fA-F]{6})$ - rgbcolor: an RGB color code like rgb like "rgb(255,255,2559" - byte: base64 encoded binary data - password: any kind of string - date: a date string like "2006-01-02" as defined by full-date in RFC3339 - duration: a duration string like "22 ns" as parsed by Golang time.ParseDuration or compatible with Scala duration format - datetime: a date time string like "2014-12-15T19:30:20.000Z" as defined by date-time in RFC3339.
    id
    string
    items
    JSONSchemaPropsOrArray
    maxItems
    integer
    maxLength
    integer
    maxProperties
    integer
    maximum
    number
    minItems
    integer
    minLength
    integer
    minProperties
    integer
    minimum
    number
    multipleOf
    number
    not
    JSONSchemaProps
    nullable
    boolean
    oneOf
    JSONSchemaProps array
    pattern
    string
    patternProperties
    object
    properties
    object
    required
    string array
    title
    string
    type
    string
    uniqueItems
    boolean
    x-kubernetes-embedded-resource
    boolean
    x-kubernetes-embedded-resource defines that the value is an embedded Kubernetes runtime.Object, with TypeMeta and ObjectMeta. The type must be object. It is allowed to further restrict the embedded object. kind, apiVersion and metadata are validated automatically. x-kubernetes-preserve-unknown-fields is allowed to be true, but does not have to be if the object is fully specified (up to kind, apiVersion, metadata).
    x-kubernetes-int-or-string
    boolean
    x-kubernetes-int-or-string specifies that this value is either an integer or a string. If this is true, an empty type is allowed and type as child of anyOf is permitted if following one of the following patterns: 1) anyOf: - type: integer - type: string 2) allOf: - anyOf: - type: integer - type: string - ... zero or more
    x-kubernetes-list-map-keys
    string array
    x-kubernetes-list-map-keys annotates an array with the x-kubernetes-list-type `map` by specifying the keys used as the index of the map. This tag MUST only be used on lists that have the "x-kubernetes-list-type" extension set to "map". Also, the values specified for this attribute must be a scalar typed field of the child structure (no nesting is supported). The properties specified must either be required or have a default value, to ensure those properties are present for all list items.
    x-kubernetes-list-type
    string
    x-kubernetes-list-type annotates an array to further describe its topology. This extension must only be used on lists and may have 3 possible values: 1) `atomic`: the list is treated as a single entity, like a scalar. Atomic lists will be entirely replaced when updated. This extension may be used on any type of list (struct, scalar, ...). 2) `set`: Sets are lists that must not have multiple items with the same value. Each value must be a scalar, an object with x-kubernetes-map-type `atomic` or an array with x-kubernetes-list-type `atomic`. 3) `map`: These lists are like maps in that their elements have a non-index key used to identify them. Order is preserved upon merge. The map tag must only be used on a list with elements of type object. Defaults to atomic for arrays.
    x-kubernetes-map-type
    string
    x-kubernetes-map-type annotates an object to further describe its topology. This extension must only be used when type is object and may have 2 possible values: 1) `granular`: These maps are actual maps (key-value pairs) and each fields are independent from each other (they can each be manipulated by separate actors). This is the default behaviour for all maps. 2) `atomic`: the list is treated as a single entity, like a scalar. Atomic maps will be entirely replaced when updated.
    x-kubernetes-preserve-unknown-fields
    boolean
    x-kubernetes-preserve-unknown-fields stops the API server decoding step from pruning fields which are not specified in the validation schema. This affects fields recursively, but switches back to normal pruning behaviour if nested properties or additionalProperties are specified in the schema. This can either be true or undefined. False is forbidden.
    x-kubernetes-validations
    ValidationRule array
    patch strategy: merge
    patch merge key: rule
    x-kubernetes-validations describes a list of validation rules written in the CEL expression language. This field is an alpha-level. Using this field requires the feature gate `CustomResourceValidationExpressions` to be enabled.
    +

    JSONSchemaPropsOrArray v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1JSONSchemaPropsOrArray
    +

    JSONSchemaPropsOrArray represents a value that can either be a JSONSchemaProps or an array of JSONSchemaProps. Mainly here for serialization purposes.

    + + + + + +
    FieldDescription
    +

    JSONSchemaPropsOrBool v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1JSONSchemaPropsOrBool
    +

    JSONSchemaPropsOrBool represents JSONSchemaProps or a boolean value. Defaults to true for the boolean property.

    + + + + + +
    FieldDescription
    +

    JobCondition v1 batch

    + + + + + +
    GroupVersionKind
    batchv1JobCondition
    +

    JobCondition describes current state of a job.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    lastProbeTime
    Time
    Last time the condition was checked.
    lastTransitionTime
    Time
    Last time the condition transit from one status to another.
    message
    string
    Human readable message indicating details about last transition.
    reason
    string
    (brief) reason for the condition's last transition.
    status
    string
    Status of the condition, one of True, False, Unknown.
    type
    string
    Type of job condition, Complete or Failed. Possible enum values: - `"Complete"` means the job has completed its execution. - `"Failed"` means the job has failed its execution. - `"Suspended"` means the job has been suspended.
    +

    JobTemplateSpec v1 batch

    + + + + + +
    GroupVersionKind
    batchv1JobTemplateSpec
    +

    JobTemplateSpec describes the data a Job should have when created from a template

    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    metadata
    ObjectMeta
    Standard object's metadata of the jobs created from this template. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    JobSpec
    Specification of the desired behavior of the job. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    KeyToPath v1 core

    + + + + + +
    GroupVersionKind
    corev1KeyToPath
    +

    Maps a string key to a path within a volume.

    + + + + + + + + +
    FieldDescription
    key
    string
    The key to project.
    mode
    integer
    Optional: mode bits used to set permissions on this file. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. If not specified, the volume defaultMode will be used. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
    path
    string
    The relative path of the file to map the key to. May not be an absolute path. May not contain the path element '..'. May not start with the string '..'.
    +

    LabelSelector v1 meta

    + + + + + +
    GroupVersionKind
    metav1LabelSelector
    +

    A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.

    + + + + + + + +
    FieldDescription
    matchExpressions
    LabelSelectorRequirement array
    matchExpressions is a list of label selector requirements. The requirements are ANDed.
    matchLabels
    object
    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
    +

    LabelSelectorRequirement v1 meta

    + + + + + +
    GroupVersionKind
    metav1LabelSelectorRequirement
    +

    A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    key
    string
    patch strategy: merge
    patch merge key: key
    key is the label key that the selector applies to.
    operator
    string
    operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
    values
    string array
    values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
    +

    Lifecycle v1 core

    + + + + + +
    GroupVersionKind
    corev1Lifecycle
    +

    Lifecycle describes actions that the management system should take in response to container lifecycle events. For the PostStart and PreStop lifecycle handlers, management of the container blocks until the action is complete, unless the container process fails, in which case the handler is aborted.

    + + + + + + + +
    FieldDescription
    postStart
    LifecycleHandler
    PostStart is called immediately after a container is created. If the handler fails, the container is terminated and restarted according to its restart policy. Other management of the container blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
    preStop
    LifecycleHandler
    PreStop is called immediately before a container is terminated due to an API request or management event such as liveness/startup probe failure, preemption, resource contention, etc. The handler is not called if the container crashes or exits. The Pod's termination grace period countdown begins before the PreStop hook is executed. Regardless of the outcome of the handler, the container will eventually terminate within the Pod's termination grace period (unless delayed by finalizers). Other management of the container blocks until the hook completes or until the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks
    +

    LifecycleHandler v1 core

    + + + + + +
    GroupVersionKind
    corev1LifecycleHandler
    +

    LifecycleHandler defines a specific action that should be taken in a lifecycle hook. One and only one of the fields, except TCPSocket must be specified.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    exec
    ExecAction
    Exec specifies the action to take.
    httpGet
    HTTPGetAction
    HTTPGet specifies the http request to perform.
    tcpSocket
    TCPSocketAction
    Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept for the backward compatibility. There are no validation of this field and lifecycle hooks will fail in runtime when tcp handler is specified.
    +

    LimitRangeItem v1 core

    + + + + + +
    GroupVersionKind
    corev1LimitRangeItem
    +

    LimitRangeItem defines a min/max usage limit for any resource that matches on kind.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    default
    object
    Default resource requirement limit value by resource name if resource limit is omitted.
    defaultRequest
    object
    DefaultRequest is the default resource requirement request value by resource name if resource request is omitted.
    max
    object
    Max usage constraints on this kind by resource name.
    maxLimitRequestRatio
    object
    MaxLimitRequestRatio if specified, the named resource must have a request and limit that are both non-zero where limit divided by request is less than or equal to the enumerated value; this represents the max burst for the named resource.
    min
    object
    Min usage constraints on this kind by resource name.
    type
    string
    Type of resource that this limit applies to. Possible enum values: - `"Container"` Limit that applies to all containers in a namespace - `"PersistentVolumeClaim"` Limit that applies to all persistent volume claims in a namespace - `"Pod"` Limit that applies to all pods in a namespace
    +

    LimitResponse v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2LimitResponse
    +

    LimitResponse defines how to handle requests that can not be executed right now.

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + +
    FieldDescription
    queuing
    QueuingConfiguration
    `queuing` holds the configuration parameters for queuing. This field may be non-empty only if `type` is `"Queue"`.
    type
    string
    `type` is "Queue" or "Reject". "Queue" means that requests that can not be executed upon arrival are held in a queue until they can be executed or a queuing limit is reached. "Reject" means that requests that can not be executed upon arrival are rejected. Required.
    +

    LimitedPriorityLevelConfiguration v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2LimitedPriorityLevelConfiguration
    +

    LimitedPriorityLevelConfiguration specifies how to handle requests that are subject to limits. It addresses two issues: + * How are requests for this priority level limited? + * What should be done with requests that exceed the limit?

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + +
    FieldDescription
    assuredConcurrencyShares
    integer
    `assuredConcurrencyShares` (ACS) configures the execution limit, which is a limit on the number of requests of this priority level that may be exeucting at a given time. ACS must be a positive number. The server's concurrency limit (SCL) is divided among the concurrency-controlled priority levels in proportion to their assured concurrency shares. This produces the assured concurrency value (ACV) --- the number of requests that may be executing at a time --- for each such priority level: ACV(l) = ceil( SCL * ACS(l) / ( sum[priority levels k] ACS(k) ) ) bigger numbers of ACS mean more reserved concurrent requests (at the expense of every other PL). This field has a default value of 30.
    limitResponse
    LimitResponse
    `limitResponse` indicates what to do with requests that can not be executed right now
    +

    ListMeta v1 meta

    + + + + + +
    GroupVersionKind
    metav1ListMeta
    +

    ListMeta describes metadata that synthetic resources must have, including lists and various status objects. A resource may have only one of {ObjectMeta, ListMeta}.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    continue
    string
    continue may be set if the user set a limit on the number of items returned, and indicates that the server has more data available. The value is opaque and may be used to issue another request to the endpoint that served this list to retrieve the next set of available objects. Continuing a consistent list may not be possible if the server configuration has changed or more than a few minutes have passed. The resourceVersion field returned when using this continue value will be identical to the value in the first response, unless you have received this token from an error message.
    remainingItemCount
    integer
    remainingItemCount is the number of subsequent items in the list which are not included in this list response. If the list request contained label or field selectors, then the number of remaining items is unknown and the field will be left unset and omitted during serialization. If the list is complete (either because it is not chunking or because this is the last chunk), then there are no more remaining items and this field will be left unset and omitted during serialization. Servers older than v1.15 do not set this field. The intended use of the remainingItemCount is *estimating* the size of a collection. Clients should not rely on the remainingItemCount to be set or to be exact.
    resourceVersion
    string
    String that identifies the server's internal version of this object that can be used by clients to determine when objects have changed. Value must be treated as opaque by clients and passed unmodified back to the server. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
    selfLink
    string
    selfLink is a URL representing this object. Populated by the system. Read-only. DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.
    +

    LoadBalancerIngress v1 core

    + + + + + +
    GroupVersionKind
    corev1LoadBalancerIngress
    +

    LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    hostname
    string
    Hostname is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)
    ip
    string
    IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)
    ports
    PortStatus array
    Ports is a list of records of service ports If used, every port defined in the service should have an entry in it
    +

    LoadBalancerStatus v1 core

    + + + + + +
    GroupVersionKind
    corev1LoadBalancerStatus
    +

    LoadBalancerStatus represents the status of a load-balancer.

    + + + + + + +
    FieldDescription
    ingress
    LoadBalancerIngress array
    Ingress is a list containing ingress points for the load-balancer. Traffic intended for the service should be sent to these ingress points.
    +

    LocalObjectReference v1 core

    + + + + + +
    GroupVersionKind
    corev1LocalObjectReference
    +

    LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace.

    + + + + + + +
    FieldDescription
    name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    +

    LocalVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1LocalVolumeSource
    +

    Local represents directly-attached storage with node affinity (Beta feature)

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type to mount. It applies only when the Path is a block device. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". The default value is to auto-select a filesystem if unspecified.
    path
    string
    The full path to the volume on the node. It can be either a directory or block device (disk, partition, ...).
    +

    ManagedFieldsEntry v1 meta

    + + + + + +
    GroupVersionKind
    metav1ManagedFieldsEntry
    +

    ManagedFieldsEntry is a workflow-id, a FieldSet and the group version of the resource that the fieldset applies to.

    +
    Appears In: + +
    + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the version of this resource that this field set applies to. The format is "group/version" just like the top-level APIVersion field. It is necessary to track the version of a field set because it cannot be automatically converted.
    fieldsType
    string
    FieldsType is the discriminator for the different fields format and version. There is currently only one possible value: "FieldsV1"
    fieldsV1
    FieldsV1
    FieldsV1 holds the first JSON version format as described in the "FieldsV1" type.
    manager
    string
    Manager is an identifier of the workflow managing these fields.
    operation
    string
    Operation is the type of operation which lead to this ManagedFieldsEntry being created. The only valid values for this field are 'Apply' and 'Update'.
    subresource
    string
    Subresource is the name of the subresource used to update that object, or empty string if the object was updated through the main resource. The value of this field is used to distinguish between managers, even if they share the same name. For example, a status update will be distinct from a regular update using the same manager name. Note that the APIVersion field is not related to the Subresource field and it always corresponds to the version of the main resource.
    time
    Time
    Time is timestamp of when these fields were set. It should always be empty if Operation is 'Apply'
    +

    MetricIdentifier v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2MetricIdentifier
    +

    MetricIdentifier defines the name and optionally selector for a metric

    +
    Other API versions of this object exist: +v2beta2 +
    + + + + + + + +
    FieldDescription
    name
    string
    name is the name of the given metric
    selector
    LabelSelector
    selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.
    +

    MetricSpec v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2MetricSpec
    +

    MetricSpec specifies how to scale based on a single metric (only `type` and one other matching field should be set at once).

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    + + + + + + + + + + + +
    FieldDescription
    containerResource
    ContainerResourceMetricSource
    containerResource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod of the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. This is an alpha feature and can be enabled by the HPAContainerMetrics feature flag.
    external
    ExternalMetricSource
    external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).
    object
    ObjectMetricSource
    object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).
    pods
    PodsMetricSource
    pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.
    resource
    ResourceMetricSource
    resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
    type
    string
    type is the type of metric source. It should be one of "ContainerResource", "External", "Object", "Pods" or "Resource", each mapping to a matching field in the object. Note: "ContainerResource" type is available on when the feature-gate HPAContainerMetrics is enabled
    +

    MetricStatus v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2MetricStatus
    +

    MetricStatus describes the last-read state of a single metric.

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    + + + + + + + + + + + +
    FieldDescription
    containerResource
    ContainerResourceMetricStatus
    container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
    external
    ExternalMetricStatus
    external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).
    object
    ObjectMetricStatus
    object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).
    pods
    PodsMetricStatus
    pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.
    resource
    ResourceMetricStatus
    resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
    type
    string
    type is the type of metric source. It will be one of "ContainerResource", "External", "Object", "Pods" or "Resource", each corresponds to a matching field in the object. Note: "ContainerResource" type is available on when the feature-gate HPAContainerMetrics is enabled
    +

    MetricTarget v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2MetricTarget
    +

    MetricTarget defines the target value, average value, or average utilization of a specific metric

    +
    Other API versions of this object exist: +v2beta2 +
    + + + + + + + + + +
    FieldDescription
    averageUtilization
    integer
    averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source type
    averageValue
    Quantity
    averageValue is the target value of the average of the metric across all relevant pods (as a quantity)
    type
    string
    type represents whether the metric type is Utilization, Value, or AverageValue
    value
    Quantity
    value is the target value of the metric (as a quantity).
    +

    MetricValueStatus v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2MetricValueStatus
    +

    MetricValueStatus holds the current value for a metric

    +
    Other API versions of this object exist: +v2beta2 +
    + + + + + + + + +
    FieldDescription
    averageUtilization
    integer
    currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.
    averageValue
    Quantity
    averageValue is the current value of the average of the metric across all relevant pods (as a quantity)
    value
    Quantity
    value is the current value of the metric (as a quantity).
    +

    MicroTime v1 meta

    + + + + + +
    GroupVersionKind
    metav1MicroTime
    +

    MicroTime is version of Time with microsecond level precision.

    + + + + + +
    FieldDescription
    +

    MutatingWebhook v1 admissionregistration.k8s.io

    + + + + + +
    GroupVersionKind
    admissionregistration.k8s.iov1MutatingWebhook
    +

    MutatingWebhook describes an admission webhook and the resources and operations it applies to.

    + + + + + + + + + + + + + + + + +
    FieldDescription
    admissionReviewVersions
    string array
    AdmissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy.
    clientConfig
    WebhookClientConfig
    ClientConfig defines how to communicate with the hook. Required
    failurePolicy
    string
    FailurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Fail.
    matchPolicy
    string
    matchPolicy defines how the "rules" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent". - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook. - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook. Defaults to "Equivalent"
    name
    string
    The name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where "imagepolicy" is the name of the webhook, and kubernetes.io is the name of the organization. Required.
    namespaceSelector
    LabelSelector
    NamespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook. For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] } If instead you want to only run the webhook on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] } See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors. Default to the empty LabelSelector, which matches everything.
    objectSelector
    LabelSelector
    ObjectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
    reinvocationPolicy
    string
    reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation. Allowed values are "Never" and "IfNeeded". Never: the webhook will not be called more than once in a single admission evaluation. IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation if the object being admitted is modified by other admission plugins after the initial webhook call. Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted. Note: * the number of additional invocations is not guaranteed to be exactly one. * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again. * webhooks that use this option may be reordered to minimize the number of additional invocations. * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead. Defaults to "Never".
    rules
    RuleWithOperations array
    Rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches _any_ Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
    sideEffects
    string
    SideEffects states whether this webhook has side effects. Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown). Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some.
    timeoutSeconds
    integer
    TimeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 10 seconds.
    +

    NFSVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1NFSVolumeSource
    +

    Represents an NFS mount that lasts the lifetime of a pod. NFS volumes do not support ownership management or SELinux relabeling.

    + + + + + + + + +
    FieldDescription
    path
    string
    Path that is exported by the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
    readOnly
    boolean
    ReadOnly here will force the NFS export to be mounted with read-only permissions. Defaults to false. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
    server
    string
    Server is the hostname or IP address of the NFS server. More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs
    +

    NamespaceCondition v1 core

    + + + + + +
    GroupVersionKind
    corev1NamespaceCondition
    +

    NamespaceCondition contains details about state of namespace.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    message
    string
    reason
    string
    status
    string
    Status of the condition, one of True, False, Unknown.
    type
    string
    Type of namespace controller condition. Possible enum values: - `"NamespaceContentRemaining"` contains information about resources remaining in a namespace. - `"NamespaceDeletionContentFailure"` contains information about namespace deleter errors during deletion of resources. - `"NamespaceDeletionDiscoveryFailure"` contains information about namespace deleter errors during resource discovery. - `"NamespaceDeletionGroupVersionParsingFailure"` contains information about namespace deleter errors parsing GV for legacy types. - `"NamespaceFinalizersRemaining"` contains information about which finalizers are on resources remaining in a namespace.
    +

    NetworkPolicyEgressRule v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1NetworkPolicyEgressRule
    +

    NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to. This type is beta-level in 1.8

    + + + + + + + +
    FieldDescription
    ports
    NetworkPolicyPort array
    List of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
    to
    NetworkPolicyPeer array
    List of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.
    +

    NetworkPolicyIngressRule v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1NetworkPolicyIngressRule
    +

    NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.

    + + + + + + + +
    FieldDescription
    from
    NetworkPolicyPeer array
    List of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.
    ports
    NetworkPolicyPort array
    List of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.
    +

    NetworkPolicyPeer v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1NetworkPolicyPeer
    +

    NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of fields are allowed

    + + + + + + + + +
    FieldDescription
    ipBlock
    IPBlock
    IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.
    namespaceSelector
    LabelSelector
    Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces. If PodSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.
    podSelector
    LabelSelector
    This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects all pods. If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the Pods matching PodSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
    +

    NetworkPolicyPort v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1NetworkPolicyPort
    +

    NetworkPolicyPort describes a port to allow traffic on

    + + + + + + + + +
    FieldDescription
    endPort
    integer
    If set, indicates that the range of ports from port to endPort, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port. This feature is in Beta state and is enabled by default. It can be disabled using the Feature Gate "NetworkPolicyEndPort".
    portThe port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.
    protocol
    string
    The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.
    +

    NodeAddress v1 core

    + + + + + +
    GroupVersionKind
    corev1NodeAddress
    +

    NodeAddress contains information for the node's address.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    address
    string
    The node address.
    type
    string
    Node address type, one of Hostname, ExternalIP or InternalIP. Possible enum values: - `"ExternalDNS"` identifies a DNS name which resolves to an IP address which has the characteristics of a NodeExternalIP. The IP it resolves to may or may not be a listed NodeExternalIP address. - `"ExternalIP"` identifies an IP address which is, in some way, intended to be more usable from outside the cluster then an internal IP, though no specific semantics are defined. It may be a globally routable IP, though it is not required to be. External IPs may be assigned directly to an interface on the node, like a NodeInternalIP, or alternatively, packets sent to the external IP may be NAT'ed to an internal node IP rather than being delivered directly (making the IP less efficient for node-to-node traffic than a NodeInternalIP). - `"Hostname"` identifies a name of the node. Although every node can be assumed to have a NodeAddress of this type, its exact syntax and semantics are not defined, and are not consistent between different clusters. - `"InternalDNS"` identifies a DNS name which resolves to an IP address which has the characteristics of a NodeInternalIP. The IP it resolves to may or may not be a listed NodeInternalIP address. - `"InternalIP"` identifies an IP address which is assigned to one of the node's network interfaces. Every node should have at least one address of this type. An internal IP is normally expected to be reachable from every other node, but may not be visible to hosts outside the cluster. By default it is assumed that kube-apiserver can reach node internal IPs, though it is possible to configure clusters where this is not the case. NodeInternalIP is the default type of node IP, and does not necessarily imply that the IP is ONLY reachable internally. If a node has multiple internal IPs, no specific semantics are assigned to the additional IPs.
    +

    NodeAffinity v1 core

    + + + + + +
    GroupVersionKind
    corev1NodeAffinity
    +

    Node affinity is a group of node affinity scheduling rules.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    preferredDuringSchedulingIgnoredDuringExecution
    PreferredSchedulingTerm array
    The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred.
    requiredDuringSchedulingIgnoredDuringExecution
    NodeSelector
    If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node.
    +

    NodeCondition v1 core

    + + + + + +
    GroupVersionKind
    corev1NodeCondition
    +

    NodeCondition contains condition information for a node.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    lastHeartbeatTime
    Time
    Last time we got an update on a given condition.
    lastTransitionTime
    Time
    Last time the condition transit from one status to another.
    message
    string
    Human readable message indicating details about last transition.
    reason
    string
    (brief) reason for the condition's last transition.
    status
    string
    Status of the condition, one of True, False, Unknown.
    type
    string
    Type of node condition. Possible enum values: - `"DiskPressure"` means the kubelet is under pressure due to insufficient available disk. - `"MemoryPressure"` means the kubelet is under pressure due to insufficient available memory. - `"NetworkUnavailable"` means that network for the node is not correctly configured. - `"PIDPressure"` means the kubelet is under pressure due to insufficient available PID. - `"Ready"` means kubelet is healthy and ready to accept pods.
    +

    NodeConfigSource v1 core

    + + + + + +
    GroupVersionKind
    corev1NodeConfigSource
    +

    NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22

    + + + + + + +
    FieldDescription
    configMap
    ConfigMapNodeConfigSource
    ConfigMap is a reference to a Node's ConfigMap
    +

    NodeConfigStatus v1 core

    + + + + + +
    GroupVersionKind
    corev1NodeConfigStatus
    +

    NodeConfigStatus describes the status of the config assigned by Node.Spec.ConfigSource.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    active
    NodeConfigSource
    Active reports the checkpointed config the node is actively using. Active will represent either the current version of the Assigned config, or the current LastKnownGood config, depending on whether attempting to use the Assigned config results in an error.
    assigned
    NodeConfigSource
    Assigned reports the checkpointed config the node will try to use. When Node.Spec.ConfigSource is updated, the node checkpoints the associated config payload to local disk, along with a record indicating intended config. The node refers to this record to choose its config checkpoint, and reports this record in Assigned. Assigned only updates in the status after the record has been checkpointed to disk. When the Kubelet is restarted, it tries to make the Assigned config the Active config by loading and validating the checkpointed payload identified by Assigned.
    error
    string
    Error describes any problems reconciling the Spec.ConfigSource to the Active config. Errors may occur, for example, attempting to checkpoint Spec.ConfigSource to the local Assigned record, attempting to checkpoint the payload associated with Spec.ConfigSource, attempting to load or validate the Assigned config, etc. Errors may occur at different points while syncing config. Earlier errors (e.g. download or checkpointing errors) will not result in a rollback to LastKnownGood, and may resolve across Kubelet retries. Later errors (e.g. loading or validating a checkpointed config) will result in a rollback to LastKnownGood. In the latter case, it is usually possible to resolve the error by fixing the config assigned in Spec.ConfigSource. You can find additional information for debugging by searching the error message in the Kubelet log. Error is a human-readable description of the error state; machines can check whether or not Error is empty, but should not rely on the stability of the Error text across Kubelet versions.
    lastKnownGood
    NodeConfigSource
    LastKnownGood reports the checkpointed config the node will fall back to when it encounters an error attempting to use the Assigned config. The Assigned config becomes the LastKnownGood config when the node determines that the Assigned config is stable and correct. This is currently implemented as a 10-minute soak period starting when the local record of Assigned config is updated. If the Assigned config is Active at the end of this period, it becomes the LastKnownGood. Note that if Spec.ConfigSource is reset to nil (use local defaults), the LastKnownGood is also immediately reset to nil, because the local default config is always assumed good. You should not make assumptions about the node's method of determining config stability and correctness, as this may change or become configurable in the future.
    +

    NodeDaemonEndpoints v1 core

    + + + + + +
    GroupVersionKind
    corev1NodeDaemonEndpoints
    +

    NodeDaemonEndpoints lists ports opened by daemons running on the Node.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    kubeletEndpoint
    DaemonEndpoint
    Endpoint on which Kubelet is listening.
    +

    NodeSelector v1 core

    + + + + + +
    GroupVersionKind
    corev1NodeSelector
    +

    A node selector represents the union of the results of one or more label queries over a set of nodes; that is, it represents the OR of the selectors represented by the node selector terms.

    + + + + + + +
    FieldDescription
    nodeSelectorTerms
    NodeSelectorTerm array
    Required. A list of node selector terms. The terms are ORed.
    +

    NodeSelectorRequirement v1 core

    + + + + + +
    GroupVersionKind
    corev1NodeSelectorRequirement
    +

    A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    key
    string
    The label key that the selector applies to.
    operator
    string
    Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. Possible enum values: - `"DoesNotExist"` - `"Exists"` - `"Gt"` - `"In"` - `"Lt"` - `"NotIn"`
    values
    string array
    An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch.
    +

    NodeSelectorTerm v1 core

    + + + + + +
    GroupVersionKind
    corev1NodeSelectorTerm
    +

    A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm.

    + + + + + + + +
    FieldDescription
    matchExpressions
    NodeSelectorRequirement array
    A list of node selector requirements by node's labels.
    matchFields
    NodeSelectorRequirement array
    A list of node selector requirements by node's fields.
    +

    NodeSystemInfo v1 core

    + + + + + +
    GroupVersionKind
    corev1NodeSystemInfo
    +

    NodeSystemInfo is a set of ids/uuids to uniquely identify the node.

    +
    Appears In: + +
    + + + + + + + + + + + + + + +
    FieldDescription
    architecture
    string
    The Architecture reported by the node
    bootID
    string
    Boot ID reported by the node.
    containerRuntimeVersion
    string
    ContainerRuntime Version reported by the node through runtime remote API (e.g. docker://1.5.0).
    kernelVersion
    string
    Kernel Version reported by the node from 'uname -r' (e.g. 3.16.0-0.bpo.4-amd64).
    kubeProxyVersion
    string
    KubeProxy Version reported by the node.
    kubeletVersion
    string
    Kubelet Version reported by the node.
    machineID
    string
    MachineID reported by the node. For unique machine identification in the cluster this field is preferred. Learn more from man(5) machine-id: http://man7.org/linux/man-pages/man5/machine-id.5.html
    operatingSystem
    string
    The Operating System reported by the node
    osImage
    string
    OS Image reported by the node from /etc/os-release (e.g. Debian GNU/Linux 7 (wheezy)).
    systemUUID
    string
    SystemUUID reported by the node. For unique machine identification MachineID is preferred. This field is specific to Red Hat hosts https://access.redhat.com/documentation/en-us/red_hat_subscription_management/1/html/rhsm/uuid
    +

    NonResourceAttributes v1 authorization.k8s.io

    + + + + + +
    GroupVersionKind
    authorization.k8s.iov1NonResourceAttributes
    +

    NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface

    + + + + + + + +
    FieldDescription
    path
    string
    Path is the URL path of the request
    verb
    string
    Verb is the standard HTTP verb
    +

    NonResourcePolicyRule v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2NonResourcePolicyRule
    +

    NonResourcePolicyRule is a predicate that matches non-resource requests according to their verb and the target non-resource URL. A NonResourcePolicyRule matches a request if and only if both (a) at least one member of verbs matches the request and (b) at least one member of nonResourceURLs matches the request.

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + +
    FieldDescription
    nonResourceURLs
    string array
    `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty. For example: - "/healthz" is legal - "/hea*" is illegal - "/hea" is legal but matches nothing - "/hea/*" also matches nothing - "/healthz/*" matches all per-component health checks. "*" matches all non-resource urls. if it is present, it must be the only entry. Required.
    verbs
    string array
    `verbs` is a list of matching verbs and may not be empty. "*" matches all verbs. If it is present, it must be the only entry. Required.
    +

    NonResourceRule v1 authorization.k8s.io

    + + + + + +
    GroupVersionKind
    authorization.k8s.iov1NonResourceRule
    +

    NonResourceRule holds information that describes a rule for the non-resource

    + + + + + + + +
    FieldDescription
    nonResourceURLs
    string array
    NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path. "*" means all.
    verbs
    string array
    Verb is a list of kubernetes non-resource API verbs, like: get, post, put, delete, patch, head, options. "*" means all.
    +

    ObjectFieldSelector v1 core

    + + + + + +
    GroupVersionKind
    corev1ObjectFieldSelector
    +

    ObjectFieldSelector selects an APIVersioned field of an object.

    + + + + + + + +
    FieldDescription
    apiVersion
    string
    Version of the schema the FieldPath is written in terms of, defaults to "v1".
    fieldPath
    string
    Path of the field to select in the specified API version.
    +

    ObjectMeta v1 meta

    + + + + + +
    GroupVersionKind
    metav1ObjectMeta
    +

    ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create.

    +
    Appears In: + +
    + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    annotations
    object
    Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations
    clusterName
    string
    The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request.
    creationTimestamp
    Time
    CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    deletionGracePeriodSeconds
    integer
    Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only.
    deletionTimestamp
    Time
    DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested. Populated by the system when a graceful deletion is requested. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    finalizers
    string array
    patch strategy: merge
    Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list.
    generateName
    string
    GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server. If this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header). Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
    generation
    integer
    A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.
    labels
    object
    Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels
    managedFields
    ManagedFieldsEntry array
    ManagedFields maps workflow-id and version to the set of fields that are managed by that workflow. This is mostly for internal housekeeping, and users typically shouldn't need to set or understand this field. A workflow can be the user's name, a controller's name, or the name of a specific apply path like "ci-cd". The set of fields is always in the version that the workflow used when modifying the object.
    name
    string
    Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names
    namespace
    string
    Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty. Must be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces
    ownerReferences
    OwnerReference array
    patch strategy: merge
    patch merge key: uid
    List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller.
    resourceVersion
    string
    An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources. Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
    selfLink
    string
    SelfLink is a URL representing this object. Populated by the system. Read-only. DEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release.
    uid
    string
    UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations. Populated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids
    +

    ObjectMetricSource v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2ObjectMetricSource
    +

    ObjectMetricSource indicates how to scale on a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    describedObject
    CrossVersionObjectReference
    describedObject specifies the descriptions of a object,such as kind,name apiVersion
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    target
    MetricTarget
    target specifies the target value for the given metric
    +

    ObjectMetricStatus v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2ObjectMetricStatus
    +

    ObjectMetricStatus indicates the current value of a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    current
    MetricValueStatus
    current contains the current value for the given metric
    describedObject
    CrossVersionObjectReference
    DescribedObject specifies the descriptions of a object,such as kind,name apiVersion
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    +

    ObjectReference v1 core

    + + + + + +
    GroupVersionKind
    corev1ObjectReference
    +

    ObjectReference contains enough information to let you inspect or modify the referred object.

    + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    API version of the referent.
    fieldPath
    string
    If referring to a piece of an object instead of an entire object, this string should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. For example, if the object reference is to a container within a pod, this would take on a value like: "spec.containers{name}" (where "name" refers to the name of the container that triggered the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object.
    kind
    string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    namespace
    string
    Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
    resourceVersion
    string
    Specific resourceVersion to which this reference is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
    uid
    string
    UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
    +

    Overhead v1 node.k8s.io

    + + + + + +
    GroupVersionKind
    node.k8s.iov1Overhead
    +

    Overhead structure represents the resource overhead associated with running a pod.

    +
    Other API versions of this object exist: +v1beta1 +v1alpha1 +
    +
    Appears In: + +
    + + + + + +
    FieldDescription
    podFixed
    object
    PodFixed represents the fixed resource overhead associated with running a pod.
    +

    OwnerReference v1 meta

    + + + + + +
    GroupVersionKind
    metav1OwnerReference
    +

    OwnerReference contains enough information to let you identify an owning object. An owning object must be in the same namespace as the dependent, or be cluster-scoped, so there is no namespace field.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    API version of the referent.
    blockOwnerDeletion
    boolean
    If true, AND if the owner has the "foregroundDeletion" finalizer, then the owner cannot be deleted from the key-value store until this reference is removed. Defaults to false. To set this field, a user needs "delete" permission of the owner, otherwise 422 (Unprocessable Entity) will be returned.
    controller
    boolean
    If true, this reference points to the managing controller.
    kind
    string
    Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    name
    string
    Name of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#names
    uid
    string
    UID of the referent. More info: http://kubernetes.io/docs/user-guide/identifiers#uids
    +

    Patch v1 meta

    + + + + + +
    GroupVersionKind
    metav1Patch
    +

    Patch is provided to give a concrete name and type to the Kubernetes PATCH request body.

    + + + + +
    FieldDescription
    +

    PersistentVolumeClaimCondition v1 core

    + + + + + +
    GroupVersionKind
    corev1PersistentVolumeClaimCondition
    +

    PersistentVolumeClaimCondition contails details about state of pvc

    + + + + + + + + + + + +
    FieldDescription
    lastProbeTime
    Time
    Last time we probed the condition.
    lastTransitionTime
    Time
    Last time the condition transitioned from one status to another.
    message
    string
    Human-readable message indicating details about last transition.
    reason
    string
    Unique, this should be a short, machine understandable string that gives the reason for condition's last transition. If it reports "ResizeStarted" that means the underlying persistent volume is being resized.
    status
    string
    type
    string
    Possible enum values: - `"FileSystemResizePending"` - controller resize is finished and a file system resize is pending on node - `"Resizing"` - a user trigger resize of pvc has been started
    +

    PersistentVolumeClaimTemplate v1 core

    + + + + + +
    GroupVersionKind
    corev1PersistentVolumeClaimTemplate
    +

    PersistentVolumeClaimTemplate is used to produce PersistentVolumeClaim objects as part of an EphemeralVolumeSource.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    metadata
    ObjectMeta
    May contain labels and annotations that will be copied into the PVC when creating it. No other fields are allowed and will be rejected during validation.
    spec
    PersistentVolumeClaimSpec
    The specification for the PersistentVolumeClaim. The entire content is copied unchanged into the PVC that gets created from this template. The same fields as in a PersistentVolumeClaim are also valid here.
    +

    PersistentVolumeClaimVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1PersistentVolumeClaimVolumeSource
    +

    PersistentVolumeClaimVolumeSource references the user's PVC in the same namespace. This volume finds the bound PV and mounts that volume for the pod. A PersistentVolumeClaimVolumeSource is, essentially, a wrapper around another type of volume that is owned by someone else (the system).

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    claimName
    string
    ClaimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
    readOnly
    boolean
    Will force the ReadOnly setting in VolumeMounts. Default false.
    +

    PhotonPersistentDiskVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1PhotonPersistentDiskVolumeSource
    +

    Represents a Photon Controller persistent disk resource.

    + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
    pdID
    string
    ID that identifies Photon Controller persistent disk
    +

    PodAffinity v1 core

    + + + + + +
    GroupVersionKind
    corev1PodAffinity
    +

    Pod affinity is a group of inter pod affinity scheduling rules.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    preferredDuringSchedulingIgnoredDuringExecution
    WeightedPodAffinityTerm array
    The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
    requiredDuringSchedulingIgnoredDuringExecution
    PodAffinityTerm array
    If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
    +

    PodAffinityTerm v1 core

    + + + + + +
    GroupVersionKind
    corev1PodAffinityTerm
    +

    Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key <topologyKey> matches that of any node on which a pod of the set of pods is running

    + + + + + + + + + +
    FieldDescription
    labelSelector
    LabelSelector
    A label query over a set of resources, in this case pods.
    namespaceSelector
    LabelSelector
    A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. This field is beta-level and is only honored when PodAffinityNamespaceSelector feature is enabled.
    namespaces
    string array
    namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace"
    topologyKey
    string
    This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed.
    +

    PodAntiAffinity v1 core

    + + + + + +
    GroupVersionKind
    corev1PodAntiAffinity
    +

    Pod anti affinity is a group of inter pod anti affinity scheduling rules.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    preferredDuringSchedulingIgnoredDuringExecution
    WeightedPodAffinityTerm array
    The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred.
    requiredDuringSchedulingIgnoredDuringExecution
    PodAffinityTerm array
    If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied.
    +

    PodCondition v1 core

    + + + + + +
    GroupVersionKind
    corev1PodCondition
    +

    PodCondition contains details for the current condition of this pod.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    lastProbeTime
    Time
    Last time we probed the condition.
    lastTransitionTime
    Time
    Last time the condition transitioned from one status to another.
    message
    string
    Human-readable message indicating details about last transition.
    reason
    string
    Unique, one-word, CamelCase reason for the condition's last transition.
    status
    string
    Status is the status of the condition. Can be True, False, Unknown. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions
    type
    string
    Type is the type of the condition. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions Possible enum values: - `"ContainersReady"` indicates whether all containers in the pod are ready. - `"Initialized"` means that all init containers in the pod have started successfully. - `"PodScheduled"` represents status of the scheduling process for this pod. - `"Ready"` means the pod is able to service requests and should be added to the load balancing pools of all matching services.
    +

    PodDNSConfig v1 core

    + + + + + +
    GroupVersionKind
    corev1PodDNSConfig
    +

    PodDNSConfig defines the DNS parameters of a pod in addition to those generated from DNSPolicy.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    nameservers
    string array
    A list of DNS name server IP addresses. This will be appended to the base nameservers generated from DNSPolicy. Duplicated nameservers will be removed.
    options
    PodDNSConfigOption array
    A list of DNS resolver options. This will be merged with the base options generated from DNSPolicy. Duplicated entries will be removed. Resolution options given in Options will override those that appear in the base DNSPolicy.
    searches
    string array
    A list of DNS search domains for host-name lookup. This will be appended to the base search paths generated from DNSPolicy. Duplicated search paths will be removed.
    +

    PodDNSConfigOption v1 core

    + + + + + +
    GroupVersionKind
    corev1PodDNSConfigOption
    +

    PodDNSConfigOption defines DNS resolver options of a pod.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    name
    string
    Required.
    value
    string
    +

    PodIP v1 core

    + + + + + +
    GroupVersionKind
    corev1PodIP
    +

    IP address information for entries in the (plural) PodIPs field. Each entry includes: + IP: An IP address allocated to the pod. Routable at least within the cluster.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    ip
    string
    ip is an IP address (IPv4 or IPv6) assigned to the pod
    +

    PodOS v1 core

    + + + + + +
    GroupVersionKind
    corev1PodOS
    +

    PodOS defines the OS parameters of a pod.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    name
    string
    Name is the name of the operating system. The currently supported values are linux and windows. Additional value may be defined in future and can be one of: https://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration Clients should expect to handle additional values and treat unrecognized values in this field as os: null
    +

    PodReadinessGate v1 core

    + + + + + +
    GroupVersionKind
    corev1PodReadinessGate
    +

    PodReadinessGate contains the reference to a pod condition

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    conditionType
    string
    ConditionType refers to a condition in the pod's condition list with matching type. Possible enum values: - `"ContainersReady"` indicates whether all containers in the pod are ready. - `"Initialized"` means that all init containers in the pod have started successfully. - `"PodScheduled"` represents status of the scheduling process for this pod. - `"Ready"` means the pod is able to service requests and should be added to the load balancing pools of all matching services.
    +

    PodSecurityContext v1 core

    + + + + + +
    GroupVersionKind
    corev1PodSecurityContext
    +

    PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. Field values of container.securityContext take precedence over field values of PodSecurityContext.

    +
    Appears In: + +
    + + + + + + + + + + + + + + +
    FieldDescription
    fsGroup
    integer
    A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod: 1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw---- If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows.
    fsGroupChangePolicy
    string
    fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. Note that this field cannot be set when spec.os.name is windows.
    runAsGroup
    integer
    The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
    runAsNonRoot
    boolean
    Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    runAsUser
    integer
    The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
    seLinuxOptions
    SELinuxOptions
    The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.
    seccompProfile
    SeccompProfile
    The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows.
    supplementalGroups
    integer array
    A list of groups applied to the first process run in each container, in addition to the container's primary GID. If unspecified, no groups will be added to any container. Note that this field cannot be set when spec.os.name is windows.
    sysctls
    Sysctl array
    Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows.
    windowsOptions
    WindowsSecurityContextOptions
    The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
    +

    PodsMetricSource v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2PodsMetricSource
    +

    PodsMetricSource indicates how to scale on a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    target
    MetricTarget
    target specifies the target value for the given metric
    +

    PodsMetricStatus v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2PodsMetricStatus
    +

    PodsMetricStatus indicates the current value of a metric describing each pod in the current scale target (for example, transactions-processed-per-second).

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    current
    MetricValueStatus
    current contains the current value for the given metric
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    +

    PolicyRule v1 rbac.authorization.k8s.io

    + + + + + +
    GroupVersionKind
    rbac.authorization.k8s.iov1PolicyRule
    +

    PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiGroups
    string array
    APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed.
    nonResourceURLs
    string array
    NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.
    resourceNames
    string array
    ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.
    resources
    string array
    Resources is a list of resources this rule applies to. '\*' represents all resources.
    verbs
    string array
    Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '\*' represents all verbs.
    +

    PolicyRulesWithSubjects v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2PolicyRulesWithSubjects
    +

    PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member of resourceRules or nonResourceRules matches the request.

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + + +
    FieldDescription
    nonResourceRules
    NonResourcePolicyRule array
    `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb and the target non-resource URL.
    resourceRules
    ResourcePolicyRule array
    `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the target resource. At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
    subjects
    Subject array
    subjects is the list of normal user, serviceaccount, or group that this rule cares about. There must be at least one member in this slice. A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request. Required.
    +

    PortStatus v1 core

    + + + + + +
    GroupVersionKind
    corev1PortStatus
    +

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    error
    string
    Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase names - cloud provider specific error values must have names that comply with the format foo.example.com/CamelCase.
    port
    integer
    Port is the port number of the service port of which status is recorded here
    protocol
    string
    Protocol is the protocol of the service port of which status is recorded here The supported values are: "TCP", "UDP", "SCTP" Possible enum values: - `"SCTP"` is the SCTP protocol. - `"TCP"` is the TCP protocol. - `"UDP"` is the UDP protocol.
    +

    PortworxVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1PortworxVolumeSource
    +

    PortworxVolumeSource represents a Portworx volume resource.

    + + + + + + + + +
    FieldDescription
    fsType
    string
    FSType represents the filesystem type to mount Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified.
    readOnly
    boolean
    Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    volumeID
    string
    VolumeID uniquely identifies a Portworx volume
    +

    Preconditions v1 meta

    + + + + + +
    GroupVersionKind
    metav1Preconditions
    +

    Preconditions must be fulfilled before an operation (update, delete, etc.) is carried out.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    resourceVersion
    string
    Specifies the target ResourceVersion
    uid
    string
    Specifies the target UID.
    +

    PreferredSchedulingTerm v1 core

    + + + + + +
    GroupVersionKind
    corev1PreferredSchedulingTerm
    +

    An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    preference
    NodeSelectorTerm
    A node selector term, associated with the corresponding weight.
    weight
    integer
    Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.
    +

    PriorityLevelConfiguration v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2PriorityLevelConfiguration
    +

    PriorityLevelConfiguration represents the configuration of a priority level.

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    PriorityLevelConfigurationSpec
    `spec` is the specification of the desired behavior of a "request-priority". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    PriorityLevelConfigurationStatus
    `status` is the current status of a "request-priority". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    PriorityLevelConfigurationCondition v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2PriorityLevelConfigurationCondition
    +

    PriorityLevelConfigurationCondition defines the condition of priority level.

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    `lastTransitionTime` is the last time the condition transitioned from one status to another.
    message
    string
    `message` is a human-readable message indicating details about last transition.
    reason
    string
    `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
    status
    string
    `status` is the status of the condition. Can be True, False, Unknown. Required.
    type
    string
    `type` is the type of the condition. Required.
    +

    PriorityLevelConfigurationReference v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2PriorityLevelConfigurationReference
    +

    PriorityLevelConfigurationReference contains information that points to the "request-priority" being used.

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + +
    FieldDescription
    name
    string
    `name` is the name of the priority level configuration being referenced Required.
    +

    Probe v1 core

    + + + + + +
    GroupVersionKind
    corev1Probe
    +

    Probe describes a health check to be performed against a container to determine whether it is alive or ready to receive traffic.

    + + + + + + + + + + + + + + + +
    FieldDescription
    exec
    ExecAction
    Exec specifies the action to take.
    failureThreshold
    integer
    Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1.
    grpc
    GRPCAction
    GRPC specifies an action involving a GRPC port. This is an alpha field and requires enabling GRPCContainerProbe feature gate.
    httpGet
    HTTPGetAction
    HTTPGet specifies the http request to perform.
    initialDelaySeconds
    integer
    Number of seconds after the container has started before liveness probes are initiated. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
    periodSeconds
    integer
    How often (in seconds) to perform the probe. Default to 10 seconds. Minimum value is 1.
    successThreshold
    integer
    Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1.
    tcpSocket
    TCPSocketAction
    TCPSocket specifies an action involving a TCP port.
    terminationGracePeriodSeconds
    integer
    Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.
    timeoutSeconds
    integer
    Number of seconds after which the probe times out. Defaults to 1 second. Minimum value is 1. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
    +

    ProjectedVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1ProjectedVolumeSource
    +

    Represents a projected volume source

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    defaultMode
    integer
    Mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
    sources
    VolumeProjection array
    list of volume projections
    +

    Quantity resource core

    + + + + + +
    GroupVersionKind
    coreresourceQuantity
    +

    Quantity is a fixed-point representation of a number. It provides convenient marshaling/unmarshaling in JSON and YAML, in addition to String() and AsInt64() accessors. + +The serialization format is: + +<quantity> ::= <signedNumber><suffix> + (Note that <suffix> may be empty, from the "" case in <decimalSI>.) +<digit> ::= 0 | 1 | ... | 9 <digits> ::= <digit> | <digit><digits> <number> ::= <digits> | <digits>.<digits> | <digits>. | .<digits> <sign> ::= "+" | "-" <signedNumber> ::= <number> | <sign><number> <suffix> ::= <binarySI> | <decimalExponent> | <decimalSI> <binarySI> ::= Ki | Mi | Gi | Ti | Pi | Ei + (International System of units; See: http://physics.nist.gov/cuu/Units/binary.html) +<decimalSI> ::= m | "" | k | M | G | T | P | E + (Note that 1024 = 1Ki but 1000 = 1k; I didn't choose the capitalization.) +<decimalExponent> ::= "e" <signedNumber> | "E" <signedNumber> + +No matter which of the three exponent forms is used, no quantity may represent a number greater than 2^63-1 in magnitude, nor may it have more than 3 decimal places. Numbers larger or more precise will be capped or rounded up. (E.g.: 0.1m will rounded up to 1m.) This may be extended in the future if we require larger or smaller quantities. + +When a Quantity is parsed from a string, it will remember the type of suffix it had, and will use the same type again when it is serialized. + +Before serializing, Quantity will be put in "canonical form". This means that Exponent/suffix will be adjusted up or down (with a corresponding increase or decrease in Mantissa) such that: + a. No precision is lost + b. No fractional digits will be emitted + c. The exponent (or suffix) is as large as possible. +The sign will be omitted unless the number is negative. + +Examples: + 1.5 will be serialized as "1500m" + 1.5Gi will be serialized as "1536Mi" + +Note that the quantity will NEVER be internally represented by a floating point number. That is the whole point of this exercise. + +Non-canonical values will still parse as long as they are well formed, but will be re-emitted in their canonical form. (So always use canonical form, or don't diff.) + +This format is intended to make it difficult to use these numbers without writing some sort of special handling code in the hopes that that will cause implementors to also use a fixed point implementation.

    + + + + + +
    FieldDescription
    +

    QueuingConfiguration v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2QueuingConfiguration
    +

    QueuingConfiguration holds the configuration parameters for queuing

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + + +
    FieldDescription
    handSize
    integer
    `handSize` is a small positive number that configures the shuffle sharding of requests into queues. When enqueuing a request at this priority level the request's flow identifier (a string pair) is hashed and the hash value is used to shuffle the list of queues and deal a hand of the size specified here. The request is put into one of the shortest queues in that hand. `handSize` must be no larger than `queues`, and should be significantly smaller (so that a few heavy flows do not saturate most of the queues). See the user-facing documentation for more extensive guidance on setting this field. This field has a default value of 8.
    queueLengthLimit
    integer
    `queueLengthLimit` is the maximum number of requests allowed to be waiting in a given queue of this priority level at a time; excess requests are rejected. This value must be positive. If not specified, it will be defaulted to 50.
    queues
    integer
    `queues` is the number of queues for this priority level. The queues exist independently at each apiserver. The value must be positive. Setting it to 1 effectively precludes shufflesharding and thus makes the distinguisher method of associated flow schemas irrelevant. This field has a default value of 64.
    +

    QuobyteVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1QuobyteVolumeSource
    +

    Represents a Quobyte mount that lasts the lifetime of a pod. Quobyte volumes do not support ownership management or SELinux relabeling.

    + + + + + + + + + + + +
    FieldDescription
    group
    string
    Group to map volume access to Default is no group
    readOnly
    boolean
    ReadOnly here will force the Quobyte volume to be mounted with read-only permissions. Defaults to false.
    registry
    string
    Registry represents a single or multiple Quobyte Registry services specified as a string as host:port pair (multiple entries are separated with commas) which acts as the central registry for volumes
    tenant
    string
    Tenant owning the given Quobyte volume in the Backend Used with dynamically provisioned Quobyte volumes, value is set by the plugin
    user
    string
    User to map volume access to Defaults to serivceaccount user
    volume
    string
    Volume is a string that references an already created Quobyte volume by name.
    +

    RBDPersistentVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1RBDPersistentVolumeSource
    +

    Represents a Rados Block Device mount that lasts the lifetime of a pod. RBD volumes support ownership management and SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd
    image
    string
    The rados image name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    keyring
    string
    Keyring is the path to key ring for RBDUser. Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    monitors
    string array
    A collection of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    pool
    string
    The rados pool name. Default is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    readOnly
    boolean
    ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    secretRef
    SecretReference
    SecretRef is name of the authentication secret for RBDUser. If provided overrides keyring. Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    user
    string
    The rados user name. Default is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    +

    RBDVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1RBDVolumeSource
    +

    Represents a Rados Block Device mount that lasts the lifetime of a pod. RBD volumes support ownership management and SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type of the volume that you want to mount. Tip: Ensure that the filesystem type is supported by the host operating system. Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd
    image
    string
    The rados image name. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    keyring
    string
    Keyring is the path to key ring for RBDUser. Default is /etc/ceph/keyring. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    monitors
    string array
    A collection of Ceph monitors. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    pool
    string
    The rados pool name. Default is rbd. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    readOnly
    boolean
    ReadOnly here will force the ReadOnly setting in VolumeMounts. Defaults to false. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    secretRef
    LocalObjectReference
    SecretRef is name of the authentication secret for RBDUser. If provided overrides keyring. Default is nil. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    user
    string
    The rados user name. Default is admin. More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it
    +

    ReplicaSetCondition v1 apps

    + + + + + +
    GroupVersionKind
    appsv1ReplicaSetCondition
    +

    ReplicaSetCondition describes the state of a replica set at a certain point.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    The last time the condition transitioned from one status to another.
    message
    string
    A human readable message indicating details about the transition.
    reason
    string
    The reason for the condition's last transition.
    status
    string
    Status of the condition, one of True, False, Unknown.
    type
    string
    Type of replica set condition.
    +

    ReplicationControllerCondition v1 core

    + + + + + +
    GroupVersionKind
    corev1ReplicationControllerCondition
    +

    ReplicationControllerCondition describes the state of a replication controller at a certain point.

    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    The last time the condition transitioned from one status to another.
    message
    string
    A human readable message indicating details about the transition.
    reason
    string
    The reason for the condition's last transition.
    status
    string
    Status of the condition, one of True, False, Unknown.
    type
    string
    Type of replication controller condition.
    +

    ResourceAttributes v1 authorization.k8s.io

    + + + + + +
    GroupVersionKind
    authorization.k8s.iov1ResourceAttributes
    +

    ResourceAttributes includes the authorization attributes available for resource requests to the Authorizer interface

    + + + + + + + + + + + + +
    FieldDescription
    group
    string
    Group is the API Group of the Resource. "*" means all.
    name
    string
    Name is the name of the resource being requested for a "get" or deleted for a "delete". "" (empty) means all.
    namespace
    string
    Namespace is the namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces "" (empty) is defaulted for LocalSubjectAccessReviews "" (empty) is empty for cluster-scoped resources "" (empty) means "all" for namespace scoped resources from a SubjectAccessReview or SelfSubjectAccessReview
    resource
    string
    Resource is one of the existing resource types. "*" means all.
    subresource
    string
    Subresource is one of the existing resource types. "" means none.
    verb
    string
    Verb is a kubernetes resource API verb, like: get, list, watch, create, update, delete, proxy. "*" means all.
    version
    string
    Version is the API Version of the Resource. "*" means all.
    +

    ResourceFieldSelector v1 core

    + + + + + +
    GroupVersionKind
    corev1ResourceFieldSelector
    +

    ResourceFieldSelector represents container resources (cpu, memory) and their output format

    + + + + + + + + +
    FieldDescription
    containerName
    string
    Container name: required for volumes, optional for env vars
    divisor
    Quantity
    Specifies the output format of the exposed resources, defaults to "1"
    resource
    string
    Required: resource to select
    +

    ResourceMetricSource v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2ResourceMetricSource
    +

    ResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. Only one "target" type should be set.

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    name
    string
    name is the name of the resource in question.
    target
    MetricTarget
    target specifies the target value for the given metric
    +

    ResourceMetricStatus v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2ResourceMetricStatus
    +

    ResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.

    +
    Other API versions of this object exist: +v2beta2 +v2beta1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    current
    MetricValueStatus
    current contains the current value for the given metric
    name
    string
    Name is the name of the resource in question.
    +

    ResourcePolicyRule v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2ResourcePolicyRule
    +

    ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) either (d1) the request does not specify a namespace (i.e., `Namespace==""`) and clusterScope is true or (d2) the request specifies a namespace and least one member of namespaces matches the request's namespace.

    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + + + + +
    FieldDescription
    apiGroups
    string array
    `apiGroups` is a list of matching API groups and may not be empty. "*" matches all API groups and, if present, must be the only entry. Required.
    clusterScope
    boolean
    `clusterScope` indicates whether to match requests that do not specify a namespace (which happens either because the resource is not namespaced or the request targets all namespaces). If this field is omitted or false then the `namespaces` field must contain a non-empty list.
    namespaces
    string array
    `namespaces` is a list of target namespaces that restricts matches. A request that specifies a target namespace matches only if either (a) this list contains that target namespace or (b) this list contains "*". Note that "*" matches any specified namespace but does not match a request that _does not specify_ a namespace (see the `clusterScope` field for that). This list may be empty, but only if `clusterScope` is true.
    resources
    string array
    `resources` is a list of matching resources (i.e., lowercase and plural) with, if desired, subresource. For example, [ "services", "nodes/status" ]. This list may not be empty. "*" matches all resources and, if present, must be the only entry. Required.
    verbs
    string array
    `verbs` is a list of matching verbs and may not be empty. "*" matches all verbs and, if present, must be the only entry. Required.
    +

    ResourceRequirements v1 core

    + + + + + +
    GroupVersionKind
    corev1ResourceRequirements
    +

    ResourceRequirements describes the compute resource requirements.

    + + + + + + + +
    FieldDescription
    limits
    object
    Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    requests
    object
    Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
    +

    ResourceRule v1 authorization.k8s.io

    + + + + + +
    GroupVersionKind
    authorization.k8s.iov1ResourceRule
    +

    ResourceRule is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.

    + + + + + + + + + +
    FieldDescription
    apiGroups
    string array
    APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "*" means all.
    resourceNames
    string array
    ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed. "*" means all.
    resources
    string array
    Resources is a list of resources this rule applies to. "*" means all in the specified apiGroups. "*/foo" represents the subresource 'foo' for all resources in the specified apiGroups.
    verbs
    string array
    Verb is a list of kubernetes resource API verbs, like: get, list, watch, create, update, delete, proxy. "*" means all.
    +

    RoleRef v1 rbac.authorization.k8s.io

    + + + + + +
    GroupVersionKind
    rbac.authorization.k8s.iov1RoleRef
    +

    RoleRef contains information that points to the role being used

    + + + + + + + + +
    FieldDescription
    apiGroup
    string
    APIGroup is the group for the resource being referenced
    kind
    string
    Kind is the type of resource being referenced
    name
    string
    Name is the name of resource being referenced
    +

    RollingUpdateStatefulSetStrategy v1 apps

    + + + + + +
    GroupVersionKind
    appsv1RollingUpdateStatefulSetStrategy
    +

    RollingUpdateStatefulSetStrategy is used to communicate parameter for RollingUpdateStatefulSetStrategyType.

    + + + + + + +
    FieldDescription
    partition
    integer
    Partition indicates the ordinal at which the StatefulSet should be partitioned. Default value is 0.
    +

    RuleWithOperations v1 admissionregistration.k8s.io

    + + + + + +
    GroupVersionKind
    admissionregistration.k8s.iov1RuleWithOperations
    +

    RuleWithOperations is a tuple of Operations and Resources. It is recommended to make sure that all the tuple expansions are valid.

    + + + + + + + + + + +
    FieldDescription
    apiGroups
    string array
    APIGroups is the API groups the resources belong to. '\*' is all groups. If '\*' is present, the length of the slice must be one. Required.
    apiVersions
    string array
    APIVersions is the API versions the resources belong to. '\*' is all versions. If '\*' is present, the length of the slice must be one. Required.
    operations
    string array
    Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '\*' is present, the length of the slice must be one. Required.
    resources
    string array
    Resources is a list of resources this rule applies to. For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '\*' means all resources, but not subresources. 'pods/\*' means all subresources of pods. '\*/scale' means all scale subresources. '\*/\*' means all resources and their subresources. If wildcard is present, the validation rule will ensure resources do not overlap with each other. Depending on the enclosing object, subresources might not be allowed. Required.
    scope
    string
    scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "*" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "*" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".
    +

    RunAsGroupStrategyOptions v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1RunAsGroupStrategyOptions
    +

    RunAsGroupStrategyOptions defines the strategy type and any options used to create the strategy.

    + + + + + + + +
    FieldDescription
    ranges
    IDRange array
    ranges are the allowed ranges of gids that may be used. If you would like to force a single gid then supply a single range with the same start and end. Required for MustRunAs.
    rule
    string
    rule is the strategy that will dictate the allowable RunAsGroup values that may be set.
    +

    RunAsUserStrategyOptions v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1RunAsUserStrategyOptions
    +

    RunAsUserStrategyOptions defines the strategy type and any options used to create the strategy.

    + + + + + + + +
    FieldDescription
    ranges
    IDRange array
    ranges are the allowed ranges of uids that may be used. If you would like to force a single uid then supply a single range with the same start and end. Required for MustRunAs.
    rule
    string
    rule is the strategy that will dictate the allowable RunAsUser values that may be set.
    +

    RuntimeClassStrategyOptions v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1RuntimeClassStrategyOptions
    +

    RuntimeClassStrategyOptions define the strategy that will dictate the allowable RuntimeClasses for a pod.

    + + + + + + + +
    FieldDescription
    allowedRuntimeClassNames
    string array
    allowedRuntimeClassNames is an allowlist of RuntimeClass names that may be specified on a pod. A value of "*" means that any RuntimeClass name is allowed, and must be the only item in the list. An empty list requires the RuntimeClassName field to be unset.
    defaultRuntimeClassName
    string
    defaultRuntimeClassName is the default RuntimeClassName to set on the pod. The default MUST be allowed by the allowedRuntimeClassNames list. A value of nil does not mutate the Pod.
    +

    SELinuxOptions v1 core

    + + + + + +
    GroupVersionKind
    corev1SELinuxOptions
    +

    SELinuxOptions are the labels to be applied to the container

    + + + + + + + + + +
    FieldDescription
    level
    string
    Level is SELinux level label that applies to the container.
    role
    string
    Role is a SELinux role label that applies to the container.
    type
    string
    Type is a SELinux type label that applies to the container.
    user
    string
    User is a SELinux user label that applies to the container.
    +

    SELinuxStrategyOptions v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1SELinuxStrategyOptions
    +

    SELinuxStrategyOptions defines the strategy type and any options used to create the strategy.

    + + + + + + + +
    FieldDescription
    rule
    string
    rule is the strategy that will dictate the allowable labels that may be set.
    seLinuxOptions
    SELinuxOptions
    seLinuxOptions required to run as; required for MustRunAs More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
    +

    Scale v1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv1Scale
    +

    Scale represents a scaling request for a resource.

    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.
    spec
    ScaleSpec
    defines the behavior of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
    status
    ScaleStatus
    current status of the scale. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status. Read-only.
    +

    ScaleIOPersistentVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1ScaleIOPersistentVolumeSource
    +

    ScaleIOPersistentVolumeSource represents a persistent ScaleIO volume

    +
    Appears In: + +
    + + + + + + + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Default is "xfs"
    gateway
    string
    The host address of the ScaleIO API Gateway.
    protectionDomain
    string
    The name of the ScaleIO Protection Domain for the configured storage.
    readOnly
    boolean
    Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    secretRef
    SecretReference
    SecretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail.
    sslEnabled
    boolean
    Flag to enable/disable SSL communication with Gateway, default false
    storageMode
    string
    Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. Default is ThinProvisioned.
    storagePool
    string
    The ScaleIO Storage Pool associated with the protection domain.
    system
    string
    The name of the storage system as configured in ScaleIO.
    volumeName
    string
    The name of a volume already created in the ScaleIO system that is associated with this volume source.
    +

    ScaleIOVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1ScaleIOVolumeSource
    +

    ScaleIOVolumeSource represents a persistent ScaleIO volume

    +
    Appears In: + +
    + + + + + + + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Default is "xfs".
    gateway
    string
    The host address of the ScaleIO API Gateway.
    protectionDomain
    string
    The name of the ScaleIO Protection Domain for the configured storage.
    readOnly
    boolean
    Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    secretRef
    LocalObjectReference
    SecretRef references to the secret for ScaleIO user and other sensitive information. If this is not provided, Login operation will fail.
    sslEnabled
    boolean
    Flag to enable/disable SSL communication with Gateway, default false
    storageMode
    string
    Indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. Default is ThinProvisioned.
    storagePool
    string
    The ScaleIO Storage Pool associated with the protection domain.
    system
    string
    The name of the storage system as configured in ScaleIO.
    volumeName
    string
    The name of a volume already created in the ScaleIO system that is associated with this volume source.
    +

    Scheduling v1 node.k8s.io

    + + + + + +
    GroupVersionKind
    node.k8s.iov1Scheduling
    +

    Scheduling specifies the scheduling constraints for nodes supporting a RuntimeClass.

    +
    Other API versions of this object exist: +v1beta1 +v1alpha1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    nodeSelector
    object
    nodeSelector lists labels that must be present on nodes that support this RuntimeClass. Pods using this RuntimeClass can only be scheduled to a node matched by this selector. The RuntimeClass nodeSelector is merged with a pod's existing nodeSelector. Any conflicts will cause the pod to be rejected in admission.
    tolerations
    Toleration array
    tolerations are appended (excluding duplicates) to pods running with this RuntimeClass during admission, effectively unioning the set of nodes tolerated by the pod and the RuntimeClass.
    +

    ScopeSelector v1 core

    + + + + + +
    GroupVersionKind
    corev1ScopeSelector
    +

    A scope selector represents the AND of the selectors represented by the scoped-resource selector requirements.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    matchExpressions
    ScopedResourceSelectorRequirement array
    A list of scope selector requirements by scope of the resources.
    +

    ScopedResourceSelectorRequirement v1 core

    + + + + + +
    GroupVersionKind
    corev1ScopedResourceSelectorRequirement
    +

    A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    operator
    string
    Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Possible enum values: - `"DoesNotExist"` - `"Exists"` - `"In"` - `"NotIn"`
    scopeName
    string
    The name of the scope that the selector applies to. Possible enum values: - `"BestEffort"` Match all pod objects that have best effort quality of service - `"CrossNamespacePodAffinity"` Match all pod objects that have cross-namespace pod (anti)affinity mentioned. This is a beta feature enabled by the PodAffinityNamespaceSelector feature flag. - `"NotBestEffort"` Match all pod objects that do not have best effort quality of service - `"NotTerminating"` Match all pod objects where spec.activeDeadlineSeconds is nil - `"PriorityClass"` Match all pod objects that have priority class mentioned - `"Terminating"` Match all pod objects where spec.activeDeadlineSeconds >=0
    values
    string array
    An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
    +

    SeccompProfile v1 core

    + + + + + +
    GroupVersionKind
    corev1SeccompProfile
    +

    SeccompProfile defines a pod/container's seccomp profile settings. Only one profile source may be set.

    + + + + + + + +
    FieldDescription
    localhostProfile
    string
    localhostProfile indicates a profile defined in a file on the node should be used. The profile must be preconfigured on the node to work. Must be a descending path, relative to the kubelet's configured seccomp profile location. Must only be set if type is "Localhost".
    type
    string
    type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. Possible enum values: - `"Localhost"` indicates a profile defined in a file on the node should be used. The file's location relative to <kubelet-root-dir>/seccomp. - `"RuntimeDefault"` represents the default container runtime seccomp profile. - `"Unconfined"` indicates no seccomp profile is applied (A.K.A. unconfined).
    +

    SecretEnvSource v1 core

    + + + + + +
    GroupVersionKind
    corev1SecretEnvSource
    +

    SecretEnvSource selects a Secret to populate the environment variables with. + +The contents of the target Secret's Data field will represent the key-value pairs as environment variables.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    optional
    boolean
    Specify whether the Secret must be defined
    +

    SecretKeySelector v1 core

    + + + + + +
    GroupVersionKind
    corev1SecretKeySelector
    +

    SecretKeySelector selects a key of a Secret.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    key
    string
    The key of the secret to select from. Must be a valid secret key.
    name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    optional
    boolean
    Specify whether the Secret or its key must be defined
    +

    SecretProjection v1 core

    + + + + + +
    GroupVersionKind
    corev1SecretProjection
    +

    Adapts a secret into a projected volume. + +The contents of the target Secret's Data field will be presented in a projected volume as files using the keys in the Data field as the file names. Note that this is identical to a secret volume source without the default mode.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    items
    KeyToPath array
    If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.
    name
    string
    Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
    optional
    boolean
    Specify whether the Secret or its key must be defined
    +

    SecretReference v1 core

    + + + + + +
    GroupVersionKind
    corev1SecretReference
    +

    SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace

    + + + + + + + +
    FieldDescription
    name
    string
    Name is unique within a namespace to reference a secret resource.
    namespace
    string
    Namespace defines the space within which the secret name must be unique.
    +

    SecretVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1SecretVolumeSource
    +

    Adapts a Secret into a volume. + +The contents of the target Secret's Data field will be presented in a volume as files using the keys in the Data field as the file names. Secret volumes support ownership management and SELinux relabeling.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    defaultMode
    integer
    Optional: mode bits used to set permissions on created files by default. Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. Defaults to 0644. Directories within the path are not affected by this setting. This might be in conflict with other options that affect the file mode, like fsGroup, and the result can be other mode bits set.
    items
    KeyToPath array
    If unspecified, each key-value pair in the Data field of the referenced Secret will be projected into the volume as a file whose name is the key and content is the value. If specified, the listed keys will be projected into the specified paths, and unlisted keys will not be present. If a key is specified which is not present in the Secret, the volume setup will error unless it is marked optional. Paths must be relative and may not contain the '..' path or start with '..'.
    optional
    boolean
    Specify whether the Secret or its keys must be defined
    secretName
    string
    Name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret
    +

    SecurityContext v1 core

    + + + + + +
    GroupVersionKind
    corev1SecurityContext
    +

    SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext. When both are set, the values in SecurityContext take precedence.

    + + + + + + + + + + + + + + + + +
    FieldDescription
    allowPrivilegeEscalation
    boolean
    AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.
    capabilities
    Capabilities
    The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows.
    privileged
    boolean
    Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.
    procMount
    string
    procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.
    readOnlyRootFilesystem
    boolean
    Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.
    runAsGroup
    integer
    The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
    runAsNonRoot
    boolean
    Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    runAsUser
    integer
    The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
    seLinuxOptions
    SELinuxOptions
    The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.
    seccompProfile
    SeccompProfile
    The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows.
    windowsOptions
    WindowsSecurityContextOptions
    The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux.
    +

    ServerAddressByClientCIDR v1 meta

    + + + + + +
    GroupVersionKind
    metav1ServerAddressByClientCIDR
    +

    ServerAddressByClientCIDR helps the client to determine the server address that they should use, depending on the clientCIDR that they match.

    + + + + + + + +
    FieldDescription
    clientCIDR
    string
    The CIDR with which clients can match their IP to figure out the server address that they should use.
    serverAddress
    string
    Address of this server, suitable for a client that matches the above CIDR. This can be a hostname, hostname:port, IP or IP:port.
    +

    ServerStorageVersion v1alpha1 internal.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    internal.apiserver.k8s.iov1alpha1ServerStorageVersion
    +

    An API server instance reports the version it can decode and the version it encodes objects to when persisting objects in the backend.

    + + + + + + + + +
    FieldDescription
    apiServerID
    string
    The ID of the reporting API server.
    decodableVersions
    string array
    The API server can decode objects encoded in these versions. The encodingVersion must be included in the decodableVersions.
    encodingVersion
    string
    The API server encodes the object to this version when persisting it in the backend (e.g., etcd).
    +

    ServiceAccountSubject v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2ServiceAccountSubject
    +

    ServiceAccountSubject holds detailed information for service-account-kind subject.

    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    name
    string
    `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name. Required.
    namespace
    string
    `namespace` is the namespace of matching ServiceAccount objects. Required.
    +

    ServiceAccountTokenProjection v1 core

    + + + + + +
    GroupVersionKind
    corev1ServiceAccountTokenProjection
    +

    ServiceAccountTokenProjection represents a projected service account token volume. This projection can be used to insert a service account token into the pods runtime filesystem for use against APIs (Kubernetes API Server or otherwise).

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    audience
    string
    Audience is the intended audience of the token. A recipient of a token must identify itself with an identifier specified in the audience of the token, and otherwise should reject the token. The audience defaults to the identifier of the apiserver.
    expirationSeconds
    integer
    ExpirationSeconds is the requested duration of validity of the service account token. As the token approaches expiration, the kubelet volume plugin will proactively rotate the service account token. The kubelet will start trying to rotate the token if the token is older than 80 percent of its time to live or if the token is older than 24 hours.Defaults to 1 hour and must be at least 10 minutes.
    path
    string
    Path is the path relative to the mount point of the file to project the token into.
    +

    ServiceBackendPort v1 networking.k8s.io

    + + + + + +
    GroupVersionKind
    networking.k8s.iov1ServiceBackendPort
    +

    ServiceBackendPort is the service port being referenced.

    + + + + + + + +
    FieldDescription
    name
    string
    Name is the name of the port on the Service. This is a mutually exclusive setting with "Number".
    number
    integer
    Number is the numerical port number (e.g. 80) on the Service. This is a mutually exclusive setting with "Name".
    +

    ServicePort v1 core

    + + + + + +
    GroupVersionKind
    corev1ServicePort
    +

    ServicePort contains information on service's port.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    appProtocol
    string
    The application protocol for this port. This field follows standard Kubernetes label syntax. Un-prefixed names are reserved for IANA standard service names (as per RFC-6335 and http://www.iana.org/assignments/service-names). Non-standard protocols should use prefixed names such as mycompany.com/my-custom-protocol.
    name
    string
    The name of this port within the service. This must be a DNS_LABEL. All ports within a ServiceSpec must have unique names. When considering the endpoints for a Service, this must match the 'name' field in the EndpointPort. Optional if only one ServicePort is defined on this service.
    nodePort
    integer
    The port on each node on which this service is exposed when type is NodePort or LoadBalancer. Usually assigned by the system. If a value is specified, in-range, and not in use it will be used, otherwise the operation will fail. If not specified, a port will be allocated if this Service requires one. If this field is specified when creating a Service which does not need it, creation will fail. This field will be wiped when updating a Service to no longer need it (e.g. changing type from NodePort to ClusterIP). More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
    port
    integer
    The port that will be exposed by this service.
    protocol
    string
    The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". Default is TCP. Possible enum values: - `"SCTP"` is the SCTP protocol. - `"TCP"` is the TCP protocol. - `"UDP"` is the UDP protocol.
    targetPortNumber or name of the port to access on the pods targeted by the service. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. If this is a string, it will be looked up as a named port in the target Pod's container ports. If this is not specified, the value of the 'port' field is used (an identity map). This field is ignored for services with clusterIP=None, and should be omitted or set equal to the 'port' field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service
    +

    ServiceReference v1 admissionregistration.k8s.io

    + + + + + +
    GroupVersionKind
    admissionregistration.k8s.iov1ServiceReference
    +

    ServiceReference holds a reference to Service.legacy.k8s.io

    + + + + + + + + + +
    FieldDescription
    name
    string
    `name` is the name of the service. Required
    namespace
    string
    `namespace` is the namespace of the service. Required
    path
    string
    `path` is an optional URL path which will be sent in any request to this service.
    port
    integer
    If specified, the port on the service that hosting webhook. Default to 443 for backward compatibility. `port` should be a valid port number (1-65535, inclusive).
    +

    SessionAffinityConfig v1 core

    + + + + + +
    GroupVersionKind
    corev1SessionAffinityConfig
    +

    SessionAffinityConfig represents the configurations of session affinity.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    clientIP
    ClientIPConfig
    clientIP contains the configurations of Client IP based session affinity.
    +

    StatefulSetCondition v1 apps

    + + + + + +
    GroupVersionKind
    appsv1StatefulSetCondition
    +

    StatefulSetCondition describes the state of a statefulset at a certain point.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    Last time the condition transitioned from one status to another.
    message
    string
    A human readable message indicating details about the transition.
    reason
    string
    The reason for the condition's last transition.
    status
    string
    Status of the condition, one of True, False, Unknown.
    type
    string
    Type of statefulset condition.
    +

    StatefulSetPersistentVolumeClaimRetentionPolicy v1 apps

    + + + + + +
    GroupVersionKind
    appsv1StatefulSetPersistentVolumeClaimRetentionPolicy
    +

    StatefulSetPersistentVolumeClaimRetentionPolicy describes the policy used for PVCs created from the StatefulSet VolumeClaimTemplates.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    whenDeleted
    string
    WhenDeleted specifies what happens to PVCs created from StatefulSet VolumeClaimTemplates when the StatefulSet is deleted. The default policy of `Retain` causes PVCs to not be affected by StatefulSet deletion. The `Delete` policy causes those PVCs to be deleted.
    whenScaled
    string
    WhenScaled specifies what happens to PVCs created from StatefulSet VolumeClaimTemplates when the StatefulSet is scaled down. The default policy of `Retain` causes PVCs to not be affected by a scaledown. The `Delete` policy causes the associated PVCs for any excess pods above the replica count to be deleted.
    +

    StatefulSetUpdateStrategy v1 apps

    + + + + + +
    GroupVersionKind
    appsv1StatefulSetUpdateStrategy
    +

    StatefulSetUpdateStrategy indicates the strategy that the StatefulSet controller will use to perform updates. It includes any additional parameters necessary to perform the update for the indicated strategy.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    rollingUpdate
    RollingUpdateStatefulSetStrategy
    RollingUpdate is used to communicate parameters when Type is RollingUpdateStatefulSetStrategyType.
    type
    string
    Type indicates the type of the StatefulSetUpdateStrategy. Default is RollingUpdate. Possible enum values: - `"OnDelete"` triggers the legacy behavior. Version tracking and ordered rolling restarts are disabled. Pods are recreated from the StatefulSetSpec when they are manually deleted. When a scale operation is performed with this strategy,specification version indicated by the StatefulSet's currentRevision. - `"RollingUpdate"` indicates that update will be applied to all Pods in the StatefulSet with respect to the StatefulSet ordering constraints. When a scale operation is performed with this strategy, new Pods will be created from the specification version indicated by the StatefulSet's updateRevision.
    +

    Status v1 meta

    + + + + + +
    GroupVersionKind
    metav1Status
    +

    Status is a return value for calls that don't return other objects.

    + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    code
    integer
    Suggested HTTP return code for this status, 0 if not set.
    details
    StatusDetails
    Extended data associated with the reason. Each reason may define its own extended details. This field is optional and the data returned is not guaranteed to conform to any schema except that defined by the reason type.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    message
    string
    A human-readable description of the status of this operation.
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    reason
    string
    A machine-readable description of why this operation is in the "Failure" status. If this value is empty there is no information available. A Reason clarifies an HTTP status code but does not override it.
    status
    string
    Status of the operation. One of: "Success" or "Failure". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    StatusCause v1 meta

    + + + + + +
    GroupVersionKind
    metav1StatusCause
    +

    StatusCause provides more information about an api.Status failure, including cases when multiple errors are encountered.

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    field
    string
    The field of the resource that has caused this error, as named by its JSON serialization. May include dot and postfix notation for nested attributes. Arrays are zero-indexed. Fields may appear more than once in an array of causes due to fields having multiple errors. Optional. Examples: "name" - the field "name" on the current resource "items[0].name" - the field "name" on the first array entry in "items"
    message
    string
    A human-readable description of the cause of the error. This field may be presented as-is to a reader.
    reason
    string
    A machine-readable description of the cause of the error. If this value is empty there is no information available.
    +

    StatusDetails v1 meta

    + + + + + +
    GroupVersionKind
    metav1StatusDetails
    +

    StatusDetails is a set of additional properties that MAY be set by the server to provide additional information about a response. The Reason field of a Status object defines what attributes will be set. Clients must ignore fields that do not match the defined type of each attribute, and should assume that any attribute may be empty, invalid, or under defined.

    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    causes
    StatusCause array
    The Causes array includes more details associated with the StatusReason failure. Not all StatusReasons may provide detailed causes.
    group
    string
    The group attribute of the resource associated with the status StatusReason.
    kind
    string
    The kind attribute of the resource associated with the status StatusReason. On some operations may differ from the requested resource Kind. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    name
    string
    The name attribute of the resource associated with the status StatusReason (when there is a single name which can be described).
    retryAfterSeconds
    integer
    If specified, the time in seconds before the operation should be retried. Some errors may indicate the client must take an alternate action - for those errors this field may indicate how long to wait before taking the alternate action.
    uid
    string
    UID of the resource. (when there is a single resource which can be described). More info: http://kubernetes.io/docs/user-guide/identifiers#uids
    +

    StorageOSPersistentVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1StorageOSPersistentVolumeSource
    +

    Represents a StorageOS persistent volume resource.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
    readOnly
    boolean
    Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    secretRef
    ObjectReference
    SecretRef specifies the secret to use for obtaining the StorageOS API credentials. If not specified, default values will be attempted.
    volumeName
    string
    VolumeName is the human-readable name of the StorageOS volume. Volume names are only unique within a namespace.
    volumeNamespace
    string
    VolumeNamespace specifies the scope of the volume within StorageOS. If no namespace is specified then the Pod's namespace will be used. This allows the Kubernetes name scoping to be mirrored within StorageOS for tighter integration. Set VolumeName to any name to override the default behaviour. Set to "default" if you are not using namespaces within StorageOS. Namespaces that do not pre-exist within StorageOS will be created.
    +

    StorageOSVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1StorageOSVolumeSource
    +

    Represents a StorageOS persistent volume resource.

    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
    readOnly
    boolean
    Defaults to false (read/write). ReadOnly here will force the ReadOnly setting in VolumeMounts.
    secretRef
    LocalObjectReference
    SecretRef specifies the secret to use for obtaining the StorageOS API credentials. If not specified, default values will be attempted.
    volumeName
    string
    VolumeName is the human-readable name of the StorageOS volume. Volume names are only unique within a namespace.
    volumeNamespace
    string
    VolumeNamespace specifies the scope of the volume within StorageOS. If no namespace is specified then the Pod's namespace will be used. This allows the Kubernetes name scoping to be mirrored within StorageOS for tighter integration. Set VolumeName to any name to override the default behaviour. Set to "default" if you are not using namespaces within StorageOS. Namespaces that do not pre-exist within StorageOS will be created.
    +

    StorageVersionCondition v1alpha1 internal.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    internal.apiserver.k8s.iov1alpha1StorageVersionCondition
    +

    Describes the state of the storageVersion at a certain point.

    + + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    Last time the condition transitioned from one status to another.
    message
    string
    A human readable message indicating details about the transition.
    observedGeneration
    integer
    If set, this represents the .metadata.generation that the condition was set based upon.
    reason
    string
    The reason for the condition's last transition.
    status
    string
    Status of the condition, one of True, False, Unknown.
    type
    string
    Type of the condition.
    +

    Subject v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2Subject
    +

    Subject matches the originator of a request, as identified by the request authentication system. There are three ways of matching an originator; by user, group, or service account.

    +
    Other API versions of this object exist: +v1beta1 +v1 +
    + + + + + + + + + +
    FieldDescription
    group
    GroupSubject
    `group` matches based on user group name.
    kind
    string
    `kind` indicates which one of the other fields is non-empty. Required
    serviceAccount
    ServiceAccountSubject
    `serviceAccount` matches ServiceAccounts.
    user
    UserSubject
    `user` matches based on username.
    +

    SubjectRulesReviewStatus v1 authorization.k8s.io

    + + + + + +
    GroupVersionKind
    authorization.k8s.iov1SubjectRulesReviewStatus
    +

    SubjectRulesReviewStatus contains the result of a rules check. This check can be incomplete depending on the set of authorizers the server is configured with and any errors experienced during evaluation. Because authorization rules are additive, if a rule appears in a list it's safe to assume the subject has that permission, even if that list is incomplete.

    + + + + + + + + + +
    FieldDescription
    evaluationError
    string
    EvaluationError can appear in combination with Rules. It indicates an error occurred during rule evaluation, such as an authorizer that doesn't support rule evaluation, and that ResourceRules and/or NonResourceRules may be incomplete.
    incomplete
    boolean
    Incomplete is true when the rules returned by this call are incomplete. This is most commonly encountered when an authorizer, such as an external authorizer, doesn't support rules evaluation.
    nonResourceRules
    NonResourceRule array
    NonResourceRules is the list of actions the subject is allowed to perform on non-resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
    resourceRules
    ResourceRule array
    ResourceRules is the list of actions the subject is allowed to perform on resources. The list ordering isn't significant, may contain duplicates, and possibly be incomplete.
    +

    SupplementalGroupsStrategyOptions v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1SupplementalGroupsStrategyOptions
    +

    SupplementalGroupsStrategyOptions defines the strategy type and options used to create the strategy.

    + + + + + + + +
    FieldDescription
    ranges
    IDRange array
    ranges are the allowed ranges of supplemental groups. If you would like to force a single supplemental group then supply a single range with the same start and end. Required for MustRunAs.
    rule
    string
    rule is the strategy that will dictate what supplemental groups is used in the SecurityContext.
    +

    Sysctl v1 core

    + + + + + +
    GroupVersionKind
    corev1Sysctl
    +

    Sysctl defines a kernel parameter to be set

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    name
    string
    Name of a property to set
    value
    string
    Value of a property to set
    +

    TCPSocketAction v1 core

    + + + + + +
    GroupVersionKind
    corev1TCPSocketAction
    +

    TCPSocketAction describes an action based on opening a socket

    + + + + + + + +
    FieldDescription
    host
    string
    Optional: Host name to connect to, defaults to the pod IP.
    portNumber or name of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
    +

    Taint v1 core

    + + + + + +
    GroupVersionKind
    corev1Taint
    +

    The node this Taint is attached to has the "effect" on any pod that does not tolerate the Taint.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    effect
    string
    Required. The effect of the taint on pods that do not tolerate the taint. Valid effects are NoSchedule, PreferNoSchedule and NoExecute. Possible enum values: - `"NoExecute"` Evict any already-running pods that do not tolerate the taint. Currently enforced by NodeController. - `"NoSchedule"` Do not allow new pods to schedule onto the node unless they tolerate the taint, but allow all pods submitted to Kubelet without going through the scheduler to start, and allow all already-running pods to continue running. Enforced by the scheduler. - `"PreferNoSchedule"` Like TaintEffectNoSchedule, but the scheduler tries not to schedule new pods onto the node, rather than prohibiting new pods from scheduling onto the node entirely. Enforced by the scheduler.
    key
    string
    Required. The taint key to be applied to a node.
    timeAdded
    Time
    TimeAdded represents the time at which the taint was added. It is only written for NoExecute taints.
    value
    string
    The taint value corresponding to the taint key.
    +

    Time v1 meta

    + + + + + +
    GroupVersionKind
    metav1Time
    +

    Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.

    +
    Appears In: + +
    + + + + +
    FieldDescription
    +

    Toleration v1 core

    + + + + + +
    GroupVersionKind
    corev1Toleration
    +

    The pod this Toleration is attached to tolerates any taint that matches the triple <key,value,effect> using the matching operator <operator>.

    + + + + + + + + + + +
    FieldDescription
    effect
    string
    Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. Possible enum values: - `"NoExecute"` Evict any already-running pods that do not tolerate the taint. Currently enforced by NodeController. - `"NoSchedule"` Do not allow new pods to schedule onto the node unless they tolerate the taint, but allow all pods submitted to Kubelet without going through the scheduler to start, and allow all already-running pods to continue running. Enforced by the scheduler. - `"PreferNoSchedule"` Like TaintEffectNoSchedule, but the scheduler tries not to schedule new pods onto the node, rather than prohibiting new pods from scheduling onto the node entirely. Enforced by the scheduler.
    key
    string
    Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys.
    operator
    string
    Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. Possible enum values: - `"Equal"` - `"Exists"`
    tolerationSeconds
    integer
    TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system.
    value
    string
    Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string.
    +

    TopologySelectorLabelRequirement v1 core

    + + + + + +
    GroupVersionKind
    corev1TopologySelectorLabelRequirement
    +

    A topology selector requirement is a selector that matches given label. This is an alpha feature and may change in the future.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    key
    string
    The label key that the selector applies to.
    values
    string array
    An array of string values. One value must match the label to be selected. Each entry in Values is ORed.
    +

    TopologySelectorTerm v1 core

    + + + + + +
    GroupVersionKind
    corev1TopologySelectorTerm
    +

    A topology selector term represents the result of label queries. A null or empty topology selector term matches no objects. The requirements of them are ANDed. It provides a subset of functionality as NodeSelectorTerm. This is an alpha feature and may change in the future.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    matchLabelExpressions
    TopologySelectorLabelRequirement array
    A list of topology selector requirements by labels.
    +

    TopologySpreadConstraint v1 core

    + + + + + +
    GroupVersionKind
    corev1TopologySpreadConstraint
    +

    TopologySpreadConstraint specifies how to spread matching pods among the given topology.

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    labelSelector
    LabelSelector
    LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain.
    maxSkew
    integer
    MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 1/1/0: | zone1 | zone2 | zone3 | | P | P | | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 1/1/1; scheduling it onto zone1(zone2) would make the ActualSkew(2-0) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It's a required field. Default value is 1 and 0 is not allowed.
    topologyKey
    string
    TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each <key, value> as a "bucket", and try to put balanced number of pods into each bucket. It's a required field.
    whenUnsatisfiable
    string
    WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. Possible enum values: - `"DoNotSchedule"` instructs the scheduler not to schedule the pod when constraints are not satisfied. - `"ScheduleAnyway"` instructs the scheduler to schedule the pod even if constraints are not satisfied.
    +

    TypedLocalObjectReference v1 core

    + + + + + +
    GroupVersionKind
    corev1TypedLocalObjectReference
    +

    TypedLocalObjectReference contains enough information to let you locate the typed referenced object inside the same namespace.

    + + + + + + + + +
    FieldDescription
    apiGroup
    string
    APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required.
    kind
    string
    Kind is the type of resource being referenced
    name
    string
    Name is the name of resource being referenced
    +

    UncountedTerminatedPods v1 batch

    + + + + + +
    GroupVersionKind
    batchv1UncountedTerminatedPods
    +

    UncountedTerminatedPods holds UIDs of Pods that have terminated but haven't been accounted in Job status counters.

    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    failed
    string array
    Failed holds UIDs of failed Pods.
    succeeded
    string array
    Succeeded holds UIDs of succeeded Pods.
    +

    UserInfo v1 authentication.k8s.io

    + + + + + +
    GroupVersionKind
    authentication.k8s.iov1UserInfo
    +

    UserInfo holds the information about the user needed to implement the user.Info interface.

    + + + + + + + + + +
    FieldDescription
    extra
    object
    Any additional information provided by the authenticator.
    groups
    string array
    The names of groups this user is a part of.
    uid
    string
    A unique value that identifies this user across time. If this user is deleted and another user by the same name is added, they will have different UIDs.
    username
    string
    The name that uniquely identifies this user among all active users.
    +

    UserSubject v1beta2 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta2UserSubject
    +

    UserSubject holds detailed information for user-kind subject.

    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + +
    FieldDescription
    name
    string
    `name` is the username that matches, or "*" to match all usernames. Required.
    +

    ValidatingWebhook v1 admissionregistration.k8s.io

    + + + + + +
    GroupVersionKind
    admissionregistration.k8s.iov1ValidatingWebhook
    +

    ValidatingWebhook describes an admission webhook and the resources and operations it applies to.

    + + + + + + + + + + + + + + + +
    FieldDescription
    admissionReviewVersions
    string array
    AdmissionReviewVersions is an ordered list of preferred `AdmissionReview` versions the Webhook expects. API server will try to use first version in the list which it supports. If none of the versions specified in this list supported by API server, validation will fail for this object. If a persisted webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail and be subject to the failure policy.
    clientConfig
    WebhookClientConfig
    ClientConfig defines how to communicate with the hook. Required
    failurePolicy
    string
    FailurePolicy defines how unrecognized errors from the admission endpoint are handled - allowed values are Ignore or Fail. Defaults to Fail.
    matchPolicy
    string
    matchPolicy defines how the "rules" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent". - Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook. - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`, a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook. Defaults to "Equivalent"
    name
    string
    The name of the admission webhook. Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where "imagepolicy" is the name of the webhook, and kubernetes.io is the name of the organization. Required.
    namespaceSelector
    LabelSelector
    NamespaceSelector decides whether to run the webhook on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the webhook. For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] } If instead you want to only run the webhook on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] } See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels for more examples of label selectors. Default to the empty LabelSelector, which matches everything.
    objectSelector
    LabelSelector
    ObjectSelector decides whether to run the webhook based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.
    rules
    RuleWithOperations array
    Rules describes what operations on what resources/subresources the webhook cares about. The webhook cares about an operation if it matches _any_ Rule. However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks from putting the cluster in a state which cannot be recovered from without completely disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
    sideEffects
    string
    SideEffects states whether this webhook has side effects. Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown). Webhooks with side effects MUST implement a reconciliation system, since a request may be rejected by a future step in the admission chain and the side effects therefore need to be undone. Requests with the dryRun attribute will be auto-rejected if they match a webhook with sideEffects == Unknown or Some.
    timeoutSeconds
    integer
    TimeoutSeconds specifies the timeout for this webhook. After the timeout passes, the webhook call will be ignored or the API call will fail based on the failure policy. The timeout value must be between 1 and 30 seconds. Default to 10 seconds.
    +

    ValidationRule v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1ValidationRule
    +

    ValidationRule describes a validation rule written in the CEL expression language.

    + + + + + + + +
    FieldDescription
    message
    string
    Message represents the message displayed when validation fails. The message is required if the Rule contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host"
    rule
    string
    Rule represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec The Rule is scoped to the location of the x-kubernetes-validations extension in the schema. The `self` variable in the CEL expression is bound to the scoped value. Example: - Rule scoped to the root of a resource with a status subresource: {"rule": "self.status.actual <= self.spec.maxDesired"} If the Rule is scoped to an object with properties, the accessible properties of the object are field selectable via `self.field` and field presence can be checked via `has(self.field)`. Null valued fields are treated as absent fields in CEL expressions. If the Rule is scoped to an object with additionalProperties (i.e. a map) the value of the map are accessible via `self[mapKey]`, map containment can be checked via `mapKey in self` and all entries of the map are accessible via CEL macros and functions such as `self.all(...)`. If the Rule is scoped to an array, the elements of the array are accessible via `self[i]` and also by macros and functions. If the Rule is scoped to a scalar, `self` is bound to the scalar value. Examples: - Rule scoped to a map of objects: {"rule": "self.components['Widget'].priority < 10"} - Rule scoped to a list of integers: {"rule": "self.values.all(value, value >= 0 && value < 100)"} - Rule scoped to a string value: {"rule": "self.startsWith('kube')"} The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object and from any x-kubernetes-embedded-resource annotated objects. No other metadata properties are accessible. Unknown data preserved in custom resources via x-kubernetes-preserve-unknown-fields is not accessible in CEL expressions. This includes: - Unknown field values that are preserved by object schemas with x-kubernetes-preserve-unknown-fields. - Object properties where the property schema is of an "unknown type". An "unknown type" is recursively defined as: - A schema with no type and x-kubernetes-preserve-unknown-fields set to true - An array where the items schema is of an "unknown type" - An object where the additionalProperties schema is of an "unknown type" Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are: "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if", "import", "let", "loop", "package", "namespace", "return". Examples: - Rule accessing a property named "namespace": {"rule": "self.__namespace__ > 0"} - Rule accessing a property named "x-prop": {"rule": "self.x__dash__prop > 0"} - Rule accessing a property named "redact__d": {"rule": "self.redact__underscores__d > 0"} Equality on arrays with x-kubernetes-list-type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type: - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and non-intersecting elements in `Y` are appended, retaining their partial order. - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with non-intersecting keys are appended, retaining their partial order.
    +

    VolumeAttachmentSource v1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1VolumeAttachmentSource
    +

    VolumeAttachmentSource represents a volume that should be attached. Right now only PersistenVolumes can be attached via external attacher, in future we may allow also inline volumes in pods. Exactly one member can be set.

    + + + + + + + +
    FieldDescription
    inlineVolumeSpec
    PersistentVolumeSpec
    inlineVolumeSpec contains all the information necessary to attach a persistent volume defined by a pod's inline VolumeSource. This field is populated only for the CSIMigration feature. It contains translated fields from a pod's inline VolumeSource to a PersistentVolumeSpec. This field is beta-level and is only honored by servers that enabled the CSIMigration feature.
    persistentVolumeName
    string
    Name of the persistent volume to attach.
    +

    VolumeDevice v1 core

    + + + + + +
    GroupVersionKind
    corev1VolumeDevice
    +

    volumeDevice describes a mapping of a raw block device within a container.

    + + + + + + + +
    FieldDescription
    devicePath
    string
    devicePath is the path inside of the container that the device will be mapped to.
    name
    string
    name must match the name of a persistentVolumeClaim in the pod
    +

    VolumeError v1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1VolumeError
    +

    VolumeError captures an error encountered during a volume operation.

    + + + + + + + +
    FieldDescription
    message
    string
    String detailing the error encountered during Attach or Detach operation. This string may be logged, so it should not contain sensitive information.
    time
    Time
    Time the error was encountered.
    +

    VolumeMount v1 core

    + + + + + +
    GroupVersionKind
    corev1VolumeMount
    +

    VolumeMount describes a mounting of a Volume within a container.

    + + + + + + + + + + + +
    FieldDescription
    mountPath
    string
    Path within the container at which the volume should be mounted. Must not contain ':'.
    mountPropagation
    string
    mountPropagation determines how mounts are propagated from the host to container and the other way around. When not set, MountPropagationNone is used. This field is beta in 1.10.
    name
    string
    This must match the Name of a Volume.
    readOnly
    boolean
    Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false.
    subPath
    string
    Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
    subPathExpr
    string
    Expanded path within the volume from which the container's volume should be mounted. Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. Defaults to "" (volume's root). SubPathExpr and SubPath are mutually exclusive.
    +

    VolumeNodeAffinity v1 core

    + + + + + +
    GroupVersionKind
    corev1VolumeNodeAffinity
    +

    VolumeNodeAffinity defines constraints that limit what nodes this volume can be accessed from.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    required
    NodeSelector
    Required specifies hard node constraints that must be met.
    +

    VolumeNodeResources v1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1VolumeNodeResources
    +

    VolumeNodeResources is a set of resource limits for scheduling of volumes.

    +
    Appears In: + +
    + + + + + +
    FieldDescription
    count
    integer
    Maximum number of unique volumes managed by the CSI driver that can be used on a node. A volume that is both attached and mounted on a node is considered to be used once, not twice. The same rule applies for a unique volume that is shared among multiple pods on the same node. If this field is not specified, then the supported number of volumes on this node is unbounded.
    +

    VolumeProjection v1 core

    + + + + + +
    GroupVersionKind
    corev1VolumeProjection
    +

    Projection that may be projected along with other supported volume types

    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    configMap
    ConfigMapProjection
    information about the configMap data to project
    downwardAPI
    DownwardAPIProjection
    information about the downwardAPI data to project
    secret
    SecretProjection
    information about the secret data to project
    serviceAccountToken
    ServiceAccountTokenProjection
    information about the serviceAccountToken data to project
    +

    VsphereVirtualDiskVolumeSource v1 core

    + + + + + +
    GroupVersionKind
    corev1VsphereVirtualDiskVolumeSource
    +

    Represents a vSphere volume resource.

    + + + + + + + + + +
    FieldDescription
    fsType
    string
    Filesystem type to mount. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
    storagePolicyID
    string
    Storage Policy Based Management (SPBM) profile ID associated with the StoragePolicyName.
    storagePolicyName
    string
    Storage Policy Based Management (SPBM) profile name.
    volumePath
    string
    Path that identifies vSphere volume vmdk
    +

    WatchEvent v1 meta

    + + + + + +
    GroupVersionKind
    metav1WatchEvent
    +

    Event represents a single event to a watched resource.

    + + + + + + +
    FieldDescription
    objectObject is: * If Type is Added or Modified: the new state of the object. * If Type is Deleted: the state of the object immediately before deletion. * If Type is Error: *Status is recommended; other types may make sense depending on context.
    type
    string
    +

    WebhookClientConfig v1 admissionregistration.k8s.io

    + + + + + +
    GroupVersionKind
    admissionregistration.k8s.iov1WebhookClientConfig
    +

    WebhookClientConfig contains the information to make a TLS connection with the webhook

    + + + + + + + + +
    FieldDescription
    caBundle
    string
    `caBundle` is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. If unspecified, system trust roots on the apiserver are used.
    service
    ServiceReference
    `service` is a reference to the service for this webhook. Either `service` or `url` must be specified. If the webhook is running within the cluster, then you should use `service`.
    url
    string
    `url` gives the location of the webhook, in standard URL form (`scheme://host:port/path`). Exactly one of `url` or `service` must be specified. The `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address. Please note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster. The scheme must be "https"; the URL must begin with "https://". A path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier. Attempting to use a user or basic auth e.g. "user:password@" is not allowed. Fragments ("#...") and query parameters ("?...") are not allowed, either.
    +

    WebhookConversion v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1WebhookConversion
    +

    WebhookConversion describes how to call a conversion webhook

    + + + + + + + +
    FieldDescription
    clientConfig
    WebhookClientConfig
    clientConfig is the instructions for how to call the webhook if strategy is `Webhook`.
    conversionReviewVersions
    string array
    conversionReviewVersions is an ordered list of preferred `ConversionReview` versions the Webhook expects. The API server will use the first version in the list which it supports. If none of the versions specified in this list are supported by API server, conversion will fail for the custom resource. If a persisted Webhook configuration specifies allowed versions and does not include any versions known to the API Server, calls to the webhook will fail.
    +

    WeightedPodAffinityTerm v1 core

    + + + + + +
    GroupVersionKind
    corev1WeightedPodAffinityTerm
    +

    The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)

    + + + + + + + +
    FieldDescription
    podAffinityTerm
    PodAffinityTerm
    Required. A pod affinity term, associated with the corresponding weight.
    weight
    integer
    weight associated with matching the corresponding podAffinityTerm, in the range 1-100.
    +

    WindowsSecurityContextOptions v1 core

    + + + + + +
    GroupVersionKind
    corev1WindowsSecurityContextOptions
    +

    WindowsSecurityContextOptions contain Windows-specific options and credentials.

    + + + + + + + + + +
    FieldDescription
    gmsaCredentialSpec
    string
    GMSACredentialSpec is where the GMSA admission webhook (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the GMSA credential spec named by the GMSACredentialSpecName field.
    gmsaCredentialSpecName
    string
    GMSACredentialSpecName is the name of the GMSA credential spec to use.
    hostProcess
    boolean
    HostProcess determines if a container should be run as a 'Host Process' container. This field is alpha-level and will only be honored by components that enable the WindowsHostProcessContainers feature flag. Setting this field without the feature flag will result in errors when validating the Pod. All of a Pod's containers must have the same effective HostProcess value (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). In addition, if HostProcess is true then HostNetwork must also be set to true.
    runAsUserName
    string
    The UserName in Windows to run the entrypoint of the container process. Defaults to the user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.
    +

    OLD API VERSIONS

    + +

    This section contains older versions of resources shown above.

    +

    CSIStorageCapacity v1alpha1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1alpha1CSIStorageCapacity
    +
    Other API versions of this object exist: +v1beta1 +
    + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    capacity
    Quantity
    Capacity is the value reported by the CSI driver in its GetCapacityResponse for a GetCapacityRequest with topology and parameters that match the previous fields. The semantic is currently (CSI spec 1.2) defined as: The available capacity, in bytes, of the storage that can be used to provision volumes. If not set, that information is currently unavailable and treated like zero capacity.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    maximumVolumeSize
    Quantity
    MaximumVolumeSize is the value reported by the CSI driver in its GetCapacityResponse for a GetCapacityRequest with topology and parameters that match the previous fields. This is defined since CSI spec 1.4.0 as the largest size that may be used in a CreateVolumeRequest.capacity_range.required_bytes field to create a volume with the same parameters as those in GetCapacityRequest. The corresponding value in the Kubernetes API is ResourceRequirements.Requests in a volume claim.
    metadata
    ObjectMeta
    Standard object's metadata. The name has no particular meaning. It must be be a DNS subdomain (dots allowed, 253 characters). To ensure that there are no conflicts with other CSI drivers on the cluster, the recommendation is to use csisc-<uuid>, a generated name, or a reverse-domain name which ends with the unique CSI driver name. Objects are namespaced. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    nodeTopology
    LabelSelector
    NodeTopology defines which nodes have access to the storage for which capacity was reported. If not set, the storage is not accessible from any node in the cluster. If empty, the storage is accessible from all nodes. This field is immutable.
    storageClassName
    string
    The name of the StorageClass that the reported capacity applies to. It must meet the same requirements as the name of a StorageClass object (non-empty, DNS subdomain). If that object no longer exists, the CSIStorageCapacity object is obsolete and should be removed by its creator. This field is immutable.
    +

    CSIStorageCapacityList v1alpha1 storage

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    CSIStorageCapacity array
    Items is the list of CSIStorageCapacity objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a CSIStorageCapacity

    +

    HTTP Request

    +POST /apis/storage.k8s.io/v1alpha1/namespaces/{namespace}/csistoragecapacities +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CSIStorageCapacity
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    CSIStorageCapacity
    OK
    201
    CSIStorageCapacity
    Created
    202
    CSIStorageCapacity
    Accepted
    +

    Patch

    +

    partially update the specified CSIStorageCapacity

    +

    HTTP Request

    +PATCH /apis/storage.k8s.io/v1alpha1/namespaces/{namespace}/csistoragecapacities/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CSIStorageCapacity
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CSIStorageCapacity
    OK
    201
    CSIStorageCapacity
    Created
    +

    Replace

    +

    replace the specified CSIStorageCapacity

    +

    HTTP Request

    +PUT /apis/storage.k8s.io/v1alpha1/namespaces/{namespace}/csistoragecapacities/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CSIStorageCapacity
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CSIStorageCapacity
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CSIStorageCapacity
    OK
    201
    CSIStorageCapacity
    Created
    +

    Delete

    +

    delete a CSIStorageCapacity

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1alpha1/namespaces/{namespace}/csistoragecapacities/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CSIStorageCapacity
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of CSIStorageCapacity

    +

    HTTP Request

    +DELETE /apis/storage.k8s.io/v1alpha1/namespaces/{namespace}/csistoragecapacities +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified CSIStorageCapacity

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1alpha1/namespaces/{namespace}/csistoragecapacities/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CSIStorageCapacity
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CSIStorageCapacity
    OK
    +

    List

    +

    list or watch objects of kind CSIStorageCapacity

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1alpha1/namespaces/{namespace}/csistoragecapacities +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CSIStorageCapacityList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind CSIStorageCapacity

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1alpha1/csistoragecapacities +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CSIStorageCapacityList
    OK
    +

    Watch

    +

    watch changes to an object of kind CSIStorageCapacity. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1alpha1/watch/namespaces/{namespace}/csistoragecapacities/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CSIStorageCapacity
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of CSIStorageCapacity. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1alpha1/watch/namespaces/{namespace}/csistoragecapacities +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of CSIStorageCapacity. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/storage.k8s.io/v1alpha1/watch/csistoragecapacities +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    ContainerResourceMetricSource v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2ContainerResourceMetricSource
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + + +
    FieldDescription
    container
    string
    container is the name of the container in the pods of the scaling target
    name
    string
    name is the name of the resource in question.
    target
    MetricTarget
    target specifies the target value for the given metric
    +

    ContainerResourceMetricSource v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1ContainerResourceMetricSource
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + + +
    FieldDescription
    container
    string
    container is the name of the container in the pods of the scaling target
    name
    string
    name is the name of the resource in question.
    targetAverageUtilization
    integer
    targetAverageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.
    targetAverageValue
    Quantity
    targetAverageValue is the target value of the average of the resource metric across all relevant pods, as a raw value (instead of as a percentage of the request), similar to the "pods" metric source type.
    +

    ContainerResourceMetricStatus v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2ContainerResourceMetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + + +
    FieldDescription
    container
    string
    Container is the name of the container in the pods of the scaling target
    current
    MetricValueStatus
    current contains the current value for the given metric
    name
    string
    Name is the name of the resource in question.
    +

    ContainerResourceMetricStatus v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1ContainerResourceMetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + + +
    FieldDescription
    container
    string
    container is the name of the container in the pods of the scaling target
    currentAverageUtilization
    integer
    currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. It will only be present if `targetAverageValue` was set in the corresponding metric specification.
    currentAverageValue
    Quantity
    currentAverageValue is the current value of the average of the resource metric across all relevant pods, as a raw value (instead of as a percentage of the request), similar to the "pods" metric source type. It will always be set, regardless of the corresponding metric specification.
    name
    string
    name is the name of the resource in question.
    +

    CronJob v1beta1 batch

    + + + + + +
    GroupVersionKind
    batchv1beta1CronJob
    +
    Other API versions of this object exist: +v1 +
    +
    Appears In: + +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    CronJobSpec
    Specification of the desired behavior of a cron job, including the schedule. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    CronJobStatus
    Current status of a cron job. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    CronJobSpec v1beta1 batch

    +
    Appears In: + +
    + + + + + + + + + + + +
    FieldDescription
    concurrencyPolicy
    string
    Specifies how to treat concurrent executions of a Job. Valid values are: - "Allow" (default): allows CronJobs to run concurrently; - "Forbid": forbids concurrent runs, skipping next run if previous run hasn't finished yet; - "Replace": cancels currently running job and replaces it with a new one
    failedJobsHistoryLimit
    integer
    The number of failed finished jobs to retain. This is a pointer to distinguish between explicit zero and not specified. Defaults to 1.
    jobTemplate
    JobTemplateSpec
    Specifies the job that will be created when executing a CronJob.
    schedule
    string
    The schedule in Cron format, see https://en.wikipedia.org/wiki/Cron.
    startingDeadlineSeconds
    integer
    Optional deadline in seconds for starting the job if it misses scheduled time for any reason. Missed jobs executions will be counted as failed ones.
    successfulJobsHistoryLimit
    integer
    The number of successful finished jobs to retain. This is a pointer to distinguish between explicit zero and not specified. Defaults to 3.
    suspend
    boolean
    This flag tells the controller to suspend subsequent executions, it does not apply to already started executions. Defaults to false.
    +

    CronJobStatus v1beta1 batch

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    active
    ObjectReference array
    A list of pointers to currently running jobs.
    lastScheduleTime
    Time
    Information when was the last time the job was successfully scheduled.
    lastSuccessfulTime
    Time
    Information when was the last time the job successfully completed.
    +

    CronJobList v1beta1 batch

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    CronJob array
    items is the list of CronJobs.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a CronJob

    +

    HTTP Request

    +POST /apis/batch/v1beta1/namespaces/{namespace}/cronjobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CronJob
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    CronJob
    OK
    201
    CronJob
    Created
    202
    CronJob
    Accepted
    +

    Patch

    +

    partially update the specified CronJob

    +

    HTTP Request

    +PATCH /apis/batch/v1beta1/namespaces/{namespace}/cronjobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CronJob
    OK
    201
    CronJob
    Created
    +

    Replace

    +

    replace the specified CronJob

    +

    HTTP Request

    +PUT /apis/batch/v1beta1/namespaces/{namespace}/cronjobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CronJob
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CronJob
    OK
    201
    CronJob
    Created
    +

    Delete

    +

    delete a CronJob

    +

    HTTP Request

    +DELETE /apis/batch/v1beta1/namespaces/{namespace}/cronjobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of CronJob

    +

    HTTP Request

    +DELETE /apis/batch/v1beta1/namespaces/{namespace}/cronjobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified CronJob

    +

    HTTP Request

    +GET /apis/batch/v1beta1/namespaces/{namespace}/cronjobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CronJob
    OK
    +

    List

    +

    list or watch objects of kind CronJob

    +

    HTTP Request

    +GET /apis/batch/v1beta1/namespaces/{namespace}/cronjobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CronJobList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind CronJob

    +

    HTTP Request

    +GET /apis/batch/v1beta1/cronjobs +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CronJobList
    OK
    +

    Watch

    +

    watch changes to an object of kind CronJob. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/batch/v1beta1/watch/namespaces/{namespace}/cronjobs/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of CronJob. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/batch/v1beta1/watch/namespaces/{namespace}/cronjobs +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of CronJob. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/batch/v1beta1/watch/cronjobs +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified CronJob

    +

    HTTP Request

    +PATCH /apis/batch/v1beta1/namespaces/{namespace}/cronjobs/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CronJob
    OK
    201
    CronJob
    Created
    +

    Read Status

    +

    read status of the specified CronJob

    +

    HTTP Request

    +GET /apis/batch/v1beta1/namespaces/{namespace}/cronjobs/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    CronJob
    OK
    +

    Replace Status

    +

    replace status of the specified CronJob

    +

    HTTP Request

    +PUT /apis/batch/v1beta1/namespaces/{namespace}/cronjobs/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the CronJob
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    CronJob
    +

    Response

    + + + + + + +
    CodeDescription
    200
    CronJob
    OK
    201
    CronJob
    Created
    +

    CrossVersionObjectReference v2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2CrossVersionObjectReference
    +
    Other API versions of this object exist: +v1 +v2beta2 +v2beta1 +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    API version of the referent
    kind
    string
    Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
    name
    string
    Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names
    +

    CrossVersionObjectReference v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2CrossVersionObjectReference
    +
    Other API versions of this object exist: +v1 +v2 +v2beta1 +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    API version of the referent
    kind
    string
    Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
    name
    string
    Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names
    +

    CrossVersionObjectReference v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1CrossVersionObjectReference
    +
    Other API versions of this object exist: +v1 +v2 +v2beta2 +
    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    API version of the referent
    kind
    string
    Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
    name
    string
    Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names
    +

    Endpoint v1beta1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1beta1Endpoint
    +
    Other API versions of this object exist: +v1 +
    + + + + + + + + + + + + +
    FieldDescription
    addresses
    string array
    addresses of this endpoint. The contents of this field are interpreted according to the corresponding EndpointSlice addressType field. Consumers must handle different types of addresses in the context of their own capabilities. This must contain at least one address but no more than 100.
    conditions
    EndpointConditions
    conditions contains information about the current status of the endpoint.
    hints
    EndpointHints
    hints contains information associated with how an endpoint should be consumed.
    hostname
    string
    hostname of this endpoint. This field may be used by consumers of endpoints to distinguish endpoints from each other (e.g. in DNS names). Multiple endpoints which use the same hostname should be considered fungible (e.g. multiple A values in DNS). Must be lowercase and pass DNS Label (RFC 1123) validation.
    nodeName
    string
    nodeName represents the name of the Node hosting this endpoint. This can be used to determine endpoints local to a Node. This field can be enabled with the EndpointSliceNodeName feature gate.
    targetRef
    ObjectReference
    targetRef is a reference to a Kubernetes object that represents this endpoint.
    topology
    object
    topology contains arbitrary topology information associated with the endpoint. These key/value pairs must conform with the label format. https://kubernetes.io/docs/concepts/overview/working-with-objects/labels Topology may include a maximum of 16 key/value pairs. This includes, but is not limited to the following well known keys: * kubernetes.io/hostname: the value indicates the hostname of the node where the endpoint is located. This should match the corresponding node label. * topology.kubernetes.io/zone: the value indicates the zone where the endpoint is located. This should match the corresponding node label. * topology.kubernetes.io/region: the value indicates the region where the endpoint is located. This should match the corresponding node label. This field is deprecated and will be removed in future api versions.
    +

    EndpointConditions v1beta1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1beta1EndpointConditions
    +
    Other API versions of this object exist: +v1 +
    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    ready
    boolean
    ready indicates that this endpoint is prepared to receive traffic, according to whatever system is managing the endpoint. A nil value indicates an unknown state. In most cases consumers should interpret this unknown state as ready. For compatibility reasons, ready should never be "true" for terminating endpoints.
    serving
    boolean
    serving is identical to ready except that it is set regardless of the terminating state of endpoints. This condition should be set to true for a ready endpoint that is terminating. If nil, consumers should defer to the ready condition. This field can be enabled with the EndpointSliceTerminatingCondition feature gate.
    terminating
    boolean
    terminating indicates that this endpoint is terminating. A nil value indicates an unknown state. Consumers should interpret this unknown state to mean that the endpoint is not terminating. This field can be enabled with the EndpointSliceTerminatingCondition feature gate.
    +

    EndpointHints v1beta1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1beta1EndpointHints
    +
    Other API versions of this object exist: +v1 +
    +
    Appears In: + +
    + + + + + +
    FieldDescription
    forZones
    ForZone array
    forZones indicates the zone(s) this endpoint should be consumed by to enable topology aware routing. May contain a maximum of 8 entries.
    +

    EndpointPort v1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1EndpointPort
    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + + + +
    FieldDescription
    appProtocol
    string
    The application protocol for this port. This field follows standard Kubernetes label syntax. Un-prefixed names are reserved for IANA standard service names (as per RFC-6335 and http://www.iana.org/assignments/service-names). Non-standard protocols should use prefixed names such as mycompany.com/my-custom-protocol.
    name
    string
    The name of this port. All ports in an EndpointSlice must have a unique name. If the EndpointSlice is dervied from a Kubernetes service, this corresponds to the Service.ports[].name. Name must either be an empty string or pass DNS_LABEL validation: * must be no more than 63 characters long. * must consist of lower case alphanumeric characters or '-'. * must start and end with an alphanumeric character. Default is empty string.
    port
    integer
    The port number of the endpoint. If this is not specified, ports are not restricted and must be interpreted in the context of the specific consumer.
    protocol
    string
    The IP protocol for this port. Must be UDP, TCP, or SCTP. Default is TCP.
    +

    EndpointPort v1beta1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1beta1EndpointPort
    +
    Other API versions of this object exist: +v1 +v1 +
    + + + + + + + + + +
    FieldDescription
    appProtocol
    string
    The application protocol for this port. This field follows standard Kubernetes label syntax. Un-prefixed names are reserved for IANA standard service names (as per RFC-6335 and http://www.iana.org/assignments/service-names). Non-standard protocols should use prefixed names such as mycompany.com/my-custom-protocol.
    name
    string
    The name of this port. All ports in an EndpointSlice must have a unique name. If the EndpointSlice is dervied from a Kubernetes service, this corresponds to the Service.ports[].name. Name must either be an empty string or pass DNS_LABEL validation: * must be no more than 63 characters long. * must consist of lower case alphanumeric characters or '-'. * must start and end with an alphanumeric character. Default is empty string.
    port
    integer
    The port number of the endpoint. If this is not specified, ports are not restricted and must be interpreted in the context of the specific consumer.
    protocol
    string
    The IP protocol for this port. Must be UDP, TCP, or SCTP. Default is TCP.
    +

    EndpointSlice v1beta1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1beta1EndpointSlice
    +
    Other API versions of this object exist: +v1 +
    + + + + + + + + + + + +
    FieldDescription
    addressType
    string
    addressType specifies the type of address carried by this EndpointSlice. All addresses in this slice must be the same type. This field is immutable after creation. The following address types are currently supported: * IPv4: Represents an IPv4 Address. * IPv6: Represents an IPv6 Address. * FQDN: Represents a Fully Qualified Domain Name.
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    endpoints
    Endpoint array
    endpoints is a list of unique endpoints in this slice. Each slice may include a maximum of 1000 endpoints.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata.
    ports
    EndpointPort array
    ports specifies the list of network ports exposed by each endpoint in this slice. Each port must have a unique name. When ports is empty, it indicates that there are no defined ports. When a port is defined with a nil port value, it indicates "all ports". Each slice may include a maximum of 100 ports.
    +

    EndpointSliceList v1beta1 discovery

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    EndpointSlice array
    List of endpoint slices
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata.
    +

    Write Operations

    +

    Create

    +

    create an EndpointSlice

    +

    HTTP Request

    +POST /apis/discovery.k8s.io/v1beta1/namespaces/{namespace}/endpointslices +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    EndpointSlice
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    EndpointSlice
    OK
    201
    EndpointSlice
    Created
    202
    EndpointSlice
    Accepted
    +

    Patch

    +

    partially update the specified EndpointSlice

    +

    HTTP Request

    +PATCH /apis/discovery.k8s.io/v1beta1/namespaces/{namespace}/endpointslices/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the EndpointSlice
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    EndpointSlice
    OK
    201
    EndpointSlice
    Created
    +

    Replace

    +

    replace the specified EndpointSlice

    +

    HTTP Request

    +PUT /apis/discovery.k8s.io/v1beta1/namespaces/{namespace}/endpointslices/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the EndpointSlice
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    EndpointSlice
    +

    Response

    + + + + + + +
    CodeDescription
    200
    EndpointSlice
    OK
    201
    EndpointSlice
    Created
    +

    Delete

    +

    delete an EndpointSlice

    +

    HTTP Request

    +DELETE /apis/discovery.k8s.io/v1beta1/namespaces/{namespace}/endpointslices/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the EndpointSlice
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of EndpointSlice

    +

    HTTP Request

    +DELETE /apis/discovery.k8s.io/v1beta1/namespaces/{namespace}/endpointslices +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified EndpointSlice

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1beta1/namespaces/{namespace}/endpointslices/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the EndpointSlice
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EndpointSlice
    OK
    +

    List

    +

    list or watch objects of kind EndpointSlice

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1beta1/namespaces/{namespace}/endpointslices +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EndpointSliceList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind EndpointSlice

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1beta1/endpointslices +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EndpointSliceList
    OK
    +

    Watch

    +

    watch changes to an object of kind EndpointSlice. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1beta1/watch/namespaces/{namespace}/endpointslices/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the EndpointSlice
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of EndpointSlice. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1beta1/watch/namespaces/{namespace}/endpointslices +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of EndpointSlice. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/discovery.k8s.io/v1beta1/watch/endpointslices +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Event v1 core

    + + + + + +
    GroupVersionKind
    corev1Event
    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    action
    string
    What action was taken/failed regarding to the Regarding object.
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    count
    integer
    The number of times this event has occurred.
    eventTime
    MicroTime
    Time when this Event was first observed.
    firstTimestamp
    Time
    The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)
    involvedObject
    ObjectReference
    The object that this event is about.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    lastTimestamp
    Time
    The time at which the most recent occurrence of this event was recorded.
    message
    string
    A human-readable description of the status of this operation.
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    reason
    string
    This should be a short, machine understandable string that gives the reason for the transition into the object's current status.
    related
    ObjectReference
    Optional secondary object for more complex actions.
    reportingComponent
    string
    Name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`.
    reportingInstance
    string
    ID of the controller instance, e.g. `kubelet-xyzf`.
    series
    EventSeries
    Data about the Event series this event represents or nil if it's a singleton Event.
    source
    EventSource
    The component reporting this event. Should be a short machine understandable string.
    type
    string
    Type of this event (Normal, Warning), new types could be added in the future
    +

    EventList v1 core

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Event array
    List of events
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    +

    Write Operations

    +

    Create

    +

    create an Event

    +

    HTTP Request

    +POST /api/v1/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Event
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Event
    OK
    201
    Event
    Created
    202
    Event
    Accepted
    +

    Patch

    +

    partially update the specified Event

    +

    HTTP Request

    +PATCH /api/v1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Event
    OK
    201
    Event
    Created
    +

    Replace

    +

    replace the specified Event

    +

    HTTP Request

    +PUT /api/v1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Event
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Event
    OK
    201
    Event
    Created
    +

    Delete

    +

    delete an Event

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Event

    +

    HTTP Request

    +DELETE /api/v1/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified Event

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Event
    OK
    +

    List

    +

    list or watch objects of kind Event

    +

    HTTP Request

    +GET /api/v1/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EventList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Event

    +

    HTTP Request

    +GET /api/v1/events +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EventList
    OK
    +

    Watch

    +

    watch changes to an object of kind Event. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Event. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Event. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /api/v1/watch/events +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Event v1beta1 events.k8s.io

    + + + + + +
    GroupVersionKind
    events.k8s.iov1beta1Event
    +
    Other API versions of this object exist: +v1 +v1 +
    +
    Appears In: + +
    + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    action
    string
    action is what action was taken/failed regarding to the regarding object. It is machine-readable. This field can have at most 128 characters.
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    deprecatedCount
    integer
    deprecatedCount is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedFirstTimestamp
    Time
    deprecatedFirstTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedLastTimestamp
    Time
    deprecatedLastTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.
    deprecatedSource
    EventSource
    deprecatedSource is the deprecated field assuring backward compatibility with core.v1 Event type.
    eventTime
    MicroTime
    eventTime is the time when this Event was first observed. It is required.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    note
    string
    note is a human-readable description of the status of this operation. Maximal length of the note is 1kB, but libraries should be prepared to handle values up to 64kB.
    reason
    string
    reason is why the action was taken. It is human-readable. This field can have at most 128 characters.
    regarding
    ObjectReference
    regarding contains the object this Event is about. In most cases it's an Object reporting controller implements, e.g. ReplicaSetController implements ReplicaSets and this event is emitted because it acts on some changes in a ReplicaSet object.
    related
    ObjectReference
    related is the optional secondary object for more complex actions. E.g. when regarding object triggers a creation or deletion of related object.
    reportingController
    string
    reportingController is the name of the controller that emitted this Event, e.g. `kubernetes.io/kubelet`. This field cannot be empty for new Events.
    reportingInstance
    string
    reportingInstance is the ID of the controller instance, e.g. `kubelet-xyzf`. This field cannot be empty for new Events and it can have at most 128 characters.
    series
    EventSeries
    series is data about the Event series this event represents or nil if it's a singleton Event.
    type
    string
    type is the type of this event (Normal, Warning), new types could be added in the future. It is machine-readable.
    +

    EventList v1beta1 events

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    Event array
    items is a list of schema objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create an Event

    +

    HTTP Request

    +POST /apis/events.k8s.io/v1beta1/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Event
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    Event
    OK
    201
    Event
    Created
    202
    Event
    Accepted
    +

    Patch

    +

    partially update the specified Event

    +

    HTTP Request

    +PATCH /apis/events.k8s.io/v1beta1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Event
    OK
    201
    Event
    Created
    +

    Replace

    +

    replace the specified Event

    +

    HTTP Request

    +PUT /apis/events.k8s.io/v1beta1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Event
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Event
    OK
    201
    Event
    Created
    +

    Delete

    +

    delete an Event

    +

    HTTP Request

    +DELETE /apis/events.k8s.io/v1beta1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of Event

    +

    HTTP Request

    +DELETE /apis/events.k8s.io/v1beta1/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified Event

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1beta1/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    Event
    OK
    +

    List

    +

    list or watch objects of kind Event

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1beta1/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EventList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind Event

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1beta1/events +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    EventList
    OK
    +

    Watch

    +

    watch changes to an object of kind Event. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1beta1/watch/namespaces/{namespace}/events/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the Event
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of Event. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1beta1/watch/namespaces/{namespace}/events +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of Event. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/events.k8s.io/v1beta1/watch/events +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    EventSeries v1 core

    + + + + + +
    GroupVersionKind
    corev1EventSeries
    +
    Other API versions of this object exist: +v1beta1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    count
    integer
    Number of occurrences in this series up to the last heartbeat time
    lastObservedTime
    MicroTime
    Time of the last occurrence observed
    +

    EventSeries v1beta1 events.k8s.io

    + + + + + +
    GroupVersionKind
    events.k8s.iov1beta1EventSeries
    +
    Other API versions of this object exist: +v1 +v1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    count
    integer
    count is the number of occurrences in this series up to the last heartbeat time.
    lastObservedTime
    MicroTime
    lastObservedTime is the time when last Event from the series was seen before last heartbeat.
    +

    ExternalMetricSource v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2ExternalMetricSource
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + +
    FieldDescription
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    target
    MetricTarget
    target specifies the target value for the given metric
    +

    ExternalMetricSource v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1ExternalMetricSource
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + + +
    FieldDescription
    metricName
    string
    metricName is the name of the metric in question.
    metricSelector
    LabelSelector
    metricSelector is used to identify a specific time series within a given metric.
    targetAverageValue
    Quantity
    targetAverageValue is the target per-pod value of global metric (as a quantity). Mutually exclusive with TargetValue.
    targetValue
    Quantity
    targetValue is the target value of the metric (as a quantity). Mutually exclusive with TargetAverageValue.
    +

    ExternalMetricStatus v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2ExternalMetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + +
    FieldDescription
    current
    MetricValueStatus
    current contains the current value for the given metric
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    +

    ExternalMetricStatus v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1ExternalMetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + + +
    FieldDescription
    currentAverageValue
    Quantity
    currentAverageValue is the current value of metric averaged over autoscaled pods.
    currentValue
    Quantity
    currentValue is the current value of the metric (as a quantity)
    metricName
    string
    metricName is the name of a metric used for autoscaling in metric system.
    metricSelector
    LabelSelector
    metricSelector is used to identify a specific time series within a given metric.
    +

    FlowDistinguisherMethod v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1FlowDistinguisherMethod
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + +
    FieldDescription
    type
    string
    `type` is the type of flow distinguisher method The supported types are "ByUser" and "ByNamespace". Required.
    +

    FlowSchema v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1FlowSchema
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    FlowSchemaSpec
    `spec` is the specification of the desired behavior of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    FlowSchemaStatus
    `status` is the current status of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    FlowSchemaSpec v1beta1 flowcontrol

    + + + + + + + + + +
    FieldDescription
    distinguisherMethod
    FlowDistinguisherMethod
    `distinguisherMethod` defines how to compute the flow distinguisher for requests that match this schema. `nil` specifies that the distinguisher is disabled and thus will always be the empty string.
    matchingPrecedence
    integer
    `matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen FlowSchema is among those with the numerically lowest (which we take to be logically highest) MatchingPrecedence. Each MatchingPrecedence value must be ranged in [1,10000]. Note that if the precedence is not specified, it will be set to 1000 as default.
    priorityLevelConfiguration
    PriorityLevelConfigurationReference
    `priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot be resolved, the FlowSchema will be ignored and marked as invalid in its status. Required.
    rules
    PolicyRulesWithSubjects array
    `rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if at least one member of rules matches the request. if it is an empty slice, there will be no requests matching the FlowSchema.
    +

    FlowSchemaStatus v1beta1 flowcontrol

    + + + + + + +
    FieldDescription
    conditions
    FlowSchemaCondition array
    `conditions` is a list of the current states of FlowSchema.
    +

    FlowSchemaList v1beta1 flowcontrol

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    FlowSchema array
    `items` is a list of FlowSchemas.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    `metadata` is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a FlowSchema

    +

    HTTP Request

    +POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    FlowSchema
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    201
    FlowSchema
    Created
    202
    FlowSchema
    Accepted
    +

    Patch

    +

    partially update the specified FlowSchema

    +

    HTTP Request

    +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    201
    FlowSchema
    Created
    +

    Replace

    +

    replace the specified FlowSchema

    +

    HTTP Request

    +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    FlowSchema
    +

    Response

    + + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    201
    FlowSchema
    Created
    +

    Delete

    +

    delete a FlowSchema

    +

    HTTP Request

    +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of FlowSchema

    +

    HTTP Request

    +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified FlowSchema

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    +

    List

    +

    list or watch objects of kind FlowSchema

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    FlowSchemaList
    OK
    +

    Watch

    +

    watch changes to an object of kind FlowSchema. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/watch/flowschemas/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of FlowSchema. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/watch/flowschemas +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified FlowSchema

    +

    HTTP Request

    +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    201
    FlowSchema
    Created
    +

    Read Status

    +

    read status of the specified FlowSchema

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    +

    Replace Status

    +

    replace status of the specified FlowSchema

    +

    HTTP Request

    +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the FlowSchema
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    FlowSchema
    +

    Response

    + + + + + + +
    CodeDescription
    200
    FlowSchema
    OK
    201
    FlowSchema
    Created
    +

    FlowSchemaCondition v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1FlowSchemaCondition
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    `lastTransitionTime` is the last time the condition transitioned from one status to another.
    message
    string
    `message` is a human-readable message indicating details about last transition.
    reason
    string
    `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
    status
    string
    `status` is the status of the condition. Can be True, False, Unknown. Required.
    type
    string
    `type` is the type of the condition. Required.
    +

    ForZone v1beta1 discovery.k8s.io

    + + + + + +
    GroupVersionKind
    discovery.k8s.iov1beta1ForZone
    +
    Other API versions of this object exist: +v1 +
    + + + + + + +
    FieldDescription
    name
    string
    name represents the name of the zone.
    +

    GroupSubject v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1GroupSubject
    +
    Other API versions of this object exist: +v1beta2 +
    +
    Appears In: + +
    + + + + + +
    FieldDescription
    name
    string
    name is the user group that matches, or "*" to match all user groups. See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some well-known group names. Required.
    +

    HPAScalingPolicy v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2HPAScalingPolicy
    +
    Other API versions of this object exist: +v2 +
    + + + + + + + + +
    FieldDescription
    periodSeconds
    integer
    PeriodSeconds specifies the window of time for which the policy should hold true. PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).
    type
    string
    Type is used to specify the scaling policy.
    value
    integer
    Value contains the amount of change which is permitted by the policy. It must be greater than zero
    +

    HPAScalingRules v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2HPAScalingRules
    +
    Other API versions of this object exist: +v2 +
    + + + + + + + + +
    FieldDescription
    policies
    HPAScalingPolicy array
    policies is a list of potential scaling polices which can be used during scaling. At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
    selectPolicy
    string
    selectPolicy is used to specify which policy should be used. If not set, the default value MaxPolicySelect is used.
    stabilizationWindowSeconds
    integer
    StabilizationWindowSeconds is the number of seconds for which past recommendations should be considered while scaling up or scaling down. StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour). If not set, use the default values: - For scale up: 0 (i.e. no stabilization is done). - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
    +

    HorizontalPodAutoscaler v1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv1HorizontalPodAutoscaler
    +
    Other API versions of this object exist: +v2 +v2beta2 +v2beta1 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    HorizontalPodAutoscalerSpec
    behaviour of autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
    status
    HorizontalPodAutoscalerStatus
    current information about the autoscaler.
    +

    HorizontalPodAutoscalerSpec v1 autoscaling

    + + + + + + + + + +
    FieldDescription
    maxReplicas
    integer
    upper limit for the number of pods that can be set by the autoscaler; cannot be smaller than MinReplicas.
    minReplicas
    integer
    minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available.
    scaleTargetRef
    CrossVersionObjectReference
    reference to scaled resource; horizontal pod autoscaler will learn the current resource consumption and will set the desired number of pods by using its Scale subresource.
    targetCPUUtilizationPercentage
    integer
    target average CPU utilization (represented as a percentage of requested CPU) over all the pods; if not specified the default autoscaling policy will be used.
    +

    HorizontalPodAutoscalerStatus v1 autoscaling

    + + + + + + + + + + +
    FieldDescription
    currentCPUUtilizationPercentage
    integer
    current average CPU utilization over all pods, represented as a percentage of requested CPU, e.g. 70 means that an average pod is using now 70% of its requested CPU.
    currentReplicas
    integer
    current number of replicas of pods managed by this autoscaler.
    desiredReplicas
    integer
    desired number of replicas of pods managed by this autoscaler.
    lastScaleTime
    Time
    last time the HorizontalPodAutoscaler scaled the number of pods; used by the autoscaler to control how often the number of pods is changed.
    observedGeneration
    integer
    most recent generation observed by this autoscaler.
    +

    HorizontalPodAutoscalerList v1 autoscaling

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    HorizontalPodAutoscaler array
    list of horizontal pod autoscaler objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata.
    +

    Write Operations

    +

    Create

    +

    create a HorizontalPodAutoscaler

    +

    HTTP Request

    +POST /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    202
    HorizontalPodAutoscaler
    Accepted
    +

    Patch

    +

    partially update the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PATCH /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Replace

    +

    replace the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PUT /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Delete

    +

    delete a HorizontalPodAutoscaler

    +

    HTTP Request

    +DELETE /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of HorizontalPodAutoscaler

    +

    HTTP Request

    +DELETE /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    +

    List

    +

    list or watch objects of kind HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscalerList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v1/horizontalpodautoscalers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscalerList
    OK
    +

    Watch

    +

    watch changes to an object of kind HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/autoscaling/v1/watch/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/autoscaling/v1/watch/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/autoscaling/v1/watch/horizontalpodautoscalers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PATCH /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Read Status

    +

    read status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    +

    Replace Status

    +

    replace status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PUT /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    HorizontalPodAutoscaler v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2HorizontalPodAutoscaler
    +
    Other API versions of this object exist: +v2 +v1 +v2beta1 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    HorizontalPodAutoscalerSpec
    spec is the specification for the behaviour of the autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
    status
    HorizontalPodAutoscalerStatus
    status is the current information about the autoscaler.
    +

    HorizontalPodAutoscalerSpec v2beta2 autoscaling

    + + + + + + + + + + +
    FieldDescription
    behavior
    HorizontalPodAutoscalerBehavior
    behavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively). If not set, the default HPAScalingRules for scale up and scale down are used.
    maxReplicas
    integer
    maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up. It cannot be less that minReplicas.
    metrics
    MetricSpec array
    metrics contains the specifications for which to use to calculate the desired replica count (the maximum replica count across all metrics will be used). The desired replica count is calculated multiplying the ratio between the target value and the current value by the current number of pods. Ergo, metrics used must decrease as the pod count is increased, and vice-versa. See the individual metric source types for more information about how each type of metric must respond. If not set, the default metric will be set to 80% average CPU utilization.
    minReplicas
    integer
    minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available.
    scaleTargetRef
    CrossVersionObjectReference
    scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics should be collected, as well as to actually change the replica count.
    +

    HorizontalPodAutoscalerStatus v2beta2 autoscaling

    + + + + + + + + + + + +
    FieldDescription
    conditions
    HorizontalPodAutoscalerCondition array
    conditions is the set of conditions required for this autoscaler to scale its target, and indicates whether or not those conditions are met.
    currentMetrics
    MetricStatus array
    currentMetrics is the last read state of the metrics used by this autoscaler.
    currentReplicas
    integer
    currentReplicas is current number of replicas of pods managed by this autoscaler, as last seen by the autoscaler.
    desiredReplicas
    integer
    desiredReplicas is the desired number of replicas of pods managed by this autoscaler, as last calculated by the autoscaler.
    lastScaleTime
    Time
    lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods, used by the autoscaler to control how often the number of pods is changed.
    observedGeneration
    integer
    observedGeneration is the most recent generation observed by this autoscaler.
    +

    HorizontalPodAutoscalerList v2beta2 autoscaling

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    HorizontalPodAutoscaler array
    items is the list of horizontal pod autoscaler objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    metadata is the standard list metadata.
    +

    Write Operations

    +

    Create

    +

    create a HorizontalPodAutoscaler

    +

    HTTP Request

    +POST /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    202
    HorizontalPodAutoscaler
    Accepted
    +

    Patch

    +

    partially update the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PATCH /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Replace

    +

    replace the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PUT /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Delete

    +

    delete a HorizontalPodAutoscaler

    +

    HTTP Request

    +DELETE /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of HorizontalPodAutoscaler

    +

    HTTP Request

    +DELETE /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    +

    List

    +

    list or watch objects of kind HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscalerList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta2/horizontalpodautoscalers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscalerList
    OK
    +

    Watch

    +

    watch changes to an object of kind HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta2/watch/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta2/watch/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta2/watch/horizontalpodautoscalers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PATCH /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Read Status

    +

    read status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    +

    Replace Status

    +

    replace status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PUT /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    HorizontalPodAutoscaler v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1HorizontalPodAutoscaler
    +
    Other API versions of this object exist: +v2 +v1 +v2beta2 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    HorizontalPodAutoscalerSpec
    spec is the specification for the behaviour of the autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.
    status
    HorizontalPodAutoscalerStatus
    status is the current information about the autoscaler.
    +

    HorizontalPodAutoscalerSpec v2beta1 autoscaling

    + + + + + + + + + +
    FieldDescription
    maxReplicas
    integer
    maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up. It cannot be less that minReplicas.
    metrics
    MetricSpec array
    metrics contains the specifications for which to use to calculate the desired replica count (the maximum replica count across all metrics will be used). The desired replica count is calculated multiplying the ratio between the target value and the current value by the current number of pods. Ergo, metrics used must decrease as the pod count is increased, and vice-versa. See the individual metric source types for more information about how each type of metric must respond.
    minReplicas
    integer
    minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available.
    scaleTargetRef
    CrossVersionObjectReference
    scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics should be collected, as well as to actually change the replica count.
    +

    HorizontalPodAutoscalerStatus v2beta1 autoscaling

    + + + + + + + + + + + +
    FieldDescription
    conditions
    HorizontalPodAutoscalerCondition array
    conditions is the set of conditions required for this autoscaler to scale its target, and indicates whether or not those conditions are met.
    currentMetrics
    MetricStatus array
    currentMetrics is the last read state of the metrics used by this autoscaler.
    currentReplicas
    integer
    currentReplicas is current number of replicas of pods managed by this autoscaler, as last seen by the autoscaler.
    desiredReplicas
    integer
    desiredReplicas is the desired number of replicas of pods managed by this autoscaler, as last calculated by the autoscaler.
    lastScaleTime
    Time
    lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods, used by the autoscaler to control how often the number of pods is changed.
    observedGeneration
    integer
    observedGeneration is the most recent generation observed by this autoscaler.
    +

    HorizontalPodAutoscalerList v2beta1 autoscaling

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    HorizontalPodAutoscaler array
    items is the list of horizontal pod autoscaler objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    metadata is the standard list metadata.
    +

    Write Operations

    +

    Create

    +

    create a HorizontalPodAutoscaler

    +

    HTTP Request

    +POST /apis/autoscaling/v2beta1/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    202
    HorizontalPodAutoscaler
    Accepted
    +

    Patch

    +

    partially update the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PATCH /apis/autoscaling/v2beta1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Replace

    +

    replace the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PUT /apis/autoscaling/v2beta1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Delete

    +

    delete a HorizontalPodAutoscaler

    +

    HTTP Request

    +DELETE /apis/autoscaling/v2beta1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of HorizontalPodAutoscaler

    +

    HTTP Request

    +DELETE /apis/autoscaling/v2beta1/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta1/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    +

    List

    +

    list or watch objects of kind HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta1/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscalerList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta1/horizontalpodautoscalers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscalerList
    OK
    +

    Watch

    +

    watch changes to an object of kind HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta1/watch/namespaces/{namespace}/horizontalpodautoscalers/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta1/watch/namespaces/{namespace}/horizontalpodautoscalers +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta1/watch/horizontalpodautoscalers +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PATCH /apis/autoscaling/v2beta1/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    Read Status

    +

    read status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +GET /apis/autoscaling/v2beta1/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    +

    Replace Status

    +

    replace status of the specified HorizontalPodAutoscaler

    +

    HTTP Request

    +PUT /apis/autoscaling/v2beta1/namespaces/{namespace}/horizontalpodautoscalers/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the HorizontalPodAutoscaler
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    HorizontalPodAutoscaler
    +

    Response

    + + + + + + +
    CodeDescription
    200
    HorizontalPodAutoscaler
    OK
    201
    HorizontalPodAutoscaler
    Created
    +

    HorizontalPodAutoscalerBehavior v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2HorizontalPodAutoscalerBehavior
    +
    Other API versions of this object exist: +v2 +
    + + + + + + + +
    FieldDescription
    scaleDown
    HPAScalingRules
    scaleDown is scaling policy for scaling Down. If not set, the default value is to allow to scale down to minReplicas pods, with a 300 second stabilization window (i.e., the highest recommendation for the last 300sec is used).
    scaleUp
    HPAScalingRules
    scaleUp is scaling policy for scaling Up. If not set, the default value is the higher of: * increase no more than 4 pods per 60 seconds * double the number of pods per 60 seconds No stabilization is used.
    +

    HorizontalPodAutoscalerCondition v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2HorizontalPodAutoscalerCondition
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    lastTransitionTime is the last time the condition transitioned from one status to another
    message
    string
    message is a human-readable explanation containing details about the transition
    reason
    string
    reason is the reason for the condition's last transition.
    status
    string
    status is the status of the condition (True, False, Unknown)
    type
    string
    type describes the current condition
    +

    HorizontalPodAutoscalerCondition v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1HorizontalPodAutoscalerCondition
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    lastTransitionTime is the last time the condition transitioned from one status to another
    message
    string
    message is a human-readable explanation containing details about the transition
    reason
    string
    reason is the reason for the condition's last transition.
    status
    string
    status is the status of the condition (True, False, Unknown)
    type
    string
    type describes the current condition
    +

    JobTemplateSpec v1beta1 batch

    + + + + + +
    GroupVersionKind
    batchv1beta1JobTemplateSpec
    +
    Other API versions of this object exist: +v1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    metadata
    ObjectMeta
    Standard object's metadata of the jobs created from this template. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    JobSpec
    Specification of the desired behavior of the job. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    LimitResponse v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1LimitResponse
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + +
    FieldDescription
    queuing
    QueuingConfiguration
    `queuing` holds the configuration parameters for queuing. This field may be non-empty only if `type` is `"Queue"`.
    type
    string
    `type` is "Queue" or "Reject". "Queue" means that requests that can not be executed upon arrival are held in a queue until they can be executed or a queuing limit is reached. "Reject" means that requests that can not be executed upon arrival are rejected. Required.
    +

    LimitedPriorityLevelConfiguration v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1LimitedPriorityLevelConfiguration
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + +
    FieldDescription
    assuredConcurrencyShares
    integer
    `assuredConcurrencyShares` (ACS) configures the execution limit, which is a limit on the number of requests of this priority level that may be exeucting at a given time. ACS must be a positive number. The server's concurrency limit (SCL) is divided among the concurrency-controlled priority levels in proportion to their assured concurrency shares. This produces the assured concurrency value (ACV) --- the number of requests that may be executing at a time --- for each such priority level: ACV(l) = ceil( SCL * ACS(l) / ( sum[priority levels k] ACS(k) ) ) bigger numbers of ACS mean more reserved concurrent requests (at the expense of every other PL). This field has a default value of 30.
    limitResponse
    LimitResponse
    `limitResponse` indicates what to do with requests that can not be executed right now
    +

    MetricIdentifier v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2MetricIdentifier
    +
    Other API versions of this object exist: +v2 +
    + + + + + + + +
    FieldDescription
    name
    string
    name is the name of the given metric
    selector
    LabelSelector
    selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.
    +

    MetricSpec v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2MetricSpec
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + + + + + +
    FieldDescription
    containerResource
    ContainerResourceMetricSource
    container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod of the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. This is an alpha feature and can be enabled by the HPAContainerMetrics feature flag.
    external
    ExternalMetricSource
    external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).
    object
    ObjectMetricSource
    object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).
    pods
    PodsMetricSource
    pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.
    resource
    ResourceMetricSource
    resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
    type
    string
    type is the type of metric source. It should be one of "ContainerResource", "External", "Object", "Pods" or "Resource", each mapping to a matching field in the object. Note: "ContainerResource" type is available on when the feature-gate HPAContainerMetrics is enabled
    +

    MetricSpec v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1MetricSpec
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + + + + +
    FieldDescription
    containerResource
    ContainerResourceMetricSource
    container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod of the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. This is an alpha feature and can be enabled by the HPAContainerMetrics feature flag.
    external
    ExternalMetricSource
    external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).
    object
    ObjectMetricSource
    object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).
    pods
    PodsMetricSource
    pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.
    resource
    ResourceMetricSource
    resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
    type
    string
    type is the type of metric source. It should be one of "ContainerResource", "External", "Object", "Pods" or "Resource", each mapping to a matching field in the object. Note: "ContainerResource" type is available on when the feature-gate HPAContainerMetrics is enabled
    +

    MetricStatus v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2MetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + + + + + +
    FieldDescription
    containerResource
    ContainerResourceMetricStatus
    container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
    external
    ExternalMetricStatus
    external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).
    object
    ObjectMetricStatus
    object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).
    pods
    PodsMetricStatus
    pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.
    resource
    ResourceMetricStatus
    resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
    type
    string
    type is the type of metric source. It will be one of "ContainerResource", "External", "Object", "Pods" or "Resource", each corresponds to a matching field in the object. Note: "ContainerResource" type is available on when the feature-gate HPAContainerMetrics is enabled
    +

    MetricStatus v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1MetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + + + + +
    FieldDescription
    containerResource
    ContainerResourceMetricStatus
    container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
    external
    ExternalMetricStatus
    external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).
    object
    ObjectMetricStatus
    object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).
    pods
    PodsMetricStatus
    pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.
    resource
    ResourceMetricStatus
    resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.
    type
    string
    type is the type of metric source. It will be one of "ContainerResource", "External", "Object", "Pods" or "Resource", each corresponds to a matching field in the object. Note: "ContainerResource" type is available on when the feature-gate HPAContainerMetrics is enabled
    +

    MetricTarget v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2MetricTarget
    +
    Other API versions of this object exist: +v2 +
    + + + + + + + + + +
    FieldDescription
    averageUtilization
    integer
    averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source type
    averageValue
    Quantity
    averageValue is the target value of the average of the metric across all relevant pods (as a quantity)
    type
    string
    type represents whether the metric type is Utilization, Value, or AverageValue
    value
    Quantity
    value is the target value of the metric (as a quantity).
    +

    MetricValueStatus v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2MetricValueStatus
    +
    Other API versions of this object exist: +v2 +
    + + + + + + + + +
    FieldDescription
    averageUtilization
    integer
    currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.
    averageValue
    Quantity
    averageValue is the current value of the average of the metric across all relevant pods (as a quantity)
    value
    Quantity
    value is the current value of the metric (as a quantity).
    +

    NonResourcePolicyRule v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1NonResourcePolicyRule
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + +
    FieldDescription
    nonResourceURLs
    string array
    `nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty. For example: - "/healthz" is legal - "/hea*" is illegal - "/hea" is legal but matches nothing - "/hea/*" also matches nothing - "/healthz/*" matches all per-component health checks. "*" matches all non-resource urls. if it is present, it must be the only entry. Required.
    verbs
    string array
    `verbs` is a list of matching verbs and may not be empty. "*" matches all verbs. If it is present, it must be the only entry. Required.
    +

    ObjectMetricSource v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2ObjectMetricSource
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + + +
    FieldDescription
    describedObject
    CrossVersionObjectReference
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    target
    MetricTarget
    target specifies the target value for the given metric
    +

    ObjectMetricSource v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1ObjectMetricSource
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + + + +
    FieldDescription
    averageValue
    Quantity
    averageValue is the target value of the average of the metric across all relevant pods (as a quantity)
    metricName
    string
    metricName is the name of the metric in question.
    selector
    LabelSelector
    selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping When unset, just the metricName will be used to gather metrics.
    target
    CrossVersionObjectReference
    target is the described Kubernetes object.
    targetValue
    Quantity
    targetValue is the target value of the metric (as a quantity).
    +

    ObjectMetricStatus v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2ObjectMetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + + +
    FieldDescription
    current
    MetricValueStatus
    current contains the current value for the given metric
    describedObject
    CrossVersionObjectReference
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    +

    ObjectMetricStatus v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1ObjectMetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + + + +
    FieldDescription
    averageValue
    Quantity
    averageValue is the current value of the average of the metric across all relevant pods (as a quantity)
    currentValue
    Quantity
    currentValue is the current value of the metric (as a quantity).
    metricName
    string
    metricName is the name of the metric in question.
    selector
    LabelSelector
    selector is the string-encoded form of a standard kubernetes label selector for the given metric When set in the ObjectMetricSource, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.
    target
    CrossVersionObjectReference
    target is the described Kubernetes object.
    +

    Overhead v1beta1 node.k8s.io

    + + + + + +
    GroupVersionKind
    node.k8s.iov1beta1Overhead
    +
    Other API versions of this object exist: +v1 +v1alpha1 +
    +
    Appears In: + +
    + + + + + +
    FieldDescription
    podFixed
    object
    PodFixed represents the fixed resource overhead associated with running a pod.
    +

    Overhead v1alpha1 node.k8s.io

    + + + + + +
    GroupVersionKind
    node.k8s.iov1alpha1Overhead
    +
    Other API versions of this object exist: +v1 +v1beta1 +
    + + + + + + +
    FieldDescription
    podFixed
    object
    PodFixed represents the fixed resource overhead associated with running a pod.
    +

    PodDisruptionBudget v1beta1 policy

    + + + + + +
    GroupVersionKind
    policyv1beta1PodDisruptionBudget
    +
    Other API versions of this object exist: +v1 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    PodDisruptionBudgetSpec
    Specification of the desired behavior of the PodDisruptionBudget.
    status
    PodDisruptionBudgetStatus
    Most recently observed status of the PodDisruptionBudget.
    +

    PodDisruptionBudgetSpec v1beta1 policy

    + + + + + + + + +
    FieldDescription
    maxUnavailableAn eviction is allowed if at most "maxUnavailable" pods selected by "selector" are unavailable after the eviction, i.e. even in absence of the evicted pod. For example, one can prevent all voluntary evictions by specifying 0. This is a mutually exclusive setting with "minAvailable".
    minAvailableAn eviction is allowed if at least "minAvailable" pods selected by "selector" will still be available after the eviction, i.e. even in the absence of the evicted pod. So for example you can prevent all voluntary evictions by specifying "100%".
    selector
    LabelSelector
    patch strategy: replace
    Label query over pods whose evictions are managed by the disruption budget. A null selector selects no pods. An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods. In policy/v1, an empty selector will select all pods in the namespace.
    +

    PodDisruptionBudgetStatus v1beta1 policy

    + + + + + + + + + + + + +
    FieldDescription
    conditions
    Condition array
    patch strategy: merge
    patch merge key: type
    Conditions contain conditions for PDB. The disruption controller sets the DisruptionAllowed condition. The following are known values for the reason field (additional reasons could be added in the future): - SyncFailed: The controller encountered an error and wasn't able to compute the number of allowed disruptions. Therefore no disruptions are allowed and the status of the condition will be False. - InsufficientPods: The number of pods are either at or below the number required by the PodDisruptionBudget. No disruptions are allowed and the status of the condition will be False. - SufficientPods: There are more pods than required by the PodDisruptionBudget. The condition will be True, and the number of allowed disruptions are provided by the disruptionsAllowed property.
    currentHealthy
    integer
    current number of healthy pods
    desiredHealthy
    integer
    minimum desired number of healthy pods
    disruptedPods
    object
    DisruptedPods contains information about pods whose eviction was processed by the API server eviction subresource handler but has not yet been observed by the PodDisruptionBudget controller. A pod will be in this map from the time when the API server processed the eviction request to the time when the pod is seen by PDB controller as having been marked for deletion (or after a timeout). The key in the map is the name of the pod and the value is the time when the API server processed the eviction request. If the deletion didn't occur and a pod is still there it will be removed from the list automatically by PodDisruptionBudget controller after some time. If everything goes smooth this map should be empty for the most of the time. Large number of entries in the map may indicate problems with pod deletions.
    disruptionsAllowed
    integer
    Number of pod disruptions that are currently allowed.
    expectedPods
    integer
    total number of pods counted by this disruption budget
    observedGeneration
    integer
    Most recent generation observed when updating this PDB status. DisruptionsAllowed and other status information is valid only if observedGeneration equals to PDB's object generation.
    +

    PodDisruptionBudgetList v1beta1 policy

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    PodDisruptionBudget array
    items list individual PodDisruptionBudget objects
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a PodDisruptionBudget

    +

    HTTP Request

    +POST /apis/policy/v1beta1/namespaces/{namespace}/poddisruptionbudgets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PodDisruptionBudget
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    201
    PodDisruptionBudget
    Created
    202
    PodDisruptionBudget
    Accepted
    +

    Patch

    +

    partially update the specified PodDisruptionBudget

    +

    HTTP Request

    +PATCH /apis/policy/v1beta1/namespaces/{namespace}/poddisruptionbudgets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    201
    PodDisruptionBudget
    Created
    +

    Replace

    +

    replace the specified PodDisruptionBudget

    +

    HTTP Request

    +PUT /apis/policy/v1beta1/namespaces/{namespace}/poddisruptionbudgets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PodDisruptionBudget
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    201
    PodDisruptionBudget
    Created
    +

    Delete

    +

    delete a PodDisruptionBudget

    +

    HTTP Request

    +DELETE /apis/policy/v1beta1/namespaces/{namespace}/poddisruptionbudgets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of PodDisruptionBudget

    +

    HTTP Request

    +DELETE /apis/policy/v1beta1/namespaces/{namespace}/poddisruptionbudgets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified PodDisruptionBudget

    +

    HTTP Request

    +GET /apis/policy/v1beta1/namespaces/{namespace}/poddisruptionbudgets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    +

    List

    +

    list or watch objects of kind PodDisruptionBudget

    +

    HTTP Request

    +GET /apis/policy/v1beta1/namespaces/{namespace}/poddisruptionbudgets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodDisruptionBudgetList
    OK
    +

    List All Namespaces

    +

    list or watch objects of kind PodDisruptionBudget

    +

    HTTP Request

    +GET /apis/policy/v1beta1/poddisruptionbudgets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodDisruptionBudgetList
    OK
    +

    Watch

    +

    watch changes to an object of kind PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/policy/v1beta1/watch/namespaces/{namespace}/poddisruptionbudgets/{name} +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/policy/v1beta1/watch/namespaces/{namespace}/poddisruptionbudgets +

    Path Parameters

    + + + + + +
    ParameterDescription
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List All Namespaces

    +

    watch individual changes to a list of PodDisruptionBudget. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/policy/v1beta1/watch/poddisruptionbudgets +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified PodDisruptionBudget

    +

    HTTP Request

    +PATCH /apis/policy/v1beta1/namespaces/{namespace}/poddisruptionbudgets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    201
    PodDisruptionBudget
    Created
    +

    Read Status

    +

    read status of the specified PodDisruptionBudget

    +

    HTTP Request

    +GET /apis/policy/v1beta1/namespaces/{namespace}/poddisruptionbudgets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    +

    Replace Status

    +

    replace status of the specified PodDisruptionBudget

    +

    HTTP Request

    +PUT /apis/policy/v1beta1/namespaces/{namespace}/poddisruptionbudgets/{name}/status +

    Path Parameters

    + + + + + + +
    ParameterDescription
    namename of the PodDisruptionBudget
    namespaceobject name and auth scope, such as for teams and projects
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PodDisruptionBudget
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PodDisruptionBudget
    OK
    201
    PodDisruptionBudget
    Created
    +

    PodsMetricSource v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2PodsMetricSource
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + +
    FieldDescription
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    target
    MetricTarget
    target specifies the target value for the given metric
    +

    PodsMetricSource v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1PodsMetricSource
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + +
    FieldDescription
    metricName
    string
    metricName is the name of the metric in question
    selector
    LabelSelector
    selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping When unset, just the metricName will be used to gather metrics.
    targetAverageValue
    Quantity
    targetAverageValue is the target value of the average of the metric across all relevant pods (as a quantity)
    +

    PodsMetricStatus v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2PodsMetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + +
    FieldDescription
    current
    MetricValueStatus
    current contains the current value for the given metric
    metric
    MetricIdentifier
    metric identifies the target metric by name and selector
    +

    PodsMetricStatus v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1PodsMetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + +
    FieldDescription
    currentAverageValue
    Quantity
    currentAverageValue is the current value of the average of the metric across all relevant pods (as a quantity)
    metricName
    string
    metricName is the name of the metric in question
    selector
    LabelSelector
    selector is the string-encoded form of a standard kubernetes label selector for the given metric When set in the PodsMetricSource, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.
    +

    PolicyRulesWithSubjects v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1PolicyRulesWithSubjects
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + + +
    FieldDescription
    nonResourceRules
    NonResourcePolicyRule array
    `nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb and the target non-resource URL.
    resourceRules
    ResourcePolicyRule array
    `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the target resource. At least one of `resourceRules` and `nonResourceRules` has to be non-empty.
    subjects
    Subject array
    subjects is the list of normal user, serviceaccount, or group that this rule cares about. There must be at least one member in this slice. A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request. Required.
    +

    PriorityLevelConfiguration v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1PriorityLevelConfiguration
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    PriorityLevelConfigurationSpec
    `spec` is the specification of the desired behavior of a "request-priority". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    status
    PriorityLevelConfigurationStatus
    `status` is the current status of a "request-priority". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    PriorityLevelConfigurationSpec v1beta1 flowcontrol

    + + + + + + + +
    FieldDescription
    limited
    LimitedPriorityLevelConfiguration
    `limited` specifies how requests are handled for a Limited priority level. This field must be non-empty if and only if `type` is `"Limited"`.
    type
    string
    `type` indicates whether this priority level is subject to limitation on request execution. A value of `"Exempt"` means that requests of this priority level are not subject to a limit (and thus are never queued) and do not detract from the capacity made available to other priority levels. A value of `"Limited"` means that (a) requests of this priority level _are_ subject to limits and (b) some of the server's limited capacity is made available exclusively to this priority level. Required.
    +

    PriorityLevelConfigurationStatus v1beta1 flowcontrol

    + + + + + + +
    FieldDescription
    conditions
    PriorityLevelConfigurationCondition array
    `conditions` is the current state of "request-priority".
    +

    PriorityLevelConfigurationList v1beta1 flowcontrol

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    PriorityLevelConfiguration array
    `items` is a list of request-priorities.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a PriorityLevelConfiguration

    +

    HTTP Request

    +POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PriorityLevelConfiguration
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    201
    PriorityLevelConfiguration
    Created
    202
    PriorityLevelConfiguration
    Accepted
    +

    Patch

    +

    partially update the specified PriorityLevelConfiguration

    +

    HTTP Request

    +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    201
    PriorityLevelConfiguration
    Created
    +

    Replace

    +

    replace the specified PriorityLevelConfiguration

    +

    HTTP Request

    +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PriorityLevelConfiguration
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    201
    PriorityLevelConfiguration
    Created
    +

    Delete

    +

    delete a PriorityLevelConfiguration

    +

    HTTP Request

    +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of PriorityLevelConfiguration

    +

    HTTP Request

    +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified PriorityLevelConfiguration

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    +

    List

    +

    list or watch objects of kind PriorityLevelConfiguration

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PriorityLevelConfigurationList
    OK
    +

    Watch

    +

    watch changes to an object of kind PriorityLevelConfiguration. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/watch/prioritylevelconfigurations/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of PriorityLevelConfiguration. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/watch/prioritylevelconfigurations +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Status Operations

    +

    Patch Status

    +

    partially update status of the specified PriorityLevelConfiguration

    +

    HTTP Request

    +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    201
    PriorityLevelConfiguration
    Created
    +

    Read Status

    +

    read status of the specified PriorityLevelConfiguration

    +

    HTTP Request

    +GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    +

    Replace Status

    +

    replace status of the specified PriorityLevelConfiguration

    +

    HTTP Request

    +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name}/status +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the PriorityLevelConfiguration
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    PriorityLevelConfiguration
    +

    Response

    + + + + + + +
    CodeDescription
    200
    PriorityLevelConfiguration
    OK
    201
    PriorityLevelConfiguration
    Created
    +

    PriorityLevelConfigurationCondition v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1PriorityLevelConfigurationCondition
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + + + + +
    FieldDescription
    lastTransitionTime
    Time
    `lastTransitionTime` is the last time the condition transitioned from one status to another.
    message
    string
    `message` is a human-readable message indicating details about last transition.
    reason
    string
    `reason` is a unique, one-word, CamelCase reason for the condition's last transition.
    status
    string
    `status` is the status of the condition. Can be True, False, Unknown. Required.
    type
    string
    `type` is the type of the condition. Required.
    +

    PriorityLevelConfigurationReference v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1PriorityLevelConfigurationReference
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + +
    FieldDescription
    name
    string
    `name` is the name of the priority level configuration being referenced Required.
    +

    QueuingConfiguration v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1QueuingConfiguration
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + + +
    FieldDescription
    handSize
    integer
    `handSize` is a small positive number that configures the shuffle sharding of requests into queues. When enqueuing a request at this priority level the request's flow identifier (a string pair) is hashed and the hash value is used to shuffle the list of queues and deal a hand of the size specified here. The request is put into one of the shortest queues in that hand. `handSize` must be no larger than `queues`, and should be significantly smaller (so that a few heavy flows do not saturate most of the queues). See the user-facing documentation for more extensive guidance on setting this field. This field has a default value of 8.
    queueLengthLimit
    integer
    `queueLengthLimit` is the maximum number of requests allowed to be waiting in a given queue of this priority level at a time; excess requests are rejected. This value must be positive. If not specified, it will be defaulted to 50.
    queues
    integer
    `queues` is the number of queues for this priority level. The queues exist independently at each apiserver. The value must be positive. Setting it to 1 effectively precludes shufflesharding and thus makes the distinguisher method of associated flow schemas irrelevant. This field has a default value of 64.
    +

    ResourceMetricSource v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2ResourceMetricSource
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + +
    FieldDescription
    name
    string
    name is the name of the resource in question.
    target
    MetricTarget
    target specifies the target value for the given metric
    +

    ResourceMetricSource v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1ResourceMetricSource
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + +
    FieldDescription
    name
    string
    name is the name of the resource in question.
    targetAverageUtilization
    integer
    targetAverageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.
    targetAverageValue
    Quantity
    targetAverageValue is the target value of the average of the resource metric across all relevant pods, as a raw value (instead of as a percentage of the request), similar to the "pods" metric source type.
    +

    ResourceMetricStatus v2beta2 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta2ResourceMetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta1 +
    + + + + + + + +
    FieldDescription
    current
    MetricValueStatus
    current contains the current value for the given metric
    name
    string
    Name is the name of the resource in question.
    +

    ResourceMetricStatus v2beta1 autoscaling

    + + + + + +
    GroupVersionKind
    autoscalingv2beta1ResourceMetricStatus
    +
    Other API versions of this object exist: +v2 +v2beta2 +
    + + + + + + + + +
    FieldDescription
    currentAverageUtilization
    integer
    currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. It will only be present if `targetAverageValue` was set in the corresponding metric specification.
    currentAverageValue
    Quantity
    currentAverageValue is the current value of the average of the resource metric across all relevant pods, as a raw value (instead of as a percentage of the request), similar to the "pods" metric source type. It will always be set, regardless of the corresponding metric specification.
    name
    string
    name is the name of the resource in question.
    +

    ResourcePolicyRule v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1ResourcePolicyRule
    +
    Other API versions of this object exist: +v1beta2 +
    + + + + + + + + + + +
    FieldDescription
    apiGroups
    string array
    `apiGroups` is a list of matching API groups and may not be empty. "*" matches all API groups and, if present, must be the only entry. Required.
    clusterScope
    boolean
    `clusterScope` indicates whether to match requests that do not specify a namespace (which happens either because the resource is not namespaced or the request targets all namespaces). If this field is omitted or false then the `namespaces` field must contain a non-empty list.
    namespaces
    string array
    `namespaces` is a list of target namespaces that restricts matches. A request that specifies a target namespace matches only if either (a) this list contains that target namespace or (b) this list contains "*". Note that "*" matches any specified namespace but does not match a request that _does not specify_ a namespace (see the `clusterScope` field for that). This list may be empty, but only if `clusterScope` is true.
    resources
    string array
    `resources` is a list of matching resources (i.e., lowercase and plural) with, if desired, subresource. For example, [ "services", "nodes/status" ]. This list may not be empty. "*" matches all resources and, if present, must be the only entry. Required.
    verbs
    string array
    `verbs` is a list of matching verbs and may not be empty. "*" matches all verbs and, if present, must be the only entry. Required.
    +

    RuntimeClass v1beta1 node.k8s.io

    + + + + + +
    GroupVersionKind
    node.k8s.iov1beta1RuntimeClass
    +
    Other API versions of this object exist: +v1 +v1alpha1 +
    +
    Appears In: + +
    + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    handler
    string
    Handler specifies the underlying runtime and configuration that the CRI implementation will use to handle pods of this class. The possible values are specific to the node & CRI configuration. It is assumed that all handlers are available on every node, and handlers of the same name are equivalent on every node. For example, a handler called "runc" might specify that the runc OCI runtime (using native Linux containers) will be used to run the containers in a pod. The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements, and is immutable.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    overhead
    Overhead
    Overhead represents the resource overhead associated with running a pod for a given RuntimeClass. For more details, see https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md This field is beta-level as of Kubernetes v1.18, and is only honored by servers that enable the PodOverhead feature.
    scheduling
    Scheduling
    Scheduling holds the scheduling constraints to ensure that pods running with this RuntimeClass are scheduled to nodes that support it. If scheduling is nil, this RuntimeClass is assumed to be supported by all nodes.
    +

    RuntimeClassList v1beta1 node

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    RuntimeClass array
    Items is a list of schema objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a RuntimeClass

    +

    HTTP Request

    +POST /apis/node.k8s.io/v1beta1/runtimeclasses +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    RuntimeClass
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    201
    RuntimeClass
    Created
    202
    RuntimeClass
    Accepted
    +

    Patch

    +

    partially update the specified RuntimeClass

    +

    HTTP Request

    +PATCH /apis/node.k8s.io/v1beta1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    201
    RuntimeClass
    Created
    +

    Replace

    +

    replace the specified RuntimeClass

    +

    HTTP Request

    +PUT /apis/node.k8s.io/v1beta1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    RuntimeClass
    +

    Response

    + + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    201
    RuntimeClass
    Created
    +

    Delete

    +

    delete a RuntimeClass

    +

    HTTP Request

    +DELETE /apis/node.k8s.io/v1beta1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of RuntimeClass

    +

    HTTP Request

    +DELETE /apis/node.k8s.io/v1beta1/runtimeclasses +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified RuntimeClass

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1beta1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    +

    List

    +

    list or watch objects of kind RuntimeClass

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1beta1/runtimeclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RuntimeClassList
    OK
    +

    Watch

    +

    watch changes to an object of kind RuntimeClass. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1beta1/watch/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of RuntimeClass. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1beta1/watch/runtimeclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    RuntimeClass v1alpha1 node.k8s.io

    + + + + + +
    GroupVersionKind
    node.k8s.iov1alpha1RuntimeClass
    +
    Other API versions of this object exist: +v1 +v1beta1 +
    + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ObjectMeta
    More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    spec
    RuntimeClassSpec
    Specification of the RuntimeClass More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    +

    RuntimeClassSpec v1alpha1 node

    +
    Appears In: + +
    + + + + + + + +
    FieldDescription
    overhead
    Overhead
    Overhead represents the resource overhead associated with running a pod for a given RuntimeClass. For more details, see https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md This field is beta-level as of Kubernetes v1.18, and is only honored by servers that enable the PodOverhead feature.
    runtimeHandler
    string
    RuntimeHandler specifies the underlying runtime and configuration that the CRI implementation will use to handle pods of this class. The possible values are specific to the node & CRI configuration. It is assumed that all handlers are available on every node, and handlers of the same name are equivalent on every node. For example, a handler called "runc" might specify that the runc OCI runtime (using native Linux containers) will be used to run the containers in a pod. The RuntimeHandler must be lowercase, conform to the DNS Label (RFC 1123) requirements, and is immutable.
    scheduling
    Scheduling
    Scheduling holds the scheduling constraints to ensure that pods running with this RuntimeClass are scheduled to nodes that support it. If scheduling is nil, this RuntimeClass is assumed to be supported by all nodes.
    +

    RuntimeClassList v1alpha1 node

    + + + + + + + + +
    FieldDescription
    apiVersion
    string
    APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
    items
    RuntimeClass array
    Items is a list of schema objects.
    kind
    string
    Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
    metadata
    ListMeta
    Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    +

    Write Operations

    +

    Create

    +

    create a RuntimeClass

    +

    HTTP Request

    +POST /apis/node.k8s.io/v1alpha1/runtimeclasses +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    RuntimeClass
    +

    Response

    + + + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    201
    RuntimeClass
    Created
    202
    RuntimeClass
    Accepted
    +

    Patch

    +

    partially update the specified RuntimeClass

    +

    HTTP Request

    +PATCH /apis/node.k8s.io/v1alpha1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    forceForce is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    Patch
    +

    Response

    + + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    201
    RuntimeClass
    Created
    +

    Replace

    +

    replace the specified RuntimeClass

    +

    HTTP Request

    +PUT /apis/node.k8s.io/v1alpha1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldManagerfieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.
    fieldValidationfieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    RuntimeClass
    +

    Response

    + + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    201
    RuntimeClass
    Created
    +

    Delete

    +

    delete a RuntimeClass

    +

    HTTP Request

    +DELETE /apis/node.k8s.io/v1alpha1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + + +
    CodeDescription
    200
    Status
    OK
    202
    Status
    Accepted
    +

    Delete Collection

    +

    delete collection of RuntimeClass

    +

    HTTP Request

    +DELETE /apis/node.k8s.io/v1alpha1/runtimeclasses +

    Query Parameters

    + + + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    dryRunWhen present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    gracePeriodSecondsThe duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    orphanDependentsDeprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the "orphan" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.
    propagationPolicyWhether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    +

    Body Parameters

    + + + + + +
    ParameterDescription
    body
    DeleteOptions
    +

    Response

    + + + + + +
    CodeDescription
    200
    Status
    OK
    +

    Read Operations

    +

    Read

    +

    read the specified RuntimeClass

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1alpha1/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RuntimeClass
    OK
    +

    List

    +

    list or watch objects of kind RuntimeClass

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1alpha1/runtimeclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    prettyIf 'true', then the output is pretty printed.
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    RuntimeClassList
    OK
    +

    Watch

    +

    watch changes to an object of kind RuntimeClass. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1alpha1/watch/runtimeclasses/{name} +

    Path Parameters

    + + + + + +
    ParameterDescription
    namename of the RuntimeClass
    +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Watch List

    +

    watch individual changes to a list of RuntimeClass. deprecated: use the 'watch' parameter with a list operation instead.

    +

    HTTP Request

    +GET /apis/node.k8s.io/v1alpha1/watch/runtimeclasses +

    Query Parameters

    + + + + + + + + + + + + + + +
    ParameterDescription
    allowWatchBookmarksallowWatchBookmarks requests watch events with type "BOOKMARK". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.
    continueThe continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the "next key". This field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.
    fieldSelectorA selector to restrict the list of returned objects by their fields. Defaults to everything.
    labelSelectorA selector to restrict the list of returned objects by their labels. Defaults to everything.
    limitlimit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true. The server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.
    prettyIf 'true', then the output is pretty printed.
    resourceVersionresourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    resourceVersionMatchresourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details. Defaults to unset
    timeoutSecondsTimeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.
    watchWatch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.
    +

    Response

    + + + + + +
    CodeDescription
    200
    WatchEvent
    OK
    +

    Scheduling v1beta1 node.k8s.io

    + + + + + +
    GroupVersionKind
    node.k8s.iov1beta1Scheduling
    +
    Other API versions of this object exist: +v1 +v1alpha1 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    nodeSelector
    object
    nodeSelector lists labels that must be present on nodes that support this RuntimeClass. Pods using this RuntimeClass can only be scheduled to a node matched by this selector. The RuntimeClass nodeSelector is merged with a pod's existing nodeSelector. Any conflicts will cause the pod to be rejected in admission.
    tolerations
    Toleration array
    tolerations are appended (excluding duplicates) to pods running with this RuntimeClass during admission, effectively unioning the set of nodes tolerated by the pod and the RuntimeClass.
    +

    Scheduling v1alpha1 node.k8s.io

    + + + + + +
    GroupVersionKind
    node.k8s.iov1alpha1Scheduling
    +
    Other API versions of this object exist: +v1 +v1beta1 +
    + + + + + + + +
    FieldDescription
    nodeSelector
    object
    nodeSelector lists labels that must be present on nodes that support this RuntimeClass. Pods using this RuntimeClass can only be scheduled to a node matched by this selector. The RuntimeClass nodeSelector is merged with a pod's existing nodeSelector. Any conflicts will cause the pod to be rejected in admission.
    tolerations
    Toleration array
    tolerations are appended (excluding duplicates) to pods running with this RuntimeClass during admission, effectively unioning the set of nodes tolerated by the pod and the RuntimeClass.
    +

    ServiceAccountSubject v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1ServiceAccountSubject
    +
    Other API versions of this object exist: +v1beta2 +
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    name
    string
    `name` is the name of matching ServiceAccount objects, or "*" to match regardless of name. Required.
    namespace
    string
    `namespace` is the namespace of matching ServiceAccount objects. Required.
    +

    ServiceReference v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1ServiceReference
    + + + + + + + + + +
    FieldDescription
    name
    string
    name is the name of the service. Required
    namespace
    string
    namespace is the namespace of the service. Required
    path
    string
    path is an optional URL path at which the webhook will be contacted.
    port
    integer
    port is an optional service port at which the webhook will be contacted. `port` should be a valid port number (1-65535, inclusive). Defaults to 443 for backward compatibility.
    +

    ServiceReference v1 apiregistration.k8s.io

    + + + + + +
    GroupVersionKind
    apiregistration.k8s.iov1ServiceReference
    + + + + + + + + +
    FieldDescription
    name
    string
    Name is the name of the service
    namespace
    string
    Namespace is the namespace of the service
    port
    integer
    If specified, the port on the service that hosting webhook. Default to 443 for backward compatibility. `port` should be a valid port number (1-65535, inclusive).
    +

    Subject v1 rbac.authorization.k8s.io

    + + + + + +
    GroupVersionKind
    rbac.authorization.k8s.iov1Subject
    +
    Other API versions of this object exist: +v1beta2 +v1beta1 +
    + + + + + + + + + +
    FieldDescription
    apiGroup
    string
    APIGroup holds the API group of the referenced subject. Defaults to "" for ServiceAccount subjects. Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
    kind
    string
    Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount". If the Authorizer does not recognized the kind value, the Authorizer should report an error.
    name
    string
    Name of the object being referenced.
    namespace
    string
    Namespace of the referenced object. If the object kind is non-namespace, such as "User" or "Group", and this value is not empty the Authorizer should report an error.
    +

    Subject v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1Subject
    +
    Other API versions of this object exist: +v1beta2 +v1 +
    + + + + + + + + + +
    FieldDescription
    group
    GroupSubject
    `group` matches based on user group name.
    kind
    string
    `kind` indicates which one of the other fields is non-empty. Required
    serviceAccount
    ServiceAccountSubject
    `serviceAccount` matches ServiceAccounts.
    user
    UserSubject
    `user` matches based on username.
    +

    TokenRequest v1 storage.k8s.io

    + + + + + +
    GroupVersionKind
    storage.k8s.iov1TokenRequest
    +
    Appears In: + +
    + + + + + + +
    FieldDescription
    audience
    string
    Audience is the intended audience of the token in "TokenRequestSpec". It will default to the audiences of kube apiserver.
    expirationSeconds
    integer
    ExpirationSeconds is the duration of validity of the token in "TokenRequestSpec". It has the same default value of "ExpirationSeconds" in "TokenRequestSpec".
    +

    UserSubject v1beta1 flowcontrol.apiserver.k8s.io

    + + + + + +
    GroupVersionKind
    flowcontrol.apiserver.k8s.iov1beta1UserSubject
    +
    Other API versions of this object exist: +v1beta2 +
    +
    Appears In: + +
    + + + + + +
    FieldDescription
    name
    string
    `name` is the username that matches, or "*" to match all usernames. Required.
    +

    WebhookClientConfig v1 apiextensions.k8s.io

    + + + + + +
    GroupVersionKind
    apiextensions.k8s.iov1WebhookClientConfig
    + + + + + + + + +
    FieldDescription
    caBundle
    string
    caBundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate. If unspecified, system trust roots on the apiserver are used.
    service
    ServiceReference
    service is a reference to the service for this webhook. Either service or url must be specified. If the webhook is running within the cluster, then you should use `service`.
    url
    string
    url gives the location of the webhook, in standard URL form (`scheme://host:port/path`). Exactly one of `url` or `service` must be specified. The `host` should not refer to a service running in the cluster; use the `service` field instead. The host might be resolved via external DNS in some apiservers (e.g., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address. Please note that using `localhost` or `127.0.0.1` as a `host` is risky unless you take great care to run this webhook on all hosts which run an apiserver which might need to make calls to this webhook. Such installs are likely to be non-portable, i.e., not easy to turn up in a new cluster. The scheme must be "https"; the URL must begin with "https://". A path is optional, and if present may be any string permissible in a URL. You may use the path to pass an arbitrary string to the webhook, for example, a cluster identifier. Attempting to use a user or basic auth e.g. "user:password@" is not allowed. Fragments ("#...") and query parameters ("?...") are not allowed, either.
    + +
    +
    +
    + + + + + + + diff --git a/static/docs/reference/generated/kubernetes-api/v1.23/js/navData.js b/static/docs/reference/generated/kubernetes-api/v1.23/js/navData.js new file mode 100644 index 0000000000..3f54c376ef --- /dev/null +++ b/static/docs/reference/generated/kubernetes-api/v1.23/js/navData.js @@ -0,0 +1 @@ +(function(){navData={"toc":[{"section":"webhookclientconfig-v1-apiextensions-k8s-io","subsections":[]},{"section":"usersubject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"tokenrequest-v1-storage-k8s-io","subsections":[]},{"section":"subject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"subject-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"servicereference-v1-apiregistration-k8s-io","subsections":[]},{"section":"servicereference-v1-apiextensions-k8s-io","subsections":[]},{"section":"serviceaccountsubject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"scheduling-v1alpha1-node-k8s-io","subsections":[]},{"section":"scheduling-v1beta1-node-k8s-io","subsections":[]},{"section":"runtimeclass-v1alpha1-node-k8s-io","subsections":[{"section":"-strong-read-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","subsections":[{"section":"watch-list-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"watch-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"list-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"read-runtimeclass-v1alpha1-node-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","subsections":[{"section":"delete-collection-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"delete-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"replace-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"patch-runtimeclass-v1alpha1-node-k8s-io","subsections":[]},{"section":"create-runtimeclass-v1alpha1-node-k8s-io","subsections":[]}]}]},{"section":"runtimeclass-v1beta1-node-k8s-io","subsections":[{"section":"-strong-read-operations-runtimeclass-v1beta1-node-k8s-io-strong-","subsections":[{"section":"watch-list-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"watch-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"list-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"read-runtimeclass-v1beta1-node-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-runtimeclass-v1beta1-node-k8s-io-strong-","subsections":[{"section":"delete-collection-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"delete-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"replace-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"patch-runtimeclass-v1beta1-node-k8s-io","subsections":[]},{"section":"create-runtimeclass-v1beta1-node-k8s-io","subsections":[]}]}]},{"section":"resourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"resourcemetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"resourcemetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"resourcemetricsource-v2beta1-autoscaling","subsections":[]},{"section":"resourcemetricsource-v2beta2-autoscaling","subsections":[]},{"section":"queuingconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"prioritylevelconfigurationreference-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"prioritylevelconfigurationcondition-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"watch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"delete-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"replace-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"create-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]}]},{"section":"policyruleswithsubjects-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"podsmetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"podsmetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"podsmetricsource-v2beta1-autoscaling","subsections":[]},{"section":"podsmetricsource-v2beta2-autoscaling","subsections":[]},{"section":"poddisruptionbudget-v1beta1-policy","subsections":[{"section":"-strong-status-operations-poddisruptionbudget-v1beta1-policy-strong-","subsections":[{"section":"replace-status-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"read-status-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"patch-status-poddisruptionbudget-v1beta1-policy","subsections":[]}]},{"section":"-strong-read-operations-poddisruptionbudget-v1beta1-policy-strong-","subsections":[{"section":"watch-list-all-namespaces-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"watch-list-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"watch-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"list-all-namespaces-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"list-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"read-poddisruptionbudget-v1beta1-policy","subsections":[]}]},{"section":"-strong-write-operations-poddisruptionbudget-v1beta1-policy-strong-","subsections":[{"section":"delete-collection-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"delete-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"replace-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"patch-poddisruptionbudget-v1beta1-policy","subsections":[]},{"section":"create-poddisruptionbudget-v1beta1-policy","subsections":[]}]}]},{"section":"overhead-v1alpha1-node-k8s-io","subsections":[]},{"section":"overhead-v1beta1-node-k8s-io","subsections":[]},{"section":"objectmetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"objectmetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"objectmetricsource-v2beta1-autoscaling","subsections":[]},{"section":"objectmetricsource-v2beta2-autoscaling","subsections":[]},{"section":"nonresourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"metricvaluestatus-v2beta2-autoscaling","subsections":[]},{"section":"metrictarget-v2beta2-autoscaling","subsections":[]},{"section":"metricstatus-v2beta1-autoscaling","subsections":[]},{"section":"metricstatus-v2beta2-autoscaling","subsections":[]},{"section":"metricspec-v2beta1-autoscaling","subsections":[]},{"section":"metricspec-v2beta2-autoscaling","subsections":[]},{"section":"metricidentifier-v2beta2-autoscaling","subsections":[]},{"section":"limitedprioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"limitresponse-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"jobtemplatespec-v1beta1-batch","subsections":[]},{"section":"horizontalpodautoscalercondition-v2beta1-autoscaling","subsections":[]},{"section":"horizontalpodautoscalercondition-v2beta2-autoscaling","subsections":[]},{"section":"horizontalpodautoscalerbehavior-v2beta2-autoscaling","subsections":[]},{"section":"horizontalpodautoscaler-v2beta1-autoscaling","subsections":[{"section":"-strong-status-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","subsections":[{"section":"replace-status-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"read-status-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"patch-status-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]}]},{"section":"-strong-read-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","subsections":[{"section":"watch-list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"watch-list-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"watch-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"list-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"read-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]}]},{"section":"-strong-write-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","subsections":[{"section":"delete-collection-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"delete-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"replace-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"patch-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]},{"section":"create-horizontalpodautoscaler-v2beta1-autoscaling","subsections":[]}]}]},{"section":"horizontalpodautoscaler-v2beta2-autoscaling","subsections":[{"section":"-strong-status-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","subsections":[{"section":"replace-status-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"read-status-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"patch-status-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]}]},{"section":"-strong-read-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","subsections":[{"section":"watch-list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"watch-list-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"watch-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"list-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"read-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]}]},{"section":"-strong-write-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","subsections":[{"section":"delete-collection-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"delete-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"replace-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"patch-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]},{"section":"create-horizontalpodautoscaler-v2beta2-autoscaling","subsections":[]}]}]},{"section":"horizontalpodautoscaler-v1-autoscaling","subsections":[{"section":"-strong-status-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"replace-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"read-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"patch-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]},{"section":"-strong-read-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"watch-list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"watch-list-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"watch-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"list-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"read-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]},{"section":"-strong-write-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"delete-collection-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"delete-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"replace-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"patch-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"create-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]}]},{"section":"hpascalingrules-v2beta2-autoscaling","subsections":[]},{"section":"hpascalingpolicy-v2beta2-autoscaling","subsections":[]},{"section":"groupsubject-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"forzone-v1beta1-discovery-k8s-io","subsections":[]},{"section":"flowschemacondition-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"watch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"delete-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"replace-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"create-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]}]},{"section":"flowdistinguishermethod-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"externalmetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"externalmetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"externalmetricsource-v2beta1-autoscaling","subsections":[]},{"section":"externalmetricsource-v2beta2-autoscaling","subsections":[]},{"section":"eventseries-v1beta1-events-k8s-io","subsections":[]},{"section":"eventseries-v1-core","subsections":[]},{"section":"event-v1beta1-events-k8s-io","subsections":[{"section":"-strong-read-operations-event-v1beta1-events-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-event-v1beta1-events-k8s-io","subsections":[]},{"section":"watch-list-event-v1beta1-events-k8s-io","subsections":[]},{"section":"watch-event-v1beta1-events-k8s-io","subsections":[]},{"section":"list-all-namespaces-event-v1beta1-events-k8s-io","subsections":[]},{"section":"list-event-v1beta1-events-k8s-io","subsections":[]},{"section":"read-event-v1beta1-events-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-event-v1beta1-events-k8s-io-strong-","subsections":[{"section":"delete-collection-event-v1beta1-events-k8s-io","subsections":[]},{"section":"delete-event-v1beta1-events-k8s-io","subsections":[]},{"section":"replace-event-v1beta1-events-k8s-io","subsections":[]},{"section":"patch-event-v1beta1-events-k8s-io","subsections":[]},{"section":"create-event-v1beta1-events-k8s-io","subsections":[]}]}]},{"section":"event-v1-core","subsections":[{"section":"-strong-read-operations-event-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-event-v1-core","subsections":[]},{"section":"watch-list-event-v1-core","subsections":[]},{"section":"watch-event-v1-core","subsections":[]},{"section":"list-all-namespaces-event-v1-core","subsections":[]},{"section":"list-event-v1-core","subsections":[]},{"section":"read-event-v1-core","subsections":[]}]},{"section":"-strong-write-operations-event-v1-core-strong-","subsections":[{"section":"delete-collection-event-v1-core","subsections":[]},{"section":"delete-event-v1-core","subsections":[]},{"section":"replace-event-v1-core","subsections":[]},{"section":"patch-event-v1-core","subsections":[]},{"section":"create-event-v1-core","subsections":[]}]}]},{"section":"endpointslice-v1beta1-discovery-k8s-io","subsections":[{"section":"-strong-read-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"watch-list-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"watch-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"list-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"read-endpointslice-v1beta1-discovery-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","subsections":[{"section":"delete-collection-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"delete-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"replace-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"patch-endpointslice-v1beta1-discovery-k8s-io","subsections":[]},{"section":"create-endpointslice-v1beta1-discovery-k8s-io","subsections":[]}]}]},{"section":"endpointport-v1beta1-discovery-k8s-io","subsections":[]},{"section":"endpointport-v1-discovery-k8s-io","subsections":[]},{"section":"endpointhints-v1beta1-discovery-k8s-io","subsections":[]},{"section":"endpointconditions-v1beta1-discovery-k8s-io","subsections":[]},{"section":"endpoint-v1beta1-discovery-k8s-io","subsections":[]},{"section":"crossversionobjectreference-v2beta1-autoscaling","subsections":[]},{"section":"crossversionobjectreference-v2beta2-autoscaling","subsections":[]},{"section":"crossversionobjectreference-v2-autoscaling","subsections":[]},{"section":"cronjob-v1beta1-batch","subsections":[{"section":"-strong-status-operations-cronjob-v1beta1-batch-strong-","subsections":[{"section":"replace-status-cronjob-v1beta1-batch","subsections":[]},{"section":"read-status-cronjob-v1beta1-batch","subsections":[]},{"section":"patch-status-cronjob-v1beta1-batch","subsections":[]}]},{"section":"-strong-read-operations-cronjob-v1beta1-batch-strong-","subsections":[{"section":"watch-list-all-namespaces-cronjob-v1beta1-batch","subsections":[]},{"section":"watch-list-cronjob-v1beta1-batch","subsections":[]},{"section":"watch-cronjob-v1beta1-batch","subsections":[]},{"section":"list-all-namespaces-cronjob-v1beta1-batch","subsections":[]},{"section":"list-cronjob-v1beta1-batch","subsections":[]},{"section":"read-cronjob-v1beta1-batch","subsections":[]}]},{"section":"-strong-write-operations-cronjob-v1beta1-batch-strong-","subsections":[{"section":"delete-collection-cronjob-v1beta1-batch","subsections":[]},{"section":"delete-cronjob-v1beta1-batch","subsections":[]},{"section":"replace-cronjob-v1beta1-batch","subsections":[]},{"section":"patch-cronjob-v1beta1-batch","subsections":[]},{"section":"create-cronjob-v1beta1-batch","subsections":[]}]}]},{"section":"containerresourcemetricstatus-v2beta1-autoscaling","subsections":[]},{"section":"containerresourcemetricstatus-v2beta2-autoscaling","subsections":[]},{"section":"containerresourcemetricsource-v2beta1-autoscaling","subsections":[]},{"section":"containerresourcemetricsource-v2beta2-autoscaling","subsections":[]},{"section":"csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"watch-list-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"watch-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"list-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"read-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"delete-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"replace-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"patch-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]},{"section":"create-csistoragecapacity-v1alpha1-storage-k8s-io","subsections":[]}]}]},{"section":"-strong-old-api-versions-strong-","subsections":[]},{"section":"windowssecuritycontextoptions-v1-core","subsections":[]},{"section":"weightedpodaffinityterm-v1-core","subsections":[]},{"section":"webhookconversion-v1-apiextensions-k8s-io","subsections":[]},{"section":"webhookclientconfig-v1-admissionregistration-k8s-io","subsections":[]},{"section":"watchevent-v1-meta","subsections":[]},{"section":"vspherevirtualdiskvolumesource-v1-core","subsections":[]},{"section":"volumeprojection-v1-core","subsections":[]},{"section":"volumenoderesources-v1-storage-k8s-io","subsections":[]},{"section":"volumenodeaffinity-v1-core","subsections":[]},{"section":"volumemount-v1-core","subsections":[]},{"section":"volumeerror-v1-storage-k8s-io","subsections":[]},{"section":"volumedevice-v1-core","subsections":[]},{"section":"volumeattachmentsource-v1-storage-k8s-io","subsections":[]},{"section":"validationrule-v1-apiextensions-k8s-io","subsections":[]},{"section":"validatingwebhook-v1-admissionregistration-k8s-io","subsections":[]},{"section":"usersubject-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"userinfo-v1-authentication-k8s-io","subsections":[]},{"section":"uncountedterminatedpods-v1-batch","subsections":[]},{"section":"typedlocalobjectreference-v1-core","subsections":[]},{"section":"topologyspreadconstraint-v1-core","subsections":[]},{"section":"topologyselectorterm-v1-core","subsections":[]},{"section":"topologyselectorlabelrequirement-v1-core","subsections":[]},{"section":"toleration-v1-core","subsections":[]},{"section":"time-v1-meta","subsections":[]},{"section":"taint-v1-core","subsections":[]},{"section":"tcpsocketaction-v1-core","subsections":[]},{"section":"sysctl-v1-core","subsections":[]},{"section":"supplementalgroupsstrategyoptions-v1beta1-policy","subsections":[]},{"section":"subjectrulesreviewstatus-v1-authorization-k8s-io","subsections":[]},{"section":"subject-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"storageversioncondition-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"storageosvolumesource-v1-core","subsections":[]},{"section":"storageospersistentvolumesource-v1-core","subsections":[]},{"section":"statusdetails-v1-meta","subsections":[]},{"section":"statuscause-v1-meta","subsections":[]},{"section":"status-v1-meta","subsections":[]},{"section":"statefulsetupdatestrategy-v1-apps","subsections":[]},{"section":"statefulsetpersistentvolumeclaimretentionpolicy-v1-apps","subsections":[]},{"section":"statefulsetcondition-v1-apps","subsections":[]},{"section":"sessionaffinityconfig-v1-core","subsections":[]},{"section":"servicereference-v1-admissionregistration-k8s-io","subsections":[]},{"section":"serviceport-v1-core","subsections":[]},{"section":"servicebackendport-v1-networking-k8s-io","subsections":[]},{"section":"serviceaccounttokenprojection-v1-core","subsections":[]},{"section":"serviceaccountsubject-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"serverstorageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"serveraddressbyclientcidr-v1-meta","subsections":[]},{"section":"securitycontext-v1-core","subsections":[]},{"section":"secretvolumesource-v1-core","subsections":[]},{"section":"secretreference-v1-core","subsections":[]},{"section":"secretprojection-v1-core","subsections":[]},{"section":"secretkeyselector-v1-core","subsections":[]},{"section":"secretenvsource-v1-core","subsections":[]},{"section":"seccompprofile-v1-core","subsections":[]},{"section":"scopedresourceselectorrequirement-v1-core","subsections":[]},{"section":"scopeselector-v1-core","subsections":[]},{"section":"scheduling-v1-node-k8s-io","subsections":[]},{"section":"scaleiovolumesource-v1-core","subsections":[]},{"section":"scaleiopersistentvolumesource-v1-core","subsections":[]},{"section":"scale-v1-autoscaling","subsections":[]},{"section":"selinuxstrategyoptions-v1beta1-policy","subsections":[]},{"section":"selinuxoptions-v1-core","subsections":[]},{"section":"runtimeclassstrategyoptions-v1beta1-policy","subsections":[]},{"section":"runasuserstrategyoptions-v1beta1-policy","subsections":[]},{"section":"runasgroupstrategyoptions-v1beta1-policy","subsections":[]},{"section":"rulewithoperations-v1-admissionregistration-k8s-io","subsections":[]},{"section":"rollingupdatestatefulsetstrategy-v1-apps","subsections":[]},{"section":"roleref-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"resourcerule-v1-authorization-k8s-io","subsections":[]},{"section":"resourcerequirements-v1-core","subsections":[]},{"section":"resourcepolicyrule-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"resourcemetricstatus-v2-autoscaling","subsections":[]},{"section":"resourcemetricsource-v2-autoscaling","subsections":[]},{"section":"resourcefieldselector-v1-core","subsections":[]},{"section":"resourceattributes-v1-authorization-k8s-io","subsections":[]},{"section":"replicationcontrollercondition-v1-core","subsections":[]},{"section":"replicasetcondition-v1-apps","subsections":[]},{"section":"rbdvolumesource-v1-core","subsections":[]},{"section":"rbdpersistentvolumesource-v1-core","subsections":[]},{"section":"quobytevolumesource-v1-core","subsections":[]},{"section":"queuingconfiguration-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"quantity-resource-core","subsections":[]},{"section":"projectedvolumesource-v1-core","subsections":[]},{"section":"probe-v1-core","subsections":[]},{"section":"prioritylevelconfigurationreference-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"prioritylevelconfigurationcondition-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"prioritylevelconfiguration-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"preferredschedulingterm-v1-core","subsections":[]},{"section":"preconditions-v1-meta","subsections":[]},{"section":"portworxvolumesource-v1-core","subsections":[]},{"section":"portstatus-v1-core","subsections":[]},{"section":"policyruleswithsubjects-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"policyrule-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"podsmetricstatus-v2-autoscaling","subsections":[]},{"section":"podsmetricsource-v2-autoscaling","subsections":[]},{"section":"podsecuritycontext-v1-core","subsections":[]},{"section":"podreadinessgate-v1-core","subsections":[]},{"section":"podos-v1-core","subsections":[]},{"section":"podip-v1-core","subsections":[]},{"section":"poddnsconfigoption-v1-core","subsections":[]},{"section":"poddnsconfig-v1-core","subsections":[]},{"section":"podcondition-v1-core","subsections":[]},{"section":"podantiaffinity-v1-core","subsections":[]},{"section":"podaffinityterm-v1-core","subsections":[]},{"section":"podaffinity-v1-core","subsections":[]},{"section":"photonpersistentdiskvolumesource-v1-core","subsections":[]},{"section":"persistentvolumeclaimvolumesource-v1-core","subsections":[]},{"section":"persistentvolumeclaimtemplate-v1-core","subsections":[]},{"section":"persistentvolumeclaimcondition-v1-core","subsections":[]},{"section":"patch-v1-meta","subsections":[]},{"section":"ownerreference-v1-meta","subsections":[]},{"section":"overhead-v1-node-k8s-io","subsections":[]},{"section":"objectreference-v1-core","subsections":[]},{"section":"objectmetricstatus-v2-autoscaling","subsections":[]},{"section":"objectmetricsource-v2-autoscaling","subsections":[]},{"section":"objectmeta-v1-meta","subsections":[]},{"section":"objectfieldselector-v1-core","subsections":[]},{"section":"nonresourcerule-v1-authorization-k8s-io","subsections":[]},{"section":"nonresourcepolicyrule-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"nonresourceattributes-v1-authorization-k8s-io","subsections":[]},{"section":"nodesysteminfo-v1-core","subsections":[]},{"section":"nodeselectorterm-v1-core","subsections":[]},{"section":"nodeselectorrequirement-v1-core","subsections":[]},{"section":"nodeselector-v1-core","subsections":[]},{"section":"nodedaemonendpoints-v1-core","subsections":[]},{"section":"nodeconfigstatus-v1-core","subsections":[]},{"section":"nodeconfigsource-v1-core","subsections":[]},{"section":"nodecondition-v1-core","subsections":[]},{"section":"nodeaffinity-v1-core","subsections":[]},{"section":"nodeaddress-v1-core","subsections":[]},{"section":"networkpolicyport-v1-networking-k8s-io","subsections":[]},{"section":"networkpolicypeer-v1-networking-k8s-io","subsections":[]},{"section":"networkpolicyingressrule-v1-networking-k8s-io","subsections":[]},{"section":"networkpolicyegressrule-v1-networking-k8s-io","subsections":[]},{"section":"namespacecondition-v1-core","subsections":[]},{"section":"nfsvolumesource-v1-core","subsections":[]},{"section":"mutatingwebhook-v1-admissionregistration-k8s-io","subsections":[]},{"section":"microtime-v1-meta","subsections":[]},{"section":"metricvaluestatus-v2-autoscaling","subsections":[]},{"section":"metrictarget-v2-autoscaling","subsections":[]},{"section":"metricstatus-v2-autoscaling","subsections":[]},{"section":"metricspec-v2-autoscaling","subsections":[]},{"section":"metricidentifier-v2-autoscaling","subsections":[]},{"section":"managedfieldsentry-v1-meta","subsections":[]},{"section":"localvolumesource-v1-core","subsections":[]},{"section":"localobjectreference-v1-core","subsections":[]},{"section":"loadbalancerstatus-v1-core","subsections":[]},{"section":"loadbalanceringress-v1-core","subsections":[]},{"section":"listmeta-v1-meta","subsections":[]},{"section":"limitedprioritylevelconfiguration-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"limitresponse-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"limitrangeitem-v1-core","subsections":[]},{"section":"lifecyclehandler-v1-core","subsections":[]},{"section":"lifecycle-v1-core","subsections":[]},{"section":"labelselectorrequirement-v1-meta","subsections":[]},{"section":"labelselector-v1-meta","subsections":[]},{"section":"keytopath-v1-core","subsections":[]},{"section":"jobtemplatespec-v1-batch","subsections":[]},{"section":"jobcondition-v1-batch","subsections":[]},{"section":"jsonschemapropsorbool-v1-apiextensions-k8s-io","subsections":[]},{"section":"jsonschemapropsorarray-v1-apiextensions-k8s-io","subsections":[]},{"section":"jsonschemaprops-v1-apiextensions-k8s-io","subsections":[]},{"section":"json-v1-apiextensions-k8s-io","subsections":[]},{"section":"ingresstls-v1-networking-k8s-io","subsections":[]},{"section":"ingressservicebackend-v1-networking-k8s-io","subsections":[]},{"section":"ingressrule-v1-networking-k8s-io","subsections":[]},{"section":"ingressclassparametersreference-v1-networking-k8s-io","subsections":[]},{"section":"ingressbackend-v1-networking-k8s-io","subsections":[]},{"section":"iscsivolumesource-v1-core","subsections":[]},{"section":"iscsipersistentvolumesource-v1-core","subsections":[]},{"section":"ipblock-v1-networking-k8s-io","subsections":[]},{"section":"idrange-v1beta1-policy","subsections":[]},{"section":"hostportrange-v1beta1-policy","subsections":[]},{"section":"hostpathvolumesource-v1-core","subsections":[]},{"section":"hostalias-v1-core","subsections":[]},{"section":"horizontalpodautoscalercondition-v2-autoscaling","subsections":[]},{"section":"horizontalpodautoscalerbehavior-v2-autoscaling","subsections":[]},{"section":"horizontalpodautoscaler-v2-autoscaling","subsections":[]},{"section":"httpingressrulevalue-v1-networking-k8s-io","subsections":[]},{"section":"httpingresspath-v1-networking-k8s-io","subsections":[]},{"section":"httpheader-v1-core","subsections":[]},{"section":"httpgetaction-v1-core","subsections":[]},{"section":"hpascalingrules-v2-autoscaling","subsections":[]},{"section":"hpascalingpolicy-v2-autoscaling","subsections":[]},{"section":"groupversionfordiscovery-v1-meta","subsections":[]},{"section":"groupsubject-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"glusterfsvolumesource-v1-core","subsections":[]},{"section":"glusterfspersistentvolumesource-v1-core","subsections":[]},{"section":"gitrepovolumesource-v1-core","subsections":[]},{"section":"grpcaction-v1-core","subsections":[]},{"section":"gcepersistentdiskvolumesource-v1-core","subsections":[]},{"section":"forzone-v1-discovery-k8s-io","subsections":[]},{"section":"flowschemacondition-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"flowschema-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"flowdistinguishermethod-v1beta2-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"flockervolumesource-v1-core","subsections":[]},{"section":"flexvolumesource-v1-core","subsections":[]},{"section":"flexpersistentvolumesource-v1-core","subsections":[]},{"section":"fieldsv1-v1-meta","subsections":[]},{"section":"fsgroupstrategyoptions-v1beta1-policy","subsections":[]},{"section":"fcvolumesource-v1-core","subsections":[]},{"section":"externalmetricstatus-v2-autoscaling","subsections":[]},{"section":"externalmetricsource-v2-autoscaling","subsections":[]},{"section":"externaldocumentation-v1-apiextensions-k8s-io","subsections":[]},{"section":"execaction-v1-core","subsections":[]},{"section":"eviction-v1-policy","subsections":[]},{"section":"eventsource-v1-core","subsections":[]},{"section":"eventseries-v1-events-k8s-io","subsections":[]},{"section":"ephemeralvolumesource-v1-core","subsections":[]},{"section":"ephemeralcontainer-v1-core","subsections":[]},{"section":"envvarsource-v1-core","subsections":[]},{"section":"envvar-v1-core","subsections":[]},{"section":"envfromsource-v1-core","subsections":[]},{"section":"endpointsubset-v1-core","subsections":[]},{"section":"endpointport-v1-core","subsections":[]},{"section":"endpointhints-v1-discovery-k8s-io","subsections":[]},{"section":"endpointconditions-v1-discovery-k8s-io","subsections":[]},{"section":"endpointaddress-v1-core","subsections":[]},{"section":"endpoint-v1-discovery-k8s-io","subsections":[]},{"section":"emptydirvolumesource-v1-core","subsections":[]},{"section":"downwardapivolumesource-v1-core","subsections":[]},{"section":"downwardapivolumefile-v1-core","subsections":[]},{"section":"downwardapiprojection-v1-core","subsections":[]},{"section":"deploymentcondition-v1-apps","subsections":[]},{"section":"deleteoptions-v1-meta","subsections":[]},{"section":"daemonsetupdatestrategy-v1-apps","subsections":[]},{"section":"daemonsetcondition-v1-apps","subsections":[]},{"section":"daemonendpoint-v1-core","subsections":[]},{"section":"customresourcevalidation-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcesubresources-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcesubresourcestatus-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcesubresourcescale-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcedefinitionversion-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcedefinitionnames-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcedefinitioncondition-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourceconversion-v1-apiextensions-k8s-io","subsections":[]},{"section":"customresourcecolumndefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"crossversionobjectreference-v1-autoscaling","subsections":[]},{"section":"containerstatewaiting-v1-core","subsections":[]},{"section":"containerstateterminated-v1-core","subsections":[]},{"section":"containerstaterunning-v1-core","subsections":[]},{"section":"containerstate-v1-core","subsections":[]},{"section":"containerresourcemetricstatus-v2-autoscaling","subsections":[]},{"section":"containerresourcemetricsource-v2-autoscaling","subsections":[]},{"section":"containerport-v1-core","subsections":[]},{"section":"containerimage-v1-core","subsections":[]},{"section":"configmapvolumesource-v1-core","subsections":[]},{"section":"configmapprojection-v1-core","subsections":[]},{"section":"configmapnodeconfigsource-v1-core","subsections":[]},{"section":"configmapkeyselector-v1-core","subsections":[]},{"section":"configmapenvsource-v1-core","subsections":[]},{"section":"condition-v1-meta","subsections":[]},{"section":"componentcondition-v1-core","subsections":[]},{"section":"clientipconfig-v1-core","subsections":[]},{"section":"cindervolumesource-v1-core","subsections":[]},{"section":"cinderpersistentvolumesource-v1-core","subsections":[]},{"section":"certificatesigningrequestcondition-v1-certificates-k8s-io","subsections":[]},{"section":"cephfsvolumesource-v1-core","subsections":[]},{"section":"cephfspersistentvolumesource-v1-core","subsections":[]},{"section":"capabilities-v1-core","subsections":[]},{"section":"csivolumesource-v1-core","subsections":[]},{"section":"csipersistentvolumesource-v1-core","subsections":[]},{"section":"csinodedriver-v1-storage-k8s-io","subsections":[]},{"section":"boundobjectreference-v1-authentication-k8s-io","subsections":[]},{"section":"azurefilevolumesource-v1-core","subsections":[]},{"section":"azurefilepersistentvolumesource-v1-core","subsections":[]},{"section":"azurediskvolumesource-v1-core","subsections":[]},{"section":"attachedvolume-v1-core","subsections":[]},{"section":"allowedhostpath-v1beta1-policy","subsections":[]},{"section":"allowedflexvolume-v1beta1-policy","subsections":[]},{"section":"allowedcsidriver-v1beta1-policy","subsections":[]},{"section":"aggregationrule-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"affinity-v1-core","subsections":[]},{"section":"awselasticblockstorevolumesource-v1-core","subsections":[]},{"section":"apiversions-v1-meta","subsections":[]},{"section":"apiservicecondition-v1-apiregistration-k8s-io","subsections":[]},{"section":"apiresource-v1-meta","subsections":[]},{"section":"apigroup-v1-meta","subsections":[]},{"section":"-strong-definitions-strong-","subsections":[]},{"section":"networkpolicy-v1-networking-k8s-io","subsections":[{"section":"-strong-read-operations-networkpolicy-v1-networking-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"watch-list-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"watch-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"list-all-namespaces-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"list-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"read-networkpolicy-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-networkpolicy-v1-networking-k8s-io-strong-","subsections":[{"section":"delete-collection-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"delete-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"replace-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"patch-networkpolicy-v1-networking-k8s-io","subsections":[]},{"section":"create-networkpolicy-v1-networking-k8s-io","subsections":[]}]}]},{"section":"tokenreview-v1-authentication-k8s-io","subsections":[{"section":"-strong-write-operations-tokenreview-v1-authentication-k8s-io-strong-","subsections":[{"section":"create-tokenreview-v1-authentication-k8s-io","subsections":[]}]}]},{"section":"tokenrequest-v1-authentication-k8s-io","subsections":[]},{"section":"subjectaccessreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-subjectaccessreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-subjectaccessreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"read-status-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"patch-status-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"watch-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"list-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"read-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"delete-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"replace-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"patch-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]},{"section":"create-storageversion-v1alpha1-internal-apiserver-k8s-io","subsections":[]}]}]},{"section":"serviceaccount-v1-core","subsections":[{"section":"-strong-read-operations-serviceaccount-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-serviceaccount-v1-core","subsections":[]},{"section":"watch-list-serviceaccount-v1-core","subsections":[]},{"section":"watch-serviceaccount-v1-core","subsections":[]},{"section":"list-all-namespaces-serviceaccount-v1-core","subsections":[]},{"section":"list-serviceaccount-v1-core","subsections":[]},{"section":"read-serviceaccount-v1-core","subsections":[]}]},{"section":"-strong-write-operations-serviceaccount-v1-core-strong-","subsections":[{"section":"delete-collection-serviceaccount-v1-core","subsections":[]},{"section":"delete-serviceaccount-v1-core","subsections":[]},{"section":"replace-serviceaccount-v1-core","subsections":[]},{"section":"patch-serviceaccount-v1-core","subsections":[]},{"section":"create-serviceaccount-v1-core","subsections":[]}]}]},{"section":"selfsubjectrulesreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-selfsubjectrulesreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-selfsubjectrulesreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"selfsubjectaccessreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-selfsubjectaccessreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-selfsubjectaccessreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"runtimeclass-v1-node-k8s-io","subsections":[{"section":"-strong-read-operations-runtimeclass-v1-node-k8s-io-strong-","subsections":[{"section":"watch-list-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"watch-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"list-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"read-runtimeclass-v1-node-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-runtimeclass-v1-node-k8s-io-strong-","subsections":[{"section":"delete-collection-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"delete-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"replace-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"patch-runtimeclass-v1-node-k8s-io","subsections":[]},{"section":"create-runtimeclass-v1-node-k8s-io","subsections":[]}]}]},{"section":"rolebinding-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-list-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-rolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"role-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-role-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-list-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-all-namespaces-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-role-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-role-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-role-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-role-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"resourcequota-v1-core","subsections":[{"section":"-strong-status-operations-resourcequota-v1-core-strong-","subsections":[{"section":"replace-status-resourcequota-v1-core","subsections":[]},{"section":"read-status-resourcequota-v1-core","subsections":[]},{"section":"patch-status-resourcequota-v1-core","subsections":[]}]},{"section":"-strong-read-operations-resourcequota-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-resourcequota-v1-core","subsections":[]},{"section":"watch-list-resourcequota-v1-core","subsections":[]},{"section":"watch-resourcequota-v1-core","subsections":[]},{"section":"list-all-namespaces-resourcequota-v1-core","subsections":[]},{"section":"list-resourcequota-v1-core","subsections":[]},{"section":"read-resourcequota-v1-core","subsections":[]}]},{"section":"-strong-write-operations-resourcequota-v1-core-strong-","subsections":[{"section":"delete-collection-resourcequota-v1-core","subsections":[]},{"section":"delete-resourcequota-v1-core","subsections":[]},{"section":"replace-resourcequota-v1-core","subsections":[]},{"section":"patch-resourcequota-v1-core","subsections":[]},{"section":"create-resourcequota-v1-core","subsections":[]}]}]},{"section":"prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"watch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"delete-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"replace-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"create-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]}]},{"section":"persistentvolume-v1-core","subsections":[{"section":"-strong-status-operations-persistentvolume-v1-core-strong-","subsections":[{"section":"replace-status-persistentvolume-v1-core","subsections":[]},{"section":"read-status-persistentvolume-v1-core","subsections":[]},{"section":"patch-status-persistentvolume-v1-core","subsections":[]}]},{"section":"-strong-read-operations-persistentvolume-v1-core-strong-","subsections":[{"section":"watch-list-persistentvolume-v1-core","subsections":[]},{"section":"watch-persistentvolume-v1-core","subsections":[]},{"section":"list-persistentvolume-v1-core","subsections":[]},{"section":"read-persistentvolume-v1-core","subsections":[]}]},{"section":"-strong-write-operations-persistentvolume-v1-core-strong-","subsections":[{"section":"delete-collection-persistentvolume-v1-core","subsections":[]},{"section":"delete-persistentvolume-v1-core","subsections":[]},{"section":"replace-persistentvolume-v1-core","subsections":[]},{"section":"patch-persistentvolume-v1-core","subsections":[]},{"section":"create-persistentvolume-v1-core","subsections":[]}]}]},{"section":"node-v1-core","subsections":[{"section":"-strong-proxy-operations-node-v1-core-strong-","subsections":[{"section":"replace-connect-proxy-path-node-v1-core","subsections":[]},{"section":"replace-connect-proxy-node-v1-core","subsections":[]},{"section":"head-connect-proxy-path-node-v1-core","subsections":[]},{"section":"head-connect-proxy-node-v1-core","subsections":[]},{"section":"get-connect-proxy-path-node-v1-core","subsections":[]},{"section":"get-connect-proxy-node-v1-core","subsections":[]},{"section":"delete-connect-proxy-path-node-v1-core","subsections":[]},{"section":"delete-connect-proxy-node-v1-core","subsections":[]},{"section":"create-connect-proxy-path-node-v1-core","subsections":[]},{"section":"create-connect-proxy-node-v1-core","subsections":[]}]},{"section":"-strong-status-operations-node-v1-core-strong-","subsections":[{"section":"replace-status-node-v1-core","subsections":[]},{"section":"read-status-node-v1-core","subsections":[]},{"section":"patch-status-node-v1-core","subsections":[]}]},{"section":"-strong-read-operations-node-v1-core-strong-","subsections":[{"section":"watch-list-node-v1-core","subsections":[]},{"section":"watch-node-v1-core","subsections":[]},{"section":"list-node-v1-core","subsections":[]},{"section":"read-node-v1-core","subsections":[]}]},{"section":"-strong-write-operations-node-v1-core-strong-","subsections":[{"section":"delete-collection-node-v1-core","subsections":[]},{"section":"delete-node-v1-core","subsections":[]},{"section":"replace-node-v1-core","subsections":[]},{"section":"patch-node-v1-core","subsections":[]},{"section":"create-node-v1-core","subsections":[]}]}]},{"section":"namespace-v1-core","subsections":[{"section":"-strong-status-operations-namespace-v1-core-strong-","subsections":[{"section":"replace-status-namespace-v1-core","subsections":[]},{"section":"read-status-namespace-v1-core","subsections":[]},{"section":"patch-status-namespace-v1-core","subsections":[]}]},{"section":"-strong-read-operations-namespace-v1-core-strong-","subsections":[{"section":"watch-list-namespace-v1-core","subsections":[]},{"section":"watch-namespace-v1-core","subsections":[]},{"section":"list-namespace-v1-core","subsections":[]},{"section":"read-namespace-v1-core","subsections":[]}]},{"section":"-strong-write-operations-namespace-v1-core-strong-","subsections":[{"section":"delete-namespace-v1-core","subsections":[]},{"section":"replace-namespace-v1-core","subsections":[]},{"section":"patch-namespace-v1-core","subsections":[]},{"section":"create-namespace-v1-core","subsections":[]}]}]},{"section":"localsubjectaccessreview-v1-authorization-k8s-io","subsections":[{"section":"-strong-write-operations-localsubjectaccessreview-v1-authorization-k8s-io-strong-","subsections":[{"section":"create-localsubjectaccessreview-v1-authorization-k8s-io","subsections":[]}]}]},{"section":"lease-v1-coordination-k8s-io","subsections":[{"section":"-strong-read-operations-lease-v1-coordination-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-lease-v1-coordination-k8s-io","subsections":[]},{"section":"watch-list-lease-v1-coordination-k8s-io","subsections":[]},{"section":"watch-lease-v1-coordination-k8s-io","subsections":[]},{"section":"list-all-namespaces-lease-v1-coordination-k8s-io","subsections":[]},{"section":"list-lease-v1-coordination-k8s-io","subsections":[]},{"section":"read-lease-v1-coordination-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-lease-v1-coordination-k8s-io-strong-","subsections":[{"section":"delete-collection-lease-v1-coordination-k8s-io","subsections":[]},{"section":"delete-lease-v1-coordination-k8s-io","subsections":[]},{"section":"replace-lease-v1-coordination-k8s-io","subsections":[]},{"section":"patch-lease-v1-coordination-k8s-io","subsections":[]},{"section":"create-lease-v1-coordination-k8s-io","subsections":[]}]}]},{"section":"flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[{"section":"-strong-status-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"replace-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"watch-list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"watch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"read-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","subsections":[{"section":"delete-collection-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"delete-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"replace-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"patch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]},{"section":"create-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","subsections":[]}]}]},{"section":"componentstatus-v1-core","subsections":[{"section":"-strong-read-operations-componentstatus-v1-core-strong-","subsections":[{"section":"list-componentstatus-v1-core","subsections":[]},{"section":"read-componentstatus-v1-core","subsections":[]}]}]},{"section":"clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-clusterrolebinding-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"clusterrole-v1-rbac-authorization-k8s-io","subsections":[{"section":"-strong-read-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"watch-list-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"watch-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"list-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"read-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","subsections":[{"section":"delete-collection-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"delete-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"replace-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"patch-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]},{"section":"create-clusterrole-v1-rbac-authorization-k8s-io","subsections":[]}]}]},{"section":"certificatesigningrequest-v1-certificates-k8s-io","subsections":[{"section":"-strong-status-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","subsections":[{"section":"replace-status-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"read-status-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"patch-status-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","subsections":[{"section":"watch-list-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"watch-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"list-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"read-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","subsections":[{"section":"delete-collection-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"delete-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"replace-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"patch-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]},{"section":"create-certificatesigningrequest-v1-certificates-k8s-io","subsections":[]}]}]},{"section":"binding-v1-core","subsections":[{"section":"-strong-write-operations-binding-v1-core-strong-","subsections":[{"section":"create-binding-v1-core","subsections":[]}]}]},{"section":"apiservice-v1-apiregistration-k8s-io","subsections":[{"section":"-strong-status-operations-apiservice-v1-apiregistration-k8s-io-strong-","subsections":[{"section":"replace-status-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"read-status-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"patch-status-apiservice-v1-apiregistration-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-apiservice-v1-apiregistration-k8s-io-strong-","subsections":[{"section":"watch-list-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"watch-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"list-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"read-apiservice-v1-apiregistration-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-apiservice-v1-apiregistration-k8s-io-strong-","subsections":[{"section":"delete-collection-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"delete-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"replace-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"patch-apiservice-v1-apiregistration-k8s-io","subsections":[]},{"section":"create-apiservice-v1-apiregistration-k8s-io","subsections":[]}]}]},{"section":"-strong-cluster-apis-strong-","subsections":[]},{"section":"podsecuritypolicy-v1beta1-policy","subsections":[{"section":"-strong-read-operations-podsecuritypolicy-v1beta1-policy-strong-","subsections":[{"section":"watch-list-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"watch-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"list-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"read-podsecuritypolicy-v1beta1-policy","subsections":[]}]},{"section":"-strong-write-operations-podsecuritypolicy-v1beta1-policy-strong-","subsections":[{"section":"delete-collection-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"delete-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"replace-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"patch-podsecuritypolicy-v1beta1-policy","subsections":[]},{"section":"create-podsecuritypolicy-v1beta1-policy","subsections":[]}]}]},{"section":"priorityclass-v1-scheduling-k8s-io","subsections":[{"section":"-strong-read-operations-priorityclass-v1-scheduling-k8s-io-strong-","subsections":[{"section":"watch-list-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"watch-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"list-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"read-priorityclass-v1-scheduling-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-priorityclass-v1-scheduling-k8s-io-strong-","subsections":[{"section":"delete-collection-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"delete-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"replace-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"patch-priorityclass-v1-scheduling-k8s-io","subsections":[]},{"section":"create-priorityclass-v1-scheduling-k8s-io","subsections":[]}]}]},{"section":"poddisruptionbudget-v1-policy","subsections":[{"section":"-strong-status-operations-poddisruptionbudget-v1-policy-strong-","subsections":[{"section":"replace-status-poddisruptionbudget-v1-policy","subsections":[]},{"section":"read-status-poddisruptionbudget-v1-policy","subsections":[]},{"section":"patch-status-poddisruptionbudget-v1-policy","subsections":[]}]},{"section":"-strong-read-operations-poddisruptionbudget-v1-policy-strong-","subsections":[{"section":"watch-list-all-namespaces-poddisruptionbudget-v1-policy","subsections":[]},{"section":"watch-list-poddisruptionbudget-v1-policy","subsections":[]},{"section":"watch-poddisruptionbudget-v1-policy","subsections":[]},{"section":"list-all-namespaces-poddisruptionbudget-v1-policy","subsections":[]},{"section":"list-poddisruptionbudget-v1-policy","subsections":[]},{"section":"read-poddisruptionbudget-v1-policy","subsections":[]}]},{"section":"-strong-write-operations-poddisruptionbudget-v1-policy-strong-","subsections":[{"section":"delete-collection-poddisruptionbudget-v1-policy","subsections":[]},{"section":"delete-poddisruptionbudget-v1-policy","subsections":[]},{"section":"replace-poddisruptionbudget-v1-policy","subsections":[]},{"section":"patch-poddisruptionbudget-v1-policy","subsections":[]},{"section":"create-poddisruptionbudget-v1-policy","subsections":[]}]}]},{"section":"podtemplate-v1-core","subsections":[{"section":"-strong-read-operations-podtemplate-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-podtemplate-v1-core","subsections":[]},{"section":"watch-list-podtemplate-v1-core","subsections":[]},{"section":"watch-podtemplate-v1-core","subsections":[]},{"section":"list-all-namespaces-podtemplate-v1-core","subsections":[]},{"section":"list-podtemplate-v1-core","subsections":[]},{"section":"read-podtemplate-v1-core","subsections":[]}]},{"section":"-strong-write-operations-podtemplate-v1-core-strong-","subsections":[{"section":"delete-collection-podtemplate-v1-core","subsections":[]},{"section":"delete-podtemplate-v1-core","subsections":[]},{"section":"replace-podtemplate-v1-core","subsections":[]},{"section":"patch-podtemplate-v1-core","subsections":[]},{"section":"create-podtemplate-v1-core","subsections":[]}]}]},{"section":"validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[{"section":"-strong-read-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"watch-list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"watch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"read-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"delete-collection-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"delete-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"replace-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"patch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"create-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]}]},{"section":"mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[{"section":"-strong-read-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"watch-list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"watch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"read-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","subsections":[{"section":"delete-collection-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"delete-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"replace-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"patch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]},{"section":"create-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","subsections":[]}]}]},{"section":"horizontalpodautoscaler-v1-autoscaling","subsections":[{"section":"-strong-status-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"replace-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"read-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"patch-status-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]},{"section":"-strong-read-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"watch-list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"watch-list-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"watch-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"list-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"read-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]},{"section":"-strong-write-operations-horizontalpodautoscaler-v1-autoscaling-strong-","subsections":[{"section":"delete-collection-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"delete-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"replace-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"patch-horizontalpodautoscaler-v1-autoscaling","subsections":[]},{"section":"create-horizontalpodautoscaler-v1-autoscaling","subsections":[]}]}]},{"section":"limitrange-v1-core","subsections":[{"section":"-strong-read-operations-limitrange-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-limitrange-v1-core","subsections":[]},{"section":"watch-list-limitrange-v1-core","subsections":[]},{"section":"watch-limitrange-v1-core","subsections":[]},{"section":"list-all-namespaces-limitrange-v1-core","subsections":[]},{"section":"list-limitrange-v1-core","subsections":[]},{"section":"read-limitrange-v1-core","subsections":[]}]},{"section":"-strong-write-operations-limitrange-v1-core-strong-","subsections":[{"section":"delete-collection-limitrange-v1-core","subsections":[]},{"section":"delete-limitrange-v1-core","subsections":[]},{"section":"replace-limitrange-v1-core","subsections":[]},{"section":"patch-limitrange-v1-core","subsections":[]},{"section":"create-limitrange-v1-core","subsections":[]}]}]},{"section":"event-v1-events-k8s-io","subsections":[{"section":"-strong-read-operations-event-v1-events-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-event-v1-events-k8s-io","subsections":[]},{"section":"watch-list-event-v1-events-k8s-io","subsections":[]},{"section":"watch-event-v1-events-k8s-io","subsections":[]},{"section":"list-all-namespaces-event-v1-events-k8s-io","subsections":[]},{"section":"list-event-v1-events-k8s-io","subsections":[]},{"section":"read-event-v1-events-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-event-v1-events-k8s-io-strong-","subsections":[{"section":"delete-collection-event-v1-events-k8s-io","subsections":[]},{"section":"delete-event-v1-events-k8s-io","subsections":[]},{"section":"replace-event-v1-events-k8s-io","subsections":[]},{"section":"patch-event-v1-events-k8s-io","subsections":[]},{"section":"create-event-v1-events-k8s-io","subsections":[]}]}]},{"section":"customresourcedefinition-v1-apiextensions-k8s-io","subsections":[{"section":"-strong-status-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","subsections":[{"section":"replace-status-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"read-status-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"patch-status-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","subsections":[{"section":"watch-list-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"watch-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"list-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"read-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","subsections":[{"section":"delete-collection-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"delete-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"replace-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"patch-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]},{"section":"create-customresourcedefinition-v1-apiextensions-k8s-io","subsections":[]}]}]},{"section":"controllerrevision-v1-apps","subsections":[{"section":"-strong-read-operations-controllerrevision-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-controllerrevision-v1-apps","subsections":[]},{"section":"watch-list-controllerrevision-v1-apps","subsections":[]},{"section":"watch-controllerrevision-v1-apps","subsections":[]},{"section":"list-all-namespaces-controllerrevision-v1-apps","subsections":[]},{"section":"list-controllerrevision-v1-apps","subsections":[]},{"section":"read-controllerrevision-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-controllerrevision-v1-apps-strong-","subsections":[{"section":"delete-collection-controllerrevision-v1-apps","subsections":[]},{"section":"delete-controllerrevision-v1-apps","subsections":[]},{"section":"replace-controllerrevision-v1-apps","subsections":[]},{"section":"patch-controllerrevision-v1-apps","subsections":[]},{"section":"create-controllerrevision-v1-apps","subsections":[]}]}]},{"section":"-strong-metadata-apis-strong-","subsections":[]},{"section":"volumeattachment-v1-storage-k8s-io","subsections":[{"section":"-strong-status-operations-volumeattachment-v1-storage-k8s-io-strong-","subsections":[{"section":"replace-status-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"read-status-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"patch-status-volumeattachment-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-volumeattachment-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"watch-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"list-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"read-volumeattachment-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-volumeattachment-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"delete-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"replace-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"patch-volumeattachment-v1-storage-k8s-io","subsections":[]},{"section":"create-volumeattachment-v1-storage-k8s-io","subsections":[]}]}]},{"section":"volume-v1-core","subsections":[]},{"section":"csistoragecapacity-v1beta1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"watch-list-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"watch-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"list-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"read-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"delete-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"replace-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"patch-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]},{"section":"create-csistoragecapacity-v1beta1-storage-k8s-io","subsections":[]}]}]},{"section":"storageclass-v1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-storageclass-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"watch-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"list-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"read-storageclass-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-storageclass-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"delete-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"replace-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"patch-storageclass-v1-storage-k8s-io","subsections":[]},{"section":"create-storageclass-v1-storage-k8s-io","subsections":[]}]}]},{"section":"persistentvolumeclaim-v1-core","subsections":[{"section":"-strong-status-operations-persistentvolumeclaim-v1-core-strong-","subsections":[{"section":"replace-status-persistentvolumeclaim-v1-core","subsections":[]},{"section":"read-status-persistentvolumeclaim-v1-core","subsections":[]},{"section":"patch-status-persistentvolumeclaim-v1-core","subsections":[]}]},{"section":"-strong-read-operations-persistentvolumeclaim-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-persistentvolumeclaim-v1-core","subsections":[]},{"section":"watch-list-persistentvolumeclaim-v1-core","subsections":[]},{"section":"watch-persistentvolumeclaim-v1-core","subsections":[]},{"section":"list-all-namespaces-persistentvolumeclaim-v1-core","subsections":[]},{"section":"list-persistentvolumeclaim-v1-core","subsections":[]},{"section":"read-persistentvolumeclaim-v1-core","subsections":[]}]},{"section":"-strong-write-operations-persistentvolumeclaim-v1-core-strong-","subsections":[{"section":"delete-collection-persistentvolumeclaim-v1-core","subsections":[]},{"section":"delete-persistentvolumeclaim-v1-core","subsections":[]},{"section":"replace-persistentvolumeclaim-v1-core","subsections":[]},{"section":"patch-persistentvolumeclaim-v1-core","subsections":[]},{"section":"create-persistentvolumeclaim-v1-core","subsections":[]}]}]},{"section":"secret-v1-core","subsections":[{"section":"-strong-read-operations-secret-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-secret-v1-core","subsections":[]},{"section":"watch-list-secret-v1-core","subsections":[]},{"section":"watch-secret-v1-core","subsections":[]},{"section":"list-all-namespaces-secret-v1-core","subsections":[]},{"section":"list-secret-v1-core","subsections":[]},{"section":"read-secret-v1-core","subsections":[]}]},{"section":"-strong-write-operations-secret-v1-core-strong-","subsections":[{"section":"delete-collection-secret-v1-core","subsections":[]},{"section":"delete-secret-v1-core","subsections":[]},{"section":"replace-secret-v1-core","subsections":[]},{"section":"patch-secret-v1-core","subsections":[]},{"section":"create-secret-v1-core","subsections":[]}]}]},{"section":"csinode-v1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csinode-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-csinode-v1-storage-k8s-io","subsections":[]},{"section":"watch-csinode-v1-storage-k8s-io","subsections":[]},{"section":"list-csinode-v1-storage-k8s-io","subsections":[]},{"section":"read-csinode-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csinode-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csinode-v1-storage-k8s-io","subsections":[]},{"section":"delete-csinode-v1-storage-k8s-io","subsections":[]},{"section":"replace-csinode-v1-storage-k8s-io","subsections":[]},{"section":"patch-csinode-v1-storage-k8s-io","subsections":[]},{"section":"create-csinode-v1-storage-k8s-io","subsections":[]}]}]},{"section":"csidriver-v1-storage-k8s-io","subsections":[{"section":"-strong-read-operations-csidriver-v1-storage-k8s-io-strong-","subsections":[{"section":"watch-list-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"watch-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"list-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"read-csidriver-v1-storage-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-csidriver-v1-storage-k8s-io-strong-","subsections":[{"section":"delete-collection-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"delete-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"replace-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"patch-csidriver-v1-storage-k8s-io","subsections":[]},{"section":"create-csidriver-v1-storage-k8s-io","subsections":[]}]}]},{"section":"configmap-v1-core","subsections":[{"section":"-strong-read-operations-configmap-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-configmap-v1-core","subsections":[]},{"section":"watch-list-configmap-v1-core","subsections":[]},{"section":"watch-configmap-v1-core","subsections":[]},{"section":"list-all-namespaces-configmap-v1-core","subsections":[]},{"section":"list-configmap-v1-core","subsections":[]},{"section":"read-configmap-v1-core","subsections":[]}]},{"section":"-strong-write-operations-configmap-v1-core-strong-","subsections":[{"section":"delete-collection-configmap-v1-core","subsections":[]},{"section":"delete-configmap-v1-core","subsections":[]},{"section":"replace-configmap-v1-core","subsections":[]},{"section":"patch-configmap-v1-core","subsections":[]},{"section":"create-configmap-v1-core","subsections":[]}]}]},{"section":"-strong-config-and-storage-apis-strong-","subsections":[]},{"section":"service-v1-core","subsections":[{"section":"-strong-proxy-operations-service-v1-core-strong-","subsections":[{"section":"replace-connect-proxy-path-service-v1-core","subsections":[]},{"section":"replace-connect-proxy-service-v1-core","subsections":[]},{"section":"head-connect-proxy-path-service-v1-core","subsections":[]},{"section":"head-connect-proxy-service-v1-core","subsections":[]},{"section":"get-connect-proxy-path-service-v1-core","subsections":[]},{"section":"get-connect-proxy-service-v1-core","subsections":[]},{"section":"delete-connect-proxy-path-service-v1-core","subsections":[]},{"section":"delete-connect-proxy-service-v1-core","subsections":[]},{"section":"create-connect-proxy-path-service-v1-core","subsections":[]},{"section":"create-connect-proxy-service-v1-core","subsections":[]}]},{"section":"-strong-status-operations-service-v1-core-strong-","subsections":[{"section":"replace-status-service-v1-core","subsections":[]},{"section":"read-status-service-v1-core","subsections":[]},{"section":"patch-status-service-v1-core","subsections":[]}]},{"section":"-strong-read-operations-service-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-service-v1-core","subsections":[]},{"section":"watch-list-service-v1-core","subsections":[]},{"section":"watch-service-v1-core","subsections":[]},{"section":"list-all-namespaces-service-v1-core","subsections":[]},{"section":"list-service-v1-core","subsections":[]},{"section":"read-service-v1-core","subsections":[]}]},{"section":"-strong-write-operations-service-v1-core-strong-","subsections":[{"section":"delete-collection-service-v1-core","subsections":[]},{"section":"delete-service-v1-core","subsections":[]},{"section":"replace-service-v1-core","subsections":[]},{"section":"patch-service-v1-core","subsections":[]},{"section":"create-service-v1-core","subsections":[]}]}]},{"section":"ingressclass-v1-networking-k8s-io","subsections":[{"section":"-strong-read-operations-ingressclass-v1-networking-k8s-io-strong-","subsections":[{"section":"watch-list-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"watch-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"list-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"read-ingressclass-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-ingressclass-v1-networking-k8s-io-strong-","subsections":[{"section":"delete-collection-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"delete-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"replace-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"patch-ingressclass-v1-networking-k8s-io","subsections":[]},{"section":"create-ingressclass-v1-networking-k8s-io","subsections":[]}]}]},{"section":"ingress-v1-networking-k8s-io","subsections":[{"section":"-strong-status-operations-ingress-v1-networking-k8s-io-strong-","subsections":[{"section":"replace-status-ingress-v1-networking-k8s-io","subsections":[]},{"section":"read-status-ingress-v1-networking-k8s-io","subsections":[]},{"section":"patch-status-ingress-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-read-operations-ingress-v1-networking-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-ingress-v1-networking-k8s-io","subsections":[]},{"section":"watch-list-ingress-v1-networking-k8s-io","subsections":[]},{"section":"watch-ingress-v1-networking-k8s-io","subsections":[]},{"section":"list-all-namespaces-ingress-v1-networking-k8s-io","subsections":[]},{"section":"list-ingress-v1-networking-k8s-io","subsections":[]},{"section":"read-ingress-v1-networking-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-ingress-v1-networking-k8s-io-strong-","subsections":[{"section":"delete-collection-ingress-v1-networking-k8s-io","subsections":[]},{"section":"delete-ingress-v1-networking-k8s-io","subsections":[]},{"section":"replace-ingress-v1-networking-k8s-io","subsections":[]},{"section":"patch-ingress-v1-networking-k8s-io","subsections":[]},{"section":"create-ingress-v1-networking-k8s-io","subsections":[]}]}]},{"section":"endpointslice-v1-discovery-k8s-io","subsections":[{"section":"-strong-read-operations-endpointslice-v1-discovery-k8s-io-strong-","subsections":[{"section":"watch-list-all-namespaces-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"watch-list-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"watch-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"list-all-namespaces-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"list-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"read-endpointslice-v1-discovery-k8s-io","subsections":[]}]},{"section":"-strong-write-operations-endpointslice-v1-discovery-k8s-io-strong-","subsections":[{"section":"delete-collection-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"delete-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"replace-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"patch-endpointslice-v1-discovery-k8s-io","subsections":[]},{"section":"create-endpointslice-v1-discovery-k8s-io","subsections":[]}]}]},{"section":"endpoints-v1-core","subsections":[{"section":"-strong-read-operations-endpoints-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-endpoints-v1-core","subsections":[]},{"section":"watch-list-endpoints-v1-core","subsections":[]},{"section":"watch-endpoints-v1-core","subsections":[]},{"section":"list-all-namespaces-endpoints-v1-core","subsections":[]},{"section":"list-endpoints-v1-core","subsections":[]},{"section":"read-endpoints-v1-core","subsections":[]}]},{"section":"-strong-write-operations-endpoints-v1-core-strong-","subsections":[{"section":"delete-collection-endpoints-v1-core","subsections":[]},{"section":"delete-endpoints-v1-core","subsections":[]},{"section":"replace-endpoints-v1-core","subsections":[]},{"section":"patch-endpoints-v1-core","subsections":[]},{"section":"create-endpoints-v1-core","subsections":[]}]}]},{"section":"-strong-service-apis-strong-","subsections":[]},{"section":"statefulset-v1-apps","subsections":[{"section":"-strong-misc-operations-statefulset-v1-apps-strong-","subsections":[{"section":"patch-scale-statefulset-v1-apps","subsections":[]},{"section":"replace-scale-statefulset-v1-apps","subsections":[]},{"section":"read-scale-statefulset-v1-apps","subsections":[]}]},{"section":"-strong-status-operations-statefulset-v1-apps-strong-","subsections":[{"section":"replace-status-statefulset-v1-apps","subsections":[]},{"section":"read-status-statefulset-v1-apps","subsections":[]},{"section":"patch-status-statefulset-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-statefulset-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-statefulset-v1-apps","subsections":[]},{"section":"watch-list-statefulset-v1-apps","subsections":[]},{"section":"watch-statefulset-v1-apps","subsections":[]},{"section":"list-all-namespaces-statefulset-v1-apps","subsections":[]},{"section":"list-statefulset-v1-apps","subsections":[]},{"section":"read-statefulset-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-statefulset-v1-apps-strong-","subsections":[{"section":"delete-collection-statefulset-v1-apps","subsections":[]},{"section":"delete-statefulset-v1-apps","subsections":[]},{"section":"replace-statefulset-v1-apps","subsections":[]},{"section":"patch-statefulset-v1-apps","subsections":[]},{"section":"create-statefulset-v1-apps","subsections":[]}]}]},{"section":"replicationcontroller-v1-core","subsections":[{"section":"-strong-misc-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"patch-scale-replicationcontroller-v1-core","subsections":[]},{"section":"replace-scale-replicationcontroller-v1-core","subsections":[]},{"section":"read-scale-replicationcontroller-v1-core","subsections":[]}]},{"section":"-strong-status-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"replace-status-replicationcontroller-v1-core","subsections":[]},{"section":"read-status-replicationcontroller-v1-core","subsections":[]},{"section":"patch-status-replicationcontroller-v1-core","subsections":[]}]},{"section":"-strong-read-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-replicationcontroller-v1-core","subsections":[]},{"section":"watch-list-replicationcontroller-v1-core","subsections":[]},{"section":"watch-replicationcontroller-v1-core","subsections":[]},{"section":"list-all-namespaces-replicationcontroller-v1-core","subsections":[]},{"section":"list-replicationcontroller-v1-core","subsections":[]},{"section":"read-replicationcontroller-v1-core","subsections":[]}]},{"section":"-strong-write-operations-replicationcontroller-v1-core-strong-","subsections":[{"section":"delete-collection-replicationcontroller-v1-core","subsections":[]},{"section":"delete-replicationcontroller-v1-core","subsections":[]},{"section":"replace-replicationcontroller-v1-core","subsections":[]},{"section":"patch-replicationcontroller-v1-core","subsections":[]},{"section":"create-replicationcontroller-v1-core","subsections":[]}]}]},{"section":"replicaset-v1-apps","subsections":[{"section":"-strong-misc-operations-replicaset-v1-apps-strong-","subsections":[{"section":"patch-scale-replicaset-v1-apps","subsections":[]},{"section":"replace-scale-replicaset-v1-apps","subsections":[]},{"section":"read-scale-replicaset-v1-apps","subsections":[]}]},{"section":"-strong-status-operations-replicaset-v1-apps-strong-","subsections":[{"section":"replace-status-replicaset-v1-apps","subsections":[]},{"section":"read-status-replicaset-v1-apps","subsections":[]},{"section":"patch-status-replicaset-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-replicaset-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-replicaset-v1-apps","subsections":[]},{"section":"watch-list-replicaset-v1-apps","subsections":[]},{"section":"watch-replicaset-v1-apps","subsections":[]},{"section":"list-all-namespaces-replicaset-v1-apps","subsections":[]},{"section":"list-replicaset-v1-apps","subsections":[]},{"section":"read-replicaset-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-replicaset-v1-apps-strong-","subsections":[{"section":"delete-collection-replicaset-v1-apps","subsections":[]},{"section":"delete-replicaset-v1-apps","subsections":[]},{"section":"replace-replicaset-v1-apps","subsections":[]},{"section":"patch-replicaset-v1-apps","subsections":[]},{"section":"create-replicaset-v1-apps","subsections":[]}]}]},{"section":"pod-v1-core","subsections":[{"section":"-strong-misc-operations-pod-v1-core-strong-","subsections":[{"section":"read-log-pod-v1-core","subsections":[]}]},{"section":"-strong-proxy-operations-pod-v1-core-strong-","subsections":[{"section":"replace-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"replace-connect-proxy-pod-v1-core","subsections":[]},{"section":"head-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"head-connect-proxy-pod-v1-core","subsections":[]},{"section":"get-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"get-connect-proxy-pod-v1-core","subsections":[]},{"section":"get-connect-portforward-pod-v1-core","subsections":[]},{"section":"delete-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"delete-connect-proxy-pod-v1-core","subsections":[]},{"section":"create-connect-proxy-path-pod-v1-core","subsections":[]},{"section":"create-connect-proxy-pod-v1-core","subsections":[]},{"section":"create-connect-portforward-pod-v1-core","subsections":[]}]},{"section":"-strong-ephemeralcontainers-operations-pod-v1-core-strong-","subsections":[{"section":"replace-ephemeralcontainers-pod-v1-core","subsections":[]},{"section":"read-ephemeralcontainers-pod-v1-core","subsections":[]},{"section":"patch-ephemeralcontainers-pod-v1-core","subsections":[]}]},{"section":"-strong-status-operations-pod-v1-core-strong-","subsections":[{"section":"replace-status-pod-v1-core","subsections":[]},{"section":"read-status-pod-v1-core","subsections":[]},{"section":"patch-status-pod-v1-core","subsections":[]}]},{"section":"-strong-read-operations-pod-v1-core-strong-","subsections":[{"section":"watch-list-all-namespaces-pod-v1-core","subsections":[]},{"section":"watch-list-pod-v1-core","subsections":[]},{"section":"watch-pod-v1-core","subsections":[]},{"section":"list-all-namespaces-pod-v1-core","subsections":[]},{"section":"list-pod-v1-core","subsections":[]},{"section":"read-pod-v1-core","subsections":[]}]},{"section":"-strong-write-operations-pod-v1-core-strong-","subsections":[{"section":"delete-collection-pod-v1-core","subsections":[]},{"section":"delete-pod-v1-core","subsections":[]},{"section":"replace-pod-v1-core","subsections":[]},{"section":"patch-pod-v1-core","subsections":[]},{"section":"create-eviction-pod-v1-core","subsections":[]},{"section":"create-pod-v1-core","subsections":[]}]}]},{"section":"job-v1-batch","subsections":[{"section":"-strong-status-operations-job-v1-batch-strong-","subsections":[{"section":"replace-status-job-v1-batch","subsections":[]},{"section":"read-status-job-v1-batch","subsections":[]},{"section":"patch-status-job-v1-batch","subsections":[]}]},{"section":"-strong-read-operations-job-v1-batch-strong-","subsections":[{"section":"watch-list-all-namespaces-job-v1-batch","subsections":[]},{"section":"watch-list-job-v1-batch","subsections":[]},{"section":"watch-job-v1-batch","subsections":[]},{"section":"list-all-namespaces-job-v1-batch","subsections":[]},{"section":"list-job-v1-batch","subsections":[]},{"section":"read-job-v1-batch","subsections":[]}]},{"section":"-strong-write-operations-job-v1-batch-strong-","subsections":[{"section":"delete-collection-job-v1-batch","subsections":[]},{"section":"delete-job-v1-batch","subsections":[]},{"section":"replace-job-v1-batch","subsections":[]},{"section":"patch-job-v1-batch","subsections":[]},{"section":"create-job-v1-batch","subsections":[]}]}]},{"section":"deployment-v1-apps","subsections":[{"section":"-strong-misc-operations-deployment-v1-apps-strong-","subsections":[{"section":"patch-scale-deployment-v1-apps","subsections":[]},{"section":"replace-scale-deployment-v1-apps","subsections":[]},{"section":"read-scale-deployment-v1-apps","subsections":[]}]},{"section":"-strong-status-operations-deployment-v1-apps-strong-","subsections":[{"section":"replace-status-deployment-v1-apps","subsections":[]},{"section":"read-status-deployment-v1-apps","subsections":[]},{"section":"patch-status-deployment-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-deployment-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-deployment-v1-apps","subsections":[]},{"section":"watch-list-deployment-v1-apps","subsections":[]},{"section":"watch-deployment-v1-apps","subsections":[]},{"section":"list-all-namespaces-deployment-v1-apps","subsections":[]},{"section":"list-deployment-v1-apps","subsections":[]},{"section":"read-deployment-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-deployment-v1-apps-strong-","subsections":[{"section":"delete-collection-deployment-v1-apps","subsections":[]},{"section":"delete-deployment-v1-apps","subsections":[]},{"section":"replace-deployment-v1-apps","subsections":[]},{"section":"patch-deployment-v1-apps","subsections":[]},{"section":"create-deployment-v1-apps","subsections":[]}]}]},{"section":"daemonset-v1-apps","subsections":[{"section":"-strong-status-operations-daemonset-v1-apps-strong-","subsections":[{"section":"replace-status-daemonset-v1-apps","subsections":[]},{"section":"read-status-daemonset-v1-apps","subsections":[]},{"section":"patch-status-daemonset-v1-apps","subsections":[]}]},{"section":"-strong-read-operations-daemonset-v1-apps-strong-","subsections":[{"section":"watch-list-all-namespaces-daemonset-v1-apps","subsections":[]},{"section":"watch-list-daemonset-v1-apps","subsections":[]},{"section":"watch-daemonset-v1-apps","subsections":[]},{"section":"list-all-namespaces-daemonset-v1-apps","subsections":[]},{"section":"list-daemonset-v1-apps","subsections":[]},{"section":"read-daemonset-v1-apps","subsections":[]}]},{"section":"-strong-write-operations-daemonset-v1-apps-strong-","subsections":[{"section":"delete-collection-daemonset-v1-apps","subsections":[]},{"section":"delete-daemonset-v1-apps","subsections":[]},{"section":"replace-daemonset-v1-apps","subsections":[]},{"section":"patch-daemonset-v1-apps","subsections":[]},{"section":"create-daemonset-v1-apps","subsections":[]}]}]},{"section":"cronjob-v1-batch","subsections":[{"section":"-strong-status-operations-cronjob-v1-batch-strong-","subsections":[{"section":"replace-status-cronjob-v1-batch","subsections":[]},{"section":"read-status-cronjob-v1-batch","subsections":[]},{"section":"patch-status-cronjob-v1-batch","subsections":[]}]},{"section":"-strong-read-operations-cronjob-v1-batch-strong-","subsections":[{"section":"watch-list-all-namespaces-cronjob-v1-batch","subsections":[]},{"section":"watch-list-cronjob-v1-batch","subsections":[]},{"section":"watch-cronjob-v1-batch","subsections":[]},{"section":"list-all-namespaces-cronjob-v1-batch","subsections":[]},{"section":"list-cronjob-v1-batch","subsections":[]},{"section":"read-cronjob-v1-batch","subsections":[]}]},{"section":"-strong-write-operations-cronjob-v1-batch-strong-","subsections":[{"section":"delete-collection-cronjob-v1-batch","subsections":[]},{"section":"delete-cronjob-v1-batch","subsections":[]},{"section":"replace-cronjob-v1-batch","subsections":[]},{"section":"patch-cronjob-v1-batch","subsections":[]},{"section":"create-cronjob-v1-batch","subsections":[]}]}]},{"section":"container-v1-core","subsections":[]},{"section":"-strong-workloads-apis-strong-","subsections":[]},{"section":"-strong-api-groups-strong-","subsections":[]},{"section":"-strong-api-overview-strong-","subsections":[]}],"flatToc":["webhookclientconfig-v1-apiextensions-k8s-io","usersubject-v1beta1-flowcontrol-apiserver-k8s-io","tokenrequest-v1-storage-k8s-io","subject-v1beta1-flowcontrol-apiserver-k8s-io","subject-v1-rbac-authorization-k8s-io","servicereference-v1-apiregistration-k8s-io","servicereference-v1-apiextensions-k8s-io","serviceaccountsubject-v1beta1-flowcontrol-apiserver-k8s-io","scheduling-v1alpha1-node-k8s-io","scheduling-v1beta1-node-k8s-io","watch-list-runtimeclass-v1alpha1-node-k8s-io","watch-runtimeclass-v1alpha1-node-k8s-io","list-runtimeclass-v1alpha1-node-k8s-io","read-runtimeclass-v1alpha1-node-k8s-io","-strong-read-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","delete-collection-runtimeclass-v1alpha1-node-k8s-io","delete-runtimeclass-v1alpha1-node-k8s-io","replace-runtimeclass-v1alpha1-node-k8s-io","patch-runtimeclass-v1alpha1-node-k8s-io","create-runtimeclass-v1alpha1-node-k8s-io","-strong-write-operations-runtimeclass-v1alpha1-node-k8s-io-strong-","runtimeclass-v1alpha1-node-k8s-io","watch-list-runtimeclass-v1beta1-node-k8s-io","watch-runtimeclass-v1beta1-node-k8s-io","list-runtimeclass-v1beta1-node-k8s-io","read-runtimeclass-v1beta1-node-k8s-io","-strong-read-operations-runtimeclass-v1beta1-node-k8s-io-strong-","delete-collection-runtimeclass-v1beta1-node-k8s-io","delete-runtimeclass-v1beta1-node-k8s-io","replace-runtimeclass-v1beta1-node-k8s-io","patch-runtimeclass-v1beta1-node-k8s-io","create-runtimeclass-v1beta1-node-k8s-io","-strong-write-operations-runtimeclass-v1beta1-node-k8s-io-strong-","runtimeclass-v1beta1-node-k8s-io","resourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","resourcemetricstatus-v2beta1-autoscaling","resourcemetricstatus-v2beta2-autoscaling","resourcemetricsource-v2beta1-autoscaling","resourcemetricsource-v2beta2-autoscaling","queuingconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","prioritylevelconfigurationreference-v1beta1-flowcontrol-apiserver-k8s-io","prioritylevelconfigurationcondition-v1beta1-flowcontrol-apiserver-k8s-io","replace-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","read-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","patch-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-status-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","watch-list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","watch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","read-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-read-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","delete-collection-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","delete-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","replace-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","patch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","create-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-write-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","policyruleswithsubjects-v1beta1-flowcontrol-apiserver-k8s-io","podsmetricstatus-v2beta1-autoscaling","podsmetricstatus-v2beta2-autoscaling","podsmetricsource-v2beta1-autoscaling","podsmetricsource-v2beta2-autoscaling","replace-status-poddisruptionbudget-v1beta1-policy","read-status-poddisruptionbudget-v1beta1-policy","patch-status-poddisruptionbudget-v1beta1-policy","-strong-status-operations-poddisruptionbudget-v1beta1-policy-strong-","watch-list-all-namespaces-poddisruptionbudget-v1beta1-policy","watch-list-poddisruptionbudget-v1beta1-policy","watch-poddisruptionbudget-v1beta1-policy","list-all-namespaces-poddisruptionbudget-v1beta1-policy","list-poddisruptionbudget-v1beta1-policy","read-poddisruptionbudget-v1beta1-policy","-strong-read-operations-poddisruptionbudget-v1beta1-policy-strong-","delete-collection-poddisruptionbudget-v1beta1-policy","delete-poddisruptionbudget-v1beta1-policy","replace-poddisruptionbudget-v1beta1-policy","patch-poddisruptionbudget-v1beta1-policy","create-poddisruptionbudget-v1beta1-policy","-strong-write-operations-poddisruptionbudget-v1beta1-policy-strong-","poddisruptionbudget-v1beta1-policy","overhead-v1alpha1-node-k8s-io","overhead-v1beta1-node-k8s-io","objectmetricstatus-v2beta1-autoscaling","objectmetricstatus-v2beta2-autoscaling","objectmetricsource-v2beta1-autoscaling","objectmetricsource-v2beta2-autoscaling","nonresourcepolicyrule-v1beta1-flowcontrol-apiserver-k8s-io","metricvaluestatus-v2beta2-autoscaling","metrictarget-v2beta2-autoscaling","metricstatus-v2beta1-autoscaling","metricstatus-v2beta2-autoscaling","metricspec-v2beta1-autoscaling","metricspec-v2beta2-autoscaling","metricidentifier-v2beta2-autoscaling","limitedprioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","limitresponse-v1beta1-flowcontrol-apiserver-k8s-io","jobtemplatespec-v1beta1-batch","horizontalpodautoscalercondition-v2beta1-autoscaling","horizontalpodautoscalercondition-v2beta2-autoscaling","horizontalpodautoscalerbehavior-v2beta2-autoscaling","replace-status-horizontalpodautoscaler-v2beta1-autoscaling","read-status-horizontalpodautoscaler-v2beta1-autoscaling","patch-status-horizontalpodautoscaler-v2beta1-autoscaling","-strong-status-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","watch-list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","watch-list-horizontalpodautoscaler-v2beta1-autoscaling","watch-horizontalpodautoscaler-v2beta1-autoscaling","list-all-namespaces-horizontalpodautoscaler-v2beta1-autoscaling","list-horizontalpodautoscaler-v2beta1-autoscaling","read-horizontalpodautoscaler-v2beta1-autoscaling","-strong-read-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","delete-collection-horizontalpodautoscaler-v2beta1-autoscaling","delete-horizontalpodautoscaler-v2beta1-autoscaling","replace-horizontalpodautoscaler-v2beta1-autoscaling","patch-horizontalpodautoscaler-v2beta1-autoscaling","create-horizontalpodautoscaler-v2beta1-autoscaling","-strong-write-operations-horizontalpodautoscaler-v2beta1-autoscaling-strong-","horizontalpodautoscaler-v2beta1-autoscaling","replace-status-horizontalpodautoscaler-v2beta2-autoscaling","read-status-horizontalpodautoscaler-v2beta2-autoscaling","patch-status-horizontalpodautoscaler-v2beta2-autoscaling","-strong-status-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","watch-list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","watch-list-horizontalpodautoscaler-v2beta2-autoscaling","watch-horizontalpodautoscaler-v2beta2-autoscaling","list-all-namespaces-horizontalpodautoscaler-v2beta2-autoscaling","list-horizontalpodautoscaler-v2beta2-autoscaling","read-horizontalpodautoscaler-v2beta2-autoscaling","-strong-read-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","delete-collection-horizontalpodautoscaler-v2beta2-autoscaling","delete-horizontalpodautoscaler-v2beta2-autoscaling","replace-horizontalpodautoscaler-v2beta2-autoscaling","patch-horizontalpodautoscaler-v2beta2-autoscaling","create-horizontalpodautoscaler-v2beta2-autoscaling","-strong-write-operations-horizontalpodautoscaler-v2beta2-autoscaling-strong-","horizontalpodautoscaler-v2beta2-autoscaling","replace-status-horizontalpodautoscaler-v1-autoscaling","read-status-horizontalpodautoscaler-v1-autoscaling","patch-status-horizontalpodautoscaler-v1-autoscaling","-strong-status-operations-horizontalpodautoscaler-v1-autoscaling-strong-","watch-list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","watch-list-horizontalpodautoscaler-v1-autoscaling","watch-horizontalpodautoscaler-v1-autoscaling","list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","list-horizontalpodautoscaler-v1-autoscaling","read-horizontalpodautoscaler-v1-autoscaling","-strong-read-operations-horizontalpodautoscaler-v1-autoscaling-strong-","delete-collection-horizontalpodautoscaler-v1-autoscaling","delete-horizontalpodautoscaler-v1-autoscaling","replace-horizontalpodautoscaler-v1-autoscaling","patch-horizontalpodautoscaler-v1-autoscaling","create-horizontalpodautoscaler-v1-autoscaling","-strong-write-operations-horizontalpodautoscaler-v1-autoscaling-strong-","horizontalpodautoscaler-v1-autoscaling","hpascalingrules-v2beta2-autoscaling","hpascalingpolicy-v2beta2-autoscaling","groupsubject-v1beta1-flowcontrol-apiserver-k8s-io","forzone-v1beta1-discovery-k8s-io","flowschemacondition-v1beta1-flowcontrol-apiserver-k8s-io","replace-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","read-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","patch-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-status-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","watch-list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","watch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","read-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-read-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","delete-collection-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","delete-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","replace-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","patch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","create-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-write-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","flowschema-v1beta1-flowcontrol-apiserver-k8s-io","flowdistinguishermethod-v1beta1-flowcontrol-apiserver-k8s-io","externalmetricstatus-v2beta1-autoscaling","externalmetricstatus-v2beta2-autoscaling","externalmetricsource-v2beta1-autoscaling","externalmetricsource-v2beta2-autoscaling","eventseries-v1beta1-events-k8s-io","eventseries-v1-core","watch-list-all-namespaces-event-v1beta1-events-k8s-io","watch-list-event-v1beta1-events-k8s-io","watch-event-v1beta1-events-k8s-io","list-all-namespaces-event-v1beta1-events-k8s-io","list-event-v1beta1-events-k8s-io","read-event-v1beta1-events-k8s-io","-strong-read-operations-event-v1beta1-events-k8s-io-strong-","delete-collection-event-v1beta1-events-k8s-io","delete-event-v1beta1-events-k8s-io","replace-event-v1beta1-events-k8s-io","patch-event-v1beta1-events-k8s-io","create-event-v1beta1-events-k8s-io","-strong-write-operations-event-v1beta1-events-k8s-io-strong-","event-v1beta1-events-k8s-io","watch-list-all-namespaces-event-v1-core","watch-list-event-v1-core","watch-event-v1-core","list-all-namespaces-event-v1-core","list-event-v1-core","read-event-v1-core","-strong-read-operations-event-v1-core-strong-","delete-collection-event-v1-core","delete-event-v1-core","replace-event-v1-core","patch-event-v1-core","create-event-v1-core","-strong-write-operations-event-v1-core-strong-","event-v1-core","watch-list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","watch-list-endpointslice-v1beta1-discovery-k8s-io","watch-endpointslice-v1beta1-discovery-k8s-io","list-all-namespaces-endpointslice-v1beta1-discovery-k8s-io","list-endpointslice-v1beta1-discovery-k8s-io","read-endpointslice-v1beta1-discovery-k8s-io","-strong-read-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","delete-collection-endpointslice-v1beta1-discovery-k8s-io","delete-endpointslice-v1beta1-discovery-k8s-io","replace-endpointslice-v1beta1-discovery-k8s-io","patch-endpointslice-v1beta1-discovery-k8s-io","create-endpointslice-v1beta1-discovery-k8s-io","-strong-write-operations-endpointslice-v1beta1-discovery-k8s-io-strong-","endpointslice-v1beta1-discovery-k8s-io","endpointport-v1beta1-discovery-k8s-io","endpointport-v1-discovery-k8s-io","endpointhints-v1beta1-discovery-k8s-io","endpointconditions-v1beta1-discovery-k8s-io","endpoint-v1beta1-discovery-k8s-io","crossversionobjectreference-v2beta1-autoscaling","crossversionobjectreference-v2beta2-autoscaling","crossversionobjectreference-v2-autoscaling","replace-status-cronjob-v1beta1-batch","read-status-cronjob-v1beta1-batch","patch-status-cronjob-v1beta1-batch","-strong-status-operations-cronjob-v1beta1-batch-strong-","watch-list-all-namespaces-cronjob-v1beta1-batch","watch-list-cronjob-v1beta1-batch","watch-cronjob-v1beta1-batch","list-all-namespaces-cronjob-v1beta1-batch","list-cronjob-v1beta1-batch","read-cronjob-v1beta1-batch","-strong-read-operations-cronjob-v1beta1-batch-strong-","delete-collection-cronjob-v1beta1-batch","delete-cronjob-v1beta1-batch","replace-cronjob-v1beta1-batch","patch-cronjob-v1beta1-batch","create-cronjob-v1beta1-batch","-strong-write-operations-cronjob-v1beta1-batch-strong-","cronjob-v1beta1-batch","containerresourcemetricstatus-v2beta1-autoscaling","containerresourcemetricstatus-v2beta2-autoscaling","containerresourcemetricsource-v2beta1-autoscaling","containerresourcemetricsource-v2beta2-autoscaling","watch-list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","watch-list-csistoragecapacity-v1alpha1-storage-k8s-io","watch-csistoragecapacity-v1alpha1-storage-k8s-io","list-all-namespaces-csistoragecapacity-v1alpha1-storage-k8s-io","list-csistoragecapacity-v1alpha1-storage-k8s-io","read-csistoragecapacity-v1alpha1-storage-k8s-io","-strong-read-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","delete-collection-csistoragecapacity-v1alpha1-storage-k8s-io","delete-csistoragecapacity-v1alpha1-storage-k8s-io","replace-csistoragecapacity-v1alpha1-storage-k8s-io","patch-csistoragecapacity-v1alpha1-storage-k8s-io","create-csistoragecapacity-v1alpha1-storage-k8s-io","-strong-write-operations-csistoragecapacity-v1alpha1-storage-k8s-io-strong-","csistoragecapacity-v1alpha1-storage-k8s-io","-strong-old-api-versions-strong-","windowssecuritycontextoptions-v1-core","weightedpodaffinityterm-v1-core","webhookconversion-v1-apiextensions-k8s-io","webhookclientconfig-v1-admissionregistration-k8s-io","watchevent-v1-meta","vspherevirtualdiskvolumesource-v1-core","volumeprojection-v1-core","volumenoderesources-v1-storage-k8s-io","volumenodeaffinity-v1-core","volumemount-v1-core","volumeerror-v1-storage-k8s-io","volumedevice-v1-core","volumeattachmentsource-v1-storage-k8s-io","validationrule-v1-apiextensions-k8s-io","validatingwebhook-v1-admissionregistration-k8s-io","usersubject-v1beta2-flowcontrol-apiserver-k8s-io","userinfo-v1-authentication-k8s-io","uncountedterminatedpods-v1-batch","typedlocalobjectreference-v1-core","topologyspreadconstraint-v1-core","topologyselectorterm-v1-core","topologyselectorlabelrequirement-v1-core","toleration-v1-core","time-v1-meta","taint-v1-core","tcpsocketaction-v1-core","sysctl-v1-core","supplementalgroupsstrategyoptions-v1beta1-policy","subjectrulesreviewstatus-v1-authorization-k8s-io","subject-v1beta2-flowcontrol-apiserver-k8s-io","storageversioncondition-v1alpha1-internal-apiserver-k8s-io","storageosvolumesource-v1-core","storageospersistentvolumesource-v1-core","statusdetails-v1-meta","statuscause-v1-meta","status-v1-meta","statefulsetupdatestrategy-v1-apps","statefulsetpersistentvolumeclaimretentionpolicy-v1-apps","statefulsetcondition-v1-apps","sessionaffinityconfig-v1-core","servicereference-v1-admissionregistration-k8s-io","serviceport-v1-core","servicebackendport-v1-networking-k8s-io","serviceaccounttokenprojection-v1-core","serviceaccountsubject-v1beta2-flowcontrol-apiserver-k8s-io","serverstorageversion-v1alpha1-internal-apiserver-k8s-io","serveraddressbyclientcidr-v1-meta","securitycontext-v1-core","secretvolumesource-v1-core","secretreference-v1-core","secretprojection-v1-core","secretkeyselector-v1-core","secretenvsource-v1-core","seccompprofile-v1-core","scopedresourceselectorrequirement-v1-core","scopeselector-v1-core","scheduling-v1-node-k8s-io","scaleiovolumesource-v1-core","scaleiopersistentvolumesource-v1-core","scale-v1-autoscaling","selinuxstrategyoptions-v1beta1-policy","selinuxoptions-v1-core","runtimeclassstrategyoptions-v1beta1-policy","runasuserstrategyoptions-v1beta1-policy","runasgroupstrategyoptions-v1beta1-policy","rulewithoperations-v1-admissionregistration-k8s-io","rollingupdatestatefulsetstrategy-v1-apps","roleref-v1-rbac-authorization-k8s-io","resourcerule-v1-authorization-k8s-io","resourcerequirements-v1-core","resourcepolicyrule-v1beta2-flowcontrol-apiserver-k8s-io","resourcemetricstatus-v2-autoscaling","resourcemetricsource-v2-autoscaling","resourcefieldselector-v1-core","resourceattributes-v1-authorization-k8s-io","replicationcontrollercondition-v1-core","replicasetcondition-v1-apps","rbdvolumesource-v1-core","rbdpersistentvolumesource-v1-core","quobytevolumesource-v1-core","queuingconfiguration-v1beta2-flowcontrol-apiserver-k8s-io","quantity-resource-core","projectedvolumesource-v1-core","probe-v1-core","prioritylevelconfigurationreference-v1beta2-flowcontrol-apiserver-k8s-io","prioritylevelconfigurationcondition-v1beta2-flowcontrol-apiserver-k8s-io","prioritylevelconfiguration-v1beta2-flowcontrol-apiserver-k8s-io","preferredschedulingterm-v1-core","preconditions-v1-meta","portworxvolumesource-v1-core","portstatus-v1-core","policyruleswithsubjects-v1beta2-flowcontrol-apiserver-k8s-io","policyrule-v1-rbac-authorization-k8s-io","podsmetricstatus-v2-autoscaling","podsmetricsource-v2-autoscaling","podsecuritycontext-v1-core","podreadinessgate-v1-core","podos-v1-core","podip-v1-core","poddnsconfigoption-v1-core","poddnsconfig-v1-core","podcondition-v1-core","podantiaffinity-v1-core","podaffinityterm-v1-core","podaffinity-v1-core","photonpersistentdiskvolumesource-v1-core","persistentvolumeclaimvolumesource-v1-core","persistentvolumeclaimtemplate-v1-core","persistentvolumeclaimcondition-v1-core","patch-v1-meta","ownerreference-v1-meta","overhead-v1-node-k8s-io","objectreference-v1-core","objectmetricstatus-v2-autoscaling","objectmetricsource-v2-autoscaling","objectmeta-v1-meta","objectfieldselector-v1-core","nonresourcerule-v1-authorization-k8s-io","nonresourcepolicyrule-v1beta2-flowcontrol-apiserver-k8s-io","nonresourceattributes-v1-authorization-k8s-io","nodesysteminfo-v1-core","nodeselectorterm-v1-core","nodeselectorrequirement-v1-core","nodeselector-v1-core","nodedaemonendpoints-v1-core","nodeconfigstatus-v1-core","nodeconfigsource-v1-core","nodecondition-v1-core","nodeaffinity-v1-core","nodeaddress-v1-core","networkpolicyport-v1-networking-k8s-io","networkpolicypeer-v1-networking-k8s-io","networkpolicyingressrule-v1-networking-k8s-io","networkpolicyegressrule-v1-networking-k8s-io","namespacecondition-v1-core","nfsvolumesource-v1-core","mutatingwebhook-v1-admissionregistration-k8s-io","microtime-v1-meta","metricvaluestatus-v2-autoscaling","metrictarget-v2-autoscaling","metricstatus-v2-autoscaling","metricspec-v2-autoscaling","metricidentifier-v2-autoscaling","managedfieldsentry-v1-meta","localvolumesource-v1-core","localobjectreference-v1-core","loadbalancerstatus-v1-core","loadbalanceringress-v1-core","listmeta-v1-meta","limitedprioritylevelconfiguration-v1beta2-flowcontrol-apiserver-k8s-io","limitresponse-v1beta2-flowcontrol-apiserver-k8s-io","limitrangeitem-v1-core","lifecyclehandler-v1-core","lifecycle-v1-core","labelselectorrequirement-v1-meta","labelselector-v1-meta","keytopath-v1-core","jobtemplatespec-v1-batch","jobcondition-v1-batch","jsonschemapropsorbool-v1-apiextensions-k8s-io","jsonschemapropsorarray-v1-apiextensions-k8s-io","jsonschemaprops-v1-apiextensions-k8s-io","json-v1-apiextensions-k8s-io","ingresstls-v1-networking-k8s-io","ingressservicebackend-v1-networking-k8s-io","ingressrule-v1-networking-k8s-io","ingressclassparametersreference-v1-networking-k8s-io","ingressbackend-v1-networking-k8s-io","iscsivolumesource-v1-core","iscsipersistentvolumesource-v1-core","ipblock-v1-networking-k8s-io","idrange-v1beta1-policy","hostportrange-v1beta1-policy","hostpathvolumesource-v1-core","hostalias-v1-core","horizontalpodautoscalercondition-v2-autoscaling","horizontalpodautoscalerbehavior-v2-autoscaling","horizontalpodautoscaler-v2-autoscaling","httpingressrulevalue-v1-networking-k8s-io","httpingresspath-v1-networking-k8s-io","httpheader-v1-core","httpgetaction-v1-core","hpascalingrules-v2-autoscaling","hpascalingpolicy-v2-autoscaling","groupversionfordiscovery-v1-meta","groupsubject-v1beta2-flowcontrol-apiserver-k8s-io","glusterfsvolumesource-v1-core","glusterfspersistentvolumesource-v1-core","gitrepovolumesource-v1-core","grpcaction-v1-core","gcepersistentdiskvolumesource-v1-core","forzone-v1-discovery-k8s-io","flowschemacondition-v1beta2-flowcontrol-apiserver-k8s-io","flowschema-v1beta2-flowcontrol-apiserver-k8s-io","flowdistinguishermethod-v1beta2-flowcontrol-apiserver-k8s-io","flockervolumesource-v1-core","flexvolumesource-v1-core","flexpersistentvolumesource-v1-core","fieldsv1-v1-meta","fsgroupstrategyoptions-v1beta1-policy","fcvolumesource-v1-core","externalmetricstatus-v2-autoscaling","externalmetricsource-v2-autoscaling","externaldocumentation-v1-apiextensions-k8s-io","execaction-v1-core","eviction-v1-policy","eventsource-v1-core","eventseries-v1-events-k8s-io","ephemeralvolumesource-v1-core","ephemeralcontainer-v1-core","envvarsource-v1-core","envvar-v1-core","envfromsource-v1-core","endpointsubset-v1-core","endpointport-v1-core","endpointhints-v1-discovery-k8s-io","endpointconditions-v1-discovery-k8s-io","endpointaddress-v1-core","endpoint-v1-discovery-k8s-io","emptydirvolumesource-v1-core","downwardapivolumesource-v1-core","downwardapivolumefile-v1-core","downwardapiprojection-v1-core","deploymentcondition-v1-apps","deleteoptions-v1-meta","daemonsetupdatestrategy-v1-apps","daemonsetcondition-v1-apps","daemonendpoint-v1-core","customresourcevalidation-v1-apiextensions-k8s-io","customresourcesubresources-v1-apiextensions-k8s-io","customresourcesubresourcestatus-v1-apiextensions-k8s-io","customresourcesubresourcescale-v1-apiextensions-k8s-io","customresourcedefinitionversion-v1-apiextensions-k8s-io","customresourcedefinitionnames-v1-apiextensions-k8s-io","customresourcedefinitioncondition-v1-apiextensions-k8s-io","customresourceconversion-v1-apiextensions-k8s-io","customresourcecolumndefinition-v1-apiextensions-k8s-io","crossversionobjectreference-v1-autoscaling","containerstatewaiting-v1-core","containerstateterminated-v1-core","containerstaterunning-v1-core","containerstate-v1-core","containerresourcemetricstatus-v2-autoscaling","containerresourcemetricsource-v2-autoscaling","containerport-v1-core","containerimage-v1-core","configmapvolumesource-v1-core","configmapprojection-v1-core","configmapnodeconfigsource-v1-core","configmapkeyselector-v1-core","configmapenvsource-v1-core","condition-v1-meta","componentcondition-v1-core","clientipconfig-v1-core","cindervolumesource-v1-core","cinderpersistentvolumesource-v1-core","certificatesigningrequestcondition-v1-certificates-k8s-io","cephfsvolumesource-v1-core","cephfspersistentvolumesource-v1-core","capabilities-v1-core","csivolumesource-v1-core","csipersistentvolumesource-v1-core","csinodedriver-v1-storage-k8s-io","boundobjectreference-v1-authentication-k8s-io","azurefilevolumesource-v1-core","azurefilepersistentvolumesource-v1-core","azurediskvolumesource-v1-core","attachedvolume-v1-core","allowedhostpath-v1beta1-policy","allowedflexvolume-v1beta1-policy","allowedcsidriver-v1beta1-policy","aggregationrule-v1-rbac-authorization-k8s-io","affinity-v1-core","awselasticblockstorevolumesource-v1-core","apiversions-v1-meta","apiservicecondition-v1-apiregistration-k8s-io","apiresource-v1-meta","apigroup-v1-meta","-strong-definitions-strong-","watch-list-all-namespaces-networkpolicy-v1-networking-k8s-io","watch-list-networkpolicy-v1-networking-k8s-io","watch-networkpolicy-v1-networking-k8s-io","list-all-namespaces-networkpolicy-v1-networking-k8s-io","list-networkpolicy-v1-networking-k8s-io","read-networkpolicy-v1-networking-k8s-io","-strong-read-operations-networkpolicy-v1-networking-k8s-io-strong-","delete-collection-networkpolicy-v1-networking-k8s-io","delete-networkpolicy-v1-networking-k8s-io","replace-networkpolicy-v1-networking-k8s-io","patch-networkpolicy-v1-networking-k8s-io","create-networkpolicy-v1-networking-k8s-io","-strong-write-operations-networkpolicy-v1-networking-k8s-io-strong-","networkpolicy-v1-networking-k8s-io","create-tokenreview-v1-authentication-k8s-io","-strong-write-operations-tokenreview-v1-authentication-k8s-io-strong-","tokenreview-v1-authentication-k8s-io","tokenrequest-v1-authentication-k8s-io","create-subjectaccessreview-v1-authorization-k8s-io","-strong-write-operations-subjectaccessreview-v1-authorization-k8s-io-strong-","subjectaccessreview-v1-authorization-k8s-io","replace-status-storageversion-v1alpha1-internal-apiserver-k8s-io","read-status-storageversion-v1alpha1-internal-apiserver-k8s-io","patch-status-storageversion-v1alpha1-internal-apiserver-k8s-io","-strong-status-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","watch-list-storageversion-v1alpha1-internal-apiserver-k8s-io","watch-storageversion-v1alpha1-internal-apiserver-k8s-io","list-storageversion-v1alpha1-internal-apiserver-k8s-io","read-storageversion-v1alpha1-internal-apiserver-k8s-io","-strong-read-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","delete-collection-storageversion-v1alpha1-internal-apiserver-k8s-io","delete-storageversion-v1alpha1-internal-apiserver-k8s-io","replace-storageversion-v1alpha1-internal-apiserver-k8s-io","patch-storageversion-v1alpha1-internal-apiserver-k8s-io","create-storageversion-v1alpha1-internal-apiserver-k8s-io","-strong-write-operations-storageversion-v1alpha1-internal-apiserver-k8s-io-strong-","storageversion-v1alpha1-internal-apiserver-k8s-io","watch-list-all-namespaces-serviceaccount-v1-core","watch-list-serviceaccount-v1-core","watch-serviceaccount-v1-core","list-all-namespaces-serviceaccount-v1-core","list-serviceaccount-v1-core","read-serviceaccount-v1-core","-strong-read-operations-serviceaccount-v1-core-strong-","delete-collection-serviceaccount-v1-core","delete-serviceaccount-v1-core","replace-serviceaccount-v1-core","patch-serviceaccount-v1-core","create-serviceaccount-v1-core","-strong-write-operations-serviceaccount-v1-core-strong-","serviceaccount-v1-core","create-selfsubjectrulesreview-v1-authorization-k8s-io","-strong-write-operations-selfsubjectrulesreview-v1-authorization-k8s-io-strong-","selfsubjectrulesreview-v1-authorization-k8s-io","create-selfsubjectaccessreview-v1-authorization-k8s-io","-strong-write-operations-selfsubjectaccessreview-v1-authorization-k8s-io-strong-","selfsubjectaccessreview-v1-authorization-k8s-io","watch-list-runtimeclass-v1-node-k8s-io","watch-runtimeclass-v1-node-k8s-io","list-runtimeclass-v1-node-k8s-io","read-runtimeclass-v1-node-k8s-io","-strong-read-operations-runtimeclass-v1-node-k8s-io-strong-","delete-collection-runtimeclass-v1-node-k8s-io","delete-runtimeclass-v1-node-k8s-io","replace-runtimeclass-v1-node-k8s-io","patch-runtimeclass-v1-node-k8s-io","create-runtimeclass-v1-node-k8s-io","-strong-write-operations-runtimeclass-v1-node-k8s-io-strong-","runtimeclass-v1-node-k8s-io","watch-list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","watch-list-rolebinding-v1-rbac-authorization-k8s-io","watch-rolebinding-v1-rbac-authorization-k8s-io","list-all-namespaces-rolebinding-v1-rbac-authorization-k8s-io","list-rolebinding-v1-rbac-authorization-k8s-io","read-rolebinding-v1-rbac-authorization-k8s-io","-strong-read-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","delete-collection-rolebinding-v1-rbac-authorization-k8s-io","delete-rolebinding-v1-rbac-authorization-k8s-io","replace-rolebinding-v1-rbac-authorization-k8s-io","patch-rolebinding-v1-rbac-authorization-k8s-io","create-rolebinding-v1-rbac-authorization-k8s-io","-strong-write-operations-rolebinding-v1-rbac-authorization-k8s-io-strong-","rolebinding-v1-rbac-authorization-k8s-io","watch-list-all-namespaces-role-v1-rbac-authorization-k8s-io","watch-list-role-v1-rbac-authorization-k8s-io","watch-role-v1-rbac-authorization-k8s-io","list-all-namespaces-role-v1-rbac-authorization-k8s-io","list-role-v1-rbac-authorization-k8s-io","read-role-v1-rbac-authorization-k8s-io","-strong-read-operations-role-v1-rbac-authorization-k8s-io-strong-","delete-collection-role-v1-rbac-authorization-k8s-io","delete-role-v1-rbac-authorization-k8s-io","replace-role-v1-rbac-authorization-k8s-io","patch-role-v1-rbac-authorization-k8s-io","create-role-v1-rbac-authorization-k8s-io","-strong-write-operations-role-v1-rbac-authorization-k8s-io-strong-","role-v1-rbac-authorization-k8s-io","replace-status-resourcequota-v1-core","read-status-resourcequota-v1-core","patch-status-resourcequota-v1-core","-strong-status-operations-resourcequota-v1-core-strong-","watch-list-all-namespaces-resourcequota-v1-core","watch-list-resourcequota-v1-core","watch-resourcequota-v1-core","list-all-namespaces-resourcequota-v1-core","list-resourcequota-v1-core","read-resourcequota-v1-core","-strong-read-operations-resourcequota-v1-core-strong-","delete-collection-resourcequota-v1-core","delete-resourcequota-v1-core","replace-resourcequota-v1-core","patch-resourcequota-v1-core","create-resourcequota-v1-core","-strong-write-operations-resourcequota-v1-core-strong-","resourcequota-v1-core","replace-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","read-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","patch-status-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-status-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","watch-list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","watch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","list-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","read-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-read-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","delete-collection-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","delete-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","replace-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","patch-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","create-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","-strong-write-operations-prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io-strong-","prioritylevelconfiguration-v1beta1-flowcontrol-apiserver-k8s-io","replace-status-persistentvolume-v1-core","read-status-persistentvolume-v1-core","patch-status-persistentvolume-v1-core","-strong-status-operations-persistentvolume-v1-core-strong-","watch-list-persistentvolume-v1-core","watch-persistentvolume-v1-core","list-persistentvolume-v1-core","read-persistentvolume-v1-core","-strong-read-operations-persistentvolume-v1-core-strong-","delete-collection-persistentvolume-v1-core","delete-persistentvolume-v1-core","replace-persistentvolume-v1-core","patch-persistentvolume-v1-core","create-persistentvolume-v1-core","-strong-write-operations-persistentvolume-v1-core-strong-","persistentvolume-v1-core","replace-connect-proxy-path-node-v1-core","replace-connect-proxy-node-v1-core","head-connect-proxy-path-node-v1-core","head-connect-proxy-node-v1-core","get-connect-proxy-path-node-v1-core","get-connect-proxy-node-v1-core","delete-connect-proxy-path-node-v1-core","delete-connect-proxy-node-v1-core","create-connect-proxy-path-node-v1-core","create-connect-proxy-node-v1-core","-strong-proxy-operations-node-v1-core-strong-","replace-status-node-v1-core","read-status-node-v1-core","patch-status-node-v1-core","-strong-status-operations-node-v1-core-strong-","watch-list-node-v1-core","watch-node-v1-core","list-node-v1-core","read-node-v1-core","-strong-read-operations-node-v1-core-strong-","delete-collection-node-v1-core","delete-node-v1-core","replace-node-v1-core","patch-node-v1-core","create-node-v1-core","-strong-write-operations-node-v1-core-strong-","node-v1-core","replace-status-namespace-v1-core","read-status-namespace-v1-core","patch-status-namespace-v1-core","-strong-status-operations-namespace-v1-core-strong-","watch-list-namespace-v1-core","watch-namespace-v1-core","list-namespace-v1-core","read-namespace-v1-core","-strong-read-operations-namespace-v1-core-strong-","delete-namespace-v1-core","replace-namespace-v1-core","patch-namespace-v1-core","create-namespace-v1-core","-strong-write-operations-namespace-v1-core-strong-","namespace-v1-core","create-localsubjectaccessreview-v1-authorization-k8s-io","-strong-write-operations-localsubjectaccessreview-v1-authorization-k8s-io-strong-","localsubjectaccessreview-v1-authorization-k8s-io","watch-list-all-namespaces-lease-v1-coordination-k8s-io","watch-list-lease-v1-coordination-k8s-io","watch-lease-v1-coordination-k8s-io","list-all-namespaces-lease-v1-coordination-k8s-io","list-lease-v1-coordination-k8s-io","read-lease-v1-coordination-k8s-io","-strong-read-operations-lease-v1-coordination-k8s-io-strong-","delete-collection-lease-v1-coordination-k8s-io","delete-lease-v1-coordination-k8s-io","replace-lease-v1-coordination-k8s-io","patch-lease-v1-coordination-k8s-io","create-lease-v1-coordination-k8s-io","-strong-write-operations-lease-v1-coordination-k8s-io-strong-","lease-v1-coordination-k8s-io","replace-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","read-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","patch-status-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-status-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","watch-list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","watch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","list-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","read-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-read-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","delete-collection-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","delete-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","replace-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","patch-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","create-flowschema-v1beta1-flowcontrol-apiserver-k8s-io","-strong-write-operations-flowschema-v1beta1-flowcontrol-apiserver-k8s-io-strong-","flowschema-v1beta1-flowcontrol-apiserver-k8s-io","list-componentstatus-v1-core","read-componentstatus-v1-core","-strong-read-operations-componentstatus-v1-core-strong-","componentstatus-v1-core","watch-list-clusterrolebinding-v1-rbac-authorization-k8s-io","watch-clusterrolebinding-v1-rbac-authorization-k8s-io","list-clusterrolebinding-v1-rbac-authorization-k8s-io","read-clusterrolebinding-v1-rbac-authorization-k8s-io","-strong-read-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","delete-collection-clusterrolebinding-v1-rbac-authorization-k8s-io","delete-clusterrolebinding-v1-rbac-authorization-k8s-io","replace-clusterrolebinding-v1-rbac-authorization-k8s-io","patch-clusterrolebinding-v1-rbac-authorization-k8s-io","create-clusterrolebinding-v1-rbac-authorization-k8s-io","-strong-write-operations-clusterrolebinding-v1-rbac-authorization-k8s-io-strong-","clusterrolebinding-v1-rbac-authorization-k8s-io","watch-list-clusterrole-v1-rbac-authorization-k8s-io","watch-clusterrole-v1-rbac-authorization-k8s-io","list-clusterrole-v1-rbac-authorization-k8s-io","read-clusterrole-v1-rbac-authorization-k8s-io","-strong-read-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","delete-collection-clusterrole-v1-rbac-authorization-k8s-io","delete-clusterrole-v1-rbac-authorization-k8s-io","replace-clusterrole-v1-rbac-authorization-k8s-io","patch-clusterrole-v1-rbac-authorization-k8s-io","create-clusterrole-v1-rbac-authorization-k8s-io","-strong-write-operations-clusterrole-v1-rbac-authorization-k8s-io-strong-","clusterrole-v1-rbac-authorization-k8s-io","replace-status-certificatesigningrequest-v1-certificates-k8s-io","read-status-certificatesigningrequest-v1-certificates-k8s-io","patch-status-certificatesigningrequest-v1-certificates-k8s-io","-strong-status-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","watch-list-certificatesigningrequest-v1-certificates-k8s-io","watch-certificatesigningrequest-v1-certificates-k8s-io","list-certificatesigningrequest-v1-certificates-k8s-io","read-certificatesigningrequest-v1-certificates-k8s-io","-strong-read-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","delete-collection-certificatesigningrequest-v1-certificates-k8s-io","delete-certificatesigningrequest-v1-certificates-k8s-io","replace-certificatesigningrequest-v1-certificates-k8s-io","patch-certificatesigningrequest-v1-certificates-k8s-io","create-certificatesigningrequest-v1-certificates-k8s-io","-strong-write-operations-certificatesigningrequest-v1-certificates-k8s-io-strong-","certificatesigningrequest-v1-certificates-k8s-io","create-binding-v1-core","-strong-write-operations-binding-v1-core-strong-","binding-v1-core","replace-status-apiservice-v1-apiregistration-k8s-io","read-status-apiservice-v1-apiregistration-k8s-io","patch-status-apiservice-v1-apiregistration-k8s-io","-strong-status-operations-apiservice-v1-apiregistration-k8s-io-strong-","watch-list-apiservice-v1-apiregistration-k8s-io","watch-apiservice-v1-apiregistration-k8s-io","list-apiservice-v1-apiregistration-k8s-io","read-apiservice-v1-apiregistration-k8s-io","-strong-read-operations-apiservice-v1-apiregistration-k8s-io-strong-","delete-collection-apiservice-v1-apiregistration-k8s-io","delete-apiservice-v1-apiregistration-k8s-io","replace-apiservice-v1-apiregistration-k8s-io","patch-apiservice-v1-apiregistration-k8s-io","create-apiservice-v1-apiregistration-k8s-io","-strong-write-operations-apiservice-v1-apiregistration-k8s-io-strong-","apiservice-v1-apiregistration-k8s-io","-strong-cluster-apis-strong-","watch-list-podsecuritypolicy-v1beta1-policy","watch-podsecuritypolicy-v1beta1-policy","list-podsecuritypolicy-v1beta1-policy","read-podsecuritypolicy-v1beta1-policy","-strong-read-operations-podsecuritypolicy-v1beta1-policy-strong-","delete-collection-podsecuritypolicy-v1beta1-policy","delete-podsecuritypolicy-v1beta1-policy","replace-podsecuritypolicy-v1beta1-policy","patch-podsecuritypolicy-v1beta1-policy","create-podsecuritypolicy-v1beta1-policy","-strong-write-operations-podsecuritypolicy-v1beta1-policy-strong-","podsecuritypolicy-v1beta1-policy","watch-list-priorityclass-v1-scheduling-k8s-io","watch-priorityclass-v1-scheduling-k8s-io","list-priorityclass-v1-scheduling-k8s-io","read-priorityclass-v1-scheduling-k8s-io","-strong-read-operations-priorityclass-v1-scheduling-k8s-io-strong-","delete-collection-priorityclass-v1-scheduling-k8s-io","delete-priorityclass-v1-scheduling-k8s-io","replace-priorityclass-v1-scheduling-k8s-io","patch-priorityclass-v1-scheduling-k8s-io","create-priorityclass-v1-scheduling-k8s-io","-strong-write-operations-priorityclass-v1-scheduling-k8s-io-strong-","priorityclass-v1-scheduling-k8s-io","replace-status-poddisruptionbudget-v1-policy","read-status-poddisruptionbudget-v1-policy","patch-status-poddisruptionbudget-v1-policy","-strong-status-operations-poddisruptionbudget-v1-policy-strong-","watch-list-all-namespaces-poddisruptionbudget-v1-policy","watch-list-poddisruptionbudget-v1-policy","watch-poddisruptionbudget-v1-policy","list-all-namespaces-poddisruptionbudget-v1-policy","list-poddisruptionbudget-v1-policy","read-poddisruptionbudget-v1-policy","-strong-read-operations-poddisruptionbudget-v1-policy-strong-","delete-collection-poddisruptionbudget-v1-policy","delete-poddisruptionbudget-v1-policy","replace-poddisruptionbudget-v1-policy","patch-poddisruptionbudget-v1-policy","create-poddisruptionbudget-v1-policy","-strong-write-operations-poddisruptionbudget-v1-policy-strong-","poddisruptionbudget-v1-policy","watch-list-all-namespaces-podtemplate-v1-core","watch-list-podtemplate-v1-core","watch-podtemplate-v1-core","list-all-namespaces-podtemplate-v1-core","list-podtemplate-v1-core","read-podtemplate-v1-core","-strong-read-operations-podtemplate-v1-core-strong-","delete-collection-podtemplate-v1-core","delete-podtemplate-v1-core","replace-podtemplate-v1-core","patch-podtemplate-v1-core","create-podtemplate-v1-core","-strong-write-operations-podtemplate-v1-core-strong-","podtemplate-v1-core","watch-list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","watch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","list-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","read-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-read-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","delete-collection-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","delete-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","replace-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","patch-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","create-validatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-write-operations-validatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","validatingwebhookconfiguration-v1-admissionregistration-k8s-io","watch-list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","watch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","list-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","read-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-read-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","delete-collection-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","delete-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","replace-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","patch-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","create-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","-strong-write-operations-mutatingwebhookconfiguration-v1-admissionregistration-k8s-io-strong-","mutatingwebhookconfiguration-v1-admissionregistration-k8s-io","replace-status-horizontalpodautoscaler-v1-autoscaling","read-status-horizontalpodautoscaler-v1-autoscaling","patch-status-horizontalpodautoscaler-v1-autoscaling","-strong-status-operations-horizontalpodautoscaler-v1-autoscaling-strong-","watch-list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","watch-list-horizontalpodautoscaler-v1-autoscaling","watch-horizontalpodautoscaler-v1-autoscaling","list-all-namespaces-horizontalpodautoscaler-v1-autoscaling","list-horizontalpodautoscaler-v1-autoscaling","read-horizontalpodautoscaler-v1-autoscaling","-strong-read-operations-horizontalpodautoscaler-v1-autoscaling-strong-","delete-collection-horizontalpodautoscaler-v1-autoscaling","delete-horizontalpodautoscaler-v1-autoscaling","replace-horizontalpodautoscaler-v1-autoscaling","patch-horizontalpodautoscaler-v1-autoscaling","create-horizontalpodautoscaler-v1-autoscaling","-strong-write-operations-horizontalpodautoscaler-v1-autoscaling-strong-","horizontalpodautoscaler-v1-autoscaling","watch-list-all-namespaces-limitrange-v1-core","watch-list-limitrange-v1-core","watch-limitrange-v1-core","list-all-namespaces-limitrange-v1-core","list-limitrange-v1-core","read-limitrange-v1-core","-strong-read-operations-limitrange-v1-core-strong-","delete-collection-limitrange-v1-core","delete-limitrange-v1-core","replace-limitrange-v1-core","patch-limitrange-v1-core","create-limitrange-v1-core","-strong-write-operations-limitrange-v1-core-strong-","limitrange-v1-core","watch-list-all-namespaces-event-v1-events-k8s-io","watch-list-event-v1-events-k8s-io","watch-event-v1-events-k8s-io","list-all-namespaces-event-v1-events-k8s-io","list-event-v1-events-k8s-io","read-event-v1-events-k8s-io","-strong-read-operations-event-v1-events-k8s-io-strong-","delete-collection-event-v1-events-k8s-io","delete-event-v1-events-k8s-io","replace-event-v1-events-k8s-io","patch-event-v1-events-k8s-io","create-event-v1-events-k8s-io","-strong-write-operations-event-v1-events-k8s-io-strong-","event-v1-events-k8s-io","replace-status-customresourcedefinition-v1-apiextensions-k8s-io","read-status-customresourcedefinition-v1-apiextensions-k8s-io","patch-status-customresourcedefinition-v1-apiextensions-k8s-io","-strong-status-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","watch-list-customresourcedefinition-v1-apiextensions-k8s-io","watch-customresourcedefinition-v1-apiextensions-k8s-io","list-customresourcedefinition-v1-apiextensions-k8s-io","read-customresourcedefinition-v1-apiextensions-k8s-io","-strong-read-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","delete-collection-customresourcedefinition-v1-apiextensions-k8s-io","delete-customresourcedefinition-v1-apiextensions-k8s-io","replace-customresourcedefinition-v1-apiextensions-k8s-io","patch-customresourcedefinition-v1-apiextensions-k8s-io","create-customresourcedefinition-v1-apiextensions-k8s-io","-strong-write-operations-customresourcedefinition-v1-apiextensions-k8s-io-strong-","customresourcedefinition-v1-apiextensions-k8s-io","watch-list-all-namespaces-controllerrevision-v1-apps","watch-list-controllerrevision-v1-apps","watch-controllerrevision-v1-apps","list-all-namespaces-controllerrevision-v1-apps","list-controllerrevision-v1-apps","read-controllerrevision-v1-apps","-strong-read-operations-controllerrevision-v1-apps-strong-","delete-collection-controllerrevision-v1-apps","delete-controllerrevision-v1-apps","replace-controllerrevision-v1-apps","patch-controllerrevision-v1-apps","create-controllerrevision-v1-apps","-strong-write-operations-controllerrevision-v1-apps-strong-","controllerrevision-v1-apps","-strong-metadata-apis-strong-","replace-status-volumeattachment-v1-storage-k8s-io","read-status-volumeattachment-v1-storage-k8s-io","patch-status-volumeattachment-v1-storage-k8s-io","-strong-status-operations-volumeattachment-v1-storage-k8s-io-strong-","watch-list-volumeattachment-v1-storage-k8s-io","watch-volumeattachment-v1-storage-k8s-io","list-volumeattachment-v1-storage-k8s-io","read-volumeattachment-v1-storage-k8s-io","-strong-read-operations-volumeattachment-v1-storage-k8s-io-strong-","delete-collection-volumeattachment-v1-storage-k8s-io","delete-volumeattachment-v1-storage-k8s-io","replace-volumeattachment-v1-storage-k8s-io","patch-volumeattachment-v1-storage-k8s-io","create-volumeattachment-v1-storage-k8s-io","-strong-write-operations-volumeattachment-v1-storage-k8s-io-strong-","volumeattachment-v1-storage-k8s-io","volume-v1-core","watch-list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","watch-list-csistoragecapacity-v1beta1-storage-k8s-io","watch-csistoragecapacity-v1beta1-storage-k8s-io","list-all-namespaces-csistoragecapacity-v1beta1-storage-k8s-io","list-csistoragecapacity-v1beta1-storage-k8s-io","read-csistoragecapacity-v1beta1-storage-k8s-io","-strong-read-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","delete-collection-csistoragecapacity-v1beta1-storage-k8s-io","delete-csistoragecapacity-v1beta1-storage-k8s-io","replace-csistoragecapacity-v1beta1-storage-k8s-io","patch-csistoragecapacity-v1beta1-storage-k8s-io","create-csistoragecapacity-v1beta1-storage-k8s-io","-strong-write-operations-csistoragecapacity-v1beta1-storage-k8s-io-strong-","csistoragecapacity-v1beta1-storage-k8s-io","watch-list-storageclass-v1-storage-k8s-io","watch-storageclass-v1-storage-k8s-io","list-storageclass-v1-storage-k8s-io","read-storageclass-v1-storage-k8s-io","-strong-read-operations-storageclass-v1-storage-k8s-io-strong-","delete-collection-storageclass-v1-storage-k8s-io","delete-storageclass-v1-storage-k8s-io","replace-storageclass-v1-storage-k8s-io","patch-storageclass-v1-storage-k8s-io","create-storageclass-v1-storage-k8s-io","-strong-write-operations-storageclass-v1-storage-k8s-io-strong-","storageclass-v1-storage-k8s-io","replace-status-persistentvolumeclaim-v1-core","read-status-persistentvolumeclaim-v1-core","patch-status-persistentvolumeclaim-v1-core","-strong-status-operations-persistentvolumeclaim-v1-core-strong-","watch-list-all-namespaces-persistentvolumeclaim-v1-core","watch-list-persistentvolumeclaim-v1-core","watch-persistentvolumeclaim-v1-core","list-all-namespaces-persistentvolumeclaim-v1-core","list-persistentvolumeclaim-v1-core","read-persistentvolumeclaim-v1-core","-strong-read-operations-persistentvolumeclaim-v1-core-strong-","delete-collection-persistentvolumeclaim-v1-core","delete-persistentvolumeclaim-v1-core","replace-persistentvolumeclaim-v1-core","patch-persistentvolumeclaim-v1-core","create-persistentvolumeclaim-v1-core","-strong-write-operations-persistentvolumeclaim-v1-core-strong-","persistentvolumeclaim-v1-core","watch-list-all-namespaces-secret-v1-core","watch-list-secret-v1-core","watch-secret-v1-core","list-all-namespaces-secret-v1-core","list-secret-v1-core","read-secret-v1-core","-strong-read-operations-secret-v1-core-strong-","delete-collection-secret-v1-core","delete-secret-v1-core","replace-secret-v1-core","patch-secret-v1-core","create-secret-v1-core","-strong-write-operations-secret-v1-core-strong-","secret-v1-core","watch-list-csinode-v1-storage-k8s-io","watch-csinode-v1-storage-k8s-io","list-csinode-v1-storage-k8s-io","read-csinode-v1-storage-k8s-io","-strong-read-operations-csinode-v1-storage-k8s-io-strong-","delete-collection-csinode-v1-storage-k8s-io","delete-csinode-v1-storage-k8s-io","replace-csinode-v1-storage-k8s-io","patch-csinode-v1-storage-k8s-io","create-csinode-v1-storage-k8s-io","-strong-write-operations-csinode-v1-storage-k8s-io-strong-","csinode-v1-storage-k8s-io","watch-list-csidriver-v1-storage-k8s-io","watch-csidriver-v1-storage-k8s-io","list-csidriver-v1-storage-k8s-io","read-csidriver-v1-storage-k8s-io","-strong-read-operations-csidriver-v1-storage-k8s-io-strong-","delete-collection-csidriver-v1-storage-k8s-io","delete-csidriver-v1-storage-k8s-io","replace-csidriver-v1-storage-k8s-io","patch-csidriver-v1-storage-k8s-io","create-csidriver-v1-storage-k8s-io","-strong-write-operations-csidriver-v1-storage-k8s-io-strong-","csidriver-v1-storage-k8s-io","watch-list-all-namespaces-configmap-v1-core","watch-list-configmap-v1-core","watch-configmap-v1-core","list-all-namespaces-configmap-v1-core","list-configmap-v1-core","read-configmap-v1-core","-strong-read-operations-configmap-v1-core-strong-","delete-collection-configmap-v1-core","delete-configmap-v1-core","replace-configmap-v1-core","patch-configmap-v1-core","create-configmap-v1-core","-strong-write-operations-configmap-v1-core-strong-","configmap-v1-core","-strong-config-and-storage-apis-strong-","replace-connect-proxy-path-service-v1-core","replace-connect-proxy-service-v1-core","head-connect-proxy-path-service-v1-core","head-connect-proxy-service-v1-core","get-connect-proxy-path-service-v1-core","get-connect-proxy-service-v1-core","delete-connect-proxy-path-service-v1-core","delete-connect-proxy-service-v1-core","create-connect-proxy-path-service-v1-core","create-connect-proxy-service-v1-core","-strong-proxy-operations-service-v1-core-strong-","replace-status-service-v1-core","read-status-service-v1-core","patch-status-service-v1-core","-strong-status-operations-service-v1-core-strong-","watch-list-all-namespaces-service-v1-core","watch-list-service-v1-core","watch-service-v1-core","list-all-namespaces-service-v1-core","list-service-v1-core","read-service-v1-core","-strong-read-operations-service-v1-core-strong-","delete-collection-service-v1-core","delete-service-v1-core","replace-service-v1-core","patch-service-v1-core","create-service-v1-core","-strong-write-operations-service-v1-core-strong-","service-v1-core","watch-list-ingressclass-v1-networking-k8s-io","watch-ingressclass-v1-networking-k8s-io","list-ingressclass-v1-networking-k8s-io","read-ingressclass-v1-networking-k8s-io","-strong-read-operations-ingressclass-v1-networking-k8s-io-strong-","delete-collection-ingressclass-v1-networking-k8s-io","delete-ingressclass-v1-networking-k8s-io","replace-ingressclass-v1-networking-k8s-io","patch-ingressclass-v1-networking-k8s-io","create-ingressclass-v1-networking-k8s-io","-strong-write-operations-ingressclass-v1-networking-k8s-io-strong-","ingressclass-v1-networking-k8s-io","replace-status-ingress-v1-networking-k8s-io","read-status-ingress-v1-networking-k8s-io","patch-status-ingress-v1-networking-k8s-io","-strong-status-operations-ingress-v1-networking-k8s-io-strong-","watch-list-all-namespaces-ingress-v1-networking-k8s-io","watch-list-ingress-v1-networking-k8s-io","watch-ingress-v1-networking-k8s-io","list-all-namespaces-ingress-v1-networking-k8s-io","list-ingress-v1-networking-k8s-io","read-ingress-v1-networking-k8s-io","-strong-read-operations-ingress-v1-networking-k8s-io-strong-","delete-collection-ingress-v1-networking-k8s-io","delete-ingress-v1-networking-k8s-io","replace-ingress-v1-networking-k8s-io","patch-ingress-v1-networking-k8s-io","create-ingress-v1-networking-k8s-io","-strong-write-operations-ingress-v1-networking-k8s-io-strong-","ingress-v1-networking-k8s-io","watch-list-all-namespaces-endpointslice-v1-discovery-k8s-io","watch-list-endpointslice-v1-discovery-k8s-io","watch-endpointslice-v1-discovery-k8s-io","list-all-namespaces-endpointslice-v1-discovery-k8s-io","list-endpointslice-v1-discovery-k8s-io","read-endpointslice-v1-discovery-k8s-io","-strong-read-operations-endpointslice-v1-discovery-k8s-io-strong-","delete-collection-endpointslice-v1-discovery-k8s-io","delete-endpointslice-v1-discovery-k8s-io","replace-endpointslice-v1-discovery-k8s-io","patch-endpointslice-v1-discovery-k8s-io","create-endpointslice-v1-discovery-k8s-io","-strong-write-operations-endpointslice-v1-discovery-k8s-io-strong-","endpointslice-v1-discovery-k8s-io","watch-list-all-namespaces-endpoints-v1-core","watch-list-endpoints-v1-core","watch-endpoints-v1-core","list-all-namespaces-endpoints-v1-core","list-endpoints-v1-core","read-endpoints-v1-core","-strong-read-operations-endpoints-v1-core-strong-","delete-collection-endpoints-v1-core","delete-endpoints-v1-core","replace-endpoints-v1-core","patch-endpoints-v1-core","create-endpoints-v1-core","-strong-write-operations-endpoints-v1-core-strong-","endpoints-v1-core","-strong-service-apis-strong-","patch-scale-statefulset-v1-apps","replace-scale-statefulset-v1-apps","read-scale-statefulset-v1-apps","-strong-misc-operations-statefulset-v1-apps-strong-","replace-status-statefulset-v1-apps","read-status-statefulset-v1-apps","patch-status-statefulset-v1-apps","-strong-status-operations-statefulset-v1-apps-strong-","watch-list-all-namespaces-statefulset-v1-apps","watch-list-statefulset-v1-apps","watch-statefulset-v1-apps","list-all-namespaces-statefulset-v1-apps","list-statefulset-v1-apps","read-statefulset-v1-apps","-strong-read-operations-statefulset-v1-apps-strong-","delete-collection-statefulset-v1-apps","delete-statefulset-v1-apps","replace-statefulset-v1-apps","patch-statefulset-v1-apps","create-statefulset-v1-apps","-strong-write-operations-statefulset-v1-apps-strong-","statefulset-v1-apps","patch-scale-replicationcontroller-v1-core","replace-scale-replicationcontroller-v1-core","read-scale-replicationcontroller-v1-core","-strong-misc-operations-replicationcontroller-v1-core-strong-","replace-status-replicationcontroller-v1-core","read-status-replicationcontroller-v1-core","patch-status-replicationcontroller-v1-core","-strong-status-operations-replicationcontroller-v1-core-strong-","watch-list-all-namespaces-replicationcontroller-v1-core","watch-list-replicationcontroller-v1-core","watch-replicationcontroller-v1-core","list-all-namespaces-replicationcontroller-v1-core","list-replicationcontroller-v1-core","read-replicationcontroller-v1-core","-strong-read-operations-replicationcontroller-v1-core-strong-","delete-collection-replicationcontroller-v1-core","delete-replicationcontroller-v1-core","replace-replicationcontroller-v1-core","patch-replicationcontroller-v1-core","create-replicationcontroller-v1-core","-strong-write-operations-replicationcontroller-v1-core-strong-","replicationcontroller-v1-core","patch-scale-replicaset-v1-apps","replace-scale-replicaset-v1-apps","read-scale-replicaset-v1-apps","-strong-misc-operations-replicaset-v1-apps-strong-","replace-status-replicaset-v1-apps","read-status-replicaset-v1-apps","patch-status-replicaset-v1-apps","-strong-status-operations-replicaset-v1-apps-strong-","watch-list-all-namespaces-replicaset-v1-apps","watch-list-replicaset-v1-apps","watch-replicaset-v1-apps","list-all-namespaces-replicaset-v1-apps","list-replicaset-v1-apps","read-replicaset-v1-apps","-strong-read-operations-replicaset-v1-apps-strong-","delete-collection-replicaset-v1-apps","delete-replicaset-v1-apps","replace-replicaset-v1-apps","patch-replicaset-v1-apps","create-replicaset-v1-apps","-strong-write-operations-replicaset-v1-apps-strong-","replicaset-v1-apps","read-log-pod-v1-core","-strong-misc-operations-pod-v1-core-strong-","replace-connect-proxy-path-pod-v1-core","replace-connect-proxy-pod-v1-core","head-connect-proxy-path-pod-v1-core","head-connect-proxy-pod-v1-core","get-connect-proxy-path-pod-v1-core","get-connect-proxy-pod-v1-core","get-connect-portforward-pod-v1-core","delete-connect-proxy-path-pod-v1-core","delete-connect-proxy-pod-v1-core","create-connect-proxy-path-pod-v1-core","create-connect-proxy-pod-v1-core","create-connect-portforward-pod-v1-core","-strong-proxy-operations-pod-v1-core-strong-","replace-ephemeralcontainers-pod-v1-core","read-ephemeralcontainers-pod-v1-core","patch-ephemeralcontainers-pod-v1-core","-strong-ephemeralcontainers-operations-pod-v1-core-strong-","replace-status-pod-v1-core","read-status-pod-v1-core","patch-status-pod-v1-core","-strong-status-operations-pod-v1-core-strong-","watch-list-all-namespaces-pod-v1-core","watch-list-pod-v1-core","watch-pod-v1-core","list-all-namespaces-pod-v1-core","list-pod-v1-core","read-pod-v1-core","-strong-read-operations-pod-v1-core-strong-","delete-collection-pod-v1-core","delete-pod-v1-core","replace-pod-v1-core","patch-pod-v1-core","create-eviction-pod-v1-core","create-pod-v1-core","-strong-write-operations-pod-v1-core-strong-","pod-v1-core","replace-status-job-v1-batch","read-status-job-v1-batch","patch-status-job-v1-batch","-strong-status-operations-job-v1-batch-strong-","watch-list-all-namespaces-job-v1-batch","watch-list-job-v1-batch","watch-job-v1-batch","list-all-namespaces-job-v1-batch","list-job-v1-batch","read-job-v1-batch","-strong-read-operations-job-v1-batch-strong-","delete-collection-job-v1-batch","delete-job-v1-batch","replace-job-v1-batch","patch-job-v1-batch","create-job-v1-batch","-strong-write-operations-job-v1-batch-strong-","job-v1-batch","patch-scale-deployment-v1-apps","replace-scale-deployment-v1-apps","read-scale-deployment-v1-apps","-strong-misc-operations-deployment-v1-apps-strong-","replace-status-deployment-v1-apps","read-status-deployment-v1-apps","patch-status-deployment-v1-apps","-strong-status-operations-deployment-v1-apps-strong-","watch-list-all-namespaces-deployment-v1-apps","watch-list-deployment-v1-apps","watch-deployment-v1-apps","list-all-namespaces-deployment-v1-apps","list-deployment-v1-apps","read-deployment-v1-apps","-strong-read-operations-deployment-v1-apps-strong-","delete-collection-deployment-v1-apps","delete-deployment-v1-apps","replace-deployment-v1-apps","patch-deployment-v1-apps","create-deployment-v1-apps","-strong-write-operations-deployment-v1-apps-strong-","deployment-v1-apps","replace-status-daemonset-v1-apps","read-status-daemonset-v1-apps","patch-status-daemonset-v1-apps","-strong-status-operations-daemonset-v1-apps-strong-","watch-list-all-namespaces-daemonset-v1-apps","watch-list-daemonset-v1-apps","watch-daemonset-v1-apps","list-all-namespaces-daemonset-v1-apps","list-daemonset-v1-apps","read-daemonset-v1-apps","-strong-read-operations-daemonset-v1-apps-strong-","delete-collection-daemonset-v1-apps","delete-daemonset-v1-apps","replace-daemonset-v1-apps","patch-daemonset-v1-apps","create-daemonset-v1-apps","-strong-write-operations-daemonset-v1-apps-strong-","daemonset-v1-apps","replace-status-cronjob-v1-batch","read-status-cronjob-v1-batch","patch-status-cronjob-v1-batch","-strong-status-operations-cronjob-v1-batch-strong-","watch-list-all-namespaces-cronjob-v1-batch","watch-list-cronjob-v1-batch","watch-cronjob-v1-batch","list-all-namespaces-cronjob-v1-batch","list-cronjob-v1-batch","read-cronjob-v1-batch","-strong-read-operations-cronjob-v1-batch-strong-","delete-collection-cronjob-v1-batch","delete-cronjob-v1-batch","replace-cronjob-v1-batch","patch-cronjob-v1-batch","create-cronjob-v1-batch","-strong-write-operations-cronjob-v1-batch-strong-","cronjob-v1-batch","container-v1-core","-strong-workloads-apis-strong-","-strong-api-groups-strong-","-strong-api-overview-strong-"]};})(); \ No newline at end of file From c79d213abc14c10277c864980d0bbcb5ccee205c Mon Sep 17 00:00:00 2001 From: Jim Angel Date: Mon, 15 Nov 2021 21:37:51 -0600 Subject: [PATCH 138/148] adding blog and correcting 1.23 docs Co-authored-by: Lachlan Evenson --- .../2021-12-09-pod-security-admission-beta.md | 782 ++++++++++++++++++ 1 file changed, 782 insertions(+) create mode 100644 content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md diff --git a/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md b/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md new file mode 100644 index 0000000000..ae4de7ad25 --- /dev/null +++ b/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md @@ -0,0 +1,782 @@ +--- +layout: blog +title: 'Pod Security Graduates to Beta' +date: 2021-12-09 +slug: pod-security-admission-beta +--- + +**Authors:** Jim Angel (Google), Lachlan Evenson (Microsoft) + +With the release of Kubernetes v1.23, [Pod Security admission](/docs/concepts/security/pod-security-admission/) has now entered beta. Pod Security is a [built-in](/docs/reference/access-authn-authz/admission-controllers/) admission controller that evaluates pod specifications against a predefined set of [Pod Security Standards](/docs/concepts/security/pod-security-standards/) and determines whether to `admit` or `deny` the pod from running. + +Pod Security is the successor to [PodSecurityPolicy](/docs/concepts/policy/pod-security-policy/) which was deprecated in the v1.21 release, and will be removed in Kubernetes v1.25. In this article, we cover the key concepts of Pod Security along with how to use it. We hope that cluster administrators and developers alike will use this new mechanism to enforce secure defaults for their workloads. + +## Why Pod Security + +The overall aim of Pod Security is to let you isolate workloads. You can run a cluster that runs different workloads and, without adding extra third-party tooling, implement controls that require Pods for a workload to restrict their own privileges to a defined bounding set. + +Pod Security overcomes key shortcomings of Kubernetes' existing, but deprecated, PodSecurityPolicy (PSP) mechanism: + + * Policy authorization model — challenging to deploy with controllers. + * Risks around switching — a lack of dry-run/audit capabilities made it hard to enable PodSecurityPolicy. + * Inconsistent and Unbounded API — the large configuration surface and evolving constraints led to a complex and confusing API. + +The shortcomings of PSP made it very difficult to use which led the community to reevaluate whether or not a better implementation could achieve the same goals. One of those goals was to provide an out-of-the-box solution to apply security best practices. Pod Security ships with predefined Pod Security levels that a cluster administrator can configure to meet the desired security posture. + +It's important to note that Pod Security doesn't have complete feature parity with the deprecated PodSecurityPolicy. Specifically, it doesn't have the ability to mutate or change Kubernetes resources to auto-remediate a policy violation on behalf of the user. Additionally, it doesn't provide fine-grained control over each allowed field and value within a pod specification or any other Kubernetes resource that you may wish to evaluate. If you need more fine-grained policy control then take a look at these [other](/docs/concepts/security/pod-security-standards/#faq) projects which support such use cases. + +Pod Security also adheres to Kubernetes best practices of declarative object management by denying resources that violate the policy. This requires resources to be updated in source repositories, and tooling to be updated prior to being deployed to Kubernetes. + +## How Does Pod Security Work? + +Pod Security is a built-in [admission controller](/docs/reference/access-authn-authz/admission-controllers/) starting with Kubernetes v1.22, but can also be run as a standalone [webhook](/docs/concepts/security/pod-security-admission/#webhook). Admission controllers function by intercepting requests in the Kubernetes API server prior to persistence to storage. They can either `admit` or `deny` a request. In the case of Pod Security, pod specifications will be evaluated against a configured policy in the form of a Pod Security Standard. This means that security sensitive fields in a pod specification will only be allowed to have [specific](h/docs/concepts/security/pod-security-standards/#profile-details) values. + +## Configuring Pod Security + +### Pod Security Standards + +In order to use Pod Security we first need to understand [Pod Security Standards](/docs/concepts/security/pod-security-standards/). These standards define three different policy levels that range from permissive to restrictive. These levels are as follows: + * `privileged` — open and unrestricted + * `baseline` — Covers known privilege escalations while minimizing restrictions + * `restricted` — Highly restricted, hardening against known and unknown privilege escalations. May cause compatibility issues + +Each of these policy levels define which fields are restricted within a pod specification and the allowed values. Some of the fields restricted by these policies include: + * `spec.securityContext.sysctls` + * `spec.hostNetwork` + * `spec.volumes[*].hostPath` + * `spec.containers[*].securityContext.privileged` + +Policy levels are applied via labels on Namespace resources, which allows for granular per-namespace policy selection. The AdmissionConfiguration in the API server can also be configured to set cluster-wide default levels and exemptions. + +### Policy modes + +Policies are applied in a specific mode. Multiple modes (with different policy levels) can be set on the same namespace. Here is a list of modes: + * `enforce` — Any Pods that violate the policy will be rejected + * `audit` — Violations will be recorded as an annotation in the audit logs, but don't affect whether the pod is allowed. + * `warn` — Violations will send a warning message back to the user, but don't affect whether the pod is allowed. + +In addition to modes you can also pin the policy to a specific version (for example v1.22). Pinning to a specific version allows the behavior to remain consistent if the policy definition changes in future Kubernetes releases. + +## Hands on demo + +### Prerequisites + +- [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) +- [kubectl](/docs/tasks/tools/) +- [Docker](https://docs.docker.com/get-docker/) or [Podman](https://podman.io/getting-started/installation) container runtime & CLI + +### Deploy a kind cluster + +```shell +kind create cluster --image kindest/node:v1.23.0 +``` + +It might take a while to start and once it's started it might take a minute or so before the node becomes ready. + +```shell +kubectl cluster-info --context kind-kind +``` + +Wait for the node STATUS to become ready. + +```shell +kubectl get nodes +``` + +The output is similar to this: + +``` +NAME STATUS ROLES AGE VERSION +kind-control-plane Ready control-plane,master 54m v1.23.0 +``` + +### Confirm Pod Security is enabled + +The best way to [confirm the API's default enabled plugins](/docs/reference/access-authn-authz/admission-controllers/#which-plugins-are-enabled-by-default) is to check the Kubernetes API container's help arguments. + +```shell +kubectl -n kube-system exec kube-apiserver-kind-control-plane -it -- kube-apiserver -h | grep "default enabled ones" +``` + +The output is similar to this: + +``` +... + --enable-admission-plugins strings +admission plugins that should be enabled in addition +to default enabled ones (NamespaceLifecycle, LimitRanger, +ServiceAccount, TaintNodesByCondition, PodSecurity, Priority, +DefaultTolerationSeconds, DefaultStorageClass, +StorageObjectInUseProtection, PersistentVolumeClaimResize, +RuntimeClass, CertificateApproval, CertificateSigning, +CertificateSubjectRestriction, DefaultIngressClass, +MutatingAdmissionWebhook, ValidatingAdmissionWebhook, +ResourceQuota). +... +``` + +`PodSecurity` is listed in the group of default enabled admission plugins. + +If using a cloud provider, or if you don't have access to the API server, the best way to check would be to run a quick end-to-end test: + +```shell +kubectl create namespace verify-pod-security +kubectl label namespace verify-pod-security pod-security.kubernetes.io/enforce=restricted +# The following command does NOT create a workload (--dry-run=server) +kubectl -n verify-pod-security run test --dry-run=server --image=busybox --privileged +kubectl delete namespace verify-pod-security +``` + +The output is similar to this: + +``` +Error from server (Forbidden): pods "test" is forbidden: violates PodSecurity "restricted:latest": privileged (container "test" must not set securityContext.privileged=true), allowPrivilegeEscalation != false (container "test" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "test" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "test" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "test" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") +``` + +### Configure Pod Security + +Policies are applied to a namespace via labels. These labels are as follows: + * `pod-security.kubernetes.io/: ` (required to enable pod security) + * `pod-security.kubernetes.io/-version: ` (*optional*, defaults to latest) + +A specific version can be supplied for each enforcement mode. The version pins the policy to the version that was shipped as part of the Kubernetes release. Pinning to a specific Kubernetes version allows for deterministic policy behavior while allowing flexibility for future updates to Pod Security Standards. The possible are `enforce`, `audit` and `warn`. + +### When to use `warn`? + +The typical uses for `warn` are to get ready for a future change where you want to enforce a different policy. The most two common cases would be: + +* `warn` at the same level but a different version (e.g. pin `enforce` to *restricted+v1.23* and `warn` at *restricted+latest*) +* `warn` at a stricter level (e.g. `enforce` baseline, `warn` restricted) + +It's not recommended to use `warn` for the exact same level+version of the policy as `enforce`. In the admission sequence, if `enforce` fails, the entire sequence fails before evaluating the `warn`. + +First, create a namespace called `verify-pod-security` if not created earlier. For the demo, `--overwrite` is used when labeling to allow repurposing a single namespace for multiple examples. + +```shell +kubectl create namespace verify-pod-security +``` + +### Deploy demo workloads + +Each workload represents a higher level of security that would not pass the profile that comes after it. + +For the following examples, use the `busybox` container runs a `sleep` command for 1 million seconds (≅11 days) or until deleted. Pod Security is not interested in which container image you chose, but rather the Pod level settings and their implications for security. + +### Privileged level and workload + +For the privileged pod, use the [privileged policy](/docs/concepts/security/pod-security-standards/#privileged). This allows the process inside a container to gain new processes (also known as "privilege escalation") and can be dangerous if untrusted. + +First, let's apply a restricted Pod Security level for a test. + +```shell +# enforces a "restricted" security policy and audits on restricted +kubectl label --overwrite ns verify-pod-security \ + pod-security.kubernetes.io/enforce=restricted \ + pod-security.kubernetes.io/audit=restricted +``` + +Next, try to deploy a privileged workload in the namespace. + +```shell +cat < +``` + +### Applying a cluster-wide policy + +In addition to applying labels to namespaces to configure policy you can also configure cluster-wide policies and exemptions using the AdmissionConfiguration resource. + +Using this resource, policy definitions are applied cluster-wide by default and any policy that is applied via namespace labels will take precedence. + +There is no runtime configurable API for the `AdmissionConfiguration` configuration file so a cluster administrator would need to specify a path to the file below via the `--admission-control-config-file` flag on the API server. + +In the following resource we are enforcing the baseline policy and warning and auditing the baseline policy. We are also making the kube-system namespace exempt from this policy. + +It's not recommended to alter control plane / clusters after install, so let's build a new cluster with a default policy on all namespaces. + +First, delete the current cluster. + +```shell +kind delete cluster +``` + +Create a Pod Security configuration that `enforce` and `audit` baseline policies while using a restricted profile to `warn` the end user. + +```shell +cat < pod-security.yaml +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- name: PodSecurity + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1beta1 + kind: PodSecurityConfiguration + defaults: + enforce: "baseline" + enforce-version: "latest" + audit: "baseline" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" + exemptions: + # Array of authenticated usernames to exempt. + usernames: [] + # Array of runtime class names to exempt. + runtimeClasses: [] + # Array of namespaces to exempt. + namespaces: [kube-system] +EOF +``` + +For additional options, check out the official [_standards admission controller_](/docs/tasks/configure-pod-container/enforce-standards-admission-controller/#configure-the-admission-controller) docs. + +We now have a default baseline policy. Next pass it to the kind configuration to enable the `--admission-control-config-file` API server argument and pass the policy file. To pass a file to a kind cluster, use a configuration file to pass additional setup instructions. Kind uses `kubeadm` to provision the cluster and the configuration file has the ability to pass `kubeadmConfigPatches` for further customization. In our case, the local file is mounted into the control plane node as `/etc/kubernetes/policies/pod-security.yaml` which is then mounted into the `apiServer` container. We also pass the `--admission-control-config-file` argument pointing to the policy's location. + +```shell +cat < kind-config.yaml +kind: Cluster +apiVersion: kind.x-k8s.io/v1alpha4 +nodes: +- role: control-plane + kubeadmConfigPatches: + - | + kind: ClusterConfiguration + apiServer: + # enable admission-control-config flag on the API server + extraArgs: + admission-control-config-file: /etc/kubernetes/policies/pod-security.yaml + # mount new file / directories on the control plane + extraVolumes: + - name: policies + hostPath: /etc/kubernetes/policies + mountPath: /etc/kubernetes/policies + readOnly: true + pathType: "DirectoryOrCreate" + # mount the local file on the control plane + extraMounts: + - hostPath: ./pod-security.yaml + containerPath: /etc/kubernetes/policies/pod-security.yaml + readOnly: true +EOF +``` + +Create a new cluster using the kind configuration file defined above. + +```shell +kind create cluster --image kindest/node:v1.23.0 --config kind-config.yaml +``` + +Let's look at the default namespace. + +```shell +kubectl describe namespace default +``` + +The output is similar to this: + +``` +Name: default +Labels: kubernetes.io/metadata.name=default +Annotations: +Status: Active + +No resource quota. + +No LimitRange resource. +``` + +Let's create a new namespace and see if the labels apply there. + +```shell +kubectl create namespace test-defaults +kubectl describe namespace test-defaults +``` + +Same. + +``` +Name: test-defaults +Labels: kubernetes.io/metadata.name=test-defaults +Annotations: +Status: Active + +No resource quota. + +No LimitRange resource. +``` + +Can a privileged workload be deployed? + +```shell +cat < Date: Wed, 8 Dec 2021 00:30:21 +0000 Subject: [PATCH 139/148] Custom style for release logos You can now use a figure shortcode to mark a release logo and get appropriate styles. --- assets/scss/_custom.scss | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/assets/scss/_custom.scss b/assets/scss/_custom.scss index 5189b5da79..71f61c6ada 100644 --- a/assets/scss/_custom.scss +++ b/assets/scss/_custom.scss @@ -7,7 +7,7 @@ $announcement-size-adjustment: 8px; } main { - img { + *:not(figure) > img { max-width: 100%; } @@ -698,6 +698,26 @@ body.td-documentation { } } +figure { + > figcaption { + padding-top: 1em; + margin-bottom: 3em; + } +} + +// Clamp size for release logos +figure.release-logo { + > figcaption { + font-size: 1.8em; + } + > img { + max-width: 100%; + max-height: calc(max(40em,min(80vh,70em))); + height: auto; + width: auto; + } +} + // Match Docsy-imposed max width on text body @media (min-width: 1200px) { From 2782b1ef8ffbb42ccae90d3a4e40f76b801789e4 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Wed, 8 Dec 2021 00:31:13 +0000 Subject: [PATCH 140/148] Update v1.23 release article to use logo styles --- content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md b/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md index edffcefce6..32336dd2d8 100644 --- a/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md +++ b/content/en/blog/_posts/2021-12-07-kubernetes-release-1.23.md @@ -123,9 +123,10 @@ A huge thank you to the release lead Rey Lejano for leading us through a success ### Release Theme and Logo -Kubernetes 1.23: The Next Frontier +**Kubernetes 1.23: The Next Frontier** + +{{< figure src="/images/blog/2021-12-07-kubernetes-release-1.23/kubernetes-1.23.png" alt="" class="release-logo" >}} -![Kubernetes 1.23 Release Logo](/images/blog/2021-12-07-kubernetes-release-1.23/kubernetes-1.23.png) "The Next Frontier" theme represents the new and graduated enhancements in 1.23, Kubernetes' history of Star Trek references, and the growth of community members in the release team. From f51716ce294eb5650886f244e014e3a4097e376d Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Wed, 8 Dec 2021 09:52:24 +0800 Subject: [PATCH 141/148] Component reference for v1.23 --- .../kube-apiserver.md | 90 ++-------- .../kube-controller-manager.md | 101 ++--------- .../kube-proxy.md | 114 ++----------- .../kube-scheduler.md | 159 +++--------------- 4 files changed, 57 insertions(+), 407 deletions(-) diff --git a/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md b/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md index 77b354dc70..cf751f5d05 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-apiserver.md @@ -39,13 +39,6 @@ kube-apiserver [flags] - ---add-dir-header - - -

    If true, adds the file directory to the header of the log messages

    - - --admission-control-config-file string @@ -74,13 +67,6 @@ kube-apiserver [flags]

    If true, allow privileged containers. [default=false]

    - ---alsologtostderr - - -

    log to standard error as well as files

    - - --anonymous-auth     Default: true @@ -169,7 +155,7 @@ kube-apiserver [flags] --audit-log-maxbackup int -

    The maximum number of old audit log files to retain.

    +

    The maximum number of old audit log files to retain. Setting a value of 0 will mean there's no restriction on the number of files.

    @@ -638,7 +624,7 @@ kube-apiserver [flags] --feature-gates <comma-separated 'key=True|False' pairs> -

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (ALPHA - default=false)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (ALPHA - default=false)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=false)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    IngressClassNamespacedParams=true|false (BETA - default=true)
    JobTrackingWithFinalizers=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (ALPHA - default=false)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetMinReadySeconds=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
    CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (BETA - default=true)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=true)
    CSIMigrationAzureDisk=true|false (BETA - default=true)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=true)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationPortworx=true|false (ALPHA - default=false)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    CustomResourceValidationExpressions=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (BETA - default=true)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DisableKubeletCloudCredentialProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=true)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (BETA - default=true)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GRPCContainerProbe=true|false (ALPHA - default=false)
    GracefulNodeShutdown=true|false (BETA - default=true)
    GracefulNodeShutdownBasedOnPodPriority=true|false (ALPHA - default=false)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    HonorPVReclaimPolicy=true|false (ALPHA - default=false)
    IdentifyPodOS=true|false (ALPHA - default=false)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
    InTreePluginRBDUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    JobMutableNodeSchedulingDirectives=true|false (BETA - default=true)
    JobReadyPods=true|false (ALPHA - default=false)
    JobTrackingWithFinalizers=true|false (BETA - default=true)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (BETA - default=true)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    OpenAPIEnums=true|false (ALPHA - default=false)
    OpenAPIV3=true|false (ALPHA - default=false)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (BETA - default=true)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServerSideFieldValidation=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetAutoDeletePVC=true|false (ALPHA - default=false)
    StatefulSetMinReadySeconds=true|false (BETA - default=true)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TopologyAwareHints=true|false (BETA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (BETA - default=true)
    csiMigrationRBD=true|false (ALPHA - default=false)

    @@ -732,34 +718,6 @@ kube-apiserver [flags]

    This option represents the maximum amount of time it should take for apiserver to complete its startup sequence and become live. From apiserver's start time to when this amount of time has elapsed, /livez will assume that unfinished post-start hooks will complete successfully and therefore return true.

    - ---log-backtrace-at <a string in the form 'file:N'>     Default: :0 - - -

    when logging hits line file:N, emit a stack trace

    - - - ---log-dir string - - -

    If non-empty, write log files in this directory

    - - - ---log-file string - - -

    If non-empty, use this log file

    - - - ---log-file-max-size uint     Default: 1800 - - -

    Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited.

    - - --log-flush-frequency duration     Default: 5s @@ -771,14 +729,7 @@ kube-apiserver [flags] --logging-format string     Default: "text" -

    Sets the log format. Permitted formats: "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule, --log-flush-frequency.
    Non-default choices are currently alpha and subject to change without warning.

    - - - ---logtostderr     Default: true - - -

    log to standard error instead of files

    +

    Sets the log format. Permitted formats: "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule.
    Non-default choices are currently alpha and subject to change without warning.

    @@ -862,7 +813,7 @@ kube-apiserver [flags] --oidc-signing-algs strings     Default: "RS256" -

    Comma-separated list of allowed JOSE asymmetric signing algorithms. JWTs with a 'alg' header value not in this list will be rejected. Values are defined by RFC 7518 https://tools.ietf.org/html/rfc7518#section-3.1.

    +

    Comma-separated list of allowed JOSE asymmetric signing algorithms. JWTs with a supported 'alg' header values are: RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512. Values are defined by RFC 7518 https://tools.ietf.org/html/rfc7518#section-3.1.

    @@ -879,13 +830,6 @@ kube-apiserver [flags]

    If provided, all usernames will be prefixed with this value. If not provided, username claims other than 'email' are prefixed by the issuer URL to avoid clashes. To skip any prefixing, provide the value '-'.

    - ---one-output - - -

    If true, only write logs to their native severity level (vs also writing to each lower severity level)

    - - --permit-address-sharing @@ -995,7 +939,7 @@ kube-apiserver [flags] --service-account-jwks-uri string -

    Overrides the URI for the JSON Web Key Set in the discovery doc served at /.well-known/openid-configuration. This flag is useful if the discovery docand key set are served to relying parties from a URL other than the API server's external (as auto-detected or overridden with external-hostname). Only valid if the ServiceAccountIssuerDiscovery feature gate is enabled.

    +

    Overrides the URI for the JSON Web Key Set in the discovery doc served at /.well-known/openid-configuration. This flag is useful if the discovery docand key set are served to relying parties from a URL other than the API server's external (as auto-detected or overridden with external-hostname).

    @@ -1055,24 +999,10 @@ kube-apiserver [flags] ---skip-headers +--shutdown-send-retry-after -

    If true, avoid header prefixes in the log messages

    - - - ---skip-log-headers - - -

    If true, avoid headers when opening log files

    - - - ---stderrthreshold int     Default: 2 - - -

    logs at or above this threshold go to stderr

    +

    If true the HTTP Server will continue listening until all non long running request(s) in flight have been drained, during this window all incoming requests will be rejected with a status code 429 and a 'Retry-After' response header, in addition 'Connection: close' response header is set in order to tear down the TCP connection when idle.

    @@ -1107,7 +1037,7 @@ kube-apiserver [flags] --tls-cipher-suites strings -

    Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.
    Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384.
    Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA.

    +

    Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.
    Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384.
    Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA.

    @@ -1160,10 +1090,10 @@ kube-apiserver [flags] ---vmodule <comma-separated 'pattern=N' settings> +--vmodule pattern=N,... -

    comma-separated list of pattern=N settings for file-filtered logging

    +

    comma-separated list of pattern=N settings for file-filtered logging (only works for text log format)

    diff --git a/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md b/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md index a8389c69f0..6f1f3489a0 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-controller-manager.md @@ -43,13 +43,6 @@ kube-controller-manager [flags] - ---add-dir-header - - -

    If true, adds the file directory to the header of the log messages

    - - --allocate-node-cidrs @@ -64,13 +57,6 @@ kube-controller-manager [flags]

    The map from metric-label to value allow-list of this label. The key's format is <MetricName>,<LabelName>. The value's format is <allowed_value>,<allowed_value>...e.g. metric1,label1='v1,v2,v3', metric1,label2='v1,v2,v3' metric2,label1='v1,v2,v3'.

    - ---alsologtostderr - - -

    log to standard error as well as files

    - - --attach-detach-reconcile-sync-period duration     Default: 1m0s @@ -288,6 +274,13 @@ kube-controller-manager [flags]

    The number of endpoint syncing operations that will be done concurrently. Larger number = faster endpoint updating, but more CPU (and network) load

    + +--concurrent-ephemeralvolume-syncs int32     Default: 5 + + +

    The number of ephemeral volume syncing operations that will be done concurrently. Larger number = faster ephemeral volume updating, but more CPU (and network) load

    + + --concurrent-gc-syncs int32     Default: 20 @@ -386,13 +379,6 @@ kube-controller-manager [flags]

    A list of controllers to enable. '*' enables all on-by-default controllers, 'foo' enables the controller named 'foo', '-foo' disables the controller named 'foo'.
    All controllers: attachdetach, bootstrapsigner, cloud-node-lifecycle, clusterrole-aggregation, cronjob, csrapproving, csrcleaner, csrsigning, daemonset, deployment, disruption, endpoint, endpointslice, endpointslicemirroring, ephemeral-volume, garbagecollector, horizontalpodautoscaling, job, namespace, nodeipam, nodelifecycle, persistentvolume-binder, persistentvolume-expander, podgc, pv-protection, pvc-protection, replicaset, replicationcontroller, resourcequota, root-ca-cert-publisher, route, service, serviceaccount, serviceaccount-token, statefulset, tokencleaner, ttl, ttl-after-finished
    Disabled-by-default controllers: bootstrapsigner, tokencleaner

    - ---deployment-controller-sync-period duration     Default: 30s - - -

    Period for syncing the deployments.

    - - --disable-attach-detach-reconcile-sync @@ -474,7 +460,7 @@ kube-controller-manager [flags] --feature-gates <comma-separated 'key=True|False' pairs> -

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (ALPHA - default=false)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (ALPHA - default=false)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=false)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    IngressClassNamespacedParams=true|false (BETA - default=true)
    JobTrackingWithFinalizers=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (ALPHA - default=false)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetMinReadySeconds=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
    CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (BETA - default=true)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=true)
    CSIMigrationAzureDisk=true|false (BETA - default=true)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=true)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationPortworx=true|false (ALPHA - default=false)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    CustomResourceValidationExpressions=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (BETA - default=true)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DisableKubeletCloudCredentialProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=true)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (BETA - default=true)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GRPCContainerProbe=true|false (ALPHA - default=false)
    GracefulNodeShutdown=true|false (BETA - default=true)
    GracefulNodeShutdownBasedOnPodPriority=true|false (ALPHA - default=false)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    HonorPVReclaimPolicy=true|false (ALPHA - default=false)
    IdentifyPodOS=true|false (ALPHA - default=false)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
    InTreePluginRBDUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    JobMutableNodeSchedulingDirectives=true|false (BETA - default=true)
    JobReadyPods=true|false (ALPHA - default=false)
    JobTrackingWithFinalizers=true|false (BETA - default=true)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (BETA - default=true)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    OpenAPIEnums=true|false (ALPHA - default=false)
    OpenAPIV3=true|false (ALPHA - default=false)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (BETA - default=true)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServerSideFieldValidation=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetAutoDeletePVC=true|false (ALPHA - default=false)
    StatefulSetMinReadySeconds=true|false (BETA - default=true)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TopologyAwareHints=true|false (BETA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (BETA - default=true)
    csiMigrationRBD=true|false (ALPHA - default=false)

    @@ -624,34 +610,6 @@ kube-controller-manager [flags]

    Path to the config file for controller leader migration, or empty to use the value that reflects default configuration of the controller manager. The config file should be of type LeaderMigrationConfiguration, group controllermanager.config.k8s.io, version v1alpha1.

    - ---log-backtrace-at <a string in the form 'file:N'>     Default: :0 - - -

    when logging hits line file:N, emit a stack trace

    - - - ---log-dir string - - -

    If non-empty, write log files in this directory

    - - - ---log-file string - - -

    If non-empty, use this log file

    - - - ---log-file-max-size uint     Default: 1800 - - -

    Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited.

    - - --log-flush-frequency duration     Default: 5s @@ -663,14 +621,7 @@ kube-controller-manager [flags] --logging-format string     Default: "text" -

    Sets the log format. Permitted formats: "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule, --log-flush-frequency.
    Non-default choices are currently alpha and subject to change without warning.

    - - - ---logtostderr     Default: true - - -

    log to standard error instead of files

    +

    Sets the log format. Permitted formats: "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule.
    Non-default choices are currently alpha and subject to change without warning.

    @@ -771,13 +722,6 @@ kube-controller-manager [flags]

    Amount of time which we allow starting Node to be unresponsive before marking it unhealthy.

    - ---one-output - - -

    If true, only write logs to their native severity level (vs also writing to each lower severity level)

    - - --permit-address-sharing @@ -946,27 +890,6 @@ kube-controller-manager [flags]

    The previous version for which you want to show hidden metrics. Only the previous minor version is meaningful, other values will not be allowed. The format is <major>.<minor>, e.g.: '1.16'. The purpose of this format is make sure you have the opportunity to notice if the next release hides additional metrics, rather than being surprised when they are permanently removed in the release after that.

    - ---skip-headers - - -

    If true, avoid header prefixes in the log messages

    - - - ---skip-log-headers - - -

    If true, avoid headers when opening log files

    - - - ---stderrthreshold int     Default: 2 - - -

    logs at or above this threshold go to stderr

    - - --terminated-pod-gc-threshold int32     Default: 12500 @@ -985,7 +908,7 @@ kube-controller-manager [flags] --tls-cipher-suites strings -

    Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.
    Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384.
    Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA.

    +

    Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.
    Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384.
    Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA.

    @@ -1038,10 +961,10 @@ kube-controller-manager [flags] ---vmodule <comma-separated 'pattern=N' settings> +--vmodule pattern=N,... -

    comma-separated list of pattern=N settings for file-filtered logging

    +

    comma-separated list of pattern=N settings for file-filtered logging (only works for text log format)

    diff --git a/content/en/docs/reference/command-line-tools-reference/kube-proxy.md b/content/en/docs/reference/command-line-tools-reference/kube-proxy.md index 3306668093..abe749b801 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-proxy.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-proxy.md @@ -42,20 +42,6 @@ kube-proxy [flags] - ---add-dir-header - - -

    If true, adds the file directory to the header of the log messages

    - - - ---alsologtostderr - - -

    log to standard error as well as files

    - - --azure-container-registry-config string @@ -84,6 +70,13 @@ kube-proxy [flags]

    Comma-separated list of files to check for boot-id. Use the first one that exists.

    + +--boot_id_file string     Default: "/proc/sys/kernel/random/boot_id" + + +

    Comma-separated list of files to check for boot-id. Use the first one that exists.

    + + --cleanup @@ -179,7 +172,7 @@ kube-proxy [flags] --feature-gates <comma-separated 'key=True|False' pairs> -

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (ALPHA - default=false)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (ALPHA - default=false)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=false)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    IngressClassNamespacedParams=true|false (BETA - default=true)
    JobTrackingWithFinalizers=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (ALPHA - default=false)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetMinReadySeconds=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
    CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (BETA - default=true)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=true)
    CSIMigrationAzureDisk=true|false (BETA - default=true)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=true)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationPortworx=true|false (ALPHA - default=false)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    CustomResourceValidationExpressions=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (BETA - default=true)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DisableKubeletCloudCredentialProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=true)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (BETA - default=true)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GRPCContainerProbe=true|false (ALPHA - default=false)
    GracefulNodeShutdown=true|false (BETA - default=true)
    GracefulNodeShutdownBasedOnPodPriority=true|false (ALPHA - default=false)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    HonorPVReclaimPolicy=true|false (ALPHA - default=false)
    IdentifyPodOS=true|false (ALPHA - default=false)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
    InTreePluginRBDUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    JobMutableNodeSchedulingDirectives=true|false (BETA - default=true)
    JobReadyPods=true|false (ALPHA - default=false)
    JobTrackingWithFinalizers=true|false (BETA - default=true)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (BETA - default=true)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    OpenAPIEnums=true|false (ALPHA - default=false)
    OpenAPIV3=true|false (ALPHA - default=false)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (BETA - default=true)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServerSideFieldValidation=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetAutoDeletePVC=true|false (ALPHA - default=false)
    StatefulSetMinReadySeconds=true|false (BETA - default=true)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TopologyAwareHints=true|false (BETA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (BETA - default=true)
    csiMigrationRBD=true|false (ALPHA - default=false)

    @@ -308,48 +301,6 @@ kube-proxy [flags]

    Path to kubeconfig file with authorization information (the master location can be overridden by the master flag).

    - ---log-backtrace-at <a string in the form 'file:N'>     Default: :0 - - -

    when logging hits line file:N, emit a stack trace

    - - - ---log-dir string - - -

    If non-empty, write log files in this directory

    - - - ---log-file string - - -

    If non-empty, use this log file

    - - - ---log-file-max-size uint     Default: 1800 - - -

    Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited.

    - - - ---log-flush-frequency duration     Default: 5s - - -

    Maximum number of seconds between log flushes

    - - - ---logtostderr     Default: true - - -

    log to standard error instead of files

    - - --machine-id-file string     Default: "/etc/machine-id,/var/lib/dbus/machine-id" @@ -357,6 +308,13 @@ kube-proxy [flags]

    Comma-separated list of files to check for machine-id. Use the first one that exists.

    + +--machine_id_file string     Default: "/etc/machine-id,/var/lib/dbus/machine-id" + + +

    Comma-separated list of files to check for machine-id. Use the first one that exists.

    + + --masquerade-all @@ -385,13 +343,6 @@ kube-proxy [flags]

    A string slice of values which specify the addresses to use for NodePorts. Values may be valid IP blocks (e.g. 1.2.3.0/24, 1.2.3.4/32). The default empty string slice ([]) means to use all local addresses.

    - ---one-output - - -

    If true, only write logs to their native severity level (vs also writing to each lower severity level)

    - - --oom-score-adj int32     Default: -999 @@ -427,27 +378,6 @@ kube-proxy [flags]

    The previous version for which you want to show hidden metrics. Only the previous minor version is meaningful, other values will not be allowed. The format is <major>.<minor>, e.g.: '1.16'. The purpose of this format is make sure you have the opportunity to notice if the next release hides additional metrics, rather than being surprised when they are permanently removed in the release after that.

    - ---skip-headers - - -

    If true, avoid header prefixes in the log messages

    - - - ---skip-log-headers - - -

    If true, avoid headers when opening log files

    - - - ---stderrthreshold int     Default: 2 - - -

    logs at or above this threshold go to stderr

    - - --udp-timeout duration     Default: 250ms @@ -455,13 +385,6 @@ kube-proxy [flags]

    How long an idle UDP connection will be kept open (e.g. '250ms', '2s'). Must be greater than 0. Only applicable for proxy-mode=userspace

    - --v, --v int - - -

    number for the log level verbosity

    - - --version version[=true] @@ -469,13 +392,6 @@ kube-proxy [flags]

    Print version information and quit

    - ---vmodule <comma-separated 'pattern=N' settings> - - -

    comma-separated list of pattern=N settings for file-filtered logging

    - - --write-config-to string diff --git a/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md b/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md index 621bac8aa2..6f0115d6ac 100644 --- a/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md +++ b/content/en/docs/reference/command-line-tools-reference/kube-scheduler.md @@ -43,20 +43,6 @@ kube-scheduler [flags] - ---add-dir-header - - -

    If true, adds the file directory to the header of the log messages

    - - - ---address string - - -

    DEPRECATED: the IP address on which to listen for the --port port (set to 0.0.0.0 or :: for listening in all interfaces and IP families). See --bind-address instead. This parameter is ignored if a config file is specified in --config.

    - - --allow-metric-labels stringToString     Default: [] @@ -64,13 +50,6 @@ kube-scheduler [flags]

    The map from metric-label to value allow-list of this label. The key's format is <MetricName>,<LabelName>. The value's format is <allowed_value>,<allowed_value>...e.g. metric1,label1='v1,v2,v3', metric1,label2='v1,v2,v3' metric2,label1='v1,v2,v3'.

    - ---alsologtostderr - - -

    log to standard error as well as files

    - - --authentication-kubeconfig string @@ -159,11 +138,11 @@ kube-scheduler [flags] --config string -

    The path to the configuration file. The following flags can overwrite fields in this file:
    --policy-config-file
    --policy-configmap
    --policy-configmap-namespace

    +

    The path to the configuration file.

    ---contention-profiling +--contention-profiling     Default: true

    DEPRECATED: enable lock contention profiling, if profiling is enabled. This parameter is ignored if a config file is specified in --config.

    @@ -187,7 +166,7 @@ kube-scheduler [flags] --feature-gates <comma-separated 'key=True|False' pairs> -

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (ALPHA - default=false)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=false)
    CSIMigrationAzureDisk=true|false (BETA - default=false)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=false)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeFSGroupPolicy=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ConfigurableFSGroupPolicy=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (ALPHA - default=false)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=false)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (ALPHA - default=false)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GenericEphemeralVolume=true|false (BETA - default=true)
    GracefulNodeShutdown=true|false (BETA - default=true)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    IPv6DualStack=true|false (BETA - default=true)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    IngressClassNamespacedParams=true|false (BETA - default=true)
    JobTrackingWithFinalizers=true|false (ALPHA - default=false)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (ALPHA - default=false)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (ALPHA - default=false)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetMinReadySeconds=true|false (ALPHA - default=false)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TTLAfterFinished=true|false (BETA - default=true)
    TopologyAwareHints=true|false (ALPHA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (ALPHA - default=false)

    +

    A set of key=value pairs that describe feature gates for alpha/experimental features. Options are:
    APIListChunking=true|false (BETA - default=true)
    APIPriorityAndFairness=true|false (BETA - default=true)
    APIResponseCompression=true|false (BETA - default=true)
    APIServerIdentity=true|false (ALPHA - default=false)
    APIServerTracing=true|false (ALPHA - default=false)
    AllAlpha=true|false (ALPHA - default=false)
    AllBeta=true|false (BETA - default=false)
    AnyVolumeDataSource=true|false (ALPHA - default=false)
    AppArmor=true|false (BETA - default=true)
    CPUManager=true|false (BETA - default=true)
    CPUManagerPolicyAlphaOptions=true|false (ALPHA - default=false)
    CPUManagerPolicyBetaOptions=true|false (BETA - default=true)
    CPUManagerPolicyOptions=true|false (BETA - default=true)
    CSIInlineVolume=true|false (BETA - default=true)
    CSIMigration=true|false (BETA - default=true)
    CSIMigrationAWS=true|false (BETA - default=true)
    CSIMigrationAzureDisk=true|false (BETA - default=true)
    CSIMigrationAzureFile=true|false (BETA - default=false)
    CSIMigrationGCE=true|false (BETA - default=true)
    CSIMigrationOpenStack=true|false (BETA - default=true)
    CSIMigrationPortworx=true|false (ALPHA - default=false)
    CSIMigrationvSphere=true|false (BETA - default=false)
    CSIStorageCapacity=true|false (BETA - default=true)
    CSIVolumeHealth=true|false (ALPHA - default=false)
    CSRDuration=true|false (BETA - default=true)
    ControllerManagerLeaderMigration=true|false (BETA - default=true)
    CustomCPUCFSQuotaPeriod=true|false (ALPHA - default=false)
    CustomResourceValidationExpressions=true|false (ALPHA - default=false)
    DaemonSetUpdateSurge=true|false (BETA - default=true)
    DefaultPodTopologySpread=true|false (BETA - default=true)
    DelegateFSGroupToCSIDriver=true|false (BETA - default=true)
    DevicePlugins=true|false (BETA - default=true)
    DisableAcceleratorUsageMetrics=true|false (BETA - default=true)
    DisableCloudProviders=true|false (ALPHA - default=false)
    DisableKubeletCloudCredentialProviders=true|false (ALPHA - default=false)
    DownwardAPIHugePages=true|false (BETA - default=true)
    EfficientWatchResumption=true|false (BETA - default=true)
    EndpointSliceTerminatingCondition=true|false (BETA - default=true)
    EphemeralContainers=true|false (BETA - default=true)
    ExpandCSIVolumes=true|false (BETA - default=true)
    ExpandInUsePersistentVolumes=true|false (BETA - default=true)
    ExpandPersistentVolumes=true|false (BETA - default=true)
    ExpandedDNSConfig=true|false (ALPHA - default=false)
    ExperimentalHostUserNamespaceDefaulting=true|false (BETA - default=false)
    GRPCContainerProbe=true|false (ALPHA - default=false)
    GracefulNodeShutdown=true|false (BETA - default=true)
    GracefulNodeShutdownBasedOnPodPriority=true|false (ALPHA - default=false)
    HPAContainerMetrics=true|false (ALPHA - default=false)
    HPAScaleToZero=true|false (ALPHA - default=false)
    HonorPVReclaimPolicy=true|false (ALPHA - default=false)
    IdentifyPodOS=true|false (ALPHA - default=false)
    InTreePluginAWSUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureDiskUnregister=true|false (ALPHA - default=false)
    InTreePluginAzureFileUnregister=true|false (ALPHA - default=false)
    InTreePluginGCEUnregister=true|false (ALPHA - default=false)
    InTreePluginOpenStackUnregister=true|false (ALPHA - default=false)
    InTreePluginPortworxUnregister=true|false (ALPHA - default=false)
    InTreePluginRBDUnregister=true|false (ALPHA - default=false)
    InTreePluginvSphereUnregister=true|false (ALPHA - default=false)
    IndexedJob=true|false (BETA - default=true)
    JobMutableNodeSchedulingDirectives=true|false (BETA - default=true)
    JobReadyPods=true|false (ALPHA - default=false)
    JobTrackingWithFinalizers=true|false (BETA - default=true)
    KubeletCredentialProviders=true|false (ALPHA - default=false)
    KubeletInUserNamespace=true|false (ALPHA - default=false)
    KubeletPodResources=true|false (BETA - default=true)
    KubeletPodResourcesGetAllocatable=true|false (BETA - default=true)
    LocalStorageCapacityIsolation=true|false (BETA - default=true)
    LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - default=false)
    LogarithmicScaleDown=true|false (BETA - default=true)
    MemoryManager=true|false (BETA - default=true)
    MemoryQoS=true|false (ALPHA - default=false)
    MixedProtocolLBService=true|false (ALPHA - default=false)
    NetworkPolicyEndPort=true|false (BETA - default=true)
    NodeSwap=true|false (ALPHA - default=false)
    NonPreemptingPriority=true|false (BETA - default=true)
    OpenAPIEnums=true|false (ALPHA - default=false)
    OpenAPIV3=true|false (ALPHA - default=false)
    PodAffinityNamespaceSelector=true|false (BETA - default=true)
    PodAndContainerStatsFromCRI=true|false (ALPHA - default=false)
    PodDeletionCost=true|false (BETA - default=true)
    PodOverhead=true|false (BETA - default=true)
    PodSecurity=true|false (BETA - default=true)
    PreferNominatedNode=true|false (BETA - default=true)
    ProbeTerminationGracePeriod=true|false (BETA - default=false)
    ProcMountType=true|false (ALPHA - default=false)
    ProxyTerminatingEndpoints=true|false (ALPHA - default=false)
    QOSReserved=true|false (ALPHA - default=false)
    ReadWriteOncePod=true|false (ALPHA - default=false)
    RecoverVolumeExpansionFailure=true|false (ALPHA - default=false)
    RemainingItemCount=true|false (BETA - default=true)
    RemoveSelfLink=true|false (BETA - default=true)
    RotateKubeletServerCertificate=true|false (BETA - default=true)
    SeccompDefault=true|false (ALPHA - default=false)
    ServerSideFieldValidation=true|false (ALPHA - default=false)
    ServiceInternalTrafficPolicy=true|false (BETA - default=true)
    ServiceLBNodePortControl=true|false (BETA - default=true)
    ServiceLoadBalancerClass=true|false (BETA - default=true)
    SizeMemoryBackedVolumes=true|false (BETA - default=true)
    StatefulSetAutoDeletePVC=true|false (ALPHA - default=false)
    StatefulSetMinReadySeconds=true|false (BETA - default=true)
    StorageVersionAPI=true|false (ALPHA - default=false)
    StorageVersionHash=true|false (BETA - default=true)
    SuspendJob=true|false (BETA - default=true)
    TopologyAwareHints=true|false (BETA - default=false)
    TopologyManager=true|false (BETA - default=true)
    VolumeCapacityPriority=true|false (ALPHA - default=false)
    WinDSR=true|false (ALPHA - default=false)
    WinOverlay=true|false (BETA - default=true)
    WindowsHostProcessContainers=true|false (BETA - default=true)
    csiMigrationRBD=true|false (ALPHA - default=false)

    @@ -205,21 +184,21 @@ kube-scheduler [flags] ---kube-api-burst int32 +--kube-api-burst int32     Default: 100

    DEPRECATED: burst to use while talking with kubernetes apiserver. This parameter is ignored if a config file is specified in --config.

    ---kube-api-content-type string +--kube-api-content-type string     Default: "application/vnd.kubernetes.protobuf"

    DEPRECATED: content type of requests sent to apiserver. This parameter is ignored if a config file is specified in --config.

    ---kube-api-qps float +--kube-api-qps float     Default: 50

    DEPRECATED: QPS to use while talking with kubernetes apiserver. This parameter is ignored if a config file is specified in --config.

    @@ -233,96 +212,68 @@ kube-scheduler [flags] ---leader-elect +--leader-elect     Default: true

    Start a leader election client and gain leadership before executing the main loop. Enable this when running replicated components for high availability.

    ---leader-elect-lease-duration duration +--leader-elect-lease-duration duration     Default: 15s

    The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate. This is only applicable if leader election is enabled.

    ---leader-elect-renew-deadline duration +--leader-elect-renew-deadline duration     Default: 10s

    The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration. This is only applicable if leader election is enabled.

    ---leader-elect-resource-lock string +--leader-elect-resource-lock string     Default: "leases"

    The type of resource object that is used for locking during leader election. Supported options are 'endpoints', 'configmaps', 'leases', 'endpointsleases' and 'configmapsleases'.

    ---leader-elect-resource-name string +--leader-elect-resource-name string     Default: "kube-scheduler"

    The name of resource object that is used for locking during leader election.

    ---leader-elect-resource-namespace string +--leader-elect-resource-namespace string     Default: "kube-system"

    The namespace of resource object that is used for locking during leader election.

    ---leader-elect-retry-period duration +--leader-elect-retry-period duration     Default: 2s

    The duration the clients should wait between attempting acquisition and renewal of a leadership. This is only applicable if leader election is enabled.

    ---lock-object-name string +--lock-object-name string     Default: "kube-scheduler"

    DEPRECATED: define the name of the lock object. Will be removed in favor of leader-elect-resource-name. This parameter is ignored if a config file is specified in --config.

    ---lock-object-namespace string +--lock-object-namespace string     Default: "kube-system"

    DEPRECATED: define the namespace of the lock object. Will be removed in favor of leader-elect-resource-namespace. This parameter is ignored if a config file is specified in --config.

    - ---log-backtrace-at <a string in the form 'file:N'>     Default: :0 - - -

    when logging hits line file:N, emit a stack trace

    - - - ---log-dir string - - -

    If non-empty, write log files in this directory

    - - - ---log-file string - - -

    If non-empty, use this log file

    - - - ---log-file-max-size uint     Default: 1800 - - -

    Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited.

    - - --log-flush-frequency duration     Default: 5s @@ -334,14 +285,7 @@ kube-scheduler [flags] --logging-format string     Default: "text" -

    Sets the log format. Permitted formats: "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule, --log-flush-frequency.
    Non-default choices are currently alpha and subject to change without warning.

    - - - ---logtostderr     Default: true - - -

    log to standard error instead of files

    +

    Sets the log format. Permitted formats: "text".
    Non-default formats don't honor these flags: --add-dir-header, --alsologtostderr, --log-backtrace-at, --log-dir, --log-file, --log-file-max-size, --logtostderr, --one-output, --skip-headers, --skip-log-headers, --stderrthreshold, --vmodule.
    Non-default choices are currently alpha and subject to change without warning.

    @@ -351,13 +295,6 @@ kube-scheduler [flags]

    The address of the Kubernetes API server (overrides any value in kubeconfig)

    - ---one-output - - -

    If true, only write logs to their native severity level (vs also writing to each lower severity level)

    - - --permit-address-sharing @@ -373,35 +310,7 @@ kube-scheduler [flags] ---policy-config-file string - - -

    DEPRECATED: file with scheduler policy configuration. This file is used if policy ConfigMap is not provided or --use-legacy-policy-config=true. Note: The predicates/priorities defined in this file will take precedence over any profiles define in ComponentConfig.

    - - - ---policy-configmap string - - -

    DEPRECATED: name of the ConfigMap object that contains scheduler's policy configuration. It must exist in the system namespace before scheduler initialization if --use-legacy-policy-config=false. The config must be provided as the value of an element in 'Data' map with the key='policy.cfg'. Note: The predicates/priorities defined in this file will take precedence over any profiles define in ComponentConfig.

    - - - ---policy-configmap-namespace string     Default: "kube-system" - - -

    DEPRECATED: the namespace where policy ConfigMap is located. The kube-system namespace will be used if this is not provided or is empty. Note: The predicates/priorities defined in this file will take precedence over any profiles define in ComponentConfig.

    - - - ---port int - - -

    DEPRECATED: the port on which to serve HTTP insecurely without authentication and authorization. If 0, don't serve plain HTTP at all. See --secure-port instead. This parameter is ignored if a config file is specified in --config.

    - - - ---profiling +--profiling     Default: true

    DEPRECATED: enable profiling via web interface host:port/debug/pprof/. This parameter is ignored if a config file is specified in --config.

    @@ -456,27 +365,6 @@ kube-scheduler [flags]

    The previous version for which you want to show hidden metrics. Only the previous minor version is meaningful, other values will not be allowed. The format is <major>.<minor>, e.g.: '1.16'. The purpose of this format is make sure you have the opportunity to notice if the next release hides additional metrics, rather than being surprised when they are permanently removed in the release after that.

    - ---skip-headers - - -

    If true, avoid header prefixes in the log messages

    - - - ---skip-log-headers - - -

    If true, avoid headers when opening log files

    - - - ---stderrthreshold int     Default: 2 - - -

    logs at or above this threshold go to stderr

    - - --tls-cert-file string @@ -488,7 +376,7 @@ kube-scheduler [flags] --tls-cipher-suites strings -

    Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.
    Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384.
    Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA.

    +

    Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.
    Preferred values: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384.
    Insecure values: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA.

    @@ -512,13 +400,6 @@ kube-scheduler [flags]

    A pair of x509 certificate and private key file paths, optionally suffixed with a list of domain patterns which are fully qualified domain names, possibly with prefixed wildcard segments. The domain patterns also allow IP addresses, but IPs should only be used if the apiserver has visibility to the IP address requested by a client. If no domain patterns are provided, the names of the certificate are extracted. Non-wildcard matches trump over wildcard matches, explicit domain patterns trump over extracted names. For multiple key/certificate pairs, use the --tls-sni-cert-key multiple times. Examples: "example.crt,example.key" or "foo.crt,foo.key:*.foo.com,foo.com".

    - ---use-legacy-policy-config - - -

    DEPRECATED: when set to true, scheduler will ignore policy ConfigMap and uses policy config file. Note: The scheduler will fail if this is combined with Plugin configs

    - - -v, --v int @@ -534,10 +415,10 @@ kube-scheduler [flags] ---vmodule <comma-separated 'pattern=N' settings> +--vmodule pattern=N,... -

    comma-separated list of pattern=N settings for file-filtered logging

    +

    comma-separated list of pattern=N settings for file-filtered logging (only works for text log format)

    From d29e93acbb22343419288ffec8d861a217035653 Mon Sep 17 00:00:00 2001 From: Pushkar Joglekar Date: Mon, 8 Nov 2021 17:19:45 -0800 Subject: [PATCH 142/148] Tutorial for pod security admission Refer blog post for v1.23 + suggestions from code review --- content/en/docs/tutorials/_index.md | 5 + content/en/docs/tutorials/security/_index.md | 5 + .../tutorials/security/cluster-level-pss.md | 319 ++++++++++++++++++ .../docs/tutorials/security/ns-level-pss.md | 160 +++++++++ 4 files changed, 489 insertions(+) create mode 100644 content/en/docs/tutorials/security/_index.md create mode 100644 content/en/docs/tutorials/security/cluster-level-pss.md create mode 100644 content/en/docs/tutorials/security/ns-level-pss.md diff --git a/content/en/docs/tutorials/_index.md b/content/en/docs/tutorials/_index.md index fdc62e11fb..34a91b6863 100644 --- a/content/en/docs/tutorials/_index.md +++ b/content/en/docs/tutorials/_index.md @@ -57,6 +57,11 @@ Before walking through each tutorial, you may want to bookmark the * [Using Source IP](/docs/tutorials/services/source-ip/) +## Security + +* [Applying Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/) +* [Applying Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/) + ## {{% heading "whatsnext" %}} If you would like to write a tutorial, see diff --git a/content/en/docs/tutorials/security/_index.md b/content/en/docs/tutorials/security/_index.md new file mode 100644 index 0000000000..fbb8140dfa --- /dev/null +++ b/content/en/docs/tutorials/security/_index.md @@ -0,0 +1,5 @@ +--- +title: "Security" +weight: 40 +--- + diff --git a/content/en/docs/tutorials/security/cluster-level-pss.md b/content/en/docs/tutorials/security/cluster-level-pss.md new file mode 100644 index 0000000000..75a77b346a --- /dev/null +++ b/content/en/docs/tutorials/security/cluster-level-pss.md @@ -0,0 +1,319 @@ +--- +title: Applying Pod Security Standards at the cluster level +content_type: tutorial +weight: 10 +--- + +{{% alert title="Note" %}} +This tutorial applies only for new clusters. +{{% /alert %}} + +Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated +to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission +is an admission controller that applies Pod Security Standards when pods are +created. This tutorial shows you how to enforce the `baseline` Pod Security +Standard at the cluster level which applies a standard configuration +to all namespaces in a cluster. + +For applying pod security standards one namespace at a time, please [follow this +tutorial](/docs/tutorials/security/ns-level-pss). + +## {{% heading "prerequisites" %}} + +Install the following on your workstation: + +- [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) +- [kubectl](https://kubernetes.io/docs/tasks/tools/) + +## Choose the right Pod Security Standard to apply + +[Pod Security Admission](/docs/concepts/security/pod-security-admission/) +lets you apply built-in [Pod Security Standards](/docs/concepts/security/pod-security-standards/) +with the following modes: `enforce`, `audit`, and `warn`. + +To gather information that helps you to choose the Pod Security Standards +that are most appropriate for your configuration, do the following: + +1. Create a cluster with no Pod Security Standards applied: + + ```shell + kind create cluster --name psa-wo-cluster-pss --image kindest/node:latest + ``` + The output is similar to this: + ``` + Creating cluster "psa-wo-cluster-pss" ... + ✓ Ensuring node image (kindest/node:latest) 🖼 + ✓ Preparing nodes 📦 + ✓ Writing configuration 📜 + ✓ Starting control-plane 🕹️ + ✓ Installing CNI 🔌 + ✓ Installing StorageClass 💾 + Set kubectl context to "kind-psa-wo-cluster-pss" + You can now use your cluster with: + + kubectl cluster-info --context kind-psa-wo-cluster-pss + + Thanks for using kind! 😊 + + ``` + +2. Set the kubectl context to the new cluster: + + ```shell + kubectl cluster-info --context kind-psa-wo-cluster-pss + ``` + The output is similar to this: + + ``` + Kubernetes control plane is running at https://127.0.0.1:61350 + + CoreDNS is running at https://127.0.0.1:61350/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy + + To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. + ``` + +3. Get a list of namespaces in the cluster: + + ```shell + kubectl get ns + ``` + The output is similar to this: + ``` + NAME STATUS AGE + default Active 9m30s + kube-node-lease Active 9m32s + kube-public Active 9m32s + kube-system Active 9m32s + local-path-storage Active 9m26s + ``` + +4. Use `--dry-run=server` to understand what happens when different Pod Security Standards + are applied: + + 1. Privileged + ```shell + kubectl label --dry-run=server --overwrite ns --all \ + pod-security.kubernetes.io/enforce=privileged + ``` + The output is similar to this: + ``` + namespace/default labeled + namespace/kube-node-lease labeled + namespace/kube-public labeled + namespace/kube-system labeled + namespace/local-path-storage labeled + ``` + 2. Baseline + ```shell + kubectl label --dry-run=server --overwrite ns --all \ + pod-security.kubernetes.io/enforce=baseline + ``` + The output is similar to this: + ``` + namespace/default labeled + namespace/kube-node-lease labeled + namespace/kube-public labeled + Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "baseline:latest" + Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes + Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes + Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged + namespace/kube-system labeled + namespace/local-path-storage labeled + ``` + + 3. Restricted + ```shell + kubectl label --dry-run=server --overwrite ns --all \ + pod-security.kubernetes.io/enforce=restricted + ``` + The output is similar to this: + ``` + namespace/default labeled + namespace/kube-node-lease labeled + namespace/kube-public labeled + Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "restricted:latest" + Warning: coredns-7bb9c7b568-hsptc (and 1 other pod): unrestricted capabilities, runAsNonRoot != true, seccompProfile + Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true + Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile + Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile + namespace/kube-system labeled + Warning: existing pods in namespace "local-path-storage" violate the new PodSecurity enforce level "restricted:latest" + Warning: local-path-provisioner-d6d9f7ffc-lw9lh: allowPrivilegeEscalation != false, unrestricted capabilities, runAsNonRoot != true, seccompProfile + namespace/local-path-storage labeled + ``` + +From the previous output, you'll notice that applying the `privileged` Pod Security Standard shows no warnings +for any namespaces. However, `baseline` and `restricted` standards both have +warnings, specifically in the `kube-system` namespace. + +## Set modes, versions and standards + +In this tutorial, you apply the following Pod Security Standards to the `latest` version: + + * `baseline` standard in `enforce` mode. + * `restricted` standard in `warn` and `audit` mode. + +The `baseline` Pod Security Standard provides a convenient +middle ground that allows keeping the exemption list short and prevents known +privilege escalations. + +Additionally, to prevent pods from failing in `kube-system`, you'll exempt the namespace +from having Pod Security Standards applied. + +When you implement Pod Security Admission in your own environment, consider the +following: + +1. Based on the risk posture applied to a cluster, a stricter Pod Security + Standard like `restricted` might be a better choice. +1. Exempting the `kube-system` namespace allows pods to run as + `privileged` in this namespace. We recommend that you apply strict RBAC + policies that limit access to `kube-system`, following the principle of least + privilege. + +1. Create a configuration file that can be consumed by the Pod Security +Admission Controller to implement these Pod Security Standards: + +``` +mkdir -p /tmp/pss +cat < /tmp/pss/cluster-level-pss.yaml +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- name: PodSecurity + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1beta1 + kind: PodSecurityConfiguration + defaults: + enforce: "baseline" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" + exemptions: + usernames: [] + runtimeClasses: [] + namespaces: [kube-system] +EOF +``` + + +1. Configure the API server to consume this file during cluster creation: + + ``` + cat < /tmp/pss/cluster-config.yaml + kind: Cluster + apiVersion: kind.x-k8s.io/v1alpha4 + nodes: + - role: control-plane + kubeadmConfigPatches: + - | + kind: ClusterConfiguration + apiServer: + extraArgs: + admission-control-config-file: /etc/config/cluster-level-pss.yaml + extraVolumes: + - name: accf + hostPath: /etc/config + mountPath: /etc/config + readOnly: false + pathType: "DirectoryOrCreate" + extraMounts: + - hostPath: /tmp/pss + containerPath: /etc/config + # optional: if set, the mount is read-only. + # default false + readOnly: false + # optional: if set, the mount needs SELinux relabeling. + # default false + selinuxRelabel: false + # optional: set propagation mode (None, HostToContainer or Bidirectional) + # see https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation + # default None + propagation: None + EOF + ``` + + {{}} + If you use Docker Desktop with KinD, the `/tmp` + directory is added as a Shared Directory under + **Preferences > Resources > File Sharing** on Mac OS. + {{}} + +2. Create a cluster that uses Pod Security Admission to apply + these Pod Security Standards: + + ```shell + kind create cluster --name psa-with-cluster-pss --image kindest/node:latest --config /tmp/pss/cluster-config.yaml + ``` + The output is similar to this: + ``` + Creating cluster "psa-with-cluster-pss" ... + ✓ Ensuring node image (kindest/node:latest) 🖼 + ✓ Preparing nodes 📦 + ✓ Writing configuration 📜 + ✓ Starting control-plane 🕹️ + ✓ Installing CNI 🔌 + ✓ Installing StorageClass 💾 + Set kubectl context to "kind-psa-with-cluster-pss" + You can now use your cluster with: + + kubectl cluster-info --context kind-psa-with-cluster-pss + + Have a question, bug, or feature request? Let us know! https://kind.sigs.k8s.io/#community 🙂 + +3. Point kubectl to the cluster + ```shell + kubectl cluster-info --context kind-psa-with-cluster-pss + Kubernetes control plane is running at https://127.0.0.1:63855 + CoreDNS is running at https://127.0.0.1:63855/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy + + To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. + ``` + +4. Create a Pod with minimal configuration in the default namespace: + + ``` + cat < /tmp/pss/nginx-pod.yaml + apiVersion: v1 + kind: Pod + metadata: + name: nginx + spec: + containers: + - image: nginx + name: nginx + ports: + - containerPort: 80 + EOF + ``` +5. Create Pod after pod security is enabled at cluster level: + + ```shell + kubectl apply -f /tmp/pss/nginx-pod.yaml + ``` + The output is similar to this: + ``` + Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") + pod/nginx created + ``` +## Clean up + +Run `kind delete cluster -name psa-with-cluster-pss` and +`kind delete cluster -name psa-wo-cluster-pss` to delete the clusters you +created. + +## {{% heading "whatsnext" %}} + +- Run a + [gist](https://gist.github.com/PushkarJ/9f7a0045f4bec31097bdd1e9db0f2f6e) + to perform all the preceding steps at once: + 1. Create a Pod Security Standards based cluster level Configuration + 2. Create a file to let API server consumes this configuration + 3. Create a cluster that creates an API server with this configuration + 4. Set kubectl context to this new cluster + 5. Create a minimal pod yaml file + 6. Apply this file to create a Pod in the new cluster +- [Pod Security Admission](/docs/concepts/security/pod-security-admission/) +- [Pod Security Standards](/docs/concepts/security/pod-security-standards/) +- [Applying Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/) diff --git a/content/en/docs/tutorials/security/ns-level-pss.md b/content/en/docs/tutorials/security/ns-level-pss.md new file mode 100644 index 0000000000..5f975418c5 --- /dev/null +++ b/content/en/docs/tutorials/security/ns-level-pss.md @@ -0,0 +1,160 @@ +--- +title: Applying Pod Security Standards at Namespace level +content_type: tutorial +weight: 10 +--- + +{{% alert title="Note" %}} +This tutorial applies only for new clusters. +{{% /alert %}} + +Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated +to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission +is an admission controller that applies Pod Security Standards when pods are +created. In this tutorial, we will enforce `baseline` Pod Security Standard, +one namespace at a time. + +# Pre-requisites + +Install the following on your workstation: + +- [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) +- [kubectl](https://kubernetes.io/docs/tasks/tools/) + +# Create cluster + +1. Create a `KinD` cluster as follows: + + ```shell + kind create cluster --name psa-ns-level --image kindest/node:latest + ``` + The output is similar to this: + ``` + Creating cluster "psa-ns-level" ... + ✓ Ensuring node image (kindest/node:latest) 🖼 + ✓ Preparing nodes 📦 + ✓ Writing configuration 📜 + ✓ Starting control-plane 🕹️ + ✓ Installing CNI 🔌 + ✓ Installing StorageClass 💾 + Set kubectl context to "kind-psa-ns-level" + You can now use your cluster with: + + kubectl cluster-info --context kind-psa-ns-level + + Not sure what to do next? 😅 Check out https://kind.sigs.k8s.io/docs/user/quick-start/ + ``` + +2. Set the kubectl context to the new cluster + ```shell + kubectl cluster-info --context kind-psa-ns-level + ``` + The output is similar to this: + ``` + Kubernetes control plane is running at https://127.0.0.1:50996 + CoreDNS is running at https://127.0.0.1:50996/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy + + To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. + ``` + +# Create Namespace + +Create a new namespace `example` for this tutorial: + +```shell +kubectl create ns example +``` +The output is similar to this: +``` +namespace/example created +``` + +# Applying one Pod Security Standard + +Enable Pod Security Standards on this namespace using labels supported by +built-in Pod Security Admission. In this step we will warn on baseline pod +security standard as per the latest version (default value) + +```shell +kubectl label --overwrite ns example \ + pod-security.kubernetes.io/warn=baseline \ + pod-security.kubernetes.io/warn-version=latest +``` + +# Applying multiple Pod Security Standards + +Multiple pod security standards can be enabled on any namespace, using labels. +Following command will `enforce` the `baseline` Pod Security Standard, but +`warn` and `audit` for `restricted` Pod Security Standards as per the latest +version (default value) + +``` +kubectl label --overwrite ns example \ + pod-security.kubernetes.io/enforce=baseline \ + pod-security.kubernetes.io/enforce-version=latest \ + pod-security.kubernetes.io/warn=restricted \ + pod-security.kubernetes.io/warn-version=latest \ + pod-security.kubernetes.io/audit=restricted \ + pod-security.kubernetes.io/audit-version=latest +``` + +# Create Pod + +1. Create a minimal pod in `example` namespace: + + ```shell + cat < /tmp/pss/nginx-pod.yaml + apiVersion: v1 + kind: Pod + metadata: + name: nginx + spec: + containers: + - image: nginx + name: nginx + ports: + - containerPort: 80 + EOF + ``` +2. Apply the pod spec to the cluster in `example` namespace: + ```shell + kubectl apply -n example -f /tmp/pss/nginx-pod.yaml + ``` + The output is similar to this: + ``` + Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") + pod/nginx created + ``` + +3. Apply the pod spec to the cluster in `default` namespace: + ```shell + kubectl apply -n default -f /tmp/pss/nginx-pod.yaml + ``` + Output is similar to this: + ``` + pod/nginx created + ``` + +As you can see the Pod Security Standards were applied only to `example` +namespace. For `default` namespace, pod was created without any warnings. +To apply pod security standards to multiple namespaces at once at cluster +level, please +[follow this tutorial](/docs/tutorials/security/cluster-level-pss). + +# Clean up + +Run `kind delete cluster -name psa-ns-level` to delete the cluster created. + +## {{% heading "whatsnext" %}} + +- Run a +[gist](https://gist.github.com/PushkarJ/c694bac35c2d100f906861667474afb5) +to perform all the preceding steps all at once. + 1. Create KinD cluster + 2. Create new namespace + 3. Apply `baseline` Pod Security Standard in `enforce` mode while applying + `restricted` Pod Security Standard also in `warn` and `audit` mode. + 4. Create a new pod with the following pod security standards applied +- [Pod Security Admission](/docs/concepts/security/pod-security-admission/) +- [Pod Security Standards](/docs/concepts/security/pod-security-standards/) +- [Applying Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/) \ No newline at end of file From d1e25451d370b46247417ca903be1b7c2bb5fbd3 Mon Sep 17 00:00:00 2001 From: Pushkar Joglekar <3390906+PushkarJ@users.noreply.github.com> Date: Tue, 7 Dec 2021 03:42:39 +0530 Subject: [PATCH 143/148] Added shell script examples Fixed nits, broken links and numbering Co-authored-by: Tim Bannister Co-authored-by: Shannon Kularathna Co-authored-by: Jim Angel --- content/en/docs/tutorials/_index.md | 4 +- .../tutorials/security/cluster-level-pss.md | 253 +++++++++--------- .../docs/tutorials/security/ns-level-pss.md | 115 ++++---- ...ith-cluster-level-baseline-pod-security.sh | 70 +++++ ...h-namespace-level-baseline-pod-security.sh | 28 ++ 5 files changed, 286 insertions(+), 184 deletions(-) create mode 100644 content/en/examples/security/kind-with-cluster-level-baseline-pod-security.sh create mode 100644 content/en/examples/security/kind-with-namespace-level-baseline-pod-security.sh diff --git a/content/en/docs/tutorials/_index.md b/content/en/docs/tutorials/_index.md index 34a91b6863..0f1181e2cf 100644 --- a/content/en/docs/tutorials/_index.md +++ b/content/en/docs/tutorials/_index.md @@ -59,8 +59,8 @@ Before walking through each tutorial, you may want to bookmark the ## Security -* [Applying Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/) -* [Applying Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/) +* [Apply Pod Security Standards at Cluster level](/docs/tutorials/security/cluster-level-pss/) +* [Apply Pod Security Standards at Namespace level](/docs/tutorials/security/ns-level-pss/) ## {{% heading "whatsnext" %}} diff --git a/content/en/docs/tutorials/security/cluster-level-pss.md b/content/en/docs/tutorials/security/cluster-level-pss.md index 75a77b346a..e2d37b765a 100644 --- a/content/en/docs/tutorials/security/cluster-level-pss.md +++ b/content/en/docs/tutorials/security/cluster-level-pss.md @@ -1,5 +1,5 @@ --- -title: Applying Pod Security Standards at the cluster level +title: Apply Pod Security Standards at the Cluster Level content_type: tutorial weight: 10 --- @@ -8,15 +8,16 @@ weight: 10 This tutorial applies only for new clusters. {{% /alert %}} -Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated -to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission -is an admission controller that applies Pod Security Standards when pods are -created. This tutorial shows you how to enforce the `baseline` Pod Security -Standard at the cluster level which applies a standard configuration +Pod Security admission (PSA) is enabled by default in v1.23 and later, as it has +[graduated to beta](/blog/2021/12/09/pod-security-admission-beta/). +Pod Security +is an admission controller that carries out checks against the Kubernetes +[Pod Security Standards](docs/concepts/security/pod-security-standards/) when new pods are +created. This tutorial shows you how to enforce the `baseline` Pod Security +Standard at the cluster level which applies a standard configuration to all namespaces in a cluster. -For applying pod security standards one namespace at a time, please [follow this -tutorial](/docs/tutorials/security/ns-level-pss). +To apply Pod Security Standards to specific namespaces, refer to [Apply Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss). ## {{% heading "prerequisites" %}} @@ -37,12 +38,12 @@ that are most appropriate for your configuration, do the following: 1. Create a cluster with no Pod Security Standards applied: ```shell - kind create cluster --name psa-wo-cluster-pss --image kindest/node:latest + kind create cluster --name psa-wo-cluster-pss --image kindest/node:v1.23.0 ``` - The output is similar to this: + The output is similar to this: ``` Creating cluster "psa-wo-cluster-pss" ... - ✓ Ensuring node image (kindest/node:latest) 🖼 + ✓ Ensuring node image (kindest/node:v1.23.0) 🖼 ✓ Preparing nodes 📦 ✓ Writing configuration 📜 ✓ Starting control-plane 🕹️ @@ -57,12 +58,12 @@ that are most appropriate for your configuration, do the following: ``` -2. Set the kubectl context to the new cluster: +1. Set the kubectl context to the new cluster: ```shell kubectl cluster-info --context kind-psa-wo-cluster-pss ``` - The output is similar to this: + The output is similar to this: ``` Kubernetes control plane is running at https://127.0.0.1:61350 @@ -72,7 +73,7 @@ that are most appropriate for your configuration, do the following: To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. ``` -3. Get a list of namespaces in the cluster: +1. Get a list of namespaces in the cluster: ```shell kubectl get ns @@ -87,60 +88,60 @@ that are most appropriate for your configuration, do the following: local-path-storage Active 9m26s ``` -4. Use `--dry-run=server` to understand what happens when different Pod Security Standards - are applied: +1. Use `--dry-run=server` to understand what happens when different Pod Security Standards + are applied: 1. Privileged - ```shell - kubectl label --dry-run=server --overwrite ns --all \ - pod-security.kubernetes.io/enforce=privileged - ``` - The output is similar to this: - ``` - namespace/default labeled - namespace/kube-node-lease labeled - namespace/kube-public labeled - namespace/kube-system labeled - namespace/local-path-storage labeled - ``` + ```shell + kubectl label --dry-run=server --overwrite ns --all \ + pod-security.kubernetes.io/enforce=privileged + ``` + The output is similar to this: + ``` + namespace/default labeled + namespace/kube-node-lease labeled + namespace/kube-public labeled + namespace/kube-system labeled + namespace/local-path-storage labeled + ``` 2. Baseline - ```shell - kubectl label --dry-run=server --overwrite ns --all \ - pod-security.kubernetes.io/enforce=baseline - ``` - The output is similar to this: - ``` - namespace/default labeled - namespace/kube-node-lease labeled - namespace/kube-public labeled - Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "baseline:latest" - Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes - Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes - Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged - namespace/kube-system labeled - namespace/local-path-storage labeled - ``` + ```shell + kubectl label --dry-run=server --overwrite ns --all \ + pod-security.kubernetes.io/enforce=baseline + ``` + The output is similar to this: + ``` + namespace/default labeled + namespace/kube-node-lease labeled + namespace/kube-public labeled + Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "baseline:latest" + Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes + Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes + Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged + namespace/kube-system labeled + namespace/local-path-storage labeled + ``` 3. Restricted - ```shell - kubectl label --dry-run=server --overwrite ns --all \ - pod-security.kubernetes.io/enforce=restricted - ``` - The output is similar to this: - ``` - namespace/default labeled - namespace/kube-node-lease labeled - namespace/kube-public labeled - Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "restricted:latest" - Warning: coredns-7bb9c7b568-hsptc (and 1 other pod): unrestricted capabilities, runAsNonRoot != true, seccompProfile - Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true - Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile - Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile - namespace/kube-system labeled - Warning: existing pods in namespace "local-path-storage" violate the new PodSecurity enforce level "restricted:latest" - Warning: local-path-provisioner-d6d9f7ffc-lw9lh: allowPrivilegeEscalation != false, unrestricted capabilities, runAsNonRoot != true, seccompProfile - namespace/local-path-storage labeled - ``` + ```shell + kubectl label --dry-run=server --overwrite ns --all \ + pod-security.kubernetes.io/enforce=restricted + ``` + The output is similar to this: + ``` + namespace/default labeled + namespace/kube-node-lease labeled + namespace/kube-public labeled + Warning: existing pods in namespace "kube-system" violate the new PodSecurity enforce level "restricted:latest" + Warning: coredns-7bb9c7b568-hsptc (and 1 other pod): unrestricted capabilities, runAsNonRoot != true, seccompProfile + Warning: etcd-psa-wo-cluster-pss-control-plane (and 3 other pods): host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true + Warning: kindnet-vzj42: non-default capabilities, host namespaces, hostPath volumes, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile + Warning: kube-proxy-m6hwf: host namespaces, hostPath volumes, privileged, allowPrivilegeEscalation != false, unrestricted capabilities, restricted volume types, runAsNonRoot != true, seccompProfile + namespace/kube-system labeled + Warning: existing pods in namespace "local-path-storage" violate the new PodSecurity enforce level "restricted:latest" + Warning: local-path-provisioner-d6d9f7ffc-lw9lh: allowPrivilegeEscalation != false, unrestricted capabilities, runAsNonRoot != true, seccompProfile + namespace/local-path-storage labeled + ``` From the previous output, you'll notice that applying the `privileged` Pod Security Standard shows no warnings for any namespaces. However, `baseline` and `restricted` standards both have @@ -148,10 +149,10 @@ warnings, specifically in the `kube-system` namespace. ## Set modes, versions and standards -In this tutorial, you apply the following Pod Security Standards to the `latest` version: +In this section, you apply the following Pod Security Standards to the `latest` version: - * `baseline` standard in `enforce` mode. - * `restricted` standard in `warn` and `audit` mode. +* `baseline` standard in `enforce` mode. +* `restricted` standard in `warn` and `audit` mode. The `baseline` Pod Security Standard provides a convenient middle ground that allows keeping the exemption list short and prevents known @@ -166,37 +167,37 @@ following: 1. Based on the risk posture applied to a cluster, a stricter Pod Security Standard like `restricted` might be a better choice. 1. Exempting the `kube-system` namespace allows pods to run as - `privileged` in this namespace. We recommend that you apply strict RBAC + `privileged` in this namespace. For real world use, the Kubernetes project + strongly recommends that you apply strict RBAC policies that limit access to `kube-system`, following the principle of least privilege. - + To implement the preceding standards, do the following: 1. Create a configuration file that can be consumed by the Pod Security -Admission Controller to implement these Pod Security Standards: - -``` -mkdir -p /tmp/pss -cat < /tmp/pss/cluster-level-pss.yaml -apiVersion: apiserver.config.k8s.io/v1 -kind: AdmissionConfiguration -plugins: -- name: PodSecurity - configuration: - apiVersion: pod-security.admission.config.k8s.io/v1beta1 - kind: PodSecurityConfiguration - defaults: - enforce: "baseline" - enforce-version: "latest" - audit: "restricted" - audit-version: "latest" - warn: "restricted" - warn-version: "latest" - exemptions: - usernames: [] - runtimeClasses: [] - namespaces: [kube-system] -EOF -``` + Admission Controller to implement these Pod Security Standards: + ``` + mkdir -p /tmp/pss + cat < /tmp/pss/cluster-level-pss.yaml + apiVersion: apiserver.config.k8s.io/v1 + kind: AdmissionConfiguration + plugins: + - name: PodSecurity + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1beta1 + kind: PodSecurityConfiguration + defaults: + enforce: "baseline" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" + exemptions: + usernames: [] + runtimeClasses: [] + namespaces: [kube-system] + EOF + ``` 1. Configure the API server to consume this file during cluster creation: @@ -234,22 +235,22 @@ EOF EOF ``` - {{}} - If you use Docker Desktop with KinD, the `/tmp` - directory is added as a Shared Directory under - **Preferences > Resources > File Sharing** on Mac OS. - {{}} + {{}} + If you use Docker Desktop with KinD on macOS, you can + add `/tmp` as a Shared Directory under the menu item + **Preferences > Resources > File Sharing**. + {{}} -2. Create a cluster that uses Pod Security Admission to apply +1. Create a cluster that uses Pod Security Admission to apply these Pod Security Standards: ```shell - kind create cluster --name psa-with-cluster-pss --image kindest/node:latest --config /tmp/pss/cluster-config.yaml + kind create cluster --name psa-with-cluster-pss --image kindest/node:v1.23.0 --config /tmp/pss/cluster-config.yaml ``` The output is similar to this: ``` Creating cluster "psa-with-cluster-pss" ... - ✓ Ensuring node image (kindest/node:latest) 🖼 + ✓ Ensuring node image (kindest/node:v1.23.0) 🖼 ✓ Preparing nodes 📦 ✓ Writing configuration 📜 ✓ Starting control-plane 🕹️ @@ -261,17 +262,20 @@ EOF kubectl cluster-info --context kind-psa-with-cluster-pss Have a question, bug, or feature request? Let us know! https://kind.sigs.k8s.io/#community 🙂 - -3. Point kubectl to the cluster - ```shell - kubectl cluster-info --context kind-psa-with-cluster-pss - Kubernetes control plane is running at https://127.0.0.1:63855 - CoreDNS is running at https://127.0.0.1:63855/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy - - To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. ``` -4. Create a Pod with minimal configuration in the default namespace: +1. Point kubectl to the cluster + ```shell + kubectl cluster-info --context kind-psa-with-cluster-pss + ``` + The output is similar to this: + ``` + Kubernetes control plane is running at https://127.0.0.1:63855 + CoreDNS is running at https://127.0.0.1:63855/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy + + To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. + ``` +1. Create the following Pod specification for a minimal configuration in the default namespace: ``` cat < /tmp/pss/nginx-pod.yaml @@ -287,8 +291,8 @@ EOF - containerPort: 80 EOF ``` -5. Create Pod after pod security is enabled at cluster level: - +1. Create the Pod in the cluster: + ```shell kubectl apply -f /tmp/pss/nginx-pod.yaml ``` @@ -296,24 +300,25 @@ EOF ``` Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") pod/nginx created - ``` + ``` + ## Clean up -Run `kind delete cluster -name psa-with-cluster-pss` and -`kind delete cluster -name psa-wo-cluster-pss` to delete the clusters you +Run `kind delete cluster -name psa-with-cluster-pss` and +`kind delete cluster -name psa-wo-cluster-pss` to delete the clusters you created. ## {{% heading "whatsnext" %}} -- Run a - [gist](https://gist.github.com/PushkarJ/9f7a0045f4bec31097bdd1e9db0f2f6e) +- Run a + [shell script](/examples/security/kind-with-cluster-level-baseline-pod-security.sh) to perform all the preceding steps at once: - 1. Create a Pod Security Standards based cluster level Configuration - 2. Create a file to let API server consumes this configuration - 3. Create a cluster that creates an API server with this configuration - 4. Set kubectl context to this new cluster - 5. Create a minimal pod yaml file - 6. Apply this file to create a Pod in the new cluster + 1. Create a Pod Security Standards based cluster level Configuration + 2. Create a file to let API server consumes this configuration + 3. Create a cluster that creates an API server with this configuration + 4. Set kubectl context to this new cluster + 5. Create a minimal pod yaml file + 6. Apply this file to create a Pod in the new cluster - [Pod Security Admission](/docs/concepts/security/pod-security-admission/) - [Pod Security Standards](/docs/concepts/security/pod-security-standards/) -- [Applying Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/) +- [Apply Pod Security Standards at the namespace level](/docs/tutorials/security/ns-level-pss/) diff --git a/content/en/docs/tutorials/security/ns-level-pss.md b/content/en/docs/tutorials/security/ns-level-pss.md index 5f975418c5..119c1411e7 100644 --- a/content/en/docs/tutorials/security/ns-level-pss.md +++ b/content/en/docs/tutorials/security/ns-level-pss.md @@ -1,37 +1,40 @@ --- -title: Applying Pod Security Standards at Namespace level +title: Apply Pod Security Standards at the Namespace Level content_type: tutorial weight: 10 --- {{% alert title="Note" %}} -This tutorial applies only for new clusters. +This tutorial applies only for new clusters. {{% /alert %}} Pod Security admission (PSA) is enabled by default in v1.23 and later, as it [graduated -to beta](/blog/2021/12/15/pod-security-admission-beta/). Pod Security Admission -is an admission controller that applies Pod Security Standards when pods are -created. In this tutorial, we will enforce `baseline` Pod Security Standard, +to beta](/blog/2021/12/09/pod-security-admission-beta/). Pod Security Admission +is an admission controller that applies +[Pod Security Standards](docs/concepts/security/pod-security-standards/) +when pods are created. In this tutorial, you will enforce the `baseline` Pod Security Standard, one namespace at a time. -# Pre-requisites +You can also apply Pod Security Standards to multiple namespaces at once at the cluster +level. For instructions, refer to [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss). +## {{% heading "prerequisites" %}} Install the following on your workstation: - [KinD](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) - [kubectl](https://kubernetes.io/docs/tasks/tools/) -# Create cluster +## Create cluster 1. Create a `KinD` cluster as follows: ```shell - kind create cluster --name psa-ns-level --image kindest/node:latest + kind create cluster --name psa-ns-level --image kindest/node:v1.23.0 ``` - The output is similar to this: + The output is similar to this: ``` Creating cluster "psa-ns-level" ... - ✓ Ensuring node image (kindest/node:latest) 🖼 + ✓ Ensuring node image (kindest/node:v1.23.0) 🖼 ✓ Preparing nodes 📦 ✓ Writing configuration 📜 ✓ Starting control-plane 🕹️ @@ -45,11 +48,11 @@ Install the following on your workstation: Not sure what to do next? 😅 Check out https://kind.sigs.k8s.io/docs/user/quick-start/ ``` -2. Set the kubectl context to the new cluster +1. Set the kubectl context to the new cluster: ```shell kubectl cluster-info --context kind-psa-ns-level ``` - The output is similar to this: + The output is similar to this: ``` Kubernetes control plane is running at https://127.0.0.1:50996 CoreDNS is running at https://127.0.0.1:50996/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy @@ -57,9 +60,9 @@ Install the following on your workstation: To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'. ``` -# Create Namespace +## Create a namespace -Create a new namespace `example` for this tutorial: +Create a new namespace called `example`: ```shell kubectl create ns example @@ -69,36 +72,34 @@ The output is similar to this: namespace/example created ``` -# Applying one Pod Security Standard +## Apply Pod Security Standards -Enable Pod Security Standards on this namespace using labels supported by -built-in Pod Security Admission. In this step we will warn on baseline pod -security standard as per the latest version (default value) +1. Enable Pod Security Standards on this namespace using labels supported by + built-in Pod Security Admission. In this step we will warn on baseline pod + security standard as per the latest version (default value) -```shell -kubectl label --overwrite ns example \ - pod-security.kubernetes.io/warn=baseline \ - pod-security.kubernetes.io/warn-version=latest -``` + ```shell + kubectl label --overwrite ns example \ + pod-security.kubernetes.io/warn=baseline \ + pod-security.kubernetes.io/warn-version=latest + ``` -# Applying multiple Pod Security Standards +2. Multiple pod security standards can be enabled on any namespace, using labels. + Following command will `enforce` the `baseline` Pod Security Standard, but + `warn` and `audit` for `restricted` Pod Security Standards as per the latest + version (default value) -Multiple pod security standards can be enabled on any namespace, using labels. -Following command will `enforce` the `baseline` Pod Security Standard, but -`warn` and `audit` for `restricted` Pod Security Standards as per the latest -version (default value) + ``` + kubectl label --overwrite ns example \ + pod-security.kubernetes.io/enforce=baseline \ + pod-security.kubernetes.io/enforce-version=latest \ + pod-security.kubernetes.io/warn=restricted \ + pod-security.kubernetes.io/warn-version=latest \ + pod-security.kubernetes.io/audit=restricted \ + pod-security.kubernetes.io/audit-version=latest + ``` -``` -kubectl label --overwrite ns example \ - pod-security.kubernetes.io/enforce=baseline \ - pod-security.kubernetes.io/enforce-version=latest \ - pod-security.kubernetes.io/warn=restricted \ - pod-security.kubernetes.io/warn-version=latest \ - pod-security.kubernetes.io/audit=restricted \ - pod-security.kubernetes.io/audit-version=latest -``` - -# Create Pod +## Verify the Pod Security Standards 1. Create a minimal pod in `example` namespace: @@ -116,45 +117,43 @@ kubectl label --overwrite ns example \ - containerPort: 80 EOF ``` -2. Apply the pod spec to the cluster in `example` namespace: +1. Apply the pod spec to the cluster in `example` namespace: ```shell kubectl apply -n example -f /tmp/pss/nginx-pod.yaml ``` - The output is similar to this: + The output is similar to this: ``` Warning: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "nginx" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "nginx" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "nginx" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "nginx" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost") pod/nginx created ``` - -3. Apply the pod spec to the cluster in `default` namespace: + +1. Apply the pod spec to the cluster in `default` namespace: ```shell kubectl apply -n default -f /tmp/pss/nginx-pod.yaml ``` - Output is similar to this: + Output is similar to this: ``` pod/nginx created ``` -As you can see the Pod Security Standards were applied only to `example` -namespace. For `default` namespace, pod was created without any warnings. -To apply pod security standards to multiple namespaces at once at cluster -level, please -[follow this tutorial](/docs/tutorials/security/cluster-level-pss). +The Pod Security Standards were applied only to the `example` +namespace. You could create the same Pod in the `default` namespace +with no warnings. -# Clean up +## Clean up Run `kind delete cluster -name psa-ns-level` to delete the cluster created. ## {{% heading "whatsnext" %}} - Run a -[gist](https://gist.github.com/PushkarJ/c694bac35c2d100f906861667474afb5) -to perform all the preceding steps all at once. - 1. Create KinD cluster - 2. Create new namespace - 3. Apply `baseline` Pod Security Standard in `enforce` mode while applying - `restricted` Pod Security Standard also in `warn` and `audit` mode. - 4. Create a new pod with the following pod security standards applied + [shell script](/examples/security/kind-with-namespace-level-baseline-pod-security.sh) + to perform all the preceding steps all at once. + 1. Create KinD cluster + 2. Create new namespace + 3. Apply `baseline` Pod Security Standard in `enforce` mode while applying + `restricted` Pod Security Standard also in `warn` and `audit` mode. + 4. Create a new pod with the following pod security standards applied - [Pod Security Admission](/docs/concepts/security/pod-security-admission/) - [Pod Security Standards](/docs/concepts/security/pod-security-standards/) -- [Applying Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/) \ No newline at end of file +- [Apply Pod Security Standards at the cluster level](/docs/tutorials/security/cluster-level-pss/) \ No newline at end of file diff --git a/content/en/examples/security/kind-with-cluster-level-baseline-pod-security.sh b/content/en/examples/security/kind-with-cluster-level-baseline-pod-security.sh new file mode 100644 index 0000000000..690b333443 --- /dev/null +++ b/content/en/examples/security/kind-with-cluster-level-baseline-pod-security.sh @@ -0,0 +1,70 @@ +#!/bin/sh +mkdir -p /tmp/pss +cat < /tmp/pss/cluster-level-pss.yaml +apiVersion: apiserver.config.k8s.io/v1 +kind: AdmissionConfiguration +plugins: +- name: PodSecurity + configuration: + apiVersion: pod-security.admission.config.k8s.io/v1beta1 + kind: PodSecurityConfiguration + defaults: + enforce: "baseline" + enforce-version: "latest" + audit: "restricted" + audit-version: "latest" + warn: "restricted" + warn-version: "latest" + exemptions: + usernames: [] + runtimeClasses: [] + namespaces: [kube-system] +EOF +cat < /tmp/pss/cluster-config.yaml +kind: Cluster +apiVersion: kind.x-k8s.io/v1alpha4 +nodes: +- role: control-plane + kubeadmConfigPatches: + - | + kind: ClusterConfiguration + apiServer: + extraArgs: + admission-control-config-file: /etc/config/cluster-level-pss.yaml + extraVolumes: + - name: accf + hostPath: /etc/config + mountPath: /etc/config + readOnly: false + pathType: "DirectoryOrCreate" + extraMounts: + - hostPath: /tmp/pss + containerPath: /etc/config + # optional: if set, the mount is read-only. + # default false + readOnly: false + # optional: if set, the mount needs SELinux relabeling. + # default false + selinuxRelabel: false + # optional: set propagation mode (None, HostToContainer or Bidirectional) + # see https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation + # default None + propagation: None +EOF +kind create cluster --name psa-with-cluster-pss --image kindest/node:v1.23.0 --config /tmp/pss/cluster-config.yaml +kubectl cluster-info --context kind-psa-with-cluster-pss +# Wait for 15 seconds (arbitrary) ServiceAccount Admission Controller to be available +sleep 15 +cat < /tmp/pss/nginx-pod.yaml +apiVersion: v1 +kind: Pod +metadata: + name: nginx +spec: + containers: + - image: nginx + name: nginx + ports: + - containerPort: 80 +EOF +kubectl apply -f /tmp/pss/nginx-pod.yaml diff --git a/content/en/examples/security/kind-with-namespace-level-baseline-pod-security.sh b/content/en/examples/security/kind-with-namespace-level-baseline-pod-security.sh new file mode 100644 index 0000000000..2081de7c14 --- /dev/null +++ b/content/en/examples/security/kind-with-namespace-level-baseline-pod-security.sh @@ -0,0 +1,28 @@ +#!/bin/sh +# Until v1.23 is released, kind node image needs to be built from k/k master branch +# Ref: https://kind.sigs.k8s.io/docs/user/quick-start/#building-images +kind create cluster --name psa-ns-level --image kindest/node:v1.23.0 +kubectl cluster-info --context kind-psa-ns-level +# Wait for 15 seconds (arbitrary) ServiceAccount Admission Controller to be available +sleep 15 +kubectl create ns example +kubectl label --overwrite ns example \ + pod-security.kubernetes.io/enforce=baseline \ + pod-security.kubernetes.io/enforce-version=latest \ + pod-security.kubernetes.io/warn=restricted \ + pod-security.kubernetes.io/warn-version=latest \ + pod-security.kubernetes.io/audit=restricted \ + pod-security.kubernetes.io/audit-version=latest +cat < /tmp/pss/nginx-pod.yaml +apiVersion: v1 +kind: Pod +metadata: + name: nginx +spec: + containers: + - image: nginx + name: nginx + ports: + - containerPort: 80 +EOF +kubectl apply -n example -f /tmp/pss/nginx-pod.yaml From b1981993363a631e7a38de84eaf987dbe4862805 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Wed, 8 Dec 2021 15:46:50 +0800 Subject: [PATCH 144/148] Configuration API for v1.23 --- .../cluster-administration/system-traces.md | 4 +- .../scheduling-eviction/kube-scheduler.md | 2 +- .../scheduler-perf-tuning.md | 4 +- content/en/docs/reference/_index.md | 4 +- .../config-api/apiserver-audit.v1.md | 28 + ...1alpha1.md => apiserver-config.v1beta1.md} | 181 +- .../config-api/kube-proxy-config.v1alpha1.md | 129 ++ .../kube-scheduler-config.v1beta2.md | 1172 ++++-------- .../kube-scheduler-config.v1beta3.md | 1587 +++++++++++++++++ .../kube-scheduler-policy-config.v1.md | 4 +- .../config-api/kubeadm-config.v1beta3.md | 444 +++-- .../config-api/kubelet-config.v1beta1.md | 239 ++- .../en/docs/reference/scheduling/config.md | 5 +- .../en/docs/reference/scheduling/policies.md | 2 +- .../configure-multiple-schedulers.md | 4 +- 15 files changed, 2552 insertions(+), 1257 deletions(-) rename content/en/docs/reference/config-api/{apiserver-config.v1alpha1.md => apiserver-config.v1beta1.md} (51%) create mode 100644 content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md diff --git a/content/en/docs/concepts/cluster-administration/system-traces.md b/content/en/docs/concepts/cluster-administration/system-traces.md index f324604b16..51428bad3e 100644 --- a/content/en/docs/concepts/cluster-administration/system-traces.md +++ b/content/en/docs/concepts/cluster-administration/system-traces.md @@ -66,7 +66,7 @@ with `--tracing-config-file=`. This is an example config that re spans for 1 in 10000 requests, and uses the default OpenTelemetry endpoint: ```yaml -apiVersion: apiserver.config.k8s.io/v1alpha1 +apiVersion: apiserver.config.k8s.io/v1beta1 kind: TracingConfiguration # default value #endpoint: localhost:4317 @@ -74,7 +74,7 @@ samplingRatePerMillion: 100 ``` For more information about the `TracingConfiguration` struct, see -[API server config API (v1alpha1)](/docs/reference/config-api/apiserver-config.v1alpha1/#apiserver-k8s-io-v1alpha1-TracingConfiguration). +[API server config API (v1beta1)](/docs/reference/config-api/apiserver-config.v1beta1/#apiserver-k8s-io-v1beta1-TracingConfiguration). ## Stability diff --git a/content/en/docs/concepts/scheduling-eviction/kube-scheduler.md b/content/en/docs/concepts/scheduling-eviction/kube-scheduler.md index 916f050513..df688ded9a 100644 --- a/content/en/docs/concepts/scheduling-eviction/kube-scheduler.md +++ b/content/en/docs/concepts/scheduling-eviction/kube-scheduler.md @@ -85,7 +85,7 @@ of the scheduler: * Read about [scheduler performance tuning](/docs/concepts/scheduling-eviction/scheduler-perf-tuning/) * Read about [Pod topology spread constraints](/docs/concepts/workloads/pods/pod-topology-spread-constraints/) * Read the [reference documentation](/docs/reference/command-line-tools-reference/kube-scheduler/) for kube-scheduler -* Read the [kube-scheduler config (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) reference +* Read the [kube-scheduler config (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) reference * Learn about [configuring multiple schedulers](/docs/tasks/extend-kubernetes/configure-multiple-schedulers/) * Learn about [topology management policies](/docs/tasks/administer-cluster/topology-manager/) * Learn about [Pod Overhead](/docs/concepts/scheduling-eviction/pod-overhead/) diff --git a/content/en/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md b/content/en/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md index 5894398c9b..00302166ce 100644 --- a/content/en/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md +++ b/content/en/docs/concepts/scheduling-eviction/scheduler-perf-tuning.md @@ -43,7 +43,7 @@ If you set `percentageOfNodesToScore` above 100, kube-scheduler acts as if you had set a value of 100. To change the value, edit the -[kube-scheduler configuration file](/docs/reference/config-api/kube-scheduler-config.v1beta2/) +[kube-scheduler configuration file](/docs/reference/config-api/kube-scheduler-config.v1beta3/) and then restart the scheduler. In many cases, the configuration file can be found at `/etc/kubernetes/config/kube-scheduler.yaml`. @@ -161,5 +161,5 @@ After going over all the Nodes, it goes back to Node 1. ## {{% heading "whatsnext" %}} -* Check the [kube-scheduler configuration reference (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) +* Check the [kube-scheduler configuration reference (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) diff --git a/content/en/docs/reference/_index.md b/content/en/docs/reference/_index.md index 5d1826f461..377c612e61 100644 --- a/content/en/docs/reference/_index.md +++ b/content/en/docs/reference/_index.md @@ -73,10 +73,10 @@ configure kubernetes components or tools. Most of these APIs are not exposed by the API server in a RESTful way though they are essential for a user or an operator to use or manage a cluster. -* [kube-apiserver configuration (v1alpha1)](/docs/reference/config-api/apiserver-config.v1alpha1/) +* [kube-apiserver configuration (v1beta1)](/docs/reference/config-api/apiserver-config.v1beta1/) * [kubelet configuration (v1beta1)](/docs/reference/config-api/kubelet-config.v1beta1/) -* [kube-scheduler configuration (v1beta1)](/docs/reference/config-api/kube-scheduler-config.v1beta1/) * [kube-scheduler configuration (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) +* [kube-scheduler configuration (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) * [kube-scheduler policy reference (v1)](/docs/reference/config-api/kube-scheduler-policy-config.v1/) * [kube-proxy configuration (v1alpha1)](/docs/reference/config-api/kube-proxy-config.v1alpha1/) * [`audit.k8s.io/v1` API](/docs/reference/config-api/apiserver-audit.v1/) diff --git a/content/en/docs/reference/config-api/apiserver-audit.v1.md b/content/en/docs/reference/config-api/apiserver-audit.v1.md index 11df06bd8c..f722e81341 100644 --- a/content/en/docs/reference/config-api/apiserver-audit.v1.md +++ b/content/en/docs/reference/config-api/apiserver-audit.v1.md @@ -279,6 +279,19 @@ be specified per rule in which case the union of both are omitted. +omitManagedFields
    +bool + + + OmitManagedFields indicates whether to omit the managed fields of the request +and response bodies from being written to the API audit log. +This is used as a global default - a value of 'true' will omit the managed fileds, +otherwise the managed fields will be included in the API audit log. +Note that this can also be specified per rule in which case the value specified +in a rule will override the global default. + + + @@ -594,6 +607,21 @@ An empty list means no restrictions will apply. +omitManagedFields
    +bool + + + OmitManagedFields indicates whether to omit the managed fields of the request +and response bodies from being written to the API audit log. +- a value of 'true' will drop the managed fields from the API audit log +- a value of 'false' indicates that the managed fileds should be included + in the API audit log +Note that the value, if specified, in this rule will override the global default +If a value is not specified then the global default specified in +Policy.OmitManagedFields will stand. + + + diff --git a/content/en/docs/reference/config-api/apiserver-config.v1alpha1.md b/content/en/docs/reference/config-api/apiserver-config.v1beta1.md similarity index 51% rename from content/en/docs/reference/config-api/apiserver-config.v1alpha1.md rename to content/en/docs/reference/config-api/apiserver-config.v1beta1.md index 81702355a5..fb5363f58d 100644 --- a/content/en/docs/reference/config-api/apiserver-config.v1alpha1.md +++ b/content/en/docs/reference/config-api/apiserver-config.v1beta1.md @@ -1,53 +1,20 @@ --- -title: kube-apiserver Configuration (v1alpha1) +title: kube-apiserver Configuration (v1beta1) content_type: tool-reference -package: apiserver.k8s.io/v1alpha1 +package: apiserver.k8s.io/v1beta1 auto_generated: true --- -Package v1alpha1 is the v1alpha1 version of the API. +Package v1beta1 is the v1beta1 version of the API. ## Resource Types -- [AdmissionConfiguration](#apiserver-k8s-io-v1alpha1-AdmissionConfiguration) -- [EgressSelectorConfiguration](#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration) -- [TracingConfiguration](#apiserver-k8s-io-v1alpha1-TracingConfiguration) +- [EgressSelectorConfiguration](#apiserver-k8s-io-v1beta1-EgressSelectorConfiguration) -## `AdmissionConfiguration` {#apiserver-k8s-io-v1alpha1-AdmissionConfiguration} - - - - - -AdmissionConfiguration provides versioned configuration for admission controllers. - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string
    apiserver.k8s.io/v1alpha1
    kind
    string
    AdmissionConfiguration
    plugins
    -[]AdmissionPluginConfiguration -
    - Plugins allows specifying a configuration per admission control plugin.
    - - - -## `EgressSelectorConfiguration` {#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration} +## `EgressSelectorConfiguration` {#apiserver-k8s-io-v1beta1-EgressSelectorConfiguration} @@ -59,14 +26,14 @@ EgressSelectorConfiguration provides versioned configuration for egress selector FieldDescription -apiVersion
    stringapiserver.k8s.io/v1alpha1 +apiVersion
    stringapiserver.k8s.io/v1beta1 kind
    stringEgressSelectorConfiguration egressSelections [Required]
    -[]EgressSelection +[]EgressSelection connectionServices contains a list of egress selection client configurations @@ -78,108 +45,14 @@ EgressSelectorConfiguration provides versioned configuration for egress selector -## `TracingConfiguration` {#apiserver-k8s-io-v1alpha1-TracingConfiguration} - - - - - -TracingConfiguration provides versioned configuration for tracing clients. - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    apiVersion
    string
    apiserver.k8s.io/v1alpha1
    kind
    string
    TracingConfiguration
    endpoint
    -string -
    - Endpoint of the collector that's running on the control-plane node. -The APIServer uses the egressType ControlPlane when sending data to the collector. -The syntax is defined in https://github.com/grpc/grpc/blob/master/doc/naming.md. -Defaults to the otlpgrpc default, localhost:4317 -The connection is insecure, and does not support TLS.
    samplingRatePerMillion
    -int32 -
    - SamplingRatePerMillion is the number of samples to collect per million spans. -Defaults to 0.
    - - - -## `AdmissionPluginConfiguration` {#apiserver-k8s-io-v1alpha1-AdmissionPluginConfiguration} +## `Connection` {#apiserver-k8s-io-v1beta1-Connection} **Appears in:** -- [AdmissionConfiguration](#apiserver-k8s-io-v1alpha1-AdmissionConfiguration) - - -AdmissionPluginConfiguration provides the configuration for a single plug-in. - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    name [Required]
    -string -
    - Name is the name of the admission controller. -It must match the registered admission plugin name.
    path
    -string -
    - Path is the path to a configuration file that contains the plugin's -configuration
    configuration
    -k8s.io/apimachinery/pkg/runtime.Unknown -
    - Configuration is an embedded configuration object to be used as the plugin's -configuration. If present, it will be used instead of the path to the configuration file.
    - - - -## `Connection` {#apiserver-k8s-io-v1alpha1-Connection} - - - - -**Appears in:** - -- [EgressSelection](#apiserver-k8s-io-v1alpha1-EgressSelection) +- [EgressSelection](#apiserver-k8s-io-v1beta1-EgressSelection) Connection provides the configuration for a single egress selection client. @@ -191,7 +64,7 @@ Connection provides the configuration for a single egress selection client. proxyProtocol [Required]
    -ProtocolType +ProtocolType Protocol is the protocol used to connect from client to the konnectivity server. @@ -199,7 +72,7 @@ Connection provides the configuration for a single egress selection client. transport
    -Transport +Transport Transport defines the transport configurations we use to dial to the konnectivity server. @@ -212,14 +85,14 @@ This is required if ProxyProtocol is HTTPConnect or GRPC. -## `EgressSelection` {#apiserver-k8s-io-v1alpha1-EgressSelection} +## `EgressSelection` {#apiserver-k8s-io-v1beta1-EgressSelection} **Appears in:** -- [EgressSelectorConfiguration](#apiserver-k8s-io-v1alpha1-EgressSelectorConfiguration) +- [EgressSelectorConfiguration](#apiserver-k8s-io-v1beta1-EgressSelectorConfiguration) EgressSelection provides the configuration for a single egress selection client. @@ -241,7 +114,7 @@ The "master" egress selector is deprecated in favor of "controlplane" connection [Required]
    -Connection +Connection connection is the exact information used to configure the egress selection @@ -253,14 +126,14 @@ The "master" egress selector is deprecated in favor of "controlplane" -## `ProtocolType` {#apiserver-k8s-io-v1alpha1-ProtocolType} +## `ProtocolType` {#apiserver-k8s-io-v1beta1-ProtocolType} (Alias of `string`) **Appears in:** -- [Connection](#apiserver-k8s-io-v1alpha1-Connection) +- [Connection](#apiserver-k8s-io-v1beta1-Connection) ProtocolType is a set of valid values for Connection.ProtocolType @@ -269,14 +142,14 @@ ProtocolType is a set of valid values for Connection.ProtocolType -## `TCPTransport` {#apiserver-k8s-io-v1alpha1-TCPTransport} +## `TCPTransport` {#apiserver-k8s-io-v1beta1-TCPTransport} **Appears in:** -- [Transport](#apiserver-k8s-io-v1alpha1-Transport) +- [Transport](#apiserver-k8s-io-v1beta1-Transport) TCPTransport provides the information to connect to konnectivity server via TCP @@ -297,7 +170,7 @@ As an example it might be "https://127.0.0.1:8131" tlsConfig
    -TLSConfig +TLSConfig TLSConfig is the config needed to use TLS when connecting to konnectivity server @@ -309,14 +182,14 @@ As an example it might be "https://127.0.0.1:8131" -## `TLSConfig` {#apiserver-k8s-io-v1alpha1-TLSConfig} +## `TLSConfig` {#apiserver-k8s-io-v1beta1-TLSConfig} **Appears in:** -- [TCPTransport](#apiserver-k8s-io-v1alpha1-TCPTransport) +- [TCPTransport](#apiserver-k8s-io-v1beta1-TCPTransport) TLSConfig provides the authentication information to connect to konnectivity server @@ -363,14 +236,14 @@ Must be configured if TCPTransport.URL is prefixed with https:// -## `Transport` {#apiserver-k8s-io-v1alpha1-Transport} +## `Transport` {#apiserver-k8s-io-v1beta1-Transport} **Appears in:** -- [Connection](#apiserver-k8s-io-v1alpha1-Connection) +- [Connection](#apiserver-k8s-io-v1beta1-Connection) Transport defines the transport configurations we use to dial to the konnectivity server @@ -382,7 +255,7 @@ Transport defines the transport configurations we use to dial to the konnectivit tcp
    -TCPTransport +TCPTransport TCP is the TCP configuration for communicating with the konnectivity server via TCP @@ -392,7 +265,7 @@ Requires at least one of TCP or UDS to be set uds
    -UDSTransport +UDSTransport UDS is the UDS configuration for communicating with the konnectivity server via UDS @@ -405,14 +278,14 @@ Requires at least one of TCP or UDS to be set -## `UDSTransport` {#apiserver-k8s-io-v1alpha1-UDSTransport} +## `UDSTransport` {#apiserver-k8s-io-v1beta1-UDSTransport} **Appears in:** -- [Transport](#apiserver-k8s-io-v1alpha1-Transport) +- [Transport](#apiserver-k8s-io-v1beta1-Transport) UDSTransport provides the information to connect to konnectivity server via UDS diff --git a/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md b/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md index 94209488fe..c0c2312f6f 100644 --- a/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md +++ b/content/en/docs/reference/config-api/kube-proxy-config.v1alpha1.md @@ -548,6 +548,8 @@ this always falls back to the userspace proxy. - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + - [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) @@ -611,6 +613,8 @@ client. **Appears in:** +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) @@ -641,6 +645,75 @@ enableProfiling is true. + + + +## `FormatOptions` {#FormatOptions} + + + + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +FormatOptions contains options for the different logging formats. + + + + + + + + + + + + + +
    FieldDescription
    json [Required]
    +JSONOptions +
    + [Experimental] JSON contains options for logging format "json".
    + +## `JSONOptions` {#JSONOptions} + + + + +**Appears in:** + +- [FormatOptions](#FormatOptions) + + +JSONOptions contains options for logging format "json". + + + + + + + + + + + + + + + + +
    FieldDescription
    splitStream [Required]
    +bool +
    + [Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering.
    infoBufferSize [Required]
    +k8s.io/apimachinery/pkg/api/resource.QuantityValue +
    + [Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.
    @@ -653,6 +726,8 @@ enableProfiling is true. - [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + - [GenericControllerManagerConfiguration](#controllermanager-config-k8s-io-v1alpha1-GenericControllerManagerConfiguration) @@ -767,6 +842,35 @@ default value of format is `text` +flushFrequency [Required]
    +time.Duration + + + Maximum number of seconds between log flushes. Ignored if the +selected logging backend writes log messages without buffering. + + + +verbosity [Required]
    +uint32 + + + Verbosity is the threshold that determines which log messages are +logged. Default is zero which logs only the most important +messages. Higher values enable additional messages. Error messages +are always logged. + + + +vmodule [Required]
    +VModuleConfiguration + + + VModule overrides the verbosity threshold for individual files. +Only supported for "text" log format. + + + sanitization [Required]
    bool @@ -776,5 +880,30 @@ Runtime log sanitization may introduce significant computation overhead and ther +options [Required]
    +FormatOptions + + + [Experimental] Options holds additional parameters that are specific +to the different logging formats. Only the options for the selected +format get used, but all of them get validated. + + + + +## `VModuleConfiguration` {#VModuleConfiguration} + +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold. + + diff --git a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md index 1a28c03c88..5479abcf36 100644 --- a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md +++ b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta2.md @@ -17,243 +17,6 @@ auto_generated: true - [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta2-NodeResourcesFitArgs) - [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta2-PodTopologySpreadArgs) - [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta2-VolumeBindingArgs) -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) - - - -## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - -ClientConnectionConfiguration contains details for constructing a client. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    kubeconfig [Required]
    -string -
    - kubeconfig is the path to a KubeConfig file.
    acceptContentTypes [Required]
    -string -
    - acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the -default value of 'application/json'. This field will control all connections to the server used by a particular -client.
    contentType [Required]
    -string -
    - contentType is the content type used when sending data to the server from this client.
    qps [Required]
    -float32 -
    - qps controls the number of queries per second allowed for this connection.
    burst [Required]
    -int32 -
    - burst allows extra queries to accumulate when a client is exceeding its rate.
    - -## `DebuggingConfiguration` {#DebuggingConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - -DebuggingConfiguration holds configuration for Debugging related features. - - - - - - - - - - - - - - - - - - -
    FieldDescription
    enableProfiling [Required]
    -bool -
    - enableProfiling enables profiling via web interface host:port/debug/pprof/
    enableContentionProfiling [Required]
    -bool -
    - enableContentionProfiling enables lock contention profiling, if -enableProfiling is true.
    - -## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} - - - - -**Appears in:** - -- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) - - -LeaderElectionConfiguration defines the configuration of leader election -clients for components that can run with leader election enabled. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    leaderElect [Required]
    -bool -
    - leaderElect enables a leader election client to gain leadership -before executing the main loop. Enable this when running replicated -components for high availability.
    leaseDuration [Required]
    -meta/v1.Duration -
    - leaseDuration is the duration that non-leader candidates will wait -after observing a leadership renewal until attempting to acquire -leadership of a led but unrenewed leader slot. This is effectively the -maximum duration that a leader can be stopped before it is replaced -by another candidate. This is only applicable if leader election is -enabled.
    renewDeadline [Required]
    -meta/v1.Duration -
    - renewDeadline is the interval between attempts by the acting master to -renew a leadership slot before it stops leading. This must be less -than or equal to the lease duration. This is only applicable if leader -election is enabled.
    retryPeriod [Required]
    -meta/v1.Duration -
    - retryPeriod is the duration the clients should wait between attempting -acquisition and renewal of a leadership. This is only applicable if -leader election is enabled.
    resourceLock [Required]
    -string -
    - resourceLock indicates the resource object type that will be used to lock -during leader election cycles.
    resourceName [Required]
    -string -
    - resourceName indicates the name of resource object that will be used to lock -during leader election cycles.
    resourceNamespace [Required]
    -string -
    - resourceName indicates the namespace of resource object that will be used to lock -during leader election cycles.
    - -## `LoggingConfiguration` {#LoggingConfiguration} - - - - -**Appears in:** - -- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) - - -LoggingConfiguration contains logging options -Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. - - - - - - - - - - - - - - - - - - -
    FieldDescription
    format [Required]
    -string -
    - Format Flag specifies the structure of log messages. -default value of format is `text`
    sanitization [Required]
    -bool -
    - [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). -Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
    @@ -386,8 +149,9 @@ settings for the proxy server to use when communicating with the apiserver. string - HealthzBindAddress is the IP address and port for the health check server to serve on, -defaulting to 0.0.0.0:10251 + Note: Both HealthzBindAddress and MetricsBindAddress fields are deprecated. +Only empty address or port 0 is allowed. Anything else will fail validation. +HealthzBindAddress is the IP address and port for the health check server to serve on. @@ -395,8 +159,7 @@ defaulting to 0.0.0.0:10251 string - MetricsBindAddress is the IP address and port for the metrics server to -serve on, defaulting to 0.0.0.0:10251. + MetricsBindAddress is the IP address and port for the metrics server to serve on. @@ -770,7 +533,7 @@ can implement this function. tlsConfig [Required]
    -ExtenderTLSConfig +ExtenderTLSConfig TLSConfig specifies the transport layer security config @@ -797,7 +560,7 @@ assuming that the extender already cached full details of all nodes in the clust managedResources
    -[]ExtenderManagedResource +[]ExtenderManagedResource ManagedResources is a list of extended resources that are managed by @@ -825,6 +588,139 @@ fail when the extender returns an error or is not reachable. +## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1beta2-ExtenderManagedResource} + + + + +**Appears in:** + +- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) + + +ExtenderManagedResource describes the arguments of extended resources +managed by an extender. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    name [Required]
    +string +
    + Name is the extended resource name.
    ignoredByScheduler [Required]
    +bool +
    + IgnoredByScheduler indicates whether kube-scheduler should ignore this +resource when applying predicates.
    + + + +## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1beta2-ExtenderTLSConfig} + + + + +**Appears in:** + +- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) + + +ExtenderTLSConfig contains settings to enable TLS with extender + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    insecure [Required]
    +bool +
    + Server should be accessed without verifying the TLS certificate. For testing only.
    serverName [Required]
    +string +
    + ServerName is passed to the server for SNI and is used in the client to check server +certificates against. If ServerName is empty, the hostname used to contact the +server is used.
    certFile [Required]
    +string +
    + Server requires TLS client certificate authentication
    keyFile [Required]
    +string +
    + Server requires TLS client certificate authentication
    caFile [Required]
    +string +
    + Trusted root certificates for server
    certData [Required]
    +[]byte +
    + CertData holds PEM-encoded bytes (typically read from a client certificate file). +CertData takes precedence over CertFile
    keyData [Required]
    +[]byte +
    + KeyData holds PEM-encoded bytes (typically read from a client certificate key file). +KeyData takes precedence over KeyFile
    caData [Required]
    +[]byte +
    + CAData holds PEM-encoded bytes (typically read from a root certificates bundle). +CAData takes precedence over CAFile
    + + + ## `KubeSchedulerProfile` {#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile} @@ -1057,7 +953,7 @@ be invoked before default plugins, default plugins must be disabled and re-enabl PluginSet - PostFilter is a list of plugins that are invoked after filtering phase, no matter whether filtering succeeds or not. + PostFilter is a list of plugins that are invoked after filtering phase, but only when no feasible nodes were found for the pod. @@ -1119,6 +1015,14 @@ The scheduler call these plugins in order. Scheduler skips the rest of these plu +multiPoint [Required]
    +PluginSet + + + MultiPoint is a simplified config section to enable plugins for all valid extension points. + + + @@ -1322,89 +1226,80 @@ UtilizationShapePoint represents single point of priority function shape. - -## `Policy` {#kubescheduler-config-k8s-io-v1-Policy} +## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} +**Appears in:** -Policy describes a struct for a policy resource used in api. +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + + +ClientConnectionConfiguration contains details for constructing a client. - - - - - + kubeconfig is the path to a KubeConfig file. - + acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the +default value of 'application/json'. This field will control all connections to the server used by a particular +client. - + contentType is the content type used when sending data to the server from this client. - + + + + + - - - - - + burst allows extra queries to accumulate when a client is exceeding its rate.
    FieldDescription
    apiVersion
    string
    kubescheduler.config.k8s.io/v1
    kind
    string
    Policy
    predicates [Required]
    -[]PredicatePolicy +
    kubeconfig [Required]
    +string
    - Holds the information to configure the fit predicate functions
    priorities [Required]
    -[]PriorityPolicy +
    acceptContentTypes [Required]
    +string
    - Holds the information to configure the priority functions
    extenders [Required]
    -[]LegacyExtender +
    contentType [Required]
    +string
    - Holds the information to communicate with the extender(s)
    hardPodAffinitySymmetricWeight [Required]
    +
    qps [Required]
    +float32 +
    + qps controls the number of queries per second allowed for this connection.
    burst [Required]
    int32
    - RequiredDuringScheduling affinity is not symmetric, but there is an implicit PreferredDuringScheduling affinity rule -corresponding to every RequiredDuringScheduling affinity rule. -HardPodAffinitySymmetricWeight represents the weight of implicit PreferredDuringScheduling affinity rule, in the range 1-100.
    alwaysCheckAllPredicates [Required]
    -bool -
    - When AlwaysCheckAllPredicates is set to true, scheduler checks all -the configured predicates even after one or more of them fails. -When the flag is set to false, scheduler skips checking the rest -of the predicates after it finds one predicate that failed.
    - - -## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1-ExtenderManagedResource} +## `DebuggingConfiguration` {#DebuggingConfiguration} **Appears in:** -- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) - -- [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) -ExtenderManagedResource describes the arguments of extended resources -managed by an extender. +DebuggingConfiguration holds configuration for Debugging related features. @@ -1412,41 +1307,37 @@ managed by an extender. - - - - - - + enableProfiling enables profiling via web interface host:port/debug/pprof/ + + + + +
    FieldDescription
    name [Required]
    -string -
    - Name is the extended resource name.
    ignoredByScheduler [Required]
    +
    enableProfiling [Required]
    bool
    - IgnoredByScheduler indicates whether kube-scheduler should ignore this -resource when applying predicates.
    enableContentionProfiling [Required]
    +bool +
    + enableContentionProfiling enables lock contention profiling, if +enableProfiling is true.
    - - -## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1-ExtenderTLSConfig} +## `FormatOptions` {#FormatOptions} **Appears in:** -- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) - -- [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender) +- [LoggingConfiguration](#LoggingConfiguration) -ExtenderTLSConfig contains settings to enable TLS with extender +FormatOptions contains options for the different logging formats. @@ -1454,91 +1345,28 @@ ExtenderTLSConfig contains settings to enable TLS with extender - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + [Experimental] JSON contains options for logging format "json".
    FieldDescription
    insecure [Required]
    -bool +
    json [Required]
    +JSONOptions
    - Server should be accessed without verifying the TLS certificate. For testing only.
    serverName [Required]
    -string -
    - ServerName is passed to the server for SNI and is used in the client to check server -certificates against. If ServerName is empty, the hostname used to contact the -server is used.
    certFile [Required]
    -string -
    - Server requires TLS client certificate authentication
    keyFile [Required]
    -string -
    - Server requires TLS client certificate authentication
    caFile [Required]
    -string -
    - Trusted root certificates for server
    certData [Required]
    -[]byte -
    - CertData holds PEM-encoded bytes (typically read from a client certificate file). -CertData takes precedence over CertFile
    keyData [Required]
    -[]byte -
    - KeyData holds PEM-encoded bytes (typically read from a client certificate key file). -KeyData takes precedence over KeyFile
    caData [Required]
    -[]byte -
    - CAData holds PEM-encoded bytes (typically read from a root certificates bundle). -CAData takes precedence over CAFile
    - - -## `LabelPreference` {#kubescheduler-config-k8s-io-v1-LabelPreference} +## `JSONOptions` {#JSONOptions} **Appears in:** -- [PriorityArgument](#kubescheduler-config-k8s-io-v1-PriorityArgument) +- [FormatOptions](#FormatOptions) -LabelPreference holds the parameters that are used to configure the corresponding priority function +JSONOptions contains options for logging format "json". @@ -1546,40 +1374,40 @@ LabelPreference holds the parameters that are used to configure the correspondin - - - - - - + [Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering. + + + + +
    FieldDescription
    label [Required]
    -string -
    - Used to identify node "groups"
    presence [Required]
    +
    splitStream [Required]
    bool
    - This is a boolean flag -If true, higher priority is given to nodes that have the label -If false, higher priority is given to nodes that do not have the label
    infoBufferSize [Required]
    +k8s.io/apimachinery/pkg/api/resource.QuantityValue +
    + [Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.
    - - -## `LabelsPresence` {#kubescheduler-config-k8s-io-v1-LabelsPresence} +## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} **Appears in:** -- [PredicateArgument](#kubescheduler-config-k8s-io-v1-PredicateArgument) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) -LabelsPresence holds the parameters that are used to configure the corresponding predicate in scheduler policy configuration. +LeaderElectionConfiguration defines the configuration of leader election +clients for components that can run with leader election enabled. @@ -1587,40 +1415,92 @@ LabelsPresence holds the parameters that are used to configure the corresponding - - - - - - + leaderElect enables a leader election client to gain leadership +before executing the main loop. Enable this when running replicated +components for high availability. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    labels [Required]
    -[]string -
    - The list of labels that identify node "groups" -All of the labels should be either present (or absent) for the node to be considered a fit for hosting the pod
    presence [Required]
    +
    leaderElect [Required]
    bool
    - The boolean flag that indicates whether the labels should be present or absent from the node
    leaseDuration [Required]
    +meta/v1.Duration +
    + leaseDuration is the duration that non-leader candidates will wait +after observing a leadership renewal until attempting to acquire +leadership of a led but unrenewed leader slot. This is effectively the +maximum duration that a leader can be stopped before it is replaced +by another candidate. This is only applicable if leader election is +enabled.
    renewDeadline [Required]
    +meta/v1.Duration +
    + renewDeadline is the interval between attempts by the acting master to +renew a leadership slot before it stops leading. This must be less +than or equal to the lease duration. This is only applicable if leader +election is enabled.
    retryPeriod [Required]
    +meta/v1.Duration +
    + retryPeriod is the duration the clients should wait between attempting +acquisition and renewal of a leadership. This is only applicable if +leader election is enabled.
    resourceLock [Required]
    +string +
    + resourceLock indicates the resource object type that will be used to lock +during leader election cycles.
    resourceName [Required]
    +string +
    + resourceName indicates the name of resource object that will be used to lock +during leader election cycles.
    resourceNamespace [Required]
    +string +
    + resourceName indicates the namespace of resource object that will be used to lock +during leader election cycles.
    - - -## `LegacyExtender` {#kubescheduler-config-k8s-io-v1-LegacyExtender} +## `LoggingConfiguration` {#LoggingConfiguration} **Appears in:** -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) -LegacyExtender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, -it is assumed that the extender chose not to provide that extension. +LoggingConfiguration contains logging options +Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. @@ -1628,481 +1508,77 @@ it is assumed that the extender chose not to provide that extension. - + Format Flag specifies the structure of log messages. +default value of format is `text` - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + Maximum number of seconds between log flushes. Ignored if the +selected logging backend writes log messages without buffering. - + + + + + + + + + + + [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). +Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`) - - - - - - + [Experimental] Options holds additional parameters that are specific +to the different logging formats. Only the options for the selected +format get used, but all of them get validated.
    FieldDescription
    urlPrefix [Required]
    +
    format [Required]
    string
    - URLPrefix at which the extender is available
    filterVerb [Required]
    -string -
    - Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.
    preemptVerb [Required]
    -string -
    - Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.
    prioritizeVerb [Required]
    -string -
    - Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.
    weight [Required]
    -int64 -
    - The numeric multiplier for the node scores that the prioritize call generates. -The weight should be a positive integer
    bindVerb [Required]
    -string -
    - Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. -If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender -can implement this function.
    enableHttps [Required]
    -bool -
    - EnableHTTPS specifies whether https should be used to communicate with the extender
    tlsConfig [Required]
    -ExtenderTLSConfig -
    - TLSConfig specifies the transport layer security config
    httpTimeout [Required]
    +
    flushFrequency [Required]
    time.Duration
    - HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize -timeout is ignored, k8s/other extenders priorities are used to select the node.
    nodeCacheCapable [Required]
    +
    verbosity [Required]
    +uint32 +
    + Verbosity is the threshold that determines which log messages are +logged. Default is zero which logs only the most important +messages. Higher values enable additional messages. Error messages +are always logged.
    vmodule [Required]
    +VModuleConfiguration +
    + VModule overrides the verbosity threshold for individual files. +Only supported for "text" log format.
    sanitization [Required]
    bool
    - NodeCacheCapable specifies that the extender is capable of caching node information, -so the scheduler should only send minimal information about the eligible nodes -assuming that the extender already cached full details of all nodes in the cluster
    managedResources
    -[]ExtenderManagedResource +
    options [Required]
    +FormatOptions
    - ManagedResources is a list of extended resources that are managed by -this extender. -- A pod will be sent to the extender on the Filter, Prioritize and Bind - (if the extender is the binder) phases iff the pod requests at least - one of the extended resources in this list. If empty or unspecified, - all pods will be sent to this extender. -- If IgnoredByScheduler is set to true for a resource, kube-scheduler - will skip checking the resource in predicates.
    ignorable [Required]
    -bool -
    - Ignorable specifies if the extender is ignorable, i.e. scheduling should not -fail when the extender returns an error or is not reachable.
    + +## `VModuleConfiguration` {#VModuleConfiguration} - - -## `PredicateArgument` {#kubescheduler-config-k8s-io-v1-PredicateArgument} - - +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) **Appears in:** -- [PredicatePolicy](#kubescheduler-config-k8s-io-v1-PredicatePolicy) +- [LoggingConfiguration](#LoggingConfiguration) -PredicateArgument represents the arguments to configure predicate functions in scheduler policy configuration. -Only one of its members may be specified +VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold. - - - - - - - - - - - - - - - - -
    FieldDescription
    serviceAffinity [Required]
    -ServiceAffinity -
    - The predicate that provides affinity for pods belonging to a service -It uses a label to identify nodes that belong to the same "group"
    labelsPresence [Required]
    -LabelsPresence -
    - The predicate that checks whether a particular node has a certain label -defined or not, regardless of value
    - - - -## `PredicatePolicy` {#kubescheduler-config-k8s-io-v1-PredicatePolicy} - - - - -**Appears in:** - -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) - - -PredicatePolicy describes a struct of a predicate policy. - - - - - - - - - - - - - - - - - - -
    FieldDescription
    name [Required]
    -string -
    - Identifier of the predicate policy -For a custom predicate, the name can be user-defined -For the Kubernetes provided predicates, the name is the identifier of the pre-defined predicate
    argument [Required]
    -PredicateArgument -
    - Holds the parameters to configure the given predicate
    - - - -## `PriorityArgument` {#kubescheduler-config-k8s-io-v1-PriorityArgument} - - - - -**Appears in:** - -- [PriorityPolicy](#kubescheduler-config-k8s-io-v1-PriorityPolicy) - - -PriorityArgument represents the arguments to configure priority functions in scheduler policy configuration. -Only one of its members may be specified - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    serviceAntiAffinity [Required]
    -ServiceAntiAffinity -
    - The priority function that ensures a good spread (anti-affinity) for pods belonging to a service -It uses a label to identify nodes that belong to the same "group"
    labelPreference [Required]
    -LabelPreference -
    - The priority function that checks whether a particular node has a certain label -defined or not, regardless of value
    requestedToCapacityRatioArguments [Required]
    -RequestedToCapacityRatioArguments -
    - The RequestedToCapacityRatio priority function is parametrized with function shape.
    - - - -## `PriorityPolicy` {#kubescheduler-config-k8s-io-v1-PriorityPolicy} - - - - -**Appears in:** - -- [Policy](#kubescheduler-config-k8s-io-v1-Policy) - - -PriorityPolicy describes a struct of a priority policy. - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    name [Required]
    -string -
    - Identifier of the priority policy -For a custom priority, the name can be user-defined -For the Kubernetes provided priority functions, the name is the identifier of the pre-defined priority function
    weight [Required]
    -int64 -
    - The numeric multiplier for the node scores that the priority function generates -The weight should be non-zero and can be a positive or a negative integer
    argument [Required]
    -PriorityArgument -
    - Holds the parameters to configure the given priority function
    - - - -## `RequestedToCapacityRatioArguments` {#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioArguments} - - - - -**Appears in:** - -- [PriorityArgument](#kubescheduler-config-k8s-io-v1-PriorityArgument) - - -RequestedToCapacityRatioArguments holds arguments specific to RequestedToCapacityRatio priority function. - - - - - - - - - - - - - - - - - - -
    FieldDescription
    shape [Required]
    -[]UtilizationShapePoint -
    - Array of point defining priority function shape.
    resources [Required]
    -[]ResourceSpec -
    - No description provided. -
    - - - -## `ResourceSpec` {#kubescheduler-config-k8s-io-v1-ResourceSpec} - - - - -**Appears in:** - -- [RequestedToCapacityRatioArguments](#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioArguments) - - -ResourceSpec represents single resource and weight for bin packing of priority RequestedToCapacityRatioArguments. - - - - - - - - - - - - - - - - - - -
    FieldDescription
    name [Required]
    -string -
    - Name of the resource to be managed by RequestedToCapacityRatio function.
    weight [Required]
    -int64 -
    - Weight of the resource.
    - - - -## `ServiceAffinity` {#kubescheduler-config-k8s-io-v1-ServiceAffinity} - - - - -**Appears in:** - -- [PredicateArgument](#kubescheduler-config-k8s-io-v1-PredicateArgument) - - -ServiceAffinity holds the parameters that are used to configure the corresponding predicate in scheduler policy configuration. - - - - - - - - - - - - - -
    FieldDescription
    labels [Required]
    -[]string -
    - The list of labels that identify node "groups" -All of the labels should match for the node to be considered a fit for hosting the pod
    - - - -## `ServiceAntiAffinity` {#kubescheduler-config-k8s-io-v1-ServiceAntiAffinity} - - - - -**Appears in:** - -- [PriorityArgument](#kubescheduler-config-k8s-io-v1-PriorityArgument) - - -ServiceAntiAffinity holds the parameters that are used to configure the corresponding priority function - - - - - - - - - - - - - -
    FieldDescription
    label [Required]
    -string -
    - Used to identify node "groups"
    - - - -## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1-UtilizationShapePoint} - - - - -**Appears in:** - -- [RequestedToCapacityRatioArguments](#kubescheduler-config-k8s-io-v1-RequestedToCapacityRatioArguments) - - -UtilizationShapePoint represents single point of priority function shape. - - - - - - - - - - - - - - - - - - -
    FieldDescription
    utilization [Required]
    -int32 -
    - Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.
    score [Required]
    -int32 -
    - Score assigned to given utilization (y axis). Valid values are 0 to 10.
    - - diff --git a/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md new file mode 100644 index 0000000000..f9ca9e5bd8 --- /dev/null +++ b/content/en/docs/reference/config-api/kube-scheduler-config.v1beta3.md @@ -0,0 +1,1587 @@ +--- +title: kube-scheduler Configuration (v1beta3) +content_type: tool-reference +package: kubescheduler.config.k8s.io/v1beta3 +auto_generated: true +--- + + +## Resource Types + + +- [DefaultPreemptionArgs](#kubescheduler-config-k8s-io-v1beta3-DefaultPreemptionArgs) +- [InterPodAffinityArgs](#kubescheduler-config-k8s-io-v1beta3-InterPodAffinityArgs) +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) +- [NodeAffinityArgs](#kubescheduler-config-k8s-io-v1beta3-NodeAffinityArgs) +- [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesBalancedAllocationArgs) +- [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesFitArgs) +- [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadArgs) +- [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta3-VolumeBindingArgs) + + + + +## `DefaultPreemptionArgs` {#kubescheduler-config-k8s-io-v1beta3-DefaultPreemptionArgs} + + + + + +DefaultPreemptionArgs holds arguments used to configure the +DefaultPreemption plugin. + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    kubescheduler.config.k8s.io/v1beta3
    kind
    string
    DefaultPreemptionArgs
    minCandidateNodesPercentage [Required]
    +int32 +
    + MinCandidateNodesPercentage is the minimum number of candidates to +shortlist when dry running preemption as a percentage of number of nodes. +Must be in the range [0, 100]. Defaults to 10% of the cluster size if +unspecified.
    minCandidateNodesAbsolute [Required]
    +int32 +
    + MinCandidateNodesAbsolute is the absolute minimum number of candidates to +shortlist. The likely number of candidates enumerated for dry running +preemption is given by the formula: +numCandidates = max(numNodes ∗ minCandidateNodesPercentage, minCandidateNodesAbsolute) +We say "likely" because there are other factors such as PDB violations +that play a role in the number of candidates shortlisted. Must be at least +0 nodes. Defaults to 100 nodes if unspecified.
    + + + +## `InterPodAffinityArgs` {#kubescheduler-config-k8s-io-v1beta3-InterPodAffinityArgs} + + + + + +InterPodAffinityArgs holds arguments used to configure the InterPodAffinity plugin. + + + + + + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    kubescheduler.config.k8s.io/v1beta3
    kind
    string
    InterPodAffinityArgs
    hardPodAffinityWeight [Required]
    +int32 +
    + HardPodAffinityWeight is the scoring weight for existing pods with a +matching hard affinity to the incoming pod.
    + + + +## `KubeSchedulerConfiguration` {#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration} + + + + + +KubeSchedulerConfiguration configures a scheduler + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    kubescheduler.config.k8s.io/v1beta3
    kind
    string
    KubeSchedulerConfiguration
    parallelism [Required]
    +int32 +
    + Parallelism defines the amount of parallelism in algorithms for scheduling a Pods. Must be greater than 0. Defaults to 16
    leaderElection [Required]
    +LeaderElectionConfiguration +
    + LeaderElection defines the configuration of leader election client.
    clientConnection [Required]
    +ClientConnectionConfiguration +
    + ClientConnection specifies the kubeconfig file and client connection +settings for the proxy server to use when communicating with the apiserver.
    DebuggingConfiguration [Required]
    +DebuggingConfiguration +
    (Members of DebuggingConfiguration are embedded into this type.) + DebuggingConfiguration holds configuration for Debugging related features +TODO: We might wanna make this a substruct like Debugging componentbaseconfigv1alpha1.DebuggingConfiguration
    percentageOfNodesToScore [Required]
    +int32 +
    + PercentageOfNodesToScore is the percentage of all nodes that once found feasible +for running a pod, the scheduler stops its search for more feasible nodes in +the cluster. This helps improve scheduler's performance. Scheduler always tries to find +at least "minFeasibleNodesToFind" feasible nodes no matter what the value of this flag is. +Example: if the cluster size is 500 nodes and the value of this flag is 30, +then scheduler stops finding further feasible nodes once it finds 150 feasible ones. +When the value is 0, default percentage (5%--50% based on the size of the cluster) of the +nodes will be scored.
    podInitialBackoffSeconds [Required]
    +int64 +
    + PodInitialBackoffSeconds is the initial backoff for unschedulable pods. +If specified, it must be greater than 0. If this value is null, the default value (1s) +will be used.
    podMaxBackoffSeconds [Required]
    +int64 +
    + PodMaxBackoffSeconds is the max backoff for unschedulable pods. +If specified, it must be greater than podInitialBackoffSeconds. If this value is null, +the default value (10s) will be used.
    profiles [Required]
    +[]KubeSchedulerProfile +
    + Profiles are scheduling profiles that kube-scheduler supports. Pods can +choose to be scheduled under a particular profile by setting its associated +scheduler name. Pods that don't specify any scheduler name are scheduled +with the "default-scheduler" profile, if present here.
    extenders [Required]
    +[]Extender +
    + Extenders are the list of scheduler extenders, each holding the values of how to communicate +with the extender. These extenders are shared by all scheduler profiles.
    + + + +## `NodeAffinityArgs` {#kubescheduler-config-k8s-io-v1beta3-NodeAffinityArgs} + + + + + +NodeAffinityArgs holds arguments to configure the NodeAffinity plugin. + + + + + + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    kubescheduler.config.k8s.io/v1beta3
    kind
    string
    NodeAffinityArgs
    addedAffinity
    +core/v1.NodeAffinity +
    + AddedAffinity is applied to all Pods additionally to the NodeAffinity +specified in the PodSpec. That is, Nodes need to satisfy AddedAffinity +AND .spec.NodeAffinity. AddedAffinity is empty by default (all Nodes +match). +When AddedAffinity is used, some Pods with affinity requirements that match +a specific Node (such as Daemonset Pods) might remain unschedulable.
    + + + +## `NodeResourcesBalancedAllocationArgs` {#kubescheduler-config-k8s-io-v1beta3-NodeResourcesBalancedAllocationArgs} + + + + + +NodeResourcesBalancedAllocationArgs holds arguments used to configure NodeResourcesBalancedAllocation plugin. + + + + + + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    kubescheduler.config.k8s.io/v1beta3
    kind
    string
    NodeResourcesBalancedAllocationArgs
    resources [Required]
    +[]ResourceSpec +
    + Resources to be managed, the default is "cpu" and "memory" if not specified.
    + + + +## `NodeResourcesFitArgs` {#kubescheduler-config-k8s-io-v1beta3-NodeResourcesFitArgs} + + + + + +NodeResourcesFitArgs holds arguments used to configure the NodeResourcesFit plugin. + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    kubescheduler.config.k8s.io/v1beta3
    kind
    string
    NodeResourcesFitArgs
    ignoredResources [Required]
    +[]string +
    + IgnoredResources is the list of resources that NodeResources fit filter +should ignore. This doesn't apply to scoring.
    ignoredResourceGroups [Required]
    +[]string +
    + IgnoredResourceGroups defines the list of resource groups that NodeResources fit filter should ignore. +e.g. if group is ["example.com"], it will ignore all resource names that begin +with "example.com", such as "example.com/aaa" and "example.com/bbb". +A resource group name can't contain '/'. This doesn't apply to scoring.
    scoringStrategy [Required]
    +ScoringStrategy +
    + ScoringStrategy selects the node resource scoring strategy. +The default strategy is LeastAllocated with an equal "cpu" and "memory" weight.
    + + + +## `PodTopologySpreadArgs` {#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadArgs} + + + + + +PodTopologySpreadArgs holds arguments used to configure the PodTopologySpread plugin. + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    kubescheduler.config.k8s.io/v1beta3
    kind
    string
    PodTopologySpreadArgs
    defaultConstraints
    +[]core/v1.TopologySpreadConstraint +
    + DefaultConstraints defines topology spread constraints to be applied to +Pods that don't define any in `pod.spec.topologySpreadConstraints`. +`.defaultConstraints[∗].labelSelectors` must be empty, as they are +deduced from the Pod's membership to Services, ReplicationControllers, +ReplicaSets or StatefulSets. +When not empty, .defaultingType must be "List".
    defaultingType
    +PodTopologySpreadConstraintsDefaulting +
    + DefaultingType determines how .defaultConstraints are deduced. Can be one +of "System" or "List". + +- "System": Use kubernetes defined constraints that spread Pods among + Nodes and Zones. +- "List": Use constraints defined in .defaultConstraints. + +Defaults to "List" if feature gate DefaultPodTopologySpread is disabled +and to "System" if enabled.
    + + + +## `VolumeBindingArgs` {#kubescheduler-config-k8s-io-v1beta3-VolumeBindingArgs} + + + + + +VolumeBindingArgs holds arguments used to configure the VolumeBinding plugin. + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    apiVersion
    string
    kubescheduler.config.k8s.io/v1beta3
    kind
    string
    VolumeBindingArgs
    bindTimeoutSeconds [Required]
    +int64 +
    + BindTimeoutSeconds is the timeout in seconds in volume binding operation. +Value must be non-negative integer. The value zero indicates no waiting. +If this value is nil, the default value (600) will be used.
    shape
    +[]UtilizationShapePoint +
    + Shape specifies the points defining the score function shape, which is +used to score nodes based on the utilization of statically provisioned +PVs. The utilization is calculated by dividing the total requested +storage of the pod by the total capacity of feasible PVs on each node. +Each point contains utilization (ranges from 0 to 100) and its +associated score (ranges from 0 to 10). You can turn the priority by +specifying different scores for different utilization numbers. +The default shape points are: +1) 0 for 0 utilization +2) 10 for 100 utilization +All points must be sorted in increasing order by utilization.
    + + + +## `Extender` {#kubescheduler-config-k8s-io-v1beta3-Extender} + + + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + + +Extender holds the parameters used to communicate with the extender. If a verb is unspecified/empty, +it is assumed that the extender chose not to provide that extension. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    urlPrefix [Required]
    +string +
    + URLPrefix at which the extender is available
    filterVerb [Required]
    +string +
    + Verb for the filter call, empty if not supported. This verb is appended to the URLPrefix when issuing the filter call to extender.
    preemptVerb [Required]
    +string +
    + Verb for the preempt call, empty if not supported. This verb is appended to the URLPrefix when issuing the preempt call to extender.
    prioritizeVerb [Required]
    +string +
    + Verb for the prioritize call, empty if not supported. This verb is appended to the URLPrefix when issuing the prioritize call to extender.
    weight [Required]
    +int64 +
    + The numeric multiplier for the node scores that the prioritize call generates. +The weight should be a positive integer
    bindVerb [Required]
    +string +
    + Verb for the bind call, empty if not supported. This verb is appended to the URLPrefix when issuing the bind call to extender. +If this method is implemented by the extender, it is the extender's responsibility to bind the pod to apiserver. Only one extender +can implement this function.
    enableHTTPS [Required]
    +bool +
    + EnableHTTPS specifies whether https should be used to communicate with the extender
    tlsConfig [Required]
    +ExtenderTLSConfig +
    + TLSConfig specifies the transport layer security config
    httpTimeout [Required]
    +meta/v1.Duration +
    + HTTPTimeout specifies the timeout duration for a call to the extender. Filter timeout fails the scheduling of the pod. Prioritize +timeout is ignored, k8s/other extenders priorities are used to select the node.
    nodeCacheCapable [Required]
    +bool +
    + NodeCacheCapable specifies that the extender is capable of caching node information, +so the scheduler should only send minimal information about the eligible nodes +assuming that the extender already cached full details of all nodes in the cluster
    managedResources
    +[]ExtenderManagedResource +
    + ManagedResources is a list of extended resources that are managed by +this extender. +- A pod will be sent to the extender on the Filter, Prioritize and Bind + (if the extender is the binder) phases iff the pod requests at least + one of the extended resources in this list. If empty or unspecified, + all pods will be sent to this extender. +- If IgnoredByScheduler is set to true for a resource, kube-scheduler + will skip checking the resource in predicates.
    ignorable [Required]
    +bool +
    + Ignorable specifies if the extender is ignorable, i.e. scheduling should not +fail when the extender returns an error or is not reachable.
    + + + +## `ExtenderManagedResource` {#kubescheduler-config-k8s-io-v1beta3-ExtenderManagedResource} + + + + +**Appears in:** + +- [Extender](#kubescheduler-config-k8s-io-v1beta3-Extender) + + +ExtenderManagedResource describes the arguments of extended resources +managed by an extender. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    name [Required]
    +string +
    + Name is the extended resource name.
    ignoredByScheduler [Required]
    +bool +
    + IgnoredByScheduler indicates whether kube-scheduler should ignore this +resource when applying predicates.
    + + + +## `ExtenderTLSConfig` {#kubescheduler-config-k8s-io-v1beta3-ExtenderTLSConfig} + + + + +**Appears in:** + +- [Extender](#kubescheduler-config-k8s-io-v1beta3-Extender) + + +ExtenderTLSConfig contains settings to enable TLS with extender + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    insecure [Required]
    +bool +
    + Server should be accessed without verifying the TLS certificate. For testing only.
    serverName [Required]
    +string +
    + ServerName is passed to the server for SNI and is used in the client to check server +certificates against. If ServerName is empty, the hostname used to contact the +server is used.
    certFile [Required]
    +string +
    + Server requires TLS client certificate authentication
    keyFile [Required]
    +string +
    + Server requires TLS client certificate authentication
    caFile [Required]
    +string +
    + Trusted root certificates for server
    certData [Required]
    +[]byte +
    + CertData holds PEM-encoded bytes (typically read from a client certificate file). +CertData takes precedence over CertFile
    keyData [Required]
    +[]byte +
    + KeyData holds PEM-encoded bytes (typically read from a client certificate key file). +KeyData takes precedence over KeyFile
    caData [Required]
    +[]byte +
    + CAData holds PEM-encoded bytes (typically read from a root certificates bundle). +CAData takes precedence over CAFile
    + + + +## `KubeSchedulerProfile` {#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile} + + + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + + +KubeSchedulerProfile is a scheduling profile. + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    schedulerName [Required]
    +string +
    + SchedulerName is the name of the scheduler associated to this profile. +If SchedulerName matches with the pod's "spec.schedulerName", then the pod +is scheduled with this profile.
    plugins [Required]
    +Plugins +
    + Plugins specify the set of plugins that should be enabled or disabled. +Enabled plugins are the ones that should be enabled in addition to the +default plugins. Disabled plugins are any of the default plugins that +should be disabled. +When no enabled or disabled plugin is specified for an extension point, +default plugins for that extension point will be used if there is any. +If a QueueSort plugin is specified, the same QueueSort Plugin and +PluginConfig must be specified for all profiles.
    pluginConfig [Required]
    +[]PluginConfig +
    + PluginConfig is an optional set of custom plugin arguments for each plugin. +Omitting config args for a plugin is equivalent to using the default config +for that plugin.
    + + + +## `Plugin` {#kubescheduler-config-k8s-io-v1beta3-Plugin} + + + + +**Appears in:** + +- [PluginSet](#kubescheduler-config-k8s-io-v1beta3-PluginSet) + + +Plugin specifies a plugin name and its weight when applicable. Weight is used only for Score plugins. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    name [Required]
    +string +
    + Name defines the name of plugin
    weight [Required]
    +int32 +
    + Weight defines the weight of plugin, only used for Score plugins.
    + + + +## `PluginConfig` {#kubescheduler-config-k8s-io-v1beta3-PluginConfig} + + + + +**Appears in:** + +- [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile) + + +PluginConfig specifies arguments that should be passed to a plugin at the time of initialization. +A plugin that is invoked at multiple extension points is initialized once. Args can have arbitrary structure. +It is up to the plugin to process these Args. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    name [Required]
    +string +
    + Name defines the name of plugin being configured
    args [Required]
    +k8s.io/apimachinery/pkg/runtime.RawExtension +
    + Args defines the arguments passed to the plugins at the time of initialization. Args can have arbitrary structure.
    + + + +## `PluginSet` {#kubescheduler-config-k8s-io-v1beta3-PluginSet} + + + + +**Appears in:** + +- [Plugins](#kubescheduler-config-k8s-io-v1beta3-Plugins) + + +PluginSet specifies enabled and disabled plugins for an extension point. +If an array is empty, missing, or nil, default plugins at that extension point will be used. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    enabled [Required]
    +[]Plugin +
    + Enabled specifies plugins that should be enabled in addition to default plugins. +If the default plugin is also configured in the scheduler config file, the weight of plugin will +be overridden accordingly. +These are called after default plugins and in the same order specified here.
    disabled [Required]
    +[]Plugin +
    + Disabled specifies default plugins that should be disabled. +When all default plugins need to be disabled, an array containing only one "∗" should be provided.
    + + + +## `Plugins` {#kubescheduler-config-k8s-io-v1beta3-Plugins} + + + + +**Appears in:** + +- [KubeSchedulerProfile](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile) + + +Plugins include multiple extension points. When specified, the list of plugins for +a particular extension point are the only ones enabled. If an extension point is +omitted from the config, then the default set of plugins is used for that extension point. +Enabled plugins are called in the order specified here, after default plugins. If they need to +be invoked before default plugins, default plugins must be disabled and re-enabled here in desired order. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    queueSort [Required]
    +PluginSet +
    + QueueSort is a list of plugins that should be invoked when sorting pods in the scheduling queue.
    preFilter [Required]
    +PluginSet +
    + PreFilter is a list of plugins that should be invoked at "PreFilter" extension point of the scheduling framework.
    filter [Required]
    +PluginSet +
    + Filter is a list of plugins that should be invoked when filtering out nodes that cannot run the Pod.
    postFilter [Required]
    +PluginSet +
    + PostFilter is a list of plugins that are invoked after filtering phase, but only when no feasible nodes were found for the pod.
    preScore [Required]
    +PluginSet +
    + PreScore is a list of plugins that are invoked before scoring.
    score [Required]
    +PluginSet +
    + Score is a list of plugins that should be invoked when ranking nodes that have passed the filtering phase.
    reserve [Required]
    +PluginSet +
    + Reserve is a list of plugins invoked when reserving/unreserving resources +after a node is assigned to run the pod.
    permit [Required]
    +PluginSet +
    + Permit is a list of plugins that control binding of a Pod. These plugins can prevent or delay binding of a Pod.
    preBind [Required]
    +PluginSet +
    + PreBind is a list of plugins that should be invoked before a pod is bound.
    bind [Required]
    +PluginSet +
    + Bind is a list of plugins that should be invoked at "Bind" extension point of the scheduling framework. +The scheduler call these plugins in order. Scheduler skips the rest of these plugins as soon as one returns success.
    postBind [Required]
    +PluginSet +
    + PostBind is a list of plugins that should be invoked after a pod is successfully bound.
    multiPoint [Required]
    +PluginSet +
    + MultiPoint is a simplified config section to enable plugins for all valid extension points. +Plugins enabled through MultiPoint will automatically register for every individual extension +point the plugin has implemented. Disabling a plugin through MultiPoint disables that behavior. +The same is true for disabling "∗" through MultiPoint (no default plugins will be automatically registered). +Plugins can still be disabled through their individual extension points. + +In terms of precedence, plugin config follows this basic hierarchy + 1. Specific extension points + 2. Explicitly configured MultiPoint plugins + 3. The set of default plugins, as MultiPoint plugins +This implies that a higher precedence plugin will run first and overwrite any settings within MultiPoint. +Explicitly user-configured plugins also take a higher precedence over default plugins. +Within this hierarchy, an Enabled setting takes precedence over Disabled. For example, if a plugin is +set in both `multiPoint.Enabled` and `multiPoint.Disabled`, the plugin will be enabled. Similarly, +including `multiPoint.Disabled = '∗'` and `multiPoint.Enabled = pluginA` will still register that specific +plugin through MultiPoint. This follows the same behavior as all other extension point configurations.
    + + + +## `PodTopologySpreadConstraintsDefaulting` {#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadConstraintsDefaulting} + +(Alias of `string`) + + +**Appears in:** + +- [PodTopologySpreadArgs](#kubescheduler-config-k8s-io-v1beta3-PodTopologySpreadArgs) + + +PodTopologySpreadConstraintsDefaulting defines how to set default constraints +for the PodTopologySpread plugin. + + + + + +## `RequestedToCapacityRatioParam` {#kubescheduler-config-k8s-io-v1beta3-RequestedToCapacityRatioParam} + + + + +**Appears in:** + +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) + + +RequestedToCapacityRatioParam define RequestedToCapacityRatio parameters + + + + + + + + + + + + + +
    FieldDescription
    shape [Required]
    +[]UtilizationShapePoint +
    + Shape is a list of points defining the scoring function shape.
    + + + +## `ResourceSpec` {#kubescheduler-config-k8s-io-v1beta3-ResourceSpec} + + + + +**Appears in:** + +- [NodeResourcesBalancedAllocationArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesBalancedAllocationArgs) + +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) + + +ResourceSpec represents a single resource. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    name [Required]
    +string +
    + Name of the resource.
    weight [Required]
    +int64 +
    + Weight of the resource.
    + + + +## `ScoringStrategy` {#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy} + + + + +**Appears in:** + +- [NodeResourcesFitArgs](#kubescheduler-config-k8s-io-v1beta3-NodeResourcesFitArgs) + + +ScoringStrategy define ScoringStrategyType for node resource plugin + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    type [Required]
    +ScoringStrategyType +
    + Type selects which strategy to run.
    resources [Required]
    +[]ResourceSpec +
    + Resources to consider when scoring. +The default resource set includes "cpu" and "memory" with an equal weight. +Allowed weights go from 1 to 100. +Weight defaults to 1 if not specified or explicitly set to 0.
    requestedToCapacityRatio [Required]
    +RequestedToCapacityRatioParam +
    + Arguments specific to RequestedToCapacityRatio strategy.
    + + + +## `ScoringStrategyType` {#kubescheduler-config-k8s-io-v1beta3-ScoringStrategyType} + +(Alias of `string`) + + +**Appears in:** + +- [ScoringStrategy](#kubescheduler-config-k8s-io-v1beta3-ScoringStrategy) + + +ScoringStrategyType the type of scoring strategy used in NodeResourcesFit plugin. + + + + + +## `UtilizationShapePoint` {#kubescheduler-config-k8s-io-v1beta3-UtilizationShapePoint} + + + + +**Appears in:** + +- [VolumeBindingArgs](#kubescheduler-config-k8s-io-v1beta3-VolumeBindingArgs) + +- [RequestedToCapacityRatioParam](#kubescheduler-config-k8s-io-v1beta3-RequestedToCapacityRatioParam) + + +UtilizationShapePoint represents single point of priority function shape. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    utilization [Required]
    +int32 +
    + Utilization (x axis). Valid values are 0 to 100. Fully utilized node maps to 100.
    score [Required]
    +int32 +
    + Score assigned to given utilization (y axis). Valid values are 0 to 10.
    + + + + + +## `ClientConnectionConfiguration` {#ClientConnectionConfiguration} + + + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + + +ClientConnectionConfiguration contains details for constructing a client. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    kubeconfig [Required]
    +string +
    + kubeconfig is the path to a KubeConfig file.
    acceptContentTypes [Required]
    +string +
    + acceptContentTypes defines the Accept header sent by clients when connecting to a server, overriding the +default value of 'application/json'. This field will control all connections to the server used by a particular +client.
    contentType [Required]
    +string +
    + contentType is the content type used when sending data to the server from this client.
    qps [Required]
    +float32 +
    + qps controls the number of queries per second allowed for this connection.
    burst [Required]
    +int32 +
    + burst allows extra queries to accumulate when a client is exceeding its rate.
    + +## `DebuggingConfiguration` {#DebuggingConfiguration} + + + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + + +DebuggingConfiguration holds configuration for Debugging related features. + + + + + + + + + + + + + + + + + + +
    FieldDescription
    enableProfiling [Required]
    +bool +
    + enableProfiling enables profiling via web interface host:port/debug/pprof/
    enableContentionProfiling [Required]
    +bool +
    + enableContentionProfiling enables lock contention profiling, if +enableProfiling is true.
    + +## `FormatOptions` {#FormatOptions} + + + + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +FormatOptions contains options for the different logging formats. + + + + + + + + + + + + + +
    FieldDescription
    json [Required]
    +JSONOptions +
    + [Experimental] JSON contains options for logging format "json".
    + +## `JSONOptions` {#JSONOptions} + + + + +**Appears in:** + +- [FormatOptions](#FormatOptions) + + +JSONOptions contains options for logging format "json". + + + + + + + + + + + + + + + + + + +
    FieldDescription
    splitStream [Required]
    +bool +
    + [Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering.
    infoBufferSize [Required]
    +k8s.io/apimachinery/pkg/api/resource.QuantityValue +
    + [Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.
    + +## `LeaderElectionConfiguration` {#LeaderElectionConfiguration} + + + + +**Appears in:** + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerConfiguration) + +- [KubeSchedulerConfiguration](#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerConfiguration) + + +LeaderElectionConfiguration defines the configuration of leader election +clients for components that can run with leader election enabled. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    leaderElect [Required]
    +bool +
    + leaderElect enables a leader election client to gain leadership +before executing the main loop. Enable this when running replicated +components for high availability.
    leaseDuration [Required]
    +meta/v1.Duration +
    + leaseDuration is the duration that non-leader candidates will wait +after observing a leadership renewal until attempting to acquire +leadership of a led but unrenewed leader slot. This is effectively the +maximum duration that a leader can be stopped before it is replaced +by another candidate. This is only applicable if leader election is +enabled.
    renewDeadline [Required]
    +meta/v1.Duration +
    + renewDeadline is the interval between attempts by the acting master to +renew a leadership slot before it stops leading. This must be less +than or equal to the lease duration. This is only applicable if leader +election is enabled.
    retryPeriod [Required]
    +meta/v1.Duration +
    + retryPeriod is the duration the clients should wait between attempting +acquisition and renewal of a leadership. This is only applicable if +leader election is enabled.
    resourceLock [Required]
    +string +
    + resourceLock indicates the resource object type that will be used to lock +during leader election cycles.
    resourceName [Required]
    +string +
    + resourceName indicates the name of resource object that will be used to lock +during leader election cycles.
    resourceNamespace [Required]
    +string +
    + resourceName indicates the namespace of resource object that will be used to lock +during leader election cycles.
    + +## `LoggingConfiguration` {#LoggingConfiguration} + + + + +**Appears in:** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +LoggingConfiguration contains logging options +Refer [Logs Options](https://github.com/kubernetes/component-base/blob/master/logs/options.go) for more information. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    format [Required]
    +string +
    + Format Flag specifies the structure of log messages. +default value of format is `text`
    flushFrequency [Required]
    +time.Duration +
    + Maximum number of seconds between log flushes. Ignored if the +selected logging backend writes log messages without buffering.
    verbosity [Required]
    +uint32 +
    + Verbosity is the threshold that determines which log messages are +logged. Default is zero which logs only the most important +messages. Higher values enable additional messages. Error messages +are always logged.
    vmodule [Required]
    +VModuleConfiguration +
    + VModule overrides the verbosity threshold for individual files. +Only supported for "text" log format.
    sanitization [Required]
    +bool +
    + [Experimental] When enabled prevents logging of fields tagged as sensitive (passwords, keys, tokens). +Runtime log sanitization may introduce significant computation overhead and therefore should not be enabled in production.`)
    options [Required]
    +FormatOptions +
    + [Experimental] Options holds additional parameters that are specific +to the different logging formats. Only the options for the selected +format get used, but all of them get validated.
    + +## `VModuleConfiguration` {#VModuleConfiguration} + +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold. + + diff --git a/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md b/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md index 8b6c0a9a24..e694f7ecbc 100644 --- a/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md +++ b/content/en/docs/reference/config-api/kube-scheduler-policy-config.v1.md @@ -89,7 +89,7 @@ of the predicates after it finds one predicate that failed. **Appears in:** -- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) +- [Extender](#kubescheduler-config-k8s-io-v1beta1-Extender) - [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender) @@ -132,7 +132,7 @@ resource when applying predicates. **Appears in:** -- [Extender](#kubescheduler-config-k8s-io-v1beta2-Extender) +- [Extender](#kubescheduler-config-k8s-io-v1beta1-Extender) - [LegacyExtender](#kubescheduler-config-k8s-io-v1-LegacyExtender) diff --git a/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md b/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md index 5f73e8b3a8..602f646e84 100644 --- a/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md +++ b/content/en/docs/reference/config-api/kubeadm-config.v1beta3.md @@ -4,59 +4,58 @@ content_type: tool-reference package: kubeadm.k8s.io/v1beta3 auto_generated: true --- +## Overview + Package v1beta3 defines the v1beta3 version of the kubeadm configuration file format. This version improves on the v1beta2 format by fixing some minor issues and adding a few new fields. A list of changes since v1beta2: -- The deprecated `ClusterConfiguration.useHyperKubeImage` field has been removed. +- The deprecated "ClusterConfiguration.useHyperKubeImage" field has been removed. Kubeadm no longer supports the hyperkube image. -- The `ClusterConfiguration.dns.type` field has been removed since CoreDNS is the only supported +- The "ClusterConfiguration.DNS.Type" field has been removed since CoreDNS is the only supported DNS server type by kubeadm. - Include "datapolicy" tags on the fields that hold secrets. This would result in the field values to be omitted when API structures are printed with klog. -- Add `InitConfiguration.skipPhases`, `JoinConfiguration.skipPhases` to allow skipping +- Add "InitConfiguration.SkipPhases", "JoinConfiguration.SkipPhases" to allow skipping a list of phases during kubeadm init/join command execution. -- Add `InitConfiguration.nodeRegistration.imagePullPolicy" and - `JoinConfiguration.nodeRegistration.imagePullPolicy` to allow specifying - the images pull policy during kubeadm "init" and "join". The value must be - one of "Always", "Never" or "IfNotPresent". "IfNotPresent" is the default, - which has been the existing behavior prior to this addition. -- Add `InitConfiguration.patches.directory`, `JoinConfiguration.patches.directory` - to allow the user to configure a directory from which to take patches for - components deployed by kubeadm. -- Move the `BootstrapToken∗` API and related utilities out of the "kubeadm" API group - to a new group "bootstraptoken". The kubeadm API version v1beta3 no longer contains - the `BootstrapToken∗` structures. +- Add "InitConfiguration.NodeRegistration.ImagePullPolicy" and "JoinConfiguration.NodeRegistration.ImagePullPolicy" + to allow specifying the images pull policy during kubeadm "init" and "join". + The value must be one of "Always", "Never" or "IfNotPresent". + "IfNotPresent" is the default, which has been the existing behavior prior to this addition. +- Add "InitConfiguration.Patches.Directory", "JoinConfiguration.Patches.Directory" to allow + the user to configure a directory from which to take patches for components deployed by kubeadm. +- Move the BootstrapToken∗ API and related utilities out of the "kubeadm" API group to a new group + "bootstraptoken". The kubeadm API version v1beta3 no longer contains the BootstrapToken∗ structures. -## Migration from old kubeadm config versions +Migration from old kubeadm config versions -- kubeadm v1.15.x and newer can be used to migrate from the v1beta1 to v1beta2. -- kubeadm v1.22.x no longer supports v1beta1 and older APIs, but can be used to migrate v1beta2 to v1beta3. +- kubeadm v1.15.x and newer can be used to migrate from v1beta1 to v1beta2. +- kubeadm v1.22.x and newer no longer support v1beta1 and older APIs, but can be used to migrate v1beta2 to v1beta3. ## Basics -The preferred way to configure kubeadm is to pass an YAML configuration file with the --config option. Some of the +The preferred way to configure kubeadm is to pass an YAML configuration file with the `--config` option. Some of the configuration options defined in the kubeadm config file are also available as command line flags, but only the most common/simple use case are supported with this approach. -A kubeadm config file could contain multiple configuration types separated using three dashes (“---”). +A kubeadm config file could contain multiple configuration types separated using three dashes (`---`). kubeadm supports the following configuration types: ```yaml apiVersion: kubeadm.k8s.io/v1beta3 kind: InitConfiguration ---- + apiVersion: kubeadm.k8s.io/v1beta3 kind: ClusterConfiguration ---- + apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration ---- + apiVersion: kubeproxy.config.k8s.io/v1alpha1 kind: KubeProxyConfiguration ---- + apiVersion: kubeadm.k8s.io/v1beta3 kind: JoinConfiguration ``` @@ -69,11 +68,12 @@ kubeadm config print join-defaults ``` The list of configuration types that must be included in a configuration file depends by the action you are -performing (init or join) and by the configuration options you are going to use (defaults or advanced customization). +performing (`init` or `join`) and by the configuration options you are going to use (defaults or advanced +customization). If some configuration types are not provided, or provided only partially, kubeadm will use default values; defaults provided by kubeadm includes also enforcing consistency of values across components when required (e.g. -cluster-cidr flag on controller manager and clusterCIDR on kube-proxy). +`--cluster-cidr` flag on controller manager and `clusterCIDR` on kube-proxy). Users are always allowed to override default values, with the only exception of a small subset of setting with relevance for security (e.g. enforce authorization-mode Node and RBAC on api server) @@ -97,8 +97,8 @@ nodeRegistration: ``` The InitConfiguration type should be used to configure runtime settings, that in case of kubeadm init -are the configuration of the bootstrap token and all the setting which are specific to the node where kubeadm -is executed, including: +are the configuration of the bootstrap token and all the setting which are specific to the node where +kubeadm is executed, including: - NodeRegistration, that holds fields that relate to registering the new node to the cluster; use it to customize the node name, the CRI socket to use or any other settings that should apply to this @@ -107,13 +107,13 @@ is executed, including: - LocalAPIEndpoint, that represents the endpoint of the instance of the API server to be deployed on this node; use it e.g. to customize the API server advertise address. - ```yaml + ``` apiVersion: kubeadm.k8s.io/v1beta3 kind: ClusterConfiguration networking: - ... + ... etcd: - ... + ... apiServer: extraArgs: ... @@ -126,9 +126,11 @@ The ClusterConfiguration type should be used to configure cluster-wide settings, including settings for: - Networking, that holds configuration for the networking topology of the cluster; use it e.g. to customize - pod subnet or services subnet. + Pod subnet or services subnet. + - Etcd configurations; use it e.g. to customize the local etcd or to configure the API server for using an external etcd cluster. + - kube-apiserver, kube-scheduler, kube-controller-manager configurations; use it to customize control-plane components by adding customized setting or overriding kubeadm default settings. @@ -138,59 +140,60 @@ including settings for: ... ``` -The KubeProxyConfiguration type should be used to change the configuration passed to kube-proxy instances deployed -in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults. +The KubeProxyConfiguration type should be used to change the configuration passed to kube-proxy instances +deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults. -See https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/ or https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration -for kube proxy official documentation. +See https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/ or +https://godoc.org/k8s.io/kube-proxy/config/v1alpha1#KubeProxyConfiguration +for kube-proxy official documentation. ```yaml apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration -... + ... ``` The KubeletConfiguration type should be used to change the configurations that will be passed to all kubelet instances deployed in the cluster. If this object is not provided or provided only partially, kubeadm applies defaults. -See https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ or https://godoc.org/k8s.io/kubelet/config/v1beta1#KubeletConfiguration +See https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ or +https://godoc.org/k8s.io/kubelet/config/v1beta1#KubeletConfiguration for kubelet official documentation. Here is a fully populated example of a single YAML file containing multiple configuration types to be used during a `kubeadm init` run. -```yaml apiVersion: kubeadm.k8s.io/v1beta3 kind: InitConfiguration bootstrapTokens: - - token: "9a08jv.c0izixklcxtmnze7" - description: "kubeadm bootstrap token" - ttl: "24h" - - token: "783bde.3f89s0fje9f38fhf" - description: "another bootstrap token" - usages: - - authentication - - signing - groups: - - system:bootstrappers:kubeadm:default-node-token +- token: "9a08jv.c0izixklcxtmnze7" + description: "kubeadm bootstrap token" + ttl: "24h" +- token: "783bde.3f89s0fje9f38fhf" + description: "another bootstrap token" + usages: + - authentication + - signing + groups: + - system:bootstrappers:kubeadm:default-node-token nodeRegistration: name: "ec2-10-100-0-1" criSocket: "/var/run/dockershim.sock" taints: - - key: "kubeadmNode" - value: "master" - effect: "NoSchedule" + - key: "kubeadmNode" + value: "master" + effect: "NoSchedule" kubeletExtraArgs: v: 4 - ignorePreflightErrors: - - IsPrivilegedUser - imagePullPolicy: "IfNotPresent" +ignorePreflightErrors: +- IsPrivilegedUser + imagePullPolicy: "IfNotPresent" localAPIEndpoint: advertiseAddress: "10.100.0.1" bindPort: 6443 certificateKey: "e6a2eb8581237ab72a4f494f30285ec12a9694d750b9785706a83bfcbbbd2204" -skipPhases: - - add/kube-proxy + skipPhases: + - addon/kube-proxy --- apiVersion: kubeadm.k8s.io/v1beta3 kind: ClusterConfiguration @@ -203,9 +206,9 @@ etcd: extraArgs: listen-client-urls: "http://10.100.0.1:2379" serverCertSANs: - - "ec2-10-100-0-1.compute-1.amazonaws.com" + - "ec2-10-100-0-1.compute-1.amazonaws.com" peerCertSANs: - - "10.100.0.1" + - "10.100.0.1" # external: # endpoints: # - "10.100.0.1:2379" @@ -214,42 +217,42 @@ etcd: # certFile: "/etcd/kubernetes/pki/etcd/etcd.crt" # keyFile: "/etcd/kubernetes/pki/etcd/etcd.key" networking: - serviceSubnet: "10.96.0.0/12" - podSubnet: "10.100.0.1/24" + serviceSubnet: "10.96.0.0/16" + podSubnet: "10.244.0.0/24" dnsDomain: "cluster.local" -kubernetesVersion: "v1.12.0" +kubernetesVersion: "v1.21.0" controlPlaneEndpoint: "10.100.0.1:6443" apiServer: extraArgs: authorization-mode: "Node,RBAC" extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File + - name: "some-volume" + hostPath: "/etc/some-path" + mountPath: "/etc/some-pod-path" + readOnly: false + pathType: File certSANs: - - "10.100.1.1" - - "ec2-10-100-0-1.compute-1.amazonaws.com" + - "10.100.1.1" + - "ec2-10-100-0-1.compute-1.amazonaws.com" timeoutForControlPlane: 4m0s controllerManager: extraArgs: "node-cidr-mask-size": "20" extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File + - name: "some-volume" + hostPath: "/etc/some-path" + mountPath: "/etc/some-pod-path" + readOnly: false + pathType: File scheduler: extraArgs: address: "10.100.0.1" extraVolumes: - - name: "some-volume" - hostPath: "/etc/some-path" - mountPath: "/etc/some-pod-path" - readOnly: false - pathType: File + - name: "some-volume" + hostPath: "/etc/some-path" + mountPath: "/etc/some-pod-path" + readOnly: false + pathType: File certificatesDir: "/etc/kubernetes/pki" imageRepository: "k8s.gcr.io" clusterName: "example-cluster" @@ -261,27 +264,26 @@ kind: KubeletConfiguration apiVersion: kubeproxy.config.k8s.io/v1alpha1 kind: KubeProxyConfiguration # kube-proxy specific options here -``` ## Kubeadm join configuration types -When executing kubeadm join with the `--config` option, the JoinConfiguration type should be provided. +When executing `kubeadm join` with the `--config` option, the JoinConfiguration type should be provided. ```yaml apiVersion: kubeadm.k8s.io/v1beta3 kind: JoinConfiguration -... + ... ``` -The JoinConfiguration type should be used to configure runtime settings, that in case of kubeadm join +The JoinConfiguration type should be used to configure runtime settings, that in case of `kubeadm join` are the discovery method used for accessing the cluster info and all the setting which are specific to the node where kubeadm is executed, including: - NodeRegistration, that holds fields that relate to registering the new node to the cluster; use it to customize the node name, the CRI socket to use or any other settings that should apply to this node only (e.g. the node ip). -- APIEndpoint, that represents the endpoint of the instance of the API server to be eventually - deployed on this node. + +- APIEndpoint, that represents the endpoint of the instance of the API server to be eventually deployed on this node. ## Resource Types @@ -315,7 +317,7 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster Etcd - `etcd` holds configuration for etcd. + Etcd holds configuration for etcd. @@ -323,7 +325,7 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster Networking - `networking` holds configuration for the networking topology of the cluster. + Networking holds configuration for the networking topology of the cluster. @@ -331,7 +333,7 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster string - `kubernetesVersion` is the target version of the control plane. + KubernetesVersion is the target version of the control plane. @@ -339,18 +341,17 @@ ClusterConfiguration contains cluster-wide configuration for a kubeadm cluster string - `controlPlaneEndpoint` sets a stable IP address or DNS name for the control plane; it + ControlPlaneEndpoint sets a stable IP address or DNS name for the control plane; it can be a valid IP address or a RFC-1123 DNS subdomain, both with optional TCP port. -In case the `controlPlaneEndpoint` is not specified, the `advertiseAddress` + `bindPort` -are used; in case the `controlPlaneEndpoint` is specified but without a TCP port, -the `bindPort` of the `localAPIEndpoint` is used. +In case the ControlPlaneEndpoint is not specified, the AdvertiseAddress + BindPort +are used; in case the ControlPlaneEndpoint is specified but without a TCP port, +the BindPort is used. Possible usages are: - -- In a cluster with more than one control plane instances, this field should be - assigned the address of the external load balancer in front of the - control plane instances. -- In environments with enforced node recycling, the ControlPlaneEndpoint - could be used for assigning a stable DNS to the control plane. +e.g. In a cluster with more than one control plane instances, this field should be +assigned the address of the external load balancer in front of the +control plane instances. +e.g. in environments with enforced node recycling, the ControlPlaneEndpoint +could be used for assigning a stable DNS to the control plane. @@ -358,7 +359,7 @@ Possible usages are: APIServer - `apiServer` contains extra settings for the API server. + APIServer contains extra settings for the API server control plane component @@ -366,7 +367,7 @@ Possible usages are: ControlPlaneComponent - `controllerManager` contains extra settings for the controller manager. + ControllerManager contains extra settings for the controller manager control plane component @@ -374,7 +375,7 @@ Possible usages are: ControlPlaneComponent - `scheduler` contains extra settings for the scheduler. + Scheduler contains extra settings for the scheduler control plane component @@ -382,7 +383,7 @@ Possible usages are: DNS - `dns` defines the options for the DNS add-on. + DNS defines the options for the DNS add-on installed in the cluster. @@ -390,7 +391,7 @@ Possible usages are: string - `certificatesDir` specifies where to store or look for all required certificates. + CertificatesDir specifies where to store or look for all required certificates. @@ -398,11 +399,10 @@ Possible usages are: string - `imageRepository` sets the container registry to pull images from. -If empty, `k8s.gcr.io` will be used by default; in case of kubernetes version is -a CI build (kubernetes version starts with `ci/` or `ci-cross/`) -`gcr.io/k8s-staging-ci-images` will be used as a default for control plane -components and for kube-proxy, while `k8s.gcr.io` will be used for all the other images. + ImageRepository sets the container registry to pull images from. +If empty, `k8s.gcr.io` will be used by default; in case of kubernetes version is a CI build (kubernetes version starts with `ci/`) +`gcr.io/k8s-staging-ci-images` will be used as a default for control plane components and for kube-proxy, while `k8s.gcr.io` +will be used for all the other images. @@ -410,7 +410,7 @@ components and for kube-proxy, while `k8s.gcr.io` will be used for all the other map[string]bool - Feature gates enabled by the user. + FeatureGates enabled by the user. @@ -418,7 +418,7 @@ components and for kube-proxy, while `k8s.gcr.io` will be used for all the other string - The cluster name. + The cluster name @@ -450,8 +450,8 @@ information. []BootstrapToken - `bootstrapTokens` is respected at `kubeadm init` time and describes a set of Bootstrap Tokens to create. -This information IS NOT uploaded to the kubeadm cluster configmap, partly because of its sensitive nature. + BootstrapTokens is respected at `kubeadm init` time and describes a set of Bootstrap Tokens to create. +This information IS NOT uploaded to the kubeadm cluster configmap, partly because of its sensitive nature @@ -459,7 +459,7 @@ This information IS NOT uploaded to the kubeadm cluster configmap, partly becaus NodeRegistrationOptions - `nodeRegistration` holds fields that relate to registering the new control-plane node to the cluster + NodeRegistration holds fields that relate to registering the new control-plane node to the cluster @@ -467,7 +467,7 @@ This information IS NOT uploaded to the kubeadm cluster configmap, partly becaus APIEndpoint - `localAPIEndpoint` represents the endpoint of the API server instance that's deployed on this control plane node + LocalAPIEndpoint represents the endpoint of the API server instance that's deployed on this control plane node In HA setups, this differs from ClusterConfiguration.ControlPlaneEndpoint in the sense that ControlPlaneEndpoint is the global endpoint for the cluster, which then loadbalances the requests to each individual API server. This configuration object lets you customize what IP/DNS name and port the local API server advertises it's accessible @@ -480,8 +480,8 @@ fails you may set the desired value here. string - `certificateKey` sets the key with which certificates and keys are encrypted prior to being uploaded in -a Secret in the cluster during the "uploadcerts" init phase. + CertificateKey sets the key with which certificates and keys are encrypted prior to being uploaded in +a secret in the cluster during the uploadcerts init phase. @@ -489,9 +489,9 @@ a Secret in the cluster during the "uploadcerts" init phase. []string - `skipPhases` is a list of phases to skip during command execution. -The list of phases can be obtained with the `kubeadm init --help` command. -The flag `--skip-phases` takes precedence over this field. + SkipPhases is a list of phases to skip during command execution. +The list of phases can be obtained with the "kubeadm init --help" command. +The flag "--skip-phases" takes precedence over this field. @@ -499,7 +499,7 @@ The flag `--skip-phases` takes precedence over this field. Patches - `patches` contains options related to applying patches to components deployed by kubeadm during + Patches contains options related to applying patches to components deployed by kubeadm during "kubeadm init". @@ -531,8 +531,7 @@ JoinConfiguration contains elements describing a particular node. NodeRegistrationOptions - `nodeRegistration` holds fields that relate to registering the new control-plane -node to the cluster + NodeRegistration holds fields that relate to registering the new control-plane node to the cluster @@ -540,7 +539,7 @@ node to the cluster string - `caCertPath` is the path to the SSL certificate authority used to + CACertPath is the path to the SSL certificate authority used to secure comunications between node and control-plane. Defaults to "/etc/kubernetes/pki/ca.crt". @@ -550,7 +549,7 @@ Defaults to "/etc/kubernetes/pki/ca.crt". Discovery - `discovery` specifies the options for the kubelet to use during the TLS Bootstrap process. + Discovery specifies the options for the kubelet to use during the TLS Bootstrap process @@ -558,8 +557,8 @@ Defaults to "/etc/kubernetes/pki/ca.crt". JoinControlPlane - `controlPlane` defines the additional control plane instance to be deployed on the -joining node. If nil, no additional control plane instance will be deployed. + ControlPlane defines the additional control plane instance to be deployed on the joining node. +If nil, no additional control plane instance will be deployed. @@ -567,9 +566,9 @@ joining node. If nil, no additional control plane instance will be deployed.[]string - `skipPhases` is a list of phases to skip during command execution. -The list of phases can be obtained with the `kubeadm join --help` command. -The flag `--skip-phases` takes precedence over this field. + SkipPhases is a list of phases to skip during command execution. +The list of phases can be obtained with the "kubeadm join --help" command. +The flag "--skip-phases" takes precedence over this field. @@ -577,8 +576,8 @@ The flag `--skip-phases` takes precedence over this field. Patches - `patches` contains options related to applying patches to components deployed by kubeadm during -`kubeadm join`. + Patches contains options related to applying patches to components deployed by kubeadm during +"kubeadm join". @@ -611,7 +610,7 @@ APIEndpoint struct contains elements of API server instance deployed on a node. string - `advertiseAddress` sets the IP address for the API server to advertise. + AdvertiseAddress sets the IP address for the API server to advertise. @@ -619,7 +618,8 @@ APIEndpoint struct contains elements of API server instance deployed on a node. int32 - `bindPort` sets the secure port for the API Server to bind to. Defaults to 6443. + BindPort sets the secure port for the API Server to bind to. +Defaults to 6443. @@ -659,7 +659,7 @@ APIServer holds settings necessary for API server deployments in the cluster []string - `certSANs` sets extra Subject Alternative Names for the API Server signing cert. + CertSANs sets extra Subject Alternative Names for the API Server signing cert. @@ -667,7 +667,7 @@ APIServer holds settings necessary for API server deployments in the cluster meta/v1.Duration - `timeoutForControlPlane` controls the timeout that we use for API server to appear + TimeoutForControlPlane controls the timeout that we use for API server to appear @@ -698,7 +698,8 @@ BootstrapTokenDiscovery is used to set the options for bootstrap token based dis string - `token` is a token used to validate cluster information fetched from the control-plane. + Token is a token used to validate cluster information +fetched from the control-plane. @@ -706,8 +707,7 @@ BootstrapTokenDiscovery is used to set the options for bootstrap token based dis string - `apiServerEndpoint` is an IP or domain name to the API server from which -information will be fetched. + APIServerEndpoint is an IP or domain name to the API server from which info will be fetched. @@ -715,13 +715,13 @@ information will be fetched. []string - CACertHashes specifies a set of public key pins to verify when token-based -discovery is used. The root CA found during discovery must match one of these -values. Specifying an empty set disables root CA pinning, which can be unsafe. -Each hash is specified as `:`, where the only currently supported -type is "sha256". This is a hex-encoded SHA-256 hash of the Subject Public Key -Info (SPKI) object in DER-encoded ASN.1. These hashes can be calculated using, -for example, OpenSSL. + CACertHashes specifies a set of public key pins to verify +when token-based discovery is used. The root CA found during discovery +must match one of these values. Specifying an empty set disables root CA +pinning, which can be unsafe. Each hash is specified as ":", +where the only currently supported type is "sha256". This is a hex-encoded +SHA-256 hash of the Subject Public Key Info (SPKI) object in DER-encoded +ASN.1. These hashes can be calculated using, for example, OpenSSL. @@ -729,9 +729,9 @@ for example, OpenSSL. bool - `unsafeSkipCAVerification` allows token-based discovery without CA verification -via `caCertHashes`. This can weaken the security of kubeadm since other nodes -can impersonate the control-plane. + UnsafeSkipCAVerification allows token-based discovery +without CA verification via CACertHashes. This can weaken +the security of kubeadm since other nodes can impersonate the control-plane. @@ -764,9 +764,11 @@ ControlPlaneComponent holds settings common to control plane component of the cl map[string]string - `extraArgs` is an extra set of flags to pass to the control plane component. + ExtraArgs is an extra set of flags to pass to the control plane component. A key in this map is the flag name as it appears on the -command line except without leading dash(es). +command line except without leading dash(es). +TODO: This is temporary and ideally we would like to switch all components to +use ComponentConfig + ConfigMaps. @@ -774,7 +776,7 @@ command line except without leading dash(es). []HostPathMount - `extraVolumes` is an extra set of host volumes, mounted to the control plane component. + ExtraVolumes is an extra set of host volumes, mounted to the control plane component. @@ -805,7 +807,7 @@ DNS defines the DNS addon that should be used in the cluster ImageMeta (Members of ImageMeta are embedded into this type.) - `imageMeta` allows to customize the image used for the DNS component. + ImageMeta allows to customize the image used for the DNS component @@ -848,8 +850,8 @@ Discovery specifies the options for the kubelet to use during the TLS Bootstrap BootstrapTokenDiscovery - `bootstrapToken` is used to set the options for bootstrap token based discovery. -`bootstrapToken` and `file` are mutually exclusive. + BootstrapToken is used to set the options for bootstrap token based discovery +BootstrapToken and File are mutually exclusive @@ -857,8 +859,8 @@ Discovery specifies the options for the kubelet to use during the TLS Bootstrap FileDiscovery - `file` specifies a file or URL to a kubeconfig file from which to load cluster information. -`bootstrapToken` and `file` are mutually exclusive. + File is used to specify a file or URL to a kubeconfig file from which to load cluster information +BootstrapToken and File are mutually exclusive @@ -866,11 +868,9 @@ Discovery specifies the options for the kubelet to use during the TLS Bootstrap string - `tlsBootstrapToken` is a token used for TLS bootstrapping. -If `bootstrapToken` is set, this field is defaulted to `bootstrapToken.token`, -but can be overridden. -If `file` is set, this field ∗∗must be set∗∗ in case the KubeConfigFile does -not contain any other authentication information + TLSBootstrapToken is a token used for TLS bootstrapping. +If .BootstrapToken is set, this field is defaulted to .BootstrapToken.Token, but can be overridden. +If .File is set, this field ∗∗must be set∗∗ in case the KubeConfigFile does not contain any other authentication information @@ -878,7 +878,7 @@ not contain any other authentication information meta/v1.Duration - `timeout` modifies the discovery timeout. + Timeout modifies the discovery timeout @@ -909,8 +909,8 @@ Etcd contains elements describing Etcd configuration. LocalEtcd - `local` provides configuration knobs for configuring the local etcd instance. -`local` and `external` are mutually exclusive. + Local provides configuration knobs for configuring the local etcd instance +Local and External are mutually exclusive @@ -918,8 +918,8 @@ Etcd contains elements describing Etcd configuration. ExternalEtcd - `external` describes how to connect to an external etcd cluster. -`local` and `external` are mutually exclusive. + External describes how to connect to an external etcd cluster +Local and External are mutually exclusive @@ -951,7 +951,7 @@ Kubeadm has no knowledge of where certificate files live and they must be suppli []string - `endpoints` are endpoints of etcd members. This field is required. + Endpoints of etcd members. Required for ExternalEtcd. @@ -959,7 +959,7 @@ Kubeadm has no knowledge of where certificate files live and they must be suppli string - `caFile` is an SSL Certificate Authority file used to secure etcd communication. + CAFile is an SSL Certificate Authority file used to secure etcd communication. Required if using a TLS connection. @@ -968,7 +968,7 @@ Required if using a TLS connection. string - `certFile` is an SSL certification file used to secure etcd communication. + CertFile is an SSL certification file used to secure etcd communication. Required if using a TLS connection. @@ -977,7 +977,7 @@ Required if using a TLS connection. string - `keyFile` is an SSL key file used to secure etcd communication. + KeyFile is an SSL key file used to secure etcd communication. Required if using a TLS connection. @@ -1009,8 +1009,7 @@ FileDiscovery is used to specify a file or URL to a kubeconfig file from which t string - `kubeConfigPath` specifies the actual file path or URL to the kubeconfig file -from which to load cluster information + KubeConfigPath is used to specify the actual file path or URL to the kubeconfig file from which to load cluster information @@ -1029,7 +1028,8 @@ from which to load cluster information - [ControlPlaneComponent](#kubeadm-k8s-io-v1beta3-ControlPlaneComponent) -HostPathMount contains elements describing volumes that are mounted from the host. +HostPathMount contains elements describing volumes that are mounted from the +host. @@ -1041,7 +1041,7 @@ HostPathMount contains elements describing volumes that are mounted from the hos string + Name of the volume inside the pod template. @@ -1049,7 +1049,8 @@ HostPathMount contains elements describing volumes that are mounted from the hos string + HostPath is the path in the host that will be mounted inside +the pod. @@ -1057,7 +1058,7 @@ HostPathMount contains elements describing volumes that are mounted from the hos string + MountPath is the path inside the pod where hostPath will be mounted. @@ -1065,7 +1066,7 @@ HostPathMount contains elements describing volumes that are mounted from the hos bool + ReadOnly controls write access to the volume @@ -1073,7 +1074,7 @@ HostPathMount contains elements describing volumes that are mounted from the hos core/v1.HostPathType + PathType is the type of the HostPath. @@ -1107,8 +1108,8 @@ originated from the Kubernetes/Kubernetes release process string + ImageRepository sets the container registry to pull images from. +if not set, the ImageRepository defined in ClusterConfiguration will be used instead. @@ -1116,9 +1117,8 @@ If not set, the ImageRepository defined in ClusterConfiguration will be used ins string + ImageTag allows to specify a tag for the image. +In case this value is set, kubeadm does not change automatically the version of the above components during upgrades. @@ -1149,8 +1149,7 @@ JoinControlPlane contains elements describing an additional control plane instan APIEndpoint + LocalAPIEndpoint represents the endpoint of the API server instance to be deployed on this node. @@ -1158,9 +1157,8 @@ on this node.string + CertificateKey is the key that is used for decryption of certificates after they are downloaded from the secret +upon joining a new control plane node. The corresponding encryption key is in the InitConfiguration. @@ -1191,7 +1189,7 @@ LocalEtcd describes that kubeadm should run an etcd cluster locally ImageMeta + ImageMeta allows to customize the container used for etcd @@ -1199,7 +1197,7 @@ LocalEtcd describes that kubeadm should run an etcd cluster locally string @@ -1208,10 +1206,10 @@ Defaults to "/var/lib/etcd".map[string]string +A key in this map is the flag name as it appears on the +command line except without leading dash(es). @@ -1219,7 +1217,7 @@ without leading dash(es).[]string + ServerCertSANs sets extra Subject Alternative Names for the etcd server signing cert. @@ -1227,7 +1225,7 @@ without leading dash(es).[]string + PeerCertSANs sets extra Subject Alternative Names for the etcd peer signing cert. @@ -1258,7 +1256,7 @@ Networking contains elements describing cluster's networking configuration string + ServiceSubnet is the subnet used by k8s services. Defaults to "10.96.0.0/12". @@ -1266,7 +1264,7 @@ Networking contains elements describing cluster's networking configuration string + PodSubnet is the subnet used by pods. @@ -1274,7 +1272,7 @@ Networking contains elements describing cluster's networking configuration string + DNSDomain is the dns domain used by k8s services. Defaults to "cluster.local". @@ -1307,10 +1305,9 @@ NodeRegistrationOptions holds fields that relate to registering a new control-pl string + Name is the `.Metadata.Name` field of the Node API object that will be created in this `kubeadm init` or `kubeadm join` operation. +This field is also used in the CommonName field of the kubelet's client certificate to the API server. +Defaults to the hostname of the node if not provided. @@ -1318,8 +1315,7 @@ API server. Defaults to the hostname of the node if not provided.string + CRISocket is used to retrieve container runtime info. This information will be annotated to the Node API object, for later re-use @@ -1327,11 +1323,9 @@ annotated to the Node API object, for later re-use.[]core/v1.Taint + Taints specifies the taints the Node API object should be registered with. If this field is unset, i.e. nil, in the `kubeadm init` process +it will be defaulted to []v1.Taint{'node-role.kubernetes.io/master=""'}. If you don't want to taint your control-plane node, set this field to an +empty slice, i.e. `taints: []` in the YAML file. This field is solely used for Node registration. @@ -1339,13 +1333,11 @@ file. This field is solely used for Node registration.map[string]string + KubeletExtraArgs passes through extra arguments to the kubelet. The arguments here are passed to the kubelet command line via the environment file +kubeadm writes at runtime for the kubelet to source. This overrides the generic base-level configuration in the kubelet-config-1.X ConfigMap +Flags have higher priority when parsing. These values are local and specific to the node kubeadm is executing on. +A key in this map is the flag name as it appears on the +command line except without leading dash(es). @@ -1353,8 +1345,7 @@ leading dash(es).[]string + IgnorePreflightErrors provides a slice of pre-flight errors to be ignored when the current node is registered. @@ -1362,11 +1353,9 @@ the current node is registered.core/v1.PullPolicy +If this field is unset kubeadm will default it to "IfNotPresent", or pull the required images if not present on the host. @@ -1399,13 +1388,12 @@ Patches contains options related to applying patches to components deployed by k string diff --git a/content/en/docs/reference/config-api/kubelet-config.v1beta1.md b/content/en/docs/reference/config-api/kubelet-config.v1beta1.md index 261a6dd5f8..619b8d70f6 100644 --- a/content/en/docs/reference/config-api/kubelet-config.v1beta1.md +++ b/content/en/docs/reference/config-api/kubelet-config.v1beta1.md @@ -493,14 +493,13 @@ Default: "5m"int32 @@ -693,7 +690,7 @@ Valid values include: requested resources; - `best-effort`: kubelet will favor pods with NUMA alignment of CPU and device resources; -- `none`: kublet has no knowledge of NUMA alignment of a pod's CPU and device resources. +- `none`: kubelet has no knowledge of NUMA alignment of a pod's CPU and device resources. - `single-numa-node`: kubelet only allows pods with a single NUMA alignment of CPU and device resources. @@ -819,6 +816,7 @@ If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that changes will only take effect on Pods created after the update. Draining the node is recommended before changing this field. +If set to the empty string, will override the default and effectively disable DNS lookups. Default: "/etc/resolv.conf" @@ -1417,6 +1415,39 @@ Default: "0s" + + + + + @@ -1485,6 +1516,26 @@ Default: 0.8 + + + + + + + + + +
    FieldDescription
    - `name` is the volume name inside the Pod template.
    - `hostPath` is the path in the host that will be mounted inside the Pod.
    - `mountPath` is the path inside the Pod where the `hostPath` volume is mounted.
    - `readOnly` controls write access to the volume.
    - `pathType` is the type of the `hostPath` volume.
    - `imageRepository` sets the container registry to pull images from. -If not set, the ImageRepository defined in ClusterConfiguration will be used instead.
    - `imageTag` allows to specify a tag for the image. -In case this value is set, kubeadm does not change automatically the -version of the above components during upgrades.
    - `localAPIEndpoint` represents the endpoint of the API server instance to be deployed -on this node.
    - `certificateKey` is the key that is used for decryption of certificates after they -are downloaded from the secret upon joining a new control plane node. The -corresponding encryption key is in the InitConfiguration.
    (Members of ImageMeta are embedded into this type.) - `ImageMeta` allows to customize the container used for etcd.
    - `dataDir` is the directory etcd will place its data. + DataDir is the directory etcd will place its data. Defaults to "/var/lib/etcd".
    - `extraArgs` are extra arguments provided to the etcd binary + ExtraArgs are extra arguments provided to the etcd binary when run inside a static pod. -A key in this map is the flag name as it appears on the command line except -without leading dash(es).
    - `serverCertSANs` sets extra Subject Alternative Names for the etcd server signing cert.
    - `peerCertSANs` sets extra Subject Alternative Names for the etcd peer signing cert.
    - `serviceSubnet` is the subnet used by k8s services. Defaults to "10.96.0.0/12".
    - `podSubnet` is the subnet used by Pods.
    - `dnsDomain` is the DNS domain used by k8s services. Defaults to "cluster.local".
    - `name` is the `.metadata.name` field of the Node API object that will be created in this -`kubeadm init` or `kubeadm join` operation. -This field is also used in the `CommonName` field of the kubelet's client certificate to the -API server. Defaults to the hostname of the node if not provided.
    - `criSocket` is used to retrieve container runtime info. This information will be -annotated to the Node API object, for later re-use.
    - `taints` specifies the taints the Node API object should be registered with. If -this field is unset, i.e. nil, in the `kubeadm init` process, it will be defaulted -to `['"node-role.kubernetes.io/master"=""']`. If you don't want to taint your -control-plane node, set this field to an empty list, i.e. `taints: []` in the YAML -file. This field is solely used for Node registration.
    - `kubeletExtraArgs` passes through extra arguments to the kubelet. The arguments here -are passed to the kubelet command line via the environment file kubeadm writes at -runtime for the kubelet to source. This overrides the generic base-level -configuration in the "kubelet-config-1.X" ConfigMap. Flags have higher priority when -parsing. These values are local and specific to the node kubeadm is executing on. -A key in this map is the flag name as it appears on the command line except without -leading dash(es).
    - `ignorePreflightErrors` provides a slice of pre-flight errors to be ignored when -the current node is registered.
    - `imagePullPolicy` specifies the policy for image pulling during `kubeadm init` and -`kubeadm join` operations. + ImagePullPolicy specifies the policy for image pulling during kubeadm "init" and "join" operations. The value of this field must be one of "Always", "IfNotPresent" or "Never". -If this field is unset kubeadm will default it to "IfNotPresent", or pull the required -images if not present on the host.
    - `directory` is a path to a directory that contains files named -`target[suffix][+patchtype].extension`. -For example, `kube-apiserver0+merge.yaml` or just `etcd.json`. `target` can be one of -"kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". `patchtype` can be one -of "strategic", "merge" or "json" and they match the patch formats supported by kubectl. -The default `patchtype` is "strategic". `extension` must be either "json" or "yaml". -`suffix` is an optional string that can be used to determine which patches are applied + Directory is a path to a directory that contains files named "target[suffix][+patchtype].extension". +For example, "kube-apiserver0+merge.yaml" or just "etcd.json". "target" can be one of +"kube-apiserver", "kube-controller-manager", "kube-scheduler", "etcd". "patchtype" can be one +of "strategic" "merge" or "json" and they match the patch formats supported by kubectl. +The default "patchtype" is "strategic". "extension" must be either "json" or "yaml". +"suffix" is an optional string that can be used to determine which patches are applied first alpha-numerically.
    - nodeLeaseDurationSeconds is the duration the Kubelet will set on its corresponding Lease, -when the NodeLease feature is enabled. This feature provides an indicator of node -health by having the Kubelet create and periodically renew a lease, named after the node, -in the kube-node-lease namespace. If the lease expires, the node can be considered unhealthy. -The lease is currently renewed every 10s, per KEP-0009. In the future, the lease renewal interval -may be set based on the lease duration. + nodeLeaseDurationSeconds is the duration the Kubelet will set on its corresponding Lease. +NodeLease provides an indicator of node health by having the Kubelet create and +periodically renew a lease, named after the node, in the kube-node-lease namespace. +If the lease expires, the node can be considered unhealthy. +The lease is currently renewed every 10s, per KEP-0009. In the future, the lease renewal +interval may be set based on the lease duration. The field value must be greater than 0. -Requires the NodeLease feature gate to be enabled. If DynamicKubeletConfig (deprecated; default off) is on, when dynamically updating this field, consider that decreasing the duration may reduce tolerance for issues that temporarily prevent @@ -514,11 +513,9 @@ Default: 40 imageMinimumGCAge is the minimum age for an unused image before it is -garbage collected. -If DynamicKubeletConfig (deprecated; default off) is on, when -dynamically updating this field, consider that -it may trigger or delay garbage collection, and may change the image overhead -on the node. +garbage collected. If DynamicKubeletConfig (deprecated; default off) +is on, when dynamically updating this field, consider that it may trigger or +delay garbage collection, and may change the image overhead on the node. Default: "2m"
    shutdownGracePeriodByPodPriority
    +[]ShutdownGracePeriodByPodPriority +
    + shutdownGracePeriodByPodPriority specifies the shutdown grace period for Pods based +on their associated priority class value. +When a shutdown request is received, the Kubelet will initiate shutdown on all pods +running on the node with a grace period that depends on the priority of the pod, +and then wait for all pods to exit. +Each entry in the array represents the graceful shutdown time a pod with a priority +class value that lies in the range of that value and the next higher entry in the +list when the node is shutting down. +For example, to allow critical pods 10s to shutdown, priority>=10000 pods 20s to +shutdown, and all remaining pods 30s to shutdown. + +shutdownGracePeriodByPodPriority: + - priority: 2000000000 + shutdownGracePeriodSeconds: 10 + - priority: 10000 + shutdownGracePeriodSeconds: 20 + - priority: 0 + shutdownGracePeriodSeconds: 30 + +The time the Kubelet will wait before exiting will at most be the maximum of all +shutdownGracePeriodSeconds for each priority class range represented on the node. +When all pods have exited or reached their grace periods, the Kubelet will release +the shutdown inhibit lock. +Requires the GracefulNodeShutdown feature gate to be enabled. +This configuration must be empty if either ShutdownGracePeriod or ShutdownGracePeriodCriticalPods is set. +Default: nil
    reservedMemory
    []MemoryReservation
    registerWithTaints
    +[]core/v1.Taint +
    + registerWithTaints are an array of taints to add to a node object when +the kubelet registers itself. This only takes effect when registerNode +is true and upon the initial registration of the node. +Default: nil
    registerNode
    +bool +
    + registerNode enables automatic registration with the apiserver. +Default: true
    @@ -1879,10 +1930,118 @@ managers (secret, configmap) are discovering object changes. + + +## `ShutdownGracePeriodByPodPriority` {#kubelet-config-k8s-io-v1beta1-ShutdownGracePeriodByPodPriority} + + + + +**Appears in:** + +- [KubeletConfiguration](#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) + + +ShutdownGracePeriodByPodPriority specifies the shutdown grace period for Pods based on their associated priority class value + + + + + + + + + + + + + + + + + + +
    FieldDescription
    priority [Required]
    +int32 +
    + priority is the priority value associated with the shutdown grace period
    shutdownGracePeriodSeconds [Required]
    +int64 +
    + shutdownGracePeriodSeconds is the shutdown grace period in seconds
    + +## `FormatOptions` {#FormatOptions} + + + + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +FormatOptions contains options for the different logging formats. + + + + + + + + + + + + + +
    FieldDescription
    json [Required]
    +JSONOptions +
    + [Experimental] JSON contains options for logging format "json".
    + +## `JSONOptions` {#JSONOptions} + + + + +**Appears in:** + +- [FormatOptions](#FormatOptions) + + +JSONOptions contains options for logging format "json". + + + + + + + + + + + + + + + + + + +
    FieldDescription
    splitStream [Required]
    +bool +
    + [Experimental] SplitStream redirects error messages to stderr while +info messages go to stdout, with buffering. The default is to write +both to stdout, without buffering.
    infoBufferSize [Required]
    +k8s.io/apimachinery/pkg/api/resource.QuantityValue +
    + [Experimental] InfoBufferSize sets the size of the info stream when +using split streams. The default is zero, which disables buffering.
    + ## `LoggingConfiguration` {#LoggingConfiguration} @@ -1911,6 +2070,35 @@ default value of format is `text` +flushFrequency [Required]
    +time.Duration + + + Maximum number of seconds between log flushes. Ignored if the +selected logging backend writes log messages without buffering. + + + +verbosity [Required]
    +uint32 + + + Verbosity is the threshold that determines which log messages are +logged. Default is zero which logs only the most important +messages. Higher values enable additional messages. Error messages +are always logged. + + + +vmodule [Required]
    +VModuleConfiguration + + + VModule overrides the verbosity threshold for individual files. +Only supported for "text" log format. + + + sanitization [Required]
    bool @@ -1920,5 +2108,30 @@ Runtime log sanitization may introduce significant computation overhead and ther +options [Required]
    +FormatOptions + + + [Experimental] Options holds additional parameters that are specific +to the different logging formats. Only the options for the selected +format get used, but all of them get validated. + + + + +## `VModuleConfiguration` {#VModuleConfiguration} + +(Alias of `[]k8s.io/component-base/config/v1alpha1.VModuleItem`) + + +**Appears in:** + +- [LoggingConfiguration](#LoggingConfiguration) + + +VModuleConfiguration is a collection of individual file names or patterns +and the corresponding verbosity threshold. + + diff --git a/content/en/docs/reference/scheduling/config.md b/content/en/docs/reference/scheduling/config.md index ca756f6124..502ffcb61e 100644 --- a/content/en/docs/reference/scheduling/config.md +++ b/content/en/docs/reference/scheduling/config.md @@ -20,7 +20,8 @@ by implementing one or more of these extension points. You can specify scheduling profiles by running `kube-scheduler --config `, using the -KubeSchedulerConfiguration ([v1beta2](/docs/reference/config-api/kube-scheduler-config.v1beta2/)) +KubeSchedulerConfiguration ([v1beta2](/docs/reference/config-api/kube-scheduler-config.v1beta2/) +or [v1beta3](/docs/reference/config-api/kube-scheduler-config.v1beta3/)) struct. A minimal configuration looks as follows: @@ -456,5 +457,5 @@ as well as its seamless integration with the existing methods for configuring ex * Read the [kube-scheduler reference](/docs/reference/command-line-tools-reference/kube-scheduler/) * Learn about [scheduling](/docs/concepts/scheduling-eviction/kube-scheduler/) -* Read the [kube-scheduler configuration (v1beta1)](/docs/reference/config-api/kube-scheduler-config.v1beta1/) reference * Read the [kube-scheduler configuration (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2/) reference +* Read the [kube-scheduler configuration (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) reference diff --git a/content/en/docs/reference/scheduling/policies.md b/content/en/docs/reference/scheduling/policies.md index 3e2e554fc9..13cc13845c 100644 --- a/content/en/docs/reference/scheduling/policies.md +++ b/content/en/docs/reference/scheduling/policies.md @@ -16,5 +16,5 @@ This scheduling policy is not supported since Kubernetes v1.23. Associated flags * Learn about [scheduling](/docs/concepts/scheduling-eviction/kube-scheduler/) * Learn about [kube-scheduler Configuration](/docs/reference/scheduling/config/) -* Read the [kube-scheduler configuration reference (v1beta2)](/docs/reference/config-api/kube-scheduler-config.v1beta2) +* Read the [kube-scheduler configuration reference (v1beta3)](/docs/reference/config-api/kube-scheduler-config.v1beta3/) * Read the [kube-scheduler Policy reference (v1)](/docs/reference/config-api/kube-scheduler-policy-config.v1/) diff --git a/content/en/docs/tasks/extend-kubernetes/configure-multiple-schedulers.md b/content/en/docs/tasks/extend-kubernetes/configure-multiple-schedulers.md index bed250a170..51271bdeab 100644 --- a/content/en/docs/tasks/extend-kubernetes/configure-multiple-schedulers.md +++ b/content/en/docs/tasks/extend-kubernetes/configure-multiple-schedulers.md @@ -76,7 +76,7 @@ to customize the behavior of your scheduler implementation. This configuration h the `kube-scheduler` during initialization with the `--config` option. The `my-scheduler-config` ConfigMap stores the configuration file. The Pod of the`my-scheduler` Deployment mounts the `my-scheduler-config` ConfigMap as a volume. In the aforementioned Scheduler Configuration, your scheduler implementation is represented via -a [KubeSchedulerProfile](/docs/reference/config-api/kube-scheduler-config.v1beta2/#kubescheduler-config-k8s-io-v1beta2-KubeSchedulerProfile). +a [KubeSchedulerProfile](/docs/reference/config-api/kube-scheduler-config.v1beta3/#kubescheduler-config-k8s-io-v1beta3-KubeSchedulerProfile). {{< note >}} To determine if a scheduler is responsible for scheduling a specific Pod, the `spec.schedulerName` field in a PodTemplate or Pod manifest must match the `schedulerName` field of the `KubeSchedulerProfile`. @@ -89,7 +89,7 @@ Also, note that you create a dedicated service account `my-scheduler` and bind t Please see the [kube-scheduler documentation](/docs/reference/command-line-tools-reference/kube-scheduler/) for detailed description of other command line arguments and -[Scheduler Configuration reference](https://kubernetes.io/docs/reference/config-api/kube-scheduler-config.v1beta2/) for +[Scheduler Configuration reference](/docs/reference/config-api/kube-scheduler-config.v1beta3/) for detailed description of other customizable `kube-scheduler` configurations. ## Run the second scheduler in the cluster From 02445930e5f11c85e3a7eecc8b48a7e73bee3685 Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Wed, 8 Dec 2021 09:34:52 +0100 Subject: [PATCH 145/148] Reference docs for kubernetes 1.23 --- api-ref-assets/api/swagger.json | 13125 ++++++++-------- api-ref-assets/config/fields.yaml | 22 + api-ref-assets/config/toc.yaml | 9 +- .../certificate-signing-request-v1.md | 40 + .../service-account-v1.md | 15 + .../token-request-v1.md | 5 + .../token-review-v1.md | 5 + .../cluster-role-binding-v1.md | 15 + .../cluster-role-v1.md | 17 +- .../local-subject-access-review-v1.md | 5 + .../role-binding-v1.md | 15 + .../authorization-resources/role-v1.md | 17 +- .../self-subject-access-review-v1.md | 5 + .../self-subject-rules-review-v1.md | 5 + .../subject-access-review-v1.md | 5 + .../cluster-resources/api-service-v1.md | 25 + .../cluster-resources/binding-v1.md | 10 + .../cluster-resources/event-v1.md | 15 + ...hema-v1beta1.md => flow-schema-v1beta2.md} | 101 +- .../cluster-resources/lease-v1.md | 15 + .../cluster-resources/namespace-v1.md | 41 + .../cluster-resources/node-v1.md | 49 + ...> priority-level-configuration-v1beta2.md} | 99 +- .../cluster-resources/runtime-class-v1.md | 24 + .../node-selector-requirement.md | 8 + .../common-parameters/common-parameters.md | 10 + .../config-map-v1.md | 15 + .../csi-driver-v1.md | 19 +- .../csi-node-v1.md | 15 + .../csi-storage-capacity-v1beta1.md | 15 + .../persistent-volume-claim-v1.md | 46 +- .../persistent-volume-v1.md | 39 +- .../config-and-storage-resources/secret-v1.md | 17 +- .../storage-class-v1.md | 15 + .../volume-attachment-v1.md | 25 + .../config-and-storage-resources/volume.md | 2 - .../custom-resource-definition-v1.md | 68 + .../mutating-webhook-configuration-v1.md | 15 + .../validating-webhook-configuration-v1.md | 15 + .../policy-resources/limit-range-v1.md | 20 + .../policy-resources/network-policy-v1.md | 15 + .../pod-disruption-budget-v1.md | 25 + .../pod-security-policy-v1beta1.md | 15 + .../policy-resources/resource-quota-v1.md | 39 + .../service-resources/endpoint-slice-v1.md | 20 + .../service-resources/endpoints-v1.md | 20 + .../service-resources/ingress-class-v1.md | 17 +- .../service-resources/ingress-v1.md | 30 + .../service-resources/service-v1.md | 142 +- .../controller-revision-v1.md | 15 + .../workload-resources/cron-job-v1.md | 30 + .../workload-resources/daemon-set-v1.md | 31 +- .../workload-resources/deployment-v1.md | 31 +- .../horizontal-pod-autoscaler-v1.md | 25 + .../horizontal-pod-autoscaler-v2.md | 1357 ++ .../horizontal-pod-autoscaler-v2beta2.md | 45 +- .../workload-resources/job-v1.md | 45 +- .../workload-resources/pod-template-v1.md | 15 + .../workload-resources/pod-v1.md | 282 +- .../workload-resources/priority-class-v1.md | 17 +- .../workload-resources/replica-set-v1.md | 27 +- .../replication-controller-v1.md | 25 + .../workload-resources/stateful-set-v1.md | 54 +- 63 files changed, 10024 insertions(+), 6326 deletions(-) rename content/en/docs/reference/kubernetes-api/cluster-resources/{flow-schema-v1beta1.md => flow-schema-v1beta2.md} (86%) rename content/en/docs/reference/kubernetes-api/cluster-resources/{priority-level-configuration-v1beta1.md => priority-level-configuration-v1beta2.md} (85%) create mode 100644 content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2.md diff --git a/api-ref-assets/api/swagger.json b/api-ref-assets/api/swagger.json index 5404b05fb9..b836f6700a 100644 --- a/api-ref-assets/api/swagger.json +++ b/api-ref-assets/api/swagger.json @@ -750,7 +750,7 @@ "type": "integer" }, "numberReady": { - "description": "The number of nodes that should be running the daemon pod and have one or more of the daemon pod running and ready.", + "description": "numberReady is the number of nodes that should be running the daemon pod and have one or more of the daemon pod running with a Ready Condition.", "format": "int32", "type": "integer" }, @@ -786,7 +786,11 @@ "description": "Rolling update config params. Present only if type = \"RollingUpdate\"." }, "type": { - "description": "Type of daemon set update. Can be \"RollingUpdate\" or \"OnDelete\". Default is RollingUpdate.", + "description": "Type of daemon set update. Can be \"RollingUpdate\" or \"OnDelete\". Default is RollingUpdate.\n\nPossible enum values:\n - `\"OnDelete\"` Replace the old daemons only when it's killed\n - `\"RollingUpdate\"` Replace the old daemons by new ones using rolling update i.e replace them on each node one after the other.", + "enum": [ + "OnDelete", + "RollingUpdate" + ], "type": "string" } }, @@ -969,7 +973,7 @@ "type": "integer" }, "readyReplicas": { - "description": "Total number of ready pods targeted by this deployment.", + "description": "readyReplicas is the number of pods targeted by this Deployment with a Ready Condition.", "format": "int32", "type": "integer" }, @@ -999,7 +1003,11 @@ "description": "Rolling update config params. Present only if DeploymentStrategyType = RollingUpdate." }, "type": { - "description": "Type of deployment. Can be \"Recreate\" or \"RollingUpdate\". Default is RollingUpdate.", + "description": "Type of deployment. Can be \"Recreate\" or \"RollingUpdate\". Default is RollingUpdate.\n\nPossible enum values:\n - `\"Recreate\"` Kill all existing pods before creating new ones.\n - `\"RollingUpdate\"` Replace the old ReplicaSets by new one using rolling update i.e gradually scale down the old ReplicaSets and scale up the new one.", + "enum": [ + "Recreate", + "RollingUpdate" + ], "type": "string" } }, @@ -1158,7 +1166,7 @@ "type": "integer" }, "readyReplicas": { - "description": "The number of ready replicas for this replica set.", + "description": "readyReplicas is the number of pods targeted by this ReplicaSet with a Ready Condition.", "format": "int32", "type": "integer" }, @@ -1310,6 +1318,20 @@ } ] }, + "io.k8s.api.apps.v1.StatefulSetPersistentVolumeClaimRetentionPolicy": { + "description": "StatefulSetPersistentVolumeClaimRetentionPolicy describes the policy used for PVCs created from the StatefulSet VolumeClaimTemplates.", + "properties": { + "whenDeleted": { + "description": "WhenDeleted specifies what happens to PVCs created from StatefulSet VolumeClaimTemplates when the StatefulSet is deleted. The default policy of `Retain` causes PVCs to not be affected by StatefulSet deletion. The `Delete` policy causes those PVCs to be deleted.", + "type": "string" + }, + "whenScaled": { + "description": "WhenScaled specifies what happens to PVCs created from StatefulSet VolumeClaimTemplates when the StatefulSet is scaled down. The default policy of `Retain` causes PVCs to not be affected by a scaledown. The `Delete` policy causes the associated PVCs for any excess pods above the replica count to be deleted.", + "type": "string" + } + }, + "type": "object" + }, "io.k8s.api.apps.v1.StatefulSetSpec": { "description": "A StatefulSetSpec is the specification of a StatefulSet.", "properties": { @@ -1318,8 +1340,16 @@ "format": "int32", "type": "integer" }, + "persistentVolumeClaimRetentionPolicy": { + "$ref": "#/definitions/io.k8s.api.apps.v1.StatefulSetPersistentVolumeClaimRetentionPolicy", + "description": "persistentVolumeClaimRetentionPolicy describes the lifecycle of persistent volume claims created from volumeClaimTemplates. By default, all persistent volume claims are created as needed and retained until manually deleted. This policy allows the lifecycle to be altered, for example by deleting persistent volume claims when their stateful set is deleted, or when their pod is scaled down. This requires the StatefulSetAutoDeletePVC feature gate to be enabled, which is alpha. +optional" + }, "podManagementPolicy": { - "description": "podManagementPolicy controls how pods are created during initial scale up, when replacing pods on nodes, or when scaling down. The default policy is `OrderedReady`, where pods are created in increasing order (pod-0, then pod-1, etc) and the controller will wait until each pod is ready before continuing. When scaling down, the pods are removed in the opposite order. The alternative policy is `Parallel` which will create pods in parallel to match the desired scale without waiting, and on scale down will delete all pods at once.", + "description": "podManagementPolicy controls how pods are created during initial scale up, when replacing pods on nodes, or when scaling down. The default policy is `OrderedReady`, where pods are created in increasing order (pod-0, then pod-1, etc) and the controller will wait until each pod is ready before continuing. When scaling down, the pods are removed in the opposite order. The alternative policy is `Parallel` which will create pods in parallel to match the desired scale without waiting, and on scale down will delete all pods at once.\n\nPossible enum values:\n - `\"OrderedReady\"` will create pods in strictly increasing order on scale up and strictly decreasing order on scale down, progressing only when the previous pod is ready or terminated. At most one pod will be changed at any time.\n - `\"Parallel\"` will create and delete pods as soon as the stateful set replica count is changed, and will not wait for pods to be ready or complete termination.", + "enum": [ + "OrderedReady", + "Parallel" + ], "type": "string" }, "replicas": { @@ -1367,7 +1397,7 @@ "description": "StatefulSetStatus represents the current state of a StatefulSet.", "properties": { "availableReplicas": { - "description": "Total number of available pods (ready for at least minReadySeconds) targeted by this statefulset. This is an alpha field and requires enabling StatefulSetMinReadySeconds feature gate. Remove omitempty when graduating to beta", + "description": "Total number of available pods (ready for at least minReadySeconds) targeted by this statefulset. This is a beta field and enabled/disabled by StatefulSetMinReadySeconds feature gate.", "format": "int32", "type": "integer" }, @@ -1400,7 +1430,7 @@ "type": "integer" }, "readyReplicas": { - "description": "readyReplicas is the number of Pods created by the StatefulSet controller that have a Ready Condition.", + "description": "readyReplicas is the number of pods created for this StatefulSet with a Ready Condition.", "format": "int32", "type": "integer" }, @@ -1420,7 +1450,8 @@ } }, "required": [ - "replicas" + "replicas", + "availableReplicas" ], "type": "object" }, @@ -1432,7 +1463,11 @@ "description": "RollingUpdate is used to communicate parameters when Type is RollingUpdateStatefulSetStrategyType." }, "type": { - "description": "Type indicates the type of the StatefulSetUpdateStrategy. Default is RollingUpdate.", + "description": "Type indicates the type of the StatefulSetUpdateStrategy. Default is RollingUpdate.\n\nPossible enum values:\n - `\"OnDelete\"` triggers the legacy behavior. Version tracking and ordered rolling restarts are disabled. Pods are recreated from the StatefulSetSpec when they are manually deleted. When a scale operation is performed with this strategy,specification version indicated by the StatefulSet's currentRevision.\n - `\"RollingUpdate\"` indicates that update will be applied to all Pods in the StatefulSet with respect to the StatefulSet ordering constraints. When a scale operation is performed with this strategy, new Pods will be created from the specification version indicated by the StatefulSet's updateRevision.", + "enum": [ + "OnDelete", + "RollingUpdate" + ], "type": "string" } }, @@ -2237,6 +2272,601 @@ ], "type": "object" }, + "io.k8s.api.autoscaling.v2.ContainerResourceMetricSource": { + "description": "ContainerResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source. Only one \"target\" type should be set.", + "properties": { + "container": { + "description": "container is the name of the container in the pods of the scaling target", + "type": "string" + }, + "name": { + "description": "name is the name of the resource in question.", + "type": "string" + }, + "target": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricTarget", + "description": "target specifies the target value for the given metric" + } + }, + "required": [ + "name", + "target", + "container" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.ContainerResourceMetricStatus": { + "description": "ContainerResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.", + "properties": { + "container": { + "description": "Container is the name of the container in the pods of the scaling target", + "type": "string" + }, + "current": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricValueStatus", + "description": "current contains the current value for the given metric" + }, + "name": { + "description": "Name is the name of the resource in question.", + "type": "string" + } + }, + "required": [ + "name", + "current", + "container" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.CrossVersionObjectReference": { + "description": "CrossVersionObjectReference contains enough information to let you identify the referred resource.", + "properties": { + "apiVersion": { + "description": "API version of the referent", + "type": "string" + }, + "kind": { + "description": "Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds\"", + "type": "string" + }, + "name": { + "description": "Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names", + "type": "string" + } + }, + "required": [ + "kind", + "name" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.ExternalMetricSource": { + "description": "ExternalMetricSource indicates how to scale on a metric not associated with any Kubernetes object (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).", + "properties": { + "metric": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricIdentifier", + "description": "metric identifies the target metric by name and selector" + }, + "target": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricTarget", + "description": "target specifies the target value for the given metric" + } + }, + "required": [ + "metric", + "target" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.ExternalMetricStatus": { + "description": "ExternalMetricStatus indicates the current value of a global metric not associated with any Kubernetes object.", + "properties": { + "current": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricValueStatus", + "description": "current contains the current value for the given metric" + }, + "metric": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricIdentifier", + "description": "metric identifies the target metric by name and selector" + } + }, + "required": [ + "metric", + "current" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.HPAScalingPolicy": { + "description": "HPAScalingPolicy is a single policy which must hold true for a specified past interval.", + "properties": { + "periodSeconds": { + "description": "PeriodSeconds specifies the window of time for which the policy should hold true. PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).", + "format": "int32", + "type": "integer" + }, + "type": { + "description": "Type is used to specify the scaling policy.", + "type": "string" + }, + "value": { + "description": "Value contains the amount of change which is permitted by the policy. It must be greater than zero", + "format": "int32", + "type": "integer" + } + }, + "required": [ + "type", + "value", + "periodSeconds" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.HPAScalingRules": { + "description": "HPAScalingRules configures the scaling behavior for one direction. These Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.", + "properties": { + "policies": { + "description": "policies is a list of potential scaling polices which can be used during scaling. At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid", + "items": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HPAScalingPolicy" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "selectPolicy": { + "description": "selectPolicy is used to specify which policy should be used. If not set, the default value Max is used.", + "type": "string" + }, + "stabilizationWindowSeconds": { + "description": "StabilizationWindowSeconds is the number of seconds for which past recommendations should be considered while scaling up or scaling down. StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour). If not set, use the default values: - For scale up: 0 (i.e. no stabilization is done). - For scale down: 300 (i.e. the stabilization window is 300 seconds long).", + "format": "int32", + "type": "integer" + } + }, + "type": "object" + }, + "io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler": { + "description": "HorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta", + "description": "metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "spec": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerSpec", + "description": "spec is the specification for the behaviour of the autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status." + }, + "status": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerStatus", + "description": "status is the current information about the autoscaler." + } + }, + "type": "object", + "x-kubernetes-group-version-kind": [ + { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + ] + }, + "io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerBehavior": { + "description": "HorizontalPodAutoscalerBehavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively).", + "properties": { + "scaleDown": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HPAScalingRules", + "description": "scaleDown is scaling policy for scaling Down. If not set, the default value is to allow to scale down to minReplicas pods, with a 300 second stabilization window (i.e., the highest recommendation for the last 300sec is used)." + }, + "scaleUp": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HPAScalingRules", + "description": "scaleUp is scaling policy for scaling Up. If not set, the default value is the higher of:\n * increase no more than 4 pods per 60 seconds\n * double the number of pods per 60 seconds\nNo stabilization is used." + } + }, + "type": "object" + }, + "io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerCondition": { + "description": "HorizontalPodAutoscalerCondition describes the state of a HorizontalPodAutoscaler at a certain point.", + "properties": { + "lastTransitionTime": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "lastTransitionTime is the last time the condition transitioned from one status to another" + }, + "message": { + "description": "message is a human-readable explanation containing details about the transition", + "type": "string" + }, + "reason": { + "description": "reason is the reason for the condition's last transition.", + "type": "string" + }, + "status": { + "description": "status is the status of the condition (True, False, Unknown)", + "type": "string" + }, + "type": { + "description": "type describes the current condition", + "type": "string" + } + }, + "required": [ + "type", + "status" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerList": { + "description": "HorizontalPodAutoscalerList is a list of horizontal pod autoscaler objects.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "items": { + "description": "items is the list of horizontal pod autoscaler objects.", + "items": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + }, + "type": "array" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta", + "description": "metadata is the standard list metadata." + } + }, + "required": [ + "items" + ], + "type": "object", + "x-kubernetes-group-version-kind": [ + { + "group": "autoscaling", + "kind": "HorizontalPodAutoscalerList", + "version": "v2" + } + ] + }, + "io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerSpec": { + "description": "HorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler.", + "properties": { + "behavior": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerBehavior", + "description": "behavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively). If not set, the default HPAScalingRules for scale up and scale down are used." + }, + "maxReplicas": { + "description": "maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up. It cannot be less that minReplicas.", + "format": "int32", + "type": "integer" + }, + "metrics": { + "description": "metrics contains the specifications for which to use to calculate the desired replica count (the maximum replica count across all metrics will be used). The desired replica count is calculated multiplying the ratio between the target value and the current value by the current number of pods. Ergo, metrics used must decrease as the pod count is increased, and vice-versa. See the individual metric source types for more information about how each type of metric must respond. If not set, the default metric will be set to 80% average CPU utilization.", + "items": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricSpec" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "minReplicas": { + "description": "minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available.", + "format": "int32", + "type": "integer" + }, + "scaleTargetRef": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.CrossVersionObjectReference", + "description": "scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics should be collected, as well as to actually change the replica count." + } + }, + "required": [ + "scaleTargetRef", + "maxReplicas" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerStatus": { + "description": "HorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler.", + "properties": { + "conditions": { + "description": "conditions is the set of conditions required for this autoscaler to scale its target, and indicates whether or not those conditions are met.", + "items": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerCondition" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "type" + ], + "x-kubernetes-list-type": "map", + "x-kubernetes-patch-merge-key": "type", + "x-kubernetes-patch-strategy": "merge" + }, + "currentMetrics": { + "description": "currentMetrics is the last read state of the metrics used by this autoscaler.", + "items": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricStatus" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "currentReplicas": { + "description": "currentReplicas is current number of replicas of pods managed by this autoscaler, as last seen by the autoscaler.", + "format": "int32", + "type": "integer" + }, + "desiredReplicas": { + "description": "desiredReplicas is the desired number of replicas of pods managed by this autoscaler, as last calculated by the autoscaler.", + "format": "int32", + "type": "integer" + }, + "lastScaleTime": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods, used by the autoscaler to control how often the number of pods is changed." + }, + "observedGeneration": { + "description": "observedGeneration is the most recent generation observed by this autoscaler.", + "format": "int64", + "type": "integer" + } + }, + "required": [ + "desiredReplicas" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.MetricIdentifier": { + "description": "MetricIdentifier defines the name and optionally selector for a metric", + "properties": { + "name": { + "description": "name is the name of the given metric", + "type": "string" + }, + "selector": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector", + "description": "selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics." + } + }, + "required": [ + "name" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.MetricSpec": { + "description": "MetricSpec specifies how to scale based on a single metric (only `type` and one other matching field should be set at once).", + "properties": { + "containerResource": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.ContainerResourceMetricSource", + "description": "containerResource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod of the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source. This is an alpha feature and can be enabled by the HPAContainerMetrics feature flag." + }, + "external": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.ExternalMetricSource", + "description": "external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster)." + }, + "object": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.ObjectMetricSource", + "description": "object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object)." + }, + "pods": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.PodsMetricSource", + "description": "pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value." + }, + "resource": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.ResourceMetricSource", + "description": "resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source." + }, + "type": { + "description": "type is the type of metric source. It should be one of \"ContainerResource\", \"External\", \"Object\", \"Pods\" or \"Resource\", each mapping to a matching field in the object. Note: \"ContainerResource\" type is available on when the feature-gate HPAContainerMetrics is enabled", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.MetricStatus": { + "description": "MetricStatus describes the last-read state of a single metric.", + "properties": { + "containerResource": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.ContainerResourceMetricStatus", + "description": "container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source." + }, + "external": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.ExternalMetricStatus", + "description": "external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster)." + }, + "object": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.ObjectMetricStatus", + "description": "object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object)." + }, + "pods": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.PodsMetricStatus", + "description": "pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value." + }, + "resource": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.ResourceMetricStatus", + "description": "resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source." + }, + "type": { + "description": "type is the type of metric source. It will be one of \"ContainerResource\", \"External\", \"Object\", \"Pods\" or \"Resource\", each corresponds to a matching field in the object. Note: \"ContainerResource\" type is available on when the feature-gate HPAContainerMetrics is enabled", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.MetricTarget": { + "description": "MetricTarget defines the target value, average value, or average utilization of a specific metric", + "properties": { + "averageUtilization": { + "description": "averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source type", + "format": "int32", + "type": "integer" + }, + "averageValue": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity", + "description": "averageValue is the target value of the average of the metric across all relevant pods (as a quantity)" + }, + "type": { + "description": "type represents whether the metric type is Utilization, Value, or AverageValue", + "type": "string" + }, + "value": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity", + "description": "value is the target value of the metric (as a quantity)." + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.MetricValueStatus": { + "description": "MetricValueStatus holds the current value for a metric", + "properties": { + "averageUtilization": { + "description": "currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.", + "format": "int32", + "type": "integer" + }, + "averageValue": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity", + "description": "averageValue is the current value of the average of the metric across all relevant pods (as a quantity)" + }, + "value": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity", + "description": "value is the current value of the metric (as a quantity)." + } + }, + "type": "object" + }, + "io.k8s.api.autoscaling.v2.ObjectMetricSource": { + "description": "ObjectMetricSource indicates how to scale on a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).", + "properties": { + "describedObject": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.CrossVersionObjectReference", + "description": "describedObject specifies the descriptions of a object,such as kind,name apiVersion" + }, + "metric": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricIdentifier", + "description": "metric identifies the target metric by name and selector" + }, + "target": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricTarget", + "description": "target specifies the target value for the given metric" + } + }, + "required": [ + "describedObject", + "target", + "metric" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.ObjectMetricStatus": { + "description": "ObjectMetricStatus indicates the current value of a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).", + "properties": { + "current": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricValueStatus", + "description": "current contains the current value for the given metric" + }, + "describedObject": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.CrossVersionObjectReference", + "description": "DescribedObject specifies the descriptions of a object,such as kind,name apiVersion" + }, + "metric": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricIdentifier", + "description": "metric identifies the target metric by name and selector" + } + }, + "required": [ + "metric", + "current", + "describedObject" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.PodsMetricSource": { + "description": "PodsMetricSource indicates how to scale on a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.", + "properties": { + "metric": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricIdentifier", + "description": "metric identifies the target metric by name and selector" + }, + "target": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricTarget", + "description": "target specifies the target value for the given metric" + } + }, + "required": [ + "metric", + "target" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.PodsMetricStatus": { + "description": "PodsMetricStatus indicates the current value of a metric describing each pod in the current scale target (for example, transactions-processed-per-second).", + "properties": { + "current": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricValueStatus", + "description": "current contains the current value for the given metric" + }, + "metric": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricIdentifier", + "description": "metric identifies the target metric by name and selector" + } + }, + "required": [ + "metric", + "current" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.ResourceMetricSource": { + "description": "ResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source. Only one \"target\" type should be set.", + "properties": { + "name": { + "description": "name is the name of the resource in question.", + "type": "string" + }, + "target": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricTarget", + "description": "target specifies the target value for the given metric" + } + }, + "required": [ + "name", + "target" + ], + "type": "object" + }, + "io.k8s.api.autoscaling.v2.ResourceMetricStatus": { + "description": "ResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source.", + "properties": { + "current": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.MetricValueStatus", + "description": "current contains the current value for the given metric" + }, + "name": { + "description": "Name is the name of the resource in question.", + "type": "string" + } + }, + "required": [ + "name", + "current" + ], + "type": "object" + }, "io.k8s.api.autoscaling.v2beta1.ContainerResourceMetricSource": { "description": "ContainerResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the \"pods\" source. Only one \"target\" type should be set.", "properties": { @@ -2533,8 +3163,7 @@ }, "required": [ "currentReplicas", - "desiredReplicas", - "conditions" + "desiredReplicas" ], "type": "object" }, @@ -3092,8 +3721,7 @@ }, "required": [ "currentReplicas", - "desiredReplicas", - "conditions" + "desiredReplicas" ], "type": "object" }, @@ -3413,7 +4041,12 @@ "description": "CronJobSpec describes how the job execution will look like and when it will actually run.", "properties": { "concurrencyPolicy": { - "description": "Specifies how to treat concurrent executions of a Job. Valid values are: - \"Allow\" (default): allows CronJobs to run concurrently; - \"Forbid\": forbids concurrent runs, skipping next run if previous run hasn't finished yet; - \"Replace\": cancels currently running job and replaces it with a new one", + "description": "Specifies how to treat concurrent executions of a Job. Valid values are: - \"Allow\" (default): allows CronJobs to run concurrently; - \"Forbid\": forbids concurrent runs, skipping next run if previous run hasn't finished yet; - \"Replace\": cancels currently running job and replaces it with a new one\n\nPossible enum values:\n - `\"Allow\"` allows CronJobs to run concurrently.\n - `\"Forbid\"` forbids concurrent runs, skipping next run if previous hasn't finished yet.\n - `\"Replace\"` cancels currently running job and replaces it with a new one.", + "enum": [ + "Allow", + "Forbid", + "Replace" + ], "type": "string" }, "failedJobsHistoryLimit": { @@ -3529,7 +4162,12 @@ "type": "string" }, "type": { - "description": "Type of job condition, Complete or Failed.", + "description": "Type of job condition, Complete or Failed.\n\nPossible enum values:\n - `\"Complete\"` means the job has completed its execution.\n - `\"Failed\"` means the job has failed its execution.\n - `\"Suspended\"` means the job has been suspended.", + "enum": [ + "Complete", + "Failed", + "Suspended" + ], "type": "string" } }, @@ -3618,7 +4256,7 @@ "description": "Describes the pod that will be created when executing a job. More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/" }, "ttlSecondsAfterFinished": { - "description": "ttlSecondsAfterFinished limits the lifetime of a Job that has finished execution (either Complete or Failed). If this field is set, ttlSecondsAfterFinished after the Job finishes, it is eligible to be automatically deleted. When the Job is being deleted, its lifecycle guarantees (e.g. finalizers) will be honored. If this field is unset, the Job won't be automatically deleted. If this field is set to zero, the Job becomes eligible to be deleted immediately after it finishes. This field is alpha-level and is only honored by servers that enable the TTLAfterFinished feature.", + "description": "ttlSecondsAfterFinished limits the lifetime of a Job that has finished execution (either Complete or Failed). If this field is set, ttlSecondsAfterFinished after the Job finishes, it is eligible to be automatically deleted. When the Job is being deleted, its lifecycle guarantees (e.g. finalizers) will be honored. If this field is unset, the Job won't be automatically deleted. If this field is set to zero, the Job becomes eligible to be deleted immediately after it finishes.", "format": "int32", "type": "integer" } @@ -3632,7 +4270,7 @@ "description": "JobStatus represents the current state of a Job.", "properties": { "active": { - "description": "The number of actively running pods.", + "description": "The number of pending and running pods.", "format": "int32", "type": "integer" }, @@ -3659,6 +4297,11 @@ "format": "int32", "type": "integer" }, + "ready": { + "description": "The number of pods which have a Ready condition.\n\nThis field is alpha-level. The job controller populates the field when the feature gate JobReadyPods is enabled (disabled by default).", + "format": "int32", + "type": "integer" + }, "startTime": { "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", "description": "Represents time when the job controller started processing a job. When a Job is created in the suspended state, this field is not set until the first time it is resumed. This field is reset every time a Job is resumed from suspension. It is represented in RFC3339 form and is in UTC." @@ -3670,7 +4313,7 @@ }, "uncountedTerminatedPods": { "$ref": "#/definitions/io.k8s.api.batch.v1.UncountedTerminatedPods", - "description": "UncountedTerminatedPods holds the UIDs of Pods that have terminated but the job controller hasn't yet accounted for in the status counters.\n\nThe job controller creates pods with a finalizer. When a pod terminates (succeeded or failed), the controller does three steps to account for it in the job status: (1) Add the pod UID to the arrays in this field. (2) Remove the pod finalizer. (3) Remove the pod UID from the arrays while increasing the corresponding\n counter.\n\nThis field is alpha-level. The job controller only makes use of this field when the feature gate PodTrackingWithFinalizers is enabled. Old jobs might not be tracked using this field, in which case the field remains null." + "description": "UncountedTerminatedPods holds the UIDs of Pods that have terminated but the job controller hasn't yet accounted for in the status counters.\n\nThe job controller creates pods with a finalizer. When a pod terminates (succeeded or failed), the controller does three steps to account for it in the job status: (1) Add the pod UID to the arrays in this field. (2) Remove the pod finalizer. (3) Remove the pod UID from the arrays while increasing the corresponding\n counter.\n\nThis field is beta-level. The job controller only makes use of this field when the feature gate JobTrackingWithFinalizers is enabled (enabled by default). Old jobs might not be tracked using this field, in which case the field remains null." } }, "type": "object" @@ -3915,7 +4558,12 @@ "type": "string" }, "type": { - "description": "type of the condition. Known conditions are \"Approved\", \"Denied\", and \"Failed\".\n\nAn \"Approved\" condition is added via the /approval subresource, indicating the request was approved and should be issued by the signer.\n\nA \"Denied\" condition is added via the /approval subresource, indicating the request was denied and should not be issued by the signer.\n\nA \"Failed\" condition is added via the /status subresource, indicating the signer failed to issue the certificate.\n\nApproved and Denied conditions are mutually exclusive. Approved, Denied, and Failed conditions cannot be removed once added.\n\nOnly one condition of a given type is allowed.", + "description": "type of the condition. Known conditions are \"Approved\", \"Denied\", and \"Failed\".\n\nAn \"Approved\" condition is added via the /approval subresource, indicating the request was approved and should be issued by the signer.\n\nA \"Denied\" condition is added via the /approval subresource, indicating the request was denied and should not be issued by the signer.\n\nA \"Failed\" condition is added via the /status subresource, indicating the signer failed to issue the certificate.\n\nApproved and Denied conditions are mutually exclusive. Approved, Denied, and Failed conditions cannot be removed once added.\n\nOnly one condition of a given type is allowed.\n\nPossible enum values:\n - `\"Approved\"` Approved indicates the request was approved and should be issued by the signer.\n - `\"Denied\"` Denied indicates the request was denied and should not be issued by the signer.\n - `\"Failed\"` Failed indicates the signer failed to issue the certificate.", + "enum": [ + "Approved", + "Denied", + "Failed" + ], "type": "string" } }, @@ -4869,7 +5517,12 @@ "type": "string" }, "imagePullPolicy": { - "description": "Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + "description": "Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images\n\nPossible enum values:\n - `\"Always\"` means that kubelet always attempts to pull the latest image. Container will fail If the pull fails.\n - `\"IfNotPresent\"` means that kubelet pulls if the image isn't present on disk. Container will fail if the image isn't present and the pull fails.\n - `\"Never\"` means that kubelet never pulls an image, but only uses a local image. Container will fail if the image isn't present", + "enum": [ + "Always", + "IfNotPresent", + "Never" + ], "type": "string" }, "lifecycle": { @@ -4927,7 +5580,11 @@ "type": "string" }, "terminationMessagePolicy": { - "description": "Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.", + "description": "Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.\n\nPossible enum values:\n - `\"FallbackToLogsOnError\"` will read the most recent contents of the container logs for the container status message when the container exits with an error and the terminationMessagePath has no contents.\n - `\"File\"` is the default behavior and will set the container status message to the contents of the container's terminationMessagePath when the container exits.", + "enum": [ + "FallbackToLogsOnError", + "File" + ], "type": "string" }, "tty": { @@ -5002,7 +5659,12 @@ "type": "string" }, "protocol": { - "description": "Protocol for port. Must be UDP, TCP, or SCTP. Defaults to \"TCP\".", + "description": "Protocol for port. Must be UDP, TCP, or SCTP. Defaults to \"TCP\".\n\nPossible enum values:\n - `\"SCTP\"` is the SCTP protocol.\n - `\"TCP\"` is the TCP protocol.\n - `\"UDP\"` is the UDP protocol.", + "enum": [ + "SCTP", + "TCP", + "UDP" + ], "type": "string" } }, @@ -5100,7 +5762,7 @@ "type": "string" }, "image": { - "description": "The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images", + "description": "The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images.", "type": "string" }, "imageID": { @@ -5120,7 +5782,7 @@ "type": "boolean" }, "restartCount": { - "description": "The number of times the container has been restarted, currently based on the number of dead containers that have not yet been removed. Note that this is calculated from dead containers. But those containers are subject to garbage collection. This value will get capped at 5 by GC.", + "description": "The number of times the container has been restarted.", "format": "int32", "type": "integer" }, @@ -5270,7 +5932,12 @@ "type": "integer" }, "protocol": { - "description": "The IP protocol for this port. Must be UDP, TCP, or SCTP. Default is TCP.", + "description": "The IP protocol for this port. Must be UDP, TCP, or SCTP. Default is TCP.\n\nPossible enum values:\n - `\"SCTP\"` is the SCTP protocol.\n - `\"TCP\"` is the TCP protocol.\n - `\"UDP\"` is the UDP protocol.", + "enum": [ + "SCTP", + "TCP", + "UDP" + ], "type": "string" } }, @@ -5436,7 +6103,7 @@ "type": "object" }, "io.k8s.api.core.v1.EphemeralContainer": { - "description": "An EphemeralContainer is a container that may be added temporarily to an existing pod for user-initiated activities such as debugging. Ephemeral containers have no resource or scheduling guarantees, and they will not be restarted when they exit or when a pod is removed or restarted. If an ephemeral container causes a pod to exceed its resource allocation, the pod may be evicted. Ephemeral containers may not be added by directly updating the pod spec. They must be added via the pod's ephemeralcontainers subresource, and they will appear in the pod spec once added. This is an alpha feature enabled by the EphemeralContainers feature flag.", + "description": "An EphemeralContainer is a temporary container that you may add to an existing Pod for user-initiated activities such as debugging. Ephemeral containers have no resource or scheduling guarantees, and they will not be restarted when they exit or when a Pod is removed or restarted. The kubelet may evict a Pod if an ephemeral container causes the Pod to exceed its resource allocation.\n\nTo add an ephemeral container, use the ephemeralcontainers subresource of an existing Pod. Ephemeral containers may not be removed or restarted.\n\nThis is a beta feature available on clusters that haven't disabled the EphemeralContainers feature gate.", "properties": { "args": { "description": "Arguments to the entrypoint. The docker image's CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container's environment. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", @@ -5473,7 +6140,12 @@ "type": "string" }, "imagePullPolicy": { - "description": "Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + "description": "Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images\n\nPossible enum values:\n - `\"Always\"` means that kubelet always attempts to pull the latest image. Container will fail If the pull fails.\n - `\"IfNotPresent\"` means that kubelet pulls if the image isn't present on disk. Container will fail if the image isn't present and the pull fails.\n - `\"Never\"` means that kubelet never pulls an image, but only uses a local image. Container will fail if the image isn't present", + "enum": [ + "Always", + "IfNotPresent", + "Never" + ], "type": "string" }, "lifecycle": { @@ -5493,7 +6165,14 @@ "items": { "$ref": "#/definitions/io.k8s.api.core.v1.ContainerPort" }, - "type": "array" + "type": "array", + "x-kubernetes-list-map-keys": [ + "containerPort", + "protocol" + ], + "x-kubernetes-list-type": "map", + "x-kubernetes-patch-merge-key": "containerPort", + "x-kubernetes-patch-strategy": "merge" }, "readinessProbe": { "$ref": "#/definitions/io.k8s.api.core.v1.Probe", @@ -5520,7 +6199,7 @@ "type": "boolean" }, "targetContainerName": { - "description": "If set, the name of the container from PodSpec that this ephemeral container targets. The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container. If not set then the ephemeral container is run in whatever namespaces are shared for the pod. Note that the container runtime must support this feature.", + "description": "If set, the name of the container from PodSpec that this ephemeral container targets. The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container. If not set then the ephemeral container uses the namespaces configured in the Pod spec.\n\nThe container runtime must implement support for this feature. If the runtime does not support namespace targeting then the result of setting this field is undefined.", "type": "string" }, "terminationMessagePath": { @@ -5528,7 +6207,11 @@ "type": "string" }, "terminationMessagePolicy": { - "description": "Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.", + "description": "Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated.\n\nPossible enum values:\n - `\"FallbackToLogsOnError\"` will read the most recent contents of the container logs for the container status message when the container exits with an error and the terminationMessagePath has no contents.\n - `\"File\"` is the default behavior and will set the container status message to the contents of the container's terminationMessagePath when the container exits.", + "enum": [ + "FallbackToLogsOnError", + "File" + ], "type": "string" }, "tty": { @@ -5545,7 +6228,7 @@ "x-kubernetes-patch-strategy": "merge" }, "volumeMounts": { - "description": "Pod volumes to mount into the container's filesystem. Cannot be updated.", + "description": "Pod volumes to mount into the container's filesystem. Subpath mounts are not allowed for ephemeral containers. Cannot be updated.", "items": { "$ref": "#/definitions/io.k8s.api.core.v1.VolumeMount" }, @@ -5873,6 +6556,23 @@ ], "type": "object" }, + "io.k8s.api.core.v1.GRPCAction": { + "properties": { + "port": { + "description": "Port number of the gRPC service. Number must be in the range 1 to 65535.", + "format": "int32", + "type": "integer" + }, + "service": { + "description": "Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + "type": "string" + } + }, + "required": [ + "port" + ], + "type": "object" + }, "io.k8s.api.core.v1.GitRepoVolumeSource": { "description": "Represents a volume that is populated with the contents of a git repository. Git repo volumes do not support ownership management. Git repo volumes support SELinux relabeling.\n\nDEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir into the Pod's container.", "properties": { @@ -5965,7 +6665,11 @@ "description": "Name or number of the port to access on the container. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME." }, "scheme": { - "description": "Scheme to use for connecting to the host. Defaults to HTTP.", + "description": "Scheme to use for connecting to the host. Defaults to HTTP.\n\nPossible enum values:\n - `\"HTTP\"` means that the scheme used will be http://\n - `\"HTTPS\"` means that the scheme used will be https://", + "enum": [ + "HTTP", + "HTTPS" + ], "type": "string" } }, @@ -5992,24 +6696,6 @@ ], "type": "object" }, - "io.k8s.api.core.v1.Handler": { - "description": "Handler defines a specific action that should be taken", - "properties": { - "exec": { - "$ref": "#/definitions/io.k8s.api.core.v1.ExecAction", - "description": "One and only one of the following should be specified. Exec specifies the action to take." - }, - "httpGet": { - "$ref": "#/definitions/io.k8s.api.core.v1.HTTPGetAction", - "description": "HTTPGet specifies the http request to perform." - }, - "tcpSocket": { - "$ref": "#/definitions/io.k8s.api.core.v1.TCPSocketAction", - "description": "TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported" - } - }, - "type": "object" - }, "io.k8s.api.core.v1.HostAlias": { "description": "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the pod's hosts file.", "properties": { @@ -6189,12 +6875,30 @@ "description": "Lifecycle describes actions that the management system should take in response to container lifecycle events. For the PostStart and PreStop lifecycle handlers, management of the container blocks until the action is complete, unless the container process fails, in which case the handler is aborted.", "properties": { "postStart": { - "$ref": "#/definitions/io.k8s.api.core.v1.Handler", + "$ref": "#/definitions/io.k8s.api.core.v1.LifecycleHandler", "description": "PostStart is called immediately after a container is created. If the handler fails, the container is terminated and restarted according to its restart policy. Other management of the container blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks" }, "preStop": { - "$ref": "#/definitions/io.k8s.api.core.v1.Handler", - "description": "PreStop is called immediately before a container is terminated due to an API request or management event such as liveness/startup probe failure, preemption, resource contention, etc. The handler is not called if the container crashes or exits. The reason for termination is passed to the handler. The Pod's termination grace period countdown begins before the PreStop hooked is executed. Regardless of the outcome of the handler, the container will eventually terminate within the Pod's termination grace period. Other management of the container blocks until the hook completes or until the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks" + "$ref": "#/definitions/io.k8s.api.core.v1.LifecycleHandler", + "description": "PreStop is called immediately before a container is terminated due to an API request or management event such as liveness/startup probe failure, preemption, resource contention, etc. The handler is not called if the container crashes or exits. The Pod's termination grace period countdown begins before the PreStop hook is executed. Regardless of the outcome of the handler, the container will eventually terminate within the Pod's termination grace period (unless delayed by finalizers). Other management of the container blocks until the hook completes or until the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks" + } + }, + "type": "object" + }, + "io.k8s.api.core.v1.LifecycleHandler": { + "description": "LifecycleHandler defines a specific action that should be taken in a lifecycle hook. One and only one of the fields, except TCPSocket must be specified.", + "properties": { + "exec": { + "$ref": "#/definitions/io.k8s.api.core.v1.ExecAction", + "description": "Exec specifies the action to take." + }, + "httpGet": { + "$ref": "#/definitions/io.k8s.api.core.v1.HTTPGetAction", + "description": "HTTPGet specifies the http request to perform." + }, + "tcpSocket": { + "$ref": "#/definitions/io.k8s.api.core.v1.TCPSocketAction", + "description": "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept for the backward compatibility. There are no validation of this field and lifecycle hooks will fail in runtime when tcp handler is specified." } }, "type": "object" @@ -6267,7 +6971,12 @@ "type": "object" }, "type": { - "description": "Type of resource that this limit applies to.", + "description": "Type of resource that this limit applies to.\n\nPossible enum values:\n - `\"Container\"` Limit that applies to all containers in a namespace\n - `\"PersistentVolumeClaim\"` Limit that applies to all persistent volume claims in a namespace\n - `\"Pod\"` Limit that applies to all pods in a namespace", + "enum": [ + "Container", + "PersistentVolumeClaim", + "Pod" + ], "type": "string" } }, @@ -6377,7 +7086,7 @@ "description": "Local represents directly-attached storage with node affinity (Beta feature)", "properties": { "fsType": { - "description": "Filesystem type to mount. It applies only when the Path is a block device. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". The default value is to auto-select a fileystem if unspecified.", + "description": "Filesystem type to mount. It applies only when the Path is a block device. Must be a filesystem type supported by the host operating system. Ex. \"ext4\", \"xfs\", \"ntfs\". The default value is to auto-select a filesystem if unspecified.", "type": "string" }, "path": { @@ -6462,7 +7171,14 @@ "type": "string" }, "type": { - "description": "Type of namespace controller condition.", + "description": "Type of namespace controller condition.\n\nPossible enum values:\n - `\"NamespaceContentRemaining\"` contains information about resources remaining in a namespace.\n - `\"NamespaceDeletionContentFailure\"` contains information about namespace deleter errors during deletion of resources.\n - `\"NamespaceDeletionDiscoveryFailure\"` contains information about namespace deleter errors during resource discovery.\n - `\"NamespaceDeletionGroupVersionParsingFailure\"` contains information about namespace deleter errors parsing GV for legacy types.\n - `\"NamespaceFinalizersRemaining\"` contains information about which finalizers are on resources remaining in a namespace.", + "enum": [ + "NamespaceContentRemaining", + "NamespaceDeletionContentFailure", + "NamespaceDeletionDiscoveryFailure", + "NamespaceDeletionGroupVersionParsingFailure", + "NamespaceFinalizersRemaining" + ], "type": "string" } }, @@ -6533,7 +7249,11 @@ "x-kubernetes-patch-strategy": "merge" }, "phase": { - "description": "Phase is the current lifecycle phase of the namespace. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/", + "description": "Phase is the current lifecycle phase of the namespace. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/\n\nPossible enum values:\n - `\"Active\"` means the namespace is available for use in the system\n - `\"Terminating\"` means the namespace is undergoing graceful termination", + "enum": [ + "Active", + "Terminating" + ], "type": "string" } }, @@ -6580,7 +7300,14 @@ "type": "string" }, "type": { - "description": "Node address type, one of Hostname, ExternalIP or InternalIP.", + "description": "Node address type, one of Hostname, ExternalIP or InternalIP.\n\nPossible enum values:\n - `\"ExternalDNS\"` identifies a DNS name which resolves to an IP address which has the characteristics of a NodeExternalIP. The IP it resolves to may or may not be a listed NodeExternalIP address.\n - `\"ExternalIP\"` identifies an IP address which is, in some way, intended to be more usable from outside the cluster then an internal IP, though no specific semantics are defined. It may be a globally routable IP, though it is not required to be. External IPs may be assigned directly to an interface on the node, like a NodeInternalIP, or alternatively, packets sent to the external IP may be NAT'ed to an internal node IP rather than being delivered directly (making the IP less efficient for node-to-node traffic than a NodeInternalIP).\n - `\"Hostname\"` identifies a name of the node. Although every node can be assumed to have a NodeAddress of this type, its exact syntax and semantics are not defined, and are not consistent between different clusters.\n - `\"InternalDNS\"` identifies a DNS name which resolves to an IP address which has the characteristics of a NodeInternalIP. The IP it resolves to may or may not be a listed NodeInternalIP address.\n - `\"InternalIP\"` identifies an IP address which is assigned to one of the node's network interfaces. Every node should have at least one address of this type. An internal IP is normally expected to be reachable from every other node, but may not be visible to hosts outside the cluster. By default it is assumed that kube-apiserver can reach node internal IPs, though it is possible to configure clusters where this is not the case. NodeInternalIP is the default type of node IP, and does not necessarily imply that the IP is ONLY reachable internally. If a node has multiple internal IPs, no specific semantics are assigned to the additional IPs.", + "enum": [ + "ExternalDNS", + "ExternalIP", + "Hostname", + "InternalDNS", + "InternalIP" + ], "type": "string" } }, @@ -6631,7 +7358,14 @@ "type": "string" }, "type": { - "description": "Type of node condition.", + "description": "Type of node condition.\n\nPossible enum values:\n - `\"DiskPressure\"` means the kubelet is under pressure due to insufficient available disk.\n - `\"MemoryPressure\"` means the kubelet is under pressure due to insufficient available memory.\n - `\"NetworkUnavailable\"` means that network for the node is not correctly configured.\n - `\"PIDPressure\"` means the kubelet is under pressure due to insufficient available PID.\n - `\"Ready\"` means kubelet is healthy and ready to accept pods.", + "enum": [ + "DiskPressure", + "MemoryPressure", + "NetworkUnavailable", + "PIDPressure", + "Ready" + ], "type": "string" } }, @@ -6743,7 +7477,15 @@ "type": "string" }, "operator": { - "description": "Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + "description": "Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.\n\nPossible enum values:\n - `\"DoesNotExist\"`\n - `\"Exists\"`\n - `\"Gt\"`\n - `\"In\"`\n - `\"Lt\"`\n - `\"NotIn\"`", + "enum": [ + "DoesNotExist", + "Exists", + "Gt", + "In", + "Lt", + "NotIn" + ], "type": "string" }, "values": { @@ -6877,7 +7619,12 @@ "description": "Set of ids/uuids to uniquely identify the node. More info: https://kubernetes.io/docs/concepts/nodes/node/#info" }, "phase": { - "description": "NodePhase is the recently observed lifecycle phase of the node. More info: https://kubernetes.io/docs/concepts/nodes/node/#phase The field is never populated, and now is deprecated.", + "description": "NodePhase is the recently observed lifecycle phase of the node. More info: https://kubernetes.io/docs/concepts/nodes/node/#phase The field is never populated, and now is deprecated.\n\nPossible enum values:\n - `\"Pending\"` means the node has been created/added by the system, but not configured.\n - `\"Running\"` means the node has been configured and has Kubernetes components running.\n - `\"Terminated\"` means the node has been removed from the cluster.", + "enum": [ + "Pending", + "Running", + "Terminated" + ], "type": "string" }, "volumesAttached": { @@ -7097,6 +7844,11 @@ "type": "string" }, "type": { + "description": "\n\n\nPossible enum values:\n - `\"FileSystemResizePending\"` - controller resize is finished and a file system resize is pending on node\n - `\"Resizing\"` - a user trigger resize of pvc has been started", + "enum": [ + "FileSystemResizePending", + "Resizing" + ], "type": "string" } }, @@ -7161,7 +7913,7 @@ }, "resources": { "$ref": "#/definitions/io.k8s.api.core.v1.ResourceRequirements", - "description": "Resources represents the minimum resources the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources" + "description": "Resources represents the minimum resources the volume should have. If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources" }, "selector": { "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector", @@ -7192,6 +7944,13 @@ }, "type": "array" }, + "allocatedResources": { + "additionalProperties": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity" + }, + "description": "The storage resource within AllocatedResources tracks the capacity allocated to a PVC. It may be larger than the actual capacity when a volume expansion operation is requested. For storage quota, the larger value from allocatedResources and PVC.spec.resources is used. If allocatedResources is not set, PVC.spec.resources alone is used for quota calculation. If a volume expansion capacity request is lowered, allocatedResources is only lowered if there are no expansion operations in progress and if the actual volume capacity is equal or lower than the requested capacity. This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature.", + "type": "object" + }, "capacity": { "additionalProperties": { "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity" @@ -7209,7 +7968,16 @@ "x-kubernetes-patch-strategy": "merge" }, "phase": { - "description": "Phase represents the current phase of PersistentVolumeClaim.", + "description": "Phase represents the current phase of PersistentVolumeClaim.\n\nPossible enum values:\n - `\"Bound\"` used for PersistentVolumeClaims that are bound\n - `\"Lost\"` used for PersistentVolumeClaims that lost their underlying PersistentVolume. The claim was bound to a PersistentVolume and this volume does not exist any longer and all data on it was lost.\n - `\"Pending\"` used for PersistentVolumeClaims that are not yet bound", + "enum": [ + "Bound", + "Lost", + "Pending" + ], + "type": "string" + }, + "resizeStatus": { + "description": "ResizeStatus stores status of resize operation. ResizeStatus is not set by default but when expansion is complete resizeStatus is set to empty string by resize controller or kubelet. This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature.", "type": "string" } }, @@ -7377,7 +8145,12 @@ "description": "NodeAffinity defines constraints that limit what nodes this volume can be accessed from. This field influences the scheduling of pods that use this volume." }, "persistentVolumeReclaimPolicy": { - "description": "What happens to a persistent volume when released from its claim. Valid options are Retain (default for manually created PersistentVolumes), Delete (default for dynamically provisioned PersistentVolumes), and Recycle (deprecated). Recycle must be supported by the volume plugin underlying this PersistentVolume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#reclaiming", + "description": "What happens to a persistent volume when released from its claim. Valid options are Retain (default for manually created PersistentVolumes), Delete (default for dynamically provisioned PersistentVolumes), and Recycle (deprecated). Recycle must be supported by the volume plugin underlying this PersistentVolume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#reclaiming\n\nPossible enum values:\n - `\"Delete\"` means the volume will be deleted from Kubernetes on release from its claim. The volume plugin must support Deletion.\n - `\"Recycle\"` means the volume will be recycled back into the pool of unbound persistent volumes on release from its claim. The volume plugin must support Recycling.\n - `\"Retain\"` means the volume will be left in its current phase (Released) for manual reclamation by the administrator. The default policy is Retain.", + "enum": [ + "Delete", + "Recycle", + "Retain" + ], "type": "string" }, "photonPersistentDisk": { @@ -7427,7 +8200,14 @@ "type": "string" }, "phase": { - "description": "Phase indicates if a volume is available, bound to a claim, or released by a claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#phase", + "description": "Phase indicates if a volume is available, bound to a claim, or released by a claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#phase\n\nPossible enum values:\n - `\"Available\"` used for PersistentVolumes that are not yet bound Available volumes are held by the binder and matched to PersistentVolumeClaims\n - `\"Bound\"` used for PersistentVolumes that are bound\n - `\"Failed\"` used for PersistentVolumes that failed to be correctly recycled or deleted after being released from a claim\n - `\"Pending\"` used for PersistentVolumes that are not available\n - `\"Released\"` used for PersistentVolumes where the bound PersistentVolumeClaim was deleted released volumes must be recycled before becoming available again this phase is used by the persistent volume claim binder to signal to another process to reclaim the resource", + "enum": [ + "Available", + "Bound", + "Failed", + "Pending", + "Released" + ], "type": "string" }, "reason": { @@ -7579,7 +8359,13 @@ "type": "string" }, "type": { - "description": "Type is the type of the condition. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions", + "description": "Type is the type of the condition. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions\n\nPossible enum values:\n - `\"ContainersReady\"` indicates whether all containers in the pod are ready.\n - `\"Initialized\"` means that all init containers in the pod have started successfully.\n - `\"PodScheduled\"` represents status of the scheduling process for this pod.\n - `\"Ready\"` means the pod is able to service requests and should be added to the load balancing pools of all matching services.", + "enum": [ + "ContainersReady", + "Initialized", + "PodScheduled", + "Ready" + ], "type": "string" } }, @@ -7674,11 +8460,30 @@ } ] }, + "io.k8s.api.core.v1.PodOS": { + "description": "PodOS defines the OS parameters of a pod.", + "properties": { + "name": { + "description": "Name is the name of the operating system. The currently supported values are linux and windows. Additional value may be defined in future and can be one of: https://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration Clients should expect to handle additional values and treat unrecognized values in this field as os: null", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object" + }, "io.k8s.api.core.v1.PodReadinessGate": { "description": "PodReadinessGate contains the reference to a pod condition", "properties": { "conditionType": { - "description": "ConditionType refers to a condition in the pod's condition list with matching type.", + "description": "ConditionType refers to a condition in the pod's condition list with matching type.\n\nPossible enum values:\n - `\"ContainersReady\"` indicates whether all containers in the pod are ready.\n - `\"Initialized\"` means that all init containers in the pod have started successfully.\n - `\"PodScheduled\"` represents status of the scheduling process for this pod.\n - `\"Ready\"` means the pod is able to service requests and should be added to the load balancing pools of all matching services.", + "enum": [ + "ContainersReady", + "Initialized", + "PodScheduled", + "Ready" + ], "type": "string" } }, @@ -7691,16 +8496,16 @@ "description": "PodSecurityContext holds pod-level security attributes and common container settings. Some fields are also present in container.securityContext. Field values of container.securityContext take precedence over field values of PodSecurityContext.", "properties": { "fsGroup": { - "description": "A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:\n\n1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.", + "description": "A special supplemental group that applies to all containers in a pod. Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod:\n\n1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows.", "format": "int64", "type": "integer" }, "fsGroupChangePolicy": { - "description": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.", + "description": "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used. Note that this field cannot be set when spec.os.name is windows.", "type": "string" }, "runAsGroup": { - "description": "The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.", + "description": "The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.", "format": "int64", "type": "integer" }, @@ -7709,20 +8514,20 @@ "type": "boolean" }, "runAsUser": { - "description": "The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container.", + "description": "The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows.", "format": "int64", "type": "integer" }, "seLinuxOptions": { "$ref": "#/definitions/io.k8s.api.core.v1.SELinuxOptions", - "description": "The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container." + "description": "The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows." }, "seccompProfile": { "$ref": "#/definitions/io.k8s.api.core.v1.SeccompProfile", - "description": "The seccomp options to use by the containers in this pod." + "description": "The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows." }, "supplementalGroups": { - "description": "A list of groups applied to the first process run in each container, in addition to the container's primary GID. If unspecified, no groups will be added to any container.", + "description": "A list of groups applied to the first process run in each container, in addition to the container's primary GID. If unspecified, no groups will be added to any container. Note that this field cannot be set when spec.os.name is windows.", "items": { "format": "int64", "type": "integer" @@ -7730,7 +8535,7 @@ "type": "array" }, "sysctls": { - "description": "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch.", + "description": "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows.", "items": { "$ref": "#/definitions/io.k8s.api.core.v1.Sysctl" }, @@ -7738,7 +8543,7 @@ }, "windowsOptions": { "$ref": "#/definitions/io.k8s.api.core.v1.WindowsSecurityContextOptions", - "description": "The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence." + "description": "The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux." } }, "type": "object" @@ -7773,7 +8578,13 @@ "description": "Specifies the DNS parameters of a pod. Parameters specified here will be merged to the generated DNS configuration based on DNSPolicy." }, "dnsPolicy": { - "description": "Set DNS policy for the pod. Defaults to \"ClusterFirst\". Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. To have DNS options set along with hostNetwork, you have to specify DNS policy explicitly to 'ClusterFirstWithHostNet'.", + "description": "Set DNS policy for the pod. Defaults to \"ClusterFirst\". Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. To have DNS options set along with hostNetwork, you have to specify DNS policy explicitly to 'ClusterFirstWithHostNet'.\n\nPossible enum values:\n - `\"ClusterFirst\"` indicates that the pod should use cluster DNS first unless hostNetwork is true, if it is available, then fall back on the default (as determined by kubelet) DNS settings.\n - `\"ClusterFirstWithHostNet\"` indicates that the pod should use cluster DNS first, if it is available, then fall back on the default (as determined by kubelet) DNS settings.\n - `\"Default\"` indicates that the pod should use the default (as determined by kubelet) DNS settings.\n - `\"None\"` indicates that the pod should use empty DNS settings. DNS parameters such as nameservers and search paths should be defined via DNSConfig.", + "enum": [ + "ClusterFirst", + "ClusterFirstWithHostNet", + "Default", + "None" + ], "type": "string" }, "enableServiceLinks": { @@ -7781,7 +8592,7 @@ "type": "boolean" }, "ephemeralContainers": { - "description": "List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing pod to perform user-initiated actions such as debugging. This list cannot be specified when creating a pod, and it cannot be modified by updating the pod spec. In order to add an ephemeral container to an existing pod, use the pod's ephemeralcontainers subresource. This field is alpha-level and is only honored by servers that enable the EphemeralContainers feature.", + "description": "List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing pod to perform user-initiated actions such as debugging. This list cannot be specified when creating a pod, and it cannot be modified by updating the pod spec. In order to add an ephemeral container to an existing pod, use the pod's ephemeralcontainers subresource. This field is beta-level and available on clusters that haven't disabled the EphemeralContainers feature gate.", "items": { "$ref": "#/definitions/io.k8s.api.core.v1.EphemeralContainer" }, @@ -7844,6 +8655,10 @@ "type": "object", "x-kubernetes-map-type": "atomic" }, + "os": { + "$ref": "#/definitions/io.k8s.api.core.v1.PodOS", + "description": "Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set.\n\nIf the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions\n\nIf the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup This is an alpha field and requires the IdentifyPodOS feature" + }, "overhead": { "additionalProperties": { "$ref": "#/definitions/io.k8s.apimachinery.pkg.api.resource.Quantity" @@ -7872,7 +8687,12 @@ "type": "array" }, "restartPolicy": { - "description": "Restart policy for all containers within the pod. One of Always, OnFailure, Never. Default to Always. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy", + "description": "Restart policy for all containers within the pod. One of Always, OnFailure, Never. Default to Always. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy\n\nPossible enum values:\n - `\"Always\"`\n - `\"Never\"`\n - `\"OnFailure\"`", + "enum": [ + "Always", + "Never", + "OnFailure" + ], "type": "string" }, "runtimeClassName": { @@ -7968,7 +8788,7 @@ "type": "array" }, "ephemeralContainerStatuses": { - "description": "Status for any ephemeral containers that have run in this pod. This field is alpha-level and is only populated by servers that enable the EphemeralContainers feature.", + "description": "Status for any ephemeral containers that have run in this pod. This field is beta-level and available on clusters that haven't disabled the EphemeralContainers feature gate.", "items": { "$ref": "#/definitions/io.k8s.api.core.v1.ContainerStatus" }, @@ -7994,7 +8814,14 @@ "type": "string" }, "phase": { - "description": "The phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle. The conditions array, the reason and message fields, and the individual container status arrays contain more detail about the pod's status. There are five possible phase values:\n\nPending: The pod has been accepted by the Kubernetes system, but one or more of the container images has not been created. This includes time before being scheduled as well as time spent downloading images over the network, which could take a while. Running: The pod has been bound to a node, and all of the containers have been created. At least one container is still running, or is in the process of starting or restarting. Succeeded: All containers in the pod have terminated in success, and will not be restarted. Failed: All containers in the pod have terminated, and at least one container has terminated in failure. The container either exited with non-zero status or was terminated by the system. Unknown: For some reason the state of the pod could not be obtained, typically due to an error in communicating with the host of the pod.\n\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-phase", + "description": "The phase of a Pod is a simple, high-level summary of where the Pod is in its lifecycle. The conditions array, the reason and message fields, and the individual container status arrays contain more detail about the pod's status. There are five possible phase values:\n\nPending: The pod has been accepted by the Kubernetes system, but one or more of the container images has not been created. This includes time before being scheduled as well as time spent downloading images over the network, which could take a while. Running: The pod has been bound to a node, and all of the containers have been created. At least one container is still running, or is in the process of starting or restarting. Succeeded: All containers in the pod have terminated in success, and will not be restarted. Failed: All containers in the pod have terminated, and at least one container has terminated in failure. The container either exited with non-zero status or was terminated by the system. Unknown: For some reason the state of the pod could not be obtained, typically due to an error in communicating with the host of the pod.\n\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-phase\n\nPossible enum values:\n - `\"Failed\"` means that all containers in the pod have terminated, and at least one container has terminated in a failure (exited with a non-zero exit code or was stopped by the system).\n - `\"Pending\"` means the pod has been accepted by the system, but one or more of the containers has not been started. This includes time before being bound to a node, as well as time spent pulling images onto the host.\n - `\"Running\"` means the pod has been bound to a node and all of the containers have been started. At least one container is still running or is in the process of being restarted.\n - `\"Succeeded\"` means that all containers in the pod have voluntarily terminated with a container exit code of 0, and the system is not going to restart any of these containers.\n - `\"Unknown\"` means that for some reason the state of the pod could not be obtained, typically due to an error in communicating with the host of the pod. Deprecated: It isn't being set since 2015 (74da3b14b0c0f658b3bb8d2def5094686d0e9095)", + "enum": [ + "Failed", + "Pending", + "Running", + "Succeeded", + "Unknown" + ], "type": "string" }, "podIP": { @@ -8011,7 +8838,12 @@ "x-kubernetes-patch-strategy": "merge" }, "qosClass": { - "description": "The Quality of Service (QOS) classification assigned to the pod based on resource requirements See PodQOSClass type for available QOS classes More info: https://git.k8s.io/community/contributors/design-proposals/node/resource-qos.md", + "description": "The Quality of Service (QOS) classification assigned to the pod based on resource requirements See PodQOSClass type for available QOS classes More info: https://git.k8s.io/community/contributors/design-proposals/node/resource-qos.md\n\nPossible enum values:\n - `\"BestEffort\"` is the BestEffort qos class.\n - `\"Burstable\"` is the Burstable qos class.\n - `\"Guaranteed\"` is the Guaranteed qos class.", + "enum": [ + "BestEffort", + "Burstable", + "Guaranteed" + ], "type": "string" }, "reason": { @@ -8115,7 +8947,12 @@ "type": "integer" }, "protocol": { - "description": "Protocol is the protocol of the service port of which status is recorded here The supported values are: \"TCP\", \"UDP\", \"SCTP\"", + "description": "Protocol is the protocol of the service port of which status is recorded here The supported values are: \"TCP\", \"UDP\", \"SCTP\"\n\nPossible enum values:\n - `\"SCTP\"` is the SCTP protocol.\n - `\"TCP\"` is the TCP protocol.\n - `\"UDP\"` is the UDP protocol.", + "enum": [ + "SCTP", + "TCP", + "UDP" + ], "type": "string" } }, @@ -8170,13 +9007,17 @@ "properties": { "exec": { "$ref": "#/definitions/io.k8s.api.core.v1.ExecAction", - "description": "One and only one of the following should be specified. Exec specifies the action to take." + "description": "Exec specifies the action to take." }, "failureThreshold": { "description": "Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3. Minimum value is 1.", "format": "int32", "type": "integer" }, + "grpc": { + "$ref": "#/definitions/io.k8s.api.core.v1.GRPCAction", + "description": "GRPC specifies an action involving a GRPC port. This is an alpha field and requires enabling GRPCContainerProbe feature gate." + }, "httpGet": { "$ref": "#/definitions/io.k8s.api.core.v1.HTTPGetAction", "description": "HTTPGet specifies the http request to perform." @@ -8198,7 +9039,7 @@ }, "tcpSocket": { "$ref": "#/definitions/io.k8s.api.core.v1.TCPSocketAction", - "description": "TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported" + "description": "TCPSocket specifies an action involving a TCP port." }, "terminationGracePeriodSeconds": { "description": "Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", @@ -8820,11 +9661,25 @@ "description": "A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.", "properties": { "operator": { - "description": "Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.", + "description": "Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.\n\nPossible enum values:\n - `\"DoesNotExist\"`\n - `\"Exists\"`\n - `\"In\"`\n - `\"NotIn\"`", + "enum": [ + "DoesNotExist", + "Exists", + "In", + "NotIn" + ], "type": "string" }, "scopeName": { - "description": "The name of the scope that the selector applies to.", + "description": "The name of the scope that the selector applies to.\n\nPossible enum values:\n - `\"BestEffort\"` Match all pod objects that have best effort quality of service\n - `\"CrossNamespacePodAffinity\"` Match all pod objects that have cross-namespace pod (anti)affinity mentioned. This is a beta feature enabled by the PodAffinityNamespaceSelector feature flag.\n - `\"NotBestEffort\"` Match all pod objects that do not have best effort quality of service\n - `\"NotTerminating\"` Match all pod objects where spec.activeDeadlineSeconds is nil\n - `\"PriorityClass\"` Match all pod objects that have priority class mentioned\n - `\"Terminating\"` Match all pod objects where spec.activeDeadlineSeconds >=0", + "enum": [ + "BestEffort", + "CrossNamespacePodAffinity", + "NotBestEffort", + "NotTerminating", + "PriorityClass", + "Terminating" + ], "type": "string" }, "values": { @@ -8849,7 +9704,12 @@ "type": "string" }, "type": { - "description": "type indicates which kind of seccomp profile will be applied. Valid options are:\n\nLocalhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.", + "description": "type indicates which kind of seccomp profile will be applied. Valid options are:\n\nLocalhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied.\n\nPossible enum values:\n - `\"Localhost\"` indicates a profile defined in a file on the node should be used. The file's location relative to /seccomp.\n - `\"RuntimeDefault\"` represents the default container runtime seccomp profile.\n - `\"Unconfined\"` indicates no seccomp profile is applied (A.K.A. unconfined).", + "enum": [ + "Localhost", + "RuntimeDefault", + "Unconfined" + ], "type": "string" } }, @@ -8901,7 +9761,7 @@ "type": "object" }, "type": { - "description": "Used to facilitate programmatic handling of secret data.", + "description": "Used to facilitate programmatic handling of secret data. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types", "type": "string" } }, @@ -9051,27 +9911,27 @@ "description": "SecurityContext holds security configuration that will be applied to a container. Some fields are present in both SecurityContext and PodSecurityContext. When both are set, the values in SecurityContext take precedence.", "properties": { "allowPrivilegeEscalation": { - "description": "AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN", + "description": "AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows.", "type": "boolean" }, "capabilities": { "$ref": "#/definitions/io.k8s.api.core.v1.Capabilities", - "description": "The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime." + "description": "The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows." }, "privileged": { - "description": "Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false.", + "description": "Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows.", "type": "boolean" }, "procMount": { - "description": "procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled.", + "description": "procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows.", "type": "string" }, "readOnlyRootFilesystem": { - "description": "Whether this container has a read-only root filesystem. Default is false.", + "description": "Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows.", "type": "boolean" }, "runAsGroup": { - "description": "The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.", + "description": "The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.", "format": "int64", "type": "integer" }, @@ -9080,21 +9940,21 @@ "type": "boolean" }, "runAsUser": { - "description": "The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.", + "description": "The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows.", "format": "int64", "type": "integer" }, "seLinuxOptions": { "$ref": "#/definitions/io.k8s.api.core.v1.SELinuxOptions", - "description": "The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence." + "description": "The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows." }, "seccompProfile": { "$ref": "#/definitions/io.k8s.api.core.v1.SeccompProfile", - "description": "The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options." + "description": "The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows." }, "windowsOptions": { "$ref": "#/definitions/io.k8s.api.core.v1.WindowsSecurityContextOptions", - "description": "The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence." + "description": "The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux." } }, "type": "object" @@ -9291,7 +10151,12 @@ "type": "integer" }, "protocol": { - "description": "The IP protocol for this port. Supports \"TCP\", \"UDP\", and \"SCTP\". Default is TCP.", + "description": "The IP protocol for this port. Supports \"TCP\", \"UDP\", and \"SCTP\". Default is TCP.\n\nPossible enum values:\n - `\"SCTP\"` is the SCTP protocol.\n - `\"TCP\"` is the TCP protocol.\n - `\"UDP\"` is the UDP protocol.", + "enum": [ + "SCTP", + "TCP", + "UDP" + ], "type": "string" }, "targetPort": { @@ -9316,7 +10181,7 @@ "type": "string" }, "clusterIPs": { - "description": "ClusterIPs is a list of IP addresses assigned to this service, and are usually assigned randomly. If an address is specified manually, is in-range (as per system configuration), and is not in use, it will be allocated to the service; otherwise creation of the service will fail. This field may not be changed through updates unless the type field is also being changed to ExternalName (which requires this field to be empty) or the type field is being changed from ExternalName (in which case this field may optionally be specified, as describe above). Valid values are \"None\", empty string (\"\"), or a valid IP address. Setting this to \"None\" makes a \"headless service\" (no virtual IP), which is useful when direct endpoint connections are preferred and proxying is not required. Only applies to types ClusterIP, NodePort, and LoadBalancer. If this field is specified when creating a Service of type ExternalName, creation will fail. This field will be wiped when updating a Service to type ExternalName. If this field is not specified, it will be initialized from the clusterIP field. If this field is specified, clients must ensure that clusterIPs[0] and clusterIP have the same value.\n\nUnless the \"IPv6DualStack\" feature gate is enabled, this field is limited to one value, which must be the same as the clusterIP field. If the feature gate is enabled, this field may hold a maximum of two entries (dual-stack IPs, in either order). These IPs must correspond to the values of the ipFamilies field. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies", + "description": "ClusterIPs is a list of IP addresses assigned to this service, and are usually assigned randomly. If an address is specified manually, is in-range (as per system configuration), and is not in use, it will be allocated to the service; otherwise creation of the service will fail. This field may not be changed through updates unless the type field is also being changed to ExternalName (which requires this field to be empty) or the type field is being changed from ExternalName (in which case this field may optionally be specified, as describe above). Valid values are \"None\", empty string (\"\"), or a valid IP address. Setting this to \"None\" makes a \"headless service\" (no virtual IP), which is useful when direct endpoint connections are preferred and proxying is not required. Only applies to types ClusterIP, NodePort, and LoadBalancer. If this field is specified when creating a Service of type ExternalName, creation will fail. This field will be wiped when updating a Service to type ExternalName. If this field is not specified, it will be initialized from the clusterIP field. If this field is specified, clients must ensure that clusterIPs[0] and clusterIP have the same value.\n\nThis field may hold a maximum of two entries (dual-stack IPs, in either order). These IPs must correspond to the values of the ipFamilies field. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies", "items": { "type": "string" }, @@ -9335,7 +10200,11 @@ "type": "string" }, "externalTrafficPolicy": { - "description": "externalTrafficPolicy denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints. \"Local\" preserves the client source IP and avoids a second hop for LoadBalancer and Nodeport type services, but risks potentially imbalanced traffic spreading. \"Cluster\" obscures the client source IP and may cause a second hop to another node, but should have good overall load-spreading.", + "description": "externalTrafficPolicy denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints. \"Local\" preserves the client source IP and avoids a second hop for LoadBalancer and Nodeport type services, but risks potentially imbalanced traffic spreading. \"Cluster\" obscures the client source IP and may cause a second hop to another node, but should have good overall load-spreading.\n\nPossible enum values:\n - `\"Cluster\"` specifies node-global (legacy) behavior.\n - `\"Local\"` specifies node-local endpoints behavior.", + "enum": [ + "Cluster", + "Local" + ], "type": "string" }, "healthCheckNodePort": { @@ -9348,7 +10217,7 @@ "type": "string" }, "ipFamilies": { - "description": "IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this service, and is gated by the \"IPv6DualStack\" feature gate. This field is usually assigned automatically based on cluster configuration and the ipFamilyPolicy field. If this field is specified manually, the requested family is available in the cluster, and ipFamilyPolicy allows it, it will be used; otherwise creation of the service will fail. This field is conditionally mutable: it allows for adding or removing a secondary IP family, but it does not allow changing the primary IP family of the Service. Valid values are \"IPv4\" and \"IPv6\". This field only applies to Services of types ClusterIP, NodePort, and LoadBalancer, and does apply to \"headless\" services. This field will be wiped when updating a Service to type ExternalName.\n\nThis field may hold a maximum of two entries (dual-stack families, in either order). These families must correspond to the values of the clusterIPs field, if specified. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field.", + "description": "IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this service. This field is usually assigned automatically based on cluster configuration and the ipFamilyPolicy field. If this field is specified manually, the requested family is available in the cluster, and ipFamilyPolicy allows it, it will be used; otherwise creation of the service will fail. This field is conditionally mutable: it allows for adding or removing a secondary IP family, but it does not allow changing the primary IP family of the Service. Valid values are \"IPv4\" and \"IPv6\". This field only applies to Services of types ClusterIP, NodePort, and LoadBalancer, and does apply to \"headless\" services. This field will be wiped when updating a Service to type ExternalName.\n\nThis field may hold a maximum of two entries (dual-stack families, in either order). These families must correspond to the values of the clusterIPs field, if specified. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field.", "items": { "type": "string" }, @@ -9356,7 +10225,7 @@ "x-kubernetes-list-type": "atomic" }, "ipFamilyPolicy": { - "description": "IPFamilyPolicy represents the dual-stack-ness requested or required by this Service, and is gated by the \"IPv6DualStack\" feature gate. If there is no value provided, then this field will be set to SingleStack. Services can be \"SingleStack\" (a single IP family), \"PreferDualStack\" (two IP families on dual-stack configured clusters or a single IP family on single-stack clusters), or \"RequireDualStack\" (two IP families on dual-stack configured clusters, otherwise fail). The ipFamilies and clusterIPs fields depend on the value of this field. This field will be wiped when updating a service to type ExternalName.", + "description": "IPFamilyPolicy represents the dual-stack-ness requested or required by this Service. If there is no value provided, then this field will be set to SingleStack. Services can be \"SingleStack\" (a single IP family), \"PreferDualStack\" (two IP families on dual-stack configured clusters or a single IP family on single-stack clusters), or \"RequireDualStack\" (two IP families on dual-stack configured clusters, otherwise fail). The ipFamilies and clusterIPs fields depend on the value of this field. This field will be wiped when updating a service to type ExternalName.", "type": "string" }, "loadBalancerClass": { @@ -9401,7 +10270,11 @@ "x-kubernetes-map-type": "atomic" }, "sessionAffinity": { - "description": "Supports \"ClientIP\" and \"None\". Used to maintain session affinity. Enable client IP based session affinity. Must be ClientIP or None. Defaults to None. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies", + "description": "Supports \"ClientIP\" and \"None\". Used to maintain session affinity. Enable client IP based session affinity. Must be ClientIP or None. Defaults to None. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies\n\nPossible enum values:\n - `\"ClientIP\"` is the Client IP based.\n - `\"None\"` - no session affinity.", + "enum": [ + "ClientIP", + "None" + ], "type": "string" }, "sessionAffinityConfig": { @@ -9409,7 +10282,13 @@ "description": "sessionAffinityConfig contains the configurations of session affinity." }, "type": { - "description": "type determines how the Service is exposed. Defaults to ClusterIP. Valid options are ExternalName, ClusterIP, NodePort, and LoadBalancer. \"ClusterIP\" allocates a cluster-internal IP address for load-balancing to endpoints. Endpoints are determined by the selector or if that is not specified, by manual construction of an Endpoints object or EndpointSlice objects. If clusterIP is \"None\", no virtual IP is allocated and the endpoints are published as a set of endpoints rather than a virtual IP. \"NodePort\" builds on ClusterIP and allocates a port on every node which routes to the same endpoints as the clusterIP. \"LoadBalancer\" builds on NodePort and creates an external load-balancer (if supported in the current cloud) which routes to the same endpoints as the clusterIP. \"ExternalName\" aliases this service to the specified externalName. Several other fields do not apply to ExternalName services. More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types", + "description": "type determines how the Service is exposed. Defaults to ClusterIP. Valid options are ExternalName, ClusterIP, NodePort, and LoadBalancer. \"ClusterIP\" allocates a cluster-internal IP address for load-balancing to endpoints. Endpoints are determined by the selector or if that is not specified, by manual construction of an Endpoints object or EndpointSlice objects. If clusterIP is \"None\", no virtual IP is allocated and the endpoints are published as a set of endpoints rather than a virtual IP. \"NodePort\" builds on ClusterIP and allocates a port on every node which routes to the same endpoints as the clusterIP. \"LoadBalancer\" builds on NodePort and creates an external load-balancer (if supported in the current cloud) which routes to the same endpoints as the clusterIP. \"ExternalName\" aliases this service to the specified externalName. Several other fields do not apply to ExternalName services. More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\n\nPossible enum values:\n - `\"ClusterIP\"` means a service will only be accessible inside the cluster, via the cluster IP.\n - `\"ExternalName\"` means a service consists of only a reference to an external name that kubedns or equivalent will return as a CNAME record, with no exposing or proxying of any pods involved.\n - `\"LoadBalancer\"` means a service will be exposed via an external load balancer (if the cloud provider supports it), in addition to 'NodePort' type.\n - `\"NodePort\"` means a service will be exposed on one port of every node, in addition to 'ClusterIP' type.", + "enum": [ + "ClusterIP", + "ExternalName", + "LoadBalancer", + "NodePort" + ], "type": "string" } }, @@ -9539,7 +10418,12 @@ "description": "The node this Taint is attached to has the \"effect\" on any pod that does not tolerate the Taint.", "properties": { "effect": { - "description": "Required. The effect of the taint on pods that do not tolerate the taint. Valid effects are NoSchedule, PreferNoSchedule and NoExecute.", + "description": "Required. The effect of the taint on pods that do not tolerate the taint. Valid effects are NoSchedule, PreferNoSchedule and NoExecute.\n\nPossible enum values:\n - `\"NoExecute\"` Evict any already-running pods that do not tolerate the taint. Currently enforced by NodeController.\n - `\"NoSchedule\"` Do not allow new pods to schedule onto the node unless they tolerate the taint, but allow all pods submitted to Kubelet without going through the scheduler to start, and allow all already-running pods to continue running. Enforced by the scheduler.\n - `\"PreferNoSchedule\"` Like TaintEffectNoSchedule, but the scheduler tries not to schedule new pods onto the node, rather than prohibiting new pods from scheduling onto the node entirely. Enforced by the scheduler.", + "enum": [ + "NoExecute", + "NoSchedule", + "PreferNoSchedule" + ], "type": "string" }, "key": { @@ -9565,7 +10449,12 @@ "description": "The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator .", "properties": { "effect": { - "description": "Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + "description": "Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.\n\nPossible enum values:\n - `\"NoExecute\"` Evict any already-running pods that do not tolerate the taint. Currently enforced by NodeController.\n - `\"NoSchedule\"` Do not allow new pods to schedule onto the node unless they tolerate the taint, but allow all pods submitted to Kubelet without going through the scheduler to start, and allow all already-running pods to continue running. Enforced by the scheduler.\n - `\"PreferNoSchedule\"` Like TaintEffectNoSchedule, but the scheduler tries not to schedule new pods onto the node, rather than prohibiting new pods from scheduling onto the node entirely. Enforced by the scheduler.", + "enum": [ + "NoExecute", + "NoSchedule", + "PreferNoSchedule" + ], "type": "string" }, "key": { @@ -9573,7 +10462,11 @@ "type": "string" }, "operator": { - "description": "Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.", + "description": "Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category.\n\nPossible enum values:\n - `\"Equal\"`\n - `\"Exists\"`", + "enum": [ + "Equal", + "Exists" + ], "type": "string" }, "tolerationSeconds": { @@ -9640,7 +10533,11 @@ "type": "string" }, "whenUnsatisfiable": { - "description": "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assigment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field.", + "description": "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod if and only if every possible node assignment for that pod would violate \"MaxSkew\" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field.\n\nPossible enum values:\n - `\"DoNotSchedule\"` instructs the scheduler not to schedule the pod when constraints are not satisfied.\n - `\"ScheduleAnyway\"` instructs the scheduler to schedule the pod even if constraints are not satisfied.", + "enum": [ + "DoNotSchedule", + "ScheduleAnyway" + ], "type": "string" } }, @@ -9715,7 +10612,7 @@ }, "ephemeral": { "$ref": "#/definitions/io.k8s.api.core.v1.EphemeralVolumeSource", - "description": "Ephemeral represents a volume that is handled by a cluster storage driver. The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, and deleted when the pod is removed.\n\nUse this if: a) the volume is only needed while the pod runs, b) features of normal volumes like restoring from snapshot or capacity\n tracking are needed,\nc) the storage driver is specified through a storage class, and d) the storage driver supports dynamic volume provisioning through\n a PersistentVolumeClaim (see EphemeralVolumeSource for more\n information on the connection between this volume type\n and PersistentVolumeClaim).\n\nUse PersistentVolumeClaim or one of the vendor-specific APIs for volumes that persist for longer than the lifecycle of an individual pod.\n\nUse CSI for light-weight local ephemeral volumes if the CSI driver is meant to be used that way - see the documentation of the driver for more information.\n\nA pod can use both types of ephemeral volumes and persistent volumes at the same time.\n\nThis is a beta feature and only available when the GenericEphemeralVolume feature gate is enabled." + "description": "Ephemeral represents a volume that is handled by a cluster storage driver. The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, and deleted when the pod is removed.\n\nUse this if: a) the volume is only needed while the pod runs, b) features of normal volumes like restoring from snapshot or capacity\n tracking are needed,\nc) the storage driver is specified through a storage class, and d) the storage driver supports dynamic volume provisioning through\n a PersistentVolumeClaim (see EphemeralVolumeSource for more\n information on the connection between this volume type\n and PersistentVolumeClaim).\n\nUse PersistentVolumeClaim or one of the vendor-specific APIs for volumes that persist for longer than the lifecycle of an individual pod.\n\nUse CSI for light-weight local ephemeral volumes if the CSI driver is meant to be used that way - see the documentation of the driver for more information.\n\nA pod can use both types of ephemeral volumes and persistent volumes at the same time." }, "fc": { "$ref": "#/definitions/io.k8s.api.core.v1.FCVolumeSource", @@ -10061,7 +10958,12 @@ "description": "EndpointSlice represents a subset of the endpoints that implement a service. For a given service there may be multiple EndpointSlice objects, selected by labels, which must be joined to produce the full set of endpoints.", "properties": { "addressType": { - "description": "addressType specifies the type of address carried by this EndpointSlice. All addresses in this slice must be the same type. This field is immutable after creation. The following address types are currently supported: * IPv4: Represents an IPv4 Address. * IPv6: Represents an IPv6 Address. * FQDN: Represents a Fully Qualified Domain Name.", + "description": "addressType specifies the type of address carried by this EndpointSlice. All addresses in this slice must be the same type. This field is immutable after creation. The following address types are currently supported: * IPv4: Represents an IPv4 Address. * IPv6: Represents an IPv6 Address. * FQDN: Represents a Fully Qualified Domain Name.\n\nPossible enum values:\n - `\"FQDN\"` represents a FQDN.\n - `\"IPv4\"` represents an IPv4 Address.\n - `\"IPv6\"` represents an IPv6 Address.", + "enum": [ + "FQDN", + "IPv4", + "IPv6" + ], "type": "string" }, "apiVersion": { @@ -11065,7 +11967,7 @@ "type": "object" }, "io.k8s.api.flowcontrol.v1beta1.ResourcePolicyRule": { - "description": "ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) least one member of namespaces matches the request.", + "description": "ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) either (d1) the request does not specify a namespace (i.e., `Namespace==\"\"`) and clusterScope is true or (d2) the request specifies a namespace and least one member of namespaces matches the request's namespace.", "properties": { "apiGroups": { "description": "`apiGroups` is a list of matching API groups and may not be empty. \"*\" matches all API groups and, if present, must be the only entry. Required.", @@ -11177,6 +12079,555 @@ ], "type": "object" }, + "io.k8s.api.flowcontrol.v1beta2.FlowDistinguisherMethod": { + "description": "FlowDistinguisherMethod specifies the method of a flow distinguisher.", + "properties": { + "type": { + "description": "`type` is the type of flow distinguisher method The supported types are \"ByUser\" and \"ByNamespace\". Required.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.FlowSchema": { + "description": "FlowSchema defines the schema of a group of flows. Note that a flow is made up of a set of inbound API requests with similar attributes and is identified by a pair of strings: the name of the FlowSchema and a \"flow distinguisher\".", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta", + "description": "`metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "spec": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchemaSpec", + "description": "`spec` is the specification of the desired behavior of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status" + }, + "status": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchemaStatus", + "description": "`status` is the current status of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status" + } + }, + "type": "object", + "x-kubernetes-group-version-kind": [ + { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + ] + }, + "io.k8s.api.flowcontrol.v1beta2.FlowSchemaCondition": { + "description": "FlowSchemaCondition describes conditions for a FlowSchema.", + "properties": { + "lastTransitionTime": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "`lastTransitionTime` is the last time the condition transitioned from one status to another." + }, + "message": { + "description": "`message` is a human-readable message indicating details about last transition.", + "type": "string" + }, + "reason": { + "description": "`reason` is a unique, one-word, CamelCase reason for the condition's last transition.", + "type": "string" + }, + "status": { + "description": "`status` is the status of the condition. Can be True, False, Unknown. Required.", + "type": "string" + }, + "type": { + "description": "`type` is the type of the condition. Required.", + "type": "string" + } + }, + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.FlowSchemaList": { + "description": "FlowSchemaList is a list of FlowSchema objects.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "items": { + "description": "`items` is a list of FlowSchemas.", + "items": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + }, + "type": "array" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta", + "description": "`metadata` is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + } + }, + "required": [ + "items" + ], + "type": "object", + "x-kubernetes-group-version-kind": [ + { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchemaList", + "version": "v1beta2" + } + ] + }, + "io.k8s.api.flowcontrol.v1beta2.FlowSchemaSpec": { + "description": "FlowSchemaSpec describes how the FlowSchema's specification looks like.", + "properties": { + "distinguisherMethod": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowDistinguisherMethod", + "description": "`distinguisherMethod` defines how to compute the flow distinguisher for requests that match this schema. `nil` specifies that the distinguisher is disabled and thus will always be the empty string." + }, + "matchingPrecedence": { + "description": "`matchingPrecedence` is used to choose among the FlowSchemas that match a given request. The chosen FlowSchema is among those with the numerically lowest (which we take to be logically highest) MatchingPrecedence. Each MatchingPrecedence value must be ranged in [1,10000]. Note that if the precedence is not specified, it will be set to 1000 as default.", + "format": "int32", + "type": "integer" + }, + "priorityLevelConfiguration": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfigurationReference", + "description": "`priorityLevelConfiguration` should reference a PriorityLevelConfiguration in the cluster. If the reference cannot be resolved, the FlowSchema will be ignored and marked as invalid in its status. Required." + }, + "rules": { + "description": "`rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if at least one member of rules matches the request. if it is an empty slice, there will be no requests matching the FlowSchema.", + "items": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PolicyRulesWithSubjects" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "priorityLevelConfiguration" + ], + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.FlowSchemaStatus": { + "description": "FlowSchemaStatus represents the current state of a FlowSchema.", + "properties": { + "conditions": { + "description": "`conditions` is a list of the current states of FlowSchema.", + "items": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchemaCondition" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "type" + ], + "x-kubernetes-list-type": "map" + } + }, + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.GroupSubject": { + "description": "GroupSubject holds detailed information for group-kind subject.", + "properties": { + "name": { + "description": "name is the user group that matches, or \"*\" to match all user groups. See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some well-known group names. Required.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.LimitResponse": { + "description": "LimitResponse defines how to handle requests that can not be executed right now.", + "properties": { + "queuing": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.QueuingConfiguration", + "description": "`queuing` holds the configuration parameters for queuing. This field may be non-empty only if `type` is `\"Queue\"`." + }, + "type": { + "description": "`type` is \"Queue\" or \"Reject\". \"Queue\" means that requests that can not be executed upon arrival are held in a queue until they can be executed or a queuing limit is reached. \"Reject\" means that requests that can not be executed upon arrival are rejected. Required.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "x-kubernetes-unions": [ + { + "discriminator": "type", + "fields-to-discriminateBy": { + "queuing": "Queuing" + } + } + ] + }, + "io.k8s.api.flowcontrol.v1beta2.LimitedPriorityLevelConfiguration": { + "description": "LimitedPriorityLevelConfiguration specifies how to handle requests that are subject to limits. It addresses two issues:\n * How are requests for this priority level limited?\n * What should be done with requests that exceed the limit?", + "properties": { + "assuredConcurrencyShares": { + "description": "`assuredConcurrencyShares` (ACS) configures the execution limit, which is a limit on the number of requests of this priority level that may be exeucting at a given time. ACS must be a positive number. The server's concurrency limit (SCL) is divided among the concurrency-controlled priority levels in proportion to their assured concurrency shares. This produces the assured concurrency value (ACV) --- the number of requests that may be executing at a time --- for each such priority level:\n\n ACV(l) = ceil( SCL * ACS(l) / ( sum[priority levels k] ACS(k) ) )\n\nbigger numbers of ACS mean more reserved concurrent requests (at the expense of every other PL). This field has a default value of 30.", + "format": "int32", + "type": "integer" + }, + "limitResponse": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.LimitResponse", + "description": "`limitResponse` indicates what to do with requests that can not be executed right now" + } + }, + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.NonResourcePolicyRule": { + "description": "NonResourcePolicyRule is a predicate that matches non-resource requests according to their verb and the target non-resource URL. A NonResourcePolicyRule matches a request if and only if both (a) at least one member of verbs matches the request and (b) at least one member of nonResourceURLs matches the request.", + "properties": { + "nonResourceURLs": { + "description": "`nonResourceURLs` is a set of url prefixes that a user should have access to and may not be empty. For example:\n - \"/healthz\" is legal\n - \"/hea*\" is illegal\n - \"/hea\" is legal but matches nothing\n - \"/hea/*\" also matches nothing\n - \"/healthz/*\" matches all per-component health checks.\n\"*\" matches all non-resource urls. if it is present, it must be the only entry. Required.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "verbs": { + "description": "`verbs` is a list of matching verbs and may not be empty. \"*\" matches all verbs. If it is present, it must be the only entry. Required.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + } + }, + "required": [ + "verbs", + "nonResourceURLs" + ], + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.PolicyRulesWithSubjects": { + "description": "PolicyRulesWithSubjects prescribes a test that applies to a request to an apiserver. The test considers the subject making the request, the verb being requested, and the resource to be acted upon. This PolicyRulesWithSubjects matches a request if and only if both (a) at least one member of subjects matches the request and (b) at least one member of resourceRules or nonResourceRules matches the request.", + "properties": { + "nonResourceRules": { + "description": "`nonResourceRules` is a list of NonResourcePolicyRules that identify matching requests according to their verb and the target non-resource URL.", + "items": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.NonResourcePolicyRule" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "resourceRules": { + "description": "`resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the target resource. At least one of `resourceRules` and `nonResourceRules` has to be non-empty.", + "items": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.ResourcePolicyRule" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + }, + "subjects": { + "description": "subjects is the list of normal user, serviceaccount, or group that this rule cares about. There must be at least one member in this slice. A slice that includes both the system:authenticated and system:unauthenticated user groups matches every request. Required.", + "items": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.Subject" + }, + "type": "array", + "x-kubernetes-list-type": "atomic" + } + }, + "required": [ + "subjects" + ], + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration": { + "description": "PriorityLevelConfiguration represents the configuration of a priority level.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta", + "description": "`metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + }, + "spec": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfigurationSpec", + "description": "`spec` is the specification of the desired behavior of a \"request-priority\". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status" + }, + "status": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfigurationStatus", + "description": "`status` is the current status of a \"request-priority\". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status" + } + }, + "type": "object", + "x-kubernetes-group-version-kind": [ + { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + ] + }, + "io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfigurationCondition": { + "description": "PriorityLevelConfigurationCondition defines the condition of priority level.", + "properties": { + "lastTransitionTime": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", + "description": "`lastTransitionTime` is the last time the condition transitioned from one status to another." + }, + "message": { + "description": "`message` is a human-readable message indicating details about last transition.", + "type": "string" + }, + "reason": { + "description": "`reason` is a unique, one-word, CamelCase reason for the condition's last transition.", + "type": "string" + }, + "status": { + "description": "`status` is the status of the condition. Can be True, False, Unknown. Required.", + "type": "string" + }, + "type": { + "description": "`type` is the type of the condition. Required.", + "type": "string" + } + }, + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfigurationList": { + "description": "PriorityLevelConfigurationList is a list of PriorityLevelConfiguration objects.", + "properties": { + "apiVersion": { + "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + "type": "string" + }, + "items": { + "description": "`items` is a list of request-priorities.", + "items": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + }, + "type": "array" + }, + "kind": { + "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + "type": "string" + }, + "metadata": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta", + "description": "`metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" + } + }, + "required": [ + "items" + ], + "type": "object", + "x-kubernetes-group-version-kind": [ + { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfigurationList", + "version": "v1beta2" + } + ] + }, + "io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfigurationReference": { + "description": "PriorityLevelConfigurationReference contains information that points to the \"request-priority\" being used.", + "properties": { + "name": { + "description": "`name` is the name of the priority level configuration being referenced Required.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfigurationSpec": { + "description": "PriorityLevelConfigurationSpec specifies the configuration of a priority level.", + "properties": { + "limited": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.LimitedPriorityLevelConfiguration", + "description": "`limited` specifies how requests are handled for a Limited priority level. This field must be non-empty if and only if `type` is `\"Limited\"`." + }, + "type": { + "description": "`type` indicates whether this priority level is subject to limitation on request execution. A value of `\"Exempt\"` means that requests of this priority level are not subject to a limit (and thus are never queued) and do not detract from the capacity made available to other priority levels. A value of `\"Limited\"` means that (a) requests of this priority level _are_ subject to limits and (b) some of the server's limited capacity is made available exclusively to this priority level. Required.", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object", + "x-kubernetes-unions": [ + { + "discriminator": "type", + "fields-to-discriminateBy": { + "limited": "Limited" + } + } + ] + }, + "io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfigurationStatus": { + "description": "PriorityLevelConfigurationStatus represents the current state of a \"request-priority\".", + "properties": { + "conditions": { + "description": "`conditions` is the current state of \"request-priority\".", + "items": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfigurationCondition" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "type" + ], + "x-kubernetes-list-type": "map" + } + }, + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.QueuingConfiguration": { + "description": "QueuingConfiguration holds the configuration parameters for queuing", + "properties": { + "handSize": { + "description": "`handSize` is a small positive number that configures the shuffle sharding of requests into queues. When enqueuing a request at this priority level the request's flow identifier (a string pair) is hashed and the hash value is used to shuffle the list of queues and deal a hand of the size specified here. The request is put into one of the shortest queues in that hand. `handSize` must be no larger than `queues`, and should be significantly smaller (so that a few heavy flows do not saturate most of the queues). See the user-facing documentation for more extensive guidance on setting this field. This field has a default value of 8.", + "format": "int32", + "type": "integer" + }, + "queueLengthLimit": { + "description": "`queueLengthLimit` is the maximum number of requests allowed to be waiting in a given queue of this priority level at a time; excess requests are rejected. This value must be positive. If not specified, it will be defaulted to 50.", + "format": "int32", + "type": "integer" + }, + "queues": { + "description": "`queues` is the number of queues for this priority level. The queues exist independently at each apiserver. The value must be positive. Setting it to 1 effectively precludes shufflesharding and thus makes the distinguisher method of associated flow schemas irrelevant. This field has a default value of 64.", + "format": "int32", + "type": "integer" + } + }, + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.ResourcePolicyRule": { + "description": "ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) either (d1) the request does not specify a namespace (i.e., `Namespace==\"\"`) and clusterScope is true or (d2) the request specifies a namespace and least one member of namespaces matches the request's namespace.", + "properties": { + "apiGroups": { + "description": "`apiGroups` is a list of matching API groups and may not be empty. \"*\" matches all API groups and, if present, must be the only entry. Required.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "clusterScope": { + "description": "`clusterScope` indicates whether to match requests that do not specify a namespace (which happens either because the resource is not namespaced or the request targets all namespaces). If this field is omitted or false then the `namespaces` field must contain a non-empty list.", + "type": "boolean" + }, + "namespaces": { + "description": "`namespaces` is a list of target namespaces that restricts matches. A request that specifies a target namespace matches only if either (a) this list contains that target namespace or (b) this list contains \"*\". Note that \"*\" matches any specified namespace but does not match a request that _does not specify_ a namespace (see the `clusterScope` field for that). This list may be empty, but only if `clusterScope` is true.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "resources": { + "description": "`resources` is a list of matching resources (i.e., lowercase and plural) with, if desired, subresource. For example, [ \"services\", \"nodes/status\" ]. This list may not be empty. \"*\" matches all resources and, if present, must be the only entry. Required.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + }, + "verbs": { + "description": "`verbs` is a list of matching verbs and may not be empty. \"*\" matches all verbs and, if present, must be the only entry. Required.", + "items": { + "type": "string" + }, + "type": "array", + "x-kubernetes-list-type": "set" + } + }, + "required": [ + "verbs", + "apiGroups", + "resources" + ], + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.ServiceAccountSubject": { + "description": "ServiceAccountSubject holds detailed information for service-account-kind subject.", + "properties": { + "name": { + "description": "`name` is the name of matching ServiceAccount objects, or \"*\" to match regardless of name. Required.", + "type": "string" + }, + "namespace": { + "description": "`namespace` is the namespace of matching ServiceAccount objects. Required.", + "type": "string" + } + }, + "required": [ + "namespace", + "name" + ], + "type": "object" + }, + "io.k8s.api.flowcontrol.v1beta2.Subject": { + "description": "Subject matches the originator of a request, as identified by the request authentication system. There are three ways of matching an originator; by user, group, or service account.", + "properties": { + "group": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.GroupSubject", + "description": "`group` matches based on user group name." + }, + "kind": { + "description": "`kind` indicates which one of the other fields is non-empty. Required", + "type": "string" + }, + "serviceAccount": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.ServiceAccountSubject", + "description": "`serviceAccount` matches ServiceAccounts." + }, + "user": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.UserSubject", + "description": "`user` matches based on username." + } + }, + "required": [ + "kind" + ], + "type": "object", + "x-kubernetes-unions": [ + { + "discriminator": "kind", + "fields-to-discriminateBy": { + "group": "Group", + "serviceAccount": "ServiceAccount", + "user": "User" + } + } + ] + }, + "io.k8s.api.flowcontrol.v1beta2.UserSubject": { + "description": "UserSubject holds detailed information for user-kind subject.", + "properties": { + "name": { + "description": "`name` is the username that matches, or \"*\" to match all usernames. Required.", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object" + }, "io.k8s.api.networking.v1.HTTPIngressPath": { "description": "HTTPIngressPath associates a path with a backend. Incoming urls matching the path are forwarded to the backend.", "properties": { @@ -11367,7 +12818,7 @@ "type": "string" }, "scope": { - "description": "Scope represents if this refers to a cluster or namespace scoped resource. This may be set to \"Cluster\" (default) or \"Namespace\". Field can be enabled with IngressClassNamespacedParams feature gate.", + "description": "Scope represents if this refers to a cluster or namespace scoped resource. This may be set to \"Cluster\" (default) or \"Namespace\".", "type": "string" } }, @@ -12950,7 +14401,7 @@ "type": "array" }, "verbs": { - "description": "Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. '*' represents all verbs.", + "description": "Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.", "items": { "type": "string" }, @@ -13154,398 +14605,6 @@ "type": "object", "x-kubernetes-map-type": "atomic" }, - "io.k8s.api.rbac.v1alpha1.AggregationRule": { - "description": "AggregationRule describes how to locate ClusterRoles to aggregate into the ClusterRole", - "properties": { - "clusterRoleSelectors": { - "description": "ClusterRoleSelectors holds a list of selectors which will be used to find ClusterRoles and create the rules. If any of the selectors match, then the ClusterRole's permissions will be added", - "items": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector" - }, - "type": "array" - } - }, - "type": "object" - }, - "io.k8s.api.rbac.v1alpha1.ClusterRole": { - "description": "ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRole, and will no longer be served in v1.22.", - "properties": { - "aggregationRule": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.AggregationRule", - "description": "AggregationRule is an optional field that describes how to build the Rules for this ClusterRole. If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be stomped by the controller." - }, - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta", - "description": "Standard object's metadata." - }, - "rules": { - "description": "Rules holds all the PolicyRules for this ClusterRole", - "items": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.PolicyRule" - }, - "type": "array" - } - }, - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRole", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.rbac.v1alpha1.ClusterRoleBinding": { - "description": "ClusterRoleBinding references a ClusterRole, but not contain it. It can reference a ClusterRole in the global namespace, and adds who information via Subject. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBinding, and will no longer be served in v1.22.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta", - "description": "Standard object's metadata." - }, - "roleRef": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleRef", - "description": "RoleRef can only reference a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error." - }, - "subjects": { - "description": "Subjects holds references to the objects the role applies to.", - "items": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Subject" - }, - "type": "array" - } - }, - "required": [ - "roleRef" - ], - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBinding", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.rbac.v1alpha1.ClusterRoleBindingList": { - "description": "ClusterRoleBindingList is a collection of ClusterRoleBindings. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoleBindings, and will no longer be served in v1.22.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "items": { - "description": "Items is a list of ClusterRoleBindings", - "items": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - }, - "type": "array" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta", - "description": "Standard object's metadata." - } - }, - "required": [ - "items" - ], - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBindingList", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.rbac.v1alpha1.ClusterRoleList": { - "description": "ClusterRoleList is a collection of ClusterRoles. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 ClusterRoles, and will no longer be served in v1.22.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "items": { - "description": "Items is a list of ClusterRoles", - "items": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - }, - "type": "array" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta", - "description": "Standard object's metadata." - } - }, - "required": [ - "items" - ], - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleList", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.rbac.v1alpha1.PolicyRule": { - "description": "PolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.", - "properties": { - "apiGroups": { - "description": "APIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed.", - "items": { - "type": "string" - }, - "type": "array" - }, - "nonResourceURLs": { - "description": "NonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as \"pods\" or \"secrets\") or non-resource URL paths (such as \"/api\"), but not both.", - "items": { - "type": "string" - }, - "type": "array" - }, - "resourceNames": { - "description": "ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.", - "items": { - "type": "string" - }, - "type": "array" - }, - "resources": { - "description": "Resources is a list of resources this rule applies to. '*' represents all resources.", - "items": { - "type": "string" - }, - "type": "array" - }, - "verbs": { - "description": "Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. '*' represents all verbs.", - "items": { - "type": "string" - }, - "type": "array" - } - }, - "required": [ - "verbs" - ], - "type": "object" - }, - "io.k8s.api.rbac.v1alpha1.Role": { - "description": "Role is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 Role, and will no longer be served in v1.22.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta", - "description": "Standard object's metadata." - }, - "rules": { - "description": "Rules holds all the PolicyRules for this Role", - "items": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.PolicyRule" - }, - "type": "array" - } - }, - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.rbac.v1alpha1.RoleBinding": { - "description": "RoleBinding references a role, but does not contain it. It can reference a Role in the same namespace or a ClusterRole in the global namespace. It adds who information via Subjects and namespace information by which namespace it exists in. RoleBindings in a given namespace only have effect in that namespace. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBinding, and will no longer be served in v1.22.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta", - "description": "Standard object's metadata." - }, - "roleRef": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleRef", - "description": "RoleRef can reference a Role in the current namespace or a ClusterRole in the global namespace. If the RoleRef cannot be resolved, the Authorizer must return an error." - }, - "subjects": { - "description": "Subjects holds references to the objects the role applies to.", - "items": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Subject" - }, - "type": "array" - } - }, - "required": [ - "roleRef" - ], - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.rbac.v1alpha1.RoleBindingList": { - "description": "RoleBindingList is a collection of RoleBindings Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleBindingList, and will no longer be served in v1.22.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "items": { - "description": "Items is a list of RoleBindings", - "items": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - }, - "type": "array" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta", - "description": "Standard object's metadata." - } - }, - "required": [ - "items" - ], - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBindingList", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.rbac.v1alpha1.RoleList": { - "description": "RoleList is a collection of Roles. Deprecated in v1.17 in favor of rbac.authorization.k8s.io/v1 RoleList, and will no longer be served in v1.22.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "items": { - "description": "Items is a list of Roles", - "items": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - }, - "type": "array" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta", - "description": "Standard object's metadata." - } - }, - "required": [ - "items" - ], - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "rbac.authorization.k8s.io", - "kind": "RoleList", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.rbac.v1alpha1.RoleRef": { - "description": "RoleRef contains information that points to the role being used", - "properties": { - "apiGroup": { - "description": "APIGroup is the group for the resource being referenced", - "type": "string" - }, - "kind": { - "description": "Kind is the type of resource being referenced", - "type": "string" - }, - "name": { - "description": "Name is the name of resource being referenced", - "type": "string" - } - }, - "required": [ - "apiGroup", - "kind", - "name" - ], - "type": "object" - }, - "io.k8s.api.rbac.v1alpha1.Subject": { - "description": "Subject contains a reference to the object or user identities a role binding applies to. This can either hold a direct API object reference, or a value for non-objects such as user and group names.", - "properties": { - "apiVersion": { - "description": "APIVersion holds the API group and version of the referenced subject. Defaults to \"v1\" for ServiceAccount subjects. Defaults to \"rbac.authorization.k8s.io/v1alpha1\" for User and Group subjects.", - "type": "string" - }, - "kind": { - "description": "Kind of object being referenced. Values defined by this API group are \"User\", \"Group\", and \"ServiceAccount\". If the Authorizer does not recognized the kind value, the Authorizer should report an error.", - "type": "string" - }, - "name": { - "description": "Name of the object being referenced.", - "type": "string" - }, - "namespace": { - "description": "Namespace of the referenced object. If the object kind is non-namespace, such as \"User\" or \"Group\", and this value is not empty the Authorizer should report an error.", - "type": "string" - } - }, - "required": [ - "kind", - "name" - ], - "type": "object" - }, "io.k8s.api.scheduling.v1.PriorityClass": { "description": "PriorityClass defines mapping from a priority class name to the priority integer value. The value can be any valid integer.", "properties": { @@ -13626,86 +14685,6 @@ } ] }, - "io.k8s.api.scheduling.v1alpha1.PriorityClass": { - "description": "DEPRECATED - This group version of PriorityClass is deprecated by scheduling.k8s.io/v1/PriorityClass. PriorityClass defines mapping from a priority class name to the priority integer value. The value can be any valid integer.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "description": { - "description": "description is an arbitrary string that usually provides guidelines on when this priority class should be used.", - "type": "string" - }, - "globalDefault": { - "description": "globalDefault specifies whether this PriorityClass should be considered as the default priority for pods that do not have any priority class. Only one PriorityClass can be marked as `globalDefault`. However, if more than one PriorityClasses exists with their `globalDefault` field set to true, the smallest value of such global default PriorityClasses will be used as the default priority.", - "type": "boolean" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta", - "description": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "preemptionPolicy": { - "description": "PreemptionPolicy is the Policy for preempting pods with lower priority. One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset. This field is beta-level, gated by the NonPreemptingPriority feature-gate.", - "type": "string" - }, - "value": { - "description": "The value of this priority class. This is the actual priority that pods receive when they have the name of this class in their pod spec.", - "format": "int32", - "type": "integer" - } - }, - "required": [ - "value" - ], - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "scheduling.k8s.io", - "kind": "PriorityClass", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.scheduling.v1alpha1.PriorityClassList": { - "description": "PriorityClassList is a collection of priority classes.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "items": { - "description": "items is the list of PriorityClasses", - "items": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - }, - "type": "array" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta", - "description": "Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - } - }, - "required": [ - "items" - ], - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "scheduling.k8s.io", - "kind": "PriorityClassList", - "version": "v1alpha1" - } - ] - }, "io.k8s.api.storage.v1.CSIDriver": { "description": "CSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster. Kubernetes attach detach controller uses this object to determine whether attach is required. Kubelet uses this object to determine whether pod information needs to be passed on mount. CSIDriver objects are non-namespaced.", "properties": { @@ -13781,7 +14760,7 @@ "type": "boolean" }, "fsGroupPolicy": { - "description": "Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details. This field is beta, and is only honored by servers that enable the CSIVolumeFSGroupPolicy feature gate.\n\nThis field is immutable.\n\nDefaults to ReadWriteOnceWithFSType, which will examine each volume to determine if Kubernetes should modify ownership and permissions of the volume. With the default policy the defined fsGroup will only be applied if a fstype is defined and the volume's access mode contains ReadWriteOnce.", + "description": "Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details.\n\nThis field is immutable.\n\nDefaults to ReadWriteOnceWithFSType, which will examine each volume to determine if Kubernetes should modify ownership and permissions of the volume. With the default policy the defined fsGroup will only be applied if a fstype is defined and the volume's access mode contains ReadWriteOnce.", "type": "string" }, "podInfoOnMount": { @@ -13793,7 +14772,7 @@ "type": "boolean" }, "storageCapacity": { - "description": "If set to true, storageCapacity indicates that the CSI volume driver wants pod scheduling to consider the storage capacity that the driver deployment will report by creating CSIStorageCapacity objects with capacity information.\n\nThe check can be enabled immediately when deploying a driver. In that case, provisioning new volumes with late binding will pause until the driver deployment has published some suitable CSIStorageCapacity object.\n\nAlternatively, the driver can be deployed with the field unset or false and it can be flipped later when storage capacity information has been published.\n\nThis field is immutable.\n\nThis is a beta field and only available when the CSIStorageCapacity feature is enabled. The default is false.", + "description": "If set to true, storageCapacity indicates that the CSI volume driver wants pod scheduling to consider the storage capacity that the driver deployment will report by creating CSIStorageCapacity objects with capacity information.\n\nThe check can be enabled immediately when deploying a driver. In that case, provisioning new volumes with late binding will pause until the driver deployment has published some suitable CSIStorageCapacity object.\n\nAlternatively, the driver can be deployed with the field unset or false and it can be flipped later when storage capacity information has been published.\n\nThis field was immutable in Kubernetes <= 1.22 and now is mutable.\n\nThis is a beta field and only available when the CSIStorageCapacity feature is enabled. The default is false.", "type": "boolean" }, "tokenRequests": { @@ -14292,156 +15271,6 @@ } ] }, - "io.k8s.api.storage.v1alpha1.VolumeAttachment": { - "description": "VolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.\n\nVolumeAttachment objects are non-namespaced.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta", - "description": "Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - }, - "spec": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachmentSpec", - "description": "Specification of the desired attach/detach volume behavior. Populated by the Kubernetes system." - }, - "status": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachmentStatus", - "description": "Status of the VolumeAttachment request. Populated by the entity completing the attach or detach operation, i.e. the external-attacher." - } - }, - "required": [ - "spec" - ], - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "storage.k8s.io", - "kind": "VolumeAttachment", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.storage.v1alpha1.VolumeAttachmentList": { - "description": "VolumeAttachmentList is a collection of VolumeAttachment objects.", - "properties": { - "apiVersion": { - "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - "type": "string" - }, - "items": { - "description": "Items is the list of VolumeAttachments", - "items": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - }, - "type": "array" - }, - "kind": { - "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - "type": "string" - }, - "metadata": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.ListMeta", - "description": "Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata" - } - }, - "required": [ - "items" - ], - "type": "object", - "x-kubernetes-group-version-kind": [ - { - "group": "storage.k8s.io", - "kind": "VolumeAttachmentList", - "version": "v1alpha1" - } - ] - }, - "io.k8s.api.storage.v1alpha1.VolumeAttachmentSource": { - "description": "VolumeAttachmentSource represents a volume that should be attached. Right now only PersistenVolumes can be attached via external attacher, in future we may allow also inline volumes in pods. Exactly one member can be set.", - "properties": { - "inlineVolumeSpec": { - "$ref": "#/definitions/io.k8s.api.core.v1.PersistentVolumeSpec", - "description": "inlineVolumeSpec contains all the information necessary to attach a persistent volume defined by a pod's inline VolumeSource. This field is populated only for the CSIMigration feature. It contains translated fields from a pod's inline VolumeSource to a PersistentVolumeSpec. This field is alpha-level and is only honored by servers that enabled the CSIMigration feature." - }, - "persistentVolumeName": { - "description": "Name of the persistent volume to attach.", - "type": "string" - } - }, - "type": "object" - }, - "io.k8s.api.storage.v1alpha1.VolumeAttachmentSpec": { - "description": "VolumeAttachmentSpec is the specification of a VolumeAttachment request.", - "properties": { - "attacher": { - "description": "Attacher indicates the name of the volume driver that MUST handle this request. This is the name returned by GetPluginName().", - "type": "string" - }, - "nodeName": { - "description": "The node that the volume should be attached to.", - "type": "string" - }, - "source": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachmentSource", - "description": "Source represents the volume that should be attached." - } - }, - "required": [ - "attacher", - "source", - "nodeName" - ], - "type": "object" - }, - "io.k8s.api.storage.v1alpha1.VolumeAttachmentStatus": { - "description": "VolumeAttachmentStatus is the status of a VolumeAttachment request.", - "properties": { - "attachError": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeError", - "description": "The last error encountered during attach operation, if any. This field must only be set by the entity completing the attach operation, i.e. the external-attacher." - }, - "attached": { - "description": "Indicates the volume is successfully attached. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.", - "type": "boolean" - }, - "attachmentMetadata": { - "additionalProperties": { - "type": "string" - }, - "description": "Upon successful attach, this field is populated with any information returned by the attach operation that must be passed into subsequent WaitForAttach or Mount calls. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.", - "type": "object" - }, - "detachError": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeError", - "description": "The last error encountered during detach operation, if any. This field must only be set by the entity completing the detach operation, i.e. the external-attacher." - } - }, - "required": [ - "attached" - ], - "type": "object" - }, - "io.k8s.api.storage.v1alpha1.VolumeError": { - "description": "VolumeError captures an error encountered during a volume operation.", - "properties": { - "message": { - "description": "String detailing the error encountered during Attach or Detach operation. This string maybe logged, so it should not contain sensitive information.", - "type": "string" - }, - "time": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Time", - "description": "Time the error was encountered." - } - }, - "type": "object" - }, "io.k8s.api.storage.v1beta1.CSIStorageCapacity": { "description": "CSIStorageCapacity stores the result of one CSI GetCapacity call. For a given StorageClass, this describes the available capacity in a particular topology segment. This can be used when considering where to instantiate new PersistentVolumes.\n\nFor example this can express things like: - StorageClass \"standard\" has \"1234 GiB\" available in \"topology.kubernetes.io/zone=us-east1\" - StorageClass \"localssd\" has \"10 GiB\" available in \"kubernetes.io/hostname=knode-abc123\"\n\nThe following three cases all imply that no capacity is available for a certain combination: - no object exists with suitable topology and storage class name - such an object exists, but the capacity is unset - such an object exists, but the capacity is zero\n\nThe producer of these objects can decide which approach is more suitable.\n\nThey are consumed by the kube-scheduler if the CSIStorageCapacity beta feature gate is enabled there and a CSI driver opts into capacity-aware scheduling with CSIDriver.StorageCapacity.", "properties": { @@ -15075,6 +15904,19 @@ "x-kubernetes-preserve-unknown-fields": { "description": "x-kubernetes-preserve-unknown-fields stops the API server decoding step from pruning fields which are not specified in the validation schema. This affects fields recursively, but switches back to normal pruning behaviour if nested properties or additionalProperties are specified in the schema. This can either be true or undefined. False is forbidden.", "type": "boolean" + }, + "x-kubernetes-validations": { + "description": "x-kubernetes-validations describes a list of validation rules written in the CEL expression language. This field is an alpha-level. Using this field requires the feature gate `CustomResourceValidationExpressions` to be enabled.", + "items": { + "$ref": "#/definitions/io.k8s.apiextensions-apiserver.pkg.apis.apiextensions.v1.ValidationRule" + }, + "type": "array", + "x-kubernetes-list-map-keys": [ + "rule" + ], + "x-kubernetes-list-type": "map", + "x-kubernetes-patch-merge-key": "rule", + "x-kubernetes-patch-strategy": "merge" } }, "type": "object" @@ -15115,6 +15957,23 @@ ], "type": "object" }, + "io.k8s.apiextensions-apiserver.pkg.apis.apiextensions.v1.ValidationRule": { + "description": "ValidationRule describes a validation rule written in the CEL expression language.", + "properties": { + "message": { + "description": "Message represents the message displayed when validation fails. The message is required if the Rule contains line breaks. The message must not contain line breaks. If unset, the message is \"failed rule: {Rule}\". e.g. \"must be a URL with the host matching spec.host\"", + "type": "string" + }, + "rule": { + "description": "Rule represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec The Rule is scoped to the location of the x-kubernetes-validations extension in the schema. The `self` variable in the CEL expression is bound to the scoped value. Example: - Rule scoped to the root of a resource with a status subresource: {\"rule\": \"self.status.actual <= self.spec.maxDesired\"}\n\nIf the Rule is scoped to an object with properties, the accessible properties of the object are field selectable via `self.field` and field presence can be checked via `has(self.field)`. Null valued fields are treated as absent fields in CEL expressions. If the Rule is scoped to an object with additionalProperties (i.e. a map) the value of the map are accessible via `self[mapKey]`, map containment can be checked via `mapKey in self` and all entries of the map are accessible via CEL macros and functions such as `self.all(...)`. If the Rule is scoped to an array, the elements of the array are accessible via `self[i]` and also by macros and functions. If the Rule is scoped to a scalar, `self` is bound to the scalar value. Examples: - Rule scoped to a map of objects: {\"rule\": \"self.components['Widget'].priority < 10\"} - Rule scoped to a list of integers: {\"rule\": \"self.values.all(value, value >= 0 && value < 100)\"} - Rule scoped to a string value: {\"rule\": \"self.startsWith('kube')\"}\n\nThe `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object and from any x-kubernetes-embedded-resource annotated objects. No other metadata properties are accessible.\n\nUnknown data preserved in custom resources via x-kubernetes-preserve-unknown-fields is not accessible in CEL expressions. This includes: - Unknown field values that are preserved by object schemas with x-kubernetes-preserve-unknown-fields. - Object properties where the property schema is of an \"unknown type\". An \"unknown type\" is recursively defined as:\n - A schema with no type and x-kubernetes-preserve-unknown-fields set to true\n - An array where the items schema is of an \"unknown type\"\n - An object where the additionalProperties schema is of an \"unknown type\"\n\nOnly property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are:\n\t \"true\", \"false\", \"null\", \"in\", \"as\", \"break\", \"const\", \"continue\", \"else\", \"for\", \"function\", \"if\",\n\t \"import\", \"let\", \"loop\", \"package\", \"namespace\", \"return\".\nExamples:\n - Rule accessing a property named \"namespace\": {\"rule\": \"self.__namespace__ > 0\"}\n - Rule accessing a property named \"x-prop\": {\"rule\": \"self.x__dash__prop > 0\"}\n - Rule accessing a property named \"redact__d\": {\"rule\": \"self.redact__underscores__d > 0\"}\n\nEquality on arrays with x-kubernetes-list-type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:\n - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and\n non-intersecting elements in `Y` are appended, retaining their partial order.\n - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values\n are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with\n non-intersecting keys are appended, retaining their partial order.", + "type": "string" + } + }, + "required": [ + "rule" + ], + "type": "object" + }, "io.k8s.apiextensions-apiserver.pkg.apis.apiextensions.v1.WebhookClientConfig": { "description": "WebhookClientConfig contains the information to make a TLS connection with the webhook.", "properties": { @@ -15534,6 +16393,11 @@ "kind": "DeleteOptions", "version": "v1" }, + { + "group": "autoscaling", + "kind": "DeleteOptions", + "version": "v2" + }, { "group": "autoscaling", "kind": "DeleteOptions", @@ -15609,6 +16473,11 @@ "kind": "DeleteOptions", "version": "v1beta1" }, + { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "DeleteOptions", + "version": "v1beta2" + }, { "group": "imagepolicy.k8s.io", "kind": "DeleteOptions", @@ -16201,6 +17070,11 @@ "kind": "WatchEvent", "version": "v1" }, + { + "group": "autoscaling", + "kind": "WatchEvent", + "version": "v2" + }, { "group": "autoscaling", "kind": "WatchEvent", @@ -16276,6 +17150,11 @@ "kind": "WatchEvent", "version": "v1beta1" }, + { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "WatchEvent", + "version": "v1beta2" + }, { "group": "imagepolicy.k8s.io", "kind": "WatchEvent", @@ -17446,6 +18325,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -17506,6 +18392,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "object name and auth scope, such as for teams and projects", "in": "path", @@ -17849,6 +18742,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -18064,6 +18964,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -18135,6 +19042,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -18442,6 +19356,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -18657,6 +19578,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -18728,6 +19656,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -19035,6 +19970,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -19250,6 +20192,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -19321,6 +20270,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -19628,6 +20584,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -19843,6 +20806,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -19914,6 +20884,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -20221,6 +21198,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -20436,6 +21420,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -20507,6 +21498,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -20638,6 +21636,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -20709,6 +21714,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -21016,6 +22028,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -21231,6 +22250,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -21302,6 +22328,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -21477,6 +22510,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "name of the Binding", "in": "path", @@ -21652,6 +22692,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -21723,6 +22770,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -21777,6 +22831,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "name of the Eviction", "in": "path", @@ -21925,7 +22986,7 @@ "uniqueItems": true }, { - "description": "Redirect the standard error stream of the pod for this call. Defaults to true.", + "description": "Redirect the standard error stream of the pod for this call.", "in": "query", "name": "stderr", "type": "boolean", @@ -21939,7 +23000,7 @@ "uniqueItems": true }, { - "description": "Redirect the standard output stream of the pod for this call. Defaults to true.", + "description": "Redirect the standard output stream of the pod for this call.", "in": "query", "name": "stdout", "type": "boolean", @@ -22816,6 +23877,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -22887,6 +23955,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -23194,6 +24269,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -23409,6 +24491,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -23480,6 +24569,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -23787,6 +24883,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -24002,6 +25105,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -24073,6 +25183,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -24204,6 +25321,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -24275,6 +25399,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -24406,6 +25537,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -24477,6 +25615,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -24784,6 +25929,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -24999,6 +26151,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -25070,6 +26229,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -25201,6 +26367,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -25272,6 +26445,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -25579,6 +26759,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -25794,6 +26981,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -25865,6 +27059,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -26172,6 +27373,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -26387,6 +27595,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -26458,6 +27673,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -26512,6 +27734,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "name of the TokenRequest", "in": "path", @@ -26595,6 +27824,127 @@ } }, "/api/v1/namespaces/{namespace}/services": { + "delete": { + "consumes": [ + "*/*" + ], + "description": "delete collection of Service", + "operationId": "deleteCoreV1CollectionNamespacedService", + "parameters": [ + { + "in": "body", + "name": "body", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" + } + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", + "in": "query", + "name": "gracePeriodSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", + "in": "query", + "name": "orphanDependents", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", + "in": "query", + "name": "propagationPolicy", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "core_v1" + ], + "x-kubernetes-action": "deletecollection", + "x-kubernetes-group-version-kind": { + "group": "", + "kind": "Service", + "version": "v1" + } + }, "get": { "consumes": [ "*/*" @@ -26742,6 +28092,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -26839,13 +28196,13 @@ "200": { "description": "OK", "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + "$ref": "#/definitions/io.k8s.api.core.v1.Service" } }, "202": { "description": "Accepted", "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + "$ref": "#/definitions/io.k8s.api.core.v1.Service" } }, "401": { @@ -26957,6 +28314,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -27028,6 +28392,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -27683,6 +29054,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -27754,6 +29132,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -27955,6 +29340,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -28026,6 +29418,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -28080,6 +29479,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "name of the Namespace", "in": "path", @@ -28233,6 +29639,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -28304,6 +29717,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -28603,6 +30023,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -28810,6 +30237,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -28881,6 +30315,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -29512,6 +30953,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -29583,6 +31031,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -29993,6 +31448,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -30200,6 +31662,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -30271,6 +31740,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -30394,6 +31870,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -30465,6 +31948,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -36614,6 +38104,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -36821,6 +38318,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -36892,6 +38396,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -37191,6 +38702,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -37398,6 +38916,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -37469,6 +38994,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -38294,6 +39826,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -38501,6 +40040,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -38572,6 +40118,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -38695,6 +40248,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -38766,6 +40326,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -39361,6 +40928,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -39568,6 +41142,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -39639,6 +41220,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -39762,6 +41350,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -39833,6 +41428,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -40769,6 +42371,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -40984,6 +42593,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -41055,6 +42671,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -41362,6 +42985,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -41577,6 +43207,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -41648,6 +43285,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -41779,6 +43423,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -41850,6 +43501,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -42157,6 +43815,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -42372,6 +44037,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -42443,6 +44115,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -42574,6 +44253,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -42645,6 +44331,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -42776,6 +44469,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -42847,6 +44547,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -43154,6 +44861,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -43369,6 +45083,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -43440,6 +45161,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -43571,6 +45299,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -43642,6 +45377,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -43773,6 +45515,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -43844,6 +45593,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -44151,6 +45907,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -44366,6 +46129,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -44437,6 +46207,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -44568,6 +46345,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -44639,6 +46423,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -44770,6 +46561,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -44841,6 +46639,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -46968,6 +48773,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "If 'true', then the output is pretty printed.", "in": "query", @@ -47116,6 +48928,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "object name and auth scope, such as for teams and projects", "in": "path", @@ -47206,6 +49025,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "If 'true', then the output is pretty printed.", "in": "query", @@ -47288,6 +49114,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "If 'true', then the output is pretty printed.", "in": "query", @@ -47370,6 +49203,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "If 'true', then the output is pretty printed.", "in": "query", @@ -47882,6 +49722,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -48097,6 +49944,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -48168,6 +50022,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -48299,6 +50160,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -48370,6 +50238,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -48765,6 +50640,1337 @@ } ] }, + "/apis/autoscaling/v2/": { + "get": { + "consumes": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "description": "get available resources", + "operationId": "getAutoscalingV2APIResources", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.APIResourceList" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ] + } + }, + "/apis/autoscaling/v2/horizontalpodautoscalers": { + "get": { + "consumes": [ + "*/*" + ], + "description": "list or watch objects of kind HorizontalPodAutoscaler", + "operationId": "listAutoscalingV2HorizontalPodAutoscalerForAllNamespaces", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerList" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "list", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ] + }, + "/apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers": { + "delete": { + "consumes": [ + "*/*" + ], + "description": "delete collection of HorizontalPodAutoscaler", + "operationId": "deleteAutoscalingV2CollectionNamespacedHorizontalPodAutoscaler", + "parameters": [ + { + "in": "body", + "name": "body", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" + } + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", + "in": "query", + "name": "gracePeriodSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", + "in": "query", + "name": "orphanDependents", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", + "in": "query", + "name": "propagationPolicy", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "deletecollection", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "get": { + "consumes": [ + "*/*" + ], + "description": "list or watch objects of kind HorizontalPodAutoscaler", + "operationId": "listAutoscalingV2NamespacedHorizontalPodAutoscaler", + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerList" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "list", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "parameters": [ + { + "description": "object name and auth scope, such as for teams and projects", + "in": "path", + "name": "namespace", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + } + ], + "post": { + "consumes": [ + "*/*" + ], + "description": "create a HorizontalPodAutoscaler", + "operationId": "createAutoscalingV2NamespacedHorizontalPodAutoscaler", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "202": { + "description": "Accepted", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "post", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + } + }, + "/apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}": { + "delete": { + "consumes": [ + "*/*" + ], + "description": "delete a HorizontalPodAutoscaler", + "operationId": "deleteAutoscalingV2NamespacedHorizontalPodAutoscaler", + "parameters": [ + { + "in": "body", + "name": "body", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", + "in": "query", + "name": "gracePeriodSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", + "in": "query", + "name": "orphanDependents", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", + "in": "query", + "name": "propagationPolicy", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + } + }, + "202": { + "description": "Accepted", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "delete", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "get": { + "consumes": [ + "*/*" + ], + "description": "read the specified HorizontalPodAutoscaler", + "operationId": "readAutoscalingV2NamespacedHorizontalPodAutoscaler", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "get", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "parameters": [ + { + "description": "name of the HorizontalPodAutoscaler", + "in": "path", + "name": "name", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "object name and auth scope, such as for teams and projects", + "in": "path", + "name": "namespace", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + } + ], + "patch": { + "consumes": [ + "application/json-patch+json", + "application/merge-patch+json", + "application/strategic-merge-patch+json", + "application/apply-patch+yaml" + ], + "description": "partially update the specified HorizontalPodAutoscaler", + "operationId": "patchAutoscalingV2NamespacedHorizontalPodAutoscaler", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, + { + "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", + "in": "query", + "name": "force", + "type": "boolean", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "patch", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "put": { + "consumes": [ + "*/*" + ], + "description": "replace the specified HorizontalPodAutoscaler", + "operationId": "replaceAutoscalingV2NamespacedHorizontalPodAutoscaler", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "put", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + } + }, + "/apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}/status": { + "get": { + "consumes": [ + "*/*" + ], + "description": "read status of the specified HorizontalPodAutoscaler", + "operationId": "readAutoscalingV2NamespacedHorizontalPodAutoscalerStatus", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "get", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "parameters": [ + { + "description": "name of the HorizontalPodAutoscaler", + "in": "path", + "name": "name", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "object name and auth scope, such as for teams and projects", + "in": "path", + "name": "namespace", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + } + ], + "patch": { + "consumes": [ + "application/json-patch+json", + "application/merge-patch+json", + "application/strategic-merge-patch+json", + "application/apply-patch+yaml" + ], + "description": "partially update status of the specified HorizontalPodAutoscaler", + "operationId": "patchAutoscalingV2NamespacedHorizontalPodAutoscalerStatus", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, + { + "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", + "in": "query", + "name": "force", + "type": "boolean", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "patch", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "put": { + "consumes": [ + "*/*" + ], + "description": "replace status of the specified HorizontalPodAutoscaler", + "operationId": "replaceAutoscalingV2NamespacedHorizontalPodAutoscalerStatus", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.autoscaling.v2.HorizontalPodAutoscaler" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "put", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + } + }, + "/apis/autoscaling/v2/watch/horizontalpodautoscalers": { + "get": { + "consumes": [ + "*/*" + ], + "description": "watch individual changes to a list of HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead.", + "operationId": "watchAutoscalingV2HorizontalPodAutoscalerListForAllNamespaces", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "watchlist", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ] + }, + "/apis/autoscaling/v2/watch/namespaces/{namespace}/horizontalpodautoscalers": { + "get": { + "consumes": [ + "*/*" + ], + "description": "watch individual changes to a list of HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead.", + "operationId": "watchAutoscalingV2NamespacedHorizontalPodAutoscalerList", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "watchlist", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "object name and auth scope, such as for teams and projects", + "in": "path", + "name": "namespace", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ] + }, + "/apis/autoscaling/v2/watch/namespaces/{namespace}/horizontalpodautoscalers/{name}": { + "get": { + "consumes": [ + "*/*" + ], + "description": "watch changes to an object of kind HorizontalPodAutoscaler. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.", + "operationId": "watchAutoscalingV2NamespacedHorizontalPodAutoscaler", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "autoscaling_v2" + ], + "x-kubernetes-action": "watch", + "x-kubernetes-group-version-kind": { + "group": "autoscaling", + "kind": "HorizontalPodAutoscaler", + "version": "v2" + } + }, + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "name of the HorizontalPodAutoscaler", + "in": "path", + "name": "name", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "object name and auth scope, such as for teams and projects", + "in": "path", + "name": "namespace", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ] + }, "/apis/autoscaling/v2beta1/": { "get": { "consumes": [ @@ -49178,6 +52384,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -49393,6 +52606,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -49464,6 +52684,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -49595,6 +52822,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -49666,6 +52900,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -50474,6 +53715,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -50689,6 +53937,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -50760,6 +54015,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -50891,6 +54153,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -50962,6 +54231,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -51914,6 +55190,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -52129,6 +55412,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -52200,6 +55490,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -52331,6 +55628,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -52402,6 +55706,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -52709,6 +56020,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -52924,6 +56242,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -52995,6 +56320,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -53126,6 +56458,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -53197,6 +56536,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -54362,6 +57708,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -54577,6 +57930,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -54648,6 +58008,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -54779,6 +58146,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -54850,6 +58224,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -55572,6 +58953,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -55779,6 +59167,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -55850,6 +59245,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -55973,6 +59375,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -56044,6 +59453,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -56167,6 +59583,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -56238,6 +59661,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -56952,6 +60382,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -57167,6 +60604,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -57238,6 +60682,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -58079,6 +61530,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -58294,6 +61752,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -58365,6 +61830,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -59173,6 +62645,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -59388,6 +62867,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -59459,6 +62945,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -60300,6 +63793,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -60515,6 +64015,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -60586,6 +64093,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -61394,6 +64908,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -61609,6 +65130,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -61680,6 +65208,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -62402,6 +65937,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -62609,6 +66151,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -62680,6 +66229,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -62803,6 +66359,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -62874,6 +66437,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -63173,6 +66743,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -63380,6 +66957,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -63451,6 +67035,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -63574,6 +67165,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -63645,6 +67243,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -64143,6 +67748,2111 @@ } ] }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/": { + "get": { + "consumes": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "description": "get available resources", + "operationId": "getFlowcontrolApiserverV1beta2APIResources", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.APIResourceList" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ] + } + }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas": { + "delete": { + "consumes": [ + "*/*" + ], + "description": "delete collection of FlowSchema", + "operationId": "deleteFlowcontrolApiserverV1beta2CollectionFlowSchema", + "parameters": [ + { + "in": "body", + "name": "body", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" + } + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", + "in": "query", + "name": "gracePeriodSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", + "in": "query", + "name": "orphanDependents", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", + "in": "query", + "name": "propagationPolicy", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "deletecollection", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + }, + "get": { + "consumes": [ + "*/*" + ], + "description": "list or watch objects of kind FlowSchema", + "operationId": "listFlowcontrolApiserverV1beta2FlowSchema", + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchemaList" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "list", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + }, + "parameters": [ + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + } + ], + "post": { + "consumes": [ + "*/*" + ], + "description": "create a FlowSchema", + "operationId": "createFlowcontrolApiserverV1beta2FlowSchema", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "202": { + "description": "Accepted", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "post", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + } + }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/{name}": { + "delete": { + "consumes": [ + "*/*" + ], + "description": "delete a FlowSchema", + "operationId": "deleteFlowcontrolApiserverV1beta2FlowSchema", + "parameters": [ + { + "in": "body", + "name": "body", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", + "in": "query", + "name": "gracePeriodSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", + "in": "query", + "name": "orphanDependents", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", + "in": "query", + "name": "propagationPolicy", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + } + }, + "202": { + "description": "Accepted", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "delete", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + }, + "get": { + "consumes": [ + "*/*" + ], + "description": "read the specified FlowSchema", + "operationId": "readFlowcontrolApiserverV1beta2FlowSchema", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "get", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + }, + "parameters": [ + { + "description": "name of the FlowSchema", + "in": "path", + "name": "name", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + } + ], + "patch": { + "consumes": [ + "application/json-patch+json", + "application/merge-patch+json", + "application/strategic-merge-patch+json", + "application/apply-patch+yaml" + ], + "description": "partially update the specified FlowSchema", + "operationId": "patchFlowcontrolApiserverV1beta2FlowSchema", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, + { + "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", + "in": "query", + "name": "force", + "type": "boolean", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "patch", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + }, + "put": { + "consumes": [ + "*/*" + ], + "description": "replace the specified FlowSchema", + "operationId": "replaceFlowcontrolApiserverV1beta2FlowSchema", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "put", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + } + }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/{name}/status": { + "get": { + "consumes": [ + "*/*" + ], + "description": "read status of the specified FlowSchema", + "operationId": "readFlowcontrolApiserverV1beta2FlowSchemaStatus", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "get", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + }, + "parameters": [ + { + "description": "name of the FlowSchema", + "in": "path", + "name": "name", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + } + ], + "patch": { + "consumes": [ + "application/json-patch+json", + "application/merge-patch+json", + "application/strategic-merge-patch+json", + "application/apply-patch+yaml" + ], + "description": "partially update status of the specified FlowSchema", + "operationId": "patchFlowcontrolApiserverV1beta2FlowSchemaStatus", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, + { + "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", + "in": "query", + "name": "force", + "type": "boolean", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "patch", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + }, + "put": { + "consumes": [ + "*/*" + ], + "description": "replace status of the specified FlowSchema", + "operationId": "replaceFlowcontrolApiserverV1beta2FlowSchemaStatus", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.FlowSchema" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "put", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + } + }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations": { + "delete": { + "consumes": [ + "*/*" + ], + "description": "delete collection of PriorityLevelConfiguration", + "operationId": "deleteFlowcontrolApiserverV1beta2CollectionPriorityLevelConfiguration", + "parameters": [ + { + "in": "body", + "name": "body", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" + } + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", + "in": "query", + "name": "gracePeriodSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", + "in": "query", + "name": "orphanDependents", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", + "in": "query", + "name": "propagationPolicy", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "deletecollection", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + }, + "get": { + "consumes": [ + "*/*" + ], + "description": "list or watch objects of kind PriorityLevelConfiguration", + "operationId": "listFlowcontrolApiserverV1beta2PriorityLevelConfiguration", + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfigurationList" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "list", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + }, + "parameters": [ + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + } + ], + "post": { + "consumes": [ + "*/*" + ], + "description": "create a PriorityLevelConfiguration", + "operationId": "createFlowcontrolApiserverV1beta2PriorityLevelConfiguration", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "202": { + "description": "Accepted", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "post", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + } + }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations/{name}": { + "delete": { + "consumes": [ + "*/*" + ], + "description": "delete a PriorityLevelConfiguration", + "operationId": "deleteFlowcontrolApiserverV1beta2PriorityLevelConfiguration", + "parameters": [ + { + "in": "body", + "name": "body", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", + "in": "query", + "name": "gracePeriodSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", + "in": "query", + "name": "orphanDependents", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", + "in": "query", + "name": "propagationPolicy", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + } + }, + "202": { + "description": "Accepted", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "delete", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + }, + "get": { + "consumes": [ + "*/*" + ], + "description": "read the specified PriorityLevelConfiguration", + "operationId": "readFlowcontrolApiserverV1beta2PriorityLevelConfiguration", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "get", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + }, + "parameters": [ + { + "description": "name of the PriorityLevelConfiguration", + "in": "path", + "name": "name", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + } + ], + "patch": { + "consumes": [ + "application/json-patch+json", + "application/merge-patch+json", + "application/strategic-merge-patch+json", + "application/apply-patch+yaml" + ], + "description": "partially update the specified PriorityLevelConfiguration", + "operationId": "patchFlowcontrolApiserverV1beta2PriorityLevelConfiguration", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, + { + "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", + "in": "query", + "name": "force", + "type": "boolean", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "patch", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + }, + "put": { + "consumes": [ + "*/*" + ], + "description": "replace the specified PriorityLevelConfiguration", + "operationId": "replaceFlowcontrolApiserverV1beta2PriorityLevelConfiguration", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "put", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + } + }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations/{name}/status": { + "get": { + "consumes": [ + "*/*" + ], + "description": "read status of the specified PriorityLevelConfiguration", + "operationId": "readFlowcontrolApiserverV1beta2PriorityLevelConfigurationStatus", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "get", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + }, + "parameters": [ + { + "description": "name of the PriorityLevelConfiguration", + "in": "path", + "name": "name", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + } + ], + "patch": { + "consumes": [ + "application/json-patch+json", + "application/merge-patch+json", + "application/strategic-merge-patch+json", + "application/apply-patch+yaml" + ], + "description": "partially update status of the specified PriorityLevelConfiguration", + "operationId": "patchFlowcontrolApiserverV1beta2PriorityLevelConfigurationStatus", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, + { + "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", + "in": "query", + "name": "force", + "type": "boolean", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "patch", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + }, + "put": { + "consumes": [ + "*/*" + ], + "description": "replace status of the specified PriorityLevelConfiguration", + "operationId": "replaceFlowcontrolApiserverV1beta2PriorityLevelConfigurationStatus", + "parameters": [ + { + "in": "body", + "name": "body", + "required": true, + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + { + "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", + "in": "query", + "name": "dryRun", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", + "in": "query", + "name": "fieldManager", + "type": "string", + "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + } + ], + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "201": { + "description": "Created", + "schema": { + "$ref": "#/definitions/io.k8s.api.flowcontrol.v1beta2.PriorityLevelConfiguration" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "put", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + } + }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/watch/flowschemas": { + "get": { + "consumes": [ + "*/*" + ], + "description": "watch individual changes to a list of FlowSchema. deprecated: use the 'watch' parameter with a list operation instead.", + "operationId": "watchFlowcontrolApiserverV1beta2FlowSchemaList", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "watchlist", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + }, + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ] + }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/watch/flowschemas/{name}": { + "get": { + "consumes": [ + "*/*" + ], + "description": "watch changes to an object of kind FlowSchema. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.", + "operationId": "watchFlowcontrolApiserverV1beta2FlowSchema", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "watch", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "FlowSchema", + "version": "v1beta2" + } + }, + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "name of the FlowSchema", + "in": "path", + "name": "name", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ] + }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/watch/prioritylevelconfigurations": { + "get": { + "consumes": [ + "*/*" + ], + "description": "watch individual changes to a list of PriorityLevelConfiguration. deprecated: use the 'watch' parameter with a list operation instead.", + "operationId": "watchFlowcontrolApiserverV1beta2PriorityLevelConfigurationList", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "watchlist", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + }, + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ] + }, + "/apis/flowcontrol.apiserver.k8s.io/v1beta2/watch/prioritylevelconfigurations/{name}": { + "get": { + "consumes": [ + "*/*" + ], + "description": "watch changes to an object of kind PriorityLevelConfiguration. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.", + "operationId": "watchFlowcontrolApiserverV1beta2PriorityLevelConfiguration", + "produces": [ + "application/json", + "application/yaml", + "application/vnd.kubernetes.protobuf", + "application/json;stream=watch", + "application/vnd.kubernetes.protobuf;stream=watch" + ], + "responses": { + "200": { + "description": "OK", + "schema": { + "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" + } + }, + "401": { + "description": "Unauthorized" + } + }, + "schemes": [ + "https" + ], + "tags": [ + "flowcontrolApiserver_v1beta2" + ], + "x-kubernetes-action": "watch", + "x-kubernetes-group-version-kind": { + "group": "flowcontrol.apiserver.k8s.io", + "kind": "PriorityLevelConfiguration", + "version": "v1beta2" + } + }, + "parameters": [ + { + "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", + "in": "query", + "name": "allowWatchBookmarks", + "type": "boolean", + "uniqueItems": true + }, + { + "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", + "in": "query", + "name": "continue", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", + "in": "query", + "name": "fieldSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", + "in": "query", + "name": "labelSelector", + "type": "string", + "uniqueItems": true + }, + { + "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", + "in": "query", + "name": "limit", + "type": "integer", + "uniqueItems": true + }, + { + "description": "name of the PriorityLevelConfiguration", + "in": "path", + "name": "name", + "required": true, + "type": "string", + "uniqueItems": true + }, + { + "description": "If 'true', then the output is pretty printed.", + "in": "query", + "name": "pretty", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersion", + "type": "string", + "uniqueItems": true + }, + { + "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", + "in": "query", + "name": "resourceVersionMatch", + "type": "string", + "uniqueItems": true + }, + { + "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", + "in": "query", + "name": "timeoutSeconds", + "type": "integer", + "uniqueItems": true + }, + { + "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", + "in": "query", + "name": "watch", + "type": "boolean", + "uniqueItems": true + } + ] + }, "/apis/internal.apiserver.k8s.io/": { "get": { "consumes": [ @@ -64470,6 +70180,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -64677,6 +70394,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -64748,6 +70472,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -64871,6 +70602,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -64942,6 +70680,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -65537,6 +71282,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -65744,6 +71496,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -65815,6 +71574,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -66233,6 +71999,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -66448,6 +72221,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -66519,6 +72299,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -66650,6 +72437,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -66721,6 +72515,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -67028,6 +72829,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -67243,6 +73051,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -67314,6 +73129,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -68734,6 +74556,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -68941,6 +74770,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -69012,6 +74848,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -69574,6 +75417,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -69781,6 +75631,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -69852,6 +75709,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -70414,6 +76278,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -70621,6 +76492,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -70692,6 +76570,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -71295,6 +77180,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -71510,6 +77402,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -71581,6 +77480,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -71712,6 +77618,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -71783,6 +77696,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -72591,6 +78511,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -72806,6 +78733,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -72877,6 +78811,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -73008,6 +78949,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -73079,6 +79027,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -73489,6 +79444,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -73696,6 +79658,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -73767,6 +79736,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -74719,6 +80695,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -74926,6 +80909,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -74997,6 +80987,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -75296,6 +81293,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -75503,6 +81507,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -75574,6 +81585,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -75881,6 +81899,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -76096,6 +82121,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -76167,6 +82199,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -76474,6 +82513,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -76689,6 +82735,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -76760,6 +82813,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -78194,3775 +84254,6 @@ } ] }, - "/apis/rbac.authorization.k8s.io/v1alpha1/": { - "get": { - "consumes": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "description": "get available resources", - "operationId": "getRbacAuthorizationV1alpha1APIResources", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.APIResourceList" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ] - } - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/clusterrolebindings": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete collection of ClusterRoleBinding", - "operationId": "deleteRbacAuthorizationV1alpha1CollectionClusterRoleBinding", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "deletecollection", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBinding", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "list or watch objects of kind ClusterRoleBinding", - "operationId": "listRbacAuthorizationV1alpha1ClusterRoleBinding", - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBindingList" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "list", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBinding", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "post": { - "consumes": [ - "*/*" - ], - "description": "create a ClusterRoleBinding", - "operationId": "createRbacAuthorizationV1alpha1ClusterRoleBinding", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "post", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBinding", - "version": "v1alpha1" - } - } - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/clusterrolebindings/{name}": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete a ClusterRoleBinding", - "operationId": "deleteRbacAuthorizationV1alpha1ClusterRoleBinding", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "delete", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBinding", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "read the specified ClusterRoleBinding", - "operationId": "readRbacAuthorizationV1alpha1ClusterRoleBinding", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "get", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBinding", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "name of the ClusterRoleBinding", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "patch": { - "consumes": [ - "application/json-patch+json", - "application/merge-patch+json", - "application/strategic-merge-patch+json", - "application/apply-patch+yaml" - ], - "description": "partially update the specified ClusterRoleBinding", - "operationId": "patchRbacAuthorizationV1alpha1ClusterRoleBinding", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - }, - { - "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", - "in": "query", - "name": "force", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "patch", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBinding", - "version": "v1alpha1" - } - }, - "put": { - "consumes": [ - "*/*" - ], - "description": "replace the specified ClusterRoleBinding", - "operationId": "replaceRbacAuthorizationV1alpha1ClusterRoleBinding", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleBinding" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "put", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBinding", - "version": "v1alpha1" - } - } - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/clusterroles": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete collection of ClusterRole", - "operationId": "deleteRbacAuthorizationV1alpha1CollectionClusterRole", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "deletecollection", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRole", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "list or watch objects of kind ClusterRole", - "operationId": "listRbacAuthorizationV1alpha1ClusterRole", - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRoleList" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "list", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRole", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "post": { - "consumes": [ - "*/*" - ], - "description": "create a ClusterRole", - "operationId": "createRbacAuthorizationV1alpha1ClusterRole", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "post", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRole", - "version": "v1alpha1" - } - } - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/clusterroles/{name}": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete a ClusterRole", - "operationId": "deleteRbacAuthorizationV1alpha1ClusterRole", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "delete", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRole", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "read the specified ClusterRole", - "operationId": "readRbacAuthorizationV1alpha1ClusterRole", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "get", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRole", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "name of the ClusterRole", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "patch": { - "consumes": [ - "application/json-patch+json", - "application/merge-patch+json", - "application/strategic-merge-patch+json", - "application/apply-patch+yaml" - ], - "description": "partially update the specified ClusterRole", - "operationId": "patchRbacAuthorizationV1alpha1ClusterRole", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - }, - { - "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", - "in": "query", - "name": "force", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "patch", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRole", - "version": "v1alpha1" - } - }, - "put": { - "consumes": [ - "*/*" - ], - "description": "replace the specified ClusterRole", - "operationId": "replaceRbacAuthorizationV1alpha1ClusterRole", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.ClusterRole" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "put", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRole", - "version": "v1alpha1" - } - } - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/namespaces/{namespace}/rolebindings": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete collection of RoleBinding", - "operationId": "deleteRbacAuthorizationV1alpha1CollectionNamespacedRoleBinding", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "deletecollection", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "list or watch objects of kind RoleBinding", - "operationId": "listRbacAuthorizationV1alpha1NamespacedRoleBinding", - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBindingList" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "list", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "object name and auth scope, such as for teams and projects", - "in": "path", - "name": "namespace", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "post": { - "consumes": [ - "*/*" - ], - "description": "create a RoleBinding", - "operationId": "createRbacAuthorizationV1alpha1NamespacedRoleBinding", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "post", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - } - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/namespaces/{namespace}/rolebindings/{name}": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete a RoleBinding", - "operationId": "deleteRbacAuthorizationV1alpha1NamespacedRoleBinding", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "delete", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "read the specified RoleBinding", - "operationId": "readRbacAuthorizationV1alpha1NamespacedRoleBinding", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "get", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "name of the RoleBinding", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "object name and auth scope, such as for teams and projects", - "in": "path", - "name": "namespace", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "patch": { - "consumes": [ - "application/json-patch+json", - "application/merge-patch+json", - "application/strategic-merge-patch+json", - "application/apply-patch+yaml" - ], - "description": "partially update the specified RoleBinding", - "operationId": "patchRbacAuthorizationV1alpha1NamespacedRoleBinding", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - }, - { - "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", - "in": "query", - "name": "force", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "patch", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - }, - "put": { - "consumes": [ - "*/*" - ], - "description": "replace the specified RoleBinding", - "operationId": "replaceRbacAuthorizationV1alpha1NamespacedRoleBinding", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBinding" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "put", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - } - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/namespaces/{namespace}/roles": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete collection of Role", - "operationId": "deleteRbacAuthorizationV1alpha1CollectionNamespacedRole", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "deletecollection", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "list or watch objects of kind Role", - "operationId": "listRbacAuthorizationV1alpha1NamespacedRole", - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleList" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "list", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "object name and auth scope, such as for teams and projects", - "in": "path", - "name": "namespace", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "post": { - "consumes": [ - "*/*" - ], - "description": "create a Role", - "operationId": "createRbacAuthorizationV1alpha1NamespacedRole", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "post", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - } - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/namespaces/{namespace}/roles/{name}": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete a Role", - "operationId": "deleteRbacAuthorizationV1alpha1NamespacedRole", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "delete", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "read the specified Role", - "operationId": "readRbacAuthorizationV1alpha1NamespacedRole", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "get", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "name of the Role", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "object name and auth scope, such as for teams and projects", - "in": "path", - "name": "namespace", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "patch": { - "consumes": [ - "application/json-patch+json", - "application/merge-patch+json", - "application/strategic-merge-patch+json", - "application/apply-patch+yaml" - ], - "description": "partially update the specified Role", - "operationId": "patchRbacAuthorizationV1alpha1NamespacedRole", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - }, - { - "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", - "in": "query", - "name": "force", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "patch", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - }, - "put": { - "consumes": [ - "*/*" - ], - "description": "replace the specified Role", - "operationId": "replaceRbacAuthorizationV1alpha1NamespacedRole", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.Role" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "put", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - } - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/rolebindings": { - "get": { - "consumes": [ - "*/*" - ], - "description": "list or watch objects of kind RoleBinding", - "operationId": "listRbacAuthorizationV1alpha1RoleBindingForAllNamespaces", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleBindingList" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "list", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/roles": { - "get": { - "consumes": [ - "*/*" - ], - "description": "list or watch objects of kind Role", - "operationId": "listRbacAuthorizationV1alpha1RoleForAllNamespaces", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.rbac.v1alpha1.RoleList" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "list", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/watch/clusterrolebindings": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch individual changes to a list of ClusterRoleBinding. deprecated: use the 'watch' parameter with a list operation instead.", - "operationId": "watchRbacAuthorizationV1alpha1ClusterRoleBindingList", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "watchlist", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBinding", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/watch/clusterrolebindings/{name}": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch changes to an object of kind ClusterRoleBinding. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.", - "operationId": "watchRbacAuthorizationV1alpha1ClusterRoleBinding", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "watch", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRoleBinding", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "name of the ClusterRoleBinding", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/watch/clusterroles": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch individual changes to a list of ClusterRole. deprecated: use the 'watch' parameter with a list operation instead.", - "operationId": "watchRbacAuthorizationV1alpha1ClusterRoleList", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "watchlist", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRole", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/watch/clusterroles/{name}": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch changes to an object of kind ClusterRole. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.", - "operationId": "watchRbacAuthorizationV1alpha1ClusterRole", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "watch", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "ClusterRole", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "name of the ClusterRole", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/watch/namespaces/{namespace}/rolebindings": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch individual changes to a list of RoleBinding. deprecated: use the 'watch' parameter with a list operation instead.", - "operationId": "watchRbacAuthorizationV1alpha1NamespacedRoleBindingList", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "watchlist", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "object name and auth scope, such as for teams and projects", - "in": "path", - "name": "namespace", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/watch/namespaces/{namespace}/rolebindings/{name}": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch changes to an object of kind RoleBinding. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.", - "operationId": "watchRbacAuthorizationV1alpha1NamespacedRoleBinding", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "watch", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "name of the RoleBinding", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "object name and auth scope, such as for teams and projects", - "in": "path", - "name": "namespace", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/watch/namespaces/{namespace}/roles": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch individual changes to a list of Role. deprecated: use the 'watch' parameter with a list operation instead.", - "operationId": "watchRbacAuthorizationV1alpha1NamespacedRoleList", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "watchlist", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "object name and auth scope, such as for teams and projects", - "in": "path", - "name": "namespace", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/watch/namespaces/{namespace}/roles/{name}": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch changes to an object of kind Role. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.", - "operationId": "watchRbacAuthorizationV1alpha1NamespacedRole", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "watch", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "name of the Role", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "object name and auth scope, such as for teams and projects", - "in": "path", - "name": "namespace", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/watch/rolebindings": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch individual changes to a list of RoleBinding. deprecated: use the 'watch' parameter with a list operation instead.", - "operationId": "watchRbacAuthorizationV1alpha1RoleBindingListForAllNamespaces", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "watchlist", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "RoleBinding", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/rbac.authorization.k8s.io/v1alpha1/watch/roles": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch individual changes to a list of Role. deprecated: use the 'watch' parameter with a list operation instead.", - "operationId": "watchRbacAuthorizationV1alpha1RoleListForAllNamespaces", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "rbacAuthorization_v1alpha1" - ], - "x-kubernetes-action": "watchlist", - "x-kubernetes-group-version-kind": { - "group": "rbac.authorization.k8s.io", - "kind": "Role", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, "/apis/scheduling.k8s.io/": { "get": { "consumes": [ @@ -82290,6 +84581,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -82497,6 +84795,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -82568,6 +84873,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -82836,846 +85148,6 @@ } ] }, - "/apis/scheduling.k8s.io/v1alpha1/": { - "get": { - "consumes": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "description": "get available resources", - "operationId": "getSchedulingV1alpha1APIResources", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.APIResourceList" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "scheduling_v1alpha1" - ] - } - }, - "/apis/scheduling.k8s.io/v1alpha1/priorityclasses": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete collection of PriorityClass", - "operationId": "deleteSchedulingV1alpha1CollectionPriorityClass", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "scheduling_v1alpha1" - ], - "x-kubernetes-action": "deletecollection", - "x-kubernetes-group-version-kind": { - "group": "scheduling.k8s.io", - "kind": "PriorityClass", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "list or watch objects of kind PriorityClass", - "operationId": "listSchedulingV1alpha1PriorityClass", - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClassList" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "scheduling_v1alpha1" - ], - "x-kubernetes-action": "list", - "x-kubernetes-group-version-kind": { - "group": "scheduling.k8s.io", - "kind": "PriorityClass", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "post": { - "consumes": [ - "*/*" - ], - "description": "create a PriorityClass", - "operationId": "createSchedulingV1alpha1PriorityClass", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "scheduling_v1alpha1" - ], - "x-kubernetes-action": "post", - "x-kubernetes-group-version-kind": { - "group": "scheduling.k8s.io", - "kind": "PriorityClass", - "version": "v1alpha1" - } - } - }, - "/apis/scheduling.k8s.io/v1alpha1/priorityclasses/{name}": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete a PriorityClass", - "operationId": "deleteSchedulingV1alpha1PriorityClass", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "scheduling_v1alpha1" - ], - "x-kubernetes-action": "delete", - "x-kubernetes-group-version-kind": { - "group": "scheduling.k8s.io", - "kind": "PriorityClass", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "read the specified PriorityClass", - "operationId": "readSchedulingV1alpha1PriorityClass", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "scheduling_v1alpha1" - ], - "x-kubernetes-action": "get", - "x-kubernetes-group-version-kind": { - "group": "scheduling.k8s.io", - "kind": "PriorityClass", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "name of the PriorityClass", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "patch": { - "consumes": [ - "application/json-patch+json", - "application/merge-patch+json", - "application/strategic-merge-patch+json", - "application/apply-patch+yaml" - ], - "description": "partially update the specified PriorityClass", - "operationId": "patchSchedulingV1alpha1PriorityClass", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - }, - { - "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", - "in": "query", - "name": "force", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "scheduling_v1alpha1" - ], - "x-kubernetes-action": "patch", - "x-kubernetes-group-version-kind": { - "group": "scheduling.k8s.io", - "kind": "PriorityClass", - "version": "v1alpha1" - } - }, - "put": { - "consumes": [ - "*/*" - ], - "description": "replace the specified PriorityClass", - "operationId": "replaceSchedulingV1alpha1PriorityClass", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.scheduling.v1alpha1.PriorityClass" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "scheduling_v1alpha1" - ], - "x-kubernetes-action": "put", - "x-kubernetes-group-version-kind": { - "group": "scheduling.k8s.io", - "kind": "PriorityClass", - "version": "v1alpha1" - } - } - }, - "/apis/scheduling.k8s.io/v1alpha1/watch/priorityclasses": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch individual changes to a list of PriorityClass. deprecated: use the 'watch' parameter with a list operation instead.", - "operationId": "watchSchedulingV1alpha1PriorityClassList", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "scheduling_v1alpha1" - ], - "x-kubernetes-action": "watchlist", - "x-kubernetes-group-version-kind": { - "group": "scheduling.k8s.io", - "kind": "PriorityClass", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/scheduling.k8s.io/v1alpha1/watch/priorityclasses/{name}": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch changes to an object of kind PriorityClass. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.", - "operationId": "watchSchedulingV1alpha1PriorityClass", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "scheduling_v1alpha1" - ], - "x-kubernetes-action": "watch", - "x-kubernetes-group-version-kind": { - "group": "scheduling.k8s.io", - "kind": "PriorityClass", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "name of the PriorityClass", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, "/apis/storage.k8s.io/": { "get": { "consumes": [ @@ -84003,6 +85475,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -84210,6 +85689,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -84281,6 +85767,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -84580,6 +86073,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -84787,6 +86287,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -84858,6 +86365,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -85157,6 +86671,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -85364,6 +86885,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -85435,6 +86963,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -85734,6 +87269,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -85941,6 +87483,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -86012,6 +87561,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -86135,6 +87691,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -86206,6 +87769,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -87577,6 +89147,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -87792,6 +89369,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -87863,6 +89447,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -87901,583 +89492,6 @@ } } }, - "/apis/storage.k8s.io/v1alpha1/volumeattachments": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete collection of VolumeAttachment", - "operationId": "deleteStorageV1alpha1CollectionVolumeAttachment", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Status" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "storage_v1alpha1" - ], - "x-kubernetes-action": "deletecollection", - "x-kubernetes-group-version-kind": { - "group": "storage.k8s.io", - "kind": "VolumeAttachment", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "list or watch objects of kind VolumeAttachment", - "operationId": "listStorageV1alpha1VolumeAttachment", - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachmentList" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "storage_v1alpha1" - ], - "x-kubernetes-action": "list", - "x-kubernetes-group-version-kind": { - "group": "storage.k8s.io", - "kind": "VolumeAttachment", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "post": { - "consumes": [ - "*/*" - ], - "description": "create a VolumeAttachment", - "operationId": "createStorageV1alpha1VolumeAttachment", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "storage_v1alpha1" - ], - "x-kubernetes-action": "post", - "x-kubernetes-group-version-kind": { - "group": "storage.k8s.io", - "kind": "VolumeAttachment", - "version": "v1alpha1" - } - } - }, - "/apis/storage.k8s.io/v1alpha1/volumeattachments/{name}": { - "delete": { - "consumes": [ - "*/*" - ], - "description": "delete a VolumeAttachment", - "operationId": "deleteStorageV1alpha1VolumeAttachment", - "parameters": [ - { - "in": "body", - "name": "body", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.DeleteOptions" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.", - "in": "query", - "name": "gracePeriodSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.", - "in": "query", - "name": "orphanDependents", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.", - "in": "query", - "name": "propagationPolicy", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - "202": { - "description": "Accepted", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "storage_v1alpha1" - ], - "x-kubernetes-action": "delete", - "x-kubernetes-group-version-kind": { - "group": "storage.k8s.io", - "kind": "VolumeAttachment", - "version": "v1alpha1" - } - }, - "get": { - "consumes": [ - "*/*" - ], - "description": "read the specified VolumeAttachment", - "operationId": "readStorageV1alpha1VolumeAttachment", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "storage_v1alpha1" - ], - "x-kubernetes-action": "get", - "x-kubernetes-group-version-kind": { - "group": "storage.k8s.io", - "kind": "VolumeAttachment", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "name of the VolumeAttachment", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - } - ], - "patch": { - "consumes": [ - "application/json-patch+json", - "application/merge-patch+json", - "application/strategic-merge-patch+json", - "application/apply-patch+yaml" - ], - "description": "partially update the specified VolumeAttachment", - "operationId": "patchStorageV1alpha1VolumeAttachment", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.Patch" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - }, - { - "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", - "in": "query", - "name": "force", - "type": "boolean", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "storage_v1alpha1" - ], - "x-kubernetes-action": "patch", - "x-kubernetes-group-version-kind": { - "group": "storage.k8s.io", - "kind": "VolumeAttachment", - "version": "v1alpha1" - } - }, - "put": { - "consumes": [ - "*/*" - ], - "description": "replace the specified VolumeAttachment", - "operationId": "replaceStorageV1alpha1VolumeAttachment", - "parameters": [ - { - "in": "body", - "name": "body", - "required": true, - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - { - "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed", - "in": "query", - "name": "dryRun", - "type": "string", - "uniqueItems": true - }, - { - "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.", - "in": "query", - "name": "fieldManager", - "type": "string", - "uniqueItems": true - } - ], - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - "201": { - "description": "Created", - "schema": { - "$ref": "#/definitions/io.k8s.api.storage.v1alpha1.VolumeAttachment" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "storage_v1alpha1" - ], - "x-kubernetes-action": "put", - "x-kubernetes-group-version-kind": { - "group": "storage.k8s.io", - "kind": "VolumeAttachment", - "version": "v1alpha1" - } - } - }, "/apis/storage.k8s.io/v1alpha1/watch/csistoragecapacities": { "get": { "consumes": [ @@ -88835,236 +89849,6 @@ } ] }, - "/apis/storage.k8s.io/v1alpha1/watch/volumeattachments": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch individual changes to a list of VolumeAttachment. deprecated: use the 'watch' parameter with a list operation instead.", - "operationId": "watchStorageV1alpha1VolumeAttachmentList", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "storage_v1alpha1" - ], - "x-kubernetes-action": "watchlist", - "x-kubernetes-group-version-kind": { - "group": "storage.k8s.io", - "kind": "VolumeAttachment", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, - "/apis/storage.k8s.io/v1alpha1/watch/volumeattachments/{name}": { - "get": { - "consumes": [ - "*/*" - ], - "description": "watch changes to an object of kind VolumeAttachment. deprecated: use the 'watch' parameter with a list operation instead, filtered to a single item with the 'fieldSelector' parameter.", - "operationId": "watchStorageV1alpha1VolumeAttachment", - "produces": [ - "application/json", - "application/yaml", - "application/vnd.kubernetes.protobuf", - "application/json;stream=watch", - "application/vnd.kubernetes.protobuf;stream=watch" - ], - "responses": { - "200": { - "description": "OK", - "schema": { - "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.WatchEvent" - } - }, - "401": { - "description": "Unauthorized" - } - }, - "schemes": [ - "https" - ], - "tags": [ - "storage_v1alpha1" - ], - "x-kubernetes-action": "watch", - "x-kubernetes-group-version-kind": { - "group": "storage.k8s.io", - "kind": "VolumeAttachment", - "version": "v1alpha1" - } - }, - "parameters": [ - { - "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.", - "in": "query", - "name": "allowWatchBookmarks", - "type": "boolean", - "uniqueItems": true - }, - { - "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.", - "in": "query", - "name": "continue", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.", - "in": "query", - "name": "fieldSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.", - "in": "query", - "name": "labelSelector", - "type": "string", - "uniqueItems": true - }, - { - "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.", - "in": "query", - "name": "limit", - "type": "integer", - "uniqueItems": true - }, - { - "description": "name of the VolumeAttachment", - "in": "path", - "name": "name", - "required": true, - "type": "string", - "uniqueItems": true - }, - { - "description": "If 'true', then the output is pretty printed.", - "in": "query", - "name": "pretty", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersion", - "type": "string", - "uniqueItems": true - }, - { - "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset", - "in": "query", - "name": "resourceVersionMatch", - "type": "string", - "uniqueItems": true - }, - { - "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.", - "in": "query", - "name": "timeoutSeconds", - "type": "integer", - "uniqueItems": true - }, - { - "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.", - "in": "query", - "name": "watch", - "type": "boolean", - "uniqueItems": true - } - ] - }, "/apis/storage.k8s.io/v1beta1/": { "get": { "consumes": [ @@ -89478,6 +90262,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ @@ -89693,6 +90484,13 @@ "type": "string", "uniqueItems": true }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true + }, { "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.", "in": "query", @@ -89764,6 +90562,13 @@ "name": "fieldManager", "type": "string", "uniqueItems": true + }, + { + "description": "fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields.", + "in": "query", + "name": "fieldValidation", + "type": "string", + "uniqueItems": true } ], "produces": [ diff --git a/api-ref-assets/config/fields.yaml b/api-ref-assets/config/fields.yaml index 9f6e23f939..25b0588619 100644 --- a/api-ref-assets/config/fields.yaml +++ b/api-ref-assets/config/fields.yaml @@ -6,6 +6,7 @@ - initContainers - imagePullSecrets - enableServiceLinks + - os - name: Volumes fields: - volumes @@ -154,6 +155,7 @@ - timeoutSeconds - failureThreshold - successThreshold + - grpc - definition: io.k8s.api.core.v1.SecurityContext field_categories: @@ -313,6 +315,7 @@ - revisionHistoryLimit - volumeClaimTemplates - minReadySeconds + - persistentVolumeClaimRetentionPolicy - definition: io.k8s.api.apps.v1.StatefulSetUpdateStrategy field_categories: @@ -393,6 +396,9 @@ - completedIndexes - conditions - uncountedTerminatedPods + - name: Alpha level + fields: + - ready - definition: io.k8s.api.batch.v1.CronJobSpec field_categories: @@ -421,6 +427,22 @@ - value - periodSeconds +- definition: io.k8s.api.autoscaling.v2.HorizontalPodAutoscalerSpec + field_categories: + - fields: + - maxReplicas + - scaleTargetRef + - minReplicas + - behavior + - metrics + +- definition: io.k8s.api.autoscaling.v2.HPAScalingPolicy + field_categories: + - fields: + - type + - value + - periodSeconds + - definition: io.k8s.api.core.v1.ServiceSpec field_categories: - fields: diff --git a/api-ref-assets/config/toc.yaml b/api-ref-assets/config/toc.yaml index 5c4efa8982..8184af24b9 100644 --- a/api-ref-assets/config/toc.yaml +++ b/api-ref-assets/config/toc.yaml @@ -23,7 +23,7 @@ parts: - PodSpec - Container - EphemeralContainer - - Handler + - LifecycleHandler - NodeAffinity - PodAffinity - PodAntiAffinity @@ -60,6 +60,9 @@ parts: - name: HorizontalPodAutoscaler group: autoscaling version: v1 + - name: HorizontalPodAutoscaler + group: autoscaling + version: v2 - name: HorizontalPodAutoscaler group: autoscaling version: v2beta2 @@ -217,10 +220,10 @@ parts: version: v1 - name: FlowSchema group: flowcontrol.apiserver.k8s.io - version: v1beta1 + version: v1beta2 - name: PriorityLevelConfiguration group: flowcontrol.apiserver.k8s.io - version: v1beta1 + version: v1beta2 - name: Binding group: "" version: v1 diff --git a/content/en/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1.md b/content/en/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1.md index a02b668387..dedb2c4d96 100644 --- a/content/en/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1.md +++ b/content/en/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1.md @@ -212,6 +212,11 @@ CertificateSigningRequestStatus contains conditions used to indicate approved/de Approved and Denied conditions are mutually exclusive. Approved, Denied, and Failed conditions cannot be removed once added. Only one condition of a given type is allowed. + + Possible enum values: + - `"Approved"` Approved indicates the request was approved and should be issued by the signer. + - `"Denied"` Denied indicates the request was denied and should not be issued by the signer. + - `"Failed"` Failed indicates the signer failed to issue the certificate. - **conditions.lastTransitionTime** (Time) @@ -449,6 +454,11 @@ POST /apis/certificates.k8s.io/v1/certificatesigningrequests }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -496,6 +506,11 @@ PUT /apis/certificates.k8s.io/v1/certificatesigningrequests/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -541,6 +556,11 @@ PUT /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}/approval }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -586,6 +606,11 @@ PUT /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -631,6 +656,11 @@ PATCH /apis/certificates.k8s.io/v1/certificatesigningrequests/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -681,6 +711,11 @@ PATCH /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}/approval }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -731,6 +766,11 @@ PATCH /apis/certificates.k8s.io/v1/certificatesigningrequests/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/authentication-resources/service-account-v1.md b/content/en/docs/reference/kubernetes-api/authentication-resources/service-account-v1.md index 250bc29d07..2b676969a8 100644 --- a/content/en/docs/reference/kubernetes-api/authentication-resources/service-account-v1.md +++ b/content/en/docs/reference/kubernetes-api/authentication-resources/service-account-v1.md @@ -298,6 +298,11 @@ POST /api/v1/namespaces/{namespace}/serviceaccounts }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -350,6 +355,11 @@ PUT /api/v1/namespaces/{namespace}/serviceaccounts/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -400,6 +410,11 @@ PATCH /api/v1/namespaces/{namespace}/serviceaccounts/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/authentication-resources/token-request-v1.md b/content/en/docs/reference/kubernetes-api/authentication-resources/token-request-v1.md index f215074e82..3e448846f6 100644 --- a/content/en/docs/reference/kubernetes-api/authentication-resources/token-request-v1.md +++ b/content/en/docs/reference/kubernetes-api/authentication-resources/token-request-v1.md @@ -161,6 +161,11 @@ POST /api/v1/namespaces/{namespace}/serviceaccounts/{name}/token }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty diff --git a/content/en/docs/reference/kubernetes-api/authentication-resources/token-review-v1.md b/content/en/docs/reference/kubernetes-api/authentication-resources/token-review-v1.md index 8740fb27a4..2e21803aa6 100644 --- a/content/en/docs/reference/kubernetes-api/authentication-resources/token-review-v1.md +++ b/content/en/docs/reference/kubernetes-api/authentication-resources/token-review-v1.md @@ -152,6 +152,11 @@ POST /apis/authentication.k8s.io/v1/tokenreviews }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty diff --git a/content/en/docs/reference/kubernetes-api/authorization-resources/cluster-role-binding-v1.md b/content/en/docs/reference/kubernetes-api/authorization-resources/cluster-role-binding-v1.md index 993148295b..610f221730 100644 --- a/content/en/docs/reference/kubernetes-api/authorization-resources/cluster-role-binding-v1.md +++ b/content/en/docs/reference/kubernetes-api/authorization-resources/cluster-role-binding-v1.md @@ -243,6 +243,11 @@ POST /apis/rbac.authorization.k8s.io/v1/clusterrolebindings }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -290,6 +295,11 @@ PUT /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -335,6 +345,11 @@ PATCH /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1.md b/content/en/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1.md index 307d6ffff0..ab7a7c7efd 100644 --- a/content/en/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1.md +++ b/content/en/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1.md @@ -70,7 +70,7 @@ ClusterRole is a cluster level, logical grouping of PolicyRules that can be refe - **rules.verbs** ([]string), required - Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. '*' represents all verbs. + Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs. - **rules.resourceNames** ([]string) @@ -239,6 +239,11 @@ POST /apis/rbac.authorization.k8s.io/v1/clusterroles }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -286,6 +291,11 @@ PUT /apis/rbac.authorization.k8s.io/v1/clusterroles/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -331,6 +341,11 @@ PATCH /apis/rbac.authorization.k8s.io/v1/clusterroles/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/authorization-resources/local-subject-access-review-v1.md b/content/en/docs/reference/kubernetes-api/authorization-resources/local-subject-access-review-v1.md index d1a61db7d6..6f786078e7 100644 --- a/content/en/docs/reference/kubernetes-api/authorization-resources/local-subject-access-review-v1.md +++ b/content/en/docs/reference/kubernetes-api/authorization-resources/local-subject-access-review-v1.md @@ -94,6 +94,11 @@ POST /apis/authorization.k8s.io/v1/namespaces/{namespace}/localsubjectaccessrevi }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty diff --git a/content/en/docs/reference/kubernetes-api/authorization-resources/role-binding-v1.md b/content/en/docs/reference/kubernetes-api/authorization-resources/role-binding-v1.md index f02dcee05a..2c40ba4df7 100644 --- a/content/en/docs/reference/kubernetes-api/authorization-resources/role-binding-v1.md +++ b/content/en/docs/reference/kubernetes-api/authorization-resources/role-binding-v1.md @@ -326,6 +326,11 @@ POST /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -378,6 +383,11 @@ PUT /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings/{name }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -428,6 +438,11 @@ PATCH /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolebindings/{na }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/authorization-resources/role-v1.md b/content/en/docs/reference/kubernetes-api/authorization-resources/role-v1.md index d96769ef24..8e4840c0f9 100644 --- a/content/en/docs/reference/kubernetes-api/authorization-resources/role-v1.md +++ b/content/en/docs/reference/kubernetes-api/authorization-resources/role-v1.md @@ -59,7 +59,7 @@ Role is a namespaced, logical grouping of PolicyRules that can be referenced as - **rules.verbs** ([]string), required - Verbs is a list of Verbs that apply to ALL the ResourceKinds and AttributeRestrictions contained in this rule. '*' represents all verbs. + Verbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs. - **rules.resourceNames** ([]string) @@ -311,6 +311,11 @@ POST /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -363,6 +368,11 @@ PUT /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -413,6 +423,11 @@ PATCH /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/authorization-resources/self-subject-access-review-v1.md b/content/en/docs/reference/kubernetes-api/authorization-resources/self-subject-access-review-v1.md index a8496aab72..cfce75947e 100644 --- a/content/en/docs/reference/kubernetes-api/authorization-resources/self-subject-access-review-v1.md +++ b/content/en/docs/reference/kubernetes-api/authorization-resources/self-subject-access-review-v1.md @@ -149,6 +149,11 @@ POST /apis/authorization.k8s.io/v1/selfsubjectaccessreviews }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty diff --git a/content/en/docs/reference/kubernetes-api/authorization-resources/self-subject-rules-review-v1.md b/content/en/docs/reference/kubernetes-api/authorization-resources/self-subject-rules-review-v1.md index f8d85dc23c..1e862f5a02 100644 --- a/content/en/docs/reference/kubernetes-api/authorization-resources/self-subject-rules-review-v1.md +++ b/content/en/docs/reference/kubernetes-api/authorization-resources/self-subject-rules-review-v1.md @@ -153,6 +153,11 @@ POST /apis/authorization.k8s.io/v1/selfsubjectrulesreviews }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty diff --git a/content/en/docs/reference/kubernetes-api/authorization-resources/subject-access-review-v1.md b/content/en/docs/reference/kubernetes-api/authorization-resources/subject-access-review-v1.md index cae105ba24..85e304d3ba 100644 --- a/content/en/docs/reference/kubernetes-api/authorization-resources/subject-access-review-v1.md +++ b/content/en/docs/reference/kubernetes-api/authorization-resources/subject-access-review-v1.md @@ -191,6 +191,11 @@ POST /apis/authorization.k8s.io/v1/subjectaccessreviews }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/api-service-v1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/api-service-v1.md index 9f06c7b3fe..81a7620d08 100644 --- a/content/en/docs/reference/kubernetes-api/cluster-resources/api-service-v1.md +++ b/content/en/docs/reference/kubernetes-api/cluster-resources/api-service-v1.md @@ -336,6 +336,11 @@ POST /apis/apiregistration.k8s.io/v1/apiservices }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -383,6 +388,11 @@ PUT /apis/apiregistration.k8s.io/v1/apiservices/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -428,6 +438,11 @@ PUT /apis/apiregistration.k8s.io/v1/apiservices/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -473,6 +488,11 @@ PATCH /apis/apiregistration.k8s.io/v1/apiservices/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -523,6 +543,11 @@ PATCH /apis/apiregistration.k8s.io/v1/apiservices/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/binding-v1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/binding-v1.md index 4acdf07c98..f9115c9ad5 100644 --- a/content/en/docs/reference/kubernetes-api/cluster-resources/binding-v1.md +++ b/content/en/docs/reference/kubernetes-api/cluster-resources/binding-v1.md @@ -90,6 +90,11 @@ POST /api/v1/namespaces/{namespace}/bindings }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -142,6 +147,11 @@ POST /api/v1/namespaces/{namespace}/pods/{name}/binding }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/event-v1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/event-v1.md index 644496e7f0..20ed36b1ab 100644 --- a/content/en/docs/reference/kubernetes-api/cluster-resources/event-v1.md +++ b/content/en/docs/reference/kubernetes-api/cluster-resources/event-v1.md @@ -374,6 +374,11 @@ POST /apis/events.k8s.io/v1/namespaces/{namespace}/events }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -426,6 +431,11 @@ PUT /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -476,6 +486,11 @@ PATCH /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/flow-schema-v1beta1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/flow-schema-v1beta2.md similarity index 86% rename from content/en/docs/reference/kubernetes-api/cluster-resources/flow-schema-v1beta1.md rename to content/en/docs/reference/kubernetes-api/cluster-resources/flow-schema-v1beta2.md index 0df4386eb1..7acb4ac527 100644 --- a/content/en/docs/reference/kubernetes-api/cluster-resources/flow-schema-v1beta1.md +++ b/content/en/docs/reference/kubernetes-api/cluster-resources/flow-schema-v1beta2.md @@ -1,11 +1,11 @@ --- api_metadata: - apiVersion: "flowcontrol.apiserver.k8s.io/v1beta1" - import: "k8s.io/api/flowcontrol/v1beta1" + apiVersion: "flowcontrol.apiserver.k8s.io/v1beta2" + import: "k8s.io/api/flowcontrol/v1beta2" kind: "FlowSchema" content_type: "api_reference" description: "FlowSchema defines the schema of a group of flows." -title: "FlowSchema v1beta1" +title: "FlowSchema v1beta2" weight: 7 auto_generated: true --- @@ -21,9 +21,9 @@ guide. You can file document formatting bugs against the [reference-docs](https://github.com/kubernetes-sigs/reference-docs/) project. --> -`apiVersion: flowcontrol.apiserver.k8s.io/v1beta1` +`apiVersion: flowcontrol.apiserver.k8s.io/v1beta2` -`import "k8s.io/api/flowcontrol/v1beta1"` +`import "k8s.io/api/flowcontrol/v1beta2"` ## FlowSchema {#FlowSchema} @@ -32,7 +32,7 @@ FlowSchema defines the schema of a group of flows. Note that a flow is made up o
    -- **apiVersion**: flowcontrol.apiserver.k8s.io/v1beta1 +- **apiVersion**: flowcontrol.apiserver.k8s.io/v1beta2 - **kind**: FlowSchema @@ -42,11 +42,11 @@ FlowSchema defines the schema of a group of flows. Note that a flow is made up o `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata -- **spec** (}}">FlowSchemaSpec) +- **spec** (}}">FlowSchemaSpec) `spec` is the specification of the desired behavior of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status -- **status** (}}">FlowSchemaStatus) +- **status** (}}">FlowSchemaStatus) `status` is the current status of a FlowSchema. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status @@ -179,7 +179,7 @@ FlowSchemaSpec describes how the FlowSchema's specification looks like. `resourceRules` is a slice of ResourcePolicyRules that identify matching requests according to their verb and the target resource. At least one of `resourceRules` and `nonResourceRules` has to be non-empty. - *ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) least one member of namespaces matches the request.* + *ResourcePolicyRule is a predicate that matches some resource requests, testing the request's verb and the target resource. A ResourcePolicyRule matches a resource request if and only if: (a) at least one member of verbs matches the request, (b) at least one member of apiGroups matches the request, (c) at least one member of resources matches the request, and (d) either (d1) the request does not specify a namespace (i.e., `Namespace==""`) and clusterScope is true or (d2) the request specifies a namespace and least one member of namespaces matches the request's namespace.* - **rules.resourceRules.apiGroups** ([]string), required @@ -261,7 +261,7 @@ FlowSchemaList is a list of FlowSchema objects.
    -- **apiVersion**: flowcontrol.apiserver.k8s.io/v1beta1 +- **apiVersion**: flowcontrol.apiserver.k8s.io/v1beta2 - **kind**: FlowSchemaList @@ -271,7 +271,7 @@ FlowSchemaList is a list of FlowSchema objects. `metadata` is the standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata -- **items** ([]}}">FlowSchema), required +- **items** ([]}}">FlowSchema), required `items` is a list of FlowSchemas. @@ -294,7 +294,7 @@ FlowSchemaList is a list of FlowSchema objects. #### HTTP Request -GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +GET /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/{name} #### Parameters @@ -313,7 +313,7 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} #### Response -200 (}}">FlowSchema): OK +200 (}}">FlowSchema): OK 401: Unauthorized @@ -322,7 +322,7 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} #### HTTP Request -GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status +GET /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/{name}/status #### Parameters @@ -341,7 +341,7 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status #### Response -200 (}}">FlowSchema): OK +200 (}}">FlowSchema): OK 401: Unauthorized @@ -350,7 +350,7 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status #### HTTP Request -GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas +GET /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas #### Parameters @@ -409,7 +409,7 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas #### Response -200 (}}">FlowSchemaList): OK +200 (}}">FlowSchemaList): OK 401: Unauthorized @@ -418,12 +418,12 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas #### HTTP Request -POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas +POST /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas #### Parameters -- **body**: }}">FlowSchema, required +- **body**: }}">FlowSchema, required @@ -438,6 +438,11 @@ POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -447,11 +452,11 @@ POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas #### Response -200 (}}">FlowSchema): OK +200 (}}">FlowSchema): OK -201 (}}">FlowSchema): Created +201 (}}">FlowSchema): Created -202 (}}">FlowSchema): Accepted +202 (}}">FlowSchema): Accepted 401: Unauthorized @@ -460,7 +465,7 @@ POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas #### HTTP Request -PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/{name} #### Parameters @@ -470,7 +475,7 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} name of the FlowSchema -- **body**: }}">FlowSchema, required +- **body**: }}">FlowSchema, required @@ -485,6 +490,11 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -494,9 +504,9 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} #### Response -200 (}}">FlowSchema): OK +200 (}}">FlowSchema): OK -201 (}}">FlowSchema): Created +201 (}}">FlowSchema): Created 401: Unauthorized @@ -505,7 +515,7 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} #### HTTP Request -PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/{name}/status #### Parameters @@ -515,7 +525,7 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status name of the FlowSchema -- **body**: }}">FlowSchema, required +- **body**: }}">FlowSchema, required @@ -530,6 +540,11 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -539,9 +554,9 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status #### Response -200 (}}">FlowSchema): OK +200 (}}">FlowSchema): OK -201 (}}">FlowSchema): Created +201 (}}">FlowSchema): Created 401: Unauthorized @@ -550,7 +565,7 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status #### HTTP Request -PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/{name} #### Parameters @@ -575,6 +590,11 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -589,9 +609,9 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} #### Response -200 (}}">FlowSchema): OK +200 (}}">FlowSchema): OK -201 (}}">FlowSchema): Created +201 (}}">FlowSchema): Created 401: Unauthorized @@ -600,7 +620,7 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} #### HTTP Request -PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/{name}/status #### Parameters @@ -625,6 +645,11 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -639,9 +664,9 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status #### Response -200 (}}">FlowSchema): OK +200 (}}">FlowSchema): OK -201 (}}">FlowSchema): Created +201 (}}">FlowSchema): Created 401: Unauthorized @@ -650,7 +675,7 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name}/status #### HTTP Request -DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas/{name} #### Parameters @@ -700,7 +725,7 @@ DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas/{name} #### HTTP Request -DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/flowschemas +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta2/flowschemas #### Parameters diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/lease-v1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/lease-v1.md index 4db3251991..b33e8ee19a 100644 --- a/content/en/docs/reference/kubernetes-api/cluster-resources/lease-v1.md +++ b/content/en/docs/reference/kubernetes-api/cluster-resources/lease-v1.md @@ -324,6 +324,11 @@ POST /apis/coordination.k8s.io/v1/namespaces/{namespace}/leases }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -376,6 +381,11 @@ PUT /apis/coordination.k8s.io/v1/namespaces/{namespace}/leases/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -426,6 +436,11 @@ PATCH /apis/coordination.k8s.io/v1/namespaces/{namespace}/leases/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/namespace-v1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/namespace-v1.md index 8ae6934385..7dc5b03f9a 100644 --- a/content/en/docs/reference/kubernetes-api/cluster-resources/namespace-v1.md +++ b/content/en/docs/reference/kubernetes-api/cluster-resources/namespace-v1.md @@ -90,6 +90,13 @@ NamespaceStatus is information about the current status of a Namespace. - **conditions.type** (string), required Type of namespace controller condition. + + Possible enum values: + - `"NamespaceContentRemaining"` contains information about resources remaining in a namespace. + - `"NamespaceDeletionContentFailure"` contains information about namespace deleter errors during deletion of resources. + - `"NamespaceDeletionDiscoveryFailure"` contains information about namespace deleter errors during resource discovery. + - `"NamespaceDeletionGroupVersionParsingFailure"` contains information about namespace deleter errors parsing GV for legacy types. + - `"NamespaceFinalizersRemaining"` contains information about which finalizers are on resources remaining in a namespace. - **conditions.lastTransitionTime** (Time) @@ -106,6 +113,10 @@ NamespaceStatus is information about the current status of a Namespace. - **phase** (string) Phase is the current lifecycle phase of the namespace. More info: https://kubernetes.io/docs/tasks/administer-cluster/namespaces/ + + Possible enum values: + - `"Active"` means the namespace is available for use in the system + - `"Terminating"` means the namespace is undergoing graceful termination @@ -294,6 +305,11 @@ POST /api/v1/namespaces }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -341,6 +357,11 @@ PUT /api/v1/namespaces/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -386,6 +407,11 @@ PUT /api/v1/namespaces/{name}/finalize }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -431,6 +457,11 @@ PUT /api/v1/namespaces/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -476,6 +507,11 @@ PATCH /api/v1/namespaces/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -526,6 +562,11 @@ PATCH /api/v1/namespaces/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/node-v1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/node-v1.md index 0046895782..0590545441 100644 --- a/content/en/docs/reference/kubernetes-api/cluster-resources/node-v1.md +++ b/content/en/docs/reference/kubernetes-api/cluster-resources/node-v1.md @@ -120,6 +120,11 @@ NodeSpec describes the attributes that a node is created with. - **taints.effect** (string), required Required. The effect of the taint on pods that do not tolerate the taint. Valid effects are NoSchedule, PreferNoSchedule and NoExecute. + + Possible enum values: + - `"NoExecute"` Evict any already-running pods that do not tolerate the taint. Currently enforced by NodeController. + - `"NoSchedule"` Do not allow new pods to schedule onto the node unless they tolerate the taint, but allow all pods submitted to Kubelet without going through the scheduler to start, and allow all already-running pods to continue running. Enforced by the scheduler. + - `"PreferNoSchedule"` Like TaintEffectNoSchedule, but the scheduler tries not to schedule new pods onto the node, rather than prohibiting new pods from scheduling onto the node entirely. Enforced by the scheduler. - **taints.key** (string), required @@ -166,6 +171,13 @@ NodeStatus is information about the current status of a node. - **addresses.type** (string), required Node address type, one of Hostname, ExternalIP or InternalIP. + + Possible enum values: + - `"ExternalDNS"` identifies a DNS name which resolves to an IP address which has the characteristics of a NodeExternalIP. The IP it resolves to may or may not be a listed NodeExternalIP address. + - `"ExternalIP"` identifies an IP address which is, in some way, intended to be more usable from outside the cluster then an internal IP, though no specific semantics are defined. It may be a globally routable IP, though it is not required to be. External IPs may be assigned directly to an interface on the node, like a NodeInternalIP, or alternatively, packets sent to the external IP may be NAT'ed to an internal node IP rather than being delivered directly (making the IP less efficient for node-to-node traffic than a NodeInternalIP). + - `"Hostname"` identifies a name of the node. Although every node can be assumed to have a NodeAddress of this type, its exact syntax and semantics are not defined, and are not consistent between different clusters. + - `"InternalDNS"` identifies a DNS name which resolves to an IP address which has the characteristics of a NodeInternalIP. The IP it resolves to may or may not be a listed NodeInternalIP address. + - `"InternalIP"` identifies an IP address which is assigned to one of the node's network interfaces. Every node should have at least one address of this type. An internal IP is normally expected to be reachable from every other node, but may not be visible to hosts outside the cluster. By default it is assumed that kube-apiserver can reach node internal IPs, though it is possible to configure clusters where this is not the case. NodeInternalIP is the default type of node IP, and does not necessarily imply that the IP is ONLY reachable internally. If a node has multiple internal IPs, no specific semantics are assigned to the additional IPs. - **allocatable** (map[string]}}">Quantity) @@ -191,6 +203,13 @@ NodeStatus is information about the current status of a node. - **conditions.type** (string), required Type of node condition. + + Possible enum values: + - `"DiskPressure"` means the kubelet is under pressure due to insufficient available disk. + - `"MemoryPressure"` means the kubelet is under pressure due to insufficient available memory. + - `"NetworkUnavailable"` means that network for the node is not correctly configured. + - `"PIDPressure"` means the kubelet is under pressure due to insufficient available PID. + - `"Ready"` means kubelet is healthy and ready to accept pods. - **conditions.lastHeartbeatTime** (Time) @@ -410,6 +429,11 @@ NodeStatus is information about the current status of a node. - **phase** (string) NodePhase is the recently observed lifecycle phase of the node. More info: https://kubernetes.io/docs/concepts/nodes/node/#phase The field is never populated, and now is deprecated. + + Possible enum values: + - `"Pending"` means the node has been created/added by the system, but not configured. + - `"Running"` means the node has been configured and has Kubernetes components running. + - `"Terminated"` means the node has been removed from the cluster. - **volumesAttached** ([]AttachedVolume) @@ -617,6 +641,11 @@ POST /api/v1/nodes }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -664,6 +693,11 @@ PUT /api/v1/nodes/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -709,6 +743,11 @@ PUT /api/v1/nodes/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -754,6 +793,11 @@ PATCH /api/v1/nodes/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -804,6 +848,11 @@ PATCH /api/v1/nodes/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/priority-level-configuration-v1beta1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/priority-level-configuration-v1beta2.md similarity index 85% rename from content/en/docs/reference/kubernetes-api/cluster-resources/priority-level-configuration-v1beta1.md rename to content/en/docs/reference/kubernetes-api/cluster-resources/priority-level-configuration-v1beta2.md index eda105ab73..bc436fb579 100644 --- a/content/en/docs/reference/kubernetes-api/cluster-resources/priority-level-configuration-v1beta1.md +++ b/content/en/docs/reference/kubernetes-api/cluster-resources/priority-level-configuration-v1beta2.md @@ -1,11 +1,11 @@ --- api_metadata: - apiVersion: "flowcontrol.apiserver.k8s.io/v1beta1" - import: "k8s.io/api/flowcontrol/v1beta1" + apiVersion: "flowcontrol.apiserver.k8s.io/v1beta2" + import: "k8s.io/api/flowcontrol/v1beta2" kind: "PriorityLevelConfiguration" content_type: "api_reference" description: "PriorityLevelConfiguration represents the configuration of a priority level." -title: "PriorityLevelConfiguration v1beta1" +title: "PriorityLevelConfiguration v1beta2" weight: 8 auto_generated: true --- @@ -21,9 +21,9 @@ guide. You can file document formatting bugs against the [reference-docs](https://github.com/kubernetes-sigs/reference-docs/) project. --> -`apiVersion: flowcontrol.apiserver.k8s.io/v1beta1` +`apiVersion: flowcontrol.apiserver.k8s.io/v1beta2` -`import "k8s.io/api/flowcontrol/v1beta1"` +`import "k8s.io/api/flowcontrol/v1beta2"` ## PriorityLevelConfiguration {#PriorityLevelConfiguration} @@ -32,7 +32,7 @@ PriorityLevelConfiguration represents the configuration of a priority level.
    -- **apiVersion**: flowcontrol.apiserver.k8s.io/v1beta1 +- **apiVersion**: flowcontrol.apiserver.k8s.io/v1beta2 - **kind**: PriorityLevelConfiguration @@ -42,11 +42,11 @@ PriorityLevelConfiguration represents the configuration of a priority level. `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata -- **spec** (}}">PriorityLevelConfigurationSpec) +- **spec** (}}">PriorityLevelConfigurationSpec) `spec` is the specification of the desired behavior of a "request-priority". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status -- **status** (}}">PriorityLevelConfigurationStatus) +- **status** (}}">PriorityLevelConfigurationStatus) `status` is the current status of a "request-priority". More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status @@ -163,7 +163,7 @@ PriorityLevelConfigurationList is a list of PriorityLevelConfiguration objects.
    -- **apiVersion**: flowcontrol.apiserver.k8s.io/v1beta1 +- **apiVersion**: flowcontrol.apiserver.k8s.io/v1beta2 - **kind**: PriorityLevelConfigurationList @@ -173,7 +173,7 @@ PriorityLevelConfigurationList is a list of PriorityLevelConfiguration objects. `metadata` is the standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata -- **items** ([]}}">PriorityLevelConfiguration), required +- **items** ([]}}">PriorityLevelConfiguration), required `items` is a list of request-priorities. @@ -196,7 +196,7 @@ PriorityLevelConfigurationList is a list of PriorityLevelConfiguration objects. #### HTTP Request -GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +GET /apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations/{name} #### Parameters @@ -215,7 +215,7 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name #### Response -200 (}}">PriorityLevelConfiguration): OK +200 (}}">PriorityLevelConfiguration): OK 401: Unauthorized @@ -224,7 +224,7 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name #### HTTP Request -GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name}/status +GET /apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations/{name}/status #### Parameters @@ -243,7 +243,7 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name #### Response -200 (}}">PriorityLevelConfiguration): OK +200 (}}">PriorityLevelConfiguration): OK 401: Unauthorized @@ -252,7 +252,7 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name #### HTTP Request -GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations +GET /apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations #### Parameters @@ -311,7 +311,7 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations #### Response -200 (}}">PriorityLevelConfigurationList): OK +200 (}}">PriorityLevelConfigurationList): OK 401: Unauthorized @@ -320,12 +320,12 @@ GET /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations #### HTTP Request -POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations +POST /apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations #### Parameters -- **body**: }}">PriorityLevelConfiguration, required +- **body**: }}">PriorityLevelConfiguration, required @@ -340,6 +340,11 @@ POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -349,11 +354,11 @@ POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations #### Response -200 (}}">PriorityLevelConfiguration): OK +200 (}}">PriorityLevelConfiguration): OK -201 (}}">PriorityLevelConfiguration): Created +201 (}}">PriorityLevelConfiguration): Created -202 (}}">PriorityLevelConfiguration): Accepted +202 (}}">PriorityLevelConfiguration): Accepted 401: Unauthorized @@ -362,7 +367,7 @@ POST /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations #### HTTP Request -PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations/{name} #### Parameters @@ -372,7 +377,7 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name name of the PriorityLevelConfiguration -- **body**: }}">PriorityLevelConfiguration, required +- **body**: }}">PriorityLevelConfiguration, required @@ -387,6 +392,11 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -396,9 +406,9 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name #### Response -200 (}}">PriorityLevelConfiguration): OK +200 (}}">PriorityLevelConfiguration): OK -201 (}}">PriorityLevelConfiguration): Created +201 (}}">PriorityLevelConfiguration): Created 401: Unauthorized @@ -407,7 +417,7 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name #### HTTP Request -PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name}/status +PUT /apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations/{name}/status #### Parameters @@ -417,7 +427,7 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name name of the PriorityLevelConfiguration -- **body**: }}">PriorityLevelConfiguration, required +- **body**: }}">PriorityLevelConfiguration, required @@ -432,6 +442,11 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -441,9 +456,9 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name #### Response -200 (}}">PriorityLevelConfiguration): OK +200 (}}">PriorityLevelConfiguration): OK -201 (}}">PriorityLevelConfiguration): Created +201 (}}">PriorityLevelConfiguration): Created 401: Unauthorized @@ -452,7 +467,7 @@ PUT /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name #### HTTP Request -PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations/{name} #### Parameters @@ -477,6 +492,11 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{na }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -491,9 +511,9 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{na #### Response -200 (}}">PriorityLevelConfiguration): OK +200 (}}">PriorityLevelConfiguration): OK -201 (}}">PriorityLevelConfiguration): Created +201 (}}">PriorityLevelConfiguration): Created 401: Unauthorized @@ -502,7 +522,7 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{na #### HTTP Request -PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name}/status +PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations/{name}/status #### Parameters @@ -527,6 +547,11 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{na }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -541,9 +566,9 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{na #### Response -200 (}}">PriorityLevelConfiguration): OK +200 (}}">PriorityLevelConfiguration): OK -201 (}}">PriorityLevelConfiguration): Created +201 (}}">PriorityLevelConfiguration): Created 401: Unauthorized @@ -552,7 +577,7 @@ PATCH /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{na #### HTTP Request -DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{name} +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations/{name} #### Parameters @@ -602,7 +627,7 @@ DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations/{n #### HTTP Request -DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta1/prioritylevelconfigurations +DELETE /apis/flowcontrol.apiserver.k8s.io/v1beta2/prioritylevelconfigurations #### Parameters diff --git a/content/en/docs/reference/kubernetes-api/cluster-resources/runtime-class-v1.md b/content/en/docs/reference/kubernetes-api/cluster-resources/runtime-class-v1.md index fad02bc731..ba69c0ddf4 100644 --- a/content/en/docs/reference/kubernetes-api/cluster-resources/runtime-class-v1.md +++ b/content/en/docs/reference/kubernetes-api/cluster-resources/runtime-class-v1.md @@ -86,6 +86,10 @@ RuntimeClass defines a class of container runtime supported in the cluster. The - **scheduling.tolerations.operator** (string) Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + + Possible enum values: + - `"Equal"` + - `"Exists"` - **scheduling.tolerations.value** (string) @@ -94,6 +98,11 @@ RuntimeClass defines a class of container runtime supported in the cluster. The - **scheduling.tolerations.effect** (string) Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + + Possible enum values: + - `"NoExecute"` Evict any already-running pods that do not tolerate the taint. Currently enforced by NodeController. + - `"NoSchedule"` Do not allow new pods to schedule onto the node unless they tolerate the taint, but allow all pods submitted to Kubelet without going through the scheduler to start, and allow all already-running pods to continue running. Enforced by the scheduler. + - `"PreferNoSchedule"` Like TaintEffectNoSchedule, but the scheduler tries not to schedule new pods onto the node, rather than prohibiting new pods from scheduling onto the node entirely. Enforced by the scheduler. - **scheduling.tolerations.tolerationSeconds** (int64) @@ -258,6 +267,11 @@ POST /apis/node.k8s.io/v1/runtimeclasses }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -305,6 +319,11 @@ PUT /apis/node.k8s.io/v1/runtimeclasses/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -350,6 +369,11 @@ PATCH /apis/node.k8s.io/v1/runtimeclasses/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/common-definitions/node-selector-requirement.md b/content/en/docs/reference/kubernetes-api/common-definitions/node-selector-requirement.md index 33af2e88e3..505fab63a5 100644 --- a/content/en/docs/reference/kubernetes-api/common-definitions/node-selector-requirement.md +++ b/content/en/docs/reference/kubernetes-api/common-definitions/node-selector-requirement.md @@ -37,6 +37,14 @@ A node selector requirement is a selector that contains values, a key, and an op - **operator** (string), required Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + + Possible enum values: + - `"DoesNotExist"` + - `"Exists"` + - `"Gt"` + - `"In"` + - `"Lt"` + - `"NotIn"` - **values** ([]string) diff --git a/content/en/docs/reference/kubernetes-api/common-parameters/common-parameters.md b/content/en/docs/reference/kubernetes-api/common-parameters/common-parameters.md index 45a90e0411..7a520f8953 100644 --- a/content/en/docs/reference/kubernetes-api/common-parameters/common-parameters.md +++ b/content/en/docs/reference/kubernetes-api/common-parameters/common-parameters.md @@ -78,6 +78,16 @@ A selector to restrict the list of returned objects by their fields. Defaults to +## fieldValidation {#fieldValidation} + +fieldValidation determines how the server should respond to unknown/duplicate fields in the object in the request. Introduced as alpha in 1.23, older servers or servers with the `ServerSideFieldValidation` feature disabled will discard valid values specified in this param and not perform any server side field validation. Valid values are: - Ignore: ignores unknown/duplicate fields. - Warn: responds with a warning for each unknown/duplicate field, but successfully serves the request. - Strict: fails the request on unknown/duplicate fields. + +
    + + + + + ## force {#force} Force is going to "force" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests. diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/config-map-v1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/config-map-v1.md index 774f12ae97..c0619358ab 100644 --- a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/config-map-v1.md +++ b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/config-map-v1.md @@ -296,6 +296,11 @@ POST /api/v1/namespaces/{namespace}/configmaps }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -348,6 +353,11 @@ PUT /api/v1/namespaces/{namespace}/configmaps/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -398,6 +408,11 @@ PATCH /api/v1/namespaces/{namespace}/configmaps/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-driver-v1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-driver-v1.md index db3a2a389b..26ca3c0871 100644 --- a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-driver-v1.md +++ b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-driver-v1.md @@ -64,7 +64,7 @@ CSIDriverSpec is the specification of a CSIDriver. - **fsGroupPolicy** (string) - Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details. This field is beta, and is only honored by servers that enable the CSIVolumeFSGroupPolicy feature gate. + Defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details. This field is immutable. @@ -93,7 +93,7 @@ CSIDriverSpec is the specification of a CSIDriver. Alternatively, the driver can be deployed with the field unset or false and it can be flipped later when storage capacity information has been published. - This field is immutable. + This field was immutable in Kubernetes \<= 1.22 and now is mutable. This is a beta field and only available when the CSIStorageCapacity feature is enabled. The default is false. @@ -289,6 +289,11 @@ POST /apis/storage.k8s.io/v1/csidrivers }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -336,6 +341,11 @@ PUT /apis/storage.k8s.io/v1/csidrivers/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -381,6 +391,11 @@ PATCH /apis/storage.k8s.io/v1/csidrivers/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-node-v1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-node-v1.md index 5eb65b7e54..cfaf156fa5 100644 --- a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-node-v1.md +++ b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-node-v1.md @@ -247,6 +247,11 @@ POST /apis/storage.k8s.io/v1/csinodes }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -294,6 +299,11 @@ PUT /apis/storage.k8s.io/v1/csinodes/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -339,6 +349,11 @@ PATCH /apis/storage.k8s.io/v1/csinodes/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-storage-capacity-v1beta1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-storage-capacity-v1beta1.md index 08c6572f89..bbac434e85 100644 --- a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-storage-capacity-v1beta1.md +++ b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/csi-storage-capacity-v1beta1.md @@ -318,6 +318,11 @@ POST /apis/storage.k8s.io/v1beta1/namespaces/{namespace}/csistoragecapacities }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -370,6 +375,11 @@ PUT /apis/storage.k8s.io/v1beta1/namespaces/{namespace}/csistoragecapacities/{na }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -420,6 +430,11 @@ PATCH /apis/storage.k8s.io/v1beta1/namespaces/{namespace}/csistoragecapacities/{ }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1.md index e1461951e8..d57d7db45c 100644 --- a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1.md +++ b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1.md @@ -70,7 +70,7 @@ PersistentVolumeClaimSpec describes the common attributes of storage devices and - **resources** (ResourceRequirements) - Resources represents the minimum resources the volume should have. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + Resources represents the minimum resources the volume should have. If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources *ResourceRequirements describes the compute resource requirements.* @@ -125,6 +125,10 @@ PersistentVolumeClaimStatus is the current status of a persistent volume claim. AccessModes contains the actual access modes the volume backing the PVC has. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 +- **allocatedResources** (map[string]}}">Quantity) + + The storage resource within AllocatedResources tracks the capacity allocated to a PVC. It may be larger than the actual capacity when a volume expansion operation is requested. For storage quota, the larger value from allocatedResources and PVC.spec.resources is used. If allocatedResources is not set, PVC.spec.resources alone is used for quota calculation. If a volume expansion capacity request is lowered, allocatedResources is only lowered if there are no expansion operations in progress and if the actual volume capacity is equal or lower than the requested capacity. This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature. + - **capacity** (map[string]}}">Quantity) Represents the actual resources of the underlying volume. @@ -143,6 +147,12 @@ PersistentVolumeClaimStatus is the current status of a persistent volume claim. - **conditions.type** (string), required + + + + Possible enum values: + - `"FileSystemResizePending"` - controller resize is finished and a file system resize is pending on node + - `"Resizing"` - a user trigger resize of pvc has been started - **conditions.lastProbeTime** (Time) @@ -169,6 +179,15 @@ PersistentVolumeClaimStatus is the current status of a persistent volume claim. - **phase** (string) Phase represents the current phase of PersistentVolumeClaim. + + Possible enum values: + - `"Bound"` used for PersistentVolumeClaims that are bound + - `"Lost"` used for PersistentVolumeClaims that lost their underlying PersistentVolume. The claim was bound to a PersistentVolume and this volume does not exist any longer and all data on it was lost. + - `"Pending"` used for PersistentVolumeClaims that are not yet bound + +- **resizeStatus** (string) + + ResizeStatus stores status of resize operation. ResizeStatus is not set by default but when expansion is complete resizeStatus is set to empty string by resize controller or kubelet. This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature. @@ -445,6 +464,11 @@ POST /api/v1/namespaces/{namespace}/persistentvolumeclaims }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -497,6 +521,11 @@ PUT /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -547,6 +576,11 @@ PUT /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -597,6 +631,11 @@ PATCH /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -652,6 +691,11 @@ PATCH /api/v1/namespaces/{namespace}/persistentvolumeclaims/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-v1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-v1.md index 86c689dc44..b4340081bb 100644 --- a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-v1.md +++ b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-v1.md @@ -108,6 +108,11 @@ PersistentVolumeSpec is the specification of a persistent volume. - **persistentVolumeReclaimPolicy** (string) What happens to a persistent volume when released from its claim. Valid options are Retain (default for manually created PersistentVolumes), Delete (default for dynamically provisioned PersistentVolumes), and Recycle (deprecated). Recycle must be supported by the volume plugin underlying this PersistentVolume. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#reclaiming + + Possible enum values: + - `"Delete"` means the volume will be deleted from Kubernetes on release from its claim. The volume plugin must support Deletion. + - `"Recycle"` means the volume will be recycled back into the pool of unbound persistent volumes on release from its claim. The volume plugin must support Recycling. + - `"Retain"` means the volume will be left in its current phase (Released) for manual reclamation by the administrator. The default policy is Retain. - **storageClassName** (string) @@ -150,7 +155,7 @@ PersistentVolumeSpec is the specification of a persistent volume. - **local.fsType** (string) - Filesystem type to mount. It applies only when the Path is a block device. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". The default value is to auto-select a fileystem if unspecified. + Filesystem type to mount. It applies only when the Path is a block device. Must be a filesystem type supported by the host operating system. Ex. "ext4", "xfs", "ntfs". The default value is to auto-select a filesystem if unspecified. ### Persistent volumes @@ -844,6 +849,13 @@ PersistentVolumeStatus is the current status of a persistent volume. - **phase** (string) Phase indicates if a volume is available, bound to a claim, or released by a claim. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#phase + + Possible enum values: + - `"Available"` used for PersistentVolumes that are not yet bound Available volumes are held by the binder and matched to PersistentVolumeClaims + - `"Bound"` used for PersistentVolumes that are bound + - `"Failed"` used for PersistentVolumes that failed to be correctly recycled or deleted after being released from a claim + - `"Pending"` used for PersistentVolumes that are not available + - `"Released"` used for PersistentVolumes where the bound PersistentVolumeClaim was deleted released volumes must be recycled before becoming available again this phase is used by the persistent volume claim binder to signal to another process to reclaim the resource - **reason** (string) @@ -1036,6 +1048,11 @@ POST /api/v1/persistentvolumes }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -1083,6 +1100,11 @@ PUT /api/v1/persistentvolumes/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -1128,6 +1150,11 @@ PUT /api/v1/persistentvolumes/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -1173,6 +1200,11 @@ PATCH /api/v1/persistentvolumes/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -1223,6 +1255,11 @@ PATCH /api/v1/persistentvolumes/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1.md index bb2710e4c8..5310484d56 100644 --- a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1.md +++ b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1.md @@ -56,7 +56,7 @@ Secret holds secret data of a certain type. The total bytes of the values in the - **type** (string) - Used to facilitate programmatic handling of secret data. + Used to facilitate programmatic handling of secret data. More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types @@ -300,6 +300,11 @@ POST /api/v1/namespaces/{namespace}/secrets }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -352,6 +357,11 @@ PUT /api/v1/namespaces/{namespace}/secrets/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -402,6 +412,11 @@ PATCH /api/v1/namespaces/{namespace}/secrets/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/storage-class-v1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/storage-class-v1.md index e5cb3b4b3e..6c9126f4c6 100644 --- a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/storage-class-v1.md +++ b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/storage-class-v1.md @@ -251,6 +251,11 @@ POST /apis/storage.k8s.io/v1/storageclasses }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -298,6 +303,11 @@ PUT /apis/storage.k8s.io/v1/storageclasses/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -343,6 +353,11 @@ PATCH /apis/storage.k8s.io/v1/storageclasses/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/volume-attachment-v1.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/volume-attachment-v1.md index 332053b4a9..a0ac08f96b 100644 --- a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/volume-attachment-v1.md +++ b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/volume-attachment-v1.md @@ -326,6 +326,11 @@ POST /apis/storage.k8s.io/v1/volumeattachments }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -373,6 +378,11 @@ PUT /apis/storage.k8s.io/v1/volumeattachments/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -418,6 +428,11 @@ PUT /apis/storage.k8s.io/v1/volumeattachments/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -463,6 +478,11 @@ PATCH /apis/storage.k8s.io/v1/volumeattachments/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -513,6 +533,11 @@ PATCH /apis/storage.k8s.io/v1/volumeattachments/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/volume.md b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/volume.md index 60badecc43..00bed4bd01 100644 --- a/content/en/docs/reference/kubernetes-api/config-and-storage-resources/volume.md +++ b/content/en/docs/reference/kubernetes-api/config-and-storage-resources/volume.md @@ -809,8 +809,6 @@ Volume represents a named volume in a pod that may be accessed by any container Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to be used that way - see the documentation of the driver for more information. A pod can use both types of ephemeral volumes and persistent volumes at the same time. - - This is a beta feature and only available when the GenericEphemeralVolume feature gate is enabled. *Represents an ephemeral volume that is handled by a normal storage driver.* diff --git a/content/en/docs/reference/kubernetes-api/extend-resources/custom-resource-definition-v1.md b/content/en/docs/reference/kubernetes-api/extend-resources/custom-resource-definition-v1.md index 89cb9687f6..df6d44e404 100644 --- a/content/en/docs/reference/kubernetes-api/extend-resources/custom-resource-definition-v1.md +++ b/content/en/docs/reference/kubernetes-api/extend-resources/custom-resource-definition-v1.md @@ -490,6 +490,49 @@ JSONSchemaProps is a JSON-Schema following Specification Draft 4 (http://json-sc x-kubernetes-preserve-unknown-fields stops the API server decoding step from pruning fields which are not specified in the validation schema. This affects fields recursively, but switches back to normal pruning behaviour if nested properties or additionalProperties are specified in the schema. This can either be true or undefined. False is forbidden. +- **x-kubernetes-validations** ([]ValidationRule) + + *Patch strategy: merge on key `rule`* + + *Map: unique values on key rule will be kept during a merge* + + x-kubernetes-validations describes a list of validation rules written in the CEL expression language. This field is an alpha-level. Using this field requires the feature gate `CustomResourceValidationExpressions` to be enabled. + + + *ValidationRule describes a validation rule written in the CEL expression language.* + + - **x-kubernetes-validations.rule** (string), required + + Rule represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec The Rule is scoped to the location of the x-kubernetes-validations extension in the schema. The `self` variable in the CEL expression is bound to the scoped value. Example: - Rule scoped to the root of a resource with a status subresource: {"rule": "self.status.actual \<= self.spec.maxDesired"} + + If the Rule is scoped to an object with properties, the accessible properties of the object are field selectable via `self.field` and field presence can be checked via `has(self.field)`. Null valued fields are treated as absent fields in CEL expressions. If the Rule is scoped to an object with additionalProperties (i.e. a map) the value of the map are accessible via `self[mapKey]`, map containment can be checked via `mapKey in self` and all entries of the map are accessible via CEL macros and functions such as `self.all(...)`. If the Rule is scoped to an array, the elements of the array are accessible via `self[i]` and also by macros and functions. If the Rule is scoped to a scalar, `self` is bound to the scalar value. Examples: - Rule scoped to a map of objects: {"rule": "self.components['Widget'].priority \< 10"} - Rule scoped to a list of integers: {"rule": "self.values.all(value, value >= 0 && value \< 100)"} - Rule scoped to a string value: {"rule": "self.startsWith('kube')"} + + The `apiVersion`, `kind`, `metadata.name` and `metadata.generateName` are always accessible from the root of the object and from any x-kubernetes-embedded-resource annotated objects. No other metadata properties are accessible. + + Unknown data preserved in custom resources via x-kubernetes-preserve-unknown-fields is not accessible in CEL expressions. This includes: - Unknown field values that are preserved by object schemas with x-kubernetes-preserve-unknown-fields. - Object properties where the property schema is of an "unknown type". An "unknown type" is recursively defined as: + - A schema with no type and x-kubernetes-preserve-unknown-fields set to true + - An array where the items schema is of an "unknown type" + - An object where the additionalProperties schema is of an "unknown type" + + Only property names of the form `[a-zA-Z_.-/][a-zA-Z0-9_.-/]*` are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '__' escapes to '__underscores__' - '.' escapes to '__dot__' - '-' escapes to '__dash__' - '/' escapes to '__slash__' - Property names that exactly match a CEL RESERVED keyword escape to '__{keyword}__'. The keywords are: + "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if", + "import", "let", "loop", "package", "namespace", "return". + Examples: + - Rule accessing a property named "namespace": {"rule": "self.__namespace__ > 0"} + - Rule accessing a property named "x-prop": {"rule": "self.x__dash__prop > 0"} + - Rule accessing a property named "redact__d": {"rule": "self.redact__underscores__d > 0"} + + Equality on arrays with x-kubernetes-list-type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type: + - 'set': `X + Y` performs a union where the array positions of all elements in `X` are preserved and + non-intersecting elements in `Y` are appended, retaining their partial order. + - 'map': `X + Y` performs a merge where the array positions of all keys in `X` are preserved but the values + are overwritten by values in `Y` when the key sets of `X` and `Y` intersect. Elements in `Y` with + non-intersecting keys are appended, retaining their partial order. + + - **x-kubernetes-validations.message** (string) + + Message represents the message displayed when validation fails. The message is required if the Rule contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" + @@ -756,6 +799,11 @@ POST /apis/apiextensions.k8s.io/v1/customresourcedefinitions }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -803,6 +851,11 @@ PUT /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -848,6 +901,11 @@ PUT /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -893,6 +951,11 @@ PATCH /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -943,6 +1006,11 @@ PATCH /apis/apiextensions.k8s.io/v1/customresourcedefinitions/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/extend-resources/mutating-webhook-configuration-v1.md b/content/en/docs/reference/kubernetes-api/extend-resources/mutating-webhook-configuration-v1.md index 499daa6405..2607b0577a 100644 --- a/content/en/docs/reference/kubernetes-api/extend-resources/mutating-webhook-configuration-v1.md +++ b/content/en/docs/reference/kubernetes-api/extend-resources/mutating-webhook-configuration-v1.md @@ -371,6 +371,11 @@ POST /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -418,6 +423,11 @@ PUT /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -463,6 +473,11 @@ PATCH /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1.md b/content/en/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1.md index 417f90402e..9cd4694781 100644 --- a/content/en/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1.md +++ b/content/en/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1.md @@ -361,6 +361,11 @@ POST /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -408,6 +413,11 @@ PUT /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -453,6 +463,11 @@ PATCH /apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/{nam }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/policy-resources/limit-range-v1.md b/content/en/docs/reference/kubernetes-api/policy-resources/limit-range-v1.md index 36d9ff42c4..caf5febdb5 100644 --- a/content/en/docs/reference/kubernetes-api/policy-resources/limit-range-v1.md +++ b/content/en/docs/reference/kubernetes-api/policy-resources/limit-range-v1.md @@ -66,6 +66,11 @@ LimitRangeSpec defines a min/max usage limit for resources that match on kind. - **limits.type** (string), required Type of resource that this limit applies to. + + Possible enum values: + - `"Container"` Limit that applies to all containers in a namespace + - `"PersistentVolumeClaim"` Limit that applies to all persistent volume claims in a namespace + - `"Pod"` Limit that applies to all pods in a namespace - **limits.default** (map[string]}}">Quantity) @@ -329,6 +334,11 @@ POST /api/v1/namespaces/{namespace}/limitranges }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -381,6 +391,11 @@ PUT /api/v1/namespaces/{namespace}/limitranges/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -431,6 +446,11 @@ PATCH /api/v1/namespaces/{namespace}/limitranges/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/policy-resources/network-policy-v1.md b/content/en/docs/reference/kubernetes-api/policy-resources/network-policy-v1.md index 2ba558d7b1..0dedc9e6e5 100644 --- a/content/en/docs/reference/kubernetes-api/policy-resources/network-policy-v1.md +++ b/content/en/docs/reference/kubernetes-api/policy-resources/network-policy-v1.md @@ -432,6 +432,11 @@ POST /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -484,6 +489,11 @@ PUT /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -534,6 +544,11 @@ PATCH /apis/networking.k8s.io/v1/namespaces/{namespace}/networkpolicies/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/policy-resources/pod-disruption-budget-v1.md b/content/en/docs/reference/kubernetes-api/policy-resources/pod-disruption-budget-v1.md index 5b88652bb2..e1fc792736 100644 --- a/content/en/docs/reference/kubernetes-api/policy-resources/pod-disruption-budget-v1.md +++ b/content/en/docs/reference/kubernetes-api/policy-resources/pod-disruption-budget-v1.md @@ -436,6 +436,11 @@ POST /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -488,6 +493,11 @@ PUT /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -538,6 +548,11 @@ PUT /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -588,6 +603,11 @@ PATCH /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -643,6 +663,11 @@ PATCH /apis/policy/v1/namespaces/{namespace}/poddisruptionbudgets/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/policy-resources/pod-security-policy-v1beta1.md b/content/en/docs/reference/kubernetes-api/policy-resources/pod-security-policy-v1beta1.md index 2f03cfa5bf..699e0e671f 100644 --- a/content/en/docs/reference/kubernetes-api/policy-resources/pod-security-policy-v1beta1.md +++ b/content/en/docs/reference/kubernetes-api/policy-resources/pod-security-policy-v1beta1.md @@ -482,6 +482,11 @@ POST /apis/policy/v1beta1/podsecuritypolicies }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -529,6 +534,11 @@ PUT /apis/policy/v1beta1/podsecuritypolicies/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -574,6 +584,11 @@ PATCH /apis/policy/v1beta1/podsecuritypolicies/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/policy-resources/resource-quota-v1.md b/content/en/docs/reference/kubernetes-api/policy-resources/resource-quota-v1.md index e71631863e..6952ebed86 100644 --- a/content/en/docs/reference/kubernetes-api/policy-resources/resource-quota-v1.md +++ b/content/en/docs/reference/kubernetes-api/policy-resources/resource-quota-v1.md @@ -81,10 +81,24 @@ ResourceQuotaSpec defines the desired hard limits to enforce for Quota. - **scopeSelector.matchExpressions.operator** (string), required Represents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. + + Possible enum values: + - `"DoesNotExist"` + - `"Exists"` + - `"In"` + - `"NotIn"` - **scopeSelector.matchExpressions.scopeName** (string), required The name of the scope that the selector applies to. + + Possible enum values: + - `"BestEffort"` Match all pod objects that have best effort quality of service + - `"CrossNamespacePodAffinity"` Match all pod objects that have cross-namespace pod (anti)affinity mentioned. This is a beta feature enabled by the PodAffinityNamespaceSelector feature flag. + - `"NotBestEffort"` Match all pod objects that do not have best effort quality of service + - `"NotTerminating"` Match all pod objects where spec.activeDeadlineSeconds is nil + - `"PriorityClass"` Match all pod objects that have priority class mentioned + - `"Terminating"` Match all pod objects where spec.activeDeadlineSeconds >=0 - **scopeSelector.matchExpressions.values** ([]string) @@ -387,6 +401,11 @@ POST /api/v1/namespaces/{namespace}/resourcequotas }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -439,6 +458,11 @@ PUT /api/v1/namespaces/{namespace}/resourcequotas/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -489,6 +513,11 @@ PUT /api/v1/namespaces/{namespace}/resourcequotas/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -539,6 +568,11 @@ PATCH /api/v1/namespaces/{namespace}/resourcequotas/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -594,6 +628,11 @@ PATCH /api/v1/namespaces/{namespace}/resourcequotas/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/service-resources/endpoint-slice-v1.md b/content/en/docs/reference/kubernetes-api/service-resources/endpoint-slice-v1.md index b602f0e728..de1ea073e3 100644 --- a/content/en/docs/reference/kubernetes-api/service-resources/endpoint-slice-v1.md +++ b/content/en/docs/reference/kubernetes-api/service-resources/endpoint-slice-v1.md @@ -45,6 +45,11 @@ EndpointSlice represents a subset of the endpoints that implement a service. For - **addressType** (string), required addressType specifies the type of address carried by this EndpointSlice. All addresses in this slice must be the same type. This field is immutable after creation. The following address types are currently supported: * IPv4: Represents an IPv4 Address. * IPv6: Represents an IPv6 Address. * FQDN: Represents a Fully Qualified Domain Name. + + Possible enum values: + - `"FQDN"` represents a FQDN. + - `"IPv4"` represents an IPv4 Address. + - `"IPv6"` represents an IPv6 Address. - **endpoints** ([]Endpoint), required @@ -387,6 +392,11 @@ POST /apis/discovery.k8s.io/v1/namespaces/{namespace}/endpointslices }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -439,6 +449,11 @@ PUT /apis/discovery.k8s.io/v1/namespaces/{namespace}/endpointslices/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -489,6 +504,11 @@ PATCH /apis/discovery.k8s.io/v1/namespaces/{namespace}/endpointslices/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/service-resources/endpoints-v1.md b/content/en/docs/reference/kubernetes-api/service-resources/endpoints-v1.md index ccc385b983..76f0f0b70f 100644 --- a/content/en/docs/reference/kubernetes-api/service-resources/endpoints-v1.md +++ b/content/en/docs/reference/kubernetes-api/service-resources/endpoints-v1.md @@ -127,6 +127,11 @@ Endpoints is a collection of endpoints that implement the actual service. Exampl - **subsets.ports.protocol** (string) The IP protocol for this port. Must be UDP, TCP, or SCTP. Default is TCP. + + Possible enum values: + - `"SCTP"` is the SCTP protocol. + - `"TCP"` is the TCP protocol. + - `"UDP"` is the UDP protocol. - **subsets.ports.name** (string) @@ -378,6 +383,11 @@ POST /api/v1/namespaces/{namespace}/endpoints }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -430,6 +440,11 @@ PUT /api/v1/namespaces/{namespace}/endpoints/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -480,6 +495,11 @@ PATCH /api/v1/namespaces/{namespace}/endpoints/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/service-resources/ingress-class-v1.md b/content/en/docs/reference/kubernetes-api/service-resources/ingress-class-v1.md index 335597af49..009a5b7f9e 100644 --- a/content/en/docs/reference/kubernetes-api/service-resources/ingress-class-v1.md +++ b/content/en/docs/reference/kubernetes-api/service-resources/ingress-class-v1.md @@ -85,7 +85,7 @@ IngressClassSpec provides information about the class of an Ingress. - **parameters.scope** (string) - Scope represents if this refers to a cluster or namespace scoped resource. This may be set to "Cluster" (default) or "Namespace". Field can be enabled with IngressClassNamespacedParams feature gate. + Scope represents if this refers to a cluster or namespace scoped resource. This may be set to "Cluster" (default) or "Namespace". @@ -246,6 +246,11 @@ POST /apis/networking.k8s.io/v1/ingressclasses }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -293,6 +298,11 @@ PUT /apis/networking.k8s.io/v1/ingressclasses/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -338,6 +348,11 @@ PATCH /apis/networking.k8s.io/v1/ingressclasses/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/service-resources/ingress-v1.md b/content/en/docs/reference/kubernetes-api/service-resources/ingress-v1.md index 7bdec1fcb2..11e7504396 100644 --- a/content/en/docs/reference/kubernetes-api/service-resources/ingress-v1.md +++ b/content/en/docs/reference/kubernetes-api/service-resources/ingress-v1.md @@ -232,6 +232,11 @@ IngressStatus describe the current state of the Ingress. - **loadBalancer.ingress.ports.protocol** (string), required Protocol is the protocol of the service port of which status is recorded here The supported values are: "TCP", "UDP", "SCTP" + + Possible enum values: + - `"SCTP"` is the SCTP protocol. + - `"TCP"` is the TCP protocol. + - `"UDP"` is the UDP protocol. - **loadBalancer.ingress.ports.error** (string) @@ -517,6 +522,11 @@ POST /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -569,6 +579,11 @@ PUT /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -619,6 +634,11 @@ PUT /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -669,6 +689,11 @@ PATCH /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -724,6 +749,11 @@ PATCH /apis/networking.k8s.io/v1/namespaces/{namespace}/ingresses/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/service-resources/service-v1.md b/content/en/docs/reference/kubernetes-api/service-resources/service-v1.md index c49b2607c1..b937bc1484 100644 --- a/content/en/docs/reference/kubernetes-api/service-resources/service-v1.md +++ b/content/en/docs/reference/kubernetes-api/service-resources/service-v1.md @@ -89,6 +89,11 @@ ServiceSpec describes the attributes that a user creates on a service. - **ports.protocol** (string) The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". Default is TCP. + + Possible enum values: + - `"SCTP"` is the SCTP protocol. + - `"TCP"` is the TCP protocol. + - `"UDP"` is the UDP protocol. - **ports.name** (string) @@ -105,18 +110,24 @@ ServiceSpec describes the attributes that a user creates on a service. - **type** (string) type determines how the Service is exposed. Defaults to ClusterIP. Valid options are ExternalName, ClusterIP, NodePort, and LoadBalancer. "ClusterIP" allocates a cluster-internal IP address for load-balancing to endpoints. Endpoints are determined by the selector or if that is not specified, by manual construction of an Endpoints object or EndpointSlice objects. If clusterIP is "None", no virtual IP is allocated and the endpoints are published as a set of endpoints rather than a virtual IP. "NodePort" builds on ClusterIP and allocates a port on every node which routes to the same endpoints as the clusterIP. "LoadBalancer" builds on NodePort and creates an external load-balancer (if supported in the current cloud) which routes to the same endpoints as the clusterIP. "ExternalName" aliases this service to the specified externalName. Several other fields do not apply to ExternalName services. More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + + Possible enum values: + - `"ClusterIP"` means a service will only be accessible inside the cluster, via the cluster IP. + - `"ExternalName"` means a service consists of only a reference to an external name that kubedns or equivalent will return as a CNAME record, with no exposing or proxying of any pods involved. + - `"LoadBalancer"` means a service will be exposed via an external load balancer (if the cloud provider supports it), in addition to 'NodePort' type. + - `"NodePort"` means a service will be exposed on one port of every node, in addition to 'ClusterIP' type. - **ipFamilies** ([]string) *Atomic: will be replaced during a merge* - IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this service, and is gated by the "IPv6DualStack" feature gate. This field is usually assigned automatically based on cluster configuration and the ipFamilyPolicy field. If this field is specified manually, the requested family is available in the cluster, and ipFamilyPolicy allows it, it will be used; otherwise creation of the service will fail. This field is conditionally mutable: it allows for adding or removing a secondary IP family, but it does not allow changing the primary IP family of the Service. Valid values are "IPv4" and "IPv6". This field only applies to Services of types ClusterIP, NodePort, and LoadBalancer, and does apply to "headless" services. This field will be wiped when updating a Service to type ExternalName. + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this service. This field is usually assigned automatically based on cluster configuration and the ipFamilyPolicy field. If this field is specified manually, the requested family is available in the cluster, and ipFamilyPolicy allows it, it will be used; otherwise creation of the service will fail. This field is conditionally mutable: it allows for adding or removing a secondary IP family, but it does not allow changing the primary IP family of the Service. Valid values are "IPv4" and "IPv6". This field only applies to Services of types ClusterIP, NodePort, and LoadBalancer, and does apply to "headless" services. This field will be wiped when updating a Service to type ExternalName. This field may hold a maximum of two entries (dual-stack families, in either order). These families must correspond to the values of the clusterIPs field, if specified. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. - **ipFamilyPolicy** (string) - IPFamilyPolicy represents the dual-stack-ness requested or required by this Service, and is gated by the "IPv6DualStack" feature gate. If there is no value provided, then this field will be set to SingleStack. Services can be "SingleStack" (a single IP family), "PreferDualStack" (two IP families on dual-stack configured clusters or a single IP family on single-stack clusters), or "RequireDualStack" (two IP families on dual-stack configured clusters, otherwise fail). The ipFamilies and clusterIPs fields depend on the value of this field. This field will be wiped when updating a service to type ExternalName. + IPFamilyPolicy represents the dual-stack-ness requested or required by this Service. If there is no value provided, then this field will be set to SingleStack. Services can be "SingleStack" (a single IP family), "PreferDualStack" (two IP families on dual-stack configured clusters or a single IP family on single-stack clusters), or "RequireDualStack" (two IP families on dual-stack configured clusters, otherwise fail). The ipFamilies and clusterIPs fields depend on the value of this field. This field will be wiped when updating a service to type ExternalName. - **clusterIP** (string) @@ -128,7 +139,7 @@ ServiceSpec describes the attributes that a user creates on a service. ClusterIPs is a list of IP addresses assigned to this service, and are usually assigned randomly. If an address is specified manually, is in-range (as per system configuration), and is not in use, it will be allocated to the service; otherwise creation of the service will fail. This field may not be changed through updates unless the type field is also being changed to ExternalName (which requires this field to be empty) or the type field is being changed from ExternalName (in which case this field may optionally be specified, as describe above). Valid values are "None", empty string (""), or a valid IP address. Setting this to "None" makes a "headless service" (no virtual IP), which is useful when direct endpoint connections are preferred and proxying is not required. Only applies to types ClusterIP, NodePort, and LoadBalancer. If this field is specified when creating a Service of type ExternalName, creation will fail. This field will be wiped when updating a Service to type ExternalName. If this field is not specified, it will be initialized from the clusterIP field. If this field is specified, clients must ensure that clusterIPs[0] and clusterIP have the same value. - Unless the "IPv6DualStack" feature gate is enabled, this field is limited to one value, which must be the same as the clusterIP field. If the feature gate is enabled, this field may hold a maximum of two entries (dual-stack IPs, in either order). These IPs must correspond to the values of the ipFamilies field. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + This field may hold a maximum of two entries (dual-stack IPs, in either order). These IPs must correspond to the values of the ipFamilies field. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies - **externalIPs** ([]string) @@ -137,6 +148,10 @@ ServiceSpec describes the attributes that a user creates on a service. - **sessionAffinity** (string) Supports "ClientIP" and "None". Used to maintain session affinity. Enable client IP based session affinity. Must be ClientIP or None. Defaults to None. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + + Possible enum values: + - `"ClientIP"` is the Client IP based. + - `"None"` - no session affinity. - **loadBalancerIP** (string) @@ -157,6 +172,10 @@ ServiceSpec describes the attributes that a user creates on a service. - **externalTrafficPolicy** (string) externalTrafficPolicy denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints. "Local" preserves the client source IP and avoids a second hop for LoadBalancer and Nodeport type services, but risks potentially imbalanced traffic spreading. "Cluster" obscures the client source IP and may cause a second hop to another node, but should have good overall load-spreading. + + Possible enum values: + - `"Cluster"` specifies node-global (legacy) behavior. + - `"Local"` specifies node-local endpoints behavior. - **internalTrafficPolicy** (string) @@ -278,6 +297,11 @@ ServiceStatus represents the current status of a service. - **loadBalancer.ingress.ports.protocol** (string), required Protocol is the protocol of the service port of which status is recorded here The supported values are: "TCP", "UDP", "SCTP" + + Possible enum values: + - `"SCTP"` is the SCTP protocol. + - `"TCP"` is the TCP protocol. + - `"UDP"` is the UDP protocol. - **loadBalancer.ingress.ports.error** (string) @@ -561,6 +585,11 @@ POST /api/v1/namespaces/{namespace}/services }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -613,6 +642,11 @@ PUT /api/v1/namespaces/{namespace}/services/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -663,6 +697,11 @@ PUT /api/v1/namespaces/{namespace}/services/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -713,6 +752,11 @@ PATCH /api/v1/namespaces/{namespace}/services/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -768,6 +812,11 @@ PATCH /api/v1/namespaces/{namespace}/services/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -837,9 +886,92 @@ DELETE /api/v1/namespaces/{namespace}/services/{name} #### Response -200 (}}">Status): OK +200 (}}">Service): OK -202 (}}">Status): Accepted +202 (}}">Service): Accepted + +401: Unauthorized + + +### `deletecollection` delete collection of Service + +#### HTTP Request + +DELETE /api/v1/namespaces/{namespace}/services + +#### Parameters + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **body**: }}">DeleteOptions + + + + +- **continue** (*in query*): string + + }}">continue + + +- **dryRun** (*in query*): string + + }}">dryRun + + +- **fieldSelector** (*in query*): string + + }}">fieldSelector + + +- **gracePeriodSeconds** (*in query*): integer + + }}">gracePeriodSeconds + + +- **labelSelector** (*in query*): string + + }}">labelSelector + + +- **limit** (*in query*): integer + + }}">limit + + +- **pretty** (*in query*): string + + }}">pretty + + +- **propagationPolicy** (*in query*): string + + }}">propagationPolicy + + +- **resourceVersion** (*in query*): string + + }}">resourceVersion + + +- **resourceVersionMatch** (*in query*): string + + }}">resourceVersionMatch + + +- **timeoutSeconds** (*in query*): integer + + }}">timeoutSeconds + + + +#### Response + + +200 (}}">Status): OK 401: Unauthorized diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/controller-revision-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/controller-revision-v1.md index bf3ffa7f12..cf6cdd0dff 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/controller-revision-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/controller-revision-v1.md @@ -322,6 +322,11 @@ POST /apis/apps/v1/namespaces/{namespace}/controllerrevisions }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -374,6 +379,11 @@ PUT /apis/apps/v1/namespaces/{namespace}/controllerrevisions/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -424,6 +434,11 @@ PATCH /apis/apps/v1/namespaces/{namespace}/controllerrevisions/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/cron-job-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/cron-job-v1.md index 3aa5ceb8be..7219be2809 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/cron-job-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/cron-job-v1.md @@ -82,6 +82,11 @@ CronJobSpec describes how the job execution will look like and when it will actu - **concurrencyPolicy** (string) Specifies how to treat concurrent executions of a Job. Valid values are: - "Allow" (default): allows CronJobs to run concurrently; - "Forbid": forbids concurrent runs, skipping next run if previous run hasn't finished yet; - "Replace": cancels currently running job and replaces it with a new one + + Possible enum values: + - `"Allow"` allows CronJobs to run concurrently. + - `"Forbid"` forbids concurrent runs, skipping next run if previous hasn't finished yet. + - `"Replace"` cancels currently running job and replaces it with a new one. - **startingDeadlineSeconds** (int64) @@ -404,6 +409,11 @@ POST /apis/batch/v1/namespaces/{namespace}/cronjobs }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -456,6 +466,11 @@ PUT /apis/batch/v1/namespaces/{namespace}/cronjobs/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -506,6 +521,11 @@ PUT /apis/batch/v1/namespaces/{namespace}/cronjobs/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -556,6 +576,11 @@ PATCH /apis/batch/v1/namespaces/{namespace}/cronjobs/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -611,6 +636,11 @@ PATCH /apis/batch/v1/namespaces/{namespace}/cronjobs/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/daemon-set-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/daemon-set-v1.md index 9d7eb6c24c..555b7217fd 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/daemon-set-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/daemon-set-v1.md @@ -82,6 +82,10 @@ DaemonSetSpec is the specification of a daemon set. - **updateStrategy.type** (string) Type of daemon set update. Can be "RollingUpdate" or "OnDelete". Default is RollingUpdate. + + Possible enum values: + - `"OnDelete"` Replace the old daemons only when it's killed + - `"RollingUpdate"` Replace the old daemons by new ones using rolling update i.e replace them on each node one after the other. - **updateStrategy.rollingUpdate** (RollingUpdateDaemonSet) @@ -120,7 +124,7 @@ DaemonSetStatus represents the current status of a daemon set. - **numberReady** (int32), required - The number of nodes that should be running the daemon pod and have one or more of the daemon pod running and ready. + numberReady is the number of nodes that should be running the daemon pod and have one or more of the daemon pod running with a Ready Condition. - **numberAvailable** (int32) @@ -461,6 +465,11 @@ POST /apis/apps/v1/namespaces/{namespace}/daemonsets }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -513,6 +522,11 @@ PUT /apis/apps/v1/namespaces/{namespace}/daemonsets/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -563,6 +577,11 @@ PUT /apis/apps/v1/namespaces/{namespace}/daemonsets/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -613,6 +632,11 @@ PATCH /apis/apps/v1/namespaces/{namespace}/daemonsets/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -668,6 +692,11 @@ PATCH /apis/apps/v1/namespaces/{namespace}/daemonsets/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/deployment-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/deployment-v1.md index c56bf76df7..60fc28f4a5 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/deployment-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/deployment-v1.md @@ -88,6 +88,10 @@ DeploymentSpec is the specification of the desired behavior of the Deployment. - **strategy.type** (string) Type of deployment. Can be "Recreate" or "RollingUpdate". Default is RollingUpdate. + + Possible enum values: + - `"Recreate"` Kill all existing pods before creating new ones. + - `"RollingUpdate"` Replace the old ReplicaSets by new one using rolling update i.e gradually scale down the old ReplicaSets and scale up the new one. - **strategy.rollingUpdate** (RollingUpdateDeployment) @@ -142,7 +146,7 @@ DeploymentStatus is the most recently observed status of the Deployment. - **readyReplicas** (int32) - Total number of ready pods targeted by this deployment. + readyReplicas is the number of pods targeted by this Deployment with a Ready Condition. - **unavailableReplicas** (int32) @@ -474,6 +478,11 @@ POST /apis/apps/v1/namespaces/{namespace}/deployments }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -526,6 +535,11 @@ PUT /apis/apps/v1/namespaces/{namespace}/deployments/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -576,6 +590,11 @@ PUT /apis/apps/v1/namespaces/{namespace}/deployments/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -626,6 +645,11 @@ PATCH /apis/apps/v1/namespaces/{namespace}/deployments/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -681,6 +705,11 @@ PATCH /apis/apps/v1/namespaces/{namespace}/deployments/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v1.md index d2da0c286a..e75dc848c0 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v1.md @@ -399,6 +399,11 @@ POST /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -451,6 +456,11 @@ PUT /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -501,6 +511,11 @@ PUT /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name}/ }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -551,6 +566,11 @@ PATCH /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -606,6 +626,11 @@ PATCH /apis/autoscaling/v1/namespaces/{namespace}/horizontalpodautoscalers/{name }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2.md b/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2.md new file mode 100644 index 0000000000..682203bc1d --- /dev/null +++ b/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2.md @@ -0,0 +1,1357 @@ +--- +api_metadata: + apiVersion: "autoscaling/v2" + import: "k8s.io/api/autoscaling/v2" + kind: "HorizontalPodAutoscaler" +content_type: "api_reference" +description: "HorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified." +title: "HorizontalPodAutoscaler" +weight: 12 +auto_generated: true +--- + + + +`apiVersion: autoscaling/v2` + +`import "k8s.io/api/autoscaling/v2"` + + +## HorizontalPodAutoscaler {#HorizontalPodAutoscaler} + +HorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified. + +
    + +- **apiVersion**: autoscaling/v2 + + +- **kind**: HorizontalPodAutoscaler + + +- **metadata** (}}">ObjectMeta) + + metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + +- **spec** (}}">HorizontalPodAutoscalerSpec) + + spec is the specification for the behaviour of the autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status. + +- **status** (}}">HorizontalPodAutoscalerStatus) + + status is the current information about the autoscaler. + + + + + +## HorizontalPodAutoscalerSpec {#HorizontalPodAutoscalerSpec} + +HorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler. + +
    + +- **maxReplicas** (int32), required + + maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up. It cannot be less that minReplicas. + +- **scaleTargetRef** (CrossVersionObjectReference), required + + scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics should be collected, as well as to actually change the replica count. + + + *CrossVersionObjectReference contains enough information to let you identify the referred resource.* + + - **scaleTargetRef.kind** (string), required + + Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + + - **scaleTargetRef.name** (string), required + + Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names + + - **scaleTargetRef.apiVersion** (string) + + API version of the referent + +- **minReplicas** (int32) + + minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available. + +- **behavior** (HorizontalPodAutoscalerBehavior) + + behavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively). If not set, the default HPAScalingRules for scale up and scale down are used. + + + *HorizontalPodAutoscalerBehavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively).* + + - **behavior.scaleDown** (HPAScalingRules) + + scaleDown is scaling policy for scaling Down. If not set, the default value is to allow to scale down to minReplicas pods, with a 300 second stabilization window (i.e., the highest recommendation for the last 300sec is used). + + + *HPAScalingRules configures the scaling behavior for one direction. These Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.* + + - **behavior.scaleDown.policies** ([]HPAScalingPolicy) + + *Atomic: will be replaced during a merge* + + policies is a list of potential scaling polices which can be used during scaling. At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid + + + *HPAScalingPolicy is a single policy which must hold true for a specified past interval.* + + - **behavior.scaleDown.policies.type** (string), required + + Type is used to specify the scaling policy. + + - **behavior.scaleDown.policies.value** (int32), required + + Value contains the amount of change which is permitted by the policy. It must be greater than zero + + - **behavior.scaleDown.policies.periodSeconds** (int32), required + + PeriodSeconds specifies the window of time for which the policy should hold true. PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min). + + - **behavior.scaleDown.selectPolicy** (string) + + selectPolicy is used to specify which policy should be used. If not set, the default value Max is used. + + - **behavior.scaleDown.stabilizationWindowSeconds** (int32) + + StabilizationWindowSeconds is the number of seconds for which past recommendations should be considered while scaling up or scaling down. StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour). If not set, use the default values: - For scale up: 0 (i.e. no stabilization is done). - For scale down: 300 (i.e. the stabilization window is 300 seconds long). + + - **behavior.scaleUp** (HPAScalingRules) + + scaleUp is scaling policy for scaling Up. If not set, the default value is the higher of: + * increase no more than 4 pods per 60 seconds + * double the number of pods per 60 seconds + No stabilization is used. + + + *HPAScalingRules configures the scaling behavior for one direction. These Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.* + + - **behavior.scaleUp.policies** ([]HPAScalingPolicy) + + *Atomic: will be replaced during a merge* + + policies is a list of potential scaling polices which can be used during scaling. At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid + + + *HPAScalingPolicy is a single policy which must hold true for a specified past interval.* + + - **behavior.scaleUp.policies.type** (string), required + + Type is used to specify the scaling policy. + + - **behavior.scaleUp.policies.value** (int32), required + + Value contains the amount of change which is permitted by the policy. It must be greater than zero + + - **behavior.scaleUp.policies.periodSeconds** (int32), required + + PeriodSeconds specifies the window of time for which the policy should hold true. PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min). + + - **behavior.scaleUp.selectPolicy** (string) + + selectPolicy is used to specify which policy should be used. If not set, the default value Max is used. + + - **behavior.scaleUp.stabilizationWindowSeconds** (int32) + + StabilizationWindowSeconds is the number of seconds for which past recommendations should be considered while scaling up or scaling down. StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour). If not set, use the default values: - For scale up: 0 (i.e. no stabilization is done). - For scale down: 300 (i.e. the stabilization window is 300 seconds long). + +- **metrics** ([]MetricSpec) + + *Atomic: will be replaced during a merge* + + metrics contains the specifications for which to use to calculate the desired replica count (the maximum replica count across all metrics will be used). The desired replica count is calculated multiplying the ratio between the target value and the current value by the current number of pods. Ergo, metrics used must decrease as the pod count is increased, and vice-versa. See the individual metric source types for more information about how each type of metric must respond. If not set, the default metric will be set to 80% average CPU utilization. + + + *MetricSpec specifies how to scale based on a single metric (only `type` and one other matching field should be set at once).* + + - **metrics.type** (string), required + + type is the type of metric source. It should be one of "ContainerResource", "External", "Object", "Pods" or "Resource", each mapping to a matching field in the object. Note: "ContainerResource" type is available on when the feature-gate HPAContainerMetrics is enabled + + - **metrics.containerResource** (ContainerResourceMetricSource) + + containerResource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod of the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. This is an alpha feature and can be enabled by the HPAContainerMetrics feature flag. + + + *ContainerResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. Only one "target" type should be set.* + + - **metrics.containerResource.container** (string), required + + container is the name of the container in the pods of the scaling target + + - **metrics.containerResource.name** (string), required + + name is the name of the resource in question. + + - **metrics.containerResource.target** (MetricTarget), required + + target specifies the target value for the given metric + + + *MetricTarget defines the target value, average value, or average utilization of a specific metric* + + - **metrics.containerResource.target.type** (string), required + + type represents whether the metric type is Utilization, Value, or AverageValue + + - **metrics.containerResource.target.averageUtilization** (int32) + + averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source type + + - **metrics.containerResource.target.averageValue** (}}">Quantity) + + averageValue is the target value of the average of the metric across all relevant pods (as a quantity) + + - **metrics.containerResource.target.value** (}}">Quantity) + + value is the target value of the metric (as a quantity). + + - **metrics.external** (ExternalMetricSource) + + external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster). + + + *ExternalMetricSource indicates how to scale on a metric not associated with any Kubernetes object (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).* + + - **metrics.external.metric** (MetricIdentifier), required + + metric identifies the target metric by name and selector + + + *MetricIdentifier defines the name and optionally selector for a metric* + + - **metrics.external.metric.name** (string), required + + name is the name of the given metric + + - **metrics.external.metric.selector** (}}">LabelSelector) + + selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics. + + - **metrics.external.target** (MetricTarget), required + + target specifies the target value for the given metric + + + *MetricTarget defines the target value, average value, or average utilization of a specific metric* + + - **metrics.external.target.type** (string), required + + type represents whether the metric type is Utilization, Value, or AverageValue + + - **metrics.external.target.averageUtilization** (int32) + + averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source type + + - **metrics.external.target.averageValue** (}}">Quantity) + + averageValue is the target value of the average of the metric across all relevant pods (as a quantity) + + - **metrics.external.target.value** (}}">Quantity) + + value is the target value of the metric (as a quantity). + + - **metrics.object** (ObjectMetricSource) + + object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object). + + + *ObjectMetricSource indicates how to scale on a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).* + + - **metrics.object.describedObject** (CrossVersionObjectReference), required + + describedObject specifies the descriptions of a object,such as kind,name apiVersion + + + *CrossVersionObjectReference contains enough information to let you identify the referred resource.* + + - **metrics.object.describedObject.kind** (string), required + + Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + + - **metrics.object.describedObject.name** (string), required + + Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names + + - **metrics.object.describedObject.apiVersion** (string) + + API version of the referent + + - **metrics.object.metric** (MetricIdentifier), required + + metric identifies the target metric by name and selector + + + *MetricIdentifier defines the name and optionally selector for a metric* + + - **metrics.object.metric.name** (string), required + + name is the name of the given metric + + - **metrics.object.metric.selector** (}}">LabelSelector) + + selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics. + + - **metrics.object.target** (MetricTarget), required + + target specifies the target value for the given metric + + + *MetricTarget defines the target value, average value, or average utilization of a specific metric* + + - **metrics.object.target.type** (string), required + + type represents whether the metric type is Utilization, Value, or AverageValue + + - **metrics.object.target.averageUtilization** (int32) + + averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source type + + - **metrics.object.target.averageValue** (}}">Quantity) + + averageValue is the target value of the average of the metric across all relevant pods (as a quantity) + + - **metrics.object.target.value** (}}">Quantity) + + value is the target value of the metric (as a quantity). + + - **metrics.pods** (PodsMetricSource) + + pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value. + + + *PodsMetricSource indicates how to scale on a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.* + + - **metrics.pods.metric** (MetricIdentifier), required + + metric identifies the target metric by name and selector + + + *MetricIdentifier defines the name and optionally selector for a metric* + + - **metrics.pods.metric.name** (string), required + + name is the name of the given metric + + - **metrics.pods.metric.selector** (}}">LabelSelector) + + selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics. + + - **metrics.pods.target** (MetricTarget), required + + target specifies the target value for the given metric + + + *MetricTarget defines the target value, average value, or average utilization of a specific metric* + + - **metrics.pods.target.type** (string), required + + type represents whether the metric type is Utilization, Value, or AverageValue + + - **metrics.pods.target.averageUtilization** (int32) + + averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source type + + - **metrics.pods.target.averageValue** (}}">Quantity) + + averageValue is the target value of the average of the metric across all relevant pods (as a quantity) + + - **metrics.pods.target.value** (}}">Quantity) + + value is the target value of the metric (as a quantity). + + - **metrics.resource** (ResourceMetricSource) + + resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. + + + *ResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. Only one "target" type should be set.* + + - **metrics.resource.name** (string), required + + name is the name of the resource in question. + + - **metrics.resource.target** (MetricTarget), required + + target specifies the target value for the given metric + + + *MetricTarget defines the target value, average value, or average utilization of a specific metric* + + - **metrics.resource.target.type** (string), required + + type represents whether the metric type is Utilization, Value, or AverageValue + + - **metrics.resource.target.averageUtilization** (int32) + + averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source type + + - **metrics.resource.target.averageValue** (}}">Quantity) + + averageValue is the target value of the average of the metric across all relevant pods (as a quantity) + + - **metrics.resource.target.value** (}}">Quantity) + + value is the target value of the metric (as a quantity). + + + + + +## HorizontalPodAutoscalerStatus {#HorizontalPodAutoscalerStatus} + +HorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler. + +
    + +- **desiredReplicas** (int32), required + + desiredReplicas is the desired number of replicas of pods managed by this autoscaler, as last calculated by the autoscaler. + +- **conditions** ([]HorizontalPodAutoscalerCondition) + + *Patch strategy: merge on key `type`* + + *Map: unique values on key type will be kept during a merge* + + conditions is the set of conditions required for this autoscaler to scale its target, and indicates whether or not those conditions are met. + + + *HorizontalPodAutoscalerCondition describes the state of a HorizontalPodAutoscaler at a certain point.* + + - **conditions.status** (string), required + + status is the status of the condition (True, False, Unknown) + + - **conditions.type** (string), required + + type describes the current condition + + - **conditions.lastTransitionTime** (Time) + + lastTransitionTime is the last time the condition transitioned from one status to another + + + *Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.* + + - **conditions.message** (string) + + message is a human-readable explanation containing details about the transition + + - **conditions.reason** (string) + + reason is the reason for the condition's last transition. + +- **currentMetrics** ([]MetricStatus) + + *Atomic: will be replaced during a merge* + + currentMetrics is the last read state of the metrics used by this autoscaler. + + + *MetricStatus describes the last-read state of a single metric.* + + - **currentMetrics.type** (string), required + + type is the type of metric source. It will be one of "ContainerResource", "External", "Object", "Pods" or "Resource", each corresponds to a matching field in the object. Note: "ContainerResource" type is available on when the feature-gate HPAContainerMetrics is enabled + + - **currentMetrics.containerResource** (ContainerResourceMetricStatus) + + container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. + + + *ContainerResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.* + + - **currentMetrics.containerResource.container** (string), required + + Container is the name of the container in the pods of the scaling target + + - **currentMetrics.containerResource.current** (MetricValueStatus), required + + current contains the current value for the given metric + + + *MetricValueStatus holds the current value for a metric* + + - **currentMetrics.containerResource.current.averageUtilization** (int32) + + currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. + + - **currentMetrics.containerResource.current.averageValue** (}}">Quantity) + + averageValue is the current value of the average of the metric across all relevant pods (as a quantity) + + - **currentMetrics.containerResource.current.value** (}}">Quantity) + + value is the current value of the metric (as a quantity). + + - **currentMetrics.containerResource.name** (string), required + + Name is the name of the resource in question. + + - **currentMetrics.external** (ExternalMetricStatus) + + external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster). + + + *ExternalMetricStatus indicates the current value of a global metric not associated with any Kubernetes object.* + + - **currentMetrics.external.current** (MetricValueStatus), required + + current contains the current value for the given metric + + + *MetricValueStatus holds the current value for a metric* + + - **currentMetrics.external.current.averageUtilization** (int32) + + currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. + + - **currentMetrics.external.current.averageValue** (}}">Quantity) + + averageValue is the current value of the average of the metric across all relevant pods (as a quantity) + + - **currentMetrics.external.current.value** (}}">Quantity) + + value is the current value of the metric (as a quantity). + + - **currentMetrics.external.metric** (MetricIdentifier), required + + metric identifies the target metric by name and selector + + + *MetricIdentifier defines the name and optionally selector for a metric* + + - **currentMetrics.external.metric.name** (string), required + + name is the name of the given metric + + - **currentMetrics.external.metric.selector** (}}">LabelSelector) + + selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics. + + - **currentMetrics.object** (ObjectMetricStatus) + + object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object). + + + *ObjectMetricStatus indicates the current value of a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).* + + - **currentMetrics.object.current** (MetricValueStatus), required + + current contains the current value for the given metric + + + *MetricValueStatus holds the current value for a metric* + + - **currentMetrics.object.current.averageUtilization** (int32) + + currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. + + - **currentMetrics.object.current.averageValue** (}}">Quantity) + + averageValue is the current value of the average of the metric across all relevant pods (as a quantity) + + - **currentMetrics.object.current.value** (}}">Quantity) + + value is the current value of the metric (as a quantity). + + - **currentMetrics.object.describedObject** (CrossVersionObjectReference), required + + DescribedObject specifies the descriptions of a object,such as kind,name apiVersion + + + *CrossVersionObjectReference contains enough information to let you identify the referred resource.* + + - **currentMetrics.object.describedObject.kind** (string), required + + Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" + + - **currentMetrics.object.describedObject.name** (string), required + + Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names + + - **currentMetrics.object.describedObject.apiVersion** (string) + + API version of the referent + + - **currentMetrics.object.metric** (MetricIdentifier), required + + metric identifies the target metric by name and selector + + + *MetricIdentifier defines the name and optionally selector for a metric* + + - **currentMetrics.object.metric.name** (string), required + + name is the name of the given metric + + - **currentMetrics.object.metric.selector** (}}">LabelSelector) + + selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics. + + - **currentMetrics.pods** (PodsMetricStatus) + + pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value. + + + *PodsMetricStatus indicates the current value of a metric describing each pod in the current scale target (for example, transactions-processed-per-second).* + + - **currentMetrics.pods.current** (MetricValueStatus), required + + current contains the current value for the given metric + + + *MetricValueStatus holds the current value for a metric* + + - **currentMetrics.pods.current.averageUtilization** (int32) + + currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. + + - **currentMetrics.pods.current.averageValue** (}}">Quantity) + + averageValue is the current value of the average of the metric across all relevant pods (as a quantity) + + - **currentMetrics.pods.current.value** (}}">Quantity) + + value is the current value of the metric (as a quantity). + + - **currentMetrics.pods.metric** (MetricIdentifier), required + + metric identifies the target metric by name and selector + + + *MetricIdentifier defines the name and optionally selector for a metric* + + - **currentMetrics.pods.metric.name** (string), required + + name is the name of the given metric + + - **currentMetrics.pods.metric.selector** (}}">LabelSelector) + + selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics. + + - **currentMetrics.resource** (ResourceMetricStatus) + + resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. + + + *ResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.* + + - **currentMetrics.resource.current** (MetricValueStatus), required + + current contains the current value for the given metric + + + *MetricValueStatus holds the current value for a metric* + + - **currentMetrics.resource.current.averageUtilization** (int32) + + currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. + + - **currentMetrics.resource.current.averageValue** (}}">Quantity) + + averageValue is the current value of the average of the metric across all relevant pods (as a quantity) + + - **currentMetrics.resource.current.value** (}}">Quantity) + + value is the current value of the metric (as a quantity). + + - **currentMetrics.resource.name** (string), required + + Name is the name of the resource in question. + +- **currentReplicas** (int32) + + currentReplicas is current number of replicas of pods managed by this autoscaler, as last seen by the autoscaler. + +- **lastScaleTime** (Time) + + lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods, used by the autoscaler to control how often the number of pods is changed. + + + *Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.* + +- **observedGeneration** (int64) + + observedGeneration is the most recent generation observed by this autoscaler. + + + + + +## HorizontalPodAutoscalerList {#HorizontalPodAutoscalerList} + +HorizontalPodAutoscalerList is a list of horizontal pod autoscaler objects. + +
    + +- **apiVersion**: autoscaling/v2 + + +- **kind**: HorizontalPodAutoscalerList + + +- **metadata** (}}">ListMeta) + + metadata is the standard list metadata. + +- **items** ([]}}">HorizontalPodAutoscaler), required + + items is the list of horizontal pod autoscaler objects. + + + + + +## Operations {#Operations} + + + +
    + + + + + + +### `get` read the specified HorizontalPodAutoscaler + +#### HTTP Request + +GET /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name} + +#### Parameters + + +- **name** (*in path*): string, required + + name of the HorizontalPodAutoscaler + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **pretty** (*in query*): string + + }}">pretty + + + +#### Response + + +200 (}}">HorizontalPodAutoscaler): OK + +401: Unauthorized + + +### `get` read status of the specified HorizontalPodAutoscaler + +#### HTTP Request + +GET /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}/status + +#### Parameters + + +- **name** (*in path*): string, required + + name of the HorizontalPodAutoscaler + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **pretty** (*in query*): string + + }}">pretty + + + +#### Response + + +200 (}}">HorizontalPodAutoscaler): OK + +401: Unauthorized + + +### `list` list or watch objects of kind HorizontalPodAutoscaler + +#### HTTP Request + +GET /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers + +#### Parameters + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **allowWatchBookmarks** (*in query*): boolean + + }}">allowWatchBookmarks + + +- **continue** (*in query*): string + + }}">continue + + +- **fieldSelector** (*in query*): string + + }}">fieldSelector + + +- **labelSelector** (*in query*): string + + }}">labelSelector + + +- **limit** (*in query*): integer + + }}">limit + + +- **pretty** (*in query*): string + + }}">pretty + + +- **resourceVersion** (*in query*): string + + }}">resourceVersion + + +- **resourceVersionMatch** (*in query*): string + + }}">resourceVersionMatch + + +- **timeoutSeconds** (*in query*): integer + + }}">timeoutSeconds + + +- **watch** (*in query*): boolean + + }}">watch + + + +#### Response + + +200 (}}">HorizontalPodAutoscalerList): OK + +401: Unauthorized + + +### `list` list or watch objects of kind HorizontalPodAutoscaler + +#### HTTP Request + +GET /apis/autoscaling/v2/horizontalpodautoscalers + +#### Parameters + + +- **allowWatchBookmarks** (*in query*): boolean + + }}">allowWatchBookmarks + + +- **continue** (*in query*): string + + }}">continue + + +- **fieldSelector** (*in query*): string + + }}">fieldSelector + + +- **labelSelector** (*in query*): string + + }}">labelSelector + + +- **limit** (*in query*): integer + + }}">limit + + +- **pretty** (*in query*): string + + }}">pretty + + +- **resourceVersion** (*in query*): string + + }}">resourceVersion + + +- **resourceVersionMatch** (*in query*): string + + }}">resourceVersionMatch + + +- **timeoutSeconds** (*in query*): integer + + }}">timeoutSeconds + + +- **watch** (*in query*): boolean + + }}">watch + + + +#### Response + + +200 (}}">HorizontalPodAutoscalerList): OK + +401: Unauthorized + + +### `create` create a HorizontalPodAutoscaler + +#### HTTP Request + +POST /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers + +#### Parameters + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **body**: }}">HorizontalPodAutoscaler, required + + + + +- **dryRun** (*in query*): string + + }}">dryRun + + +- **fieldManager** (*in query*): string + + }}">fieldManager + + +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + +- **pretty** (*in query*): string + + }}">pretty + + + +#### Response + + +200 (}}">HorizontalPodAutoscaler): OK + +201 (}}">HorizontalPodAutoscaler): Created + +202 (}}">HorizontalPodAutoscaler): Accepted + +401: Unauthorized + + +### `update` replace the specified HorizontalPodAutoscaler + +#### HTTP Request + +PUT /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name} + +#### Parameters + + +- **name** (*in path*): string, required + + name of the HorizontalPodAutoscaler + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **body**: }}">HorizontalPodAutoscaler, required + + + + +- **dryRun** (*in query*): string + + }}">dryRun + + +- **fieldManager** (*in query*): string + + }}">fieldManager + + +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + +- **pretty** (*in query*): string + + }}">pretty + + + +#### Response + + +200 (}}">HorizontalPodAutoscaler): OK + +201 (}}">HorizontalPodAutoscaler): Created + +401: Unauthorized + + +### `update` replace status of the specified HorizontalPodAutoscaler + +#### HTTP Request + +PUT /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}/status + +#### Parameters + + +- **name** (*in path*): string, required + + name of the HorizontalPodAutoscaler + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **body**: }}">HorizontalPodAutoscaler, required + + + + +- **dryRun** (*in query*): string + + }}">dryRun + + +- **fieldManager** (*in query*): string + + }}">fieldManager + + +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + +- **pretty** (*in query*): string + + }}">pretty + + + +#### Response + + +200 (}}">HorizontalPodAutoscaler): OK + +201 (}}">HorizontalPodAutoscaler): Created + +401: Unauthorized + + +### `patch` partially update the specified HorizontalPodAutoscaler + +#### HTTP Request + +PATCH /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name} + +#### Parameters + + +- **name** (*in path*): string, required + + name of the HorizontalPodAutoscaler + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **body**: }}">Patch, required + + + + +- **dryRun** (*in query*): string + + }}">dryRun + + +- **fieldManager** (*in query*): string + + }}">fieldManager + + +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + +- **force** (*in query*): boolean + + }}">force + + +- **pretty** (*in query*): string + + }}">pretty + + + +#### Response + + +200 (}}">HorizontalPodAutoscaler): OK + +201 (}}">HorizontalPodAutoscaler): Created + +401: Unauthorized + + +### `patch` partially update status of the specified HorizontalPodAutoscaler + +#### HTTP Request + +PATCH /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}/status + +#### Parameters + + +- **name** (*in path*): string, required + + name of the HorizontalPodAutoscaler + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **body**: }}">Patch, required + + + + +- **dryRun** (*in query*): string + + }}">dryRun + + +- **fieldManager** (*in query*): string + + }}">fieldManager + + +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + +- **force** (*in query*): boolean + + }}">force + + +- **pretty** (*in query*): string + + }}">pretty + + + +#### Response + + +200 (}}">HorizontalPodAutoscaler): OK + +201 (}}">HorizontalPodAutoscaler): Created + +401: Unauthorized + + +### `delete` delete a HorizontalPodAutoscaler + +#### HTTP Request + +DELETE /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name} + +#### Parameters + + +- **name** (*in path*): string, required + + name of the HorizontalPodAutoscaler + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **body**: }}">DeleteOptions + + + + +- **dryRun** (*in query*): string + + }}">dryRun + + +- **gracePeriodSeconds** (*in query*): integer + + }}">gracePeriodSeconds + + +- **pretty** (*in query*): string + + }}">pretty + + +- **propagationPolicy** (*in query*): string + + }}">propagationPolicy + + + +#### Response + + +200 (}}">Status): OK + +202 (}}">Status): Accepted + +401: Unauthorized + + +### `deletecollection` delete collection of HorizontalPodAutoscaler + +#### HTTP Request + +DELETE /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers + +#### Parameters + + +- **namespace** (*in path*): string, required + + }}">namespace + + +- **body**: }}">DeleteOptions + + + + +- **continue** (*in query*): string + + }}">continue + + +- **dryRun** (*in query*): string + + }}">dryRun + + +- **fieldSelector** (*in query*): string + + }}">fieldSelector + + +- **gracePeriodSeconds** (*in query*): integer + + }}">gracePeriodSeconds + + +- **labelSelector** (*in query*): string + + }}">labelSelector + + +- **limit** (*in query*): integer + + }}">limit + + +- **pretty** (*in query*): string + + }}">pretty + + +- **propagationPolicy** (*in query*): string + + }}">propagationPolicy + + +- **resourceVersion** (*in query*): string + + }}">resourceVersion + + +- **resourceVersionMatch** (*in query*): string + + }}">resourceVersionMatch + + +- **timeoutSeconds** (*in query*): integer + + }}">timeoutSeconds + + + +#### Response + + +200 (}}">Status): OK + +401: Unauthorized + diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2beta2.md b/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2beta2.md index 67894ab9c4..2db318f513 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2beta2.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/horizontal-pod-autoscaler-v2beta2.md @@ -6,7 +6,7 @@ api_metadata: content_type: "api_reference" description: "HorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified." title: "HorizontalPodAutoscaler v2beta2" -weight: 12 +weight: 13 auto_generated: true --- @@ -411,7 +411,15 @@ HorizontalPodAutoscalerStatus describes the current status of a horizontal pod a
    -- **conditions** ([]HorizontalPodAutoscalerCondition), required +- **currentReplicas** (int32), required + + currentReplicas is current number of replicas of pods managed by this autoscaler, as last seen by the autoscaler. + +- **desiredReplicas** (int32), required + + desiredReplicas is the desired number of replicas of pods managed by this autoscaler, as last calculated by the autoscaler. + +- **conditions** ([]HorizontalPodAutoscalerCondition) conditions is the set of conditions required for this autoscaler to scale its target, and indicates whether or not those conditions are met. @@ -441,14 +449,6 @@ HorizontalPodAutoscalerStatus describes the current status of a horizontal pod a reason is the reason for the condition's last transition. -- **currentReplicas** (int32), required - - currentReplicas is current number of replicas of pods managed by this autoscaler, as last seen by the autoscaler. - -- **desiredReplicas** (int32), required - - desiredReplicas is the desired number of replicas of pods managed by this autoscaler, as last calculated by the autoscaler. - - **currentMetrics** ([]MetricStatus) currentMetrics is the last read state of the metrics used by this autoscaler. @@ -951,6 +951,11 @@ POST /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -1003,6 +1008,11 @@ PUT /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/{n }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -1053,6 +1063,11 @@ PUT /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/{n }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -1103,6 +1118,11 @@ PATCH /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/ }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -1158,6 +1178,11 @@ PATCH /apis/autoscaling/v2beta2/namespaces/{namespace}/horizontalpodautoscalers/ }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/job-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/job-v1.md index 0f61e522eb..eea384cdf9 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/job-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/job-v1.md @@ -100,7 +100,7 @@ JobSpec describes how the job execution will look like. - **ttlSecondsAfterFinished** (int32) - ttlSecondsAfterFinished limits the lifetime of a Job that has finished execution (either Complete or Failed). If this field is set, ttlSecondsAfterFinished after the Job finishes, it is eligible to be automatically deleted. When the Job is being deleted, its lifecycle guarantees (e.g. finalizers) will be honored. If this field is unset, the Job won't be automatically deleted. If this field is set to zero, the Job becomes eligible to be deleted immediately after it finishes. This field is alpha-level and is only honored by servers that enable the TTLAfterFinished feature. + ttlSecondsAfterFinished limits the lifetime of a Job that has finished execution (either Complete or Failed). If this field is set, ttlSecondsAfterFinished after the Job finishes, it is eligible to be automatically deleted. When the Job is being deleted, its lifecycle guarantees (e.g. finalizers) will be honored. If this field is unset, the Job won't be automatically deleted. If this field is set to zero, the Job becomes eligible to be deleted immediately after it finishes. - **suspend** (boolean) @@ -143,7 +143,7 @@ JobStatus represents the current state of a Job. - **active** (int32) - The number of actively running pods. + The number of pending and running pods. - **failed** (int32) @@ -175,6 +175,11 @@ JobStatus represents the current state of a Job. - **conditions.type** (string), required Type of job condition, Complete or Failed. + + Possible enum values: + - `"Complete"` means the job has completed its execution. + - `"Failed"` means the job has failed its execution. + - `"Suspended"` means the job has been suspended. - **conditions.lastProbeTime** (Time) @@ -205,7 +210,7 @@ JobStatus represents the current state of a Job. The job controller creates pods with a finalizer. When a pod terminates (succeeded or failed), the controller does three steps to account for it in the job status: (1) Add the pod UID to the arrays in this field. (2) Remove the pod finalizer. (3) Remove the pod UID from the arrays while increasing the corresponding counter. - This field is alpha-level. The job controller only makes use of this field when the feature gate PodTrackingWithFinalizers is enabled. Old jobs might not be tracked using this field, in which case the field remains null. + This field is beta-level. The job controller only makes use of this field when the feature gate JobTrackingWithFinalizers is enabled (enabled by default). Old jobs might not be tracked using this field, in which case the field remains null. *UncountedTerminatedPods holds UIDs of Pods that have terminated but haven't been accounted in Job status counters.* @@ -224,6 +229,15 @@ JobStatus represents the current state of a Job. +### Alpha level + + +- **ready** (int32) + + The number of pods which have a Ready condition. + + This field is alpha-level. The job controller populates the field when the feature gate JobReadyPods is enabled (disabled by default). + ## JobList {#JobList} @@ -497,6 +511,11 @@ POST /apis/batch/v1/namespaces/{namespace}/jobs }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -549,6 +568,11 @@ PUT /apis/batch/v1/namespaces/{namespace}/jobs/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -599,6 +623,11 @@ PUT /apis/batch/v1/namespaces/{namespace}/jobs/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -649,6 +678,11 @@ PATCH /apis/batch/v1/namespaces/{namespace}/jobs/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -704,6 +738,11 @@ PATCH /apis/batch/v1/namespaces/{namespace}/jobs/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/pod-template-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/pod-template-v1.md index 7e75ea07de..8d2737ee73 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/pod-template-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/pod-template-v1.md @@ -306,6 +306,11 @@ POST /api/v1/namespaces/{namespace}/podtemplates }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -358,6 +363,11 @@ PUT /api/v1/namespaces/{namespace}/podtemplates/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -408,6 +418,11 @@ PATCH /api/v1/namespaces/{namespace}/podtemplates/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/pod-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/pod-v1.md index 8c166cfd9e..a93d0e1c12 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/pod-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/pod-v1.md @@ -87,6 +87,21 @@ PodSpec is a description of a pod. EnableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Defaults to true. +- **os** (PodOS) + + Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set. + + If the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions + + If the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup This is an alpha field and requires the IdentifyPodOS feature + + + *PodOS defines the OS parameters of a pod.* + + - **os.name** (string), required + + Name is the name of the operating system. The currently supported values are linux and windows. Additional value may be defined in future and can be one of: https://github.com/opencontainers/runtime-spec/blob/master/config.md#platform-specific-configuration Clients should expect to handle additional values and treat unrecognized values in this field as os: null + ### Volumes @@ -140,6 +155,10 @@ PodSpec is a description of a pod. - **tolerations.operator** (string) Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + + Possible enum values: + - `"Equal"` + - `"Exists"` - **tolerations.value** (string) @@ -148,6 +167,11 @@ PodSpec is a description of a pod. - **tolerations.effect** (string) Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + + Possible enum values: + - `"NoExecute"` Evict any already-running pods that do not tolerate the taint. Currently enforced by NodeController. + - `"NoSchedule"` Do not allow new pods to schedule onto the node unless they tolerate the taint, but allow all pods submitted to Kubelet without going through the scheduler to start, and allow all already-running pods to continue running. Enforced by the scheduler. + - `"PreferNoSchedule"` Like TaintEffectNoSchedule, but the scheduler tries not to schedule new pods onto the node, rather than prohibiting new pods from scheduling onto the node entirely. Enforced by the scheduler. - **tolerations.tolerationSeconds** (int64) @@ -193,7 +217,11 @@ PodSpec is a description of a pod. WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. - A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assigment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. + A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. + + Possible enum values: + - `"DoNotSchedule"` instructs the scheduler not to schedule the pod when constraints are not satisfied. + - `"ScheduleAnyway"` instructs the scheduler to schedule the pod even if constraints are not satisfied. - **topologySpreadConstraints.labelSelector** (}}">LabelSelector) @@ -205,6 +233,11 @@ PodSpec is a description of a pod. - **restartPolicy** (string) Restart policy for all containers within the pod. One of Always, OnFailure, Never. Default to Always. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy + + Possible enum values: + - `"Always"` + - `"Never"` + - `"OnFailure"` - **terminationGracePeriodSeconds** (int64) @@ -224,6 +257,12 @@ PodSpec is a description of a pod. - **readinessGates.conditionType** (string), required ConditionType refers to a condition in the pod's condition list with matching type. + + Possible enum values: + - `"ContainersReady"` indicates whether all containers in the pod are ready. + - `"Initialized"` means that all init containers in the pod have started successfully. + - `"PodScheduled"` represents status of the scheduling process for this pod. + - `"Ready"` means the pod is able to service requests and should be added to the load balancing pools of all matching services. ### Hostname and Name resolution @@ -289,6 +328,12 @@ PodSpec is a description of a pod. - **dnsPolicy** (string) Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. To have DNS options set along with hostNetwork, you have to specify DNS policy explicitly to 'ClusterFirstWithHostNet'. + + Possible enum values: + - `"ClusterFirst"` indicates that the pod should use cluster DNS first unless hostNetwork is true, if it is available, then fall back on the default (as determined by kubelet) DNS settings. + - `"ClusterFirstWithHostNet"` indicates that the pod should use cluster DNS first, if it is available, then fall back on the default (as determined by kubelet) DNS settings. + - `"Default"` indicates that the pod should use the default (as determined by kubelet) DNS settings. + - `"None"` indicates that the pod should use empty DNS settings. DNS parameters such as nameservers and search paths should be defined via DNSConfig. ### Hosts namespaces @@ -332,7 +377,7 @@ PodSpec is a description of a pod. - **securityContext.runAsUser** (int64) - The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. + The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - **securityContext.runAsNonRoot** (boolean) @@ -340,11 +385,11 @@ PodSpec is a description of a pod. - **securityContext.runAsGroup** (int64) - The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. + The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - **securityContext.supplementalGroups** ([]int64) - A list of groups applied to the first process run in each container, in addition to the container's primary GID. If unspecified, no groups will be added to any container. + A list of groups applied to the first process run in each container, in addition to the container's primary GID. If unspecified, no groups will be added to any container. Note that this field cannot be set when spec.os.name is windows. - **securityContext.fsGroup** (int64) @@ -352,15 +397,15 @@ PodSpec is a description of a pod. 1. The owning GID will be the FSGroup 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) 3. The permission bits are OR'd with rw-rw---- - If unset, the Kubelet will not modify the ownership and permissions of any volume. + If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. - **securityContext.fsGroupChangePolicy** (string) - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume before being exposed inside Pod. This field will only apply to volume types which support fsGroup based ownership(and permissions). It will have no effect on ephemeral volume types such as: secret, configmaps and emptydir. Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. Note that this field cannot be set when spec.os.name is windows. - **securityContext.seccompProfile** (SeccompProfile) - The seccomp options to use by the containers in this pod. + The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. *SeccompProfile defines a pod/container's seccomp profile settings. Only one profile source may be set.* @@ -370,6 +415,11 @@ PodSpec is a description of a pod. type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. + + Possible enum values: + - `"Localhost"` indicates a profile defined in a file on the node should be used. The file's location relative to \/seccomp. + - `"RuntimeDefault"` represents the default container runtime seccomp profile. + - `"Unconfined"` indicates no seccomp profile is applied (A.K.A. unconfined). - **securityContext.seccompProfile.localhostProfile** (string) @@ -377,7 +427,7 @@ PodSpec is a description of a pod. - **securityContext.seLinuxOptions** (SELinuxOptions) - The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. + The SELinux context to be applied to all containers. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in SecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. *SELinuxOptions are the labels to be applied to the container* @@ -400,7 +450,7 @@ PodSpec is a description of a pod. - **securityContext.sysctls** ([]Sysctl) - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. *Sysctl defines a kernel parameter to be set* @@ -415,7 +465,7 @@ PodSpec is a description of a pod. - **securityContext.windowsOptions** (WindowsSecurityContextOptions) - The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + The Windows specific settings applied to all containers. If unspecified, the options within a container's SecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux. *WindowsSecurityContextOptions contain Windows-specific options and credentials.* @@ -454,7 +504,7 @@ PodSpec is a description of a pod. *Patch strategy: merge on key `name`* - List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing pod to perform user-initiated actions such as debugging. This list cannot be specified when creating a pod, and it cannot be modified by updating the pod spec. In order to add an ephemeral container to an existing pod, use the pod's ephemeralcontainers subresource. This field is alpha-level and is only honored by servers that enable the EphemeralContainers feature. + List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing pod to perform user-initiated actions such as debugging. This list cannot be specified when creating a pod, and it cannot be modified by updating the pod spec. In order to add an ephemeral container to an existing pod, use the pod's ephemeralcontainers subresource. This field is beta-level and available on clusters that haven't disabled the EphemeralContainers feature gate. ### Deprecated @@ -487,6 +537,11 @@ A single application container that you want to run within a pod. - **imagePullPolicy** (string) Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + + Possible enum values: + - `"Always"` means that kubelet always attempts to pull the latest image. Container will fail If the pull fails. + - `"IfNotPresent"` means that kubelet pulls if the image isn't present on disk. Container will fail if the image isn't present and the pull fails. + - `"Never"` means that kubelet never pulls an image, but only uses a local image. Container will fail if the image isn't present ### Entrypoint @@ -536,6 +591,11 @@ A single application container that you want to run within a pod. - **ports.protocol** (string) Protocol for port. Must be UDP, TCP, or SCTP. Defaults to "TCP". + + Possible enum values: + - `"SCTP"` is the SCTP protocol. + - `"TCP"` is the TCP protocol. + - `"UDP"` is the UDP protocol. ### Environment variables @@ -736,13 +796,13 @@ A single application container that you want to run within a pod. *Lifecycle describes actions that the management system should take in response to container lifecycle events. For the PostStart and PreStop lifecycle handlers, management of the container blocks until the action is complete, unless the container process fails, in which case the handler is aborted.* - - **lifecycle.postStart** (}}">Handler) + - **lifecycle.postStart** (}}">LifecycleHandler) PostStart is called immediately after a container is created. If the handler fails, the container is terminated and restarted according to its restart policy. Other management of the container blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks - - **lifecycle.preStop** (}}">Handler) + - **lifecycle.preStop** (}}">LifecycleHandler) - PreStop is called immediately before a container is terminated due to an API request or management event such as liveness/startup probe failure, preemption, resource contention, etc. The handler is not called if the container crashes or exits. The reason for termination is passed to the handler. The Pod's termination grace period countdown begins before the PreStop hooked is executed. Regardless of the outcome of the handler, the container will eventually terminate within the Pod's termination grace period. Other management of the container blocks until the hook completes or until the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + PreStop is called immediately before a container is terminated due to an API request or management event such as liveness/startup probe failure, preemption, resource contention, etc. The handler is not called if the container crashes or exits. The Pod's termination grace period countdown begins before the PreStop hook is executed. Regardless of the outcome of the handler, the container will eventually terminate within the Pod's termination grace period (unless delayed by finalizers). Other management of the container blocks until the hook completes or until the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks - **terminationMessagePath** (string) @@ -751,6 +811,10 @@ A single application container that you want to run within a pod. - **terminationMessagePolicy** (string) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated. + + Possible enum values: + - `"FallbackToLogsOnError"` will read the most recent contents of the container logs for the container status message when the container exits with an error and the terminationMessagePath has no contents. + - `"File"` is the default behavior and will set the container status message to the contents of the container's terminationMessagePath when the container exits. - **livenessProbe** (}}">Probe) @@ -776,7 +840,7 @@ A single application container that you want to run within a pod. - **securityContext.runAsUser** (int64) - The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows. - **securityContext.runAsNonRoot** (boolean) @@ -784,27 +848,27 @@ A single application container that you want to run within a pod. - **securityContext.runAsGroup** (int64) - The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows. - **securityContext.readOnlyRootFilesystem** (boolean) - Whether this container has a read-only root filesystem. Default is false. + Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows. - **securityContext.procMount** (string) - procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. + procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows. - **securityContext.privileged** (boolean) - Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. + Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows. - **securityContext.allowPrivilegeEscalation** (boolean) - AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN + AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows. - **securityContext.capabilities** (Capabilities) - The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. + The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows. *Adds and removes POSIX capabilities from running containers.* @@ -819,7 +883,7 @@ A single application container that you want to run within a pod. - **securityContext.seccompProfile** (SeccompProfile) - The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. + The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows. *SeccompProfile defines a pod/container's seccomp profile settings. Only one profile source may be set.* @@ -829,6 +893,11 @@ A single application container that you want to run within a pod. type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. + + Possible enum values: + - `"Localhost"` indicates a profile defined in a file on the node should be used. The file's location relative to \/seccomp. + - `"RuntimeDefault"` represents the default container runtime seccomp profile. + - `"Unconfined"` indicates no seccomp profile is applied (A.K.A. unconfined). - **securityContext.seccompProfile.localhostProfile** (string) @@ -836,7 +905,7 @@ A single application container that you want to run within a pod. - **securityContext.seLinuxOptions** (SELinuxOptions) - The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows. *SELinuxOptions are the labels to be applied to the container* @@ -859,7 +928,7 @@ A single application container that you want to run within a pod. - **securityContext.windowsOptions** (WindowsSecurityContextOptions) - The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux. *WindowsSecurityContextOptions contain Windows-specific options and credentials.* @@ -899,7 +968,11 @@ A single application container that you want to run within a pod. ## EphemeralContainer {#EphemeralContainer} -An EphemeralContainer is a container that may be added temporarily to an existing pod for user-initiated activities such as debugging. Ephemeral containers have no resource or scheduling guarantees, and they will not be restarted when they exit or when a pod is removed or restarted. If an ephemeral container causes a pod to exceed its resource allocation, the pod may be evicted. Ephemeral containers may not be added by directly updating the pod spec. They must be added via the pod's ephemeralcontainers subresource, and they will appear in the pod spec once added. This is an alpha feature enabled by the EphemeralContainers feature flag. +An EphemeralContainer is a temporary container that you may add to an existing Pod for user-initiated activities such as debugging. Ephemeral containers have no resource or scheduling guarantees, and they will not be restarted when they exit or when a Pod is removed or restarted. The kubelet may evict a Pod if an ephemeral container causes the Pod to exceed its resource allocation. + +To add an ephemeral container, use the ephemeralcontainers subresource of an existing Pod. Ephemeral containers may not be removed or restarted. + +This is a beta feature available on clusters that haven't disabled the EphemeralContainers feature gate.
    @@ -909,7 +982,9 @@ An EphemeralContainer is a container that may be added temporarily to an existin - **targetContainerName** (string) - If set, the name of the container from PodSpec that this ephemeral container targets. The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container. If not set then the ephemeral container is run in whatever namespaces are shared for the pod. Note that the container runtime must support this feature. + If set, the name of the container from PodSpec that this ephemeral container targets. The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container. If not set then the ephemeral container uses the namespaces configured in the Pod spec. + + The container runtime must implement support for this feature. If the runtime does not support namespace targeting then the result of setting this field is undefined. @@ -923,6 +998,11 @@ An EphemeralContainer is a container that may be added temporarily to an existin - **imagePullPolicy** (string) Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + + Possible enum values: + - `"Always"` means that kubelet always attempts to pull the latest image. Container will fail If the pull fails. + - `"IfNotPresent"` means that kubelet pulls if the image isn't present on disk. Container will fail if the image isn't present and the pull fails. + - `"Never"` means that kubelet never pulls an image, but only uses a local image. Container will fail if the image isn't present ### Entrypoint @@ -1064,7 +1144,7 @@ An EphemeralContainer is a container that may be added temporarily to an existin *Patch strategy: merge on key `mountPath`* - Pod volumes to mount into the container's filesystem. Cannot be updated. + Pod volumes to mount into the container's filesystem. Subpath mounts are not allowed for ephemeral containers. Cannot be updated. *VolumeMount describes a mounting of a Volume within a container.* @@ -1120,6 +1200,10 @@ An EphemeralContainer is a container that may be added temporarily to an existin - **terminationMessagePolicy** (string) Indicate how the termination message should be populated. File will use the contents of terminationMessagePath to populate the container status message on both success and failure. FallbackToLogsOnError will use the last chunk of container log output if the termination message file is empty and the container exited with an error. The log output is limited to 2048 bytes or 80 lines, whichever is smaller. Defaults to File. Cannot be updated. + + Possible enum values: + - `"FallbackToLogsOnError"` will read the most recent contents of the container logs for the container status message when the container exits with an error and the terminationMessagePath has no contents. + - `"File"` is the default behavior and will set the container status message to the contents of the container's terminationMessagePath when the container exits. ### Debugging @@ -1141,6 +1225,10 @@ An EphemeralContainer is a container that may be added temporarily to an existin - **ports** ([]ContainerPort) + *Patch strategy: merge on key `containerPort`* + + *Map: unique values on keys `containerPort, protocol` will be kept during a merge* + Ports are not allowed for ephemeral containers. @@ -1165,6 +1253,11 @@ An EphemeralContainer is a container that may be added temporarily to an existin - **ports.protocol** (string) Protocol for port. Must be UDP, TCP, or SCTP. Defaults to "TCP". + + Possible enum values: + - `"SCTP"` is the SCTP protocol. + - `"TCP"` is the TCP protocol. + - `"UDP"` is the UDP protocol. - **resources** (ResourceRequirements) @@ -1188,13 +1281,13 @@ An EphemeralContainer is a container that may be added temporarily to an existin *Lifecycle describes actions that the management system should take in response to container lifecycle events. For the PostStart and PreStop lifecycle handlers, management of the container blocks until the action is complete, unless the container process fails, in which case the handler is aborted.* - - **lifecycle.postStart** (}}">Handler) + - **lifecycle.postStart** (}}">LifecycleHandler) PostStart is called immediately after a container is created. If the handler fails, the container is terminated and restarted according to its restart policy. Other management of the container blocks until the hook completes. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks - - **lifecycle.preStop** (}}">Handler) + - **lifecycle.preStop** (}}">LifecycleHandler) - PreStop is called immediately before a container is terminated due to an API request or management event such as liveness/startup probe failure, preemption, resource contention, etc. The handler is not called if the container crashes or exits. The reason for termination is passed to the handler. The Pod's termination grace period countdown begins before the PreStop hooked is executed. Regardless of the outcome of the handler, the container will eventually terminate within the Pod's termination grace period. Other management of the container blocks until the hook completes or until the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + PreStop is called immediately before a container is terminated due to an API request or management event such as liveness/startup probe failure, preemption, resource contention, etc. The handler is not called if the container crashes or exits. The Pod's termination grace period countdown begins before the PreStop hook is executed. Regardless of the outcome of the handler, the container will eventually terminate within the Pod's termination grace period (unless delayed by finalizers). Other management of the container blocks until the hook completes or until the termination grace period is reached. More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks - **livenessProbe** (}}">Probe) @@ -1213,7 +1306,7 @@ An EphemeralContainer is a container that may be added temporarily to an existin - **securityContext.runAsUser** (int64) - The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows. - **securityContext.runAsNonRoot** (boolean) @@ -1221,27 +1314,27 @@ An EphemeralContainer is a container that may be added temporarily to an existin - **securityContext.runAsGroup** (int64) - The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + The GID to run the entrypoint of the container process. Uses runtime default if unset. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows. - **securityContext.readOnlyRootFilesystem** (boolean) - Whether this container has a read-only root filesystem. Default is false. + Whether this container has a read-only root filesystem. Default is false. Note that this field cannot be set when spec.os.name is windows. - **securityContext.procMount** (string) - procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. + procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note that this field cannot be set when spec.os.name is windows. - **securityContext.privileged** (boolean) - Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. + Run container in privileged mode. Processes in privileged containers are essentially equivalent to root on the host. Defaults to false. Note that this field cannot be set when spec.os.name is windows. - **securityContext.allowPrivilegeEscalation** (boolean) - AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN + AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. This bool directly controls if the no_new_privs flag will be set on the container process. AllowPrivilegeEscalation is true always when the container is: 1) run as Privileged 2) has CAP_SYS_ADMIN Note that this field cannot be set when spec.os.name is windows. - **securityContext.capabilities** (Capabilities) - The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. + The capabilities to add/drop when running containers. Defaults to the default set of capabilities granted by the container runtime. Note that this field cannot be set when spec.os.name is windows. *Adds and removes POSIX capabilities from running containers.* @@ -1256,7 +1349,7 @@ An EphemeralContainer is a container that may be added temporarily to an existin - **securityContext.seccompProfile** (SeccompProfile) - The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. + The seccomp options to use by this container. If seccomp options are provided at both the pod & container level, the container options override the pod options. Note that this field cannot be set when spec.os.name is windows. *SeccompProfile defines a pod/container's seccomp profile settings. Only one profile source may be set.* @@ -1266,6 +1359,11 @@ An EphemeralContainer is a container that may be added temporarily to an existin type indicates which kind of seccomp profile will be applied. Valid options are: Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. + + Possible enum values: + - `"Localhost"` indicates a profile defined in a file on the node should be used. The file's location relative to \/seccomp. + - `"RuntimeDefault"` represents the default container runtime seccomp profile. + - `"Unconfined"` indicates no seccomp profile is applied (A.K.A. unconfined). - **securityContext.seccompProfile.localhostProfile** (string) @@ -1273,7 +1371,7 @@ An EphemeralContainer is a container that may be added temporarily to an existin - **securityContext.seLinuxOptions** (SELinuxOptions) - The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + The SELinux context to be applied to the container. If unspecified, the container runtime will allocate a random SELinux context for each container. May also be set in PodSecurityContext. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is windows. *SELinuxOptions are the labels to be applied to the container* @@ -1296,7 +1394,7 @@ An EphemeralContainer is a container that may be added temporarily to an existin - **securityContext.windowsOptions** (WindowsSecurityContextOptions) - The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + The Windows specific settings applied to all containers. If unspecified, the options from the PodSecurityContext will be used. If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. Note that this field cannot be set when spec.os.name is linux. *WindowsSecurityContextOptions contain Windows-specific options and credentials.* @@ -1323,15 +1421,15 @@ An EphemeralContainer is a container that may be added temporarily to an existin -## Handler {#Handler} +## LifecycleHandler {#LifecycleHandler} -Handler defines a specific action that should be taken +LifecycleHandler defines a specific action that should be taken in a lifecycle hook. One and only one of the fields, except TCPSocket must be specified.
    - **exec** (ExecAction) - One and only one of the following should be specified. Exec specifies the action to take. + Exec specifies the action to take. *ExecAction describes a "run in container" action.* @@ -1380,10 +1478,14 @@ Handler defines a specific action that should be taken - **httpGet.scheme** (string) Scheme to use for connecting to the host. Defaults to HTTP. + + Possible enum values: + - `"HTTP"` means that the scheme used will be http:// + - `"HTTPS"` means that the scheme used will be https:// - **tcpSocket** (TCPSocketAction) - TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept for the backward compatibility. There are no validation of this field and lifecycle hooks will fail in runtime when tcp handler is specified. *TCPSocketAction describes an action based on opening a socket* @@ -1603,7 +1705,7 @@ Probe describes a health check to be performed against a container to determine - **exec** (ExecAction) - One and only one of the following should be specified. Exec specifies the action to take. + Exec specifies the action to take. *ExecAction describes a "run in container" action.* @@ -1652,10 +1754,14 @@ Probe describes a health check to be performed against a container to determine - **httpGet.scheme** (string) Scheme to use for connecting to the host. Defaults to HTTP. + + Possible enum values: + - `"HTTP"` means that the scheme used will be http:// + - `"HTTPS"` means that the scheme used will be https:// - **tcpSocket** (TCPSocketAction) - TCPSocket specifies an action involving a TCP port. TCP hooks not yet supported + TCPSocket specifies an action involving a TCP port. *TCPSocketAction describes an action based on opening a socket* @@ -1695,6 +1801,23 @@ Probe describes a health check to be performed against a container to determine Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. +- **grpc** (GRPCAction) + + GRPC specifies an action involving a GRPC port. This is an alpha field and requires enabling GRPCContainerProbe feature gate. + + + ** + + - **grpc.port** (int32), required + + Port number of the gRPC service. Number must be in the range 1 to 65535. + + - **grpc.service** (string) + + Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + @@ -1727,6 +1850,13 @@ PodStatus represents information about the status of a pod. Status may trail the Pending: The pod has been accepted by the Kubernetes system, but one or more of the container images has not been created. This includes time before being scheduled as well as time spent downloading images over the network, which could take a while. Running: The pod has been bound to a node, and all of the containers have been created. At least one container is still running, or is in the process of starting or restarting. Succeeded: All containers in the pod have terminated in success, and will not be restarted. Failed: All containers in the pod have terminated, and at least one container has terminated in failure. The container either exited with non-zero status or was terminated by the system. Unknown: For some reason the state of the pod could not be obtained, typically due to an error in communicating with the host of the pod. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-phase + + Possible enum values: + - `"Failed"` means that all containers in the pod have terminated, and at least one container has terminated in a failure (exited with a non-zero exit code or was stopped by the system). + - `"Pending"` means the pod has been accepted by the system, but one or more of the containers has not been started. This includes time before being bound to a node, as well as time spent pulling images onto the host. + - `"Running"` means the pod has been bound to a node and all of the containers have been started. At least one container is still running or is in the process of being restarted. + - `"Succeeded"` means that all containers in the pod have voluntarily terminated with a container exit code of 0, and the system is not going to restart any of these containers. + - `"Unknown"` means that for some reason the state of the pod could not be obtained, typically due to an error in communicating with the host of the pod. Deprecated: It isn't being set since 2015 (74da3b14b0c0f658b3bb8d2def5094686d0e9095) - **message** (string) @@ -1770,6 +1900,12 @@ PodStatus represents information about the status of a pod. Status may trail the - **conditions.type** (string), required Type is the type of the condition. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#pod-conditions + + Possible enum values: + - `"ContainersReady"` indicates whether all containers in the pod are ready. + - `"Initialized"` means that all init containers in the pod have started successfully. + - `"PodScheduled"` represents status of the scheduling process for this pod. + - `"Ready"` means the pod is able to service requests and should be added to the load balancing pools of all matching services. - **conditions.lastProbeTime** (Time) @@ -1796,6 +1932,11 @@ PodStatus represents information about the status of a pod. Status may trail the - **qosClass** (string) The Quality of Service (QOS) classification assigned to the pod based on resource requirements See PodQOSClass type for available QOS classes More info: https://git.k8s.io/community/contributors/design-proposals/node/resource-qos.md + + Possible enum values: + - `"BestEffort"` is the BestEffort qos class. + - `"Burstable"` is the Burstable qos class. + - `"Guaranteed"` is the Guaranteed qos class. - **initContainerStatuses** ([]ContainerStatus) @@ -1810,7 +1951,7 @@ PodStatus represents information about the status of a pod. Status may trail the - **initContainerStatuses.image** (string), required - The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images + The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images. - **initContainerStatuses.imageID** (string), required @@ -1980,7 +2121,7 @@ PodStatus represents information about the status of a pod. Status may trail the - **initContainerStatuses.restartCount** (int32), required - The number of times the container has been restarted, currently based on the number of dead containers that have not yet been removed. Note that this is calculated from dead containers. But those containers are subject to garbage collection. This value will get capped at 5 by GC. + The number of times the container has been restarted. - **initContainerStatuses.started** (boolean) @@ -1999,7 +2140,7 @@ PodStatus represents information about the status of a pod. Status may trail the - **containerStatuses.image** (string), required - The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images + The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images. - **containerStatuses.imageID** (string), required @@ -2169,7 +2310,7 @@ PodStatus represents information about the status of a pod. Status may trail the - **containerStatuses.restartCount** (int32), required - The number of times the container has been restarted, currently based on the number of dead containers that have not yet been removed. Note that this is calculated from dead containers. But those containers are subject to garbage collection. This value will get capped at 5 by GC. + The number of times the container has been restarted. - **containerStatuses.started** (boolean) @@ -2177,7 +2318,7 @@ PodStatus represents information about the status of a pod. Status may trail the - **ephemeralContainerStatuses** ([]ContainerStatus) - Status for any ephemeral containers that have run in this pod. This field is alpha-level and is only populated by servers that enable the EphemeralContainers feature. + Status for any ephemeral containers that have run in this pod. This field is beta-level and available on clusters that haven't disabled the EphemeralContainers feature gate. *ContainerStatus contains details for the current status of this container.* @@ -2188,7 +2329,7 @@ PodStatus represents information about the status of a pod. Status may trail the - **ephemeralContainerStatuses.image** (string), required - The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images + The image the container is running. More info: https://kubernetes.io/docs/concepts/containers/images. - **ephemeralContainerStatuses.imageID** (string), required @@ -2358,7 +2499,7 @@ PodStatus represents information about the status of a pod. Status may trail the - **ephemeralContainerStatuses.restartCount** (int32), required - The number of times the container has been restarted, currently based on the number of dead containers that have not yet been removed. Note that this is calculated from dead containers. But those containers are subject to garbage collection. This value will get capped at 5 by GC. + The number of times the container has been restarted. - **ephemeralContainerStatuses.started** (boolean) @@ -2747,6 +2888,11 @@ POST /api/v1/namespaces/{namespace}/pods }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -2799,6 +2945,11 @@ PUT /api/v1/namespaces/{namespace}/pods/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -2849,6 +3000,11 @@ PUT /api/v1/namespaces/{namespace}/pods/{name}/ephemeralcontainers }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -2899,6 +3055,11 @@ PUT /api/v1/namespaces/{namespace}/pods/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -2949,6 +3110,11 @@ PATCH /api/v1/namespaces/{namespace}/pods/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -3004,6 +3170,11 @@ PATCH /api/v1/namespaces/{namespace}/pods/{name}/ephemeralcontainers }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -3059,6 +3230,11 @@ PATCH /api/v1/namespaces/{namespace}/pods/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/priority-class-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/priority-class-v1.md index cd96fe6790..20233188ac 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/priority-class-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/priority-class-v1.md @@ -6,7 +6,7 @@ api_metadata: content_type: "api_reference" description: "PriorityClass defines mapping from a priority class name to the priority integer value." title: "PriorityClass" -weight: 13 +weight: 14 auto_generated: true --- @@ -217,6 +217,11 @@ POST /apis/scheduling.k8s.io/v1/priorityclasses }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -264,6 +269,11 @@ PUT /apis/scheduling.k8s.io/v1/priorityclasses/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -309,6 +319,11 @@ PATCH /apis/scheduling.k8s.io/v1/priorityclasses/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/replica-set-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/replica-set-v1.md index f2c5f894af..e9a60070dc 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/replica-set-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/replica-set-v1.md @@ -96,7 +96,7 @@ ReplicaSetStatus represents the current status of a ReplicaSet. - **readyReplicas** (int32) - The number of ready replicas for this replica set. + readyReplicas is the number of pods targeted by this ReplicaSet with a Ready Condition. - **fullyLabeledReplicas** (int32) @@ -413,6 +413,11 @@ POST /apis/apps/v1/namespaces/{namespace}/replicasets }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -465,6 +470,11 @@ PUT /apis/apps/v1/namespaces/{namespace}/replicasets/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -515,6 +525,11 @@ PUT /apis/apps/v1/namespaces/{namespace}/replicasets/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -565,6 +580,11 @@ PATCH /apis/apps/v1/namespaces/{namespace}/replicasets/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -620,6 +640,11 @@ PATCH /apis/apps/v1/namespaces/{namespace}/replicasets/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/replication-controller-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/replication-controller-v1.md index 890897ecbb..a83a50a4cb 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/replication-controller-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/replication-controller-v1.md @@ -413,6 +413,11 @@ POST /api/v1/namespaces/{namespace}/replicationcontrollers }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -465,6 +470,11 @@ PUT /api/v1/namespaces/{namespace}/replicationcontrollers/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -515,6 +525,11 @@ PUT /api/v1/namespaces/{namespace}/replicationcontrollers/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -565,6 +580,11 @@ PATCH /api/v1/namespaces/{namespace}/replicationcontrollers/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -620,6 +640,11 @@ PATCH /api/v1/namespaces/{namespace}/replicationcontrollers/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force diff --git a/content/en/docs/reference/kubernetes-api/workload-resources/stateful-set-v1.md b/content/en/docs/reference/kubernetes-api/workload-resources/stateful-set-v1.md index 6bc6da0e15..cb10234801 100644 --- a/content/en/docs/reference/kubernetes-api/workload-resources/stateful-set-v1.md +++ b/content/en/docs/reference/kubernetes-api/workload-resources/stateful-set-v1.md @@ -89,6 +89,10 @@ A StatefulSetSpec is the specification of a StatefulSet. - **updateStrategy.type** (string) Type indicates the type of the StatefulSetUpdateStrategy. Default is RollingUpdate. + + Possible enum values: + - `"OnDelete"` triggers the legacy behavior. Version tracking and ordered rolling restarts are disabled. Pods are recreated from the StatefulSetSpec when they are manually deleted. When a scale operation is performed with this strategy,specification version indicated by the StatefulSet's currentRevision. + - `"RollingUpdate"` indicates that update will be applied to all Pods in the StatefulSet with respect to the StatefulSet ordering constraints. When a scale operation is performed with this strategy, new Pods will be created from the specification version indicated by the StatefulSet's updateRevision. - **updateStrategy.rollingUpdate** (RollingUpdateStatefulSetStrategy) @@ -104,6 +108,10 @@ A StatefulSetSpec is the specification of a StatefulSet. - **podManagementPolicy** (string) podManagementPolicy controls how pods are created during initial scale up, when replacing pods on nodes, or when scaling down. The default policy is `OrderedReady`, where pods are created in increasing order (pod-0, then pod-1, etc) and the controller will wait until each pod is ready before continuing. When scaling down, the pods are removed in the opposite order. The alternative policy is `Parallel` which will create pods in parallel to match the desired scale without waiting, and on scale down will delete all pods at once. + + Possible enum values: + - `"OrderedReady"` will create pods in strictly increasing order on scale up and strictly decreasing order on scale down, progressing only when the previous pod is ready or terminated. At most one pod will be changed at any time. + - `"Parallel"` will create and delete pods as soon as the stateful set replica count is changed, and will not wait for pods to be ready or complete termination. - **revisionHistoryLimit** (int32) @@ -117,6 +125,21 @@ A StatefulSetSpec is the specification of a StatefulSet. Minimum number of seconds for which a newly created pod should be ready without any of its container crashing for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready) This is an alpha field and requires enabling StatefulSetMinReadySeconds feature gate. +- **persistentVolumeClaimRetentionPolicy** (StatefulSetPersistentVolumeClaimRetentionPolicy) + + persistentVolumeClaimRetentionPolicy describes the lifecycle of persistent volume claims created from volumeClaimTemplates. By default, all persistent volume claims are created as needed and retained until manually deleted. This policy allows the lifecycle to be altered, for example by deleting persistent volume claims when their stateful set is deleted, or when their pod is scaled down. This requires the StatefulSetAutoDeletePVC feature gate to be enabled, which is alpha. +optional + + + *StatefulSetPersistentVolumeClaimRetentionPolicy describes the policy used for PVCs created from the StatefulSet VolumeClaimTemplates.* + + - **persistentVolumeClaimRetentionPolicy.whenDeleted** (string) + + WhenDeleted specifies what happens to PVCs created from StatefulSet VolumeClaimTemplates when the StatefulSet is deleted. The default policy of `Retain` causes PVCs to not be affected by StatefulSet deletion. The `Delete` policy causes those PVCs to be deleted. + + - **persistentVolumeClaimRetentionPolicy.whenScaled** (string) + + WhenScaled specifies what happens to PVCs created from StatefulSet VolumeClaimTemplates when the StatefulSet is scaled down. The default policy of `Retain` causes PVCs to not be affected by a scaledown. The `Delete` policy causes the associated PVCs for any excess pods above the replica count to be deleted. + @@ -133,7 +156,7 @@ StatefulSetStatus represents the current state of a StatefulSet. - **readyReplicas** (int32) - readyReplicas is the number of Pods created by the StatefulSet controller that have a Ready Condition. + readyReplicas is the number of pods created for this StatefulSet with a Ready Condition. - **currentReplicas** (int32) @@ -143,9 +166,9 @@ StatefulSetStatus represents the current state of a StatefulSet. updatedReplicas is the number of Pods created by the StatefulSet controller from the StatefulSet version indicated by updateRevision. -- **availableReplicas** (int32) +- **availableReplicas** (int32), required - Total number of available pods (ready for at least minReadySeconds) targeted by this statefulset. This is an alpha field and requires enabling StatefulSetMinReadySeconds feature gate. Remove omitempty when graduating to beta + Total number of available pods (ready for at least minReadySeconds) targeted by this statefulset. This is a beta field and enabled/disabled by StatefulSetMinReadySeconds feature gate. - **collisionCount** (int32) @@ -470,6 +493,11 @@ POST /apis/apps/v1/namespaces/{namespace}/statefulsets }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -522,6 +550,11 @@ PUT /apis/apps/v1/namespaces/{namespace}/statefulsets/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -572,6 +605,11 @@ PUT /apis/apps/v1/namespaces/{namespace}/statefulsets/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **pretty** (*in query*): string }}">pretty @@ -622,6 +660,11 @@ PATCH /apis/apps/v1/namespaces/{namespace}/statefulsets/{name} }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force @@ -677,6 +720,11 @@ PATCH /apis/apps/v1/namespaces/{namespace}/statefulsets/{name}/status }}">fieldManager +- **fieldValidation** (*in query*): string + + }}">fieldValidation + + - **force** (*in query*): boolean }}">force From 69f6250d6e798a1b640fefa8e72a0a33d4d87a34 Mon Sep 17 00:00:00 2001 From: OlaAde Date: Wed, 8 Dec 2021 21:26:19 +0300 Subject: [PATCH 146/148] Typo Correction Added missing `:` colons to the sample code. --- content/en/docs/concepts/services-networking/ingress.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/services-networking/ingress.md b/content/en/docs/concepts/services-networking/ingress.md index 52e8771418..efcdff7151 100644 --- a/content/en/docs/concepts/services-networking/ingress.md +++ b/content/en/docs/concepts/services-networking/ingress.md @@ -250,7 +250,7 @@ kind: IngressClass metadata: name: external-lb-1 spec: - controller example.com/ingress-controller + controller: example.com/ingress-controller parameters: # The parameters for this IngressClass are specified in a # ClusterIngressParameter (API group k8s.example.net) named @@ -297,7 +297,7 @@ kind: IngressClass metadata: name: external-lb-2 spec: - controller example.com/ingress-controller + controller: example.com/ingress-controller parameters: # The parameters for this IngressClass are specified in an # IngressParameter (API group k8s.example.com) named "external-config", From bea7fe7116f94149fcde8b8cbd0fd75fc18c5a3e Mon Sep 17 00:00:00 2001 From: Jim Angel Date: Wed, 8 Dec 2021 19:07:05 -0600 Subject: [PATCH 147/148] fix wrong url --- .../en/blog/_posts/2021-12-09-pod-security-admission-beta.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md b/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md index ae4de7ad25..e578ff4b3e 100644 --- a/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md +++ b/content/en/blog/_posts/2021-12-09-pod-security-admission-beta.md @@ -770,7 +770,7 @@ Listed as "optional future extensions" and currently out of scope, SIG Auth has Pod Security is a promising new feature that provides an out-of-the-box way to allow users to improve the security posture of their workloads. Like any new enhancement that has matured to beta, we ask that you try it out, provide feedback, or share your experience via either raising a Github issue or joining SIG Auth community meetings. It's our hope that Pod Security will be deployed on every cluster in our ongoing pursuit as a community to make Kubernetes security a priority. -For a step by step guide on how to enable "baseline" Pod Security Standards with Pod Security Admission feature please refer to these dedicated [tutorials](/docs/tutorials/pod-security) that cover the configuration needed at cluster level and namespace level. +For a step by step guide on how to enable "baseline" Pod Security Standards with Pod Security Admission feature please refer to these dedicated [tutorials](/docs/tutorials/security/) that cover the configuration needed at cluster level and namespace level. ## Additional resources From a1506ae810d86c66671178fa69864149f0f0d4d2 Mon Sep 17 00:00:00 2001 From: Rey Lejano Date: Mon, 6 Dec 2021 13:29:10 -0800 Subject: [PATCH 148/148] add hpa v2beta1 and v2beta2 to deprecation guide --- .../reference/using-api/deprecation-guide.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/content/en/docs/reference/using-api/deprecation-guide.md b/content/en/docs/reference/using-api/deprecation-guide.md index 579e4c04ac..0de8345d10 100644 --- a/content/en/docs/reference/using-api/deprecation-guide.md +++ b/content/en/docs/reference/using-api/deprecation-guide.md @@ -20,6 +20,16 @@ deprecated API versions to newer and more stable API versions. ## Removed APIs by release +### v1.26 + +The **v1.26** release will stop serving the following deprecated API versions: + +#### HorizontalPodAutoscaler {#horizontalpodautoscaler-v126} + +The **autoscaling/v2beta2** API version of HorizontalPodAutoscaler will no longer be served in v1.26. + +* Migrate manifests and API clients to use the **autoscaling/v2** API version, available since v1.23. +* All existing persisted objects are accessible via the new API ### v1.25 @@ -60,6 +70,13 @@ The **events.k8s.io/v1beta1** API version of Event will no longer be served in v * use `reportingController` instead of the deprecated `source.component` field (which is renamed to `deprecatedSource.component` and not permitted in new **events.k8s.io/v1** Events) * use `reportingInstance` instead of the deprecated `source.host` field (which is renamed to `deprecatedSource.host` and not permitted in new **events.k8s.io/v1** Events) +#### HorizontalPodAutoscaler {#horizontalpodautoscaler-v125} + +The **autoscaling/v2beta1** API version of HorizontalPodAutoscaler will no longer be served in v1.25. + +* Migrate manifests and API clients to use the **autoscaling/v2** API version, available since v1.23. +* All existing persisted objects are accessible via the new API + #### PodDisruptionBudget {#poddisruptionbudget-v125} The **policy/v1beta1** API version of PodDisruptionBudget will no longer be served in v1.25.

    =>Wv@JV(=mC}v(vZt4QL$pFZ3uLYD!gna01!38DTWuln;YKP1is{LL~QFo`gWzgMGUS_V^=`cb8FTjeV`isz!K-A-rl( zmkw=%&-bTAD~jv}Qah;EsSAU`c5fb4=ATgCkAl-f6$C(|??CFG=3WHpVp0#Hov(+% zQb;UtP*_OpO*)AWbnL`0)2e~bs^6*3Fxqeo;THg(C>;vs>l+xmM`^AOST51tr3>T?ND252qH7C0BOT!c$N@JNeFWq-FR!e?W>6OmjhELq_k&5Royb=bk$m3sd+xj4 z+-l`nD~)Pl1`b=l#Oz+aH23jgdH??XmEeE8w_E`z%%!DYqNLAs+%BnRE-r@O7%L4j z4+mb+^)D-mXPA0ULK2VzK-@D)w!;)Z0)_eH08slUjt`#F;Q^uV|NFRD*aF|*1s#-mv6|T-eQL$lJbPN)81mVslFV42 zfh(R&{TTx3r0kxm(U<5Bs%=;%+r{?4taIb z+ut`klNx3U%#inxIwe5+hzHwu-micl-mG|nZK`0 zK(buy#NVdkPiz5|N8BJJRicfOCcR@`QjtaWm%c&8B?3x#;@i~MM^z;PFmpq(2Rf_v zKeKFZaM6{M@mUr;woI!lK)dJDKR2RoO$aT+4~p#zD$h(EVz>& zr@Znu7Q)mjGs=*4{%Bk{wV*&%P3rmYE@4`UO-}N7Xzap7#UFN;@5vaCbvXMmT_U^X z#^u8)+?axH(Xp_$k-~{x<&)0r>)l@Wmg?WFL6mF(`MW?g&q39cR)!n}M1`w*M&tX$ zaM0Bo)EV*&Jfvtu7f#a^WngFU8|LaA-e$%GHpVyhQqe*W1fN|x9V4ESnEP&Yim34>zDU1T2=Z((yK;B>C>jd zD+qb7K>1FFr0a&{Mqj{h(0fpe=F(Ju}*Hwk`I|{kvp7FxhKW_A5 z`7-N!Kla*$dy<_(RPLV)7ylmE7KL;G(_7k8FVYon>IDcX>sK{H$MbXn@pl8Oc$+l? zGnkT)VVF#p*ENJ5DsC{7VhRcdY%R1s<#)Q(8B!UndK+MJS;zjEC@BF{mu}w@_WUfVa}xojxHH(d2vaHSib*_auFdiSl^lb>m8<~}(aynSfT_5s?I zH%MMx4|&woQ4>;~G;lG~>fjmxg@1-1$7vof?^b* zoB#Xs#%ha?Ai6Cp~o#^ z(a2F}Fu#G-RB-k6j%34~l#6LG6bjDTSN_Q<;(%3q)IuhL7ARdPb17+?%XXNVGGG~6 zrs*@NP_1#8lNm{qEU1jePFe38WfHO&=*TEJ*{e(`CknvQiNR$xOY#t#TRA0PgNgQT zP(WnV+DDUgsX| z00x@OUa!xy)nz%gsRI<)>Xm2o^#Vrj?}M*lzwkGMKv%Yo9_Srt%XnKmyexMsk$Y#~ zN}5PIp>N|q&cy$`v8DH2F$#PmTeQS3L?c5Y3|R62L^5}FraPR~tb7nHbz)tn{MBWZ z_Vee@+k?@*^#6P?-JrK}vfDDit!{w@7)5Zw{mXUS2-mjUhZp+0E}7l(^TC_il6g2& zS}4|)>Z9+a9^%s=cNb2Wfhh-!)72CrR1mx_tV23g@MFROTaa1GGWqyTvPNNzoPR`5 zOgCxYsa=21jqVsX_+Tb!~*8h+oxprNQ+!`fx2>ix~bbRTYYbWQ;lb znNmv#6zbh%%`1nZEMFx<^6$%MNU;UeAl*kW@!W-OZinT7!KzeD|MhRuyN^ibh}@t* zWNT1xt*;D(bu8}T^oZ~{F?1D)@g8=$7j(1AY*Cz)t0R_&yh~+V=nqv1@wNxb@L?7< z@~{CvCol7i2l5~Rf+VKUeBKG|ii*lAAr=X!-xGrYULXLO2ZVS_!sXZnSz3Yqx^)qb zF#Z&E{&bDq8-(oZ?D03^Ffk6N{_+q5otsF#XOFG+tinSrgP9HD1#UF!NVWk00t9rg zE3kux1*%VfwgEV_M^-m>I=fmy^t zXl=;=HQ_i?r}2(O^$|UC!oSZWVjq2t1Wl3O@5Pu z?4N^{$yR57c&ea1PwA3u50J^p=ncgWl1LC~OqsO|i*=<9RPyOP_WDv2Gw z{JfI{-AF|7Cys~rwRr<86|Sp{8|7%=pmXW+kgi0!u^K}^{%tSq6|9`fu}{4+$^e31 zIdlH=1{4%h=bZdk@_8kdt5J5@i=1!U;sA(N=Yn<8#6Nh`o%h3x-j4$o1J)H#syjKy z=N8*usp0Ocf8K8I4{I(IfAnMNZ`=k`9UQ7&SWu^!ko4FBgjCkmrjFapl|D}c4! zpV`Uc_G^dG?_eljZDL}gX>ErT0CQd6vFHf40+S5;c z4tiecWBNi)p)D^R6e^nLy7G-muE(zD1d0`My@PF7ceMNSI75jVDO1@k5p})qNrrlq z?p+7UX0tZ_sfd$%iLypaD#cNzi(y#)l!0Y+E;nh4U#)#BUdt7qoGALl;C z@yQP_Q&S7;i!}h(6GRVa&7y7mw9gyNbDxrvOK{XRKm)q3f%`m0FvO)x*f~eI8L!@L zb?!}Jy7^Xqr^oDBWw+e%gRYXP1s(hpTEE;r*6bNW!phcR_t_@5qdf%c1xa$Nfhj$& z;n_mWhXFU4e5AM6K@1Cr>m^F<_~~7-Z1iDhLD`-a1#+neV#^Z6%O|T^^1U2RqVkuX zMpT;_kuoy(m9kyytz*%@Kq!|Mx(=q*BZ>u21p4ji4ku4Ub&tcGLm)LpBZ_rlEcs zA6%bJlQoOJcitZ6^ru0HFAUh4g037Lp=MbII2dYBvV=SyjhSZKU>kDte`FY~m0flV zX5sW$R`8fGAmX(C+=m>7boxse#0A`J9_OHuy^RP34+<%WJa7qA7=$3r1=D42g+U4Y zlLKkPhGY`?2zhenQ+%@%pVvY>Fh0@%I&AR04?zNz^CA6FodKLfuFy8**VAiv5}IJa%ySm?%(@w zwp`orn!wIb!pqxs@S2BY{hxnhf6(^iKiJ=M{>|kLKJOiBAQklA);OIYL_Eb--JZr3qfUNj)U9inkf42(l6lPJ zy~utE|I&E=x(!OVetCnPm#M1HYa*5_A;e7PnYz+(;e}Ik@?}Km7ZK*#F>zSwd>w%H zRp~aB3!;^6yR(Ez;tEr3PQLcgU1~#eu8H>B(oG&|2Inow1UN^j8_2?3QxBAt(h66t z@~s68KoaMYO9KiKs}cg72poHnSIhV{*-SBfuOIGj&LFy;`Nk$1-0!L+9f8$}s53>?c z6}l}O+X5*sWO1AxRfxSJ_qk zFdSt0TKaYuJSYRvdzpQjd4VN@Oq!WI*H`L>aCKusMwzXg8T@}kW931Hj0j>L9hyHa zD|Ro{ii=orKU_-bx!@x(64WCO)c{?WAEN7X@WE?QTho&tz9&-Hv`CIJiYhap=zosd7sFYP_6<k&qob0y&l*(wTHdZ`#~1VBUqprkr%`{=ADjU5a+r*NtU4N`jI zVA<8O&xEEvw_6U$sGh))w3E4bud?Iv@;CcYNw9g5Q zI-9*px(9A(hk7@ZR)6i8_y6d#X?w+OE9!li`0BRhE{p-a=A`+g_?sUokUm-cS2C>` zNTy{z-A9!bGNb-S>ahW3KK@7Qd371$=b!%S@(@nDxM+z5XxGjnVo=4kKhsPBWNQ zMj>$I7BzBUL};~aSJ$^U{tuG2LpuAuXFl;<5dM~b-{}Fya z7?K*})+f&+_@+5?)+4%M-IO=w_iFuz{Nh)(_8oPkY*8b;y*nqZ{7t$fVASzwOk7my z;0?WJ1Jusi3fmEb%iBbwYEUU-W(>hKDo=zGz`}oWdj^40{>I*?ugY0?Uo9t1vGUwV z#4g^^P;U>t3qvKu4H#Gv8t-JNhI*~v-Xt)7BT{7*nVm|t4o`^DN_`<+N3Er5QDs3@ z%AsTYAd%`CqN`5B%LAsQa&f3z9K$uLQ{H+CYSp7?`qj&*y}eAQ{xxesfP$Tv14Sc8 z9|8gb60_;!3R*#=oA&v7Qf#WX+Mp@q2q#W?@jGGa$m7GRA-E7zsPDYwpezM3i8)b- z3C|JqNO+|d^W0Mbmk=JvL8~^5*4JBs>pnon>K@LgExdsE*Om=@<_$K(#?bbO-{hS4 z2AR)oQwI?cHTH>4+4g$(=TY(V%A*qlAJ8bcs|fQH-%wNy8=Nxyh9bI&r3s5cGK{La zpz@2zxygSDaE1JelwT=x0am(INrnmk^Kuf_|HINtQhKFobycS^n$~gkqYYPe243+Y+;(0sxboB$P&*#<9uZTBmF{u0}K1MUaB9 zF*@OQD*7By1R$*Z(OFa;->-y{f#n^kclBci>IHN+i=7Y%rhFvMR^4D(62-it_smHW zeDt`8J@|v^Z``32DPdQYJ~oSA-tw{H9NAx&UbKoifNyTU8;g2C4uBTD#BLh@R!$#j z8Qb}Fb*(3L9xD4n>)JH0_(Mg!w4cL z`!44*$={XQiASD?Y zp4eh`bd?2=6;Shr0P@!qv<9^+#ugm=k(<0DLR~aQJ8RwZHl`3347d?&2 zf8U$5x;38OHum_#fV!Umm3=rkt2$bd+0pN}=&Uum`!A6F)&1b8BZqNE$u*al;t_!z z_^Vg58oD;BRzIU{IP)BOR{mur|Gy!2eX+R5E{D|LV$Jz0IvYmET@D110OomlL*4Bm zjZD$u=H_M)a~c3W0svd!!Y|ujnaxLtlvpE8)IZv1!(#l*hnzOgR1U>*#ZR9-BaW6l zfB|3Ju{fpp$eB++bKK|lyOr&N|K+z$dl0t1-siDxMQts4eq5L&SY}I#8ad}6BLDL< z)20a%(4ij-gm-=wK5%TtTcs;*$2v z7)5JSqvp}RkX~tGz+X$Ac$@cG92kDWIhp2U?#z%__0ifgh>^4bLWyFbE7%@e&HfP% z?1L$5rGt^>2+4nE0SI4L6}=--QyYe>!)iJRWJE^LxB(OqHIf4-Q@{gfWtCGQScY?L za%7U0sDQA^_vb8#ss_c*<~{`OQT2(B=uslctfZq9q(ICg^jaWw#joCi8#dsKg88r) zT6fctDJ{5y%yEJvsHj6$$_JU}mClwe`g-jX$Khe1sz>%h&qG+`D73VjpS*cJG;~8$ zCiWoJ`OYx7-q;PF+y@D;+FqW46t4N@6 z$QqAJS+|xpZ8wgPiasD)27qZ|`vX;!0o2Dw%(+0KNrKJ9isj-YjN9RK^UK1hej}+B zOT*b8zJ(O4jArM4pL>_D^0eImSUt<9$JY9d^@w8X>1;i)n2k*IK_5&cyv~Aa9*&G( z#(s$cB*zBlD`6c}PCQp_(XDt*-)sHbPT%a=J@=E!OUr-K^Z$FSd+Jnw{v52#>Oquw z)W%)@?b{o`XOcLWu$WZ8!=rlAqu&q^?RT~y>bwM`Y_xUvlk~~KfZYH4SB>-0in260 z==em;=R^oJ2M|&~mIu5`azM5G$J~1Pa%t9YyP4E+>sJjNU9@+*CIE%p42>seFoxz%MNrftmJQC}eWdK5FNBV<4 z9ltGDBa_8zRWzse9z#)i^b$|-rZA7pE<#;le*B9=q#>Q)$|-@KUhIQg5L;;~b}S^9 zGM1vQUuWFF77k|}+OOsgG*%@mr9U|E?D)FZCL9y#W-r7Qe?6AFK|b^tU%Wiis+?u> zqD^JVqh-~$l%ImCKyc+7tE)~cX*7&5kAr>8ORm1Z_Rcs&C1XuPsYshV6dTRDy$Yk- zHBoI=dbQ{Y=}aI(>2jP&r__~15>c?eTl9Ih==%?i*Bu%+NgD>Ric z8rL#th9emwa{pun_9S~DIf%MIjKL*$2)#LqOjOFewPMR{Iw|4V-Im-8%kaV6WIW;fa;=*d=3H!qe*^Fpe4hO z86S5|?`H0+@%F9KE?2)dkSc#ITm@BvIqliS+5|Mg(j@!-4KDY9lfRG*qP5q`> zdSJr-H_}QfCAvfz8(}}cfr^wW-VGJYFh~;-Wjl_v)0H^B2O4VucdjSGN=)L@a+|`b zT_O^DyoNkNDk{|h*vxjE{((d>K>qjA$HzA+r|nHqohFpwMeJ+GwY0x(Sc{=wm;F&X18*c7qDZzXa@ z&^=f)Vl^WqV-~c1^w+n{ddKs4h;9Dc<#DyZ>;Fn6Dc<{Zr6Jz6>RYsVKRT+nv9WQ5 zOn(0Sd1bHy83x90T{&MO%p)c@Zu9VXE*JpIcx>$YqeqXn=K`s(M8~&$CM2M%0e4p` z9N?T8^2Xen8ExFs#}BRqcmM{yvU$;kxi=l*w;%0$&F>OF8~E157cd6g;Jq@mx%M<|F@9W269-U>GMN}{IV{DqWr=semKlWI zU+Gf<5Q#lYAE4kU%tiQ*b!btCtZlk2E&ZiN3Au_MxY!A}URAa}pkZL0Pb1d^B(hJU zD5iw6U!~{D1VXK+u7f6yuAe>8+j69qK$j-=Wmc9kgLDZ@g<=`=60}kyPFh=|8doCg}H5n=H4wdk|RhQocX1;Y+e);3!zF4 zq_M%PqMc2-gBSy-YZ`$6&&{$ZC{$E5?a#Uyj0C15i%z+vI3yMq#*gA8zL^&2mLX58 zFp~U3oZQ(u$Puw7LqRY@%0)NerULPAB^UR*w{H|ZJYZ`F zb78~dJ_hgQ9)`M;wfC^#Y$EdTa9@i5AJ*yncshoF5cG99ds&mXU;+Vjb?z#LZ4oV*^qxj)+n@Ru6v<~nF#}}z<^$Qz5Rdd< z$qkRdl)uN1v$paBx{*@6*9M-gNi4d%svWmZYaSutxDk!`O%^Fd!S34r^qtpMq`*~D z{}(0G_g4PJH9}i^-}KuAUAQ;Pte)+3`>Sq29IZmxfAZrjzXDTeb;covgjv<*a{i`u zjr|?9)kzVSrGgF9rA#>%%LZyP(XB2Q$5!5itQcfz-N&ZqSNvUzE@H<9HYksHymExIsk*2nE5s zZw<;u`gW;a;z?j{byN@%hjTlVg7akAc!-m%N~m-5qH^&%e_Jmu2!hQ3-IY8@T*jX& zH;iMhu5)Ha3YXQN?(N*Xu%X>;h>xN0?Kca}ZKln){@qY!i@n7$RKuMU*eW^&zis{V zy1}hBh~e~P5LD*p=j1BNgrQIY%TIw&u--F-%zTjVidlN+0Cf>hU>SZ-%Bk?Vc-G3mOu@%nD=%ZPNo;4Z7jvs=6`s34kx0q9o(hNsu)VD^vR#PDMrK=-?2V znE1@vUQ3T8>ag@sHxN+!jM(7MCw|WM%jUuefsECI``yTNDA;=&rhHAcpI_ zF>aex;+b!IDRjQ|>W<$$^`-fx259|_vD)Ce?eS(~K>e-g)*lW32eY56{Qdog@AuW6 zHTy5q!B;j>EC1X-u|M}Y0)U^^=NCSIGvj@=%-PwFA$@6LfwPzAv&zFlqK?0bt`@W@ zpekxg{?(miS5$nZ1#A+ioT-Hc;g{*x%pmd`SM>q-fZMdI{)IHQgyu@a>EdiO3xaN6 zHM;^-BJj+?=P!deU!o324#Kz}7X>y&!*wMP={~L(f=$(9y7E~ZVCD${CApBzy{2Y6Xz~6AMso}QQrnmi4RWzTMyHW{|C~Vnr)9K2ge{@|YJ8tYhu?diD zizy~qh2>#oQztZi@Txo`h72**6d-+CggJ~CI70>x<+*5~vdxH&81A1sk5SvpOuU%I z=&_u#$;bNSsx(_OjzKcBheZ>1lmbg+p2(OVuK52)*Lwgp{RUm5p$DXdCLIFORXRu& z2pvHnfD{4gMFjB=NbjLalOnwrA=0b#9;8TBP(i9vMLoXrMqA3 zXE-|%@g9{HdvHm-Nq2_lwBc^5ST2m zDotJ5{8Aj4zR=|3C4VuojcV_TwCe8Z!NFLK%B#^351mDiJ>?)xT-Nb(qF3`?pAhrx z#7td!E%faB2&syGM^)*U7~E~93~nSBMrnP^PfQ$JPFBX0Z7~Yt3KNp920xWOqRG7& z^V)A24S=5P#eakTrXr_83c&`nvWZg8KE+7Xl1k=ue2Uv!fb1kxuo z<@{_((R~lDOk%7IQJr2aIWBpQNv?gz8dIYa>xr#fu1*<7c=NWMRco{X=m z)xNZ8(JZf~D7c`R4;^9KMRpzZ)cs>tObN7#o32Yp>00v1rU!0=Sm zrbnp892oSZ^se^at?dd*50lp9YtYsXA+#VOV4#Uizg0}NaYl(mf{9P251w&Yru*$q z)7(~YT<1mp_OUm!9WiZxSKR#pPuyzGB}ZK$EK z!(5i1}nh9Yrsmk z)qkeqJDgngWgCNq2kYZDE-qxR@8=8~ia~1X>%%H5Z)eMR2}E|fDigC~sq)p1-2lPB z??!>Nl-*MvF~H|mTugjyd;RAQ8(d_#9j%r7>V6NdNIYIj5;UZ=I_HK#tET~_u93Te zA7Uq&Z);Lw$KO{5ANYs)I6)Tkw0-dUu3xG%L)l|1A0GxoL%V4y{DgQiV=h|wyTcvO zZ>k*Ok4g0oIIAc|!bDZ9u9jd6(+)cNhnwD#Iv)w!+Wdh2*gXFqH5jF;Z4e6=j@aUg zjnIkk%{L8uhYALgqQ#qc{lUO(25?k9n*Va%Ks@+dRLoqkWOQ91nGhx%f8Aw-@Q-A# z3<)feo$Lc`MyDnvC5P1s1%-o8jQr#cStDvOZ9KMja0_#j5Sk#@^EaCaLiC$>shN$Vb(4O-7?K_JoG&&p>CUA>fz5IE!-B2uU>gqSnl zzCL+1BZCYy}*kwtX@}clu zx8l#aNrWr|pgfTnqPz-yvLvI{llaD{dSz=&AoTd{_g7i9?d@8P&?F_op+6437y!2> zZ=t$tQ|;*GCE7jJO17OTq|Ud1VLXG z@We>kC3Nv(9LPQ*F)=aM%jj3hro&ABAIayi&k=-WR#sMq>E1?B!peto{R~H}H*pnI zjn6c4fM~=*kyP5u3~#`STstW&+wg1vcT2VZ_nXx|m1U>&mrFrca{fPT*hVma;?S*C z`wPblFR+DY;QgJ&*eqAm4nlDORKKHIKP;byp#e3xo*CxMJ>}He!WMDPI3^9{tJB!Y zcDN;5@C)Z#`B9TgozMN@J&(PTUM6~8y(Eq;wW2N+NjkY z41X-ZtcUxB5FCw``RGPRX`{p}$6=rP5#f`0JcA4?eiAJ$9_rZDbe^eo`<9jN&@r)K zTlj1Dj9B~NUbe`{NXLg9_d&XAZXT>w;=SDTNIK4*uOkt0+Lqe=E$9H)M#YGc0i{5*)7sg@T%m zwu5jm8?i8pPrgA9r&4S30XI-Ki4Q6Q4it0*sibVSUZtXn@x?Gb6nYpyvF?92GP*r+ zLGYuYEjTX`-~lY!9hIYy>mpw&`rEs0@9bX5jdmX6w}J-h_rmRWRoi!W&nrh3&a$V; zmUs;eu5-3!6}UF6AVj0gxpamcP3cA$oj+(kF)IDly=H(u??>Fokgb2|lZ9rGAQCUn ze2aO)EhsQT(nB=(Y=A*xrOpf)YOTaRkfofxrp>AH^6SQkl;5srMr7mf#|nkeVJc5` z%L}wFd}96ZWcOY@)B4%v;_;sbwIN#(d55+2_39J3Wbimci#xgHrLn20wX179kTg|` zD0%K@W5fLWkI(f(mO}FK<5N>qz~0NZiRHJmC7*?U|NcGuFm;o*fAnEqmucFay10`tiy?=cAq2IaHK47HYJExM*XCuY39VMvQfw-gB0 zO;~!-uy0|=g^_S9aePRv;{38{->%}3W9F+OwS?l75ZC%3@SjrRF=4-jT6+A<=B!;( z(bsxUi03Zt7@GRGTZtbodgkD7{q$6k9T#AI=r!+YK6t>Tr>Sfuac%)Vg)!Spoe~xB z^`nt;J)-$Y@Z~eSg$aq<=m}oF=?Gtw>j0okB-5(sEoIxtX6Vu|(t%9?G5fZNX))5s z!KoAXG45nV!;}I9Jn+^B2b4_;N4iq1FjO&SdKZ0D`iAnS880ZMMYW5z2(|aFz8%o}f=fn&Q2SzOusaRUidZd`*VC028`Db5ldZ_a_ zX6fEU&Wfv4XlzdLYdNQXpjIs!aWvmMst(F|o$H%K_sIVxh#UAUi>=5V+>7I&q?Yjo z`nBP#;7Gw-nNH~)_P_`8Fj`_3o?Ra&=o1J}sjTLjv{;+qUO!t9`NKyUzj-sX)*MEA zdvUX}B99dNmJ@-~_0_9afT-9D8VAG#*wK^Q*x2YS(Fnr!^TL8X$kyvp&$<66d=K>N zJ3GhBy}k~7u6Hnb_|V42W;HV}Bq$yHRDiz*7OACQ-$xX9EXnHSSd zycC0mQnCcm>o&KwzZTy<6yWMMjZEZ-{)QxpDYUg0vV8s=*4!)SInAkPHf$LK)ZYfg z&G+82gzOWV`i6E?t`BW^ty>kNChiy*YD_n2VW?9`X>oI+1WOI9|U+A;;3_9=lRC$2JHIz zZ$C_X>wofJmCQR^S4#uWl!Soq&WDRvBh##0?g0WgFX+Zux~!BFn1(IEg8SUGwGi#4 zPoAuq86tjymt;Efhi%iWH_;Jh7u%sUa`mTz`jY7+_ zxI4UWV(NJJQIDe$+chmuZ`X^8@^azySe8<-W;Us)iW=!Tq7q{VSA~Ko$JTo;(_72S z(J|;-d?TSv;(Xfd>5{FSp*0~vZbBHTw6Uxd_N_%fw$(kG?;*#dV`EF%_cW-+q` zLA-r0Snc#8P6^5jYl}*qOqIn%4*lf7Hg`aEAo&+Wxns^Q)uy>u+}qB;_<)$sTccxM zbZ8y)czEIRu37>!@excoz$z#xZ)|T8lS#pjpR5rlOjs#~)XPB_4FYKPxpZ5(6!L_ z+joD-^^@tpoOrfBzdt$TXJLxZn)CZsMzj5Ir9A7O_0CT&zQ<8MOdGOA(0m8EvE_Kd z&&1eR{b{bnTQ_zFLa;%Cax7PF1dtIXCML^OZ9lQAXRvV%n2J3>sVxfSWMJ{Z&^#|N zU)ObXYUw7MrV}_mk?mnLK2c*5m>D={xr2$nBkEaj^v&?g`%m)w#c#Uw`Q zMUsRjet;lI+^k-(;jkvuUXLC0tJ$|%@JU==xJ?q^Jx;qU?KS&oSeJS^hbQV(I-PT6 z{|3|vXJ5+mD?AmdagCo|w*5Gk$5U3VXF@;KPV+9bG|bJ#Kx?fmi~E5M&Cs`{*q&D1 zyk#5)GCG8&7SmW5GO0=2dsnxv*GI>YS2j0npPmn2NA7}V!RK;2=z<%o7W_@C)_4Cn zUvXqzTadZ6=(vXa7Ke-w>>y%Ul=T_E=Y>b1<@ajzq5B9=U_u97*BC|apJb04(9H)S{dfs!~`r0_YrPmhXC$m?6zDm;fAVG^H} z>cS3KmzC^-1;k3lon+*r_fYsDb^J*TeXB}_Dh{85jVa*Otxw6DKZhss(#Br<`YKTJ z6^tc6B{mge#B~iyoYW_MjV^vtMXyctfn(*SA=lW6V_no>ISqLNr+D8W6qs#6flg;HwKdFoGZ8*NIqeu)^{SP4+qNaRm< z8?Ng=5gsG15dPr#UQ|c^{lU2WAdp-!-zTGX%)AnZY=f5<&v4n!8-wod2#Y*Ts0UFd zFTcaSKhSNRZJ~(TW)MGxK%XKg_8nAYkyz@$Ob(S^nAEfO6_%t&Yv@3utt#5C~ z0!$bwA#4;1rr86h*X=|Yj4dqe0|ElR*Z^cmsvtoRI->|+gS>wI`oDgNe2LM$2UzW~ z772HEciF=UrOn;urY1;wR@S|7Jm6Y(u(1hy|Neb8BZ%(>8t2<-g7PC>7tIvEz=-6_ zE^wfGc#}B2jT`@yr_J1lefMZlvxU4<2g#BG_zN=GX*8PC7^rWm^>?Ni4rt4m+Dn6o z_s%74yna2Sqok|6op0`!4XP#MS)G{ba-;#2fuAP3 z52H-Xwu;}Hev!BbtI9(1e_-@zB%KjGpi`{84Z3!9>Aj(%4dA2|6PZpuO zl&qcJKmTksM0&r5L?la471-W^w$XP_!CfuagH&_~PXCrncx(uU5JZwUz0b#~@9 zM~G&Oe%M&~N_YLbBygF5H`4esy7)#kLkZY+07}(qgaRF41rV$Nr@r1@E}Gn6q{eZ3 zKi&am(fNk3bF)JgZeV7rrp2eP#K~SHBahwAc+g$fkx1?56p{N!dbfU} zrUjlUK*AK|m7CNG8eX(D&y?QwV^@Z~&Pmw6;)j0deDQI1DABT#jH5Hfv9izJ&s=GK z;uS*oh@bG{?!s9OgJ6CY6J}L-OoqgKV%w1KYrf0F%u?;iU!MA+tUBooq>v2?LS`9X z{1UO`AxY(V>c>!SPil_+92Js~6n@odqL-|@85s-{Y=<_qAqj@~gnJ)6!vsh?#7HH# zt#iWe5fipf45a{ShOPM%feJ(J`n=VYqC@XS?qY^;wx`yXMp^aV^7xDiVc6Y2@Fbaa zP^~Ks=OY9^ef`?!r&DcIkW$D?f<|l23OpH(Tz{^LS83SF*82X^(i;Y4FW+Wl$G0SXM@hKg`AhtC_v$-{xR$$V!2>VW;}>h>yze{-?J>NCdt>R7 z$KbnmTC{90_Jz5BR>!sdQb6mWKUD(z*ISDNXAJ0*->#8;v>A-&a_{--wfO$@R2tOe zY-!J!@bK_krnat+!K(tljRS-it9k=;)}^8b0GTdhTW)uE(UQ`NiVDtT%Rvy|*f<4Q z*529qMQUp5p`4$KOWe+m3s8Pu3k7hCnzyD1KsC&PqihXCefclTXU~K$Zux^{AmCj= zZnXi`J%G$pUa7jey1unFvuoW!B%@h-TFmTiP0xs6P{O$XTK(wz@yJUbN{+p(Qk;^S znbP-#@1h@9OR#fu~)%tM`XcD|ie4L3hiyi9z#;V{7I5g;M@0-5FcjR{J3M z{3;L1Bs!SnE^xtX1=iFGaFBeT0UXe}92dTxJjsSp)sMoI;#>DXt8_DbhFyxC{*Ks8 zi-*5e^5Sb}s;UqLK9+4JYeeXQn5PhuW?z=C95Eb9KIT18 z*aD_<$oV;Pk-)O>nX(Es%7Db0QAvm@%76k6DM5&!h}zxR$skjW4@_UXo71SE)1erg zLiRp(lqz4iOV}ri>jafT?;QW*MMbGbN<^Ok2YYyb17RhACM!ADf_{ek84c@-PcU$| zItLR~hbn?u9QX$r)G1lU77v0zEiNTy$Xm;^xG)M6rr4#Uhd&*hL{;gbsR>ov(XUhj zJs@cWIUkKSH5!rW`03Bj`tdq(#(kjl)HjM-`}xUW>7b0fsFU$3JNF*HFc!-bRS7!C zyKVVz9op@|FQ#)r7lVyi=AERWd5Fi;n&)$-MlWbVcKe$J0n-QpYX$fMD*XJbG~Uhs z0BfzDZGGSa6Lt*bkpL(jd>0IoQsV@H;gz!N_6{ihSneM9zOa1=z~Hgh=mfBiF1+Ql z-=JYf4xTGf$n^tfE_exW7f8F9*@@f{1q3G6I|GfF1MdMArNGcsGcz+ul8{uG} zh087)Uo&r1plMa)eD;?A9!i!b$`9Lu78{=lY%S7**0|NR=BJR0!c7(}YS!YEL%$B8 zdxpA(1Y-oE;Zc;A=D+Yzac2OxD}J)vr9dbL7I+HL7}H7o%29HDKbo(jcl}w`UF8#J zuz0~&;{*BZdtufDr!Uvn`y_%GrioIJ8ywIbB(ym3&{r;=RSwa$ScK+}5y^g38J1sV z0NXFwTKIK5DG5Uop-2y$X|?Fbq_WA@Vl1j-xa0QBDm^tz_x1(q#v;xJq%&t~I^4O6 z?<*^*yfy0GeoRZs-C;pdf=D75*2nIW|73C11+- zC*2el_*sCUClVdqL{^%hVQy2QvYFUk(5U+S@`c;$$Z_*mqzNn~w?H1Z7NXZZ8n&Im zetXK~z z{ZZcdUKrpL{{qJ@F7x*7J_`9!u(I{uy?ah)`yh62-MUrN)P!9PFzwztxBy1*%|OeY zMJjR!oYm}18mWYx`~gA}J$WQH1INY1*}lV)@m_#iw`28&pC>y3d;qxh2J@W`2L}fp z7hA9b!)-C(xMY0+cyQ&Dy1{Kz0p1AYWUQkL+&7yJ%Wt~wWB={BWgzkc(!zfW@K_(z z`J@8RC9n33f>Lz?w)E+3%F%G%$lE80+?JK!Hzse?hAME^Ho0iWX7X_2K(NTtxnbsm zr?$x}-ja=DbRvB|=L|gn>X=Xd&ZaSi#b`umk2kaRVK@vx#TCMi-T~e-_|zBY#|#yo zwTuOd{3?d8YI7Aayr)z)r1fg{!Wg&1caxT=s8G2DeM4FoF=mu4j!uEnmkqeI!BhONn7OW!K1T|6n|LN>(x{vixM=yh4->gMWg@4c2FNE=0n#6+rg5W z`|WA<(V(86d(8iLwkvv^aaMKJJ=zu`ilr<0%vSFxso-LJ>__sT$9~cM|I_mDSXxt`~$m3qe@PB{@JA*GkLWz-p?ODzQzC1TH^0CiyII6 zi08$N7n{zn&ssA<<#upb&m4XUIHQxfmF!jEPy9BVdb52W!{q2r zaxTAXjaekHD_>>3*QK?0}BT?3)n=9VRCg} zfD@s`?WqZIe8|-N!%!Wk#>%>9(uf>qaktrL)IpNjotzc>X_AVwpu_oW9F&M`F5$?JgIs8J`Zn?;+!090hhNVI) zw2vqenkf&g+7_=Bd+^b6bhwHoK|GujT%4!G_m{0kNeLB%jN$mb((PdFKUl;t1fR?x zMSKh!@JVPc_}we5rgweQEE>kv({qUf=-|6u?ms8yIRF>G+Cnle%xw^1>|DMr{0~10 zGn(7GyC;vN2_BqoSFg8*0RR|35p>0KviJJxV*>z)a;)tpqXcf$T=X8L3_ha+0`hJpv^{VK-fU}I3VUmg+3>|lu~XDbF?QahIQ{gNrK_up z0{W$i0Q5HY_Vx(nP9$K3Q8c^^?FD~%R<}I7|jf+VOedijy^B1>E z+;0Fo6?H5%a;oWerPHQihi&dgJPQu)OC(o&!rTdYMg2SP+zR5*7WfA-@RlhLpvsy# z5Fu`Q`n_P%by!padkNb+$0R5*MKKB3>ZoE8%=7;9g~$w?xXZ8mGaSQYiJV!^5z_Y2TP^Ori8)ZbrH==i0K9<|`#vXJ#UFWro9XCNa~vczX@8&eY1 zw?F^V?6Z;}e+LxWjL|uukko;&0xTd13(#Dwt*yNU%QQ^@!4epl3t|=zJB3pE1@%V0 z69f?GFy0=`JYcAuYS#!Aq{<(#-Lx9GK)NC`~K9pCD*(?VWq zk$`TXSSupLQXN{33uqQLZ8(gS!<-V_~en!5|f_(ReiXU-XQOE_wh;qBqsPNpBTJXvC`ZQx5klx4}rYSovb2AQ=Ko5R6Y_0o zDHx6Z^Sik#4jEG&bWwfs)2nL)l*z<}tl@}I5M>A7Y#yEH+shx8J0-kqxhvD%3z$H) zY1VJ+L)s2P5J^xXuXPvwZ7~A(z8QT!9XVIM$9-S{`pW1?R$ty|3INo=+;xYBKbQ>B z4zd6tvPpQn7!(xfE}k6n!LPHUO8&}8lrNhnXAzSc_h`e(O(tksVZN(_) z$mk?)Q8HEHL*v~Ftwg;auSA}pnq6KT=k6C{(qVVxWkf;WdKy@LO{L()n=Oi%h7y5| zruDW4+#XvI92`46?%KDrZ$SI{J`>-Cl5+>#rM4m(z2XX8^6I^NmO|=TCp{JUE5F<9 zWOMr&!;_>*mOC5~y2uhVYR^H#Sz2G=&nItLOamd*iA2*mesrwZCrq(G>)|fH>pLc! zWCim6w*d@jSaG+^iq8XH+BmvDG$++5F_Tv+u#KFedpR56{JR)K!b#E5&`68P`t7cC;2_a%3AmaO_@o)}e4|q3Ox&x)2oF;-&2xdY}EG)(d|CU~M6j1$NCG%XdckMHE^$>xP4Bn;)S6?QX zt&zgwH+mcRPBvscB5u6u$JPT11)fx|_lk2ccuRO2Av_G^cUK|3*EO3t&eYVLHtsbB{CE&rt^q~ zz|dfi=+NH8z~wzYr^1t7Kb^Uz!&5o%O;=oZEJG*N-AWD?EQv}b*VYn%;`fEU7QemV zTL?GBuk3qvGn$6OY}a_z(%c~(+S?`0{ng0yW`h8dM8*3yQxaq0+5{g3N2!oU zM3_JT!Xnjz9R}>jsD4sDF66sE(x;iGgmk-~1+)u9rPTRqXHeS=Z)htTfvp=BI=kqd zv)_XQ4Ajff_LS4U|B4jk+Olj5n|p8 z_Wu*_x-ju`pzBBvsI^GgS>OgYJgV7I-Thm5lpjvL?>_{whx-!EM^270u#0YdRd%T7gM$y4rxGsx z&b0W4P)Ghkth)UdiBXjq@wzx8i!>g%azpJ*8(mk){y*3P$P8Jr_M+{BC2+~pUd#12 zye$V>CDw_A_h)}M$!>x6lYJV`! zy#yyIwt%UFKRLj5M8R?egEfu%8PcBqEa_zoo8dR$P>)WS`#R=_t}C8>BP7wk?4@^! zq5pkM(fd1S8f=7yDw@#nvTRYIV28f6GoLtb`Kf2^s8FI-TFF0>8X8V9zDNlT>;gUY zFGXikZ#F85_SY5szJ{rzq)2t}Rf8Ym(6__DF2B*<%PS2m$@1-BRkL@&6TB=p5t&~R0KrFdy}N;#yItezeJF8A#QjG1Q@4gU=8QrOj|IKOYO=?9Z;NKrFZfjS*04z!Ez-l~zD)y8}KGEYv{$npj)27lC;= zsbJGhjL&#!&)+n&&>^}02aA1_t}Yi3Zg%~;>A$7l1qA0ljJBsk-&&`zL{zt)TlIEC z-7TRRHz9J4w+{?sU)>RNVY;(7_cm^K;|Q&r42vVNGpXqc3U-f2IHS?MreU?$OOC8= zBWOC~YOzkn-D4O+q}M+dbYy&8h9}K9SW#Mu=ni+#VKlW92~*tdVO$NzRp*4G|7H6dBn+9~h#M+pZO_dqRA$T&{5!IddSSB3s;EmmqE(bwJ^BTA5!S+|A=h+PCy*xZV6 z3zVTA936!-5+ioPAhCA_4g(Gw z>g93m%2_-;f2wCF2liN^z$w~_ea*smJLiOEH3@_>5>@jX;~VkB!I!q+gXVv7aswY3 z)u0FZkSeC)ly|%{bSmHrL#hKc-^)wT8^5^URBc*fNiHmd0beouc)|T}W77DuF4%=E z!A-Y;C`z#w$$$gT9+{_H!Q%Ff)MBSE4YU+JQM%U&T6vLmy;iLVA?hVC5>AB^Q>fq^ z*C^2uf51A;C|mGf_nF&*L50W0Kng**!Jl>{!D?6vJ6CU8y77d{@e8-xvC)nA;Al-T zaL9qVV*|-LfCJpx%#1QsmjtXfPtZkfle)SXgYd!$$#p$V4(0Sgj9AFNcPNlO_%hh% zS#*!kLifb(0{0YMt4ZGxNy5(~-wj86;(8RCi0+7(9YWE{JE1w*06>c=bzsot$@-_S zbE{o}2Ta(BukV11vjV(oPQqWG!NQ3DpJ|7a?&u(iztpb`*19UZ!(OT_L9cv&;b2N+ zuN$x-W_fg%k5i2VFO~seVk`1A3|vs4?*hzsRhs}rTrB-|baa%rX!$SkFQf>(v;-m; zmec@*FW6w87#j?NtffT?n?8UVF&NLX3YOmU?E~%)TVMRHRbIRM>m`_cT)gDy+Uuc+ zi1XvyAA5a!ukaS=)g@0kF!O28-Y{EUEkPVuDuorhji@RSvYm~D&PpGGs?jwPPf8!! zY*3u4^OX-%*=WzFr14!3Vs8H3IP;D^`B6U_m)({I6Sh=&EiQ?KPlcwI3=W7Tr>w;m z-5nu%Qt(*41hR4Lt57D&8xx9P3$&oVd1JVa)QLiGv}p$ONTBo8>o=OZnpQbQi`!hu z3WkQ|Ghn6~-;+JeSkU?lBF$2l<`n&fP{+Jkk}ip>IOUTuSAOxgv+54juGxfj{-}$u zjayU1RT!T%i#M}xKx@(^=s~$nWZNDn{5~}C9RMy<&kk4iJ*%fbvP!N?eUi`T4GSq) z++|lO8!tomeFJ+)tz=nw^rL5h*C(_#g3iJ_cVztTi0HU~;b*RxvM;!^5cJY!t_c{hM z^a&1N9<5Tm!y;VxRpCTWf3W(2Dc!(PQ^BJF-^eO{TwW5u;#;xEk9}gKM)_{n2tXGR zQI@!{q|5vScZrS%r)H)%iq)Nnb4(P6b$wu3*A+i_jfDgc6_e-5=Y|Ogcgu|b9wP_I zH?S)K#_of-siK$iEVpm_YlZ@F=QC90ZIEk5=_*pnFMMT_cyQfgw#RSW7OC$@hRin* ziZji5>N+X$bvTn*XUqDjc*_l=yoSNg69%!CmU*dn(W~UXx?7B z0@faBx+KzKWzE!;nk#ak z!iMkdF@Al}iR33<2ErDfou=W&6nTn)))uk$^b+w3;PZ}E^x!4Mi@R2FcA#z+c~_13=S;nY2n3d9UEpv+a?=?K&Eg>EvTFQRy z#AtiYY^MjTgnq|g2V2E(9B#Wf)9YZs@rp$$rBRKbZ030%Asr5kl(?a>s>GFjwZ?M{l=vJAY{++xho6)*d%(2-c?a-Z?A@aesJ!!ww$61VxX(m&l3EX?Z&S=-+ov` z8Fc#k(f8kTPuCCfu5L&4S;6W9U|+&hQZ&Qky!cihv?sj0z-33s1~~|9;9nt}D;f(V zx(T1nnM5K*47iM$sBs>n(VDdQNN7}{yqhs`KB7Z`Ngrl!PY74e)+ojghF9U?0>;kC zv|%Pig_55HR^F7K$WcO-qS6EG(q#f}@rAsOS+AO0UJB3?6id>8{WyhPuzc$dFwp^F zcj@sCYx^t*h z&yw~(zKhW9$#9WvRUbv}Ise0;mcP`77PqL%zYz#az-)Xe!d4hEEK7=IZ9&^JT676AvhxSq)DUK7WuRCH!h4&Zajd}Yy9 zIKl4O-Rc(DdSG8UkiN&fE~h;m(SSou%ADMaF^N1VxZf+oHbq;ka8tW$@!o8oU!E3+ z0HZ?1HC2%7beP^la`YfLGsd!@uL1X$^9`;_;o9Gd>?_V1e85}Eb29MgoU8L7XBUoI z!uFxS6CgG&cO_eWwM3+VwaAKO#J7xBJp&%trvMx-uzH!vddXgetw+8iCVYxzEAQw4 zP(cDfg~L$0c(eb?F@4b0GmDPHNRaQa_l7>!ioFUZuukH3uoZ?un3??ZmoF>8%=Ps2 z*~3Rx0Rb18wtz`;cTWl;AF*}S`qK1$^L1Wt`m6DP%LD&&8@3{}CQ0S91*@DslQcA8 zs3Wt)zRa=(oirDr_j=9Da(2-KBYt^cK@!)PUomW>5U3fx(#q#)cHq;A_b*IW`tsXT`_ zWf?PpIt~jp9)L~JXEybi(#BEYmeY9am>5F4r4&t4p1CF*0D%`b^qoL)F?zUWpN-&R z3z1vKE2l!41`}C*`%01p8FW}YHpY@>oU9+o2 zY!|%92sADq{yVr5lZ|jG*%5v}^wLqfY?!KqW=yI9X(hu7n46MZt=^f=M)gp=Zt&e2 zh2IX?4&B>jvC|Tq2=86(A*z*wZjtPo&2Qu_Wy@<3M^*1&C(wkVvQDi!g_1pA-B7dt zoKT8tt-`69DM-oB{Qy;_8U`gTw&2#i_GU*Q3vnOdF02A;Q#q$G+Zzrs^c&x(M%b81 zapHbEN)x!@yyMa>mTXkQ5?Nz#alF@iYwt0vx#iB#`^o_uCLcjBp64_i)onUaD^e%} z&f5U}q#qG}QN(cpruWQ}WPfJKT=MtVuX5bU!sGH+xQmy+o3V6_&(D_I7JfU8Zk5?* zC-d3ZddymSb*Uo)bZ)@5t?le%37T0z(6rGuwzf*|Ff25l_s}JPEqMp)ZC;SP^uJ>b z-g8e6FrpMT+c&{oa-a_ms2T=e{$D7*O9}e!KfQFF-E8MQY;cq%kaR#RmjQx#XYzk= zfvaO{ULQDBH|OsSW7&QT8o#|!(Zyw;UoEEvZl=+b5|)QT*kSmSa!*$7c~sCiK2$P! z?4bu?zpbDVJvhC4w0YzUC{0fYzvx z(~s4^K2~26gQG@+FwLDux53;e@Q^gPWF?be$BR7~{pKvfY18bH->^GWLRr zuoxQdzfAB)EuQ2E?nmqR%hHoZ0iLYC@{iK9MX3asq9c*w9AVEF8J+4yC6W+fiT=G8 zy43leu!+h>RC7hxH!@2tbym>ffLXnEB|ep|#X&zE%B%a%apHs}G)VsJX28@bw+=SiW!jkG*GBHc66Q$;y_IGO{9jCQ-;JTe3HyvMD1Wdy`OR zl9d?=*?aRpZ|eK~{oeQe{GX3cljphb>pHLFIL_lduj>}q@ui5$(e}efKb@4Gkyb?Y zloLOgpK6-E@B4%5?M4kOv{Bc$MOpDP@P5L{gqS?9$tZNsKtEKJKnBgYnmX*u3MP#@ zm*nCzo%AH^T++56ggVyAeuCAqwHCU_n}j5@g5G3v)=6Py^VdX6-d(8X#|*ye2{-)p&h3`FDtNf= z$J8lAPE%m|q;aUOxUou$_$;XtEJG5fI^$DQa}`eIHLu;syAJ!q6F}VN!hS7yl7lKD z(|l!^Z?pqp+^x6B&cOGBBwDy6-og1&_L-L z+(q;cbi=Ta-sb14+}-`Ng0^^erV9Xb8zI1XtqmT>BZ|N z9huZ%D=}4_dk+hvQZD~6O%+GWAkES#`f^Fi#@~n|D<{bJfWPzh+hDpKb@k_GMS_0k z@y{R_P?FvSw!3(kj2b9igQ9 z{4DI@8w2}*1!YRqtkWE=c!_OW1EV|f%(R%2pF>ZkpbJyT={)}R+@Q+)=Y!GnE{|4i z(}1^2!x{t(id(=x$o#6mQ5TnmxaaIEhxx??b*i%n%_k%z{K!Ar&3A>PPFz=-s9~${ zHC%80UvQi!#A^GEM((mBafjrJKavbtFz(-Fs;R&9FpfhTn?p-iGW5L^)z=*FCvjWu zKNN<|B$j)FM?xR~?0ny`8Vk`2&=VsqRbcn?5fA_%as#GahbO+({t8_{){LOw=z1Y6 zS7_;5Z{CE`q@6Wb;K)SmbHfGwIQONZ=*;IS6xgG`SpAMrU_;A@Q2NYwMKq4_ zGIN|vrUq-$tV@b|E_2-HR1Hr4D_7zSJOlzS-}}uHmwA+^{JP~F+bu=rNK7*UwkX9< zQ?rGH1O&4L^Y#^l_6hXoKfTw-M=>WTNb|szd@d*;^;gfXce7!9WPO=AT8byGfHd5k zXSGehl*CMdU0pR>Lm^XLl|!7nIl>$tlZqUV?Ns3WQnWIAVL^dc#Q=TZxBSoV*8E)P zH#TV5qR)Rk_3+d3T{3^AOdsWEHkQ8G+2=vKhwSf9Z;!_@jW3jWKI`sQ+u!Z4`&Ev? znx^@hzqFt{#eTi0oY`~Us6hGt)k$$wqA-(!^x0o;Ru)N;TIN3n%y1NAzU;t`Ys1Rz z#jhJnzMo$q#NIHs@je)h3=QQb&Lko#N)~!8wg1gIs*TM}RvN+y=#j(qZ!8$JS>A!i zS>MO`Y7=lJx?C0Mi?U9JgR&B?>>uL7#p*=0J|*}1B=fYO_m73@Wy|~>E{8$}h0G|0k3H1iP6f)A4xkjm z-6Ap^Ezxf1GpOs(uSNJ6ylHb%31~9$;?f@{Rbl(8k0o%1_?xw+lZ})>f>QVyg-iiI zB0Q_#zfqswQ*Tg6hbO z`sV}+>WvbF>vR(^C<2H!vU|Ag5)*HT}_C z--=L3fVfN)o6Sfi5j=FxGhkzm>9fI4Lwf%RrA$8RU@4aK1x^d!ZRU>51l;*05|o_< zBG`n#_P6(>V|-;G`#Cs)o~e$fsBUCy%j53N^eF^C!n_JsA)ym@jetOvGgcBmJ|VGb zef?7Ly?$24@X1LPac_}}>MXHJQt8<;ZY*IX-%AGJlu*TQy}jll0&M&ebzUkK7T)dU zz7WJlv$ii(1iEH*Gv z-jgu&VcZN&j2?y8*>Qe3S$LisePn?$TKM^|eHRxcD?dr{3KDV4nGR#Mp`=Kod zvq4ow^HiE;+f7`Sm5hp-RPA|(1qKS!R|@_rL=O+J8UMUsbqW7v$1@|oc!rV>kr$BA z_q#1dOh-%G>Pla_y$%1t%{Ts#Ms4Fd8+rM|N&R)tI;NJ|eRI%s95J(GIIxQ^TLWLo zk35Ra9G@UcfvqPUMZO|Lkr2G}S(!gN<~*kY`>lw!$lKTeQ<2J@XZ$GGDq;)_1n?9i z8S4sM8pIjHWwKRK=b00fB~v3*wck8b=JCCDi^NYl&~F<(MhS~T{jr%(<;}#}?d0=! zRC9YHK1Xn4qNte7@!5ac3;!gTO_pE^Ha5tX)YoSq&!#X#F<+;)Xri8oXzMYh`)PmL z%MndhU}N?%+Shc--*a}b*&w60D5y|N)NVNuLOz4bpHz%g{|Vi#eo71*E`78z){sIG?tCaLF8 zjQ(W3@n!;ndP_C_wRPJB`_3xjfxI3oWd)wKqARcPPC2 zsLQm6dMG-OjTs|`lTtll1w#Oq`^;1ny(Io;4g4tOXRv{2UdOkIVB0ztU*Oa7=XS!F zdzx82SuEk7na{I*GPh@=j+#{?_{;{Fo~=533+1I;C_|2)iO!ix9%x2x9ZL>etC|y| zkomPM7Hu|?B%6Xw(TC7WI*IWhg8O+y8?#C#0f#^bd5ZdZw2UHuX%+yI`T|=94`K1J zKpPLZp}p2(u{?`$L^i17yZdPQ;%zj)(8OW`Y{lY&VWV zW{OrWzvvZz4FN30C`);|kEa41BfVMmNX&2C|EN=;=!ZMQo-^Y)K29b? z5-0-ovz?l~iJ5JN&l$_P<|4@x#{#QAz1u8~yUkHHKG{$q+zEzC{dJ2l93hbQ?j})* zuAiBJAGoua*%T@2oQN1MTj{XQj-R3v3f`rwO(=3d# z_y)J4J=+8xN30Tzsfl-!8pda{$EP3B-YDe*D7C2M_?W7ypqkyAbt^Yjm6JKHEk!*$ zMeB_`FIyB|Rt#rW%xpIyzFZ~72iT+iTH=tV%(lkgh%eyCaYdqGLEN9(aG(8fzUz>X zvCGit!Saz52Zi({TJwi!WNLoV-$ZPLU6PuxVp$05c|>G0O>ul#VHua9aM8a^yKvx9 zF&vz$-fGMbLKbh^Py31oaKr#15mAFh5dKgX6Rf3O)%!rQ$_RWL( zgwX*^DE=8}o7{y1NAZk~8kFDRDg1%RBhCT)uts7gal-umwn;wL%5XNttlV4~y&>xE z@85$MM4csXy+Mm$^iEM#m^A@O;^4p!5at+%kx33WHHoLe3DF1Y{~hLvEIOPxgDCme z>Hu|AR1>QG*|4Yz`6Ng}uSN6VMtlZvB4HjWl)R<722nd6+@+^n(#$Uns=xryfjB77dvx;Do zk#YO>TKkPH)!DsXO1k>wJyRO&6|StTd_Sf)ZvjjrD|=xrWwIbFjClLN1BIa4{--H& zT3XuWpV2B4!G`;+#Uk8&r~Az1&$2~lx4ZZVefuqf%62S6s}Q@&%EIU`o%)H2;^Qei zSYK?n&cnVDlSC-4JXGgDg2G^Pt&}w4!8W&ei)JQZ)&EY46HCEf zI4T>C1;GR-p$H2b zZNLjpjVLk%z2?(o;yq~7>5-S8Pjd5II5iR>L4JTj8eH}j^dwim1&kdoc>2OoiiAU@ z_kGzEtrFAOXq~KiocbNqn93oAu=w zPPs}xmYxbp0IA6HsE9VRctf4~;bD4;DD+2dNbA{8s|YBI1n?#AuC%M7p=N)a3zN4Isxz zDJh`@{*ngrrjCLk$ifHQ2C)l~;OOLJQP&A8g;Tcj%Q%Y|6etQ72Yt_Z%;A0Og>cUS zkSwBJ)>JzCGm8GR8UC%F9!Y$i0A9dmxM9euQ39tgJ$m%T>XK@945Z$0tdBEO#C7s- zN@vMGv#DoOn5^+rl&|)cJ zIUl1Qeq7r|!W!$%H>Xlnac#@!1Yh2`qngHfF8k4d$F{(wX8p8uRa;|JpH~Y78AHYk z2nkFG32u}RYF(I7$;aJo`cd_hDH7QhX4W(@?#}In#l>g+a|i8Pnw3N@Tf3T|_6HU= zdr1^vRcK^Vg*QTsDNjO(A!H1Fc z)1!AF4U}ExJzC{;nGC&BU^^o6R=@Av7yD{SQZd@~bGPa7Rv*B;LzkES`GK)`4 zX!>4qug8?a!V#x6uOB0~9nfmdsC|6J2- z&#c2Bv|$Wg<^V^QhR~vg%6)X~9;fd4@2Jww8>vcz$#E04Z>Ep-;m8fW z?(sBbH-A6?2MH(<%b^iBMi~U-+8QC0b#DN|z!$WaBCA@Ny%Ew_q$M(*n@aicF?nbx ziD}#O4%pz2SVy+Q<=(Qa-avkD^~#8uJhsscjy|jKQHG*N7+Z4&$+Ds)oqD4*b;8$h z>g0sC9GunSF66PlJ?-SdmKF;KR5z72dY%)(o_fPO&Mz$IpQQ!Mv=EjluNTk%Aw>~Y zj=Z`pVF7}68dz|0sWF%ztCP^v_yWuy*XC!$hg&v86xViEghx$NZC21|x|>Nx{VwFM z!_Uweqi;9{ShG_zq+ko75e5@WU60n#wQ=1PV=KAoNC8v%=asg1qRom+OHDvt03hH* zEHYxE^!4>=7#REv^8JA^IxJ36KhJ7aux2Qw7wdx5j_+8$l$d%;1wt_4exTb3P0iqR`G~DfUY}-{l13;O z&hQr+gvTISg#`L7vY!gE8pjrIgbbkwgF2-uMi>t1sy#P~XJ}5|`1n^iI|B`tKYRh0 z0i+4OB(kg7phA`^43Gj_)Pl97?1i$!z_^0LKs$sag~5MuOOyGA?!>2a7A^cUNs68$ zacf@T#yzV6S6N5GzvIHnn)X(K4INZeU!Ruaqel%(Ta8A1Mpjn1aFRbp#G;d=Y?JZ8 zK4CBcr#x>kffk7<&07R?k7tvk%$eta(c;`S1YKBJD^)lsCPn~xk=NyRNNK?c-*V@s z4gK)rLH+dP#^p4VFEn}u2Ni7*8oJ$T9A(~+<^9gl{78(Q%LUPbA`FHRxbL|rfXp6p zjcI#eML<{};f=f$NUKJ|78h+lnZ2Jssy(PX6m{Zd<|J3l^PTc~33}6*#!JRAK(`Sc zgWm>~mL~J%D_bnp5Q!lbgD?EFb$r`YE7d8k&acqI(e(2t+rEc{jUXMWe%A4QF4}P% zs)a5;u7R&D_l5njeab3oQp&(7FFM*uo^F1QG7gk{y=hPYvHCq7BW6hpnX*8*-n$`H zM&jdtK0$|%MwWxZr)T!*P@*``X&M@@UhAguab}+e=6NSkRx*$0CnKMOMZ(DzAj`_d z$IR)op;C=`@cNBhOUk~`F@Oc=vR%(qPrLZ-Eeth|7eNK1{Dj}p4yMOO=Y=#=QZh0% zB78q-zLy;{b925uv$CAA((>{+!1tYrqBy95;=8A$QzHgaPG&+@ma@HI=d_LZwkLq( z&Mc9OGEX;)HKiyGE@V2@s9m|~l;L)jMBnCtWAQ}RO9NJE(O}5op$EN$huBbN{q))o zI3#~&Nrg$tzLWiUpx_#QTxzCrDtyQMS;f|16^q;t&ah zj}}E}s8=`7!BLGV{d4@6E@6UBg=3?EbO}jFit4?NXBL=PGD;T*%&9*te=?IT=)S8) z7^IX8KF`^+i-GdqA1@3I88~4H#SAv>_R1s*RX0Y00*_XXjoiD*0Jt$r>O<`CWus0Ef`tXAfBH`6d%hG5mLqjG}YKWKP z7dOnX&+*iJ4GNR4*uW8E_n#qMKTkyygLnlJUI#v=s>Fy_;4tgVFY!q47(jFEx2R4J z=hoFR5&N5NVElP6GEEM}yvELSiDybfT!`OGSpWR=6%})zGvuw&43d9xW|OvtwTN#b zh#U>bYQ3GO1$mlLSJKs)nHfn4ScBcLBX^3KmRj4xk-u1?iQ zAlck6OJ2#$A?D+$`#Yp$<_PnMJwXy@V;aE~rsuxXU?GCw z3*0&I=qCFcdAV%MecaxU{gkpE%^i7_0K`V<=7XfkVi89?=@O!3MbwK5*A9l z2`j(*Ve3r@ax0sI7f42P3Mh(K1anIMB*@JX&ksY02l4zSTbYb@JLg~`5F!A%8sA|7 zJy4`17 z^s7c}L1q+sV}1QEK01WN3Z6;3+Cq#?$qs~sMu@Dl`yQL<8kI!I6#yH-#{+CN0#Diq zHiC}^euaw*4Yse8qwGIp$eLph+7%!JHbH?g@&PJA2&@bZ1p{}%8z2wo6Hm^69ZbMh zLadi`^+anpJ;)b=nNoJja2Db;jZz8*ks+f#Co7*y`F_v_icz3ZVMj6zkP18irfb?4 z2E5mrk|FZnLC(1Y5ZG%icZs$MtP?On5d#Wlxoijx)ooS$%PwdLvIdRs7AI_`cg$we zZH;7jlsS+}BQJye7I4uZu|#w@ScFbh zWP!^|%>TqO8D%oCo}OKeAKWfXIp~U!tpnuG3!66GQrrUn*c~35m}0L}AiUi`)usxF zzLJ3@`PV$}=FgG@%(X2O6|LeV4`immM^m6?l1*0whXd1hpAJb`{=71a1`_H`3eD>J zV2puV;G1;vv|zSC@8K(PXhEoP@nq4Dz%O^;lYT&oq>s9ZsEv``776K}efMB?y#Y2M zbRkNRM8i=8aY<@x#f1{-N&bEg{GK`KC}LbR_+@Yq4+V2FXj?_Hy9D0``V|T(#tGWd z004>dN5M#3{|P93B%pZ4`72O_0q~g#B;~36r9j45_}IRX+t4sFK5P8(DNNc3?6ZGf zu`gh#`{$6k{PKmAi;4iE8L%A%Y}{a7!b%%zVq}CuvW1nD?@)Uym2kcdFxSNgQjJNJ zM#CFG6G@G~&%54|`meGZrz8hOYiUx{H=!C=q>OSi3U4 zJw5nF0%o7l_qV(4qPrV&nJjfplTNCl8a8hnL62n>k9<)n`Jv`_9{NNQGhCILfo;BWA)w7eO@R5ETKbKk( z?^!PYc*z^bOhgt~nzu$?O!r-T%Ccr>s@snUGV1xo)(Zr8vtURhz=%}Y=Zg&s{-|DS)|wt?nD9o z17I4>`lT()U_4O3V1vTZPCjr3)2UnF$ieA0SWtn41&x};*G}%zzIE|$7-k7%KeDj8 zQk;Hw?7Yof_0zumBl;VAH>L6}28U_&{HAkWgR9Uq7axDtTz(zlcW#G{s2oBF6b+DK z=;NA=_@K=$y%>4|x|(x*YY$-RAw1a$;1>d85)S)Dd4a-R-+WzG)bmCKDMACLn-qTg zD8};#$a8q2bi@6bJju8XE1rciSh8eqq@5w#t|V2v3!&t5;yUcicHYU&;QR=oPqiGs zkGhGh@XMthL`0(Du*50b!P5r)d>rqM{v?e*9+(B=P>E6__>`^&o)bC>a0m2y*1+G0 zxL{!;{7k-XRV0MF1@U2)lzqd8_pL&> z0m!iQ=%GM%;(h@MNj|3cf$SCt!yx$`eVGo|;L_j4qA8%5*U}tTG%)ZGthGuULuyt| zY;fBIC7wtjV4_-YY7eS5vkBez`#2^amk1{J4fVT)Q-de6E(;wr9YCywJPVv&hOinq zR48y(V7QBpk2wM`r6=|u82@`~a%OOA_Y>m=UevYI=!HErLnot@Ri7)E8h2IT%$wne z(W9XsGdQJVq>2HV5auj{2q#ib&Ai_X;s+)Y->hg5g#zve;vX3qL7|EU2~j|b@HMlv zJOktXJ%E*_njxIM9N5WmA=I5qX-<_2}vE}g1E_PJ`5)7xI<`eEk zX-vUKo`H|VeM_5zd++6DT15@0#vH!jbYj3=fWFdkW`Nw0%11P`wCE8$90&-s=y6ez zJw%*Th(lhvpaP_%@e70*n32%&f|emlwZ5^D zT2(~{K#%g8Yzc>By3f!PPcHvxoLN|C0+#n$$Mu7L8(G#!8|{AwwXkqfG~(N1 z%*=A6E7%!C3K$-UCvyu*X8M4vH*TUD|0Lm{a!8KLXRYx)vmcYLK7q}3;J=}vU?L6j zujug=2r&Yg0Z=qf*|U%!iN<|#on7*@x*Wi;O zvGb^70tNv?NM4BkS%-y;rzfHS0IDEm-CPKdD14)P>1*TLheHJuGsDftSby5 z!#{KJ>qz1sTW8>6KYeyHII-8jG$Pf})FA5uuZ19dT=qxeVj>-)_!H%l6)YQborCVwgy{gRZ|If*E+`*v^PB0;V-U z>8ClU+AiJMy?V@rQs$kuWs}fth3MKQ6RCUmE`Z8`7zI=W@&4-Oo0)j?F6a`nDC%vm ze7vu+$h9YY1v|{-al*L+e1;xk_rJXW<^U~#(!r(GvqRbs=Su9D$=a@RXASq?U{Tr; zrF=hcPyR2dNl-R_TgY|2e=aw#_TiP{j)g3{VIn_Wl7(kZ-H}>9J4-H}y_#LFlaev? zg;+69-raO1C|359v%6;7q0n0QqxRvN&Vz@sKdapD&sA%z)ZOD(9;*!kvb|oquRBuv zd~)ww|R`d9J|jcMaxNP+QxrrK~(dB-hpBD>REU{ zgP$57`~3p6lro3BkbWM;OiBhndpgK}1-n@kxSaTyArF-Y5kx7Oix}FF$u|!js4$bg zBxmqz1#3&%)APvk8Z#u3m4^#)E7M0mJpG3ju0f?ED*p}uHKbi&ME?C*NJ8^{aO+f#dsa&T1} z^IiV$Qoz->LyvKL%JL_CuNWF^NMqO#tQ)ZNZ1N zfk#dj;i12HNA#BJmQ*cI@pk}MIr)?)I>aFK7s(lX?Ss)D!0dGzuz!-nNm-3>l_@|n z%VXidnxCEet&TDKEE>6&VaS$av5?S3MAO?p^-(!U60jJr~FHN{A_k zYqMg?-KXB1h^mhh=&T>s7jm&E4_6P;i`lR7tUgM8Uo;TwxH1MDD+z6BH4H|1T60hq zL4hH4{fpfM(L>4)WXti4Za=)Oi3tcfF03_wL7H>=3MR2G&5MB>rPfH`3WNkA(yqt8@t`Ya4=7DwClk7?!n4=7HZp$>j8mWBu{(XjojpXVB2o|-_7*eoR@ zmt71qF~7~^p|P4U_vgAxUEH>pCwalXk~KG5{gvD1aWgyobXGzC)M%uRY!ekBHsoy} z^!P%F)jdR7FTEVgjBx#jr*y;J#xtF=5D zVN_Mr;CP`Br_@WOsF>MgK1RMZri`wPJo_l>fT77j855xYD1UyT)Rs~ zsI%3t>*{meAA@hM3qzijKNDsNv49|;rHycNl~Le~LpE@KP>D`}fv%f=)+@kXU=^?o zAPIor1+9caY(Nw^HVr`B;FCeK88lmeNqI{6GPz;*TSLAq5^@|U5DIL&IG#V`IB@-uI7oI%`zJTxW!Xs-2F<6 z@7>B5UdquGsS>={Oq|$FJA3u(rbz=edxeDh`GXp0T6I$We%~s~rxL~+ z$^CLu9j;yjKo$bfYhAdm$&-YH1Oo*jxG4s;?Wbc)@@yY$mornK#r%}R6b-naP&vt} zJ`cY1DkQq}AZN5td1*yozJmL58YGQ=yUGZZm$OW`wFJh3C&_~DJ-p^r_>1_QiCPHJ z;du~Lx-nB^l-4V@iNLg2SHo8uH{^B@O*_2VVeVY=V^c2k z43Gp4+Paw0KB|R-Z5x^BahyEkh>`xBi>S`BL)`kgZ=G?V6{Pzz^`EEz}iG= zolwX#$k(0CT1 z?~QGCR^KN#ie8Fq*`8VL=kH}VZ7Vb%JKuQ_sT2sfR@~vIFT|GiJF_og1tNW-JHOgs z+3LM4SJ2(j^M)E*wLE@Q?rbJ%9)Ao z#E*iEF{eanR1F|0%K#gNxSqu8fW9rhxtyS5VeHy=oroN`)|D#ADgy~tTv~t8Ip1`> zMB-YAvxr8uXn$u+Q=%+>2_x_#ME4fK=*>Ag=X4Nz7K^{O_FxhA-9I?+@#sqfwaD+f z)*CcR{VUznRiaOI9B)bv)J_vHStm@D>ewf-LcabI8W((5 zCm{%Jrmnjhd!tQpkMm;;Q<^DdQD=oaw+hP~C;U9` z;aZ%Fn}X(z6Rl`G@HoI!7N5D2Ba|^DpCFG48e87<;K4SGgYR}%cL)y;jy5HN2{fmm z=JFRDre*6*SApnaeX+2Mxq#?~z*fY1a0klox(-zYMW^gck)l94saoj8{{Y`6^R92~ zx?uwvH0k;77=d9$So+_--M4D-x2t{CZ%V*Gt)5G*hJQbyBQ2vfHbAauX~%Cddry0|4ltrD-#53?q`c4_h0uU4m=HgJ2t=n_RmJ6 zH6?&j6gPrp5@7Di`KPq9QZsmQssKr&(~u|n+7Io|V?k~VXqHCXSG+_KOps+VQsMME zMeti&1&8{PsxkGeW^9$dpK>wMykA0h?m4(?Mi(|jV=aV7=_YSEHJ&W7SfoVzEHZ$|{1Z$w)<`DkWei7C7#9sNijJNB zF55(L{sE&^Ep-&W@a;Qo7nMrdteoot&T;3q{Os`Lm~q`PaD-grWYW&Rb;($0@(~>& zjeTk2`8vlOaA30Y^5|JZTTtm;Pu|j#X+Hn8Y4G;`_X{vpEsV?Y(rGfP=IQ~&lCc;5 ze@iH5cp|XCBx$(DVF4N-6yoh|%Bo)_tj3!BO8+{NDY`}mW}}>NY2Y+mibmUzcD2`m zzWQ9@v&e^5As zE31JHW?>36XCMX&Qf{mR{Zs+^=>nW-UVY3mEpnErP?f9V6I~H}y;RKuecYPayUim5 zeXiLv3!*PK6F;=e_q$RHs6jseq&M+FEnGBjwW=Hv+;DOI?IUvt$xBJ3zgpT(s@~y5 zG9Y9$+tSW+lF*5EYK_$LelU56wpFsa4#}G^dSq5B_=)owcZ7E_7^C$ZadT|wBPB0@ z%lQiROcpAj;1Z&7jv&n$S@^Lzkc5uVlyi+vQSoEd+j?A|NXgup+oxJP6Kom4>o7&%Z>J}-i)DGotXIDi&oNMc+W zp7HhHqHQNU2Z`v0a1Kp4 zNnNeX9$D5$4AjVJjutG=m~NNs9)kwHrE69 zC;ilUiVyy=3&<3Z>D~DMyTF=*0c+L@*p3u>SpKsL7LfJf^1{`U-_-k|+$}n0NCT?| z2IOje?F^sbQr>?`X$Gs@76a=AjHjvZIsVlH_xM_OO-FiNU}}CRe&!sb|0BMxLVU?l zLKcL2jFdirW4LJqCC)%eT9Z$0;SLi_R+8IsHyoO?0sQ-i9OFo-`xnJ`&AZ7sudz}g z^jHo-=CRTmw;Zfp`xF#SnrS!wgS~S(%Kr_Gg?X1LW2GHYIpToiy$F(jIS;mO2ej@D z{N11j4QuZ~%mZzXrb;8X*hIz4+NXq*3&sSW`yMC!N4J_)?CDZQ-R`w>Af!$WbwW(% z3LcI(*LOqRBKF;3>d2S-R{jwG4Q+fjSD%XZTfa#O$)f$gf{F=(Dq9G(4TtB3N?niC z(1l!mWifU-GT=sFn2c;O7sxC|pv}C5z6xZHOJ*9c7(UajD`a0>jDy^JUZ{=W<>l9q z0XA??AS?-HLcww+X8Fyvi*U8#ZfoYC+e~52`)2gF)`YW2yD5i0hm7olnr^y@jq-zjPV) zt_CEJK1o*uUF>_Cu}G)RkOfcl-5cYWsqkCGku9zS8kd4B1aYDrE#GyM#bQEWXMn;d zk<3SWA3*re#h6my&*26<#^+Tt7(6LGwh5mrHNDc7U38hlFL z(q2+Iw5G3M&b)U(i_MfS>yX~WfKh^YgBGUa9WYD)nSk$)Ouf-!?*J2{(U1ZYUoX32 zO$J?HIp09Uz|E}I=7ZfCvZL)W-BFq64|(K#&~v0;Np{L^cT+RO&65d;S!<)(wv-^B z!H*(Z8FIST0bs+p1NsH*+G(=bi@>{^(>zEfb{cxpi6J%EEv)y_3dX4a)3M&jfisgCuw8GdWCXZvZTw?WPNcA3kku{Q&bZzIw-6lahYM zr7+KeLSXU!uk_!8ec8JjPvTCe=@vsOjilPg0dxa!nFy&63PLFzsgYuMF`=Fq#PUPp ziqr|0{0+f73&^RTAZ)(FO^$>r=sQYh7O4491?ps^h_VN8Ho>5Xml^p7Xi@*kNds^A zwK-i?w7v>n9%#OA?~~iAT%ppDMW0c{xP&+;rUXcL2}_n>fiGI#3rL-1E2Gh3g`trR z`fPz|$u!F$1%SC*OR5usX?A{>czdO5WMCyRt@ACnnVZak%&P=F?r$PRGq}mAeRfEG zCQvRxrNZKAm+O9@y|<)IKwiiJD{0Cn{9)UQ(9-}8Y7a*C97Y7pPPR*UR9@^K575FQ zAhgniq6d@LDa2b2%`=pNia$~r@Ix@MZoA7+*XiYVk}4tkWXQC>C@ARRZK(^G;s+8 zP(P5Lg5YyeOTmYHBqZF!b+8M}G1sv`y)O(^A{SxopC5>^>VmORh`;khPjN1JNc;Yz zm_2I_C8RZ2?o>QKg}efk7ochx2#KrES*Qj)4Wcwtk&_$RiWvVyA`)s~ zzZIuM&umq0e7}NU*|TH-*i^Wau#{(YTGH5=9$m6$^p@OQnxqM0QLEmYn6kNe3yZ1; z{?>H!w5(h+42{pxsMe?5=}pa{ZCY|Q?uc)@J`%q9>uVBZl>Ok@vSb&Zm?~giX9>cx zcnXON8483SDmx^*xC2 zO?>e5#dc%+33%S~uETHz{Rb54{nDlD&bb9rumq%_AM}MRps*3Cm3RMpFo?$ER$LBQ zjo08c_(J?tWVMCd@H<|<@(iFpSg05-2#o;`1>Eo>sEn?G^b%|8|6_qFlzF5W_0AH-~6sW;J@+huso`+Z0p@o z_K-F~ZMS)}9Y-wl=&6bwGr)C7bISx`f^n>#Im20Lk> zumH6tVmG_2{6VK+(=i9?eH z3D19gq_%Zz`!}$ZFs&hMR1)DBU?i9Co1YYDT@l zI>W-L<5Eg7{@qr+RMX2@m+%MK?I3HNlXhasnccqq^h(`O%o@KNlkU~Xm#}e6QWgd0 zzZrW3#ogtUHH2gl%G4#HXUG-G|93&0R4oB66^VJXCahp&ZUBrg7<4LG(5OI)e&KLO zgO2^$^SZnTd#s#H!%R&%n;V7;bxf4hOTW&h={D4b%T7SM$N#8svVwxBcz{kr^`|#= zb>3CMIuUlBXka&E9~GN9|J;8KOYH)WnT`$b9ff-n0~+N&{U|hc@JDWzyOYI|z&L2` z?dETeg$D%>;gj|Hz;{z#-Ss~aEc9X|Clw$9i~{Iu#{|M|g`_x$`Jnj|ny>lIza??z zGyzh>se}SV_*H!93xt-18(sU9Y$YCpT}a|GJ^nSSIY06IcExaQKr0R`lAL33m2ct) zEj)xrrdb0pEqY;_P_7q_w*)6TFig$i&~tN9La=qeer^9;c2Z7Zey&X)rL&6-$J!d< zVv+j-<%I|?{E~||WTyENy&vG?Hz{v9UaH9&8BveeHmz!3U?sczd?Lx*!rmb`I3RMy zOp%Ve!opeLJsG+CsScSTWw8!y!2xzB^aaM8_STTS=Eei#mySK-oN>vkTiH2V*MrEh zey{jX?5s?=ig#^^UcI;SxQ9RDwyyeKd(owOA$;s*!j@8OxxE}_G5sR7lDx#%rYH`n z#;arc%Z`Opy`jQ+Z$5XBv`;ODt`Tt77kHwLHmq3neKXUAZ@J8H#%`c4B6O%T`9&BC zsCSiwx-Tat)}Yi2<$rj4L;$B`tby ze(5ZNvrC{-r|49m8SU+%LS(;{kF5+ ztNw)x=agGM(QWd!oBv!Tdrg3&x?WC&{tN4#U{2{}TM_K{4#S0c8MCDImTG)n(?X@O z5ss~n#AZ~khw-f+h>-i^zZHFVq>52PjGF^q6Swj&=ic5KkL?`W{ zaMqJDo{IO}D1t_~;ZIX%Wr%t(+QW0f;6eBVKKL@mw)$3;IKiMp_Sxyl= zRc=A4ny@e4>E-3EE*)R^W+RgEpmEgI-NK0qO9}f^f9-M`LH^1Yyk*=l`J$j2v-(57 zt{3!7UpE|{z>j)WzbJQzbWp17cjd#60J?ZXyo7vgfic!U`YZf(d zAakYb+ONj1Qe0F$zBnWt4CVFIxOaO?qgQu)U#Bw{u@t@)5)1M{tLEYi^eY$ZoF=he z=qx%8h%H-v`>8ztDZQ|q>dJ=($qDWSciKs=@|6wJneK4B_^-IY3Em8~h1r2?w10Gs z4YizB=-pGf*+?ziA6pI$evh1;bIZ!Kk%to(n)*W#zrrl*%h@W6)C+BU?kMP)8ZA7Pjpuz3B;RGWor@ zcsRUtojv;ZOnee$Eevo=IFq&*QjyM#D?wzq^Avh!Bd$ns3TXtHS zG=w8uZ_eAdZrgJ!E_dK*;z?{*xmb*heJ;~!4$;Cu4hk<0Xnl3WHR4f8AV!(N;(R~l zc-{Ql-(G-vD~+$>J-7MFKCQJ}T3PX03@3^YLr?igxJ9qAqYY06C1|jW)xH9~j2Dq9 zo<11#za=E(cJXr&*E<MR{q9om!WFrW5kY$Y$@jwi2^FpBXdqJ2_=dsb5PjdD5rZE`XE zphjF|?J|JxpBLlTp`qN4msjq=h9zq|JMBxfnr!6VO~KTZq1P@831um;rKP5(`eXSz zkGjeyCME{8Oun9^ex*62l4H_D00CcAoH5h>{)gAJ8lR+8LPFEHOpkEH;JJQ}jMQX- zXp%o46H^Hf1nBMUJs+vSLGHRQpbF={SzABehsQu29Kd_R$ss-C<3^0pRN=MGf=jR=5a)%sone_|>8Bp=z37dT$@aDHQ4|p{5hVF}C|9SKJl-5=y_w6740Kx!< zQLp1<2Hu+oYrWM;g%(A{$2vUl{Ky#OuZg10)&Mh6F-n>6xZvCDEZ1W%l&SM@&?m+a zs9MECkYrEQTd70r!#&7bdZ=u*U<2CzdC{oD(|+NR3z}M5)(;-Qer_drPMYE2 z>S6KPF~P>5U~4HgiP}Zj5yJ9SDQ591N7$9)aV0rj5Zz}L2W(x0*#Sv zZfUYcQxG+9yTx6_?gaA&Zyy;Lvpg8Hq6`B?%4g}!zAEny6l5gKnQ{NTZv=VZ(^1&? zdG2s`{w?;WPMF$zv(L&9ec&Wg+IwFFGa~nmG7gIBLt$R+bBuI`s7htahT)vw&a;Ot z7?nLo)UVV3js;=v+qW8?o^?^5GvLXLnkTaXr_*Prr%(QPkN@ed{ghTKmS1|bJsLj4 zMVb_jVtSez3Xko3$&wx()Qt7lM3VfE*?f7$&Ke^B_u}Dxkrs?Qam|MR@0l4@Ak);R ze(7ApDJ8tgv0Y4;7_br&9c*$(05el-ZA4Jx*ud><`j-+h67q&e&;Iw6!Mu;Ut#$Cm z5U|bmtmr{la)n1=!78mR#hmi_@P+rhg$U+2wgsPLx0NuT?)hvL^^cBJ?F)wkV{_C? z?lQNcC;z=^)d;Qo64^nNyzyb)?O&tPj`;<>-1{`4>LvOiB}ME0^*~xigad&mfwup= zR3o0-y1cZP`VpYUBgvm?70BuDnsXE>-DoP2^g?eY z$K&{aguMqmm;LuYewh_AB4m~*GLyY4lD)G>k&(S;NQvwu8QCieN%pQpC`8#idsEr` z&PCmQ?(zNqJ$T&J?R{OZamMpJ&w0I$EXWOM;t|lkqll07#$>txQmiF=9W(Wv)?BDe~ zkNx`pyhOdPH#^IcFAl88YvE#Ea}YC5G6LmJfTW~qZDjXgJ-QonG2`<;EB^5k1$!(F#W8s&q{96$ zWc`eF?PVtAVfGJ;?;W7eU!O3F;w1i@GkE|&U(0MX}eX;^u|d2 zRypOkTe`wOoIYLw%%9)_KwlvMA;*VLkTn!<^5}E>HfX$XyC}zB`NxDJ!8w4*HTbJ; z0FqwKG}f)kyo>}tfVqSj>kdQ;p*sm5$Y^@3`)A3FRHFQ;)%!fUVP__zjCJK3LL$K) zFu~@RraNXjo-Dkod+Fu~?jMn9WZidFO21syCKKwMVZExgGOh_kVw+-ok@#=m)xy zDhIQd2lJyUC#SEPq=FLEVZ~ zHZUI%(PX@|m`iwgxU~?)sYdql-cIoifECgynos}ZIKDA{j#dWA0NGS@nmBO`QQ<#bTX(db0>d$$tJAwG%1$Gfbf+Uaz-_Bk^pqBPunO;)uc zlaq0Y%je~_=fw#Sq5b-O--e*qOzPwYwlFc$1otc0!{^}>j&@d-${kEtZv7o7DDJiR zV>^=6{zn>It)92SOPb*$Cj^SWuudzW2n5VTj!sG69|>ZVsf!E!heYIWeTH~T-VDLJ z1Q0Ae{Whu*;h(k>_tErkSz^Av+s2*Sx2pLo90SBE1^SAIae)%)nT_bQ6~gA$-CEH` zjly53jj8D%go9Oh8==KP-AILlby5y&1EUmE#!=~uxL`;uT@(LUD&^E$x}DhCgY zsMspOVF_}W)9O-eB!);HTcrV5s=tK6_n6wi_ncn};RMq*6T()$ivBu}V@i*$&>`;U zIYSva&J}-bK~$j8$17io--DTQ34<7ohZd8W$IxSG_|7ze#Kpfv!Q^Lq>`=!}0mh%X zNVU-GWIB89%KpMd?FG5drimp^ff$^W4zsQYK>*o9ffFhPzjapP;R?+RaS8sJlwZ33#o(F=<0lQkUTEOBrCUVmv%ue9@i)bhZIJ27pF62T~ zx!cfq^Y%(Rkpj3&vWLU3uHF7o)^%L(>t?qhXMQ3F%{}U$O;q%sr^Zh+>GL4ImnaTP zk$L~r&C%P5#7qgC762XLV$&*o2slANu?*1?h`x&GaXDTTx(S;cEaD^o%X~|X#!eb^ z#nGB2YH_%!pCoG!${p%jVV7QgN`MUW875!ijVH_=>3i~{#W7!v1D@);opMvBEWwos z{~fR(F{6}r7&ut9On=)?5PWolaBR?cOJRdk1_HvIp&hXfb1aEFTCX;lM7QRNzQYp_ zP-^(n{*I>~m%~6ie4Ea~pZ@fSVjV7ihePt%K0#tK`4pfDL>)II>ySp$|A4T*n8YtWDwP>sb9YXgsoAK839oKCB8XBk zh&)>`Jk6IA_94eouJIt;Jcu%aj)MWJ>18?^``c){{4(0U4gM=Uo^@t8mq>DZ?Cdj{%hGYt_Xc3X#!bt=io`fwZJi^kD;cb_iHK8 zDX0M)P6569;8e)EYJY;q^PJEHiAg}^tux<(|hcfOYxRD4_mH! zu@2GFn~&UNl#)MG_h{deXO@-8M-In1t6R3@O@k-_>WiY6S1 zmwY9M*kSUpbOEtxA~$|+e{!I3Tpe|8Yc}@a^ypu6UVHBzdi3eU)|<-)B44XQEDzHa zIlb-6(OULHtq05r;GC~2uwYsy2R>vzqVuK@{=~I{Q5>)_#ojxG;^%2`YDN61f1c}q zsfp5%jfbSkcQR`@l~Z8sdhW)Q{W2y0{U zVdjYwIL@7krXxYPOfTBPoIBR5mjnQD|0W8AX!~aP08sFvJP@-KYX6*3KnnVf5;$>T z7$>FcZsvmT*iBW;IDwM;H9HvmXO{$xv9g?Z`sp->;u3F9%}mT4t`9MGEH~lev-7Cy zJHkKr1$>zP)u zP_g+o0!1)-Uy57}oqk-8g4I2)TaypTh=C$&^3!1-had?t)g)F*$%IwXgcHe3aq_ee z;RVY6Dtj>^87}&#LxpN=Lmf9lr-SQZ@v?X07b&)Tmm3WVXl8@`VQ^yy(KV=dhf0KY zO*$dE@nBB5SRukX^|uJi7YEe1rSB-}zkgH=P39gl;n^bp0ht!P0UOxoei~1Lu#XLn zma=Q0y_Ju3z3$+#hnE*B5v{$9I?UZ{fqOT+CtrSKJ2BzLcH)X)Cg+tq%955YPe-=S zIn=wom?Rydn0R%oPv)P|TLz>XjM`doxL`;OA};`af)fUh$QHq=JhFMT*vpEv-WIG0 zWLi2q(>*Wy+PyVEokz*0shyQrYtOrqhq1TOW46KS==am#N-wH@zbI<^UuW(^XG3D z#8*|TO0tWExKCzvw}v+AqtTR&M?D%LDl`;(ph7|mLV^VZM0BSGpex<-5wH{ew}fzg zan1omSz#a2U2;KjW2VMCKl%Q$9LvS(shRKdh5Qk#yw0~z4R^PM{d)H?o9^ZfQT&V* z(K6ml&f@?;u37CkcAOt(cwf1yc5d=Yi=lSu#iHB*6pkwj7T5E<^*yA_wI9s=Gc;#w z`=x{qyIuh7G<9XyFgW@z054rcUp=+?whgrZHOy7BMEkG+-=x_s?%WXr*XUU-^AAQ~ zw#rmFD5(V$$`IyDFpOJ#wA{3BS7qltb*5sfJHfO?I~^&C;hIQDQWfTB@PvpDNW`cE zLhXm#3>PhCEf1ihl6O3}Q|<+T)P5;q`nFI1yp;HgX~QMbvC<&_0Z$VZ1-sUZnkA@q zZw@Rz>8x%l5cDB+&70XQ6U~bva7f5>1ss_ta*~Q#V1CmcyOtUTGrFDVuezN`&Yj6A zWoYf5kZ~*sF&^Atsdqg6s_;J~GX_Lt2^85xzJo&kH?b0WgxTqiGGkVWwc`#=#0N-h z=x>b#=ZQ=uXn;irQ*%+~1#eS9tZ<1eZW){7@cR|KW8;{~G4>#r+1^SSo0Fd&gPxn| z>;hB5hHPzbFWnxI`8P+iq)SGCgxgy^S3(0*JphrwVnJZ)i-X7SWjUBMa-U|!0zBx> z_91FC>tNaU9p{{S&DKt8O~LzuGOjZRf_Zv-Zo9!U<5^TqmfrjC8EpM8pOlp0Q=-!z zcRZc=;@?EidL@cXmcXz&m(WnoM|}^QW{c5Y}Uugks*N=X+05y@;C&1g%pVCagXrd#`Qb_kObaFbrF&BvK;=@GNg` z2=@5ax0Q!Dwr1b%o?g+nU%cK7fyl&8ESg~S9ILcE;V?2maIT)?NsaOL*T;LxkA5uX z>J1+|hdN&f-GX+v4W11>dT{kBc0$jGnt2`KDDobLxMzJdYtel+ zd4+#@ajlj0@0{Kh%B7Paq0)lI$880N2feZ8JW3P zAP%?s#pQphs^K!h1o&Wj*zp#(nnp?ER`>;rAW%>EZ zAEPMzvs=8VL^HH;ZEC1vF2);F(?TYU2y5~}W~)^D4z;%Jq8rdPTJfHp#E8|8fRaqhtyX174?L7 zh*|!mQ8`C+KWM}=E>3YE27VOR0Dvw)tq# z1L46~#pC{#4qjJ*R`{^NUevG*TZ|gl%pCqu;|t>bY$rN>R&Q%I;dI!RdI!W;OFVEp z7m!`MI4EG~V4FbRvBtw2`w0ft-S4u?lhyioW=*4!a`lta`2^|$E`UtWffPX5Xm6l; zA^XF{kB2LPVQ2MR^K(2JwajE{ssp<jg?I^<@oqk$#`A_J(I zGh%dYC@rMo8~Lq1K(W5Gdiq^M#uj-91?257p#Z)qcgQuDj2P_Brfqe8JVmt{H~$v_ zzCzcnrXx7#qN(*&jf?e^&uyLc?N{(>ac7`5*iEby$Xw$#{ZXd}OXSnXOb7A~2{ub$ z0y}_pZE-q`^Z><47ELJgF*5G2sK{FtjmR?3G$=G+3}XPWlqxwh2Ma?+Ku`fno>#S% zin`mb!LRuHq8)PIvs(9uBL`*}K^)%3P-IvESBZvU`_V1%TF9%0V@D(~ z?5$Xtvh_PC^xR^^wVp%r7BDQr>;U0bIYfZZZ=xYGYq7UstH@fpWuN3SB~+$>xx@8d zaAiTmOQcZ;MVb3SOTtu3ArXS(=ZB$eMAJvr>GT1iTLbq0OR>wrQxEE1;y|SBohu-^ zvhWX<<4Sg8b3w}^jAUA#p(H^q?f*y*SACA)?^=N0k|a(>;EM@WEdMIwL70YrJ|-=9 zAK}&P8rFxv0HE6YA|^^@5qP6^)CnBH5S+N3HHJG8SQ`_Htw^9m8kzjDc)b zZ-Uv6_Sk%|kO(uzuZ2F7=&29OTvj{)(24AsRvyrPdip^a{+7ii!xO4hXix$|t67Zm ztpmg=Ze3tc&L0-&SH9$T;zAYHrx7q?a;;!7Z?}UH&$;Q#XiWy}IuHv~o8X9m=sE`H zGmn5`Y7|aKcwxAf2Lg$PQj-unhM`qdJ!kOxptJ%s$T`=D%YJfEuZJ+g7F8&4jr-Y9 zX7~Tu`Cq&Jl8fyjLUtz>f8`$;_vCwMu#2uCI~Jh39Ed+yA(St&PPJnna!`ktCl1iT zTzp40AWHhSVT@YIEKv72LJXr3pirc4OuX^>du0|P+X&Hl`Ok&mylRVCpbmiI@R%s; z((gNir&Qg9G?&mgTVDZQ13~H`mzeo$!^@@)RCobGb+U)C`1_?cf2ymHs0b8qB=wDL z_Wner9z};Xr2eOdE*yOU!9*k~^}Y=UH1gj_MWi3HSj=K7G8Vr@NZ6ta6Codh%|c7W zvSrrp;~#L9)esVO6(6zngyF7Mht$onorv0}s73yZZyu%tX@3}7rYw!-(}47X%mlgx zQOPKj0mVl*tj`pvx5S;FheQZCFwnQ`6J6v?Sm^x2A*T38d7WsFBzSf7rbFEsZ`d4D)0-s{FTgJd9HQiakei0h0ofwuBO?eH;JLYqa}m4MciU zhR2MHP3-0eDD>Iu;iXZS?<<-4Ai?pAl%_c#rIEGscQKUHO*#6r{n;R{eDDpMG-lYWG=;Z|9ykDsE_2 z3Jc3aoe(XC`#W9-`{jX@n02(API$5Nc;K&Eo|EFJ6hRml11b(>8of_iAsZ448~{Eb z#ZOxoz+k&y#Vj>DDE%rg{|M3Jmql-%cDlokRufM?IMlrW$O=X((?}L~?h!(+#xY65 z$tkW@wwdu%>`C*QZ+!zVx2u;c^UZyHl<+HDIVy9DpB7VM7wk)rq59|T=ObF``*{{s zZUpb5qHP~=Km2naFH_Zuq8bjjdriC!7neC8Qg>5DY9WA2f;W%B{QcFr*U$cxL4ui| zIDP`t=Dt#w2HTNeT$$KmHbB#G(x>#wMA&&wS#1EC|D>l+`k*UdGjWNI7f4_<_r0Hj zMz|?!oLRD3A?@&Oy5t>Vu^IX-Y0oI_x$WKo`Fcgp!He{~E=~N#`7H^blzzRiG-Zfb z=%is093HL;nvI=mO;EDr8;_ng2s6fD6U%#8X5132s`0O6kneV?5fbGai@*7odEl=? zBUwRtucv(YYyh{)tc8}X+M^WA z7|=lwT}Sw!rEEs_Q2A+v!u08*sI3H+7HXdK)~<+g0lQ@k6sHXMSiE}-tGjb^3JGZ0 zAJn)4{n&K*P5rWkM``lv>B3*&JTaC^oHXpCg$-@|1~Wwqj1}m*#2i=Pt9XjWr{2!H ze}pOI%{>|`;TYfMIz<8I|0~xaytYf91W^<`v{MZs(B6_qc}yanI&9a~Y_J8$%oId>OtDleKU+gQvw;n*^D2sbCGwq20ACqgC0{@efZm;#YnsX!T<|eCj zxS8MGUKz}l1C!I5x+{+?XiW*4!L(MY(^aa0dAPM*$2k#TX|jN~T;WK)N5_8jKNO*M z^!fwrZ)VmDoBlFJcH`*-5mfkdfDhJK*_w~y7{IQPX-F?+WRpVr5=Y^>rki&puFH5AHl|4AkI z)&q;ieDMN>*VoJE5GZk02ekl_kIopFDg}klUoK6@#L1)96ooynlQt|o+#qJ}ZV7$h zaEGVLP}Jgt{|0Kz>*P4TVQn$`)~g3iK5dtxiLceqD6N4`g@pBJ0nVYK&gyiUiYJE(Q z*(?ZU+gK70n2TnI0al@OF{sXI&~MfvW7-U~&gpOYAtVNp16g5m4nrE{!Bt-!W5tdIM5m1f_K9%Xw8&0#F?6 zXUZ8o|{Zy>dubU5_Qyn~lDOmjWG|_F6r! zKL^s2s8CNIlvW}WkTgFj0|1<5x)d!=hngt$GKc5;a(&=Hxiwg2KciT@Y$PeXq)UKL zytNrTSiK&1MCO_!znmbl#F&&|{j9B3uq6K}6dqz8EH0i38vUVF1&yBs8;VB(%`V~M z;UaVnR?jbg{yR}lXAG>X_wL=$N>RT^o-O5dFv^0r#gc4u?X471Y^BdafimE>=!*@w zOM&&-|LyD}Mk;802$6lk$^5&&il>888Sl*5q4w2)?AU(Q-MwEWCWfkL%r^+aU7L0z zj*hGLt=I1GcSHmY4{D8Ds#*A!?kYfq_B~d$DlGpSKy}7b7<7EZ&%ar)G6 zMKRA|MC8M_^|r~py9Pd5;=;nHh0-#t#s*KIpB?V5A^;h?zv|rU0Ww1-x>k4}+?9Y= zgTRC8Q77vMU00)JK~yR&<)&)(z7avC+!8i8HI$!&m!W=U+|WWDUoMp19CnLsM1pza4PBmw>wgRMqE7xteO|I1AYLv*n1=v5eLD|?9%Td%-jV$7MX!tM zu2JrOto++W;~m1mLRPsiw3&B(uf?L9Ao_X>NIY-_2Vcym;K-3jx#|8sRv7Ev1>3;P z1{7LLUyEP%Ri)c-9> zQho&E`E@8j zg2dwgyEu=T3lQJGYxBs6Ou3NZVnUgn%*#eLXz&B&>i<)u=!=OKYeHr3sRP<%6f(}f z&%u@e@XDa*N+p{FGBNg zRZzdH+Q`bZ*fQaC0URIrSfO`P=J@gBy(P9uHiMPfCfwQOuJ>2bn(wGI2z4q*8u%@=o{V~PmjA~GY4L;FOq`s&JjDVn ztM(wA@KkeHvzK;Yil7qGa6f7Jkxi2T4i}O{?LDgDNEsq2l9EG%GQ^{%RVy#b){7S3_WCihqt50s*uyVaW(A6-%uA z%*4m|L>7vxpW(l7VkHB%r2fYF4tp3Oo*!DhZGD!7g6#e&nR(PYu!D7oA$}YMf+UJ!L*{DK2UTH1C`I$@Y@X3>Mkc`#XFGA&(le+~3%1xoezMtQ~qK81eFodiB zb8N;XX1~&y=)sjVI2wZ<>zZa3l*#HqkGG&FTuSNjp=|FtRFVBExcqrga49hjuB|o( z4pE$!(MQ>SL;avx#XZA=$Gu(AXItNzO{3aar~ffzqaYjkVrkKQI+8Q{`bSlNzwx|1 zks$O$O%0TkJ>wPLdxQcv`-WmSRsvrVm?h;GpdeX3R5)gjrpzuvY#ZtYWDk6R0NQ1v zXC~Ct9?kacPVWi7Sle5$5bP5FQnj_W{cdPYylXeiz^XEz{o~%FTTiZ)#a%BpkB~nD z$BU+Bih+g0Lr-kY{@i|ifYRntjdfMPvqy1&EeHVx>}Ad7n!Lt-N-b%yL)xr5Q>npr z-~aeZ9Sg1p0XY6ZQg7&|r|4y&o~;V1oq%k2AD69~?N_@~{=T>;qW`O`xOs~^jns5+#W9Z70*oKy)s^+KTy;X^*J2*%6 zsuI|4iGpl6{UR+L0A@#BWn|%{*Y@DO-Ie^snSthN!6z3RHJammceyshH#I|f^K7>| zv(;qbu;To@^X)#c8>@68Zpr*ZUTO~{-#A4@szC61OLq)qXSbl}5!hJ-_So$T7=V~` z4irt~bJRO$?Q!m-FJJr>ZMO9<`Qq(9yYW6Px&^~38*Eg1m2N7_ZckHT3*FJ;_xb)Z zHMmtgGcD>K6a(k>Y$T!H8mfWobqx`bJAN3566$s$zTbyPV{X&4Cg1Zk{l0Me(txJH zDW1y(S}i*_>TDNg_BJ^mZGISSy0gS1)=jp1FWT|pdD3_eAHog2r|X0vcf-k zDI|pr9qjU|GMp%K6Ul?~vt`xR9rb?F+Iw%Z!~=KJTx=ecR?kCo-}*6oIxkQ@A~^g- zOG^t2496_N=yZnB3MZ~_1>C>i+1{SAuwVmc#BvUN&9a-<@+As5(~w>y+?s=yV3V2f zF=qE1kQrQn6_8d~7W5QQ)fZHH|zMAkJZ~`qGE=GB~6ElIk z#*2$hWn$Bt#jACj6k^s}hI=wY9^MZw)j4REi0bmd2(O*1$2Ua~5gCwM80;B~&CL@B z2Mb{!iHUUjAVTft>XD$u=7w!}d{F&`(EYgCfq@L$o9e`h z6mg&o%xkD|+qd1rB=8V8_Bt~?ZC|Cg#IGs+U3zcw?B-a_x@sMq!m{{IpZVQq@5htx zH9PcUn}rJ`p+oU@)_o7JO2T!fR5UcGFM~5*mVHo4t0l$oFyI2INKRSV27b+zGNbEI z4Vs~+EFc7_x21C^0r7#osnvga9UX0W}K`B+(76T7LiCx+a){^W0-u z3)oGfC-N~nMR1rgLzTsPuu@ytbwS;gzg5psh1{kMCBP57+$Sh{wGqNb(8I?_Viy<^ zO%N&Rk(_L$#c2xh-TMdUc*!!LcPrB|wBib(BmYkm%F_s=1%Hy&Uk{>l0sSgdZ4P*Vp+X8*KDGBfB}2MLT2OeGJT zM1@noUClU)KM1C07yG}~>?|*mIhRR9daso1y`bG&sNVgUJv60RQ#RY{!g}u9Yuh2Q zfl7BZ0DAza@~qL}UZ}X&Hphky{{$x}iF|fIC!lL>B;(PeM_H&sVX3p>fO=$U*u=9u z_KPUQVycHU>of$b!Fp?>a% z9bRJ(H9G*agGr%>Y4=(OcLMmGhg{$K^kGtyn9#nIduf-0^^RDc;z3++NWY_(NMi!_ zR~<%wQww*tk_{<7zpJ0Ex)#nB$d~I|mV9OCePm)0G%jo%oq4)(z`VD@IQmhpMXAce z&p4P90i7p|n~3DDy|nk6pCsx#hy60lM8$SobhJQ5ep0l8?d3N=AbwH8i9Fl;ojYOmsPWS4p+|MJ{g6AUKc;t0z*dn909Zsu@}l})(51T%!j&rd3~IbZG4CK1 zl<$&RIPO%wuN(E78*b=!GlGVgb%eN*QO-Ff->)Jfi2V8JNTa)EM5B!hTU;WYoI-di z*X#voy33teqd5%;!y6pyv6!F%A++BcsBm>G!EG0S-iZfd%NGm|CsP#wmG zIYRH7U`J+Fc`r_W9v;S>eob<6?7Va;yO-Bk91$#oc)f!09SI|z{gUqRK$9I6NHB> zh)_b3j5EK3_>Go^nU)<{&_&&AIPOR3y^qy5Tk%N`2^_)3MBcktAkYmeXrXCh!7BCq zwdcG#SD|fvGPCUKz~qz^jI)YQOGh0gW96f7!eYa%&*t!2RWiu`!{|gp4pJTv>MpZg4iYwGA-H4Lph^E8$ z9e}&Ntg?RIrhp%5xS>77j4vMg*X70J(-H=xbj_yi5#ru$FM9+XJ)mdU<{1JNF~^F5 zXZiWz2k!YVz*)0-TXxwN+5ttilSw@&cDB8B>k{-p zMmxlw*3o)tREG(7Xup2_+6Z(F^o}s#G&=n1ILg~bJXGz2gM?Blsp1r*X(XViuA(aM zuV25oAagV2BD5@dJ7SaqUBkvh9$Xsvz-CxYBSz2f-jK?!d%u2d!7uYF+&)+Tb;6nI z#s0{G(2@Osk(FY|@59tV|Rl<|XBL2S+K_D7(b54e_g?I=l}uRCM4 zcd*Q@tgwBjM7ka<(1RF4XQLYhcCQcL40#a7o6XGDJwWnKv6bNaQ+mbCG8uF!XRncs zDlNu@1-TbK@~|PNA|_GETXGXY-oHP?9E7PIokmZDjfr;d1Q6pys~?|PiY>RehZE#< z92%2Yc_U5hl&C_!!^C1}^7x|b!HCcynUr!eFT+m{2z=j6pro6jp!H`SQ+Vyx1s#Cq z=I%9&K?~43A58q9{ripgA}ZBtWH^9xQORR#=8BaEvl+JAvfp+I42g=e@<{>qabdVL zzhZ!n*7cD*8(X6uI_i;%phpG}Zh?@%{nT@&a512E!>uAk9SPK4tW}j@gj8M0oYk$| zO*(J6dk&hN6mub9zz+u!UXtWFPE|3$A%sQJ9wqYXn(Oj-2}2F$QWjzw_~~+277It+ z3->PqYp0}{i0k3@ir~RP19am+AzrbK!POWsqMm%vm$vWnu}~0Tx9{!Jr(}-3)?pXh zUb<{vq|@2eWjt8v-ad*6hUUZtQ=^^DA2Iy4bgmLAz1q27%_-tcTt0&u4(G0Y8l@IK z^m4KbCy>B_^x~PBnG^N1i+XQ9T%b@ETqKQZ`Fv)+A6jffzYKhGHs97sV+;lolAA}h zqtTAvB|cjvUEAAJOT<7xooePb@Y(snlhsUjocCjl{)dS??NPe?j#_@FK<3$kyBHvW zGwh;xzJzdTe(}(T;l(v!1=L@OfHAHZ@UFkxmM>a*!f^Xh1@t6*hjY5=WKil!;=__Y ziY=y&-!bCZnxVZR*Z~2%VZ>#w8yXwqAZ(vgUPmw4uknSzw<{Leh7~lA@xzafgBkxKx;#D2ij?@YoD_`}wO0*5I2?31O3{ zaKkNHfex}@PNTr%|m#gMcAXiYo4T};2XFke}uA+n7chCxwx1d8kmp= z`|IN~kE?2HwGH$IJn<2`S0aw!<2xuj-#pLv;_%p~K8iCt{cJpqqOd|7PlBZ!B_-YE z)%5%_*7h)^%JHDZGM_k7Kg+YkX~WQT0&WCMeX3TKA&ohVVRVef|Hit&=g`afLk~t$ zywMh|%!l?N0R=lZ@}6$}To8yC8`p_(A?;}BAKBg(u}#(W;EkW?mbQ8X(Sh3{nVpRk zR>eZ#x^fyqX(x4po1EZ)rBvV=M9HWI^87usmbe;OCxRe$f?6<+n5lQcIFh2^=B$S8 z^h1nwgwb`Dl4(Ht>`?u~0Yh+Mfq@Rb&>DiR8T#tAhg$^6y=U=FHc2?a)KzLG(Vg2JYI(dxqrZ1w~E|lLfOhW4y$lQYt zNbtFbTsUSj+^ril@4Bnmwxjq6E+B-j9B2s#z%Gi6ymD<<#%t&T)?i*rdXlj23tg4N zj`h-Q7Wnqx$d(G%Y$aMZuD2K5<7#O)nqQGyZ<^_0ZvQAhQ+5{bDD-u5ePi}=ABEfj zr$683xN$i8)2C17W_Yk5^3sw~W3o?d?%6xTeURy&_+V&(RUv`QTl*5Jb0Cq0*BmdcC=&IqWSNCUm4U_-iwx2;KUjfYqpXGbx? z@^kL=ys#vvKx$2!z4{F=uz$?vmNv1&&YxqirAV4>2wr$}02H8^ih_ay3KaV0BN$mM zCNsZrQH4TdO=wyI*a3OJtM^JL7ygdC$AgZy%&w?Rm=7qDQz%GZNszqc) zSy7Nikje5nRO33u6F{A?wb%$e13GN7uH8YIFj$?Qu(fgtE8uP2p|2+{sgNOPXR4FLfi7$)?laN8pUMnF zYIg=u5Ko>v@PI+ze~OY!7aCa2^1NgxBN^u*rzBSSL|v0oXf%f#&K;9^HK2YL?GFZn za{mPFJBbe`7Zn{p^N1yTGLe~WeImZ2-O*bhd-9X%M5{qaS*9dE>6gd#7FQq90vf)! zV@Q;l-exrWHCMoX6kCsj0{{Q73|D;nDC?cLphb^;;F%-B*Y#D}rhw_s3jLo8`x zczqs&sD;6huq6XdGRPMBK_j>J6M=!BQ~zi}e}MRvrJ-(_5V&slGXO*APsmuMd(p=P z$=^*f*q+;=)>5~l-D?vF)JQTUa~yzOHf{)jtHe`@eRM7ym7|De`cVlW4xk*Mmh8!l z51^FLKRmep7`xNT)(*H_SSe^i({6}mT%!bSaRF3_B`KLWF)+xce$Jr2t~UTZgR(oO zoT>Csh?0RN3`;k-By^Mx2}KcKMv0Zg^yg5xO%&5a`~B1uv#T=b`PTy2ST_+Fb`I3j zNv+9vEth%EeQ$vlsu`V$JEzxgH8;4eZ#cRw?mUta&Ns-HmXpH=fn}7D?RB?sAT_kC z7$8Kt3yd2yjESN33^4Jjd$f4|>z=TDmtWs(*3yd*?bXtgkleUO3kGWuqA`06bGSH@ZAZnW9m=4L99IrIu{@9H{K(nm}C1Fz#nxj-6Dkxh^E&sbxfy|QN_q-PA$00hJ%npoCSUIz_Mva11j40 zJcrQU&w(&e$@jd3=FK^9v$QiAK$COg3{AptWxb?3YWh#qVxZ8(k$#u5&ZiJmag0&s z(n(^8lf=GI4l-Z^kx2mbCTg7oG6<`;x7P@w3+`AjsNnss7wG^1f-cgScYLSzjxsPb zIYu%5;GbhD0TO3F+!&!F}@(!9!P}KyRz|(bl?(MRBcKIgq|TenK&=%fb%YU`R4z z?rX)0&{45}XhmD;gA@5k+vm@i(4Ol3`ztXYC#K?CpnDfc5(GP-dFB=;JndmO&`o4M z4W8~^Fg_ujXlOu^cz}ZNeQmu6M(Nf;V#kkl#%7-*7}tJ0rGL*q^ptRX+MseuEOyBq z>UXi6yWJ@4?NsFO|j%^yG}ZP}wrEG6l*EWu*hgFpu~YzST)k7;8Y zS^EXIB%vn~$#~T=^(AP1N!GUy$n?O@T(>fHwzg&mCT3)9OU2NTD5;f#of&)$I0=Xp zK>(yZJ%u4MNW(b{8qLsSg#x|Ou<1Q>;_zxNUr3ikrK)eRb5mB3zN@vH<2XbHN66ly z*2b>p_PGUPZ6k@O1QYFvR!)`s+LhiEJW@gjv4ND+VFreF6o~L#sp~$%fd+a z6ho6I06_*!E^p&!fI|x`nsby@3ZaWV)#S1pf}jmtp;x(zre=T<7v)YVqYUchBvU`U zB1mh0=5ZSwgHnmUYSG(7<~}A>6JQE%y&+bSRj4#Q%}@Y>D>==MwmWgAs#3hG1XE6x zhlYL(srF<1fxoSJtzO6FRO4^FGLcBgaZ0oSX?8ZtrXUP>Zvdb+=~+cde1bD!(0bq) z(_lb~g7}p2q#q9p^HaX*Nu`7_w;(6GZA%Q0;9L(;z>=>5Am9U40wr!YN8`V@Bc-Ff zG$a|}#a1Ump7$s)%Dr|^zx()1Dmyg9Zk5q%SIm_dOU@!^*V93&)1MjXo8+L9Np*)CSo ziR|18!ctKmqxWB)G&JxSXw|fxmNAaozNW7o@`RpKqskkc#9{w#_88_z(D)a6rva%0 z#_UP6bN%cqB}?G)z-I1>YAY*8ynijZk@f7`8MdlDiZ-%oN$HgCZHQl>_b!kq*AKyB zDlLPQBMGR{$L}gih2L#IztZ%MT5Yx~{}2Mk`^|pKtt&(7iRMKo@cf|zJcyByaD#U` z6*V=CdmWbtCSc6>+{d=9K>E=eM#-OkeL!yQmzJ#iijOENMfLI2GikkcISbs)Wn!A=a*|GuKWq^l zBN^w!N9d6sSRO3%pbTs}6{ONGLjh>aVZQ=>i9>f?fq(>!0~O5&@>!l{>Z30P@iYddN_ox7#tu`;4A$5=5Z0|X3x4i4^q(EOLhA~ zFp!YxZl?8nlgonH_?NoW9o{-YhaT?1yi-m|LRq)0MZ|TXT~|=5WH8!AZ@@x9Ye^QquJ6RMwml~S4jDt-D294jZfG(S7?@|gjr;kG(4qQk9?iHdyrPUk zR|bK<1Cs$gbIYmK(JPZ}k1ak}xuGHXi_dxSwWBifAl9S2Z=WflleKcf(0WNQNz3h2E zV+Xt@WGNtuCcFIzkFpPAY_(t*DBE{x70sKP)ke4OwrM18d_FAe^e8;N+bTAk>G+&O zgyOE+jIjIC9Y&Rj*!8mSZXys60$Q7!4+ZaEGeobS#f;}AX88I-0$a01t8CP4kgUy{ zH_o}Jp-V8xx)c8?Fz`$rYI-Q&+cFDF!N|z-ETvRF04ec}7CIzCRMhw?1P7lyIWLb8 z*bj;6&?G5cU0o+VOcIiZ=C@q6J;RS?2^`V4k*RljVIb(f=658N_aRwUO0#=~*tM!? z<70u`PoS@M^LS90IM{DZGMusj8v&ZIsRk`B$tbyX=zsH zuS$~1LBw~&m&jKI$nyT-p1T6Cw!{dCegua_@?T0(c4}zOiv4KnCISwV@#F~-lJ-TG zAU{ZYX;{*G@6uH2UuIF1B+X$BUS1i?$oX2mHEX=Sdd)hBw0+#*HqEn~5PjtH;2@oK zgQDaOcn$=(U~<5bS>_$Vy~{;ua4HL&m+8I&m z^(xLjgZ$%`7E0g{@@Z1&ARpZu%EZ=Vx$;k3T>oL74x^K6}i;;;q=eTM_~YF zgf6sf&1f73f(?+6QRdA9(z6GFHwZa423U)P3--fq7#^R9vY4bf zgzPFMe&|T4l#azRW63*lK#UCvbg0;7059Mz$xbC8UTA2U%KR)h*B{KV_n=KlaG-pY z}G7g2CJ_G#sTnQ-(yH8@!`kc-_N8SUYvEr*1 zSBkO#F_b?;ikze&gl>_ii4Oy{oRX2jRGwE*@KEZKqzrJbbr5|dvp3uyqaw03%FOO;#Z4-x(x5L!AUH4MdtVH$!)iT^pD;UB#yZ+ zY#Uzn$%I?VtcFy@^daMs`T2Q>c!9tHWKS1<=#Ip2(DD&U9^P@*q~EB^3V^~{6e#eG z24XX$vQTnzcSCdDdY4;6uJ-T)$PBvqU~t$T6^%9AUJ=+`Nit18rSkLq?+~T=Bd!4? zak{5tAFBA{-WQ~bdJ;B|zwC1K$Vb&*Sf;2L3?^Op*`hmv%p5S3LxeQ7K$MQG>Tj?q z0QtD+Who45Q4v9`@bLAL4V&K9ZIp~N&F?UxK>dZT#hgpU6anxyvk!~Pi4472RS^l2 z1phNx@ilm8qV2|z%03+#fP;x~?^4S1!OFAt;P!7+e>ZWdBCR_#;LoDyWDR4ps+u(B zu{~Em7A@#zl1qr6abb$O93u-`?0aHk5fs};b41)5zgm=m&nTkIkMCGCY5(1cgyHTe zpD|l@OxR?#NQiB}VHjsWAE{xf^_kt*SK!K57}J3ccL8aV=UPgoWNJB)1?3LR@`ym!Ti6BC z)lWxAR0vPxyI4~Ib8sQgUP8B6-iZJL$m=P}fw^@T}-f;2rVjzZX3(0-Cqr4Jc%hck^}v$=+wL(^i(87qb-hbkDe| zhmK}6*wg~GP%}CPnJd(hn(+m)a3Q{i8-6)o?GN#&OdRpQ^eF7&VgE~AY+@%FoB^;! zbO|K0sA`5tU)sRXLTQC2mwkCAWPNX=%yQQv$jO*Lo`WY_U^cF&Xwi6XM+lQxW#{t(iBZ6wvL`{jT+vKv#_X` zC_nCR-Xr4kc@d|XcKlf$S>XkTy%7wJSwMekPwzo=S_ta<2ar`MVzIt?5SSSVM1!OZ z1T44eyF<_2YulDkFT4N$kwU2?jQ4n=Io}edR4T~SD>J(nIThoka_Ja@JPV@^y)N& zEG7_tBupRHkLGAVXrWLu%n_CErMkc4s^H*2Z$V`sI%j8R2c8o$R@ex1YsJ2M5h$SH zcMnK`xB;XCg&0P&b{L%tnb#_Wg?pOhzAQ#4-F#RF3%EX_R`_zoafZ%e@)2q}x^_n| zu*{kgE7@ZpEpg}LB54ZT_VLO77{wyU2SZmLD}gJV;em|(C%;n+vd8wv*uEZms}O=? z-HoQR%H>XJC>b8*f5v5k4ty~HNia8%nZ$rX1*CRA{Ndr_gM@S%fM^)JR*m=nW9u!z zs@k^p@oiuL21+OhC?z2wh)An+Hz=)$bVzrIsI)YKbO{Js>COWPh)8!xh%}qpH2<-- zp8Nam_y3-UbMAfaJxA7>YtAv=@xJdI;~;H4glT7TP>ix;**p~1v!QrPx$ApoH|gYX zoY&I1b;Xp58z!^uV&en%$k>IH&&1z#wn|5iUgmOpuycE89nrPLd8MK#gh!HNSpNBT zGMQED6fOU==K&7?MvG{KA7^Z7vU)U(U^r&eVv&DO5GSAo%aXn95IKQw)qNsMI9ez? z*vam_6O~O<0YCryU^~xC*xPZ-JGc6BV|Lqi=t-J7JTLw01?Yy4O#7&+i(|%?etuMs zI$$s6Xqne%S!GuF9Yb+sV%(cVfgA~YLrg?R5gbijm&Mnm1pL7X@=K+!Timv_?Bj** z(Rjbj_r<9d8i7SL{$eWH$DM;t#HK7VUixP1@pDFn-YFj zHr}&`^a`xogJ&E?kMnMF-g`Mp`QQ_ptI2-kk<5Ya;-GNY5BvUH#(z|>-(|J>UxHQT zJQe?ml`l`W73N>ekI;iW`&!=hgg|1*iuTgV2eAdu-^VtR%JZ-AMC;VH^LPYCsud_H z>BffbN3*<7Z)^)O!yvQ_x+eS)kKZ^M*|)%j(!;NKm6)8TsD`sTj@fRb1=eVPd#J4P zZ$a)(;{#UbA;a=8Bmp>!0#pix1SA!o6>qKmWg-;KpPHoTmF zV7Z$$DwgY@;gG%Plyl`xaAMG2DeS-1iTTdb5LfF>V@+`yShBhts{_&t!k*{tJxS^l z-97mnT%OlL-J7s(aN#SN#y>R_o-J}UD^wFpPhxdXy+89pV{y|*m?|%7Lsa52?W;obzD>BS;|z-RoXcnceWV((~NU+eY3%@2C|#kn!MP(ofv;grAq+3Q9AV*|K6wvq*tTYHEBuskdWD08?1vxo{c5;h4nK_b<6E9CRPmTK~ zm_sNLIAF%nhXg$`g;khrS&5f`Z(4`xHhJhc zsPL9Bc!Kqa(0u52;OT1nQviLS5a{wXbi#C++^#wFa|lLE4H`B4uNp=ZW$B-HRbu0G z)fTqj!B>ui)B_+Ilp&}HaE^mFDU1-j7oXnmPlG@t4v8z zQB2lY*VOSJ*ZEG%S#D3A39fXeKGorI9p(fQ8D0-)JPto%N_hiUg*(60KI7E+Qe9BM z#V7xBEyP)X3JN)}PT|E$gOs9GVi{DHC(P+pUeo$%oS@;_x#|qjK1uo%XFf5!u;pn5(etOXtXo0w76I@O0GBi7CR>Fw-OQ(@s&AB9 zS?iqXZ#m+5T-HW1L}Yib?=%u#}&~B4~{`#0Z!DupXct~<0#l>IL8wH zv&ZsQ+X870*utUFfw`W)t|Y4MzN?6=+uI!Zt!r}bv`_%>aS+s^Cw<=#d`^4nBJEEw z=6Xa&1!eW&FTD*F7nFzXW4BRq)P1zfr&83Fy`k#-5|o}>p70#yIR?I~0N+=aoMacJk)iXGJ5jfawM|2hiV#j}1$P zp{D9DG+sgk%r_h;oU)=E0t(aHt~3xS2y0K@Kj62a`{#d3;+!#~mJ%u|ml0b8Fc+XP zgQ^SnY5qvVDZs^n--(a&L6l*&NjyUsT{8H#dxxxQwzQDL%p`w@8{lDzbN97~Z_@j9 zF8Ror<*zusx>YwF7-_tp%5k{gCNm|J=OUw^oM#o2TE|5p{$gj-JN8rV{6N$6?9pt38BJH9*275QQ@}j$1?Xu?f`M7n*U3Dr^aRQAaFh~qWBPo z$Ya(MZ*=7jP7J*&9YzN%M~o~3#CMp}atxdlz-s*|D@vc*)gwXA+WNU!IS{77=j}_h zA%3&bI{JCW%4@wfs=o8Gm!(&5K+czJ^d<(>wiH@a*aJK7x>xor_?RAdmnUM^PKP8k z@i>x9T4QfM%%eto8ejV-yMx`o%yP0r42o=X)p9%9z#J`vv@QmoxOxJF$;-i#P}HSj zn1?J7mep47LW^Vl@ z$G6v$$5BXxnbYvLU{4VBe0Dvze;IbliE%z3jV)5TqSEW(kg#6@pKmbkneO?l3CU0( zfEdZa9tveJoKmWHh&nU9vR?R~73_OPV z*yT}U6BF-FV=!%CS$AB^6BZFXk zTq;bo`5Qmj0b!7Z@P{#ZRErJBfC5`B~N9R}J z*nKMjjrBXEP>G={qVb`18j6g~JAM#)OkjV%?34R;JmH%P;X1OCH!pr~4@P`AdgChc znETStZum!k3)#!}Y93yNEHIdsl5w@*7aD9YJzt#SUwa{NUX>WEp43N|8hV3_9>4g`WrO3(--nviPiV~B|* zfrmoul*DI<-vd~^Dk)*C_xN|oUEXes@j4;31%y3$n=c09dW@Niq8*{KQCz>t>RXT- zBhZLYMfYPnXcdw3io3M#CjEN=8crVfW^zvmQ&?*FhG6BPU16O{33mD=?N9=d?Md5% z$5jPFgYc>Y`ysU3*aM?5hwmcI9g~vh-Gbal3siHt$b;S)@)kV-S_B5x78Bwq#p^Kr z3;1{7Ue6+KKbpEGtGC0*3c%4!V%1_m-~f@_LkoU~q6#!uJm8kqu9|E!HR^!n*G~o3 z(}{i;&bj93_s){h+l>gg?^693*W)_pSvkoi#oG@M2FYQ(N+ULf8mTU<&2;d28M=w1 z^*hVs|J7Jf=7{}Zh94=83{g;jG!C5OG%UrrC`(0=3XZ1y6nLRvz*MeU#U3Ap>UX)Z zdp^A^=eAo4TvRnkZ!Uev;&2q7ClCb!%n1|v(9K|KBrU$+sqXTK1QmjfLXWAL@iKS= zt3Q}h#IKZ=^M`Q#3?Kj9@9XgKgON)2y-3|a5GSG!o)73pM(x5v<=sfo>B1~le}4w9 z5U5$+_1H#1KAUNld7>3pi6I#L6`ZZKzsf|Z?qR8`+@ZxO6M*h_|IlOWzcFUzqLz!O zvqXl>AO=21$axSLfO|ZK2n@LWcGaMASDgspXLpoZUFqx8G5Fs(gNEM3z$0H=1Nd8_tll30}SU>Weg`jX&u?dpHy4{`P7yW2I9Z_x% z?v|nl@F!h@@{;ziuz~nI1dxU9ynrMR_ z!^5B6|FL{WymDhe7I72J&EEai@`>#dJjT>%1>y!93FlVyrv1#*R&?n3!*G{gv%yB# z+njzl2@n_CVSD+=AR6qhAnq5(U?_h5w^R*m;Z)CZn0mzmU-(?1FW9?!NXcXwJ4d~& z%s&K>Q8T@gkE<*pYL&UnuKDN-UD+remA0TiuKs2ph_N2dUH@V!wpBwvwM4F5g%q`- z5lo0C=EmNv_xx-Pz(AN$Dk`ecdZ=ra^Xi@8az-ogc(tSc3mA0z2vKbhRUI zL3R`IbM@69xxfdd@>u&s1t~mZv%H^^&xVO<7UAno5Bq-xmW63Hpt-?urYYtXXu-0* ze8|fwWjy*H((^s}DA4_pkj!YybfqE`7v+MgI1EE!PlPIB1S$iK`t2E{jj%5jpyCs2 z`?d2qw<@B?@)Qk1*;5N~6M)U)F7m*I@o*s;~p81HOFcw2t5G{3IP}-27N;Ja_NyyYu%ZQU`^bc#)NN|BnA2gO^ z-b=~4Y%1L@!^JZU+qng-h8Ggd)cBA3&_i>|D6Bjrf{U%#h8kbc&)T z)RGvsFiVx;iC?i)xO2m3mE~@ovE)k$xUfGKe`W!`$Z+Hf=9PfXfK`x2^0M3NZ1(WQ_1D_{9uiJ znW51!HCU{>A;Ct+-JR;G?2l})C&3I^v+=StdOoK$LXgv~bep|wihjf@v0kIv_SiwF z_p9KJEjGAxLWC0)SrMr+^b8_3RXau_ZZEJ0;ds217TgCX2poU3_g~@{JXILoS)iiA z=-?Vhgac;LKiH_mp21}z#QrQL7O}%`)g4Dr38YcU?I+utpY}%tkkGRHQF;7EikpAO zPA};lgvQY*F@+uIX-Zc48i8LUAreFY9E7Vkl^)K*nWgBB9MpOCc||`l+a3Y#U{U2{X!T&DA6;X6cC>1qs?c+2wCxf< zo62^%QI@9B9r7D(Hl_`*dv%&hn~qsL#`)?d?a3b^flSF9VN6>=039F=R9lAvCQ2}(D7uZFk6dZ!<0wh4L$rNHx$EPnD<#!XqQDh|yzPOX z%L=QFOHZ!xdEC9)nFpooHDRZeD-h`P9NQ_?QcFz^N0@Ysa(BWPJmewzmhc=y=r#Is ziVVAWg@q99T6mj*f}{DTkzg3M3!;5m;kenJ?a#^C+o`)bb^9KYe!9~Ck8?z0pO5Wj zAyT3uujwpCZY@NP%Cug>$LE;C$=AYA(HUSXN+9^>4IFkvKvm185i+8)TI<~AqQN4lU$*+=Ab(u z+g~4?YZXYSmL`cDd4(9Z|DV5awFyFX+cPU?0r(p5Zg>Be*W)dt1V|%rW8@?vklcX! z3H}a0aHS$Kgpz>?n>Bh4G{LV!P=0*OQZ3=%@7}tm*k68FMjcXru$A>HFS)4;&vx}_ zzongti4Eli*3MV(S495gO9ZJwDWJS5xUqFwu`2G!22P2STFD!88_}7Pkd|lC78gOi zF#Dr!hd1I4-Z*m~F27KQ-vlP*EX16Q9L&Ei+*hKffmq$f1womhaW5?n2NC(Jvj53M zS(6SGViHLwVL#(cbI(UAr!SZ=h`6;w%l^ zTT(%+UfBTz4Es*w-(KaFXje!4c=5iLqPgP=V$@(Hfz z=g8pa&Z}V81$T>w%}WrY!NV7=79I$gu!k{z*o*+p(JG8%yJVV*7=trxN!35- zk3P=wkXf~70H{TK2dBS=sEB(wFjR)2SffNLUCKC9OaJSr5F?@Gi@L9NK3tmEcLz-4|Qv$;C4x4FrCGoHRGFDX5CC9$-3zXO{gdj1&;z?Zxpg+?s z&wR~Xi+yV`#EP!IX#0@=%lS(gJA?ek+C5E!v+Z4~62uUgM*P3M8dJIuLfUYf$MF$| zLn`bXl{BBqrelb~mQhrRv~5LieDA;mxja`sIR%(qa_L0t!J7g{vcpOLImn~({pY00 zJb+Kdm9Lb-aS`i=`M|{k&!nyFPvC{QeKzxZqr3Jdjhu2GdwuA=^5@pFQ2o%0h_yT5 zJgi9r^{87oNOcA(A4=Q;{j+_p985`zI8zd6cR*SkN5Pgs85kf}!+;8gt6OwZC=^^j zV!H+&4xq|5T&l8*OdZvXQt;^g>@P_El6?Dh;>_I|yR)uXL#vx_AHl5}rwv~MDeCku zEBbmP&8n=svdUa(D)8{VVkEfCt-}4^)+Fv7BvSf-ZNk>DAlY^R3EQ!qXCiib>w-zf?5&#X|=;J^_ z&>xJXQ1W?@>h0{EIiESP_fNkd%d!Df7EfZrt8@r^NYxOvfJn~w|Jum{xHNnlXytQB zj}aUOL^G>WY_6eR=4!wdEig_Uh=sryugLs00m7Y{bx;aM-`ev-{Sj4QYyvK^WmA z`5DQ#Kr#3qS@mNg;)O@SZ5jY{y7VCStM?S%S<2|&#(}cd8+M`DfAo&byM%yg(^A6X zK3nVLAarjg;C#ffE82piXs%7er9jjW0>N-dne{TI&lwP|)N@E+WzNM_1HXM86qC+0 zkag&~QiQ@)Bcfqt5OU$&G!_(!iNWHr2whsrtpg2q(S`3*R9UnRE zwij#(d%r5j^O*-I*MrcTibVVP;9mt-Mp)LLj@l3l&5j9&Pg1t z;NJ|!A;v009|S7{g#S}P^ynkYa~@J{HHOA#G^OCjH0ZhyK^VoECP4hAX>~HCmfn&$ zWqt2l#g0nj9bv-j)kJ4cSGXu&{>68=^5#H_iNkpJ0ri;By&aKF+EL#}$}dQvY?9k? zLECG`tnv1cU#Y&aY+%V8jUuEMmW_1^IhVtn4c8;GE`U#k_W|4k2kYFw$_PDDN2Q;a z0HR{%9+b$Ze%wMz%2(2Tglgb4kZUEPA45kPZ zEGg7SJv=%2EOy7v^SazUJnrMawv8{t8FZAkd&(443Q^H7xPqqX266#o`S0yjB~x77 zyAU`&P!a$zFsS{KHjaK#63@xaRV(`LdP^|%IH#0G$EE~fT77HwpbDP{cwj5@H4g51 zC9F3%W!uk-5j(Cru%uV&%m)}CVL~*#lQ{am?v&S`3#q?O>ysduK{*7;j5`hfUntyL z^sBz-ha2> z25$RNU9IUX@rMO(kF5clT|2H^HoR6;5#PIt~jgo6jSNk-tBZ7gza`C)jRnaf2mq}AfCF2i-Ih}%8O4phT} zlt*um?Fxe0WEw^Iq|EKC<5;!ze(F3Gd2{~L7TJke75?V-^{{UDr0g!QY-#;&L4$ab zu{}BVvAI~k6U_uaY=vz3uRSZLeL?&Vc+73Lkqux&4S?d-*Pa4Ktj7dg{0<17XRN}d zm^VP(R3YLB*tJPxwIM+ge%L|5lU+o-Rg!Sup0G+6ZMrnDJQt94F2W~5%cxe>gUVA| zkb-0;ovA`zE&W(+Pq{4E{giC#wUN73@W>ZW-nta_uNS~^OlWHX=+jlIs#hgr{qki~ z53A>ZQ3Zli)t#Ej|9Es;UCWUEBuaY-{QG&gdke*cb>M(iIB$cXTdCo1Wl@0F;e42(~?ubvtLT#fy4&zHc1Z@o|qOT1e z&?7FYx384**zOq>$jA0Ra7{Bv6!hz{662z?f178LAnh+?d@v^u0F=(X3 z`MGM02f8+Uy088=vD;>!5Du9i7@gn?PGD0m`fhyZVHn-3hi>9P5qGp|2%SB6S%K`N zPk?mSgWkSfBSv7#S`0+|K(ecLZ;?&(N6_v>u3I8*!TLX#pYZyZ)BW$$k~nzT2hZ8w zc~osp%pG~6bm_vcWcWOD^U56W=f%huH|QJ|;S|Aii??7U6zy%VP4pf;m)DFP*X#wq zH~9YLpO8aze%4iAp#;(KuhXoyrqJ*08V-@KeE?1yiowBCNn(iCR=e8=oQuc4Q@V)Y zl1*Va-C6NerQV?v-Xl&~6-TS6L&XEtGbpcQ^Tj$>;Dk(>*^_pEnS9Kyyp1=Pk!RXz zgrX}p7=^{VuZ{Ipi2GFWprh=cauZoYH_?oHBL`;zPfdxjhT~YNL%3V%^CCzDVT`~Q zHh@^HXujA?>5u^cxdee7F|D2gC73`iFXcJ^sqb!He_Ce1R#V4(Go~Kqj!$G==>PQL z4L1uxGxhK1-%o6tF#)$>Kchc#q04^gVb6O@Nu})R(#nbl)%;G2goi(_Rowe(9$XOn z8X)ycxEr%Z-u$PViu<@@jprbAQ=tnOpuhe>bN^KLWqvNQ$K~FQvK`8g-bkKk8)YpR zVc>6ZxjlV2@V%(}AULunUH6K)cuh;Om4zmEc$`f;~jhJ9&PGV(8s(ioo)v@ zo}*$kEcl?+-LsQ-JW{Fk#3upIx9$v7@u~1t+Qh!sWiFFK|TcLKyb~ZF|Fsx;l*=MXde;(XRV)8K3LX4%D zGOQ|j(2j6ADso!p)u?Y#;&IeBW@4C7N+%UrQF@=ZPERUHQyOj6DTMhqT>989|X~ z1D1Gc6lwR}rrDv&T>*^yA&_ zI|)(Zb7fP-=^7;DrB=mi+E41tpBbJ!1^X)5{6MkAsot87I3+hFWrt|3S1b?sIF3Ctmp%his?@~4^$jsIxKlbmt^SxJ) zB7dm7(~!@f$Z@1t)p6uGpYLPG!&dxFcHSJ%?d9R!wQjYHDcM0xc!R0#%y;MbNF~Nv z*|i-vn=);GQ5yI&3tm<|sUqiD;-NgT1Yb?olkwGHKi^}-7C(Q%(yg%2GI ze0*1uREvs>TcaxiFnpP=g)ubW|8Ij9Eh|x-fE}P}&Ojr+6+gzQ|b- zx}}win}P1nFfP|Tb@L53r%P7p6aTNS!vcbbZ+Mg*dF5>1W$*OfODk3@%19-?WxxBY zGA}15CpF+0;-RrAYvTV3eNFIu9_$==z>n|4V(;}Hf_>t z^!3YubJtN`T`Jsn?>^@{fl3lBTDs~WB`uT9bq$Xk@J1v{Jf3l zwH>RY?J$?4vJIYD$}Q7e%MUq?_A91_2XUG+d0p`}`So_UBK(Yw4kY+^1v0p1O*gvC zc;?zWW%!gPv z7SaHwD}=G<2qQw9{ zvwW!9#Yv2l-F#10Wu7~oi@1W2Rk4pZj4CWv{ zC?{ECyl4I9_k~O=_MZ2P+PUUVGE3B-=Yof$VuKy!M2yB1k7}xudswF8d;%86dQ+UO zj2mKiOe+n&$)kHH&RNF0W2}%#xB5e%+iz~pU~f;;?&V;Q5M*)SzV-`IRd%`?0c_-KJJn8h7K=_~M_Z zoql)IwP6>73FbZz!!5P$5IO82aWLX8KD6+4HW}u+7K)5kv~k5)9XbY8Z^7_W6iPNg zk}l=@_Yvv`$kGKLIZd^%JRKYn$nd!kY4xP8EOg!F=k#38(DIS>@6ne$DK)FLkEBR6 zWs6py-6f%#)-qQjtg)SS-JJ@l5=NVmv1xyleI44tVPtMDD<~)kd#Ofsy05pFKBPGn z8V6><*mOQLO8;eUUzR=ALxww89C=jfFdia@^=N1v_xe}Nc@&EAg5T$1PiO6i0du!X zzw|m%_hC~h>@oGc-AdM!(496}Q4-@c0yFO!op%z>yJJ+2=7I03!W0z_Ps2* z{JDsXUHgink2COK?-KL=4NgM8;k16HBXYPoyhZ3JHQ(lZJ1|?XLMBz%^?|V5LF61G z2|HB?3$*S_PZxvG09~b8pK(I;gDYw(*Dt=r(R>b1*cN4b7&vwzgVSl%U0Fmg;==n<$jmi=Bk09*6(z z(A+Gm-o}pgVWM^0_jZ%JjW!zxSa!cwYuM|ph`ApO^707i2xDwJDit49^IK|Va|dyi zlvU?$#$R;76e?J&z1piPNlA z9hW=eD4t+M2;#**1xgEhSF!QB(J&g00&5)4&N9wjn7C`P4n9ttJ7D6wi$5aRyw`O%r<{;ae7XGD&<6N z?jg%=8$9n^V!WjqpAPVFVt>-kiE37wEF9_V?Lx7xHFhIYzCD(lz0YIFCrdcS1H%^j<6k=T%q-?e&2_l&-@ z(ROk{R8Ul`p5x$jk%BY!%RV=fi0S@qrz+j_?zxr@3_M=QVdfF6e@p*OYf3pSk$j#z z(7J!$37~5e0$rV-iXKNL>BF|Rbyj_-9afgA__by1$EPN_J?`x#FF5PXGd5D>)RCZ* z(wS7wWVg*ILsRB4r>S%2&YwrxZL>woyeGtBQP&?2YYT+O=lFd&&hX)ii$+bAaE^lc z&imrRu{1c@e{ZOJQeo`JjkdaA*I{$+n-4LQY?jD&d`(53A~HUQ39x z&nAzO|b`)BDA1l>Qyvs|zZ7peU)l|#A_+ut^6wqk}B>}$X-i2{@E#=X~k`v^G?-pnJH z%(*Kh;PQuOHile66(Rv0P9co>i>E>^iD;fu;)_?;(TRs}3auy_@le)Rmom{7ZnQ(? zLDY{v0VeDI@M{(U%*hwn61&VQ;RO=+rI*<4HP0MwYVE!;$`p!R$lJ7%-Ql*Jo*FBe zu^UnSF_ann;&4iHTL^_p?@(XpnXf?ROzfv!dQviuJn2qqE%Zrdz4XNKewP=5BX_oh zdhc0rQ>LZ>h?G*kMH)^Al>;cTMI|LUV7Y~G6Ds+S_I(tiEekTE=1G&=0e|t!exdvd zrx29G(R>g8iH*bc<3WMC6;mRs=;5fQv9eiqk>UYtT)&Pt+c571PcPNkZAhmO2u}FR|pPWS2 z71##4XbpS&sik;@c)oN<`;uY1dwcJ16QWcK2X=zz&Tu^km=b)Ab#Y34YSOp7#=t!G za?mhl;hc)*(S~gUZ!?*|Zixyt4~C!m)^~9a{b5%;v>kE zTd$u(I;XaxS$w{H5v8xG2-!U5ZnTxE8#&rv{Oo_A2(y3NOxMIjQnC3U=T66);-mAq zp2zgb_r-@Fb`w4CQN5c+y~f%b+f>#aBR*7}tSR5T&r~J;yJdu;qXDgVtF-iKJ)oz< z_WeEnrk={RsF!^nSXZ>FD)!}YG+AaX9*ScfYGw65ze)1cY`vN)mUqAo)Otfo=>cX__v4NBD$=wz8hm&D6~D z&cm`0`Krsck;UUeMd#Mg9_!7{R{2 zXMdL_m-Fdh44~-b$zv#4zyJS9s9k)Bg!>_#>KAjk(%BNfwP>HM`!@4KXs~;WbT6Iy z!YLm>=UmihP|_cISAr@$H=C9=jp6{G@$sywKQN2a7~@QjI@HkYzNg_hqP~4<57O~& zYiDdFn)+&08d~r`yl&;Dlw)pU!gB3-*P`=w-hjY$vGh326f14TOm#JHNLpmI5(qt zzCJ;J&>H#K&pvOaKvu2fG5%&8-QKQZrBP#M@N@Je-JF?1O>(G`86`>eA!Xd_@5H*# zR*_R06-;(v+*T?mfPlK=cBB&7jPdYNpTFjBUD#O7$Z3oRBIrd-@XL`?^v+0)^i4i; zeFG2b5``(AJB&{taSA|!LH0YWqB7_ELc5oPkj@m$oipG1Nq4C747qw(CBs)?b*h4j zHu&5Mi_^i6_dFXjnK`%66tF(*2kSlZhYCegja6~KJ{qJ}Ol+z*J^XeG7A8tU3fal& znSi4QDPn0G5DtJct2*#3X_N;mR%^PPSQ>5X7K>!4U z`${_1$!B9As?J9pWJHbFKl~-g*EJC9oNuZw&TJotGi8&1e=Yg30OF{ z2ds$4sCFvGUB#gMx42W!jxWfaIZ-6v>}D~pe^BErH>K_VYdNdPcMRLx&l=*(XauEk zSNTjIKHtL|_P+Y-ZBFo#m!gm$}x~nW~^VH}X{r53N^HS!WaaU^rWon@#u8s;dXR5PG8M zG89y@S*4R>dIfhAp1=bk^iIoMY1RbRZMW=+pzX-+qqjCifL`6=q9197w?9Yjy&zL{2guJb1T_$Mn}=K$Dg z?F&PRWMsrbmnKKzQe8Gyn8BwBA#G^9Y+$Wip93koJ5h@G=0)CO&UiefF9D}6o6oY!__ zTz1QTLX@l)L$)lSbi=w8uE-QGy*vB6VwAk5xu_ZGin|FN&h2)@WRj8GK@4Rldf@(KMYb#DOAJd&-09uX|zVAao4N?7q zeTLC{&$WmyMJ535-JLT28FzF!R%0xs`Dis`fz-%tI@lSnY8m3?{K2mcGPl4$-LC!w zwojkyA%z3u zwJ=bR|36)u39 zS0!JK9z#mZ$V|?J&%jK}Lu{9x=RwF@i*qewpU04SIdoEh9|k`anaIHVGOlVFh)Juu zB)A=hRqwV_E3}!pJ78(xcZcJV4_mRD7r6cYMzOo==-)4eupd@B3!+5t&IJ(iBFgt z?o(fePmK!S5Bo$Z@=qYb(Lde$QxXBqD$78N?l*Ie2a-;YFGx5J!MOumnVB<1e0R$? zu^~NkV{*23%@)4#^G996dW@RTz(qmGQ%b}LpCaS63e4qRGiQ2L_11CM4tOagPbl%=yjAtuCl9A-Dnw3rcSndV8QtNsHzvFtP=J(B$f2om>^B}=JC%Ah z7|QYGh4}X>`xZH-o9V*L=C2y;U@rg{t2gq}Us?HU|6}IJFmMkuG>n}=MZ6Saz3}mc z$`3dZnJh#O60(pQRoVC;A0aVKD#(%ZzMs}-WKYiDraXZ{Nh#A^Qo2K4RJr_xtzv|S z46Wvw<@_6i-I#1cUv0nWV)~0uf=*udhhq)4HLz;D=$`~$9i>J*2=V#a+V9$*&#dn- zvi&(&_$RN>S|R(Gm@FcM${$AfWFSGFgN?|cneL0N&MDHO5j1c-2+?}K%ZbcKwRNbF zKGUH3yxq|BXN{(%Rj5W%!5`*+^exaa@b|&PpLTrcgZM9>`PG%DJ=ALbQriNK zvD(-;eOxgLItR{RoMf9nK0;`cq1Mt^&d$U$70AFfl;TwdRXBnxYv;l?4c^AQnBuzH z|0j^QENn8zwQFh?SUUSqRcG4B$Hd*@blULCzUtWlA9?<3XWdoLacLGd1afyQ>ppYV zada%1#B3wKv+uX@)7QCuOdWmi%>VGT(sn33R0J+Arqd;1C>SC*w1PxfimAhL`%L)o zft3JC%B3o*AGZ0zVQ}jpVFDxPTR~fwrm=OPiqF+}yl5I*k$y9|Zf7~2d)2i@BE^U~ zyR_E5KrY07kQE&uo{H~#kDlN@aQpZtk0XO&fHS^+QIYOa==cf`Wp0X7@#|++#&;=C zlo`_RTzt(CuVlPM}I zv$^YwRIQyio1TCAn$)VE${l2DG+mVk-(_KI#(>;qv;C?w@>myh0=4Uj3k<>LUc zMD@YMj_03FkT6q)=&8Xdxl@tynf9v_50(bLh=i%aycxKj4%gIy-uODZE~iWFCra!m z`kZg;Q^~WbOtq3l9so}s`+osB>T-5d6Z7m7d{mM^;nLMDX+Bd3;d>_YZRESr?zs49 z;&vjXprE@e7WmQ439_*+;35JdvhP?xI6R0CfQLq6T}dK^x{a~7E}uc%mYx}$*Bpx3 zY(o=u3l{U;-o6YI_k)G39(4R0N41s`XTNlAsEvU+1T@`v7B49cuJA35R%jd?9KeSQ z_td~*r75In|MdbOdP>%xdJb4@pfy2D3~Q=LC@e0{1`-lll@ni;r3Exo=r)Xu^Yd_F z3n9USFM&WtMkx!|*C)cxBgO5h#O1z0vZFpbLj55ic!8q3E8@i&F3Zr{)%Db*9Y9|% zwTFo;ZEB<~zD^jTLVOA7h_?0KRL81pF4i1L0)4sBs?f2}Q>Jx?lP`luf_>DwpxQz$ zm(JwHXocpTm24-5)oifeBL)+G$8>+@6s_ndPf)^N7`T$+1o^#~2b zepGJL6Fz*K1%+3m)g#fzP#gs~0id=Bz~>)PsW14(( zmW*wDt~jjp7bAI=jSw}G$M4n#M>pYcIXbFnqb9ODdVop|$2&z8Vzkyw*8;r3!ltex zYetj$LWGeSj^z)VMwBlvv#h(6z>HIzG2VZTPY;;thyT)>XE=SC*nF}sBx5e8$Z+~vqBB_;s{#@~T$t^kveprrthGKb0C5Pq zT*bp8`F$-21Elw#)FMpeU?h7Qrs-&235D%s0^3P2EG%qI`1KiDaXtP#vZG%ja8U64 z8lS@Eh3^W=fCdQ>+@&;u!AW)c);4VBw@A5SNbd{fnKzn?VafD5xteqQ-+kQ3g=E~} zz7YmE=qaCci}UiH5j?ya3D2bmVZZ>oW9oP{0e^Rut1_qe_4U!DA6K+wNO-`mU8)Fh zAXIX?eDpO#6OCjSbj`iP!Lcf%b54I0uuUKQh0s`o@6S|}&7DL=+(Hl}JsKo9jV>hw z01Z+LB-dG;w$VEiaRn-GAjH9r3F3fkv3XGA)9@oLh$Ap_O8)6_Lpox7WWl2PK2Y$Y z0Wd^?R-%=rn!a)veEY!ijf{M=Tt?~@$K`gVrM>wD5-mF#sXtQPB^k3nN+IXf^SZ~c ztdKf@u9<_62gxM(8ZV91{K`r+P)RZ}0dyvV`G(;JL<|W!8ft3G*q?I~njXKG#zY^Zz^+iD1+yCV|pEl5k9T%Pr>cL0&$j(35ls@^Y<8C8(aW^$W-dCOuO~NxGGThq{845 z`3+F|;`tq!-^;enu3weMuVqf`Fmkp{0ea76J3$7p9+k(QeCFI4`X@kbX3$>gF3wg@ z9Ig7gRt__a=)+rR=$P4|-#igft>I-)Qdk1}#ev&ML}T$maLG7+A-dE^O84H4y| zL36O2ZgXO0{eWrwn)$hw|FVEwr$%b&Rw)qmwf~CxtQ40Sg&|sp-~3cwULGMG#G0E5d$eUaG;y7_hezAq^5jNBVj%bW-)ATY%r1s z$$OASr@^C}n41T_FeF7Pw*Q<_fPWeed(^1=g9yK*c$aP5*qPg7%J+|j<$D91PiJVf z7k)EiYial?dflwZX)TXBkUwE@M9lOX9g@hjyCAn6=QCv_w14cl+2(YgpcE-!ggvG|j_6!f_NYZgS%fWy$I5iNOD6Y|W zOksY*ct1^`1E>3mzd_YDRN;tD=bjZG>+;dNr}rXmS?_>0%Qi>Y%wpKL3E|jbBl$TGJROn5U5mGcuh85_0m;|E#d9{Ph(4s=k<> zw72$15%#C}3}qu6vntVn_y}Yas7(%Nl$#3<05?Z|hnI^{fMRow_pN0jGfi4G+59m0SYs4g(KVHzjmlX%9 zAAaDt!|1!vw3Z`5myM5MEp!)J&O!Yeo*A&-Tk4by03q~vWYYM~L}TU9)P?w#`IcFB zM90{K<|IRFneSVk`hb{cblt=fQGaU=retsn#_Ac{nb`P?1v8^#`KiCm zU7nD+8{^7t3lLzK%MEwfNrU9}HD&E?LT^_!hVZg^E>T9}NiIBQWdPyehKE$m$Inl1 zlAqcv>YYJ{ggU?=z%=0d4!9Q817C>)7C63AIm~$H42n@EP!cvw5tM~eQmh%a6HRQ@ zTq!FOJoA&jt#Jl{Yn(48ttTI3rnR)|L-ggi+UgAqIfYeVqW|*ToRR=le`l&hkzpGt zbaQCw+b1AnOZ!^;8FCDK6!=7sHL<-`hmVpopJV+T0RDO&eO`Z!cM3T_{R!WHFN}XN zdA8AIk4B>6~lAyq~D|w=2U$2<#STn4vzwl=t&3_U`@@ zCu4hC4{?kRoTai5%tf`Dp+f$xSD!RV(8nM4OR9YCC=m-f3KUP)gbZu8UC3f)e znwm_GtH7Dd!TNPvy-(k2^i0Xok*5(4?@`tIN}>K-JWjbt>x1)im+~Zxvcq9zGXOU_ zVO?RLmM-cy1^qt{l_ld9LcpX<7q@pFgn_)fI~Q_9W*ZjT{SSkRfX#n0gy_KG-B+u293tiSr(b&PZas`|`K~rO?fa4wuei#wfyM`^MutNY zDxTaH80dn7ED?CMI4!j=O%?(wZ5cxVD?{~BrZN+R2ucAb#V`f} zdDzM6=;F1(*>{! zu-L4*FZe9Gyub6>3>b|s+3D{!Qjo#~*;2+HiXb5E!IXS&yT{D`j_n{+UB-=YGG@7OZ#a${Ghd zrCp5#vk=;TuRiexB=)ZEL0odJ#bRTv@1Qw!c1xOfFc()WRbE7Gn$t z2S*ZEB62*;p+pFSk>7T`Avn(nX2G)X_r?&=1OmnOdg{Z#YI(mSBvyOltAd&YSc(QXS1jmN9q z5wqTi8=uo^5-d0InUlsWx-TJ{17Mo5N5mY^B=@aysHfp`xMoS*`N z3plLd!Z(A+$f1H`BE|<41)v;bhM%O51cX14Qy8Qth?`K+&OIeK<&(h$teeGQh(&No z%|?5uXV^v(V!|t1AI~h~8BJMiJ9-ABlx!RrVF1^F-2mVZ@DK2JsX`KVd*SW63k(X> zT3^!by-ywX5A(U^2{h9qbhCoFUf6p1s&HjictgR|#{bvXmB&+=zWt{pg=(72sL)~v zB}>VciT1GzSt3p`gpMU7g-)58Uz_UKvzEaiON0tJlFCww5JHBMWQlZ$c)#~U{bt^G zK5w7;qw}2Sx$pa0zSnhM*Y`fp#PA=s{)UtLg7tHARhIF19INF8Awsff$i{c#sNaO< z`R<^}wcP&EP`vjQnanT}NMV`Xqkx~()YKXa#;a54gC+vcSkVpq&TX2Hss(=;{=_)fNSx);< z9!UxcB-4F1-SuL1n{7}wi~WI%bQ#1gRSBm|k|cLtKBhESk%L_U=Ozj;DDRmwSD@Vt z&8RO9!JEz!k$M3SbbD<4MmKzEEg5X`+TN;>hjF4Q`LiCr)+!C z;!L7SnNh$_S#V@czO{9~(Wo%P|7;U4zIh^~-2O%Unng&^PylN@SYLAoJ+Y4i8L8rl zR|3#(@{P0CymB<{k(18O@nfU;>65?Z`|Wv|Nh%C4nf~ij^Yg>|_xfIumgvD-o_q7# zGO*!HEhspa9sGD3cP15awr=AB6KkVo+3Z5Plq*ZNfestv{@7f*(%lZ-U3jvD6*GW& zWdU7Aap~a)w81)USP9>8r)HJoa zMAgJpEcd7Y`LtFT{b8D8h@2P6IW}G(;NgwDKyUKS=HS{)#ATt6{=C#GCDH(SdJuVS z2Z(q#uj2<*_q_hl2`1i5bXJF)3Xh6PR!z~B=o&X$=v>+J+FCo`mWd~2zuxFB^wc%6 zX_yC+G-}L0s_8q8h6fJ~-Tl;H79^xt{!w*c%ot>guzJDy^A9z(B1~q$WcPZ`x<`VE z;B53Pjj~Wb-(7qd+|x&f=Hl-SNFhQ?k(AjZhUMB`c#NkCJ_pkuO#t%Rak^u@;Ya)ATbg^phVivMrevwsv2c~f(3XjYy!5OeW#nM@VV@W1 zOA#myYXIy@28$NXVi_~iyq$66gOrGk!6$Yj*14V#TeQkZpGupDbZ9>`vU_NG!x+Ia z``VTQb!qo@oedjEgZ626j#}neAJ^s?DBX@Lc6F->#f3L`gZ{PMz&HZ6Zuq_!9a4~f z=^bA|X>B&^*O0ZkFx=l2;bEz5Lpov+GQX8tf-+K%kvp)g zXv+Ss>+n_$qX&vp*Zi!{WD_$9X*eaq8N3a?f#mwUW(HD7=&dRu5`PZtfe zD5~t-^SvKECwC{ujd{{NED0oe-iHtG+2iTjSs1{*ahWZu z@)Sj(0%iMLM(aqNiY7}*m-osv&r_k6gl^O8*gvh*KBnKLwI0EV-pJfh$VGR8$~st>b@#vLm6p_Q##HGiZ!hrM`nF+Yp14j# z(N)XX^p#V(!Hy86aVr~cW6Qbcd8v7G&KRXkwbH9{ZmtT|!Kn#hsqZLGHfbHAhDmrD zTGQCV(xz>`^|i=WB7k()MmOj32Zqyh2&5x4xLAbm1>|r4&=O1AZz zuPQCkrKEX-5`9vqo02#tK!XQIi4=h^h0H0iV;|Ln{&bZCbp8n**~-jvwA*=Nl-1t9 zWGA?T5>Sb5&1-LjoN@_1`5Ey-&sE*(27A#NTA|5Uv+A{j73kS%&B*_M zwC4cupv+16k!9;X`rsL%Li|5{-{!NI=HxssEl9nIjwsy@gN!2uX&L_ueTQYd6}?5O z0h|jv_KVwcJm>cGnSZ&{GBxFYG8pvdZ_Iyt>u#?|>g(ph`-AFn)yekkz;F;lRH}q*y3oeB_8T@ygs3p(dZ;I(4rFP=z2ugntYTu%iW~cz>SVr) zPg@Vn|EJ&4no}XYTS^Trw3`Pm;6>oFMJ7o1r|3~gQBas(o7sbH&=lw!xh`wnornZX zHoY9BPqM>TCA<#K|0SPLA?jqpkG6`x57K?7Oepfsw{52?mB<&!398U(zatf8(ZjBd zYZ^g08)Vw-_l>FUGEt9-ogjhYZ_1m%b`aHWYLHWlUiTnedMo?-axgMP;+VJp7hi;I z+OOCsoqI+Dl}h;qLeKlhs7S^wPQk~jiYIbLuEe)Y|pN#7bjvua5f8c1Y` zjJhQq^jLywVT2ia13);=KPFOwo z5Non}i^LO8${>IoyH9L4h#KU0N597Pr8^V4rEvzL{Hy9t5Y;jG<=QTN zRtg9_`+ffBzEUATzRniZ%T|1sRoHiTL9uPKiu)Q(D^-$aIR)1$wvo2wRBr^DU9})ulTL!4fA__A-pBcVpIz}7 z>-v0ex#F>5KwTtXowt>)#+M*ozvQFTNy zA^si;_b67SWn?@VZ0e9NN_}eL`PRYcFVZ*OU%8RAuH+B+D=iIe>yK+SqF5(o8%Lbh zHjc;;^uI0vf_T!F1*jSkY8+L29eJj%@gDZD*vu-`voQNa{IC-^^aD=1ZC_f~9370% z#~~{a<*z)jkKpfT4t;c~v~8%r;HoAzByjY?RDasZU^XSa4N+txvUJJ1B$33;9po^yzPvDSm>p9-m7tR=bSk`XsOX;rgLgCG)hGyYCE{o9T__ zPIr+btCS>oC_P@gg%t)q*eOSnp723BE^a5MvgA_+Kswr$kSS*Vxp@YCSW}u}@e7|T zyJ`1ueyyUBxNGs3!;-;X-m|G%X*ubQs1o4pG-6=mpG{sAcDrc^ikF2z{vN%dqU1u3 zz7r23!bY_Qv>QBQCW_qPU$MT|^4Q#{t<4`nPhvX`T~lWvM0aE3b5MVEna_@orEY#9 zkO-9k%G3`RAMQ3chvEd!>_|YkM%>og4vJmfEho(~-q(_AQZ_6+oU9L;0VD5PAT(0e zRW~wEu7Z{R;3}bf5VB$d_CglxBJDkIpTt}OCTDOItkO-=e3m8MiXR`rq^S5?#8KlP z0aI*L%njM3o!_DS8@d9<8a^{8y5lHve@}0`{PH zU%iCyz!5}q@qPGnM|HmIqkp3Xt&TvlX}f&+%GD*P@2v_}#Pe5&q4bLLVe}y?>8w>> zw+=>gNd=Z8NVlVkk~}$Awy));!HuTav@CucokOuL@nF~)-JC`ahr)>xh6U_sk5B(( zJQnwd1TUf0#T!2@ff+5SMB2}2LNsue~kbHooqAqni;zw-Hw_+6Pts0BJK6nQch33=2+Od9jL!^tXT44%|=3F zH~rH~eJu*aq&FX`6B!gJ0}v%`v4HHXy-nZ+ddqz#$V9Xy+o-$k05g= zIob~Kkjy@W`OsyU9XW+W{Z|qELvPkpzuRf(Z!Ihzy&lV^v^#k5A~vvct#@iHQxTg% zxt{{TJ01UiRiDi-jN(ZEQR$!CNJ_>aB%w=xKoRi@!fi{QRT>_4>I`)x3&x+$tKg<; zi1FpJKKQ(rMWNY>jpWMS7Rr>(86pOh2t{!a(RjjS~uCN8++0*QaQZ8!?<~W$L!DEI?to8 z=x<)l!z-*a%j$sZv&7yT>kbClraskNVbI@L;dgPZse0be&+jHCua>?4-N?yVR!t`L zt3Ie)Vrtnf(WzS6yKhx-)AJkYk)u_3bLRQL-qIm<;OT}!&93b6FX_>f4;JVoyZg1d zMmcAC&7x%2@$gU)GmGw6>1RiE`n3xMbr@o=qu89`(+@+}V)0QFT)T`F4f6cVCa?1lRV+{CxrMZ|djnQU?tm zH29R7w1RXA&9yBh2MUWP(+auuF1IJ!V`^k@lR$?{+o)x%wSRft$N7Q(@9J=KI8YB)>-Hyn$xFlJaI5Jn6=V=9Xf;(n+2_!4*Uq1fY$G1Pd;ZXmRjfp0htwU3JZP#FDg>LND2;1=H zq$W9-o?jRuie8FMOS;skfA{| zDCY#of8e5^AjLR4{H{-jZLZ^^u>_Uq>fgcp{^Z(Qlh0>F!o*8CCH=7ZfUkxo;jKXVAU5hchMPkhtrpYzeu<+O?pEC;S*{^Ofw*+#|(S-yYBpp+$UT2&2J6(nP|VS#W&dt=Fiy{ zqv0=Sm{AxaWo}zhZsMrhrJ(k8-5L>Cch!Hsu6tG5q~`HQW5<6UiCKUCPN+? zVN$VQc7?_IuIwuQ5LhD<;=QKadD=F9w_^ZZlFWT{wGRhh7c#h-HO8GkR1$YQc)`SY z^LTIO@zpU9)_~UXpHF0=POs+s?qIiQMURxF3-Opa)W87I*zDnVt{Va`myF(%(K~bO z_x?8+`@%d3IVBr6jaHQDS{{AFYq(;7E0?dIyBBV7M2UDz0z4+H^J3!0h)vx2ZI2B)_-PMN(<}Zapk+ir9z}PW4F-d2#HvnXiJsg~QEGnN(OBy)y2WaHvd|NMo9ag}^eFT_kF~Wz(`&vQa>)p%6Uxp1w2cB%) z!3WED_{63#WWDg+(Dk}dJud(pR! zjqTW^;itmwD-15kZ>yU0Kk{$@>v;1#QlR>^twCI6q(EB*{Oi!CzY?R>@e*+LG1G3P zHqCElYA3Y3%o%mEd86%-q=-<(yiPy3p)X#t*DT*bkjabaf8wCS0FMUl(USQhAu=tu9S=EJOw|A%cUUms z5=2Bv?@M5&7ST^6J}K%P_0D1TPp~ii5YMq(W~vLB$g_zi8Pwunn--?TsCPH~ zj$-Vyc8jVAUq&$uZZojz>&(<%iH(UH$-Sqt;_L}}C~T6$Q)j-dYq4R6)_`V8abCXr zW~ozG_ghrH;`1kWdAv|S7B@=NA`s6^4FtyFV=CbjB+@|OuYe-oHZWkuAl z8(Bd{d*yLmM400IrAVIl9Dp?~j-A6m?*e)#q8Hu`<6$MQr$*9i1X!kFxkjg9m$F$f zhT!)hedK8l_X60DAzm#tsi2@B9XQ1)IHpSZ&?&Sh(W$I6%x+Sydt9>;-+-tn?d;f2 zGbj<_bxy}TDEOpSQ(T)vS_5ujnfvuwBgL^4E2*r$Ca>e2~r51+Sw)h`KEsn~~ zOPNpXp!P8b2Mo8AE?BI*ZbX?_tAZ_oF>`WP0J&@Hl7OdKyY7%ni&J8zy)&l-w;ega zG})^=I4u^5PY|XwgjqEoko4;EO?_|4^5LmD-uM`NJv0b9JO`}~s4BDHhvR<~wM>`B z5IT}K?q>kbv)lQ;>sjKrg7|1v*yHJ7okP6sh%D2jrRr74wafIyps$gsY84sp#=PR* zEK7QtN2E8xnd$MuF`m0@soT%ia@uQ zF!QT*5$tK!4lt%4Ir1WaO^fVzipr_x<)Ik%r;~s5nUb>hc>#*G5T;D+sCa}&QAsDE zXN5yVdXJW1dyb=$4|pk##bW5kZl68*%J#*uNIN?Q&e2?;*P|Cg?lB|xSkU)yw$Wc9 zmU%vg{>u4K@|A_;E87Hj&NkO2I_5;*Ue+;_Vr(%G6%z|}rKlefXqDOHcj#4Borr0V zUrsT^tueb*sRUQTgFgx+lN)7^)!jnuRT755i6in{u~#WajKd`b7r6y|;}o^%R}3yx zn^y2zqJfP73c0f^pBiS@!#a_CFcf{kSe8y=rbcPkv#sT=h-sO)X_lvAoD?1gIO{+gY9zwMsQKiej=`<9hrUg!3U+(Y*k5$om5sit+!u@6Uh8?V79BIB^RZ1 z1$}Zc1(_S2WfEK9wKmLd*PaEE1(C2xW$;{lC>s&LUK6_wj}3(pDAZwvAtk|ctHWK% zG8CJtUpb$Uf*+@lMOOU=I9_%8dpfm^(9F!!_fCX2a)g0hlmn(2w*JVvk`2TO-keB- zF7@aOK`sPVt7e$P03z+kb0nsou**%N(JL3y-A=Tn2edrOPM0v88k_H})NR148AQl> zIGk96`8<54T$d}6rfsv9MyAR8brO}tWUhObko2h3aZw(UKw3)QSFc2fc)-Eu8Yx#2J-a1=xH!Si41Q$9>C|E zh~eOaxn#X_D2^&Z7bQ^o6rZye_Bak~YcnIslpRGqAV6WEdYUX)G&mVkKSc(Sz25$m zvA$fVT?n5$lm^Uh;Lp>AlY}tH#X_Wul8wI%2GcXpONo(aMn+1oQM#N1*!vS1!xF)H z%E8g{OCeh=r+oH7M+Mnimde;7s}p7V1+@>&?a{W8jfQb??DtkPOx@GTOm7ke9AUNZ z4jdNDSgNr%4-;c4HdaeD@XzPZ2e_{VDzJX16Z}{si;FiPWzO}n1E%he7XeonJjD2~ z6c>wN+Eo$>sFK(r>`|&ohCe4{#deNnZ@>jV9nErAwu|=R3#dZ}kvkaoVMej`%n_Hw z1Au$ZU%o$;?%Iqj=#&*K<17q~vlvlHChq(^vyOXYNa+@x?C_F!MkX`0? z9`U!5R}3|hT~P~q5)@04`FQ!ZpM(FNCr=TA;~bhD7?|7MU%BM`f+xZ{SikhuxDwW@ zHv)+Nb#L$%Xc7tshTNo$*2N`ShPyhe` literal 0 HcmV?d00001 From 8506e8b1de09f658c3f806c30a59afbf0a74b965 Mon Sep 17 00:00:00 2001 From: Jesse Butler Date: Tue, 7 Dec 2021 16:26:34 -0500 Subject: [PATCH 137/148] Generate single-page API reference for 1.23 --- .../generated/kubernetes-api/v1.23/index.html | 43998 ++++++++++++++++ .../kubernetes-api/v1.23/js/navData.js | 1 + 2 files changed, 43999 insertions(+) create mode 100644 static/docs/reference/generated/kubernetes-api/v1.23/index.html create mode 100644 static/docs/reference/generated/kubernetes-api/v1.23/js/navData.js diff --git a/static/docs/reference/generated/kubernetes-api/v1.23/index.html b/static/docs/reference/generated/kubernetes-api/v1.23/index.html new file mode 100644 index 0000000000..1d1d5e8afc --- /dev/null +++ b/static/docs/reference/generated/kubernetes-api/v1.23/index.html @@ -0,0 +1,43998 @@ + + + + +Kubernetes API Reference Docs + + + + + + +